ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.42 by pcg, Sun Dec 2 00:54:52 2007 UTC vs.
Revision 1.64 by root, Tue Dec 4 10:29:43 2012 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
41#include "pidfile.h" 52#include "pidfile.h"
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
57
58using namespace std;
46 59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
50 63
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 100 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 101 (*c)->script_init_env (ext);
89 } 102 }
90} 103}
91 104
105inline const char *
92const char *vpn::script_if_init () 106vpn::script_if_init ()
93{ 107{
94 script_init_env (); 108 script_init_env ();
95 109
96 return tap->if_up (); 110 return tap->if_up ();
97} 111}
98 112
113inline const char *
99const char *vpn::script_if_up () 114vpn::script_if_up ()
100{ 115{
101 script_init_env (); 116 script_init_env ();
102 117
103 char *filename; 118 char *filename;
104 asprintf (&filename, 119 asprintf (&filename,
… …
108 123
109 return filename; 124 return filename;
110} 125}
111 126
112int 127int
128vpn::setup_socket (u8 prot, int family, int type, int proto)
129{
130 int fd = socket (family, type, proto);
131
132 if (fd < 0)
133 {
134 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
135 return fd;
136 }
137
138 fcntl (fd, F_SETFL, O_NONBLOCK);
139 fcntl (fd, F_SETFD, FD_CLOEXEC);
140
141#ifdef SO_MARK
142 if (::conf.nfmark)
143 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
144 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
145#endif
146
147 return fd;
148}
149
150int
113vpn::setup () 151vpn::setup ()
114{ 152{
153 int success = 0;
154
115 ipv4_tos = -1; 155 ipv4_tos = -1;
116 ipv4_fd = -1; 156 ipv4_fd = -1;
117 157
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 158 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 159 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 160 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 161
122 if (ipv4_fd < 0) 162 if (ipv4_fd < 0)
123 return -1; 163 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 164
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 165#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 166 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 167 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 168 // fragment for me sometimes.
… …
137 174
138 sockinfo si (THISNODE, PROT_IPv4); 175 sockinfo si (THISNODE, PROT_IPv4);
139 176
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 177 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 178 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 179 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 180 return -1;
144 } 181 }
145 182
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 183 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
184 ++success;
147 } 185 }
186 else
187 THISNODE->protocols &= ~PROT_IPv4;
148 188
149 udpv4_tos = -1; 189 udpv4_tos = -1;
150 udpv4_fd = -1; 190 udpv4_fd = -1;
151 191
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 192 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 193 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 194 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 195
156 if (udpv4_fd < 0) 196 if (udpv4_fd < 0)
157 return -1; 197 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 198
162 // standard daemon practise... 199 // standard daemon practise...
163 { 200 {
164 int oval = 1; 201 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 202 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 214
178 sockinfo si (THISNODE, PROT_UDPv4); 215 sockinfo si (THISNODE, PROT_UDPv4);
179 216
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 217 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 218 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 219 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 220 return -1;
184 } 221 }
185 222
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 223 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
224 ++success;
187 } 225 }
226 else
227 THISNODE->protocols &= ~PROT_UDPv4;
188 228
189 icmpv4_tos = -1; 229 icmpv4_tos = -1;
190 icmpv4_fd = -1; 230 icmpv4_fd = -1;
191 231
192#if ENABLE_ICMP 232#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 233 if (THISNODE->protocols & PROT_ICMPv4)
194 { 234 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 235 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 236
197 if (icmpv4_fd < 0) 237 if (icmpv4_fd < 0)
198 return -1; 238 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 239
203#ifdef ICMP_FILTER 240#ifdef ICMP_FILTER
204 { 241 {
205 icmp_filter oval; 242 icmp_filter oval;
206 oval.data = 0xffffffff; 243 oval.data = 0xffffffff;
… …
223 260
224 sockinfo si (THISNODE, PROT_ICMPv4); 261 sockinfo si (THISNODE, PROT_ICMPv4);
225 262
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 263 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 264 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 265 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 266 return -1;
230 } 267 }
231 268
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 269 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
270 ++success;
233 } 271 }
234#endif 272#endif
235 273
236 tcpv4_fd = -1; 274 tcpv4_fd = -1;
237 275
238#if ENABLE_TCP 276#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 277 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 278 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 279 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 280
243 if (tcpv4_fd < 0) 281 if (tcpv4_fd < 0)
244 return -1; 282 return -1;
245 283
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 284 // standard daemon practise...
250 { 285 {
251 int oval = 1; 286 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 287 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 288 }
254 289
255 sockinfo si (THISNODE, PROT_TCPv4); 290 sockinfo si (THISNODE, PROT_TCPv4);
256 291
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 292 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 293 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 294 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 295 return -1;
261 } 296 }
262 297
263 if (listen (tcpv4_fd, 5)) 298 if (listen (tcpv4_fd, 5))
264 { 299 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 300 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 301 return -1;
267 } 302 }
268 303
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 304 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
305 ++success;
270 } 306 }
307 else
308 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 309#endif
272 310
273 dnsv4_tos = -1; 311 dnsv4_tos = -1;
274 dnsv4_fd = -1; 312 dnsv4_fd = -1;
275 313
276#if ENABLE_DNS 314#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 315 if (THISNODE->protocols & PROT_DNSv4)
278 { 316 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 317 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 318
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 319 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 320
283 if (dnsv4_fd < 0) 321 if (dnsv4_fd < 0)
284 return -1; 322 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 323
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 324# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 325 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 326 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 327 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 341 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 342 PROT_DNSv4);
308 343
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 344 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 345 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 346 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 347 return -1;
313 } 348 }
314 349
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 350 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
351 ++success;
316 } 352 }
317#endif 353#endif
318 354
319 ///////////////////////////////////////////////////////////////////////////// 355 /////////////////////////////////////////////////////////////////////////////
356
357 if (!success)
358 {
359 slog (L_ERR, _("no protocols enabled."));
360 return -1;
361 }
320 362
321 reconnect_all (); 363 reconnect_all ();
322 364
323 ///////////////////////////////////////////////////////////////////////////// 365 /////////////////////////////////////////////////////////////////////////////
324 366
325 tap = new tap_device (); 367 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 368 if (!tap) //D this, of course, never catches
327 { 369 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 370 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 371 return -1;
330 } 372 }
331 373
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 374 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 375
376 run_script_cb cb;
377 cb.set<vpn, &vpn::script_if_init> (this);
378
334 if (tap->if_up () && 379 if (tap->if_up () &&
335 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 380 !run_script (cb, true))
336 { 381 {
337 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 382 slog (L_ERR, _("interface initialization command '%s' failed."),
338 tap->if_up ()); 383 tap->if_up ());
339 exit (EXIT_FAILURE); 384 return -1;
340 }
341
342 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
343 { 385 }
386
387 cb.set<vpn, &vpn::script_if_up> (this);
388 if (!run_script (cb, true))
389 {
344 slog (L_ERR, _("if-up command execution failed, exiting.")); 390 slog (L_ERR, _("if-up command execution failed."));
345 exit (EXIT_FAILURE); 391 return -1;
346 } 392 }
347 393
348 tap_ev_watcher.start (tap->fd, EV_READ); 394 tap_ev_watcher.start (tap->fd, EV_READ);
349 395
350 return 0; 396 return 0;
397}
398
399bool
400vpn::drop_privileges ()
401{
402 if (::conf.change_root)
403 {
404 if (!strcmp (::conf.change_root, "/"))
405 {
406 char dir [L_tmpnam];
407 if (!tmpnam (dir))
408 {
409 slog (L_CRIT, _("unable to create anonymous root path."));
410 return false;
411 }
412
413 if (mkdir (dir, 0700))
414 {
415 slog (L_CRIT, _("unable to crate anonymous root directory."));
416 return false;
417 }
418
419 if (chdir (dir))
420 {
421 slog (L_CRIT, _("unable to change to anonymous root directory."));
422 return false;
423 }
424
425 if (rmdir (dir))
426 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
427 }
428 else
429 {
430 if (chdir (::conf.change_root))
431 {
432 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
433 return false;
434 }
435 }
436
437 if (chroot ("."))
438 {
439 slog (L_CRIT, _("unable to set new root directory."));
440 return false;
441 }
442
443 if (chdir ("/"))
444 {
445 slog (L_CRIT, _("unable to set cwd to new root directory."));
446 return false;
447 }
448 }
449
450 if (::conf.change_gid)
451 if (setgid (::conf.change_gid))
452 {
453 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
454 return false;
455 }
456
457 if (::conf.change_uid)
458 if (setuid (::conf.change_uid))
459 {
460 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
461 return false;
462 }
463
464 return true;
351} 465}
352 466
353bool 467bool
354vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 468vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355{ 469{
… …
423 { 537 {
424 // broadcast, this is ugly, but due to the security policy 538 // broadcast, this is ugly, but due to the security policy
425 // we have to connect to all hosts... 539 // we have to connect to all hosts...
426 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 540 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
427 if ((*c)->conf != THISNODE) 541 if ((*c)->conf != THISNODE)
428 (*c)->inject_data_packet (pkt, true); 542 (*c)->inject_data_packet (pkt);
429 } 543 }
430} 544}
431 545
432void 546void
433vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 547vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
434{ 548{
435 unsigned int src = pkt->src (); 549 unsigned int src = pkt->src ();
436 unsigned int dst = pkt->dst (); 550 unsigned int dst = pkt->dst ();
437 551
438 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 552 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
439 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 553 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
440 554
441 if (src == 0 || src > conns.size () 555 if (src == 0 || src > conns.size ()
442 || dst > conns.size () 556 || dst > conns.size ()
443 || pkt->typ () >= vpn_packet::PT_MAX) 557 || pkt->typ () >= vpn_packet::PT_MAX)
444 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 558 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
446 else if (dst > conns.size ())
447 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
448 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 559 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
449 else 560 else
450 { 561 {
451 connection *c = conns[src - 1]; 562 connection *c = conns[src - 1];
452 563
453 if (dst == 0) 564 if (dst == 0)
454 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 565 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
455 c->conf->nodename, (const char *)rsi); 566 c->conf->nodename, (const char *)rsi);
456 else if (dst != THISNODE->id) 567 else if (dst != THISNODE->id)
457 { 568 {
458 if (THISNODE->routerprio) 569 if (THISNODE->routerprio)
459 // the tos setting gets lost here. who cares. 570 // the tos setting gets lost here. who cares.
460 conns[dst - 1]->inject_vpn_packet (pkt); 571 conns[dst - 1]->inject_vpn_packet (pkt);
461 else 572 else
462 slog (L_WARN, 573 slog (L_WARN,
463 _("%s(%s): forwarding request (=> %s), but we are no router"), 574 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
464 c->conf->nodename, (const char *)rsi, 575 c->conf->nodename, (const char *)rsi,
465 conns[dst - 1]->conf->nodename); 576 conns[dst - 1]->conf->nodename);
466 } 577 }
467 else 578 else
468 c->recv_vpn_packet (pkt, rsi); 579 c->recv_vpn_packet (pkt, rsi);
… …
473vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 584vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
474{ 585{
475 switch (si.prot) 586 switch (si.prot)
476 { 587 {
477 case PROT_IPv4: 588 case PROT_IPv4:
478 return send_ipv4_packet (pkt, si, tos); 589 return send_ipv4_packet (pkt, si, tos);
479 590
480 case PROT_UDPv4: 591 case PROT_UDPv4:
481 return send_udpv4_packet (pkt, si, tos); 592 return send_udpv4_packet (pkt, si, tos);
482 593
483#if ENABLE_TCP 594#if ENABLE_TCP
484 case PROT_TCPv4: 595 case PROT_TCPv4:
485 return send_tcpv4_packet (pkt, si, tos); 596 return send_tcpv4_packet (pkt, si, tos);
486#endif 597#endif
487#if ENABLE_ICMP 598#if ENABLE_ICMP
488 case PROT_ICMPv4: 599 case PROT_ICMPv4:
489 return send_icmpv4_packet (pkt, si, tos); 600 return send_icmpv4_packet (pkt, si, tos);
490#endif 601#endif
491#if ENABLE_DNS 602#if ENABLE_DNS
492 case PROT_DNSv4: 603 case PROT_DNSv4:
493 return send_dnsv4_packet (pkt, si, tos); 604 return send_dnsv4_packet (pkt, si, tos);
494#endif 605#endif
495 default: 606 default:
496 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 607 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
497 } 608 }
498 609
499 return false; 610 return false;
500} 611}
501 612
502void 613inline void
503vpn::ipv4_ev (ev::io &w, int revents) 614vpn::ipv4_ev (ev::io &w, int revents)
504{ 615{
505 if (revents & EV_READ) 616 if (revents & EV_READ)
506 { 617 {
507 vpn_packet *pkt = new vpn_packet; 618 vpn_packet *pkt = new vpn_packet;
… …
516 if (len > 0) 627 if (len > 0)
517 { 628 {
518 pkt->len = len; 629 pkt->len = len;
519 630
520 // raw sockets deliver the ipv4 header, but don't expect it on sends 631 // raw sockets deliver the ipv4 header, but don't expect it on sends
521 pkt->skip_hdr (IP_OVERHEAD); 632 pkt->skip_hdr (pkt->ipv4_hdr_len ());
522 633
523 recv_vpn_packet (pkt, si); 634 recv_vpn_packet (pkt, si);
524 } 635 }
525 else 636 else
526 { 637 {
527 // probably ECONNRESET or somesuch 638 // probably ECONNRESET or somesuch
528 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 639 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
529 } 640 }
530 641
531 delete pkt; 642 delete pkt;
532 } 643 }
533 else 644 else
534 { 645 {
535 slog (L_ERR, 646 slog (L_ERR,
536 _("FATAL: unknown revents %08x in socket, terminating\n"), 647 _("FATAL: unknown revents %08x in socket, exiting.\n"),
537 revents); 648 revents);
538 exit (EXIT_FAILURE); 649 exit (EXIT_FAILURE);
539 } 650 }
540} 651}
541 652
542#if ENABLE_ICMP 653#if ENABLE_ICMP
543void 654inline void
544vpn::icmpv4_ev (ev::io &w, int revents) 655vpn::icmpv4_ev (ev::io &w, int revents)
545{ 656{
546 if (revents & EV_READ) 657 if (revents & EV_READ)
547 { 658 {
548 vpn_packet *pkt = new vpn_packet; 659 vpn_packet *pkt = new vpn_packet;
… …
563 if (hdr->type == ::conf.icmp_type 674 if (hdr->type == ::conf.icmp_type
564 && hdr->code == 255) 675 && hdr->code == 255)
565 { 676 {
566 // raw sockets deliver the ipv4, but don't expect it on sends 677 // raw sockets deliver the ipv4, but don't expect it on sends
567 // this is slow, but... 678 // this is slow, but...
568 pkt->skip_hdr (ICMP_OVERHEAD); 679 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
569 680
570 recv_vpn_packet (pkt, si); 681 recv_vpn_packet (pkt, si);
571 } 682 }
572 } 683 }
573 else 684 else
574 { 685 {
575 // probably ECONNRESET or somesuch 686 // probably ECONNRESET or somesuch
576 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 687 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
577 } 688 }
578 689
579 delete pkt; 690 delete pkt;
580 } 691 }
581 else 692 else
582 { 693 {
583 slog (L_ERR, 694 slog (L_ERR,
584 _("FATAL: unknown revents %08x in socket, terminating\n"), 695 _("FATAL: unknown revents %08x in socket, exiting.\n"),
585 revents); 696 revents);
586 exit (EXIT_FAILURE); 697 exit (EXIT_FAILURE);
587 } 698 }
588} 699}
589#endif 700#endif
590 701
591void 702inline void
592vpn::udpv4_ev (ev::io &w, int revents) 703vpn::udpv4_ev (ev::io &w, int revents)
593{ 704{
594 if (revents & EV_READ) 705 if (revents & EV_READ)
595 { 706 {
596 vpn_packet *pkt = new vpn_packet; 707 vpn_packet *pkt = new vpn_packet;
… …
609 recv_vpn_packet (pkt, si); 720 recv_vpn_packet (pkt, si);
610 } 721 }
611 else 722 else
612 { 723 {
613 // probably ECONNRESET or somesuch 724 // probably ECONNRESET or somesuch
614 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 725 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
615 } 726 }
616 727
617 delete pkt; 728 delete pkt;
618 } 729 }
619 else 730 else
620 { 731 {
621 slog (L_ERR, 732 slog (L_ERR,
622 _("FATAL: unknown revents %08x in socket, terminating\n"), 733 _("FATAL: unknown revents %08x in socket, exiting.\n"),
623 revents); 734 revents);
624 exit (EXIT_FAILURE); 735 exit (EXIT_FAILURE);
625 } 736 }
626} 737}
627 738
628void 739inline void
629vpn::tap_ev (ev::io &w, int revents) 740vpn::tap_ev (ev::io &w, int revents)
630{ 741{
631 if (revents & EV_READ) 742 if (revents & EV_READ)
632 { 743 {
633 /* process data */ 744 /* process data */
… …
665 } 776 }
666 else 777 else
667 abort (); 778 abort ();
668} 779}
669 780
670void 781inline void
671vpn::event_cb (ev::timer &w, int) 782vpn::event_cb (ev::timer &w, int)
672{ 783{
673 if (events) 784 if (events)
674 { 785 {
675 if (events & EVENT_SHUTDOWN) 786 if (events & EVENT_SHUTDOWN)
676 { 787 {
677 slog (L_INFO, _("preparing shutdown...")); 788 slog (L_INFO, _("preparing shutdown..."));
678 789
679 shutdown_all (); 790 shutdown_all ();
680 remove_pid (conf.pidfilename); 791 remove_pid (conf.pidfilename);
681 slog (L_INFO, _("terminating")); 792 slog (L_INFO, _("exiting."));
682 exit (EXIT_SUCCESS); 793 exit (EXIT_SUCCESS);
683 } 794 }
684 795
685 if (events & EVENT_RECONNECT) 796 if (events & EVENT_RECONNECT)
686 { 797 {
687 slog (L_INFO, _("forced reconnect")); 798 slog (L_INFO, _("forced reconnect."));
688 799
689 reconnect_all (); 800 reconnect_all ();
690 } 801 }
691 802
692 events = 0; 803 events = 0;
… …
708 819
709 conns.clear (); 820 conns.clear ();
710 821
711 connection_init (); 822 connection_init ();
712 823
713 for (configuration::node_vector::iterator i = conf.nodes.begin (); 824 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
714 i != conf.nodes.end (); ++i) 825 conns.push_back (new connection (this, *i));
715 { 826
716 connection *conn = new connection (this, *i); 827 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
717 conns.push_back (conn);
718 conn->establish_connection (); 828 (*c)->establish_connection ();
719 }
720} 829}
721 830
722connection *vpn::find_router () 831bool
832vpn::can_direct (conf_node *src, conf_node *dst) const
723{ 833{
724 u32 prio = 1; 834 return src != dst
835 && src->may_direct (dst)
836 && dst->may_direct (src)
837 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
838 || (src->protocols & dst->connectable_protocols ()));
839}
840
841// only works for indirect and routed connections: find a router
842// from THISNODE to dst
843connection *
844vpn::find_router_for (const connection *dst)
845{
725 connection *router = 0; 846 connection *router = 0;
726 847
848 // first try to find a router with a direct connection, route there
849 // regardless of any other considerations.
850 {
851 u32 prio = 1;
852
853 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
854 {
855 connection *c = *i;
856
857 if (c->conf->routerprio > prio
858 && c->conf != THISNODE
859 && can_direct (c->conf, dst->conf)
860 && c->ictx && c->octx)
861 {
862 prio = c->conf->routerprio;
863 router = c;
864 }
865 }
866 }
867
868 if (router)
869 return router;
870
871 // second try find the router with the highest priority, higher than ours
872 {
873 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
874
875 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
876 {
877 connection *c = *i;
878
879 if (c->conf->routerprio > prio
880 && c != dst
881 && c->conf != THISNODE
882 && c->ictx && c->octx)
883 {
884 prio = c->conf->routerprio;
885 router = c;
886 }
887 }
888 }
889
890 return router;
891}
892
893void
894vpn::connection_established (connection *c)
895{
727 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 896 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
728 { 897 {
729 connection *c = *i; 898 connection *o = *i;
730 899
731 if (c->conf->routerprio > prio 900 if (!o->is_direct
732 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 901 && o->si.valid ()
733 && c->ictx && c->octx 902 && c->si != o->si
734 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 903 && c == find_router_for (o))
735 {
736 prio = c->conf->routerprio;
737 router = c;
738 } 904 {
905 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
906 o->conf->nodename, c->conf->nodename);
907 o->rekey ();
908 }
739 } 909 }
740
741 return router;
742} 910}
743 911
912void
744void vpn::send_connect_request (int id) 913vpn::send_connect_request (connection *c)
745{ 914{
746 connection *c = find_router (); 915 connection *r = find_router_for (c);
747 916
748 if (c) 917 if (r)
918 {
919 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
920 c->conf->nodename, r->conf->nodename);
749 c->send_connect_request (id); 921 r->send_connect_request (c->conf->id);
922 }
750 else 923 else
751 // no router found, aggressively connect to all routers 924 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
752 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 925 c->conf->nodename);
753 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
754 (*i)->establish_connection ();
755} 926}
756 927
757void 928void
758connection::dump_status () 929connection::dump_status ()
759{ 930{
760 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 931 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
761 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 932 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
762 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 933 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
763 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 934 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
764 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 935 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
765 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
766 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
767} 936}
768 937
769void 938void
770vpn::dump_status () 939vpn::dump_status ()
771{ 940{
… …
776 945
777 slog (L_NOTICE, _("END status dump")); 946 slog (L_NOTICE, _("END status dump"));
778} 947}
779 948
780vpn::vpn (void) 949vpn::vpn (void)
950{
781: event (this, &vpn::event_cb) 951 event .set<vpn, &vpn::event_cb > (this);
782, udpv4_ev_watcher (this, &vpn::udpv4_ev) 952 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
783, ipv4_ev_watcher (this, &vpn::ipv4_ev) 953 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
784#if ENABLE_TCP 954#if ENABLE_TCP
785, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 955 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
786#endif 956#endif
787#if ENABLE_ICMP 957#if ENABLE_ICMP
788, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 958 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
789#endif 959#endif
790#if ENABLE_DNS 960#if ENABLE_DNS
791, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 961 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
792#endif 962#endif
793, tap_ev_watcher (this, &vpn::tap_ev) 963 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
794{
795} 964}
796 965
797vpn::~vpn () 966vpn::~vpn ()
798{ 967{
799} 968}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines