ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.45 by pcg, Thu Dec 6 00:35:29 2007 UTC vs.
Revision 1.64 by root, Tue Dec 4 10:29:43 2012 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
41#include "pidfile.h" 52#include "pidfile.h"
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
57
58using namespace std;
46 59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
50 63
… …
110 123
111 return filename; 124 return filename;
112} 125}
113 126
114int 127int
128vpn::setup_socket (u8 prot, int family, int type, int proto)
129{
130 int fd = socket (family, type, proto);
131
132 if (fd < 0)
133 {
134 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
135 return fd;
136 }
137
138 fcntl (fd, F_SETFL, O_NONBLOCK);
139 fcntl (fd, F_SETFD, FD_CLOEXEC);
140
141#ifdef SO_MARK
142 if (::conf.nfmark)
143 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
144 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
145#endif
146
147 return fd;
148}
149
150int
115vpn::setup () 151vpn::setup ()
116{ 152{
153 int success = 0;
154
117 ipv4_tos = -1; 155 ipv4_tos = -1;
118 ipv4_fd = -1; 156 ipv4_fd = -1;
119 157
120 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 158 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
121 { 159 {
122 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 160 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
123 161
124 if (ipv4_fd < 0) 162 if (ipv4_fd < 0)
125 return -1; 163 return -1;
126
127 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
128 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
129 164
130#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 165#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
131 // this I really consider a linux bug. I am neither connected 166 // this I really consider a linux bug. I am neither connected
132 // nor do I fragment myself. Linux still sets DF and doesn't 167 // nor do I fragment myself. Linux still sets DF and doesn't
133 // fragment for me sometimes. 168 // fragment for me sometimes.
… …
139 174
140 sockinfo si (THISNODE, PROT_IPv4); 175 sockinfo si (THISNODE, PROT_IPv4);
141 176
142 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 177 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
143 { 178 {
144 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 179 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
145 exit (EXIT_FAILURE); 180 return -1;
146 } 181 }
147 182
148 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 183 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
184 ++success;
149 } 185 }
186 else
187 THISNODE->protocols &= ~PROT_IPv4;
150 188
151 udpv4_tos = -1; 189 udpv4_tos = -1;
152 udpv4_fd = -1; 190 udpv4_fd = -1;
153 191
154 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 192 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
155 { 193 {
156 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 194 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
157 195
158 if (udpv4_fd < 0) 196 if (udpv4_fd < 0)
159 return -1; 197 return -1;
160
161 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
162 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
163 198
164 // standard daemon practise... 199 // standard daemon practise...
165 { 200 {
166 int oval = 1; 201 int oval = 1;
167 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 202 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
179 214
180 sockinfo si (THISNODE, PROT_UDPv4); 215 sockinfo si (THISNODE, PROT_UDPv4);
181 216
182 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 217 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
183 { 218 {
184 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 219 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
185 exit (EXIT_FAILURE); 220 return -1;
186 } 221 }
187 222
188 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 223 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
224 ++success;
189 } 225 }
226 else
227 THISNODE->protocols &= ~PROT_UDPv4;
190 228
191 icmpv4_tos = -1; 229 icmpv4_tos = -1;
192 icmpv4_fd = -1; 230 icmpv4_fd = -1;
193 231
194#if ENABLE_ICMP 232#if ENABLE_ICMP
195 if (THISNODE->protocols & PROT_ICMPv4) 233 if (THISNODE->protocols & PROT_ICMPv4)
196 { 234 {
197 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 235 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
198 236
199 if (icmpv4_fd < 0) 237 if (icmpv4_fd < 0)
200 return -1; 238 return -1;
201
202 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
203 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
204 239
205#ifdef ICMP_FILTER 240#ifdef ICMP_FILTER
206 { 241 {
207 icmp_filter oval; 242 icmp_filter oval;
208 oval.data = 0xffffffff; 243 oval.data = 0xffffffff;
… …
225 260
226 sockinfo si (THISNODE, PROT_ICMPv4); 261 sockinfo si (THISNODE, PROT_ICMPv4);
227 262
228 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 263 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
229 { 264 {
230 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 265 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
231 exit (EXIT_FAILURE); 266 return -1;
232 } 267 }
233 268
234 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 269 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
270 ++success;
235 } 271 }
236#endif 272#endif
237 273
238 tcpv4_fd = -1; 274 tcpv4_fd = -1;
239 275
240#if ENABLE_TCP 276#if ENABLE_TCP
241 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 277 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
242 { 278 {
243 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 279 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
244 280
245 if (tcpv4_fd < 0) 281 if (tcpv4_fd < 0)
246 return -1; 282 return -1;
247 283
248 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
249 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
250
251 // standard daemon practise... 284 // standard daemon practise...
252 { 285 {
253 int oval = 1; 286 int oval = 1;
254 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 287 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
255 } 288 }
256 289
257 sockinfo si (THISNODE, PROT_TCPv4); 290 sockinfo si (THISNODE, PROT_TCPv4);
258 291
259 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 292 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
260 { 293 {
261 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 294 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
262 exit (EXIT_FAILURE); 295 return -1;
263 } 296 }
264 297
265 if (listen (tcpv4_fd, 5)) 298 if (listen (tcpv4_fd, 5))
266 { 299 {
267 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 300 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
268 exit (EXIT_FAILURE); 301 return -1;
269 } 302 }
270 303
271 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 304 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
305 ++success;
272 } 306 }
307 else
308 THISNODE->protocols &= ~PROT_TCPv4;
273#endif 309#endif
274 310
275 dnsv4_tos = -1; 311 dnsv4_tos = -1;
276 dnsv4_fd = -1; 312 dnsv4_fd = -1;
277 313
278#if ENABLE_DNS 314#if ENABLE_DNS
279 if (THISNODE->protocols & PROT_DNSv4) 315 if (THISNODE->protocols & PROT_DNSv4)
280 { 316 {
281 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 317 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
282 318
283 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 319 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
284 320
285 if (dnsv4_fd < 0) 321 if (dnsv4_fd < 0)
286 return -1; 322 return -1;
287
288 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
289 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
290 323
291# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 324# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
292 // this I really consider a linux bug. I am neither connected 325 // this I really consider a linux bug. I am neither connected
293 // nor do I fragment myself. Linux still sets DF and doesn't 326 // nor do I fragment myself. Linux still sets DF and doesn't
294 // fragment for me sometimes. 327 // fragment for me sometimes.
… …
308 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 341 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
309 PROT_DNSv4); 342 PROT_DNSv4);
310 343
311 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 344 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
312 { 345 {
313 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 346 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
314 exit (EXIT_FAILURE); 347 return -1;
315 } 348 }
316 349
317 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 350 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
351 ++success;
318 } 352 }
319#endif 353#endif
320 354
321 ///////////////////////////////////////////////////////////////////////////// 355 /////////////////////////////////////////////////////////////////////////////
356
357 if (!success)
358 {
359 slog (L_ERR, _("no protocols enabled."));
360 return -1;
361 }
322 362
323 reconnect_all (); 363 reconnect_all ();
324 364
325 ///////////////////////////////////////////////////////////////////////////// 365 /////////////////////////////////////////////////////////////////////////////
326 366
327 tap = new tap_device (); 367 tap = new tap_device ();
328 if (!tap) //D this, of course, never catches 368 if (!tap) //D this, of course, never catches
329 { 369 {
330 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 370 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
331 exit (EXIT_FAILURE); 371 return -1;
332 } 372 }
333 373
334 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 374 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
335 375
336 run_script_cb cb; 376 run_script_cb cb;
337 cb.set<vpn, &vpn::script_if_init> (this); 377 cb.set<vpn, &vpn::script_if_init> (this);
338 378
339 if (tap->if_up () && 379 if (tap->if_up () &&
340 !run_script (cb, true)) 380 !run_script (cb, true))
341 { 381 {
342 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 382 slog (L_ERR, _("interface initialization command '%s' failed."),
343 tap->if_up ()); 383 tap->if_up ());
344 exit (EXIT_FAILURE); 384 return -1;
345 } 385 }
346 386
347 cb.set<vpn, &vpn::script_if_up> (this); 387 cb.set<vpn, &vpn::script_if_up> (this);
348 if (!run_script (cb, true)) 388 if (!run_script (cb, true))
349 { 389 {
350 slog (L_ERR, _("if-up command execution failed, exiting.")); 390 slog (L_ERR, _("if-up command execution failed."));
351 exit (EXIT_FAILURE); 391 return -1;
352 } 392 }
353 393
354 tap_ev_watcher.start (tap->fd, EV_READ); 394 tap_ev_watcher.start (tap->fd, EV_READ);
355 395
356 return 0; 396 return 0;
397}
398
399bool
400vpn::drop_privileges ()
401{
402 if (::conf.change_root)
403 {
404 if (!strcmp (::conf.change_root, "/"))
405 {
406 char dir [L_tmpnam];
407 if (!tmpnam (dir))
408 {
409 slog (L_CRIT, _("unable to create anonymous root path."));
410 return false;
411 }
412
413 if (mkdir (dir, 0700))
414 {
415 slog (L_CRIT, _("unable to crate anonymous root directory."));
416 return false;
417 }
418
419 if (chdir (dir))
420 {
421 slog (L_CRIT, _("unable to change to anonymous root directory."));
422 return false;
423 }
424
425 if (rmdir (dir))
426 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
427 }
428 else
429 {
430 if (chdir (::conf.change_root))
431 {
432 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
433 return false;
434 }
435 }
436
437 if (chroot ("."))
438 {
439 slog (L_CRIT, _("unable to set new root directory."));
440 return false;
441 }
442
443 if (chdir ("/"))
444 {
445 slog (L_CRIT, _("unable to set cwd to new root directory."));
446 return false;
447 }
448 }
449
450 if (::conf.change_gid)
451 if (setgid (::conf.change_gid))
452 {
453 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
454 return false;
455 }
456
457 if (::conf.change_uid)
458 if (setuid (::conf.change_uid))
459 {
460 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
461 return false;
462 }
463
464 return true;
357} 465}
358 466
359bool 467bool
360vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 468vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
361{ 469{
… …
429 { 537 {
430 // broadcast, this is ugly, but due to the security policy 538 // broadcast, this is ugly, but due to the security policy
431 // we have to connect to all hosts... 539 // we have to connect to all hosts...
432 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 540 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
433 if ((*c)->conf != THISNODE) 541 if ((*c)->conf != THISNODE)
434 (*c)->inject_data_packet (pkt, true); 542 (*c)->inject_data_packet (pkt);
435 } 543 }
436} 544}
437 545
438void 546void
439vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 547vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
440{ 548{
441 unsigned int src = pkt->src (); 549 unsigned int src = pkt->src ();
442 unsigned int dst = pkt->dst (); 550 unsigned int dst = pkt->dst ();
443 551
444 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 552 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 553 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
446 554
447 if (src == 0 || src > conns.size () 555 if (src == 0 || src > conns.size ()
448 || dst > conns.size () 556 || dst > conns.size ()
449 || pkt->typ () >= vpn_packet::PT_MAX) 557 || pkt->typ () >= vpn_packet::PT_MAX)
450 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 558 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
451 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
452 else if (dst > conns.size ())
453 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
454 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 559 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
455 else 560 else
456 { 561 {
457 connection *c = conns[src - 1]; 562 connection *c = conns[src - 1];
458 563
459 if (dst == 0) 564 if (dst == 0)
460 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 565 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
461 c->conf->nodename, (const char *)rsi); 566 c->conf->nodename, (const char *)rsi);
462 else if (dst != THISNODE->id) 567 else if (dst != THISNODE->id)
463 { 568 {
464 if (THISNODE->routerprio) 569 if (THISNODE->routerprio)
465 // the tos setting gets lost here. who cares. 570 // the tos setting gets lost here. who cares.
466 conns[dst - 1]->inject_vpn_packet (pkt); 571 conns[dst - 1]->inject_vpn_packet (pkt);
467 else 572 else
468 slog (L_WARN, 573 slog (L_WARN,
469 _("%s(%s): forwarding request (=> %s), but we are no router"), 574 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
470 c->conf->nodename, (const char *)rsi, 575 c->conf->nodename, (const char *)rsi,
471 conns[dst - 1]->conf->nodename); 576 conns[dst - 1]->conf->nodename);
472 } 577 }
473 else 578 else
474 c->recv_vpn_packet (pkt, rsi); 579 c->recv_vpn_packet (pkt, rsi);
… …
479vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 584vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
480{ 585{
481 switch (si.prot) 586 switch (si.prot)
482 { 587 {
483 case PROT_IPv4: 588 case PROT_IPv4:
484 return send_ipv4_packet (pkt, si, tos); 589 return send_ipv4_packet (pkt, si, tos);
485 590
486 case PROT_UDPv4: 591 case PROT_UDPv4:
487 return send_udpv4_packet (pkt, si, tos); 592 return send_udpv4_packet (pkt, si, tos);
488 593
489#if ENABLE_TCP 594#if ENABLE_TCP
490 case PROT_TCPv4: 595 case PROT_TCPv4:
491 return send_tcpv4_packet (pkt, si, tos); 596 return send_tcpv4_packet (pkt, si, tos);
492#endif 597#endif
493#if ENABLE_ICMP 598#if ENABLE_ICMP
494 case PROT_ICMPv4: 599 case PROT_ICMPv4:
495 return send_icmpv4_packet (pkt, si, tos); 600 return send_icmpv4_packet (pkt, si, tos);
496#endif 601#endif
497#if ENABLE_DNS 602#if ENABLE_DNS
498 case PROT_DNSv4: 603 case PROT_DNSv4:
499 return send_dnsv4_packet (pkt, si, tos); 604 return send_dnsv4_packet (pkt, si, tos);
500#endif 605#endif
501 default: 606 default:
502 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 607 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
503 } 608 }
504 609
505 return false; 610 return false;
506} 611}
507 612
… …
522 if (len > 0) 627 if (len > 0)
523 { 628 {
524 pkt->len = len; 629 pkt->len = len;
525 630
526 // raw sockets deliver the ipv4 header, but don't expect it on sends 631 // raw sockets deliver the ipv4 header, but don't expect it on sends
527 pkt->skip_hdr (IP_OVERHEAD); 632 pkt->skip_hdr (pkt->ipv4_hdr_len ());
528 633
529 recv_vpn_packet (pkt, si); 634 recv_vpn_packet (pkt, si);
530 } 635 }
531 else 636 else
532 { 637 {
533 // probably ECONNRESET or somesuch 638 // probably ECONNRESET or somesuch
534 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 639 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
535 } 640 }
536 641
537 delete pkt; 642 delete pkt;
538 } 643 }
539 else 644 else
540 { 645 {
541 slog (L_ERR, 646 slog (L_ERR,
542 _("FATAL: unknown revents %08x in socket, terminating\n"), 647 _("FATAL: unknown revents %08x in socket, exiting.\n"),
543 revents); 648 revents);
544 exit (EXIT_FAILURE); 649 exit (EXIT_FAILURE);
545 } 650 }
546} 651}
547 652
… …
569 if (hdr->type == ::conf.icmp_type 674 if (hdr->type == ::conf.icmp_type
570 && hdr->code == 255) 675 && hdr->code == 255)
571 { 676 {
572 // raw sockets deliver the ipv4, but don't expect it on sends 677 // raw sockets deliver the ipv4, but don't expect it on sends
573 // this is slow, but... 678 // this is slow, but...
574 pkt->skip_hdr (ICMP_OVERHEAD); 679 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
575 680
576 recv_vpn_packet (pkt, si); 681 recv_vpn_packet (pkt, si);
577 } 682 }
578 } 683 }
579 else 684 else
580 { 685 {
581 // probably ECONNRESET or somesuch 686 // probably ECONNRESET or somesuch
582 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 687 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
583 } 688 }
584 689
585 delete pkt; 690 delete pkt;
586 } 691 }
587 else 692 else
588 { 693 {
589 slog (L_ERR, 694 slog (L_ERR,
590 _("FATAL: unknown revents %08x in socket, terminating\n"), 695 _("FATAL: unknown revents %08x in socket, exiting.\n"),
591 revents); 696 revents);
592 exit (EXIT_FAILURE); 697 exit (EXIT_FAILURE);
593 } 698 }
594} 699}
595#endif 700#endif
… …
615 recv_vpn_packet (pkt, si); 720 recv_vpn_packet (pkt, si);
616 } 721 }
617 else 722 else
618 { 723 {
619 // probably ECONNRESET or somesuch 724 // probably ECONNRESET or somesuch
620 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 725 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
621 } 726 }
622 727
623 delete pkt; 728 delete pkt;
624 } 729 }
625 else 730 else
626 { 731 {
627 slog (L_ERR, 732 slog (L_ERR,
628 _("FATAL: unknown revents %08x in socket, terminating\n"), 733 _("FATAL: unknown revents %08x in socket, exiting.\n"),
629 revents); 734 revents);
630 exit (EXIT_FAILURE); 735 exit (EXIT_FAILURE);
631 } 736 }
632} 737}
633 738
… …
682 { 787 {
683 slog (L_INFO, _("preparing shutdown...")); 788 slog (L_INFO, _("preparing shutdown..."));
684 789
685 shutdown_all (); 790 shutdown_all ();
686 remove_pid (conf.pidfilename); 791 remove_pid (conf.pidfilename);
687 slog (L_INFO, _("terminating")); 792 slog (L_INFO, _("exiting."));
688 exit (EXIT_SUCCESS); 793 exit (EXIT_SUCCESS);
689 } 794 }
690 795
691 if (events & EVENT_RECONNECT) 796 if (events & EVENT_RECONNECT)
692 { 797 {
693 slog (L_INFO, _("forced reconnect")); 798 slog (L_INFO, _("forced reconnect."));
694 799
695 reconnect_all (); 800 reconnect_all ();
696 } 801 }
697 802
698 events = 0; 803 events = 0;
… …
714 819
715 conns.clear (); 820 conns.clear ();
716 821
717 connection_init (); 822 connection_init ();
718 823
719 for (configuration::node_vector::iterator i = conf.nodes.begin (); 824 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
720 i != conf.nodes.end (); ++i) 825 conns.push_back (new connection (this, *i));
721 { 826
722 connection *conn = new connection (this, *i); 827 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
723 conns.push_back (conn);
724 conn->establish_connection (); 828 (*c)->establish_connection ();
725 }
726} 829}
727 830
728connection *vpn::find_router () 831bool
832vpn::can_direct (conf_node *src, conf_node *dst) const
729{ 833{
730 u32 prio = 1; 834 return src != dst
835 && src->may_direct (dst)
836 && dst->may_direct (src)
837 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
838 || (src->protocols & dst->connectable_protocols ()));
839}
840
841// only works for indirect and routed connections: find a router
842// from THISNODE to dst
843connection *
844vpn::find_router_for (const connection *dst)
845{
731 connection *router = 0; 846 connection *router = 0;
732 847
848 // first try to find a router with a direct connection, route there
849 // regardless of any other considerations.
850 {
851 u32 prio = 1;
852
853 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
854 {
855 connection *c = *i;
856
857 if (c->conf->routerprio > prio
858 && c->conf != THISNODE
859 && can_direct (c->conf, dst->conf)
860 && c->ictx && c->octx)
861 {
862 prio = c->conf->routerprio;
863 router = c;
864 }
865 }
866 }
867
868 if (router)
869 return router;
870
871 // second try find the router with the highest priority, higher than ours
872 {
873 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
874
875 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
876 {
877 connection *c = *i;
878
879 if (c->conf->routerprio > prio
880 && c != dst
881 && c->conf != THISNODE
882 && c->ictx && c->octx)
883 {
884 prio = c->conf->routerprio;
885 router = c;
886 }
887 }
888 }
889
890 return router;
891}
892
893void
894vpn::connection_established (connection *c)
895{
733 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 896 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
734 { 897 {
735 connection *c = *i; 898 connection *o = *i;
736 899
737 if (c->conf->routerprio > prio 900 if (!o->is_direct
738 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 901 && o->si.valid ()
739 && c->ictx && c->octx 902 && c->si != o->si
740 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 903 && c == find_router_for (o))
741 {
742 prio = c->conf->routerprio;
743 router = c;
744 } 904 {
905 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
906 o->conf->nodename, c->conf->nodename);
907 o->rekey ();
908 }
745 } 909 }
746
747 return router;
748} 910}
749 911
912void
750void vpn::send_connect_request (int id) 913vpn::send_connect_request (connection *c)
751{ 914{
752 connection *c = find_router (); 915 connection *r = find_router_for (c);
753 916
754 if (c) 917 if (r)
918 {
919 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
920 c->conf->nodename, r->conf->nodename);
755 c->send_connect_request (id); 921 r->send_connect_request (c->conf->id);
922 }
756 else 923 else
757 // no router found, aggressively connect to all routers 924 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
758 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 925 c->conf->nodename);
759 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
760 (*i)->establish_connection ();
761} 926}
762 927
763void 928void
764connection::dump_status () 929connection::dump_status ()
765{ 930{
766 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 931 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
767 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 932 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
768 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 933 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
769 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 934 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
770 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 935 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
771 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
772 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
773} 936}
774 937
775void 938void
776vpn::dump_status () 939vpn::dump_status ()
777{ 940{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines