ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.42 by pcg, Sun Dec 2 00:54:52 2007 UTC vs.
Revision 1.69 by root, Sat Sep 5 17:40:22 2015 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2007 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
61
62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
48 87
49///////////////////////////////////////////////////////////////////////////// 88/////////////////////////////////////////////////////////////////////////////
50 89
51static void inline 90static void inline
52set_tos (int fd, int &tos_prev, int tos) 91set_tos (int fd, int &tos_prev, int tos)
… …
65{ 104{
66 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
67 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
68 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
69 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
70 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
71 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
72 111
73 char *env; 112 char *env;
74 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
75 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
87 snprintf (ext, 16, "_%d", (*c)->conf->id); 126 snprintf (ext, 16, "_%d", (*c)->conf->id);
88 (*c)->script_init_env (ext); 127 (*c)->script_init_env (ext);
89 } 128 }
90} 129}
91 130
131inline const char *
92const char *vpn::script_if_init () 132vpn::script_if_init ()
93{ 133{
94 script_init_env (); 134 script_init_env ();
95 135
96 return tap->if_up (); 136 return tap->if_up ();
97} 137}
98 138
139inline const char *
99const char *vpn::script_if_up () 140vpn::script_if_up ()
100{ 141{
101 script_init_env (); 142 script_init_env ();
102 143
103 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
104 asprintf (&filename, 145}
105 "%s/%s",
106 confbase,
107 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
108 146
109 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
110} 168}
111 169
112int 170int
113vpn::setup () 171vpn::setup ()
114{ 172{
173 int success = 0;
174
115 ipv4_tos = -1; 175 ipv4_tos = -1;
116 ipv4_fd = -1; 176 ipv4_fd = -1;
117 177
118 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
119 { 179 {
120 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
121 181
122 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
123 return -1; 183 return -1;
124
125 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
126 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
127 184
128#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
130 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
131 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
137 194
138 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
139 196
140 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
141 { 198 {
142 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 200 return -1;
144 } 201 }
145 202
146 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
147 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
148 208
149 udpv4_tos = -1; 209 udpv4_tos = -1;
150 udpv4_fd = -1; 210 udpv4_fd = -1;
151 211
152 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
153 { 213 {
154 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
155 215
156 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
157 return -1; 217 return -1;
158
159 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
160 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
161 218
162 // standard daemon practise... 219 // standard daemon practise...
163 { 220 {
164 int oval = 1; 221 int oval = 1;
165 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
177 234
178 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
179 236
180 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
181 { 238 {
182 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
183 exit (EXIT_FAILURE); 240 return -1;
184 } 241 }
185 242
186 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
187 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
188 248
189 icmpv4_tos = -1; 249 icmpv4_tos = -1;
190 icmpv4_fd = -1; 250 icmpv4_fd = -1;
191 251
192#if ENABLE_ICMP 252#if ENABLE_ICMP
193 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
194 { 254 {
195 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
196 256
197 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
198 return -1; 258 return -1;
199
200 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
201 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
202 259
203#ifdef ICMP_FILTER 260#ifdef ICMP_FILTER
204 { 261 {
205 icmp_filter oval; 262 icmp_filter oval;
206 oval.data = 0xffffffff; 263 oval.data = 0xffffffff;
… …
223 280
224 sockinfo si (THISNODE, PROT_ICMPv4); 281 sockinfo si (THISNODE, PROT_ICMPv4);
225 282
226 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 283 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
227 { 284 {
228 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 285 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
229 exit (EXIT_FAILURE); 286 return -1;
230 } 287 }
231 288
232 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 289 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
290 ++success;
233 } 291 }
234#endif 292#endif
235 293
236 tcpv4_fd = -1; 294 tcpv4_fd = -1;
237 295
238#if ENABLE_TCP 296#if ENABLE_TCP
239 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 297 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
240 { 298 {
241 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 299 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
242 300
243 if (tcpv4_fd < 0) 301 if (tcpv4_fd < 0)
244 return -1; 302 return -1;
245 303
246 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
247 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
248
249 // standard daemon practise... 304 // standard daemon practise...
250 { 305 {
251 int oval = 1; 306 int oval = 1;
252 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 307 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
253 } 308 }
254 309
255 sockinfo si (THISNODE, PROT_TCPv4); 310 sockinfo si (THISNODE, PROT_TCPv4);
256 311
257 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 312 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
258 { 313 {
259 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 314 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
260 exit (EXIT_FAILURE); 315 return -1;
261 } 316 }
262 317
263 if (listen (tcpv4_fd, 5)) 318 if (listen (tcpv4_fd, 5))
264 { 319 {
265 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
266 exit (EXIT_FAILURE); 321 return -1;
267 } 322 }
268 323
269 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 324 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
325 ++success;
270 } 326 }
327 else
328 THISNODE->protocols &= ~PROT_TCPv4;
271#endif 329#endif
272 330
273 dnsv4_tos = -1; 331 dnsv4_tos = -1;
274 dnsv4_fd = -1; 332 dnsv4_fd = -1;
275 333
276#if ENABLE_DNS 334#if ENABLE_DNS
277 if (THISNODE->protocols & PROT_DNSv4) 335 if (THISNODE->protocols & PROT_DNSv4)
278 { 336 {
279 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 337 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
280 338
281 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 339 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
282 340
283 if (dnsv4_fd < 0) 341 if (dnsv4_fd < 0)
284 return -1; 342 return -1;
285
286 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
287 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
288 343
289# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 344# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
290 // this I really consider a linux bug. I am neither connected 345 // this I really consider a linux bug. I am neither connected
291 // nor do I fragment myself. Linux still sets DF and doesn't 346 // nor do I fragment myself. Linux still sets DF and doesn't
292 // fragment for me sometimes. 347 // fragment for me sometimes.
… …
306 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 361 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
307 PROT_DNSv4); 362 PROT_DNSv4);
308 363
309 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 364 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
310 { 365 {
311 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 366 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
312 exit (EXIT_FAILURE); 367 return -1;
313 } 368 }
314 369
315 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 370 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
371 ++success;
316 } 372 }
317#endif 373#endif
318 374
319 ///////////////////////////////////////////////////////////////////////////// 375 /////////////////////////////////////////////////////////////////////////////
376
377 if (!success)
378 {
379 slog (L_ERR, _("no protocols enabled."));
380 return -1;
381 }
320 382
321 reconnect_all (); 383 reconnect_all ();
322 384
323 ///////////////////////////////////////////////////////////////////////////// 385 /////////////////////////////////////////////////////////////////////////////
324 386
325 tap = new tap_device (); 387 tap = new tap_device ();
326 if (!tap) //D this, of course, never catches 388 if (!tap) //D this, of course, never catches
327 { 389 {
328 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 390 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
329 exit (EXIT_FAILURE); 391 return -1;
330 } 392 }
331 393
332 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 394 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
333 395
396 run_script_cb cb;
397 cb.set<vpn, &vpn::script_if_init> (this);
398
334 if (tap->if_up () && 399 if (tap->if_up () &&
335 !run_script (run_script_cb (this, &vpn::script_if_init), true)) 400 !run_script (cb, true))
336 { 401 {
337 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 402 slog (L_ERR, _("interface initialization command '%s' failed."),
338 tap->if_up ()); 403 tap->if_up ());
339 exit (EXIT_FAILURE); 404 return -1;
340 }
341
342 if (!run_script (run_script_cb (this, &vpn::script_if_up), true))
343 { 405 }
406
407 cb.set<vpn, &vpn::script_if_up> (this);
408 if (!run_script (cb, true))
409 {
344 slog (L_ERR, _("if-up command execution failed, exiting.")); 410 slog (L_ERR, _("if-up command execution failed."));
345 exit (EXIT_FAILURE); 411 return -1;
346 } 412 }
347 413
348 tap_ev_watcher.start (tap->fd, EV_READ); 414 tap_ev_watcher.start (tap->fd, EV_READ);
349 415
350 return 0; 416 return 0;
417}
418
419bool
420vpn::drop_privileges ()
421{
422 if (::conf.change_root)
423 {
424 if (!strcmp (::conf.change_root, "/"))
425 {
426 char dir [L_tmpnam];
427 if (!tmpnam (dir))
428 {
429 slog (L_CRIT, _("unable to create anonymous root path."));
430 return false;
431 }
432
433 if (mkdir (dir, 0700))
434 {
435 slog (L_CRIT, _("unable to create anonymous root directory."));
436 return false;
437 }
438
439 if (chdir (dir))
440 {
441 slog (L_CRIT, _("unable to change to anonymous root directory."));
442 return false;
443 }
444
445 if (rmdir (dir))
446 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
447 }
448 else
449 {
450 if (chdir (::conf.change_root))
451 {
452 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
453 return false;
454 }
455 }
456
457 if (chroot ("."))
458 {
459 slog (L_CRIT, _("unable to set new root directory."));
460 return false;
461 }
462
463 if (chdir ("/"))
464 {
465 slog (L_CRIT, _("unable to set cwd to new root directory."));
466 return false;
467 }
468 }
469
470 if (::conf.change_gid)
471 if (setgid (::conf.change_gid))
472 {
473 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
474 return false;
475 }
476
477 if (::conf.change_uid)
478 if (setuid (::conf.change_uid))
479 {
480 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
481 return false;
482 }
483
484 return true;
351} 485}
352 486
353bool 487bool
354vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 488vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
355{ 489{
356 set_tos (ipv4_fd, ipv4_tos, tos); 490 set_tos (ipv4_fd, ipv4_tos, tos);
357 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 491 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
358 492
359 return true; 493 return true;
360} 494}
361 495
362static u16 496static u16
… …
393 hdr->code = 255; 527 hdr->code = 255;
394 hdr->checksum = 0; 528 hdr->checksum = 0;
395 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 529 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
396 530
397 set_tos (icmpv4_fd, icmpv4_tos, tos); 531 set_tos (icmpv4_fd, icmpv4_tos, tos);
398 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 532 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
399 533
400 return true; 534 return true;
401} 535}
402#endif 536#endif
403 537
404bool 538bool
405vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 539vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
406{ 540{
407 set_tos (udpv4_fd, udpv4_tos, tos); 541 set_tos (udpv4_fd, udpv4_tos, tos);
408 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 542 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
409 543
410 return true; 544 return true;
411} 545}
412 546
413void 547void
… …
423 { 557 {
424 // broadcast, this is ugly, but due to the security policy 558 // broadcast, this is ugly, but due to the security policy
425 // we have to connect to all hosts... 559 // we have to connect to all hosts...
426 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 560 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
427 if ((*c)->conf != THISNODE) 561 if ((*c)->conf != THISNODE)
428 (*c)->inject_data_packet (pkt, true); 562 (*c)->inject_data_packet (pkt);
429 } 563 }
430} 564}
431 565
432void 566void
433vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 567vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
434{ 568{
435 unsigned int src = pkt->src (); 569 unsigned int src = pkt->src ();
436 unsigned int dst = pkt->dst (); 570 unsigned int dst = pkt->dst ();
437 571
438 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 572 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
439 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 573 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
440 574
441 if (src == 0 || src > conns.size () 575 if (src == 0 || src > conns.size ()
442 || dst > conns.size () 576 || dst > conns.size ()
443 || pkt->typ () >= vpn_packet::PT_MAX) 577 || pkt->typ () >= vpn_packet::PT_MAX)
444 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 578 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
445 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
446 else if (dst > conns.size ())
447 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
448 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
449 else 580 else
450 { 581 {
451 connection *c = conns[src - 1]; 582 connection *c = conns[src - 1];
452 583
453 if (dst == 0) 584 if (dst == 0)
454 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 585 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
455 c->conf->nodename, (const char *)rsi); 586 c->conf->nodename, (const char *)rsi);
456 else if (dst != THISNODE->id) 587 else if (dst != THISNODE->id)
457 { 588 {
458 if (THISNODE->routerprio) 589 if (THISNODE->routerprio)
459 // the tos setting gets lost here. who cares. 590 // the tos setting gets lost here. who cares.
460 conns[dst - 1]->inject_vpn_packet (pkt); 591 conns[dst - 1]->inject_vpn_packet (pkt);
461 else 592 else
462 slog (L_WARN, 593 slog (L_WARN,
463 _("%s(%s): forwarding request (=> %s), but we are no router"), 594 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
464 c->conf->nodename, (const char *)rsi, 595 c->conf->nodename, (const char *)rsi,
465 conns[dst - 1]->conf->nodename); 596 conns[dst - 1]->conf->nodename);
466 } 597 }
467 else 598 else
468 c->recv_vpn_packet (pkt, rsi); 599 c->recv_vpn_packet (pkt, rsi);
… …
473vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 604vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
474{ 605{
475 switch (si.prot) 606 switch (si.prot)
476 { 607 {
477 case PROT_IPv4: 608 case PROT_IPv4:
478 return send_ipv4_packet (pkt, si, tos); 609 return send_ipv4_packet (pkt, si, tos);
479 610
480 case PROT_UDPv4: 611 case PROT_UDPv4:
481 return send_udpv4_packet (pkt, si, tos); 612 return send_udpv4_packet (pkt, si, tos);
482 613
483#if ENABLE_TCP 614#if ENABLE_TCP
484 case PROT_TCPv4: 615 case PROT_TCPv4:
485 return send_tcpv4_packet (pkt, si, tos); 616 return send_tcpv4_packet (pkt, si, tos);
486#endif 617#endif
487#if ENABLE_ICMP 618#if ENABLE_ICMP
488 case PROT_ICMPv4: 619 case PROT_ICMPv4:
489 return send_icmpv4_packet (pkt, si, tos); 620 return send_icmpv4_packet (pkt, si, tos);
490#endif 621#endif
491#if ENABLE_DNS 622#if ENABLE_DNS
492 case PROT_DNSv4: 623 case PROT_DNSv4:
493 return send_dnsv4_packet (pkt, si, tos); 624 return send_dnsv4_packet (pkt, si, tos);
494#endif 625#endif
495 default: 626 default:
496 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 627 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
497 } 628 }
498 629
499 return false; 630 return false;
500} 631}
501 632
502void 633inline void
503vpn::ipv4_ev (ev::io &w, int revents) 634vpn::ipv4_ev (ev::io &w, int revents)
504{ 635{
505 if (revents & EV_READ) 636 if (revents & EV_READ)
506 { 637 {
507 vpn_packet *pkt = new vpn_packet; 638 vpn_packet *pkt = new vpn_packet;
… …
516 if (len > 0) 647 if (len > 0)
517 { 648 {
518 pkt->len = len; 649 pkt->len = len;
519 650
520 // raw sockets deliver the ipv4 header, but don't expect it on sends 651 // raw sockets deliver the ipv4 header, but don't expect it on sends
521 pkt->skip_hdr (IP_OVERHEAD); 652 pkt->skip_hdr (pkt->ipv4_hdr_len ());
522 653
523 recv_vpn_packet (pkt, si); 654 recv_vpn_packet (pkt, si);
524 } 655 }
525 else 656 else
526 { 657 {
527 // probably ECONNRESET or somesuch 658 // probably ECONNRESET or somesuch
528 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 659 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
529 } 660 }
530 661
531 delete pkt; 662 delete pkt;
532 } 663 }
533 else 664 else
534 { 665 {
535 slog (L_ERR, 666 slog (L_ERR,
536 _("FATAL: unknown revents %08x in socket, terminating\n"), 667 _("FATAL: unknown revents %08x in socket, exiting.\n"),
537 revents); 668 revents);
538 exit (EXIT_FAILURE); 669 exit (EXIT_FAILURE);
539 } 670 }
540} 671}
541 672
542#if ENABLE_ICMP 673#if ENABLE_ICMP
543void 674inline void
544vpn::icmpv4_ev (ev::io &w, int revents) 675vpn::icmpv4_ev (ev::io &w, int revents)
545{ 676{
546 if (revents & EV_READ) 677 if (revents & EV_READ)
547 { 678 {
548 vpn_packet *pkt = new vpn_packet; 679 vpn_packet *pkt = new vpn_packet;
… …
563 if (hdr->type == ::conf.icmp_type 694 if (hdr->type == ::conf.icmp_type
564 && hdr->code == 255) 695 && hdr->code == 255)
565 { 696 {
566 // raw sockets deliver the ipv4, but don't expect it on sends 697 // raw sockets deliver the ipv4, but don't expect it on sends
567 // this is slow, but... 698 // this is slow, but...
568 pkt->skip_hdr (ICMP_OVERHEAD); 699 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
569 700
570 recv_vpn_packet (pkt, si); 701 recv_vpn_packet (pkt, si);
571 } 702 }
572 } 703 }
573 else 704 else
574 { 705 {
575 // probably ECONNRESET or somesuch 706 // probably ECONNRESET or somesuch
576 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 707 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
577 } 708 }
578 709
579 delete pkt; 710 delete pkt;
580 } 711 }
581 else 712 else
582 { 713 {
583 slog (L_ERR, 714 slog (L_ERR,
584 _("FATAL: unknown revents %08x in socket, terminating\n"), 715 _("FATAL: unknown revents %08x in socket, exiting.\n"),
585 revents); 716 revents);
586 exit (EXIT_FAILURE); 717 exit (EXIT_FAILURE);
587 } 718 }
588} 719}
589#endif 720#endif
590 721
591void 722inline void
592vpn::udpv4_ev (ev::io &w, int revents) 723vpn::udpv4_ev (ev::io &w, int revents)
593{ 724{
594 if (revents & EV_READ) 725 if (revents & EV_READ)
595 { 726 {
596 vpn_packet *pkt = new vpn_packet; 727 vpn_packet *pkt = new vpn_packet;
… …
609 recv_vpn_packet (pkt, si); 740 recv_vpn_packet (pkt, si);
610 } 741 }
611 else 742 else
612 { 743 {
613 // probably ECONNRESET or somesuch 744 // probably ECONNRESET or somesuch
614 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 745 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
615 } 746 }
616 747
617 delete pkt; 748 delete pkt;
618 } 749 }
619 else 750 else
620 { 751 {
621 slog (L_ERR, 752 slog (L_ERR,
622 _("FATAL: unknown revents %08x in socket, terminating\n"), 753 _("FATAL: unknown revents %08x in socket, exiting.\n"),
623 revents); 754 revents);
624 exit (EXIT_FAILURE); 755 exit (EXIT_FAILURE);
625 } 756 }
626} 757}
627 758
628void 759inline void
629vpn::tap_ev (ev::io &w, int revents) 760vpn::tap_ev (ev::io &w, int revents)
630{ 761{
631 if (revents & EV_READ) 762 if (revents & EV_READ)
632 { 763 {
633 /* process data */ 764 /* process data */
… …
665 } 796 }
666 else 797 else
667 abort (); 798 abort ();
668} 799}
669 800
670void 801inline void
671vpn::event_cb (ev::timer &w, int) 802vpn::event_cb (ev::timer &w, int)
672{ 803{
673 if (events) 804 if (events)
674 { 805 {
675 if (events & EVENT_SHUTDOWN) 806 if (events & EVENT_SHUTDOWN)
676 { 807 {
677 slog (L_INFO, _("preparing shutdown...")); 808 slog (L_INFO, _("preparing shutdown..."));
678 809
679 shutdown_all (); 810 shutdown_all ();
680 remove_pid (conf.pidfilename); 811 remove_pid (conf.pidfilename);
681 slog (L_INFO, _("terminating")); 812 slog (L_INFO, _("exiting."));
682 exit (EXIT_SUCCESS); 813 exit (EXIT_SUCCESS);
683 } 814 }
684 815
685 if (events & EVENT_RECONNECT) 816 if (events & EVENT_RECONNECT)
686 { 817 {
687 slog (L_INFO, _("forced reconnect")); 818 slog (L_INFO, _("forced reconnect."));
688 819
689 reconnect_all (); 820 reconnect_all ();
690 } 821 }
691 822
692 events = 0; 823 events = 0;
… …
708 839
709 conns.clear (); 840 conns.clear ();
710 841
711 connection_init (); 842 connection_init ();
712 843
713 for (configuration::node_vector::iterator i = conf.nodes.begin (); 844 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
714 i != conf.nodes.end (); ++i) 845 conns.push_back (new connection (this, *i));
715 { 846
716 connection *conn = new connection (this, *i); 847 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
717 conns.push_back (conn);
718 conn->establish_connection (); 848 (*c)->establish_connection ();
719 }
720} 849}
721 850
722connection *vpn::find_router () 851bool
852vpn::can_direct (conf_node *src, conf_node *dst) const
723{ 853{
724 u32 prio = 1; 854 return src != dst
855 && src->may_direct (dst)
856 && dst->may_direct (src)
857 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
858 || (src->protocols & dst->connectable_protocols ()));
859}
860
861// only works for indirect and routed connections: find a router
862// from THISNODE to dst
863connection *
864vpn::find_router_for (const connection *dst)
865{
725 connection *router = 0; 866 connection *router = 0;
726 867
868 // first try to find a router with a direct connection, route there
869 // regardless of any other considerations.
870 {
871 u32 prio = 1;
872
873 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
874 {
875 connection *c = *i;
876
877 if (c->conf->routerprio > prio
878 && c->conf != THISNODE
879 && can_direct (c->conf, dst->conf)
880 && c->ictx && c->octx)
881 {
882 prio = c->conf->routerprio;
883 router = c;
884 }
885 }
886 }
887
888 if (router)
889 return router;
890
891 // second try find the router with the highest priority, higher than ours
892 {
893 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
894
895 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
896 {
897 connection *c = *i;
898
899 if (c->conf->routerprio > prio
900 && c != dst
901 && c->conf != THISNODE
902 && c->ictx && c->octx)
903 {
904 prio = c->conf->routerprio;
905 router = c;
906 }
907 }
908 }
909
910 return router;
911}
912
913void
914vpn::connection_established (connection *c)
915{
727 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 916 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
728 { 917 {
729 connection *c = *i; 918 connection *o = *i;
730 919
731 if (c->conf->routerprio > prio 920 if (o->si.valid ()
732 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 921 && c->si != o->si
733 && c->ictx && c->octx 922 && c == find_router_for (o)
734 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 923 && !can_direct (THISNODE, o->conf))
735 {
736 prio = c->conf->routerprio;
737 router = c;
738 } 924 {
925 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
926 o->conf->nodename, c->conf->nodename);
927 o->rekey ();
928 }
739 } 929 }
740
741 return router;
742} 930}
743 931
932void
744void vpn::send_connect_request (int id) 933vpn::send_connect_request (connection *c)
745{ 934{
746 connection *c = find_router (); 935 connection *r = find_router_for (c);
747 936
748 if (c) 937 if (r)
938 {
939 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
940 c->conf->nodename, r->conf->nodename);
749 c->send_connect_request (id); 941 r->send_connect_request (c->conf->id);
942 }
750 else 943 else
751 // no router found, aggressively connect to all routers 944 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
752 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 945 c->conf->nodename);
753 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
754 (*i)->establish_connection ();
755} 946}
756 947
757void 948void
758connection::dump_status () 949connection::dump_status ()
759{ 950{
760 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 951 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
761 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 952 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
762 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 953 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
763 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 954 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
764 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 955 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
765 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
766 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
767} 956}
768 957
769void 958void
770vpn::dump_status () 959vpn::dump_status ()
771{ 960{
… …
776 965
777 slog (L_NOTICE, _("END status dump")); 966 slog (L_NOTICE, _("END status dump"));
778} 967}
779 968
780vpn::vpn (void) 969vpn::vpn (void)
970{
781: event (this, &vpn::event_cb) 971 event .set<vpn, &vpn::event_cb > (this);
782, udpv4_ev_watcher (this, &vpn::udpv4_ev) 972 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
783, ipv4_ev_watcher (this, &vpn::ipv4_ev) 973 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
784#if ENABLE_TCP 974#if ENABLE_TCP
785, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 975 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
786#endif 976#endif
787#if ENABLE_ICMP 977#if ENABLE_ICMP
788, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 978 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
789#endif 979#endif
790#if ENABLE_DNS 980#if ENABLE_DNS
791, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 981 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
792#endif 982#endif
793, tap_ev_watcher (this, &vpn::tap_ev) 983 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
794{
795} 984}
796 985
797vpn::~vpn () 986vpn::~vpn ()
798{ 987{
799} 988}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines