ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.35 by pcg, Fri Apr 8 16:12:49 2005 UTC vs.
Revision 1.63 by root, Tue Jan 17 21:38:11 2012 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
96 120
97 return filename; 121 return filename;
98} 122}
99 123
100int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
101vpn::setup () 148vpn::setup ()
102{ 149{
150 int success = 0;
151
152 ipv4_tos = -1;
103 ipv4_fd = -1; 153 ipv4_fd = -1;
104 154
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 156 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108 158
109 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
110 return -1; 160 return -1;
111
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113 161
114#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
115 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
116 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
117 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
123 171
124 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
125 173
126 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
127 { 175 {
128 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
129 exit (EXIT_FAILURE); 177 return -1;
130 } 178 }
131 179
132 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
133 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
134 185
186 udpv4_tos = -1;
135 udpv4_fd = -1; 187 udpv4_fd = -1;
136 188
137 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
138 { 190 {
139 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
140 192
141 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
142 return -1; 194 return -1;
143
144 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
145 195
146 // standard daemon practise... 196 // standard daemon practise...
147 { 197 {
148 int oval = 1; 198 int oval = 1;
149 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
161 211
162 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
163 213
164 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
165 { 215 {
166 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
167 exit (EXIT_FAILURE); 217 return -1;
168 } 218 }
169 219
170 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
171 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
172 225
226 icmpv4_tos = -1;
173 icmpv4_fd = -1; 227 icmpv4_fd = -1;
174 228
175#if ENABLE_ICMP 229#if ENABLE_ICMP
176 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
177 { 231 {
178 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
179 233
180 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
181 return -1; 235 return -1;
182
183 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
184 236
185#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
186 { 238 {
187 icmp_filter oval; 239 icmp_filter oval;
188 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
197 // this I really consider a linux bug. I am neither connected 249 // this I really consider a linux bug. I am neither connected
198 // nor do I fragment myself. Linux still sets DF and doesn't 250 // nor do I fragment myself. Linux still sets DF and doesn't
199 // fragment for me sometimes. 251 // fragment for me sometimes.
200 { 252 {
201 int oval = IP_PMTUDISC_DONT; 253 int oval = IP_PMTUDISC_DONT;
202 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 254 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
203 } 255 }
204#endif 256#endif
205 257
206 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
207 259
208 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
209 { 261 {
210 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
211 exit (EXIT_FAILURE); 263 return -1;
212 } 264 }
213 265
214 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
215 } 268 }
216#endif 269#endif
217 270
218 tcpv4_fd = -1; 271 tcpv4_fd = -1;
219 272
220#if ENABLE_TCP 273#if ENABLE_TCP
221 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
222 { 275 {
223 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
224 277
225 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
226 return -1; 279 return -1;
227 280
228 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
229
230 // standard daemon practise... 281 // standard daemon practise...
231 { 282 {
232 int oval = 1; 283 int oval = 1;
233 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
234 } 285 }
235 286
236 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
237 288
238 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
239 { 290 {
240 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
241 exit (EXIT_FAILURE); 292 return -1;
242 } 293 }
243 294
244 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
245 { 296 {
246 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
247 exit (EXIT_FAILURE); 298 return -1;
248 } 299 }
249 300
250 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
251 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
252#endif 306#endif
307
308 dnsv4_tos = -1;
309 dnsv4_fd = -1;
253 310
254#if ENABLE_DNS 311#if ENABLE_DNS
255 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
256 { 313 {
257 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
258 315
259 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
260 317
261 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
262 return -1; 319 return -1;
263 320
264# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
… …
281 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
282 PROT_DNSv4); 339 PROT_DNSv4);
283 340
284 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
285 { 342 {
286 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287 exit (EXIT_FAILURE); 344 return -1;
288 } 345 }
289 346
290 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
291 } 349 }
292#endif 350#endif
293 351
294 ///////////////////////////////////////////////////////////////////////////// 352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
355 {
356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
295 359
296 reconnect_all (); 360 reconnect_all ();
297 361
298 ///////////////////////////////////////////////////////////////////////////// 362 /////////////////////////////////////////////////////////////////////////////
299 363
300 tap = new tap_device (); 364 tap = new tap_device ();
301 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
302 { 366 {
303 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
304 exit (EXIT_FAILURE); 368 return -1;
305 } 369 }
306 370
371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
307 if (tap->if_up () && 376 if (tap->if_up () &&
308 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 377 !run_script (cb, true))
309 { 378 {
310 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 379 slog (L_ERR, _("interface initialization command '%s' failed."),
311 tap->if_up ()); 380 tap->if_up ());
312 exit (EXIT_FAILURE); 381 return -1;
313 }
314
315 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
316 { 382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
317 slog (L_ERR, _("if-up command execution failed, exiting.")); 387 slog (L_ERR, _("if-up command execution failed."));
318 exit (EXIT_FAILURE); 388 return -1;
319 } 389 }
320 390
321 tap_ev_watcher.start (tap->fd, EVENT_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
322 392
323 return 0; 393 return 0;
324} 394}
325 395
326bool 396bool
327vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 397vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
328{ 398{
329#if defined(SOL_IP) && defined(IP_TOS) 399 set_tos (ipv4_fd, ipv4_tos, tos);
330 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
331#endif
332 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 400 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
333 401
334 return true; 402 return true;
335} 403}
336 404
… …
359 427
360#if ENABLE_ICMP 428#if ENABLE_ICMP
361bool 429bool
362vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 430vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
363{ 431{
364#if defined(SOL_IP) && defined(IP_TOS)
365 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
366#endif
367
368 pkt->unshift_hdr (4); 432 pkt->unshift_hdr (4);
369 433
370 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 434 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
371 hdr->type = ::conf.icmp_type; 435 hdr->type = ::conf.icmp_type;
372 hdr->code = 255; 436 hdr->code = 255;
373 hdr->checksum = 0; 437 hdr->checksum = 0;
374 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 438 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
375 439
440 set_tos (icmpv4_fd, icmpv4_tos, tos);
376 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 441 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
377 442
378 return true; 443 return true;
379} 444}
380#endif 445#endif
381 446
382bool 447bool
383vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 448vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
384{ 449{
385#if defined(SOL_IP) && defined(IP_TOS) 450 set_tos (udpv4_fd, udpv4_tos, tos);
386 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
387#endif
388 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 451 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
389 452
390 return true; 453 return true;
391} 454}
392 455
… …
403 { 466 {
404 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
405 // we have to connect to all hosts... 468 // we have to connect to all hosts...
406 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
407 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
408 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
409 } 472 }
410} 473}
411 474
412void 475void
413vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
414{ 477{
415 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
416 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
417 480
418 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
419 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
420 483
421 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
422 || dst > conns.size () 485 || dst > conns.size ()
423 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
424 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
425 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
426 else if (dst > conns.size ())
427 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
429 else 489 else
430 { 490 {
431 connection *c = conns[src - 1]; 491 connection *c = conns[src - 1];
432 492
433 if (dst == 0) 493 if (dst == 0)
434 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 494 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
435 c->conf->nodename, (const char *)rsi); 495 c->conf->nodename, (const char *)rsi);
436 else if (dst != THISNODE->id) 496 else if (dst != THISNODE->id)
437 { 497 {
438 if (THISNODE->routerprio) 498 if (THISNODE->routerprio)
439 // the tos setting gets lost here. who cares. 499 // the tos setting gets lost here. who cares.
440 conns[dst - 1]->inject_vpn_packet (pkt); 500 conns[dst - 1]->inject_vpn_packet (pkt);
441 else 501 else
442 slog (L_WARN, 502 slog (L_WARN,
443 _("%s(%s): forwarding request (=> %s), but we are no router"), 503 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
444 c->conf->nodename, (const char *)rsi, 504 c->conf->nodename, (const char *)rsi,
445 conns[dst - 1]->conf->nodename); 505 conns[dst - 1]->conf->nodename);
446 } 506 }
447 else 507 else
448 c->recv_vpn_packet (pkt, rsi); 508 c->recv_vpn_packet (pkt, rsi);
… …
453vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 513vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
454{ 514{
455 switch (si.prot) 515 switch (si.prot)
456 { 516 {
457 case PROT_IPv4: 517 case PROT_IPv4:
458 return send_ipv4_packet (pkt, si, tos); 518 return send_ipv4_packet (pkt, si, tos);
519
459 case PROT_UDPv4: 520 case PROT_UDPv4:
460 return send_udpv4_packet (pkt, si, tos); 521 return send_udpv4_packet (pkt, si, tos);
522
461#if ENABLE_TCP 523#if ENABLE_TCP
462 case PROT_TCPv4: 524 case PROT_TCPv4:
463 return send_tcpv4_packet (pkt, si, tos); 525 return send_tcpv4_packet (pkt, si, tos);
464#endif 526#endif
465#if ENABLE_ICMP 527#if ENABLE_ICMP
466 case PROT_ICMPv4: 528 case PROT_ICMPv4:
467 return send_icmpv4_packet (pkt, si, tos); 529 return send_icmpv4_packet (pkt, si, tos);
468#endif 530#endif
469#if ENABLE_DNS 531#if ENABLE_DNS
470 case PROT_DNSv4: 532 case PROT_DNSv4:
471 return send_dnsv4_packet (pkt, si, tos); 533 return send_dnsv4_packet (pkt, si, tos);
472#endif 534#endif
473
474 default: 535 default:
475 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 536 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
476 } 537 }
477 538
478 return false; 539 return false;
479} 540}
480 541
481void 542inline void
482vpn::ipv4_ev (io_watcher &w, short revents) 543vpn::ipv4_ev (ev::io &w, int revents)
483{ 544{
484 if (revents & EVENT_READ) 545 if (revents & EV_READ)
485 { 546 {
486 vpn_packet *pkt = new vpn_packet; 547 vpn_packet *pkt = new vpn_packet;
487 struct sockaddr_in sa; 548 struct sockaddr_in sa;
488 socklen_t sa_len = sizeof (sa); 549 socklen_t sa_len = sizeof (sa);
489 int len; 550 int len;
… …
495 if (len > 0) 556 if (len > 0)
496 { 557 {
497 pkt->len = len; 558 pkt->len = len;
498 559
499 // raw sockets deliver the ipv4 header, but don't expect it on sends 560 // raw sockets deliver the ipv4 header, but don't expect it on sends
500 pkt->skip_hdr (IP_OVERHEAD); 561 pkt->skip_hdr (pkt->ipv4_hdr_len ());
501 562
502 recv_vpn_packet (pkt, si); 563 recv_vpn_packet (pkt, si);
503 } 564 }
504 else 565 else
505 { 566 {
506 // probably ECONNRESET or somesuch 567 // probably ECONNRESET or somesuch
507 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 568 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
508 } 569 }
509 570
510 delete pkt; 571 delete pkt;
511 } 572 }
512 else 573 else
513 { 574 {
514 slog (L_ERR, 575 slog (L_ERR,
515 _("FATAL: unknown revents %08x in socket, terminating\n"), 576 _("FATAL: unknown revents %08x in socket, exiting.\n"),
516 revents); 577 revents);
517 exit (EXIT_FAILURE); 578 exit (EXIT_FAILURE);
518 } 579 }
519} 580}
520 581
521#if ENABLE_ICMP 582#if ENABLE_ICMP
522void 583inline void
523vpn::icmpv4_ev (io_watcher &w, short revents) 584vpn::icmpv4_ev (ev::io &w, int revents)
524{ 585{
525 if (revents & EVENT_READ) 586 if (revents & EV_READ)
526 { 587 {
527 vpn_packet *pkt = new vpn_packet; 588 vpn_packet *pkt = new vpn_packet;
528 struct sockaddr_in sa; 589 struct sockaddr_in sa;
529 socklen_t sa_len = sizeof (sa); 590 socklen_t sa_len = sizeof (sa);
530 int len; 591 int len;
… …
542 if (hdr->type == ::conf.icmp_type 603 if (hdr->type == ::conf.icmp_type
543 && hdr->code == 255) 604 && hdr->code == 255)
544 { 605 {
545 // raw sockets deliver the ipv4, but don't expect it on sends 606 // raw sockets deliver the ipv4, but don't expect it on sends
546 // this is slow, but... 607 // this is slow, but...
547 pkt->skip_hdr (ICMP_OVERHEAD); 608 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
548 609
549 recv_vpn_packet (pkt, si); 610 recv_vpn_packet (pkt, si);
550 } 611 }
551 } 612 }
552 else 613 else
553 { 614 {
554 // probably ECONNRESET or somesuch 615 // probably ECONNRESET or somesuch
555 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 616 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
556 } 617 }
557 618
558 delete pkt; 619 delete pkt;
559 } 620 }
560 else 621 else
561 { 622 {
562 slog (L_ERR, 623 slog (L_ERR,
563 _("FATAL: unknown revents %08x in socket, terminating\n"), 624 _("FATAL: unknown revents %08x in socket, exiting.\n"),
564 revents); 625 revents);
565 exit (EXIT_FAILURE); 626 exit (EXIT_FAILURE);
566 } 627 }
567} 628}
568#endif 629#endif
569 630
570void 631inline void
571vpn::udpv4_ev (io_watcher &w, short revents) 632vpn::udpv4_ev (ev::io &w, int revents)
572{ 633{
573 if (revents & EVENT_READ) 634 if (revents & EV_READ)
574 { 635 {
575 vpn_packet *pkt = new vpn_packet; 636 vpn_packet *pkt = new vpn_packet;
576 struct sockaddr_in sa; 637 struct sockaddr_in sa;
577 socklen_t sa_len = sizeof (sa); 638 socklen_t sa_len = sizeof (sa);
578 int len; 639 int len;
… …
588 recv_vpn_packet (pkt, si); 649 recv_vpn_packet (pkt, si);
589 } 650 }
590 else 651 else
591 { 652 {
592 // probably ECONNRESET or somesuch 653 // probably ECONNRESET or somesuch
593 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 654 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
594 } 655 }
595 656
596 delete pkt; 657 delete pkt;
597 } 658 }
598 else 659 else
599 { 660 {
600 slog (L_ERR, 661 slog (L_ERR,
601 _("FATAL: unknown revents %08x in socket, terminating\n"), 662 _("FATAL: unknown revents %08x in socket, exiting.\n"),
602 revents); 663 revents);
603 exit (EXIT_FAILURE); 664 exit (EXIT_FAILURE);
604 } 665 }
605} 666}
606 667
607void 668inline void
608vpn::tap_ev (io_watcher &w, short revents) 669vpn::tap_ev (ev::io &w, int revents)
609{ 670{
610 if (revents & EVENT_READ) 671 if (revents & EV_READ)
611 { 672 {
612 /* process data */ 673 /* process data */
613 tap_packet *pkt; 674 tap_packet *pkt;
614 675
615 pkt = tap->recv (); 676 pkt = tap->recv ();
… …
644 } 705 }
645 else 706 else
646 abort (); 707 abort ();
647} 708}
648 709
649void 710inline void
650vpn::event_cb (time_watcher &w) 711vpn::event_cb (ev::timer &w, int)
651{ 712{
652 if (events) 713 if (events)
653 { 714 {
654 if (events & EVENT_SHUTDOWN) 715 if (events & EVENT_SHUTDOWN)
655 { 716 {
656 slog (L_INFO, _("preparing shutdown...")); 717 slog (L_INFO, _("preparing shutdown..."));
657 718
658 shutdown_all (); 719 shutdown_all ();
659 remove_pid (conf.pidfilename); 720 remove_pid (conf.pidfilename);
660 slog (L_INFO, _("terminating")); 721 slog (L_INFO, _("exiting."));
661 exit (EXIT_SUCCESS); 722 exit (EXIT_SUCCESS);
662 } 723 }
663 724
664 if (events & EVENT_RECONNECT) 725 if (events & EVENT_RECONNECT)
665 { 726 {
666 slog (L_INFO, _("forced reconnect")); 727 slog (L_INFO, _("forced reconnect."));
667 728
668 reconnect_all (); 729 reconnect_all ();
669 } 730 }
670 731
671 events = 0; 732 events = 0;
… …
687 748
688 conns.clear (); 749 conns.clear ();
689 750
690 connection_init (); 751 connection_init ();
691 752
692 for (configuration::node_vector::iterator i = conf.nodes.begin (); 753 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
693 i != conf.nodes.end (); ++i) 754 conns.push_back (new connection (this, *i));
694 { 755
695 connection *conn = new connection (this, *i); 756 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
696 conns.push_back (conn);
697 conn->establish_connection (); 757 (*c)->establish_connection ();
698 }
699} 758}
700 759
701connection *vpn::find_router () 760bool
761vpn::can_direct (conf_node *src, conf_node *dst) const
702{ 762{
703 u32 prio = 1; 763 return src != dst
764 && src->may_direct (dst)
765 && dst->may_direct (src)
766 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
767 || (src->protocols & dst->connectable_protocols ()));
768}
769
770// only works for indirect and routed connections: find a router
771// from THISNODE to dst
772connection *
773vpn::find_router_for (const connection *dst)
774{
704 connection *router = 0; 775 connection *router = 0;
705 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void
823vpn::connection_established (connection *c)
824{
706 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 825 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
707 { 826 {
708 connection *c = *i; 827 connection *o = *i;
709 828
710 if (c->conf->routerprio > prio 829 if (!o->is_direct
711 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 830 && o->si.valid ()
712 && c->ictx && c->octx 831 && c->si != o->si
713 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 832 && c == find_router_for (o))
714 {
715 prio = c->conf->routerprio;
716 router = c;
717 } 833 {
834 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
835 o->conf->nodename, c->conf->nodename);
836 o->rekey ();
837 }
718 } 838 }
719
720 return router;
721} 839}
722 840
841void
723void vpn::send_connect_request (int id) 842vpn::send_connect_request (connection *c)
724{ 843{
725 connection *c = find_router (); 844 connection *r = find_router_for (c);
726 845
727 if (c) 846 if (r)
847 {
848 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
849 c->conf->nodename, r->conf->nodename);
728 c->send_connect_request (id); 850 r->send_connect_request (c->conf->id);
851 }
729 else 852 else
730 // no router found, aggressively connect to all routers 853 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
731 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 854 c->conf->nodename);
732 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
733 (*i)->establish_connection ();
734} 855}
735 856
736void 857void
737connection::dump_status () 858connection::dump_status ()
738{ 859{
739 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 860 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
740 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 861 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
741 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 862 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
742 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 863 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
743 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 864 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
744 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
745 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
746} 865}
747 866
748void 867void
749vpn::dump_status () 868vpn::dump_status ()
750{ 869{
751 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 870 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
752 871
753 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 872 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
754 (*c)->dump_status (); 873 (*c)->dump_status ();
755 874
756 slog (L_NOTICE, _("END status dump")); 875 slog (L_NOTICE, _("END status dump"));
757} 876}
758 877
759vpn::vpn (void) 878vpn::vpn (void)
879{
760: event (this, &vpn::event_cb) 880 event .set<vpn, &vpn::event_cb > (this);
761, udpv4_ev_watcher (this, &vpn::udpv4_ev) 881 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
762, ipv4_ev_watcher (this, &vpn::ipv4_ev) 882 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
763#if ENABLE_TCP 883#if ENABLE_TCP
764, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 884 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
765#endif 885#endif
766#if ENABLE_ICMP 886#if ENABLE_ICMP
767, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 887 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
768#endif 888#endif
769#if ENABLE_DNS 889#if ENABLE_DNS
770, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 890 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
771#endif 891#endif
772, tap_ev_watcher (this, &vpn::tap_ev) 892 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
773{
774} 893}
775 894
776vpn::~vpn () 895vpn::~vpn ()
777{ 896{
778} 897}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines