[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.67 by root, Fri Oct 11 04:07:24 2013 UTC

…		…
1	/*	1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.	2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
21		31
22	#include "config.h"	32	#include "config.h"
23		33
24	#include <list>	34	#include <list>
28	#include <cstdlib>	38	#include <cstdlib>
29		39
30	#include <sys/types.h>	40	#include <sys/types.h>
31	#include <sys/socket.h>	41	#include <sys/socket.h>
32	#include <sys/wait.h>	42	#include <sys/wait.h>
		43	#include <sys/stat.h>
33	#include <errno.h>	44	#include <errno.h>
34	#include <time.h>	45	#include <time.h>
35	#include <unistd.h>	46	#include <unistd.h>
36	#include <fcntl.h>	47	#include <fcntl.h>
37	#include <sys/socket.h>	48	#include <sys/socket.h>
…		…
42		53
43	#include "connection.h"	54	#include "connection.h"
44	#include "util.h"	55	#include "util.h"
45	#include "vpn.h"	56	#include "vpn.h"
46		57
		58	using namespace std;
		59
47	vpn network; // THE vpn (bad design...)	60	vpn network; // THE vpn (bad design...)
48		61
49	/////////////////////////////////////////////////////////////////////////////	62	/////////////////////////////////////////////////////////////////////////////
		63
		64	static void inline
		65	set_tos (int fd, int &tos_prev, int tos)
		66	{
		67	#if defined(SOL_IP) && defined(IP_TOS)
		68	if (tos_prev == tos)
		69	return;
		70
		71	tos_prev = tos;
		72	setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
		73	#endif
		74	}
50		75
51	void	76	void
52	vpn::script_init_env ()	77	vpn::script_init_env ()
53	{	78	{
54	// the tunnel device mtu should be the physical mtu - overhead	79	// the tunnel device mtu should be the physical mtu - overhead
55	// the tricky part is rounding to the cipher key blocksize	80	// the tricky part is rounding to the cipher key blocksize
56	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;	81	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
57	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion	82	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
58	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round	83	mtu -= mtu % BLOCK_SIZE (CIPHER); // round
59	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again	84	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
60		85
61	char *env;	86	char *env;
62	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);	87	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
63	asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
64	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
65	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);	88	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
66	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);	89	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
67	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);	90	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
68	asprintf (&env, "MTU=%d", mtu); putenv (env);	91	asprintf (&env, "MTU=%d", mtu); putenv (env);
69	asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",	92	asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
70	0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,	93	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
71	THISNODE->id & 0xff); putenv (env);
72		94
73	// TODO: info for other nodes, maybe?	95	conns [THISNODE->id - 1]->script_init_env ("");
74	}
75		96
		97	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
		98	{
		99	char ext[16];
		100	snprintf (ext, 16, "_%d", (*c)->conf->id);
		101	(*c)->script_init_env (ext);
		102	}
		103	}
		104
		105	inline const char *
76	const char *vpn::script_if_init ()	106	vpn::script_if_init ()
77	{	107	{
78	script_init_env ();	108	script_init_env ();
79		109
80	return tap->if_up ();	110	return tap->if_up ();
81	}	111	}
82		112
		113	inline const char *
83	const char *vpn::script_if_up ()	114	vpn::script_if_up ()
84	{	115	{
85	script_init_env ();	116	script_init_env ();
86		117
87	char *filename;	118	return conf.config_filename (::conf.script_if_up, "if-up");
88	asprintf (&filename,	119	}
89	"%s/%s",
90	confbase,
91	::conf.script_if_up ? ::conf.script_if_up : "if-up");
92		120
93	return filename;	121	int
		122	vpn::setup_socket (u8 prot, int family, int type, int proto)
		123	{
		124	int fd = socket (family, type, proto);
		125
		126	if (fd < 0)
		127	{
		128	slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
		129	return fd;
		130	}
		131
		132	fcntl (fd, F_SETFL, O_NONBLOCK);
		133	fcntl (fd, F_SETFD, FD_CLOEXEC);
		134
		135	#ifdef SO_MARK
		136	if (::conf.nfmark)
		137	if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
		138	slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
		139	#endif
		140
		141	return fd;
94	}	142	}
95		143
96	int	144	int
97	vpn::setup ()	145	vpn::setup ()
98	{	146	{
		147	int success = 0;
		148
		149	ipv4_tos = -1;
99	ipv4_fd = -1;	150	ipv4_fd = -1;
100		151
101	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)	152	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
102	{	153	{
103	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);	154	ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
104		155
105	if (ipv4_fd < 0)	156	if (ipv4_fd < 0)
106	return -1;	157	return -1;
107
108	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
109		158
110	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	159	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
111	// this I really consider a linux bug. I am neither connected	160	// this I really consider a linux bug. I am neither connected
112	// nor do I fragment myself. Linux still sets DF and doesn't	161	// nor do I fragment myself. Linux still sets DF and doesn't
113	// fragment for me sometimes.	162	// fragment for me sometimes.
…		…
119		168
120	sockinfo si (THISNODE, PROT_IPv4);	169	sockinfo si (THISNODE, PROT_IPv4);
121		170
122	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))	171	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
123	{	172	{
124	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));	173	slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
125	exit (EXIT_FAILURE);	174	return -1;
126	}	175	}
127		176
128	ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);	177	ipv4_ev_watcher.start (ipv4_fd, EV_READ);
		178	++success;
129	}	179	}
		180	else
		181	THISNODE->protocols &= ~PROT_IPv4;
130		182
		183	udpv4_tos = -1;
131	udpv4_fd = -1;	184	udpv4_fd = -1;
132		185
133	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)	186	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
134	{	187	{
135	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	188	udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
136		189
137	if (udpv4_fd < 0)	190	if (udpv4_fd < 0)
138	return -1;	191	return -1;
139
140	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
141		192
142	// standard daemon practise...	193	// standard daemon practise...
143	{	194	{
144	int oval = 1;	195	int oval = 1;
145	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	196	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
157		208
158	sockinfo si (THISNODE, PROT_UDPv4);	209	sockinfo si (THISNODE, PROT_UDPv4);
159		210
160	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))	211	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
161	{	212	{
162	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));	213	slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
163	exit (EXIT_FAILURE);	214	return -1;
164	}	215	}
165		216
166	udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);	217	udpv4_ev_watcher.start (udpv4_fd, EV_READ);
		218	++success;
167	}	219	}
		220	else
		221	THISNODE->protocols &= ~PROT_UDPv4;
168		222
		223	icmpv4_tos = -1;
169	icmpv4_fd = -1;	224	icmpv4_fd = -1;
170		225
171	#if ENABLE_ICMP	226	#if ENABLE_ICMP
172	if (THISNODE->protocols & PROT_ICMPv4)	227	if (THISNODE->protocols & PROT_ICMPv4)
173	{	228	{
174	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);	229	icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
175		230
176	if (icmpv4_fd < 0)	231	if (icmpv4_fd < 0)
177	return -1;	232	return -1;
178
179	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
180		233
181	#ifdef ICMP_FILTER	234	#ifdef ICMP_FILTER
182	{	235	{
183	icmp_filter oval;	236	icmp_filter oval;
184	oval.data = 0xffffffff;	237	oval.data = 0xffffffff;
…		…
193	// this I really consider a linux bug. I am neither connected	246	// this I really consider a linux bug. I am neither connected
194	// nor do I fragment myself. Linux still sets DF and doesn't	247	// nor do I fragment myself. Linux still sets DF and doesn't
195	// fragment for me sometimes.	248	// fragment for me sometimes.
196	{	249	{
197	int oval = IP_PMTUDISC_DONT;	250	int oval = IP_PMTUDISC_DONT;
198	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	251	setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
199	}	252	}
200	#endif	253	#endif
201		254
202	sockinfo si (THISNODE, PROT_ICMPv4);	255	sockinfo si (THISNODE, PROT_ICMPv4);
203		256
204	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))	257	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
205	{	258	{
206	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));	259	slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
207	exit (EXIT_FAILURE);	260	return -1;
208	}	261	}
209		262
210	icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);	263	icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
		264	++success;
211	}	265	}
212	#endif	266	#endif
213		267
214	tcpv4_fd = -1;	268	tcpv4_fd = -1;
215		269
216	#if ENABLE_TCP	270	#if ENABLE_TCP
217	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)	271	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
218	{	272	{
219	tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);	273	tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
220		274
221	if (tcpv4_fd < 0)	275	if (tcpv4_fd < 0)
222	return -1;	276	return -1;
223		277
224	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
225
226	// standard daemon practise...	278	// standard daemon practise...
227	{	279	{
228	int oval = 1;	280	int oval = 1;
229	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	281	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
230	}	282	}
231		283
232	sockinfo si (THISNODE, PROT_TCPv4);	284	sockinfo si (THISNODE, PROT_TCPv4);
233		285
234	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))	286	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
235	{	287	{
236	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));	288	slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
237	exit (EXIT_FAILURE);	289	return -1;
238	}	290	}
239		291
240	if (listen (tcpv4_fd, 5))	292	if (listen (tcpv4_fd, 5))
241	{	293	{
242	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));	294	slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
243	exit (EXIT_FAILURE);	295	return -1;
244	}	296	}
245		297
246	tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);	298	tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
		299	++success;
247	}	300	}
		301	else
		302	THISNODE->protocols &= ~PROT_TCPv4;
248	#endif	303	#endif
		304
		305	dnsv4_tos = -1;
		306	dnsv4_fd = -1;
249		307
250	#if ENABLE_DNS	308	#if ENABLE_DNS
251	if (THISNODE->protocols & PROT_DNSv4)	309	if (THISNODE->protocols & PROT_DNSv4)
252	{	310	{
253	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	311	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
254		312
255	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);	313	dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
256		314
257	if (dnsv4_fd < 0)	315	if (dnsv4_fd < 0)
258	return -1;	316	return -1;
259		317
260	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)	318	# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
261	// this I really consider a linux bug. I am neither connected	319	// this I really consider a linux bug. I am neither connected
262	// nor do I fragment myself. Linux still sets DF and doesn't	320	// nor do I fragment myself. Linux still sets DF and doesn't
263	// fragment for me sometimes.	321	// fragment for me sometimes.
264	{	322	{
265	int oval = IP_PMTUDISC_DONT;	323	int oval = IP_PMTUDISC_DONT;
266	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);	324	setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
267	}	325	}
268	#endif	326	# endif
269		327
270	// standard daemon practise...	328	// standard daemon practise...
271	{	329	{
272	int oval = 1;	330	int oval = 1;
273	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);	331	setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
…		…
277	THISNODE->dns_hostname ? THISNODE->dns_port : 0,	335	THISNODE->dns_hostname ? THISNODE->dns_port : 0,
278	PROT_DNSv4);	336	PROT_DNSv4);
279		337
280	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))	338	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
281	{	339	{
282	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));	340	slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
283	exit (EXIT_FAILURE);	341	return -1;
284	}	342	}
285		343
286	dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);	344	dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
		345	++success;
		346	}
		347	#endif
		348
		349	/////////////////////////////////////////////////////////////////////////////
		350
		351	if (!success)
287	}	352	{
288	#endif	353	slog (L_ERR, _("no protocols enabled."));
		354	return -1;
		355	}
		356
		357	reconnect_all ();
		358
		359	/////////////////////////////////////////////////////////////////////////////
289		360
290	tap = new tap_device ();	361	tap = new tap_device ();
291	if (!tap) //D this, of course, never catches	362	if (!tap) //D this, of course, never catches
292	{	363	{
293	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);	364	slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
294	exit (EXIT_FAILURE);	365	return -1;
295	}	366	}
296		367
		368	fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
		369
		370	run_script_cb cb;
		371	cb.set<vpn, &vpn::script_if_init> (this);
		372
297	if (tap->if_up () &&	373	if (tap->if_up () &&
298	!run_script (run_script_cb (this, &vpn::script_if_init), true))	374	!run_script (cb, true))
299	{	375	{
300	slog (L_ERR, _("interface initialization command '%s' failed, exiting."),	376	slog (L_ERR, _("interface initialization command '%s' failed."),
301	tap->if_up ());	377	tap->if_up ());
302	exit (EXIT_FAILURE);	378	return -1;
303	}
304
305	if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
306	{	379	}
		380
		381	cb.set<vpn, &vpn::script_if_up> (this);
		382	if (!run_script (cb, true))
		383	{
307	slog (L_ERR, _("if-up command execution failed, exiting."));	384	slog (L_ERR, _("if-up command execution failed."));
308	exit (EXIT_FAILURE);	385	return -1;
309	}	386	}
310		387
311	tap_ev_watcher.start (tap->fd, EVENT_READ);	388	tap_ev_watcher.start (tap->fd, EV_READ);
312
313	reconnect_all ();
314		389
315	return 0;	390	return 0;
		391	}
		392
		393	bool
		394	vpn::drop_privileges ()
		395	{
		396	if (::conf.change_root)
		397	{
		398	if (!strcmp (::conf.change_root, "/"))
		399	{
		400	char dir [L_tmpnam];
		401	if (!tmpnam (dir))
		402	{
		403	slog (L_CRIT, _("unable to create anonymous root path."));
		404	return false;
		405	}
		406
		407	if (mkdir (dir, 0700))
		408	{
		409	slog (L_CRIT, _("unable to crate anonymous root directory."));
		410	return false;
		411	}
		412
		413	if (chdir (dir))
		414	{
		415	slog (L_CRIT, _("unable to change to anonymous root directory."));
		416	return false;
		417	}
		418
		419	if (rmdir (dir))
		420	slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
		421	}
		422	else
		423	{
		424	if (chdir (::conf.change_root))
		425	{
		426	slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
		427	return false;
		428	}
		429	}
		430
		431	if (chroot ("."))
		432	{
		433	slog (L_CRIT, _("unable to set new root directory."));
		434	return false;
		435	}
		436
		437	if (chdir ("/"))
		438	{
		439	slog (L_CRIT, _("unable to set cwd to new root directory."));
		440	return false;
		441	}
		442	}
		443
		444	if (::conf.change_gid)
		445	if (setgid (::conf.change_gid))
		446	{
		447	slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
		448	return false;
		449	}
		450
		451	if (::conf.change_uid)
		452	if (setuid (::conf.change_uid))
		453	{
		454	slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
		455	return false;
		456	}
		457
		458	return true;
316	}	459	}
317		460
318	bool	461	bool
319	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	462	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
320	{	463	{
321	#if defined(SOL_IP) && defined(IP_TOS)	464	set_tos (ipv4_fd, ipv4_tos, tos);
322	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
323	#endif
324	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	465	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325		466
326	return true;	467	return true;
327	}	468	}
328		469
…		…
351		492
352	#if ENABLE_ICMP	493	#if ENABLE_ICMP
353	bool	494	bool
354	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	495	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355	{	496	{
356	#if defined(SOL_IP) && defined(IP_TOS)
357	setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
358	#endif
359
360	pkt->unshift_hdr (4);	497	pkt->unshift_hdr (4);
361		498
362	icmp_header hdr = (icmp_header )&((*pkt)[0]);	499	icmp_header hdr = (icmp_header )&((*pkt)[0]);
363	hdr->type = ::conf.icmp_type;	500	hdr->type = ::conf.icmp_type;
364	hdr->code = 255;	501	hdr->code = 255;
365	hdr->checksum = 0;	502	hdr->checksum = 0;
366	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);	503	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
367		504
		505	set_tos (icmpv4_fd, icmpv4_tos, tos);
368	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	506	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
369		507
370	return true;	508	return true;
371	}	509	}
372	#endif	510	#endif
373		511
374	bool	512	bool
375	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	513	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
376	{	514	{
377	#if defined(SOL_IP) && defined(IP_TOS)	515	set_tos (udpv4_fd, udpv4_tos, tos);
378	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
379	#endif
380	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());	516	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
381		517
382	return true;	518	return true;
383	}	519	}
384		520
…		…
395	{	531	{
396	// broadcast, this is ugly, but due to the security policy	532	// broadcast, this is ugly, but due to the security policy
397	// we have to connect to all hosts...	533	// we have to connect to all hosts...
398	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	534	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
399	if ((*c)->conf != THISNODE)	535	if ((*c)->conf != THISNODE)
400	(*c)->inject_data_packet (pkt, true);	536	(*c)->inject_data_packet (pkt);
401	}	537	}
402	}	538	}
403		539
404	void	540	void
405	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)	541	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
406	{	542	{
407	unsigned int src = pkt->src ();	543	unsigned int src = pkt->src ();
408	unsigned int dst = pkt->dst ();	544	unsigned int dst = pkt->dst ();
409		545
410	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),	546	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
411	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);	547	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
412		548
413	if (src == 0 \|\| src > conns.size ()	549	if (src == 0 \|\| src > conns.size ()
414	\|\| dst > conns.size ()	550	\|\| dst > conns.size ()
415	\|\| pkt->typ () >= vpn_packet::PT_MAX)	551	\|\| pkt->typ () >= vpn_packet::PT_MAX)
416	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),	552	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
417	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
418	else if (dst > conns.size ())
419	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
420	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());	553	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
421	else	554	else
422	{	555	{
423	connection *c = conns[src - 1];	556	connection *c = conns[src - 1];
424		557
425	if (dst == 0)	558	if (dst == 0)
426	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),	559	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
427	c->conf->nodename, (const char *)rsi);	560	c->conf->nodename, (const char *)rsi);
428	else if (dst != THISNODE->id)	561	else if (dst != THISNODE->id)
429	{	562	{
430	if (THISNODE->routerprio)	563	if (THISNODE->routerprio)
431	// the tos setting gets lost here. who cares.	564	// the tos setting gets lost here. who cares.
432	conns[dst - 1]->inject_vpn_packet (pkt);	565	conns[dst - 1]->inject_vpn_packet (pkt);
433	else	566	else
434	slog (L_WARN,	567	slog (L_WARN,
435	_("%s(%s): forwarding request (=> %s), but we are no router"),	568	_("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
436	c->conf->nodename, (const char *)rsi,	569	c->conf->nodename, (const char *)rsi,
437	conns[dst - 1]->conf->nodename);	570	conns[dst - 1]->conf->nodename);
438	}	571	}
439	else	572	else
440	c->recv_vpn_packet (pkt, rsi);	573	c->recv_vpn_packet (pkt, rsi);
…		…
445	vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)	578	vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
446	{	579	{
447	switch (si.prot)	580	switch (si.prot)
448	{	581	{
449	case PROT_IPv4:	582	case PROT_IPv4:
450	return send_ipv4_packet (pkt, si, tos);	583	return send_ipv4_packet (pkt, si, tos);
		584
451	case PROT_UDPv4:	585	case PROT_UDPv4:
452	return send_udpv4_packet (pkt, si, tos);	586	return send_udpv4_packet (pkt, si, tos);
		587
453	#if ENABLE_TCP	588	#if ENABLE_TCP
454	case PROT_TCPv4:	589	case PROT_TCPv4:
455	return send_tcpv4_packet (pkt, si, tos);	590	return send_tcpv4_packet (pkt, si, tos);
456	#endif	591	#endif
457	#if ENABLE_ICMP	592	#if ENABLE_ICMP
458	case PROT_ICMPv4:	593	case PROT_ICMPv4:
459	return send_icmpv4_packet (pkt, si, tos);	594	return send_icmpv4_packet (pkt, si, tos);
460	#endif	595	#endif
461	#if ENABLE_DNS	596	#if ENABLE_DNS
462	case PROT_DNSv4:	597	case PROT_DNSv4:
463	return send_dnsv4_packet (pkt, si, tos);	598	return send_dnsv4_packet (pkt, si, tos);
464	#endif	599	#endif
465
466	default:	600	default:
467	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si);	601	slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
468	}	602	}
469		603
470	return false;	604	return false;
471	}	605	}
472		606
473	void	607	inline void
474	vpn::ipv4_ev (io_watcher &w, short revents)	608	vpn::ipv4_ev (ev::io &w, int revents)
475	{	609	{
476	if (revents & EVENT_READ)	610	if (revents & EV_READ)
477	{	611	{
478	vpn_packet *pkt = new vpn_packet;	612	vpn_packet *pkt = new vpn_packet;
479	struct sockaddr_in sa;	613	struct sockaddr_in sa;
480	socklen_t sa_len = sizeof (sa);	614	socklen_t sa_len = sizeof (sa);
481	int len;	615	int len;
…		…
487	if (len > 0)	621	if (len > 0)
488	{	622	{
489	pkt->len = len;	623	pkt->len = len;
490		624
491	// raw sockets deliver the ipv4 header, but don't expect it on sends	625	// raw sockets deliver the ipv4 header, but don't expect it on sends
492	pkt->skip_hdr (IP_OVERHEAD);	626	pkt->skip_hdr (pkt->ipv4_hdr_len ());
493		627
494	recv_vpn_packet (pkt, si);	628	recv_vpn_packet (pkt, si);
495	}	629	}
496	else	630	else
497	{	631	{
498	// probably ECONNRESET or somesuch	632	// probably ECONNRESET or somesuch
499	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	633	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
500	}	634	}
501		635
502	delete pkt;	636	delete pkt;
503	}	637	}
504	else	638	else
505	{	639	{
506	slog (L_ERR,	640	slog (L_ERR,
507	_("FATAL: unknown revents %08x in socket, terminating\n"),	641	_("FATAL: unknown revents %08x in socket, exiting.\n"),
508	revents);	642	revents);
509	exit (EXIT_FAILURE);	643	exit (EXIT_FAILURE);
510	}	644	}
511	}	645	}
512		646
513	#if ENABLE_ICMP	647	#if ENABLE_ICMP
514	void	648	inline void
515	vpn::icmpv4_ev (io_watcher &w, short revents)	649	vpn::icmpv4_ev (ev::io &w, int revents)
516	{	650	{
517	if (revents & EVENT_READ)	651	if (revents & EV_READ)
518	{	652	{
519	vpn_packet *pkt = new vpn_packet;	653	vpn_packet *pkt = new vpn_packet;
520	struct sockaddr_in sa;	654	struct sockaddr_in sa;
521	socklen_t sa_len = sizeof (sa);	655	socklen_t sa_len = sizeof (sa);
522	int len;	656	int len;
…		…
534	if (hdr->type == ::conf.icmp_type	668	if (hdr->type == ::conf.icmp_type
535	&& hdr->code == 255)	669	&& hdr->code == 255)
536	{	670	{
537	// raw sockets deliver the ipv4, but don't expect it on sends	671	// raw sockets deliver the ipv4, but don't expect it on sends
538	// this is slow, but...	672	// this is slow, but...
539	pkt->skip_hdr (ICMP_OVERHEAD);	673	pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
540		674
541	recv_vpn_packet (pkt, si);	675	recv_vpn_packet (pkt, si);
542	}	676	}
543	}	677	}
544	else	678	else
545	{	679	{
546	// probably ECONNRESET or somesuch	680	// probably ECONNRESET or somesuch
547	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));	681	slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
548	}	682	}
549		683
550	delete pkt;	684	delete pkt;
551	}	685	}
552	else	686	else
553	{	687	{
554	slog (L_ERR,	688	slog (L_ERR,
555	_("FATAL: unknown revents %08x in socket, terminating\n"),	689	_("FATAL: unknown revents %08x in socket, exiting.\n"),
556	revents);	690	revents);
557	exit (EXIT_FAILURE);	691	exit (EXIT_FAILURE);
558	}	692	}
559	}	693	}
560	#endif	694	#endif
561		695
562	void	696	inline void
563	vpn::udpv4_ev (io_watcher &w, short revents)	697	vpn::udpv4_ev (ev::io &w, int revents)
564	{	698	{
565	if (revents & EVENT_READ)	699	if (revents & EV_READ)
566	{	700	{
567	vpn_packet *pkt = new vpn_packet;	701	vpn_packet *pkt = new vpn_packet;
568	struct sockaddr_in sa;	702	struct sockaddr_in sa;
569	socklen_t sa_len = sizeof (sa);	703	socklen_t sa_len = sizeof (sa);
570	int len;	704	int len;
…		…
580	recv_vpn_packet (pkt, si);	714	recv_vpn_packet (pkt, si);
581	}	715	}
582	else	716	else
583	{	717	{
584	// probably ECONNRESET or somesuch	718	// probably ECONNRESET or somesuch
585	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));	719	slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
586	}	720	}
587		721
588	delete pkt;	722	delete pkt;
589	}	723	}
590	else	724	else
591	{	725	{
592	slog (L_ERR,	726	slog (L_ERR,
593	_("FATAL: unknown revents %08x in socket, terminating\n"),	727	_("FATAL: unknown revents %08x in socket, exiting.\n"),
594	revents);	728	revents);
595	exit (EXIT_FAILURE);	729	exit (EXIT_FAILURE);
596	}	730	}
597	}	731	}
598		732
599	void	733	inline void
600	vpn::tap_ev (io_watcher &w, short revents)	734	vpn::tap_ev (ev::io &w, int revents)
601	{	735	{
602	if (revents & EVENT_READ)	736	if (revents & EV_READ)
603	{	737	{
604	/* process data */	738	/* process data */
605	tap_packet *pkt;	739	tap_packet *pkt;
606		740
607	pkt = tap->recv ();	741	pkt = tap->recv ();
…		…
636	}	770	}
637	else	771	else
638	abort ();	772	abort ();
639	}	773	}
640		774
641	void	775	inline void
642	vpn::event_cb (time_watcher &w)	776	vpn::event_cb (ev::timer &w, int)
643	{	777	{
644	if (events)	778	if (events)
645	{	779	{
646	if (events & EVENT_SHUTDOWN)	780	if (events & EVENT_SHUTDOWN)
647	{	781	{
648	slog (L_INFO, _("preparing shutdown..."));	782	slog (L_INFO, _("preparing shutdown..."));
649		783
650	shutdown_all ();	784	shutdown_all ();
651	remove_pid (conf.pidfilename);	785	remove_pid (conf.pidfilename);
652	slog (L_INFO, _("terminating"));	786	slog (L_INFO, _("exiting."));
653	exit (EXIT_SUCCESS);	787	exit (EXIT_SUCCESS);
654	}	788	}
655		789
656	if (events & EVENT_RECONNECT)	790	if (events & EVENT_RECONNECT)
657	{	791	{
658	slog (L_INFO, _("forced reconnect"));	792	slog (L_INFO, _("forced reconnect."));
659		793
660	reconnect_all ();	794	reconnect_all ();
661	}	795	}
662		796
663	events = 0;	797	events = 0;
…		…
679		813
680	conns.clear ();	814	conns.clear ();
681		815
682	connection_init ();	816	connection_init ();
683		817
684	for (configuration::node_vector::iterator i = conf.nodes.begin ();	818	for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
685	i != conf.nodes.end (); ++i)	819	conns.push_back (new connection (this, *i));
686	{	820
687	connection conn = new connection (this, i);	821	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
688	conns.push_back (conn);
689	conn->establish_connection ();	822	(*c)->establish_connection ();
690	}
691	}	823	}
692		824
693	connection *vpn::find_router ()	825	bool
		826	vpn::can_direct (conf_node src, conf_node dst) const
694	{	827	{
695	u32 prio = 1;	828	return src != dst
		829	&& src->may_direct (dst)
		830	&& dst->may_direct (src)
		831	&& (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
		832	\|\| (src->protocols & dst->connectable_protocols ()));
		833	}
		834
		835	// only works for indirect and routed connections: find a router
		836	// from THISNODE to dst
		837	connection *
		838	vpn::find_router_for (const connection *dst)
		839	{
696	connection *router = 0;	840	connection *router = 0;
697		841
		842	// first try to find a router with a direct connection, route there
		843	// regardless of any other considerations.
		844	{
		845	u32 prio = 1;
		846
		847	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		848	{
		849	connection c = i;
		850
		851	if (c->conf->routerprio > prio
		852	&& c->conf != THISNODE
		853	&& can_direct (c->conf, dst->conf)
		854	&& c->ictx && c->octx)
		855	{
		856	prio = c->conf->routerprio;
		857	router = c;
		858	}
		859	}
		860	}
		861
		862	if (router)
		863	return router;
		864
		865	// second try find the router with the highest priority, higher than ours
		866	{
		867	u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
		868
		869	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
		870	{
		871	connection c = i;
		872
		873	if (c->conf->routerprio > prio
		874	&& c != dst
		875	&& c->conf != THISNODE
		876	&& c->ictx && c->octx)
		877	{
		878	prio = c->conf->routerprio;
		879	router = c;
		880	}
		881	}
		882	}
		883
		884	return router;
		885	}
		886
		887	void
		888	vpn::connection_established (connection *c)
		889	{
698	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	890	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
699	{	891	{
700	connection c = i;	892	connection o = i;
701		893
702	if (c->conf->routerprio > prio	894	if (o->si.valid ()
703	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use	895	&& c->si != o->si
704	&& c->ictx && c->octx	896	&& c == find_router_for (o)
705	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode	897	&& !can_direct (THISNODE, o->conf))
706	{
707	prio = c->conf->routerprio;
708	router = c;
709	}	898	{
		899	slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
		900	o->conf->nodename, c->conf->nodename);
		901	o->rekey ();
		902	}
710	}	903	}
711
712	return router;
713	}	904	}
714		905
		906	void
715	void vpn::send_connect_request (int id)	907	vpn::send_connect_request (connection *c)
716	{	908	{
717	connection *c = find_router ();	909	connection *r = find_router_for (c);
718		910
719	if (c)	911	if (r)
		912	{
		913	slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
		914	c->conf->nodename, r->conf->nodename);
720	c->send_connect_request (id);	915	r->send_connect_request (c->conf->id);
		916	}
721	else	917	else
722	// no router found, aggressively connect to all routers	918	slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
723	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)	919	c->conf->nodename);
724	if ((i)->conf->routerprio && (i)->conf != THISNODE)
725	(*i)->establish_connection ();
726	}	920	}
727		921
728	void	922	void
729	connection::dump_status ()	923	connection::dump_status ()
730	{	924	{
731	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);	925	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
732	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),	926	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
733	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);	927	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
734	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),	928	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
735	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);	929	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
736	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
737	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
738	}	930	}
739		931
740	void	932	void
741	vpn::dump_status ()	933	vpn::dump_status ()
742	{	934	{
743	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);	935	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
744		936
745	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)	937	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
746	(*c)->dump_status ();	938	(*c)->dump_status ();
747		939
748	slog (L_NOTICE, _("END status dump"));	940	slog (L_NOTICE, _("END status dump"));
749	}	941	}
750		942
751	vpn::vpn (void)	943	vpn::vpn (void)
		944	{
752	: event (this, &vpn::event_cb)	945	event .set<vpn, &vpn::event_cb > (this);
753	, udpv4_ev_watcher (this, &vpn::udpv4_ev)	946	udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
754	, ipv4_ev_watcher (this, &vpn::ipv4_ev)	947	ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
755	#if ENABLE_TCP	948	#if ENABLE_TCP
756	, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)	949	tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
757	#endif	950	#endif
758	#if ENABLE_ICMP	951	#if ENABLE_ICMP
759	, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)	952	icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
760	#endif	953	#endif
761	#if ENABLE_DNS	954	#if ENABLE_DNS
762	, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)	955	dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
763	#endif	956	#endif
764	, tap_ev_watcher (this, &vpn::tap_ev)	957	tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
765	{
766	}	958	}
767		959
768	vpn::~vpn ()	960	vpn::~vpn ()
769	{	961	{
770	}	962	}

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs. Revision 1.67 by root, Fri Oct 11 04:07:24 2013 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.33 by pcg, Wed Mar 23 21:55:39 2005 UTC vs.
Revision 1.67 by root, Fri Oct 11 04:07:24 2013 UTC