ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.41 by pcg, Sun Dec 2 00:20:19 2007 UTC vs.
Revision 1.66 by root, Thu Jul 18 13:35:16 2013 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
50 63
51static void inline 64static void inline
… …
65{ 78{
66 // the tunnel device mtu should be the physical mtu - overhead 79 // the tunnel device mtu should be the physical mtu - overhead
67 // the tricky part is rounding to the cipher key blocksize 80 // the tricky part is rounding to the cipher key blocksize
68 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 81 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
69 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 82 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
70 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 83 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
71 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 84 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
72 85
73 char *env; 86 char *env;
74 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 87 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
75 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 88 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 100 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 101 (*c)->script_init_env (ext);
89 } 102 }
90} 103}
91 104
105inline const char *
92const char *vpn::script_if_init () 106vpn::script_if_init ()
93{ 107{
94 script_init_env (); 108 script_init_env ();
95 109
96 return tap->if_up (); 110 return tap->if_up ();
97} 111}
98 112
113inline const char *
99const char *vpn::script_if_up () 114vpn::script_if_up ()
100{ 115{
101 script_init_env (); 116 script_init_env ();
102 117
103 char *filename; 118 return conf.config_filename (::conf.script_if_up, "if-up");
104 asprintf (&filename, 119}
105 "%s/%s",
106 confbase,
107 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
108 120
109 return filename; 121int
122vpn::setup_socket (u8 prot, int family, int type, int proto)
123{
124 int fd = socket (family, type, proto);
125
126 if (fd < 0)
127 {
128 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
129 return fd;
130 }
131
132 fcntl (fd, F_SETFL, O_NONBLOCK);
133 fcntl (fd, F_SETFD, FD_CLOEXEC);
134
135#ifdef SO_MARK
136 if (::conf.nfmark)
137 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
138 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
139#endif
140
141 return fd;
110} 142}
111 143
112int 144int
113vpn::setup () 145vpn::setup ()
114{ 146{
147 int success = 0;
148
115 ipv4_tos = -1; 149 ipv4_tos = -1;
116 ipv4_fd = -1; 150 ipv4_fd = -1;
117 151
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 152 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 153 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 154 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 155
122 if (ipv4_fd < 0) 156 if (ipv4_fd < 0)
123 return -1; 157 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 158
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 159#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 160 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 161 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 162 // fragment for me sometimes.
… …
137 168
138 sockinfo si (THISNODE, PROT_IPv4); 169 sockinfo si (THISNODE, PROT_IPv4);
139 170
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 171 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 172 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 173 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 174 return -1;
144 } 175 }
145 176
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 177 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
178 ++success;
147 } 179 }
180 else
181 THISNODE->protocols &= ~PROT_IPv4;
148 182
149 udpv4_tos = -1; 183 udpv4_tos = -1;
150 udpv4_fd = -1; 184 udpv4_fd = -1;
151 185
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 186 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 187 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 188 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 189
156 if (udpv4_fd < 0) 190 if (udpv4_fd < 0)
157 return -1; 191 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 192
162 // standard daemon practise... 193 // standard daemon practise...
163 { 194 {
164 int oval = 1; 195 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 196 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 208
178 sockinfo si (THISNODE, PROT_UDPv4); 209 sockinfo si (THISNODE, PROT_UDPv4);
179 210
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 211 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 212 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 213 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 214 return -1;
184 } 215 }
185 216
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 217 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
218 ++success;
187 } 219 }
220 else
221 THISNODE->protocols &= ~PROT_UDPv4;
188 222
189 icmpv4_tos = -1; 223 icmpv4_tos = -1;
190 icmpv4_fd = -1; 224 icmpv4_fd = -1;
191 225
192#if ENABLE_ICMP 226#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 227 if (THISNODE->protocols & PROT_ICMPv4)
194 { 228 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 229 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 230
197 if (icmpv4_fd < 0) 231 if (icmpv4_fd < 0)
198 return -1; 232 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 233
203#ifdef ICMP_FILTER 234#ifdef ICMP_FILTER
204 { 235 {
205 icmp_filter oval; 236 icmp_filter oval;
206 oval.data = 0xffffffff; 237 oval.data = 0xffffffff;
… …
223 254
224 sockinfo si (THISNODE, PROT_ICMPv4); 255 sockinfo si (THISNODE, PROT_ICMPv4);
225 256
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 257 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 258 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 259 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 260 return -1;
230 } 261 }
231 262
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 263 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
264 ++success;
233 } 265 }
234#endif 266#endif
235 267
236 tcpv4_fd = -1; 268 tcpv4_fd = -1;
237 269
238#if ENABLE_TCP 270#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 271 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 272 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 273 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 274
243 if (tcpv4_fd < 0) 275 if (tcpv4_fd < 0)
244 return -1; 276 return -1;
245 277
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 278 // standard daemon practise...
250 { 279 {
251 int oval = 1; 280 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 281 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 282 }
254 283
255 sockinfo si (THISNODE, PROT_TCPv4); 284 sockinfo si (THISNODE, PROT_TCPv4);
256 285
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 286 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 287 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 288 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 289 return -1;
261 } 290 }
262 291
263 if (listen (tcpv4_fd, 5)) 292 if (listen (tcpv4_fd, 5))
264 { 293 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 294 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 295 return -1;
267 } 296 }
268 297
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 298 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
299 ++success;
270 } 300 }
301 else
302 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 303#endif
272 304
273 dnsv4_tos = -1; 305 dnsv4_tos = -1;
274 dnsv4_fd = -1; 306 dnsv4_fd = -1;
275 307
276#if ENABLE_DNS 308#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 309 if (THISNODE->protocols & PROT_DNSv4)
278 { 310 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 311 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 312
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 313 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 314
283 if (dnsv4_fd < 0) 315 if (dnsv4_fd < 0)
284 return -1; 316 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 317
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 318# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 319 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 320 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 321 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 335 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 336 PROT_DNSv4);
308 337
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 338 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 339 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 340 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 341 return -1;
313 } 342 }
314 343
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 344 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
345 ++success;
316 } 346 }
317#endif 347#endif
318 348
319 ///////////////////////////////////////////////////////////////////////////// 349 /////////////////////////////////////////////////////////////////////////////
350
351 if (!success)
352 {
353 slog (L_ERR, _("no protocols enabled."));
354 return -1;
355 }
320 356
321 reconnect_all (); 357 reconnect_all ();
322 358
323 ///////////////////////////////////////////////////////////////////////////// 359 /////////////////////////////////////////////////////////////////////////////
324 360
325 tap = new tap_device (); 361 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 362 if (!tap) //D this, of course, never catches
327 { 363 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 364 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 365 return -1;
330 } 366 }
331 367
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 368 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 369
370 run_script_cb cb;
371 cb.set<vpn, &vpn::script_if_init> (this);
372
334 if (tap->if_up () && 373 if (tap->if_up () &&
335 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 374 !run_script (cb, true))
336 { 375 {
337 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 376 slog (L_ERR, _("interface initialization command '%s' failed."),
338 tap->if_up ()); 377 tap->if_up ());
339 exit (EXIT_FAILURE); 378 return -1;
340 }
341
342 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
343 { 379 }
380
381 cb.set<vpn, &vpn::script_if_up> (this);
382 if (!run_script (cb, true))
383 {
344 slog (L_ERR, _("if-up command execution failed, exiting.")); 384 slog (L_ERR, _("if-up command execution failed."));
345 exit (EXIT_FAILURE); 385 return -1;
346 } 386 }
347 387
348 tap_ev_watcher.start (tap->fd, EV_READ); 388 tap_ev_watcher.start (tap->fd, EV_READ);
349 389
350 return 0; 390 return 0;
391}
392
393bool
394vpn::drop_privileges ()
395{
396 if (::conf.change_root)
397 {
398 if (!strcmp (::conf.change_root, "/"))
399 {
400 char dir [L_tmpnam];
401 if (!tmpnam (dir))
402 {
403 slog (L_CRIT, _("unable to create anonymous root path."));
404 return false;
405 }
406
407 if (mkdir (dir, 0700))
408 {
409 slog (L_CRIT, _("unable to crate anonymous root directory."));
410 return false;
411 }
412
413 if (chdir (dir))
414 {
415 slog (L_CRIT, _("unable to change to anonymous root directory."));
416 return false;
417 }
418
419 if (rmdir (dir))
420 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
421 }
422 else
423 {
424 if (chdir (::conf.change_root))
425 {
426 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
427 return false;
428 }
429 }
430
431 if (chroot ("."))
432 {
433 slog (L_CRIT, _("unable to set new root directory."));
434 return false;
435 }
436
437 if (chdir ("/"))
438 {
439 slog (L_CRIT, _("unable to set cwd to new root directory."));
440 return false;
441 }
442 }
443
444 if (::conf.change_gid)
445 if (setgid (::conf.change_gid))
446 {
447 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
448 return false;
449 }
450
451 if (::conf.change_uid)
452 if (setuid (::conf.change_uid))
453 {
454 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
455 return false;
456 }
457
458 return true;
351} 459}
352 460
353bool 461bool
354vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 462vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355{ 463{
… …
423 { 531 {
424 // broadcast, this is ugly, but due to the security policy 532 // broadcast, this is ugly, but due to the security policy
425 // we have to connect to all hosts... 533 // we have to connect to all hosts...
426 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 534 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
427 if ((*c)->conf != THISNODE) 535 if ((*c)->conf != THISNODE)
428 (*c)->inject_data_packet (pkt, true); 536 (*c)->inject_data_packet (pkt);
429 } 537 }
430} 538}
431 539
432void 540void
433vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 541vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
434{ 542{
435 unsigned int src = pkt->src (); 543 unsigned int src = pkt->src ();
436 unsigned int dst = pkt->dst (); 544 unsigned int dst = pkt->dst ();
437 545
438 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 546 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
439 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 547 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
440 548
441 if (src == 0 || src > conns.size () 549 if (src == 0 || src > conns.size ()
442 || dst > conns.size () 550 || dst > conns.size ()
443 || pkt->typ () >= vpn_packet::PT_MAX) 551 || pkt->typ () >= vpn_packet::PT_MAX)
444 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 552 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
446 else if (dst > conns.size ())
447 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
448 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 553 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
449 else 554 else
450 { 555 {
451 connection *c = conns[src - 1]; 556 connection *c = conns[src - 1];
452 557
453 if (dst == 0) 558 if (dst == 0)
454 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 559 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
455 c->conf->nodename, (const char *)rsi); 560 c->conf->nodename, (const char *)rsi);
456 else if (dst != THISNODE->id) 561 else if (dst != THISNODE->id)
457 { 562 {
458 if (THISNODE->routerprio) 563 if (THISNODE->routerprio)
459 // the tos setting gets lost here. who cares. 564 // the tos setting gets lost here. who cares.
460 conns[dst - 1]->inject_vpn_packet (pkt); 565 conns[dst - 1]->inject_vpn_packet (pkt);
461 else 566 else
462 slog (L_WARN, 567 slog (L_WARN,
463 _("%s(%s): forwarding request (=> %s), but we are no router"), 568 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
464 c->conf->nodename, (const char *)rsi, 569 c->conf->nodename, (const char *)rsi,
465 conns[dst - 1]->conf->nodename); 570 conns[dst - 1]->conf->nodename);
466 } 571 }
467 else 572 else
468 c->recv_vpn_packet (pkt, rsi); 573 c->recv_vpn_packet (pkt, rsi);
… …
473vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 578vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
474{ 579{
475 switch (si.prot) 580 switch (si.prot)
476 { 581 {
477 case PROT_IPv4: 582 case PROT_IPv4:
478 return send_ipv4_packet (pkt, si, tos); 583 return send_ipv4_packet (pkt, si, tos);
479 584
480 case PROT_UDPv4: 585 case PROT_UDPv4:
481 return send_udpv4_packet (pkt, si, tos); 586 return send_udpv4_packet (pkt, si, tos);
482 587
483#if ENABLE_TCP 588#if ENABLE_TCP
484 case PROT_TCPv4: 589 case PROT_TCPv4:
485 return send_tcpv4_packet (pkt, si, tos); 590 return send_tcpv4_packet (pkt, si, tos);
486#endif 591#endif
487#if ENABLE_ICMP 592#if ENABLE_ICMP
488 case PROT_ICMPv4: 593 case PROT_ICMPv4:
489 return send_icmpv4_packet (pkt, si, tos); 594 return send_icmpv4_packet (pkt, si, tos);
490#endif 595#endif
491#if ENABLE_DNS 596#if ENABLE_DNS
492 case PROT_DNSv4: 597 case PROT_DNSv4:
493 return send_dnsv4_packet (pkt, si, tos); 598 return send_dnsv4_packet (pkt, si, tos);
494#endif 599#endif
495 default: 600 default:
496 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 601 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
497 } 602 }
498 603
499 return false; 604 return false;
500} 605}
501 606
502void 607inline void
503vpn::ipv4_ev (ev::io &w, int revents) 608vpn::ipv4_ev (ev::io &w, int revents)
504{ 609{
505 if (revents & EV_READ) 610 if (revents & EV_READ)
506 { 611 {
507 vpn_packet *pkt = new vpn_packet; 612 vpn_packet *pkt = new vpn_packet;
… …
516 if (len > 0) 621 if (len > 0)
517 { 622 {
518 pkt->len = len; 623 pkt->len = len;
519 624
520 // raw sockets deliver the ipv4 header, but don't expect it on sends 625 // raw sockets deliver the ipv4 header, but don't expect it on sends
521 pkt->skip_hdr (IP_OVERHEAD); 626 pkt->skip_hdr (pkt->ipv4_hdr_len ());
522 627
523 recv_vpn_packet (pkt, si); 628 recv_vpn_packet (pkt, si);
524 } 629 }
525 else 630 else
526 { 631 {
527 // probably ECONNRESET or somesuch 632 // probably ECONNRESET or somesuch
528 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 633 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
529 } 634 }
530 635
531 delete pkt; 636 delete pkt;
532 } 637 }
533 else 638 else
534 { 639 {
535 slog (L_ERR, 640 slog (L_ERR,
536 _("FATAL: unknown revents %08x in socket, terminating\n"), 641 _("FATAL: unknown revents %08x in socket, exiting.\n"),
537 revents); 642 revents);
538 exit (EXIT_FAILURE); 643 exit (EXIT_FAILURE);
539 } 644 }
540} 645}
541 646
542#if ENABLE_ICMP 647#if ENABLE_ICMP
543void 648inline void
544vpn::icmpv4_ev (ev::io &w, int revents) 649vpn::icmpv4_ev (ev::io &w, int revents)
545{ 650{
546 if (revents & EV_READ) 651 if (revents & EV_READ)
547 { 652 {
548 vpn_packet *pkt = new vpn_packet; 653 vpn_packet *pkt = new vpn_packet;
… …
563 if (hdr->type == ::conf.icmp_type 668 if (hdr->type == ::conf.icmp_type
564 && hdr->code == 255) 669 && hdr->code == 255)
565 { 670 {
566 // raw sockets deliver the ipv4, but don't expect it on sends 671 // raw sockets deliver the ipv4, but don't expect it on sends
567 // this is slow, but... 672 // this is slow, but...
568 pkt->skip_hdr (ICMP_OVERHEAD); 673 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
569 674
570 recv_vpn_packet (pkt, si); 675 recv_vpn_packet (pkt, si);
571 } 676 }
572 } 677 }
573 else 678 else
574 { 679 {
575 // probably ECONNRESET or somesuch 680 // probably ECONNRESET or somesuch
576 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 681 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
577 } 682 }
578 683
579 delete pkt; 684 delete pkt;
580 } 685 }
581 else 686 else
582 { 687 {
583 slog (L_ERR, 688 slog (L_ERR,
584 _("FATAL: unknown revents %08x in socket, terminating\n"), 689 _("FATAL: unknown revents %08x in socket, exiting.\n"),
585 revents); 690 revents);
586 exit (EXIT_FAILURE); 691 exit (EXIT_FAILURE);
587 } 692 }
588} 693}
589#endif 694#endif
590 695
591void 696inline void
592vpn::udpv4_ev (ev::io &w, int revents) 697vpn::udpv4_ev (ev::io &w, int revents)
593{ 698{
594 if (revents & EV_READ) 699 if (revents & EV_READ)
595 { 700 {
596 vpn_packet *pkt = new vpn_packet; 701 vpn_packet *pkt = new vpn_packet;
… …
609 recv_vpn_packet (pkt, si); 714 recv_vpn_packet (pkt, si);
610 } 715 }
611 else 716 else
612 { 717 {
613 // probably ECONNRESET or somesuch 718 // probably ECONNRESET or somesuch
614 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 719 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
615 } 720 }
616 721
617 delete pkt; 722 delete pkt;
618 } 723 }
619 else 724 else
620 { 725 {
621 slog (L_ERR, 726 slog (L_ERR,
622 _("FATAL: unknown revents %08x in socket, terminating\n"), 727 _("FATAL: unknown revents %08x in socket, exiting.\n"),
623 revents); 728 revents);
624 exit (EXIT_FAILURE); 729 exit (EXIT_FAILURE);
625 } 730 }
626} 731}
627 732
628void 733inline void
629vpn::tap_ev (ev::io &w, int revents) 734vpn::tap_ev (ev::io &w, int revents)
630{ 735{
631 if (revents & EV_READ) 736 if (revents & EV_READ)
632 { 737 {
633 /* process data */ 738 /* process data */
… …
665 } 770 }
666 else 771 else
667 abort (); 772 abort ();
668} 773}
669 774
670void 775inline void
671vpn::event_cb (ev::timer &w, int) 776vpn::event_cb (ev::timer &w, int)
672{ 777{
673 if (events) 778 if (events)
674 { 779 {
675 if (events & EVENT_SHUTDOWN) 780 if (events & EVENT_SHUTDOWN)
676 { 781 {
677 slog (L_INFO, _("preparing shutdown...")); 782 slog (L_INFO, _("preparing shutdown..."));
678 783
679 shutdown_all (); 784 shutdown_all ();
680 remove_pid (conf.pidfilename); 785 remove_pid (conf.pidfilename);
681 slog (L_INFO, _("terminating")); 786 slog (L_INFO, _("exiting."));
682 exit (EXIT_SUCCESS); 787 exit (EXIT_SUCCESS);
683 } 788 }
684 789
685 if (events & EVENT_RECONNECT) 790 if (events & EVENT_RECONNECT)
686 { 791 {
687 slog (L_INFO, _("forced reconnect")); 792 slog (L_INFO, _("forced reconnect."));
688 793
689 reconnect_all (); 794 reconnect_all ();
690 } 795 }
691 796
692 events = 0; 797 events = 0;
… …
708 813
709 conns.clear (); 814 conns.clear ();
710 815
711 connection_init (); 816 connection_init ();
712 817
713 for (configuration::node_vector::iterator i = conf.nodes.begin (); 818 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
714 i != conf.nodes.end (); ++i) 819 conns.push_back (new connection (this, *i));
715 { 820
716 connection *conn = new connection (this, *i); 821 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
717 conns.push_back (conn);
718 conn->establish_connection (); 822 (*c)->establish_connection ();
719 }
720} 823}
721 824
722connection *vpn::find_router () 825bool
826vpn::can_direct (conf_node *src, conf_node *dst) const
723{ 827{
724 u32 prio = 1; 828 return src != dst
829 && src->may_direct (dst)
830 && dst->may_direct (src)
831 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
832 || (src->protocols & dst->connectable_protocols ()));
833}
834
835// only works for indirect and routed connections: find a router
836// from THISNODE to dst
837connection *
838vpn::find_router_for (const connection *dst)
839{
725 connection *router = 0; 840 connection *router = 0;
726 841
842 // first try to find a router with a direct connection, route there
843 // regardless of any other considerations.
844 {
845 u32 prio = 1;
846
847 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
848 {
849 connection *c = *i;
850
851 if (c->conf->routerprio > prio
852 && c->conf != THISNODE
853 && can_direct (c->conf, dst->conf)
854 && c->ictx && c->octx)
855 {
856 prio = c->conf->routerprio;
857 router = c;
858 }
859 }
860 }
861
862 if (router)
863 return router;
864
865 // second try find the router with the highest priority, higher than ours
866 {
867 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
868
869 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
870 {
871 connection *c = *i;
872
873 if (c->conf->routerprio > prio
874 && c != dst
875 && c->conf != THISNODE
876 && c->ictx && c->octx)
877 {
878 prio = c->conf->routerprio;
879 router = c;
880 }
881 }
882 }
883
884 return router;
885}
886
887void
888vpn::connection_established (connection *c)
889{
727 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 890 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
728 { 891 {
729 connection *c = *i; 892 connection *o = *i;
730 893
731 if (c->conf->routerprio > prio 894 if (!o->is_direct
732 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 895 && o->si.valid ()
733 && c->ictx && c->octx 896 && c->si != o->si
734 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 897 && c == find_router_for (o))
735 {
736 prio = c->conf->routerprio;
737 router = c;
738 } 898 {
899 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
900 o->conf->nodename, c->conf->nodename);
901 o->rekey ();
902 }
739 } 903 }
740
741 return router;
742} 904}
743 905
906void
744void vpn::send_connect_request (int id) 907vpn::send_connect_request (connection *c)
745{ 908{
746 connection *c = find_router (); 909 connection *r = find_router_for (c);
747 910
748 if (c) 911 if (r)
912 {
913 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
914 c->conf->nodename, r->conf->nodename);
749 c->send_connect_request (id); 915 r->send_connect_request (c->conf->id);
916 }
750 else 917 else
751 // no router found, aggressively connect to all routers 918 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
752 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 919 c->conf->nodename);
753 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
754 (*i)->establish_connection ();
755} 920}
756 921
757void 922void
758connection::dump_status () 923connection::dump_status ()
759{ 924{
760 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 925 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
761 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 926 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
762 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 927 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
763 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 928 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
764 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 929 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
765 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
766 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
767} 930}
768 931
769void 932void
770vpn::dump_status () 933vpn::dump_status ()
771{ 934{
… …
776 939
777 slog (L_NOTICE, _("END status dump")); 940 slog (L_NOTICE, _("END status dump"));
778} 941}
779 942
780vpn::vpn (void) 943vpn::vpn (void)
944{
781: event (this, &vpn::event_cb) 945 event .set<vpn, &vpn::event_cb > (this);
782, udpv4_ev_watcher (this, &vpn::udpv4_ev) 946 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
783, ipv4_ev_watcher (this, &vpn::ipv4_ev) 947 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
784#if ENABLE_TCP 948#if ENABLE_TCP
785, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 949 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
786#endif 950#endif
787#if ENABLE_ICMP 951#if ENABLE_ICMP
788, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 952 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
789#endif 953#endif
790#if ENABLE_DNS 954#if ENABLE_DNS
791, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 955 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
792#endif 956#endif
793, tap_ev_watcher (this, &vpn::tap_ev) 957 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
794{
795} 958}
796 959
797vpn::~vpn () 960vpn::~vpn ()
798{ 961{
799} 962}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines