ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.41 by pcg, Sun Dec 2 00:20:19 2007 UTC vs.
Revision 1.63 by root, Tue Jan 17 21:38:11 2012 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 97 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 98 (*c)->script_init_env (ext);
89 } 99 }
90} 100}
91 101
102inline const char *
92const char *vpn::script_if_init () 103vpn::script_if_init ()
93{ 104{
94 script_init_env (); 105 script_init_env ();
95 106
96 return tap->if_up (); 107 return tap->if_up ();
97} 108}
98 109
110inline const char *
99const char *vpn::script_if_up () 111vpn::script_if_up ()
100{ 112{
101 script_init_env (); 113 script_init_env ();
102 114
103 char *filename; 115 char *filename;
104 asprintf (&filename, 116 asprintf (&filename,
… …
108 120
109 return filename; 121 return filename;
110} 122}
111 123
112int 124int
125vpn::setup_socket (u8 prot, int family, int type, int proto)
126{
127 int fd = socket (family, type, proto);
128
129 if (fd < 0)
130 {
131 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
132 return fd;
133 }
134
135 fcntl (fd, F_SETFL, O_NONBLOCK);
136 fcntl (fd, F_SETFD, FD_CLOEXEC);
137
138#ifdef SO_MARK
139 if (::conf.nfmark)
140 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
141 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
142#endif
143
144 return fd;
145}
146
147int
113vpn::setup () 148vpn::setup ()
114{ 149{
150 int success = 0;
151
115 ipv4_tos = -1; 152 ipv4_tos = -1;
116 ipv4_fd = -1; 153 ipv4_fd = -1;
117 154
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 155 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 156 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 157 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 158
122 if (ipv4_fd < 0) 159 if (ipv4_fd < 0)
123 return -1; 160 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 161
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 162#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 163 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 164 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 165 // fragment for me sometimes.
… …
137 171
138 sockinfo si (THISNODE, PROT_IPv4); 172 sockinfo si (THISNODE, PROT_IPv4);
139 173
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 174 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 175 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 176 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 177 return -1;
144 } 178 }
145 179
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 180 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
181 ++success;
147 } 182 }
183 else
184 THISNODE->protocols &= ~PROT_IPv4;
148 185
149 udpv4_tos = -1; 186 udpv4_tos = -1;
150 udpv4_fd = -1; 187 udpv4_fd = -1;
151 188
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 189 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 190 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 191 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 192
156 if (udpv4_fd < 0) 193 if (udpv4_fd < 0)
157 return -1; 194 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 195
162 // standard daemon practise... 196 // standard daemon practise...
163 { 197 {
164 int oval = 1; 198 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 199 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 211
178 sockinfo si (THISNODE, PROT_UDPv4); 212 sockinfo si (THISNODE, PROT_UDPv4);
179 213
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 214 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 215 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 216 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 217 return -1;
184 } 218 }
185 219
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 220 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
221 ++success;
187 } 222 }
223 else
224 THISNODE->protocols &= ~PROT_UDPv4;
188 225
189 icmpv4_tos = -1; 226 icmpv4_tos = -1;
190 icmpv4_fd = -1; 227 icmpv4_fd = -1;
191 228
192#if ENABLE_ICMP 229#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 230 if (THISNODE->protocols & PROT_ICMPv4)
194 { 231 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 232 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 233
197 if (icmpv4_fd < 0) 234 if (icmpv4_fd < 0)
198 return -1; 235 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 236
203#ifdef ICMP_FILTER 237#ifdef ICMP_FILTER
204 { 238 {
205 icmp_filter oval; 239 icmp_filter oval;
206 oval.data = 0xffffffff; 240 oval.data = 0xffffffff;
… …
223 257
224 sockinfo si (THISNODE, PROT_ICMPv4); 258 sockinfo si (THISNODE, PROT_ICMPv4);
225 259
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 260 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 261 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 262 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 263 return -1;
230 } 264 }
231 265
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 266 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
267 ++success;
233 } 268 }
234#endif 269#endif
235 270
236 tcpv4_fd = -1; 271 tcpv4_fd = -1;
237 272
238#if ENABLE_TCP 273#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 274 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 275 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 276 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 277
243 if (tcpv4_fd < 0) 278 if (tcpv4_fd < 0)
244 return -1; 279 return -1;
245 280
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 281 // standard daemon practise...
250 { 282 {
251 int oval = 1; 283 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 284 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 285 }
254 286
255 sockinfo si (THISNODE, PROT_TCPv4); 287 sockinfo si (THISNODE, PROT_TCPv4);
256 288
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 290 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 292 return -1;
261 } 293 }
262 294
263 if (listen (tcpv4_fd, 5)) 295 if (listen (tcpv4_fd, 5))
264 { 296 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 297 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 298 return -1;
267 } 299 }
268 300
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 301 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
302 ++success;
270 } 303 }
304 else
305 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 306#endif
272 307
273 dnsv4_tos = -1; 308 dnsv4_tos = -1;
274 dnsv4_fd = -1; 309 dnsv4_fd = -1;
275 310
276#if ENABLE_DNS 311#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 312 if (THISNODE->protocols & PROT_DNSv4)
278 { 313 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 314 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 315
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 316 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 317
283 if (dnsv4_fd < 0) 318 if (dnsv4_fd < 0)
284 return -1; 319 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 320
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 321# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 322 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 323 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 324 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 338 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 339 PROT_DNSv4);
308 340
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 341 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 342 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 343 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 344 return -1;
313 } 345 }
314 346
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 347 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
348 ++success;
316 } 349 }
317#endif 350#endif
318 351
319 ///////////////////////////////////////////////////////////////////////////// 352 /////////////////////////////////////////////////////////////////////////////
353
354 if (!success)
355 {
356 slog (L_ERR, _("no protocols enabled."));
357 return -1;
358 }
320 359
321 reconnect_all (); 360 reconnect_all ();
322 361
323 ///////////////////////////////////////////////////////////////////////////// 362 /////////////////////////////////////////////////////////////////////////////
324 363
325 tap = new tap_device (); 364 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 365 if (!tap) //D this, of course, never catches
327 { 366 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 367 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 368 return -1;
330 } 369 }
331 370
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 371 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 372
373 run_script_cb cb;
374 cb.set<vpn, &vpn::script_if_init> (this);
375
334 if (tap->if_up () && 376 if (tap->if_up () &&
335 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 377 !run_script (cb, true))
336 { 378 {
337 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 379 slog (L_ERR, _("interface initialization command '%s' failed."),
338 tap->if_up ()); 380 tap->if_up ());
339 exit (EXIT_FAILURE); 381 return -1;
340 }
341
342 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
343 { 382 }
383
384 cb.set<vpn, &vpn::script_if_up> (this);
385 if (!run_script (cb, true))
386 {
344 slog (L_ERR, _("if-up command execution failed, exiting.")); 387 slog (L_ERR, _("if-up command execution failed."));
345 exit (EXIT_FAILURE); 388 return -1;
346 } 389 }
347 390
348 tap_ev_watcher.start (tap->fd, EV_READ); 391 tap_ev_watcher.start (tap->fd, EV_READ);
349 392
350 return 0; 393 return 0;
… …
423 { 466 {
424 // broadcast, this is ugly, but due to the security policy 467 // broadcast, this is ugly, but due to the security policy
425 // we have to connect to all hosts... 468 // we have to connect to all hosts...
426 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 469 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
427 if ((*c)->conf != THISNODE) 470 if ((*c)->conf != THISNODE)
428 (*c)->inject_data_packet (pkt, true); 471 (*c)->inject_data_packet (pkt);
429 } 472 }
430} 473}
431 474
432void 475void
433vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 476vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
434{ 477{
435 unsigned int src = pkt->src (); 478 unsigned int src = pkt->src ();
436 unsigned int dst = pkt->dst (); 479 unsigned int dst = pkt->dst ();
437 480
438 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 481 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
439 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 482 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
440 483
441 if (src == 0 || src > conns.size () 484 if (src == 0 || src > conns.size ()
442 || dst > conns.size () 485 || dst > conns.size ()
443 || pkt->typ () >= vpn_packet::PT_MAX) 486 || pkt->typ () >= vpn_packet::PT_MAX)
444 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 487 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 488 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
446 else if (dst > conns.size ())
447 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
448 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
449 else 489 else
450 { 490 {
451 connection *c = conns[src - 1]; 491 connection *c = conns[src - 1];
452 492
453 if (dst == 0) 493 if (dst == 0)
454 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 494 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
455 c->conf->nodename, (const char *)rsi); 495 c->conf->nodename, (const char *)rsi);
456 else if (dst != THISNODE->id) 496 else if (dst != THISNODE->id)
457 { 497 {
458 if (THISNODE->routerprio) 498 if (THISNODE->routerprio)
459 // the tos setting gets lost here. who cares. 499 // the tos setting gets lost here. who cares.
460 conns[dst - 1]->inject_vpn_packet (pkt); 500 conns[dst - 1]->inject_vpn_packet (pkt);
461 else 501 else
462 slog (L_WARN, 502 slog (L_WARN,
463 _("%s(%s): forwarding request (=> %s), but we are no router"), 503 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
464 c->conf->nodename, (const char *)rsi, 504 c->conf->nodename, (const char *)rsi,
465 conns[dst - 1]->conf->nodename); 505 conns[dst - 1]->conf->nodename);
466 } 506 }
467 else 507 else
468 c->recv_vpn_packet (pkt, rsi); 508 c->recv_vpn_packet (pkt, rsi);
… …
473vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 513vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
474{ 514{
475 switch (si.prot) 515 switch (si.prot)
476 { 516 {
477 case PROT_IPv4: 517 case PROT_IPv4:
478 return send_ipv4_packet (pkt, si, tos); 518 return send_ipv4_packet (pkt, si, tos);
479 519
480 case PROT_UDPv4: 520 case PROT_UDPv4:
481 return send_udpv4_packet (pkt, si, tos); 521 return send_udpv4_packet (pkt, si, tos);
482 522
483#if ENABLE_TCP 523#if ENABLE_TCP
484 case PROT_TCPv4: 524 case PROT_TCPv4:
485 return send_tcpv4_packet (pkt, si, tos); 525 return send_tcpv4_packet (pkt, si, tos);
486#endif 526#endif
487#if ENABLE_ICMP 527#if ENABLE_ICMP
488 case PROT_ICMPv4: 528 case PROT_ICMPv4:
489 return send_icmpv4_packet (pkt, si, tos); 529 return send_icmpv4_packet (pkt, si, tos);
490#endif 530#endif
491#if ENABLE_DNS 531#if ENABLE_DNS
492 case PROT_DNSv4: 532 case PROT_DNSv4:
493 return send_dnsv4_packet (pkt, si, tos); 533 return send_dnsv4_packet (pkt, si, tos);
494#endif 534#endif
495 default: 535 default:
496 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 536 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
497 } 537 }
498 538
499 return false; 539 return false;
500} 540}
501 541
502void 542inline void
503vpn::ipv4_ev (ev::io &w, int revents) 543vpn::ipv4_ev (ev::io &w, int revents)
504{ 544{
505 if (revents & EV_READ) 545 if (revents & EV_READ)
506 { 546 {
507 vpn_packet *pkt = new vpn_packet; 547 vpn_packet *pkt = new vpn_packet;
… …
516 if (len > 0) 556 if (len > 0)
517 { 557 {
518 pkt->len = len; 558 pkt->len = len;
519 559
520 // raw sockets deliver the ipv4 header, but don't expect it on sends 560 // raw sockets deliver the ipv4 header, but don't expect it on sends
521 pkt->skip_hdr (IP_OVERHEAD); 561 pkt->skip_hdr (pkt->ipv4_hdr_len ());
522 562
523 recv_vpn_packet (pkt, si); 563 recv_vpn_packet (pkt, si);
524 } 564 }
525 else 565 else
526 { 566 {
527 // probably ECONNRESET or somesuch 567 // probably ECONNRESET or somesuch
528 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 568 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
529 } 569 }
530 570
531 delete pkt; 571 delete pkt;
532 } 572 }
533 else 573 else
534 { 574 {
535 slog (L_ERR, 575 slog (L_ERR,
536 _("FATAL: unknown revents %08x in socket, terminating\n"), 576 _("FATAL: unknown revents %08x in socket, exiting.\n"),
537 revents); 577 revents);
538 exit (EXIT_FAILURE); 578 exit (EXIT_FAILURE);
539 } 579 }
540} 580}
541 581
542#if ENABLE_ICMP 582#if ENABLE_ICMP
543void 583inline void
544vpn::icmpv4_ev (ev::io &w, int revents) 584vpn::icmpv4_ev (ev::io &w, int revents)
545{ 585{
546 if (revents & EV_READ) 586 if (revents & EV_READ)
547 { 587 {
548 vpn_packet *pkt = new vpn_packet; 588 vpn_packet *pkt = new vpn_packet;
… …
563 if (hdr->type == ::conf.icmp_type 603 if (hdr->type == ::conf.icmp_type
564 && hdr->code == 255) 604 && hdr->code == 255)
565 { 605 {
566 // raw sockets deliver the ipv4, but don't expect it on sends 606 // raw sockets deliver the ipv4, but don't expect it on sends
567 // this is slow, but... 607 // this is slow, but...
568 pkt->skip_hdr (ICMP_OVERHEAD); 608 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
569 609
570 recv_vpn_packet (pkt, si); 610 recv_vpn_packet (pkt, si);
571 } 611 }
572 } 612 }
573 else 613 else
574 { 614 {
575 // probably ECONNRESET or somesuch 615 // probably ECONNRESET or somesuch
576 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 616 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
577 } 617 }
578 618
579 delete pkt; 619 delete pkt;
580 } 620 }
581 else 621 else
582 { 622 {
583 slog (L_ERR, 623 slog (L_ERR,
584 _("FATAL: unknown revents %08x in socket, terminating\n"), 624 _("FATAL: unknown revents %08x in socket, exiting.\n"),
585 revents); 625 revents);
586 exit (EXIT_FAILURE); 626 exit (EXIT_FAILURE);
587 } 627 }
588} 628}
589#endif 629#endif
590 630
591void 631inline void
592vpn::udpv4_ev (ev::io &w, int revents) 632vpn::udpv4_ev (ev::io &w, int revents)
593{ 633{
594 if (revents & EV_READ) 634 if (revents & EV_READ)
595 { 635 {
596 vpn_packet *pkt = new vpn_packet; 636 vpn_packet *pkt = new vpn_packet;
… …
609 recv_vpn_packet (pkt, si); 649 recv_vpn_packet (pkt, si);
610 } 650 }
611 else 651 else
612 { 652 {
613 // probably ECONNRESET or somesuch 653 // probably ECONNRESET or somesuch
614 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 654 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
615 } 655 }
616 656
617 delete pkt; 657 delete pkt;
618 } 658 }
619 else 659 else
620 { 660 {
621 slog (L_ERR, 661 slog (L_ERR,
622 _("FATAL: unknown revents %08x in socket, terminating\n"), 662 _("FATAL: unknown revents %08x in socket, exiting.\n"),
623 revents); 663 revents);
624 exit (EXIT_FAILURE); 664 exit (EXIT_FAILURE);
625 } 665 }
626} 666}
627 667
628void 668inline void
629vpn::tap_ev (ev::io &w, int revents) 669vpn::tap_ev (ev::io &w, int revents)
630{ 670{
631 if (revents & EV_READ) 671 if (revents & EV_READ)
632 { 672 {
633 /* process data */ 673 /* process data */
… …
665 } 705 }
666 else 706 else
667 abort (); 707 abort ();
668} 708}
669 709
670void 710inline void
671vpn::event_cb (ev::timer &w, int) 711vpn::event_cb (ev::timer &w, int)
672{ 712{
673 if (events) 713 if (events)
674 { 714 {
675 if (events & EVENT_SHUTDOWN) 715 if (events & EVENT_SHUTDOWN)
676 { 716 {
677 slog (L_INFO, _("preparing shutdown...")); 717 slog (L_INFO, _("preparing shutdown..."));
678 718
679 shutdown_all (); 719 shutdown_all ();
680 remove_pid (conf.pidfilename); 720 remove_pid (conf.pidfilename);
681 slog (L_INFO, _("terminating")); 721 slog (L_INFO, _("exiting."));
682 exit (EXIT_SUCCESS); 722 exit (EXIT_SUCCESS);
683 } 723 }
684 724
685 if (events & EVENT_RECONNECT) 725 if (events & EVENT_RECONNECT)
686 { 726 {
687 slog (L_INFO, _("forced reconnect")); 727 slog (L_INFO, _("forced reconnect."));
688 728
689 reconnect_all (); 729 reconnect_all ();
690 } 730 }
691 731
692 events = 0; 732 events = 0;
… …
708 748
709 conns.clear (); 749 conns.clear ();
710 750
711 connection_init (); 751 connection_init ();
712 752
713 for (configuration::node_vector::iterator i = conf.nodes.begin (); 753 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
714 i != conf.nodes.end (); ++i) 754 conns.push_back (new connection (this, *i));
715 { 755
716 connection *conn = new connection (this, *i); 756 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
717 conns.push_back (conn);
718 conn->establish_connection (); 757 (*c)->establish_connection ();
719 }
720} 758}
721 759
722connection *vpn::find_router () 760bool
761vpn::can_direct (conf_node *src, conf_node *dst) const
723{ 762{
724 u32 prio = 1; 763 return src != dst
764 && src->may_direct (dst)
765 && dst->may_direct (src)
766 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
767 || (src->protocols & dst->connectable_protocols ()));
768}
769
770// only works for indirect and routed connections: find a router
771// from THISNODE to dst
772connection *
773vpn::find_router_for (const connection *dst)
774{
725 connection *router = 0; 775 connection *router = 0;
726 776
777 // first try to find a router with a direct connection, route there
778 // regardless of any other considerations.
779 {
780 u32 prio = 1;
781
782 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
783 {
784 connection *c = *i;
785
786 if (c->conf->routerprio > prio
787 && c->conf != THISNODE
788 && can_direct (c->conf, dst->conf)
789 && c->ictx && c->octx)
790 {
791 prio = c->conf->routerprio;
792 router = c;
793 }
794 }
795 }
796
797 if (router)
798 return router;
799
800 // second try find the router with the highest priority, higher than ours
801 {
802 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
803
804 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
805 {
806 connection *c = *i;
807
808 if (c->conf->routerprio > prio
809 && c != dst
810 && c->conf != THISNODE
811 && c->ictx && c->octx)
812 {
813 prio = c->conf->routerprio;
814 router = c;
815 }
816 }
817 }
818
819 return router;
820}
821
822void
823vpn::connection_established (connection *c)
824{
727 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 825 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
728 { 826 {
729 connection *c = *i; 827 connection *o = *i;
730 828
731 if (c->conf->routerprio > prio 829 if (!o->is_direct
732 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 830 && o->si.valid ()
733 && c->ictx && c->octx 831 && c->si != o->si
734 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 832 && c == find_router_for (o))
735 {
736 prio = c->conf->routerprio;
737 router = c;
738 } 833 {
834 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
835 o->conf->nodename, c->conf->nodename);
836 o->rekey ();
837 }
739 } 838 }
740
741 return router;
742} 839}
743 840
841void
744void vpn::send_connect_request (int id) 842vpn::send_connect_request (connection *c)
745{ 843{
746 connection *c = find_router (); 844 connection *r = find_router_for (c);
747 845
748 if (c) 846 if (r)
847 {
848 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
849 c->conf->nodename, r->conf->nodename);
749 c->send_connect_request (id); 850 r->send_connect_request (c->conf->id);
851 }
750 else 852 else
751 // no router found, aggressively connect to all routers 853 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
752 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 854 c->conf->nodename);
753 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
754 (*i)->establish_connection ();
755} 855}
756 856
757void 857void
758connection::dump_status () 858connection::dump_status ()
759{ 859{
760 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 860 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
761 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 861 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
762 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 862 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
763 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 863 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
764 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 864 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
765 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
766 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
767} 865}
768 866
769void 867void
770vpn::dump_status () 868vpn::dump_status ()
771{ 869{
… …
776 874
777 slog (L_NOTICE, _("END status dump")); 875 slog (L_NOTICE, _("END status dump"));
778} 876}
779 877
780vpn::vpn (void) 878vpn::vpn (void)
879{
781: event (this, &vpn::event_cb) 880 event .set<vpn, &vpn::event_cb > (this);
782, udpv4_ev_watcher (this, &vpn::udpv4_ev) 881 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
783, ipv4_ev_watcher (this, &vpn::ipv4_ev) 882 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
784#if ENABLE_TCP 883#if ENABLE_TCP
785, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 884 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
786#endif 885#endif
787#if ENABLE_ICMP 886#if ENABLE_ICMP
788, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 887 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
789#endif 888#endif
790#if ENABLE_DNS 889#if ENABLE_DNS
791, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 890 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
792#endif 891#endif
793, tap_ev_watcher (this, &vpn::tap_ev) 892 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
794{
795} 893}
796 894
797vpn::~vpn () 895vpn::~vpn ()
798{ 896{
799} 897}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines