ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.39 by pcg, Sat Nov 10 05:14:22 2007 UTC vs.
Revision 1.63 by root, Tue Jan 17 21:38:11 2012 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
46 56
47vpn network; // THE vpn (bad design...) 57vpn network; // THE vpn (bad design...)
48 58
49///////////////////////////////////////////////////////////////////////////// 59/////////////////////////////////////////////////////////////////////////////
50 60
61static void inline
62set_tos (int fd, int &tos_prev, int tos)
63{
64#if defined(SOL_IP) && defined(IP_TOS)
65 if (tos_prev == tos)
66 return;
67
68 tos_prev = tos;
69 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
70#endif
71}
72
51void 73void
52vpn::script_init_env () 74vpn::script_init_env ()
53{ 75{
54 // the tunnel device mtu should be the physical mtu - overhead 76 // the tunnel device mtu should be the physical mtu - overhead
55 // the tricky part is rounding to the cipher key blocksize 77 // the tricky part is rounding to the cipher key blocksize
… …
75 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
76 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
77 } 99 }
78} 100}
79 101
102inline const char *
80const char *vpn::script_if_init () 103vpn::script_if_init ()
81{ 104{
82 script_init_env (); 105 script_init_env ();
83 106
84 return tap->if_up (); 107 return tap->if_up ();
85} 108}
86 109
110inline const char *
87const char *vpn::script_if_up () 111vpn::script_if_up ()
88{ 112{
89 script_init_env (); 113 script_init_env ();
90 114
91 char *filename; 115 char *filename;
92 asprintf (&filename, 116 asprintf (&filename,
… …
96 120
97 return filename; 121 return filename;
98} 122}
99 123
100int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
101vpn::setup () 148vpn::setup ()
102{ 149{
150 int success = 0;
151
152 ipv4_tos = -1;
103 ipv4_fd = -1; 153 ipv4_fd = -1;
104 154
105 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
106 { 156 {
107 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
108 158
109 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
110 return -1; 160 return -1;
111
112 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
113 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
114 161
115#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
116 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
117 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
118 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
124 171
125 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
126 173
127 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
128 { 175 {
129 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
130 exit (EXIT_FAILURE); 177 return -1;
131 } 178 }
132 179
133 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
134 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
135 185
186 udpv4_tos = -1;
136 udpv4_fd = -1; 187 udpv4_fd = -1;
137 188
138 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
139 { 190 {
140 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
141 192
142 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
143 return -1; 194 return -1;
144
145 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
146 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
147 195
148 // standard daemon practise... 196 // standard daemon practise...
149 { 197 {
150 int oval = 1; 198 int oval = 1;
151 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
163 211
164 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
165 213
166 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
167 { 215 {
168 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
169 exit (EXIT_FAILURE); 217 return -1;
170 } 218 }
171 219
172 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
173 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
174 225
226 icmpv4_tos = -1;
175 icmpv4_fd = -1; 227 icmpv4_fd = -1;
176 228
177#if ENABLE_ICMP 229#if ENABLE_ICMP
178 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
179 { 231 {
180 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
181 233
182 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
183 return -1; 235 return -1;
184
185 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
186 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
187 236
188#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
189 { 238 {
190 icmp_filter oval; 239 icmp_filter oval;
191 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
208 257
209 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
210 259
211 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
212 { 261 {
213 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
214 exit (EXIT_FAILURE); 263 return -1;
215 } 264 }
216 265
217 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
218 } 268 }
219#endif 269#endif
220 270
221 tcpv4_fd = -1; 271 tcpv4_fd = -1;
222 272
223#if ENABLE_TCP 273#if ENABLE_TCP
224 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
225 { 275 {
226 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
227 277
228 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
229 return -1; 279 return -1;
230 280
231 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
232 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
233
234 // standard daemon practise... 281 // standard daemon practise...
235 { 282 {
236 int oval = 1; 283 int oval = 1;
237 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
238 } 285 }
239 286
240 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
241 288
242 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
243 { 290 {
244 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
245 exit (EXIT_FAILURE); 292 return -1;
246 } 293 }
247 294
248 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
249 { 296 {
250 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
251 exit (EXIT_FAILURE); 298 return -1;
252 } 299 }
253 300
254 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
255 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
256#endif 306#endif
307
308 dnsv4_tos = -1;
309 dnsv4_fd = -1;
257 310
258#if ENABLE_DNS 311#if ENABLE_DNS
259 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
260 { 313 {
261 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
262 315
263 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
264 317
265 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
266 return -1; 319 return -1;
267
268 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
269 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
270 320
271# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
272 // this I really consider a linux bug. I am neither connected 322 // this I really consider a linux bug. I am neither connected
273 // nor do I fragment myself. Linux still sets DF and doesn't 323 // nor do I fragment myself. Linux still sets DF and doesn't
274 // fragment for me sometimes. 324 // fragment for me sometimes.
… …
288 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
289 PROT_DNSv4); 339 PROT_DNSv4);
290 340
291 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
292 { 342 {
293 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
294 exit (EXIT_FAILURE); 344 return -1;
295 } 345 }
296 346
297 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
298 } 349 }
299#endif 350#endif
300 351
301 ///////////////////////////////////////////////////////////////////////////// 352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
355 {
356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
302 359
303 reconnect_all (); 360 reconnect_all ();
304 361
305 ///////////////////////////////////////////////////////////////////////////// 362 /////////////////////////////////////////////////////////////////////////////
306 363
307 tap = new tap_device (); 364 tap = new tap_device ();
308 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
309 { 366 {
310 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
311 exit (EXIT_FAILURE); 368 return -1;
312 } 369 }
313 370
314 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
315 372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
316 if (tap->if_up () && 376 if (tap->if_up () &&
317 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 377 !run_script (cb, true))
318 { 378 {
319 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 379 slog (L_ERR, _("interface initialization command '%s' failed."),
320 tap->if_up ()); 380 tap->if_up ());
321 exit (EXIT_FAILURE); 381 return -1;
322 }
323
324 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
325 { 382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
326 slog (L_ERR, _("if-up command execution failed, exiting.")); 387 slog (L_ERR, _("if-up command execution failed."));
327 exit (EXIT_FAILURE); 388 return -1;
328 } 389 }
329 390
330 tap_ev_watcher.start (tap->fd, EV_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
331 392
332 return 0; 393 return 0;
333} 394}
334 395
335bool 396bool
336vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 397vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
337{ 398{
338#if defined(SOL_IP) && defined(IP_TOS) 399 set_tos (ipv4_fd, ipv4_tos, tos);
339 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
340#endif
341 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 400 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
342 401
343 return true; 402 return true;
344} 403}
345 404
… …
368 427
369#if ENABLE_ICMP 428#if ENABLE_ICMP
370bool 429bool
371vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 430vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
372{ 431{
373#if defined(SOL_IP) && defined(IP_TOS)
374 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
375#endif
376
377 pkt->unshift_hdr (4); 432 pkt->unshift_hdr (4);
378 433
379 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 434 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
380 hdr->type = ::conf.icmp_type; 435 hdr->type = ::conf.icmp_type;
381 hdr->code = 255; 436 hdr->code = 255;
382 hdr->checksum = 0; 437 hdr->checksum = 0;
383 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 438 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
384 439
440 set_tos (icmpv4_fd, icmpv4_tos, tos);
385 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 441 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
386 442
387 return true; 443 return true;
388} 444}
389#endif 445#endif
390 446
391bool 447bool
392vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 448vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
393{ 449{
394#if defined(SOL_IP) && defined(IP_TOS) 450 set_tos (udpv4_fd, udpv4_tos, tos);
395 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
396#endif
397 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 451 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
398 452
399 return true; 453 return true;
400} 454}
401 455
… …
412 { 466 {
413 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
414 // we have to connect to all hosts... 468 // we have to connect to all hosts...
415 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
416 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
417 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
418 } 472 }
419} 473}
420 474
421void 475void
422vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
423{ 477{
424 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
425 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
426 480
427 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
428 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
429 483
430 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
431 || dst > conns.size () 485 || dst > conns.size ()
432 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
433 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
434 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
435 else if (dst > conns.size ())
436 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
437 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
438 else 489 else
439 { 490 {
440 connection *c = conns[src - 1]; 491 connection *c = conns[src - 1];
441 492
442 if (dst == 0) 493 if (dst == 0)
443 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 494 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
444 c->conf->nodename, (const char *)rsi); 495 c->conf->nodename, (const char *)rsi);
445 else if (dst != THISNODE->id) 496 else if (dst != THISNODE->id)
446 { 497 {
447 if (THISNODE->routerprio) 498 if (THISNODE->routerprio)
448 // the tos setting gets lost here. who cares. 499 // the tos setting gets lost here. who cares.
449 conns[dst - 1]->inject_vpn_packet (pkt); 500 conns[dst - 1]->inject_vpn_packet (pkt);
450 else 501 else
451 slog (L_WARN, 502 slog (L_WARN,
452 _("%s(%s): forwarding request (=> %s), but we are no router"), 503 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
453 c->conf->nodename, (const char *)rsi, 504 c->conf->nodename, (const char *)rsi,
454 conns[dst - 1]->conf->nodename); 505 conns[dst - 1]->conf->nodename);
455 } 506 }
456 else 507 else
457 c->recv_vpn_packet (pkt, rsi); 508 c->recv_vpn_packet (pkt, rsi);
… …
462vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 513vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
463{ 514{
464 switch (si.prot) 515 switch (si.prot)
465 { 516 {
466 case PROT_IPv4: 517 case PROT_IPv4:
467 return send_ipv4_packet (pkt, si, tos); 518 return send_ipv4_packet (pkt, si, tos);
519
468 case PROT_UDPv4: 520 case PROT_UDPv4:
469 return send_udpv4_packet (pkt, si, tos); 521 return send_udpv4_packet (pkt, si, tos);
522
470#if ENABLE_TCP 523#if ENABLE_TCP
471 case PROT_TCPv4: 524 case PROT_TCPv4:
472 return send_tcpv4_packet (pkt, si, tos); 525 return send_tcpv4_packet (pkt, si, tos);
473#endif 526#endif
474#if ENABLE_ICMP 527#if ENABLE_ICMP
475 case PROT_ICMPv4: 528 case PROT_ICMPv4:
476 return send_icmpv4_packet (pkt, si, tos); 529 return send_icmpv4_packet (pkt, si, tos);
477#endif 530#endif
478#if ENABLE_DNS 531#if ENABLE_DNS
479 case PROT_DNSv4: 532 case PROT_DNSv4:
480 return send_dnsv4_packet (pkt, si, tos); 533 return send_dnsv4_packet (pkt, si, tos);
481#endif 534#endif
482
483 default: 535 default:
484 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 536 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
485 } 537 }
486 538
487 return false; 539 return false;
488} 540}
489 541
490void 542inline void
491vpn::ipv4_ev (ev::io &w, int revents) 543vpn::ipv4_ev (ev::io &w, int revents)
492{ 544{
493 if (revents & EV_READ) 545 if (revents & EV_READ)
494 { 546 {
495 vpn_packet *pkt = new vpn_packet; 547 vpn_packet *pkt = new vpn_packet;
… …
504 if (len > 0) 556 if (len > 0)
505 { 557 {
506 pkt->len = len; 558 pkt->len = len;
507 559
508 // raw sockets deliver the ipv4 header, but don't expect it on sends 560 // raw sockets deliver the ipv4 header, but don't expect it on sends
509 pkt->skip_hdr (IP_OVERHEAD); 561 pkt->skip_hdr (pkt->ipv4_hdr_len ());
510 562
511 recv_vpn_packet (pkt, si); 563 recv_vpn_packet (pkt, si);
512 } 564 }
513 else 565 else
514 { 566 {
515 // probably ECONNRESET or somesuch 567 // probably ECONNRESET or somesuch
516 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 568 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
517 } 569 }
518 570
519 delete pkt; 571 delete pkt;
520 } 572 }
521 else 573 else
522 { 574 {
523 slog (L_ERR, 575 slog (L_ERR,
524 _("FATAL: unknown revents %08x in socket, terminating\n"), 576 _("FATAL: unknown revents %08x in socket, exiting.\n"),
525 revents); 577 revents);
526 exit (EXIT_FAILURE); 578 exit (EXIT_FAILURE);
527 } 579 }
528} 580}
529 581
530#if ENABLE_ICMP 582#if ENABLE_ICMP
531void 583inline void
532vpn::icmpv4_ev (ev::io &w, int revents) 584vpn::icmpv4_ev (ev::io &w, int revents)
533{ 585{
534 if (revents & EV_READ) 586 if (revents & EV_READ)
535 { 587 {
536 vpn_packet *pkt = new vpn_packet; 588 vpn_packet *pkt = new vpn_packet;
… …
551 if (hdr->type == ::conf.icmp_type 603 if (hdr->type == ::conf.icmp_type
552 && hdr->code == 255) 604 && hdr->code == 255)
553 { 605 {
554 // raw sockets deliver the ipv4, but don't expect it on sends 606 // raw sockets deliver the ipv4, but don't expect it on sends
555 // this is slow, but... 607 // this is slow, but...
556 pkt->skip_hdr (ICMP_OVERHEAD); 608 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
557 609
558 recv_vpn_packet (pkt, si); 610 recv_vpn_packet (pkt, si);
559 } 611 }
560 } 612 }
561 else 613 else
562 { 614 {
563 // probably ECONNRESET or somesuch 615 // probably ECONNRESET or somesuch
564 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 616 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
565 } 617 }
566 618
567 delete pkt; 619 delete pkt;
568 } 620 }
569 else 621 else
570 { 622 {
571 slog (L_ERR, 623 slog (L_ERR,
572 _("FATAL: unknown revents %08x in socket, terminating\n"), 624 _("FATAL: unknown revents %08x in socket, exiting.\n"),
573 revents); 625 revents);
574 exit (EXIT_FAILURE); 626 exit (EXIT_FAILURE);
575 } 627 }
576} 628}
577#endif 629#endif
578 630
579void 631inline void
580vpn::udpv4_ev (ev::io &w, int revents) 632vpn::udpv4_ev (ev::io &w, int revents)
581{ 633{
582 if (revents & EV_READ) 634 if (revents & EV_READ)
583 { 635 {
584 vpn_packet *pkt = new vpn_packet; 636 vpn_packet *pkt = new vpn_packet;
… …
597 recv_vpn_packet (pkt, si); 649 recv_vpn_packet (pkt, si);
598 } 650 }
599 else 651 else
600 { 652 {
601 // probably ECONNRESET or somesuch 653 // probably ECONNRESET or somesuch
602 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 654 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
603 } 655 }
604 656
605 delete pkt; 657 delete pkt;
606 } 658 }
607 else 659 else
608 { 660 {
609 slog (L_ERR, 661 slog (L_ERR,
610 _("FATAL: unknown revents %08x in socket, terminating\n"), 662 _("FATAL: unknown revents %08x in socket, exiting.\n"),
611 revents); 663 revents);
612 exit (EXIT_FAILURE); 664 exit (EXIT_FAILURE);
613 } 665 }
614} 666}
615 667
616void 668inline void
617vpn::tap_ev (ev::io &w, int revents) 669vpn::tap_ev (ev::io &w, int revents)
618{ 670{
619 if (revents & EV_READ) 671 if (revents & EV_READ)
620 { 672 {
621 /* process data */ 673 /* process data */
… …
653 } 705 }
654 else 706 else
655 abort (); 707 abort ();
656} 708}
657 709
658void 710inline void
659vpn::event_cb (ev::timer &w, int) 711vpn::event_cb (ev::timer &w, int)
660{ 712{
661 if (events) 713 if (events)
662 { 714 {
663 if (events & EVENT_SHUTDOWN) 715 if (events & EVENT_SHUTDOWN)
664 { 716 {
665 slog (L_INFO, _("preparing shutdown...")); 717 slog (L_INFO, _("preparing shutdown..."));
666 718
667 shutdown_all (); 719 shutdown_all ();
668 remove_pid (conf.pidfilename); 720 remove_pid (conf.pidfilename);
669 slog (L_INFO, _("terminating")); 721 slog (L_INFO, _("exiting."));
670 exit (EXIT_SUCCESS); 722 exit (EXIT_SUCCESS);
671 } 723 }
672 724
673 if (events & EVENT_RECONNECT) 725 if (events & EVENT_RECONNECT)
674 { 726 {
675 slog (L_INFO, _("forced reconnect")); 727 slog (L_INFO, _("forced reconnect."));
676 728
677 reconnect_all (); 729 reconnect_all ();
678 } 730 }
679 731
680 events = 0; 732 events = 0;
… …
696 748
697 conns.clear (); 749 conns.clear ();
698 750
699 connection_init (); 751 connection_init ();
700 752
701 for (configuration::node_vector::iterator i = conf.nodes.begin (); 753 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
702 i != conf.nodes.end (); ++i) 754 conns.push_back (new connection (this, *i));
703 { 755
704 connection *conn = new connection (this, *i); 756 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
705 conns.push_back (conn);
706 conn->establish_connection (); 757 (*c)->establish_connection ();
707 }
708} 758}
709 759
710connection *vpn::find_router () 760bool
761vpn::can_direct (conf_node *src, conf_node *dst) const
711{ 762{
712 u32 prio = 1; 763 return src != dst
764 && src->may_direct (dst)
765 && dst->may_direct (src)
766 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
767 || (src->protocols & dst->connectable_protocols ()));
768}
769
770// only works for indirect and routed connections: find a router
771// from THISNODE to dst
772connection *
773vpn::find_router_for (const connection *dst)
774{
713 connection *router = 0; 775 connection *router = 0;
714 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void
823vpn::connection_established (connection *c)
824{
715 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 825 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
716 { 826 {
717 connection *c = *i; 827 connection *o = *i;
718 828
719 if (c->conf->routerprio > prio 829 if (!o->is_direct
720 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 830 && o->si.valid ()
721 && c->ictx && c->octx 831 && c->si != o->si
722 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 832 && c == find_router_for (o))
723 {
724 prio = c->conf->routerprio;
725 router = c;
726 } 833 {
834 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
835 o->conf->nodename, c->conf->nodename);
836 o->rekey ();
837 }
727 } 838 }
728
729 return router;
730} 839}
731 840
841void
732void vpn::send_connect_request (int id) 842vpn::send_connect_request (connection *c)
733{ 843{
734 connection *c = find_router (); 844 connection *r = find_router_for (c);
735 845
736 if (c) 846 if (r)
847 {
848 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
849 c->conf->nodename, r->conf->nodename);
737 c->send_connect_request (id); 850 r->send_connect_request (c->conf->id);
851 }
738 else 852 else
739 // no router found, aggressively connect to all routers 853 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
740 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 854 c->conf->nodename);
741 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
742 (*i)->establish_connection ();
743} 855}
744 856
745void 857void
746connection::dump_status () 858connection::dump_status ()
747{ 859{
748 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 860 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
749 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 861 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
750 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 862 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
751 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 863 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
752 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 864 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
753 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
754 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
755} 865}
756 866
757void 867void
758vpn::dump_status () 868vpn::dump_status ()
759{ 869{
760 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev::ev_now ()); 870 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
761 871
762 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 872 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
763 (*c)->dump_status (); 873 (*c)->dump_status ();
764 874
765 slog (L_NOTICE, _("END status dump")); 875 slog (L_NOTICE, _("END status dump"));
766} 876}
767 877
768vpn::vpn (void) 878vpn::vpn (void)
879{
769: event (this, &vpn::event_cb) 880 event .set<vpn, &vpn::event_cb > (this);
770, udpv4_ev_watcher (this, &vpn::udpv4_ev) 881 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
771, ipv4_ev_watcher (this, &vpn::ipv4_ev) 882 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
772#if ENABLE_TCP 883#if ENABLE_TCP
773, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 884 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
774#endif 885#endif
775#if ENABLE_ICMP 886#if ENABLE_ICMP
776, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 887 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
777#endif 888#endif
778#if ENABLE_DNS 889#if ENABLE_DNS
779, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 890 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
780#endif 891#endif
781, tap_ev_watcher (this, &vpn::tap_ev) 892 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
782{
783} 893}
784 894
785vpn::~vpn () 895vpn::~vpn ()
786{ 896{
787} 897}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines