ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.45 by pcg, Thu Dec 6 00:35:29 2007 UTC vs.
Revision 1.62 by root, Sat Dec 17 22:05:34 2011 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
110 120
111 return filename; 121 return filename;
112} 122}
113 123
114int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
115vpn::setup () 148vpn::setup ()
116{ 149{
150 int success = 0;
151
152#if 1//D2
117 ipv4_tos = -1; 153 ipv42_tos = -1;
118 ipv4_fd = -1; 154 ipv42_fd = -1;
119 155
120 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 156 if (THISNODE->protocols & PROT_IPv42 && ::conf.ip_proto)
121 { 157 {
122 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 158 ipv42_fd = setup_socket (PROT_IPv42, PF_INET, SOCK_RAW, ::conf.ip2_proto);
123 159
124 if (ipv4_fd < 0) 160 if (ipv42_fd < 0)
125 return -1; 161 return -1;
126
127 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
128 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
129 162
130#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 163#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
131 // this I really consider a linux bug. I am neither connected 164 // this I really consider a linux bug. I am neither connected
132 // nor do I fragment myself. Linux still sets DF and doesn't 165 // nor do I fragment myself. Linux still sets DF and doesn't
133 // fragment for me sometimes. 166 // fragment for me sometimes.
134 { 167 {
135 int oval = IP_PMTUDISC_DONT; 168 int oval = IP_PMTUDISC_DONT;
136 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 169 setsockopt (ipv42_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
137 } 170 }
138#endif 171#endif
139 172
140 sockinfo si (THISNODE, PROT_IPv4); 173 sockinfo si (THISNODE, PROT_IPv42);
141 174
142 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 175 if (bind (ipv42_fd, si.sav4 (), si.salenv4 ()))
143 { 176 {
144 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 177 slog (L_ERR, _("can't bind ipv42 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
145 exit (EXIT_FAILURE); 178 return -1;
146 } 179 }
147 180
148 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 181 ipv42_ev_watcher.start (ipv42_fd, EV_READ);
182 ++success;
149 } 183 }
184 else
185 THISNODE->protocols &= ~PROT_IPv42;
186#endif
150 187
151 udpv4_tos = -1; 188 ipv4_tos = -1;
152 udpv4_fd = -1; 189 ipv4_fd = -1;
153 190
154 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 191 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
155 { 192 {
156 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 193 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
157 194
158 if (udpv4_fd < 0) 195 if (ipv4_fd < 0)
159 return -1; 196 return -1;
160
161 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
162 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
163
164 // standard daemon practise...
165 {
166 int oval = 1;
167 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
168 }
169 197
170#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 198#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
171 // this I really consider a linux bug. I am neither connected 199 // this I really consider a linux bug. I am neither connected
172 // nor do I fragment myself. Linux still sets DF and doesn't 200 // nor do I fragment myself. Linux still sets DF and doesn't
173 // fragment for me sometimes. 201 // fragment for me sometimes.
174 { 202 {
175 int oval = IP_PMTUDISC_DONT; 203 int oval = IP_PMTUDISC_DONT;
204 setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
205 }
206#endif
207
208 sockinfo si (THISNODE, PROT_IPv4);
209
210 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
211 {
212 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
213 return -1;
214 }
215
216 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
217 ++success;
218 }
219 else
220 THISNODE->protocols &= ~PROT_IPv4;
221
222 udpv4_tos = -1;
223 udpv4_fd = -1;
224
225 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
226 {
227 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
228
229 if (udpv4_fd < 0)
230 return -1;
231
232 // standard daemon practise...
233 {
234 int oval = 1;
235 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
236 }
237
238#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
239 // this I really consider a linux bug. I am neither connected
240 // nor do I fragment myself. Linux still sets DF and doesn't
241 // fragment for me sometimes.
242 {
243 int oval = IP_PMTUDISC_DONT;
176 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 244 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
177 } 245 }
178#endif 246#endif
179 247
180 sockinfo si (THISNODE, PROT_UDPv4); 248 sockinfo si (THISNODE, PROT_UDPv4);
181 249
182 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 250 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 251 {
184 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 252 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 253 return -1;
186 } 254 }
187 255
188 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 256 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
257 ++success;
189 } 258 }
259 else
260 THISNODE->protocols &= ~PROT_UDPv4;
190 261
191 icmpv4_tos = -1; 262 icmpv4_tos = -1;
192 icmpv4_fd = -1; 263 icmpv4_fd = -1;
193 264
194#if ENABLE_ICMP 265#if ENABLE_ICMP
195 if (THISNODE->protocols & PROT_ICMPv4) 266 if (THISNODE->protocols & PROT_ICMPv4)
196 { 267 {
197 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 268 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
198 269
199 if (icmpv4_fd < 0) 270 if (icmpv4_fd < 0)
200 return -1; 271 return -1;
201
202 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
203 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
204 272
205#ifdef ICMP_FILTER 273#ifdef ICMP_FILTER
206 { 274 {
207 icmp_filter oval; 275 icmp_filter oval;
208 oval.data = 0xffffffff; 276 oval.data = 0xffffffff;
… …
225 293
226 sockinfo si (THISNODE, PROT_ICMPv4); 294 sockinfo si (THISNODE, PROT_ICMPv4);
227 295
228 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 296 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
229 { 297 {
230 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 298 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
231 exit (EXIT_FAILURE); 299 return -1;
232 } 300 }
233 301
234 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 302 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
303 ++success;
235 } 304 }
236#endif 305#endif
237 306
238 tcpv4_fd = -1; 307 tcpv4_fd = -1;
239 308
240#if ENABLE_TCP 309#if ENABLE_TCP
241 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 310 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
242 { 311 {
243 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 312 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
244 313
245 if (tcpv4_fd < 0) 314 if (tcpv4_fd < 0)
246 return -1; 315 return -1;
247 316
248 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
249 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
250
251 // standard daemon practise... 317 // standard daemon practise...
252 { 318 {
253 int oval = 1; 319 int oval = 1;
254 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 320 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
255 } 321 }
256 322
257 sockinfo si (THISNODE, PROT_TCPv4); 323 sockinfo si (THISNODE, PROT_TCPv4);
258 324
259 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 325 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
260 { 326 {
261 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 327 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
262 exit (EXIT_FAILURE); 328 return -1;
263 } 329 }
264 330
265 if (listen (tcpv4_fd, 5)) 331 if (listen (tcpv4_fd, 5))
266 { 332 {
267 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 333 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
268 exit (EXIT_FAILURE); 334 return -1;
269 } 335 }
270 336
271 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 337 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
338 ++success;
272 } 339 }
340 else
341 THISNODE->protocols &= ~PROT_TCPv4;
273#endif 342#endif
274 343
275 dnsv4_tos = -1; 344 dnsv4_tos = -1;
276 dnsv4_fd = -1; 345 dnsv4_fd = -1;
277 346
278#if ENABLE_DNS 347#if ENABLE_DNS
279 if (THISNODE->protocols & PROT_DNSv4) 348 if (THISNODE->protocols & PROT_DNSv4)
280 { 349 {
281 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 350 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
282 351
283 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 352 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
284 353
285 if (dnsv4_fd < 0) 354 if (dnsv4_fd < 0)
286 return -1; 355 return -1;
287
288 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
289 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
290 356
291# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 357# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
292 // this I really consider a linux bug. I am neither connected 358 // this I really consider a linux bug. I am neither connected
293 // nor do I fragment myself. Linux still sets DF and doesn't 359 // nor do I fragment myself. Linux still sets DF and doesn't
294 // fragment for me sometimes. 360 // fragment for me sometimes.
… …
308 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 374 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
309 PROT_DNSv4); 375 PROT_DNSv4);
310 376
311 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 377 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
312 { 378 {
313 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 379 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
314 exit (EXIT_FAILURE); 380 return -1;
315 } 381 }
316 382
317 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 383 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
384 ++success;
318 } 385 }
319#endif 386#endif
320 387
321 ///////////////////////////////////////////////////////////////////////////// 388 /////////////////////////////////////////////////////////////////////////////
389
390 if (!success)
391 {
392 slog (L_ERR, _("no protocols enabled."));
393 return -1;
394 }
322 395
323 reconnect_all (); 396 reconnect_all ();
324 397
325 ///////////////////////////////////////////////////////////////////////////// 398 /////////////////////////////////////////////////////////////////////////////
326 399
327 tap = new tap_device (); 400 tap = new tap_device ();
328 if (!tap) //D this, of course, never catches 401 if (!tap) //D this, of course, never catches
329 { 402 {
330 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 403 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
331 exit (EXIT_FAILURE); 404 return -1;
332 } 405 }
333 406
334 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 407 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
335 408
336 run_script_cb cb; 409 run_script_cb cb;
337 cb.set<vpn, &vpn::script_if_init> (this); 410 cb.set<vpn, &vpn::script_if_init> (this);
338 411
339 if (tap->if_up () && 412 if (tap->if_up () &&
340 !run_script (cb, true)) 413 !run_script (cb, true))
341 { 414 {
342 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 415 slog (L_ERR, _("interface initialization command '%s' failed."),
343 tap->if_up ()); 416 tap->if_up ());
344 exit (EXIT_FAILURE); 417 return -1;
345 } 418 }
346 419
347 cb.set<vpn, &vpn::script_if_up> (this); 420 cb.set<vpn, &vpn::script_if_up> (this);
348 if (!run_script (cb, true)) 421 if (!run_script (cb, true))
349 { 422 {
350 slog (L_ERR, _("if-up command execution failed, exiting.")); 423 slog (L_ERR, _("if-up command execution failed."));
351 exit (EXIT_FAILURE); 424 return -1;
352 } 425 }
353 426
354 tap_ev_watcher.start (tap->fd, EV_READ); 427 tap_ev_watcher.start (tap->fd, EV_READ);
355 428
356 return 0; 429 return 0;
… …
362 set_tos (ipv4_fd, ipv4_tos, tos); 435 set_tos (ipv4_fd, ipv4_tos, tos);
363 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 436 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
364 437
365 return true; 438 return true;
366} 439}
440
441#if 1 //D
442bool
443vpn::send_ipv42_packet (vpn_packet *pkt, const sockinfo &si, int tos)
444{
445 set_tos (ipv42_fd, ipv42_tos, tos);
446 sendto (ipv42_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
447
448 return true;
449}
450#endif
367 451
368static u16 452static u16
369ipv4_checksum (u16 *data, unsigned int len) 453ipv4_checksum (u16 *data, unsigned int len)
370{ 454{
371 // use 32 bit accumulator and fold back carry bits at the end 455 // use 32 bit accumulator and fold back carry bits at the end
… …
429 { 513 {
430 // broadcast, this is ugly, but due to the security policy 514 // broadcast, this is ugly, but due to the security policy
431 // we have to connect to all hosts... 515 // we have to connect to all hosts...
432 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 516 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
433 if ((*c)->conf != THISNODE) 517 if ((*c)->conf != THISNODE)
434 (*c)->inject_data_packet (pkt, true); 518 (*c)->inject_data_packet (pkt);
435 } 519 }
436} 520}
437 521
438void 522void
439vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 523vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
440{ 524{
441 unsigned int src = pkt->src (); 525 unsigned int src = pkt->src ();
442 unsigned int dst = pkt->dst (); 526 unsigned int dst = pkt->dst ();
443 527
444 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 528 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 529 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
446 530
447 if (src == 0 || src > conns.size () 531 if (src == 0 || src > conns.size ()
448 || dst > conns.size () 532 || dst > conns.size ()
449 || pkt->typ () >= vpn_packet::PT_MAX) 533 || pkt->typ () >= vpn_packet::PT_MAX)
450 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 534 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
451 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 535 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
452 else if (dst > conns.size ())
453 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
454 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
455 else 536 else
456 { 537 {
457 connection *c = conns[src - 1]; 538 connection *c = conns[src - 1];
458 539
459 if (dst == 0) 540 if (dst == 0)
460 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 541 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
461 c->conf->nodename, (const char *)rsi); 542 c->conf->nodename, (const char *)rsi);
462 else if (dst != THISNODE->id) 543 else if (dst != THISNODE->id)
463 { 544 {
464 if (THISNODE->routerprio) 545 if (THISNODE->routerprio)
465 // the tos setting gets lost here. who cares. 546 // the tos setting gets lost here. who cares.
466 conns[dst - 1]->inject_vpn_packet (pkt); 547 conns[dst - 1]->inject_vpn_packet (pkt);
467 else 548 else
468 slog (L_WARN, 549 slog (L_WARN,
469 _("%s(%s): forwarding request (=> %s), but we are no router"), 550 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
470 c->conf->nodename, (const char *)rsi, 551 c->conf->nodename, (const char *)rsi,
471 conns[dst - 1]->conf->nodename); 552 conns[dst - 1]->conf->nodename);
472 } 553 }
473 else 554 else
474 c->recv_vpn_packet (pkt, rsi); 555 c->recv_vpn_packet (pkt, rsi);
… …
478bool 559bool
479vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 560vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
480{ 561{
481 switch (si.prot) 562 switch (si.prot)
482 { 563 {
564#if 1//D2
565 case PROT_IPv42:
566 return send_ipv42_packet (pkt, si, tos);
567#endif
568
483 case PROT_IPv4: 569 case PROT_IPv4:
484 return send_ipv4_packet (pkt, si, tos); 570 return send_ipv4_packet (pkt, si, tos);
485 571
486 case PROT_UDPv4: 572 case PROT_UDPv4:
487 return send_udpv4_packet (pkt, si, tos); 573 return send_udpv4_packet (pkt, si, tos);
488 574
489#if ENABLE_TCP 575#if ENABLE_TCP
490 case PROT_TCPv4: 576 case PROT_TCPv4:
491 return send_tcpv4_packet (pkt, si, tos); 577 return send_tcpv4_packet (pkt, si, tos);
492#endif 578#endif
493#if ENABLE_ICMP 579#if ENABLE_ICMP
494 case PROT_ICMPv4: 580 case PROT_ICMPv4:
… …
497#if ENABLE_DNS 583#if ENABLE_DNS
498 case PROT_DNSv4: 584 case PROT_DNSv4:
499 return send_dnsv4_packet (pkt, si, tos); 585 return send_dnsv4_packet (pkt, si, tos);
500#endif 586#endif
501 default: 587 default:
502 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 588 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
503 } 589 }
504 590
505 return false; 591 return false;
506} 592}
507 593
594#if 1//D2
508inline void 595inline void
509vpn::ipv4_ev (ev::io &w, int revents) 596vpn::ipv42_ev (ev::io &w, int revents)
510{ 597{
511 if (revents & EV_READ) 598 if (revents & EV_READ)
512 { 599 {
513 vpn_packet *pkt = new vpn_packet; 600 vpn_packet *pkt = new vpn_packet;
514 struct sockaddr_in sa; 601 struct sockaddr_in sa;
515 socklen_t sa_len = sizeof (sa); 602 socklen_t sa_len = sizeof (sa);
516 int len; 603 int len;
517 604
518 len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 605 len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
519 606
607 sockinfo si(sa, PROT_IPv42);
608
609 if (len > 0)
610 {
611 pkt->len = len;
612
613 // raw sockets deliver the ipv4 header, but don't expect it on sends
614 pkt->skip_hdr (pkt->ipv4_hdr_len ());
615
616 recv_vpn_packet (pkt, si);
617 }
618 else
619 {
620 // probably ECONNRESET or somesuch
621 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
622 }
623
624 delete pkt;
625 }
626 else
627 {
628 slog (L_ERR,
629 _("FATAL: unknown revents %08x in socket, exiting.\n"),
630 revents);
631 exit (EXIT_FAILURE);
632 }
633}
634#endif
635
636inline void
637vpn::ipv4_ev (ev::io &w, int revents)
638{
639 if (revents & EV_READ)
640 {
641 vpn_packet *pkt = new vpn_packet;
642 struct sockaddr_in sa;
643 socklen_t sa_len = sizeof (sa);
644 int len;
645
646 len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
647
520 sockinfo si(sa, PROT_IPv4); 648 sockinfo si(sa, PROT_IPv4);
521 649
522 if (len > 0) 650 if (len > 0)
523 { 651 {
524 pkt->len = len; 652 pkt->len = len;
525 653
526 // raw sockets deliver the ipv4 header, but don't expect it on sends 654 // raw sockets deliver the ipv4 header, but don't expect it on sends
527 pkt->skip_hdr (IP_OVERHEAD); 655 pkt->skip_hdr (pkt->ipv4_hdr_len ());
528 656
529 recv_vpn_packet (pkt, si); 657 recv_vpn_packet (pkt, si);
530 } 658 }
531 else 659 else
532 { 660 {
533 // probably ECONNRESET or somesuch 661 // probably ECONNRESET or somesuch
534 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 662 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
535 } 663 }
536 664
537 delete pkt; 665 delete pkt;
538 } 666 }
539 else 667 else
540 { 668 {
541 slog (L_ERR, 669 slog (L_ERR,
542 _("FATAL: unknown revents %08x in socket, terminating\n"), 670 _("FATAL: unknown revents %08x in socket, exiting.\n"),
543 revents); 671 revents);
544 exit (EXIT_FAILURE); 672 exit (EXIT_FAILURE);
545 } 673 }
546} 674}
547 675
… …
569 if (hdr->type == ::conf.icmp_type 697 if (hdr->type == ::conf.icmp_type
570 && hdr->code == 255) 698 && hdr->code == 255)
571 { 699 {
572 // raw sockets deliver the ipv4, but don't expect it on sends 700 // raw sockets deliver the ipv4, but don't expect it on sends
573 // this is slow, but... 701 // this is slow, but...
574 pkt->skip_hdr (ICMP_OVERHEAD); 702 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
575 703
576 recv_vpn_packet (pkt, si); 704 recv_vpn_packet (pkt, si);
577 } 705 }
578 } 706 }
579 else 707 else
580 { 708 {
581 // probably ECONNRESET or somesuch 709 // probably ECONNRESET or somesuch
582 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 710 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
583 } 711 }
584 712
585 delete pkt; 713 delete pkt;
586 } 714 }
587 else 715 else
588 { 716 {
589 slog (L_ERR, 717 slog (L_ERR,
590 _("FATAL: unknown revents %08x in socket, terminating\n"), 718 _("FATAL: unknown revents %08x in socket, exiting.\n"),
591 revents); 719 revents);
592 exit (EXIT_FAILURE); 720 exit (EXIT_FAILURE);
593 } 721 }
594} 722}
595#endif 723#endif
… …
615 recv_vpn_packet (pkt, si); 743 recv_vpn_packet (pkt, si);
616 } 744 }
617 else 745 else
618 { 746 {
619 // probably ECONNRESET or somesuch 747 // probably ECONNRESET or somesuch
620 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 748 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
621 } 749 }
622 750
623 delete pkt; 751 delete pkt;
624 } 752 }
625 else 753 else
626 { 754 {
627 slog (L_ERR, 755 slog (L_ERR,
628 _("FATAL: unknown revents %08x in socket, terminating\n"), 756 _("FATAL: unknown revents %08x in socket, exiting.\n"),
629 revents); 757 revents);
630 exit (EXIT_FAILURE); 758 exit (EXIT_FAILURE);
631 } 759 }
632} 760}
633 761
… …
682 { 810 {
683 slog (L_INFO, _("preparing shutdown...")); 811 slog (L_INFO, _("preparing shutdown..."));
684 812
685 shutdown_all (); 813 shutdown_all ();
686 remove_pid (conf.pidfilename); 814 remove_pid (conf.pidfilename);
687 slog (L_INFO, _("terminating")); 815 slog (L_INFO, _("exiting."));
688 exit (EXIT_SUCCESS); 816 exit (EXIT_SUCCESS);
689 } 817 }
690 818
691 if (events & EVENT_RECONNECT) 819 if (events & EVENT_RECONNECT)
692 { 820 {
693 slog (L_INFO, _("forced reconnect")); 821 slog (L_INFO, _("forced reconnect."));
694 822
695 reconnect_all (); 823 reconnect_all ();
696 } 824 }
697 825
698 events = 0; 826 events = 0;
… …
714 842
715 conns.clear (); 843 conns.clear ();
716 844
717 connection_init (); 845 connection_init ();
718 846
719 for (configuration::node_vector::iterator i = conf.nodes.begin (); 847 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
720 i != conf.nodes.end (); ++i) 848 conns.push_back (new connection (this, *i));
721 { 849
722 connection *conn = new connection (this, *i); 850 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
723 conns.push_back (conn);
724 conn->establish_connection (); 851 (*c)->establish_connection ();
725 }
726} 852}
727 853
728connection *vpn::find_router () 854bool
855vpn::can_direct (conf_node *src, conf_node *dst) const
729{ 856{
730 u32 prio = 1; 857 return src != dst
858 && src->may_direct (dst)
859 && dst->may_direct (src)
860 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
861 || (src->protocols & dst->connectable_protocols ()));
862}
863
864// only works for indirect and routed connections: find a router
865// from THISNODE to dst
866connection *
867vpn::find_router_for (const connection *dst)
868{
731 connection *router = 0; 869 connection *router = 0;
732 870
871 // first try to find a router with a direct connection, route there
872 // regardless of any other considerations.
873 {
874 u32 prio = 1;
875
876 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
877 {
878 connection *c = *i;
879
880 if (c->conf->routerprio > prio
881 && c->conf != THISNODE
882 && can_direct (c->conf, dst->conf)
883 && c->ictx && c->octx)
884 {
885 prio = c->conf->routerprio;
886 router = c;
887 }
888 }
889 }
890
891 if (router)
892 return router;
893
894 // second try find the router with the highest priority, higher than ours
895 {
896 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
897
898 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
899 {
900 connection *c = *i;
901
902 if (c->conf->routerprio > prio
903 && c != dst
904 && c->conf != THISNODE
905 && c->ictx && c->octx)
906 {
907 prio = c->conf->routerprio;
908 router = c;
909 }
910 }
911 }
912
913 return router;
914}
915
916void
917vpn::connection_established (connection *c)
918{
733 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 919 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
734 { 920 {
735 connection *c = *i; 921 connection *o = *i;
736 922
737 if (c->conf->routerprio > prio 923 if (!o->is_direct
738 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 924 && o->si.valid ()
739 && c->ictx && c->octx 925 && c->si != o->si
740 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 926 && c == find_router_for (o))
741 {
742 prio = c->conf->routerprio;
743 router = c;
744 } 927 {
928 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
929 o->conf->nodename, c->conf->nodename);
930 o->rekey ();
931 }
745 } 932 }
746
747 return router;
748} 933}
749 934
935void
750void vpn::send_connect_request (int id) 936vpn::send_connect_request (connection *c)
751{ 937{
752 connection *c = find_router (); 938 connection *r = find_router_for (c);
753 939
754 if (c) 940 if (r)
941 {
942 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
943 c->conf->nodename, r->conf->nodename);
755 c->send_connect_request (id); 944 r->send_connect_request (c->conf->id);
945 }
756 else 946 else
757 // no router found, aggressively connect to all routers 947 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
758 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 948 c->conf->nodename);
759 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
760 (*i)->establish_connection ();
761} 949}
762 950
763void 951void
764connection::dump_status () 952connection::dump_status ()
765{ 953{
766 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 954 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
767 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 955 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
768 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 956 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
769 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 957 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
770 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 958 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
771 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
772 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
773} 959}
774 960
775void 961void
776vpn::dump_status () 962vpn::dump_status ()
777{ 963{
… …
786vpn::vpn (void) 972vpn::vpn (void)
787{ 973{
788 event .set<vpn, &vpn::event_cb > (this); 974 event .set<vpn, &vpn::event_cb > (this);
789 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this); 975 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
790 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this); 976 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
977#if 1//D2
978 ipv42_ev_watcher .set<vpn, &vpn::ipv42_ev > (this);
979#endif
791#if ENABLE_TCP 980#if ENABLE_TCP
792 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this); 981 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
793#endif 982#endif
794#if ENABLE_ICMP 983#if ENABLE_ICMP
795 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this); 984 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines