ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.51 by pcg, Sun Aug 10 14:48:57 2008 UTC vs.
Revision 1.69 by root, Sat Sep 5 17:40:22 2015 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify it 7 GVPE is free software; you can redistribute it and/or modify it
8 under the terms of the GNU General Public License as published by the 8 under the terms of the GNU General Public License as published by the
… …
38#include <cstdlib> 38#include <cstdlib>
39 39
40#include <sys/types.h> 40#include <sys/types.h>
41#include <sys/socket.h> 41#include <sys/socket.h>
42#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
43#include <errno.h> 44#include <errno.h>
44#include <time.h> 45#include <time.h>
45#include <unistd.h> 46#include <unistd.h>
46#include <fcntl.h> 47#include <fcntl.h>
47#include <sys/socket.h> 48#include <sys/socket.h>
… …
52 53
53#include "connection.h" 54#include "connection.h"
54#include "util.h" 55#include "util.h"
55#include "vpn.h" 56#include "vpn.h"
56 57
58using namespace std;
59
57vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
61
62/////////////////////////////////////////////////////////////////////////////
63
64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
58 87
59///////////////////////////////////////////////////////////////////////////// 88/////////////////////////////////////////////////////////////////////////////
60 89
61static void inline 90static void inline
62set_tos (int fd, int &tos_prev, int tos) 91set_tos (int fd, int &tos_prev, int tos)
… …
75{ 104{
76 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
77 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
78 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
79 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
80 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
81 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
82 111
83 char *env; 112 char *env;
84 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
85 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
… …
110inline const char * 139inline const char *
111vpn::script_if_up () 140vpn::script_if_up ()
112{ 141{
113 script_init_env (); 142 script_init_env ();
114 143
115 char *filename; 144 return conf.config_filename (::conf.script_if_up, "if-up");
116 asprintf (&filename, 145}
117 "%s/%s",
118 confbase,
119 ::conf.script_if_up ? ::conf.script_if_up : "if-up");
120 146
121 return filename; 147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
122} 168}
123 169
124int 170int
125vpn::setup () 171vpn::setup ()
126{ 172{
… …
129 ipv4_tos = -1; 175 ipv4_tos = -1;
130 ipv4_fd = -1; 176 ipv4_fd = -1;
131 177
132 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
133 { 179 {
134 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
135 181
136 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
137 return -1; 183 return -1;
138
139 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
140 fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
141 184
142#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
143 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
144 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
145 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
152 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
153 196
154 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
155 { 198 {
156 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
157 exit (EXIT_FAILURE); 200 return -1;
158 } 201 }
159 202
160 ipv4_ev_watcher.start (ipv4_fd, EV_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
161 ++success; 204 ++success;
162 } 205 }
… …
166 udpv4_tos = -1; 209 udpv4_tos = -1;
167 udpv4_fd = -1; 210 udpv4_fd = -1;
168 211
169 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
170 { 213 {
171 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
172 215
173 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
174 return -1; 217 return -1;
175
176 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
177 fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
178 218
179 // standard daemon practise... 219 // standard daemon practise...
180 { 220 {
181 int oval = 1; 221 int oval = 1;
182 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
195 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
196 236
197 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
198 { 238 {
199 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
200 exit (EXIT_FAILURE); 240 return -1;
201 } 241 }
202 242
203 udpv4_ev_watcher.start (udpv4_fd, EV_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
204 ++success; 244 ++success;
205 } 245 }
… …
210 icmpv4_fd = -1; 250 icmpv4_fd = -1;
211 251
212#if ENABLE_ICMP 252#if ENABLE_ICMP
213 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
214 { 254 {
215 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
216 256
217 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
218 return -1; 258 return -1;
219
220 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
221 fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
222 259
223#ifdef ICMP_FILTER 260#ifdef ICMP_FILTER
224 { 261 {
225 icmp_filter oval; 262 icmp_filter oval;
226 oval.data = 0xffffffff; 263 oval.data = 0xffffffff;
… …
244 sockinfo si (THISNODE, PROT_ICMPv4); 281 sockinfo si (THISNODE, PROT_ICMPv4);
245 282
246 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 283 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
247 { 284 {
248 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno)); 285 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
249 exit (EXIT_FAILURE); 286 return -1;
250 } 287 }
251 288
252 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ); 289 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
253 ++success; 290 ++success;
254 } 291 }
… …
257 tcpv4_fd = -1; 294 tcpv4_fd = -1;
258 295
259#if ENABLE_TCP 296#if ENABLE_TCP
260 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 297 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
261 { 298 {
262 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 299 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
263 300
264 if (tcpv4_fd < 0) 301 if (tcpv4_fd < 0)
265 return -1; 302 return -1;
266 303
267 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
268 fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
269
270 // standard daemon practise... 304 // standard daemon practise...
271 { 305 {
272 int oval = 1; 306 int oval = 1;
273 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 307 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
274 } 308 }
… …
276 sockinfo si (THISNODE, PROT_TCPv4); 310 sockinfo si (THISNODE, PROT_TCPv4);
277 311
278 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 312 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
279 { 313 {
280 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno)); 314 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
281 exit (EXIT_FAILURE); 315 return -1;
282 } 316 }
283 317
284 if (listen (tcpv4_fd, 5)) 318 if (listen (tcpv4_fd, 5))
285 { 319 {
286 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
287 exit (EXIT_FAILURE); 321 return -1;
288 } 322 }
289 323
290 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ); 324 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
291 ++success; 325 ++success;
292 } 326 }
… …
300#if ENABLE_DNS 334#if ENABLE_DNS
301 if (THISNODE->protocols & PROT_DNSv4) 335 if (THISNODE->protocols & PROT_DNSv4)
302 { 336 {
303 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 337 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
304 338
305 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 339 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
306 340
307 if (dnsv4_fd < 0) 341 if (dnsv4_fd < 0)
308 return -1; 342 return -1;
309
310 fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
311 fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
312 343
313# if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 344# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
314 // this I really consider a linux bug. I am neither connected 345 // this I really consider a linux bug. I am neither connected
315 // nor do I fragment myself. Linux still sets DF and doesn't 346 // nor do I fragment myself. Linux still sets DF and doesn't
316 // fragment for me sometimes. 347 // fragment for me sometimes.
… …
331 PROT_DNSv4); 362 PROT_DNSv4);
332 363
333 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 364 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
334 { 365 {
335 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno)); 366 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
336 exit (EXIT_FAILURE); 367 return -1;
337 } 368 }
338 369
339 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ); 370 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
340 ++success; 371 ++success;
341 } 372 }
… …
343 374
344 ///////////////////////////////////////////////////////////////////////////// 375 /////////////////////////////////////////////////////////////////////////////
345 376
346 if (!success) 377 if (!success)
347 { 378 {
348 slog (L_ERR, _("no protocols enabled, exiting.")); 379 slog (L_ERR, _("no protocols enabled."));
349 exit (EXIT_FAILURE); 380 return -1;
350 } 381 }
351 382
352 reconnect_all (); 383 reconnect_all ();
353 384
354 ///////////////////////////////////////////////////////////////////////////// 385 /////////////////////////////////////////////////////////////////////////////
355 386
356 tap = new tap_device (); 387 tap = new tap_device ();
357 if (!tap) //D this, of course, never catches 388 if (!tap) //D this, of course, never catches
358 { 389 {
359 slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname); 390 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
360 exit (EXIT_FAILURE); 391 return -1;
361 } 392 }
362 393
363 fcntl (tap->fd, F_SETFD, FD_CLOEXEC); 394 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
364 395
365 run_script_cb cb; 396 run_script_cb cb;
366 cb.set<vpn, &vpn::script_if_init> (this); 397 cb.set<vpn, &vpn::script_if_init> (this);
367 398
368 if (tap->if_up () && 399 if (tap->if_up () &&
369 !run_script (cb, true)) 400 !run_script (cb, true))
370 { 401 {
371 slog (L_ERR, _("interface initialization command '%s' failed, exiting."), 402 slog (L_ERR, _("interface initialization command '%s' failed."),
372 tap->if_up ()); 403 tap->if_up ());
373 exit (EXIT_FAILURE); 404 return -1;
374 } 405 }
375 406
376 cb.set<vpn, &vpn::script_if_up> (this); 407 cb.set<vpn, &vpn::script_if_up> (this);
377 if (!run_script (cb, true)) 408 if (!run_script (cb, true))
378 { 409 {
379 slog (L_ERR, _("if-up command execution failed, exiting.")); 410 slog (L_ERR, _("if-up command execution failed."));
380 exit (EXIT_FAILURE); 411 return -1;
381 } 412 }
382 413
383 tap_ev_watcher.start (tap->fd, EV_READ); 414 tap_ev_watcher.start (tap->fd, EV_READ);
384 415
385 return 0; 416 return 0;
417}
418
419bool
420vpn::drop_privileges ()
421{
422 if (::conf.change_root)
423 {
424 if (!strcmp (::conf.change_root, "/"))
425 {
426 char dir [L_tmpnam];
427 if (!tmpnam (dir))
428 {
429 slog (L_CRIT, _("unable to create anonymous root path."));
430 return false;
431 }
432
433 if (mkdir (dir, 0700))
434 {
435 slog (L_CRIT, _("unable to create anonymous root directory."));
436 return false;
437 }
438
439 if (chdir (dir))
440 {
441 slog (L_CRIT, _("unable to change to anonymous root directory."));
442 return false;
443 }
444
445 if (rmdir (dir))
446 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
447 }
448 else
449 {
450 if (chdir (::conf.change_root))
451 {
452 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
453 return false;
454 }
455 }
456
457 if (chroot ("."))
458 {
459 slog (L_CRIT, _("unable to set new root directory."));
460 return false;
461 }
462
463 if (chdir ("/"))
464 {
465 slog (L_CRIT, _("unable to set cwd to new root directory."));
466 return false;
467 }
468 }
469
470 if (::conf.change_gid)
471 if (setgid (::conf.change_gid))
472 {
473 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
474 return false;
475 }
476
477 if (::conf.change_uid)
478 if (setuid (::conf.change_uid))
479 {
480 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
481 return false;
482 }
483
484 return true;
386} 485}
387 486
388bool 487bool
389vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 488vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
390{ 489{
391 set_tos (ipv4_fd, ipv4_tos, tos); 490 set_tos (ipv4_fd, ipv4_tos, tos);
392 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 491 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
393 492
394 return true; 493 return true;
395} 494}
396 495
397static u16 496static u16
… …
428 hdr->code = 255; 527 hdr->code = 255;
429 hdr->checksum = 0; 528 hdr->checksum = 0;
430 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 529 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
431 530
432 set_tos (icmpv4_fd, icmpv4_tos, tos); 531 set_tos (icmpv4_fd, icmpv4_tos, tos);
433 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 532 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
434 533
435 return true; 534 return true;
436} 535}
437#endif 536#endif
438 537
439bool 538bool
440vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 539vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
441{ 540{
442 set_tos (udpv4_fd, udpv4_tos, tos); 541 set_tos (udpv4_fd, udpv4_tos, tos);
443 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 542 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
444 543
445 return true; 544 return true;
446} 545}
447 546
448void 547void
… …
474 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 573 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
475 574
476 if (src == 0 || src > conns.size () 575 if (src == 0 || src > conns.size ()
477 || dst > conns.size () 576 || dst > conns.size ()
478 || pkt->typ () >= vpn_packet::PT_MAX) 577 || pkt->typ () >= vpn_packet::PT_MAX)
479 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
480 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
481 else if (dst > conns.size ())
482 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."), 578 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
483 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
484 else 580 else
485 { 581 {
486 connection *c = conns[src - 1]; 582 connection *c = conns[src - 1];
… …
508vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 604vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
509{ 605{
510 switch (si.prot) 606 switch (si.prot)
511 { 607 {
512 case PROT_IPv4: 608 case PROT_IPv4:
513 return send_ipv4_packet (pkt, si, tos); 609 return send_ipv4_packet (pkt, si, tos);
514 610
515 case PROT_UDPv4: 611 case PROT_UDPv4:
516 return send_udpv4_packet (pkt, si, tos); 612 return send_udpv4_packet (pkt, si, tos);
517 613
518#if ENABLE_TCP 614#if ENABLE_TCP
519 case PROT_TCPv4: 615 case PROT_TCPv4:
520 return send_tcpv4_packet (pkt, si, tos); 616 return send_tcpv4_packet (pkt, si, tos);
521#endif 617#endif
522#if ENABLE_ICMP 618#if ENABLE_ICMP
523 case PROT_ICMPv4: 619 case PROT_ICMPv4:
524 return send_icmpv4_packet (pkt, si, tos); 620 return send_icmpv4_packet (pkt, si, tos);
525#endif 621#endif
526#if ENABLE_DNS 622#if ENABLE_DNS
527 case PROT_DNSv4: 623 case PROT_DNSv4:
528 return send_dnsv4_packet (pkt, si, tos); 624 return send_dnsv4_packet (pkt, si, tos);
529#endif 625#endif
530 default: 626 default:
531 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si); 627 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
532 } 628 }
533 629
… …
551 if (len > 0) 647 if (len > 0)
552 { 648 {
553 pkt->len = len; 649 pkt->len = len;
554 650
555 // raw sockets deliver the ipv4 header, but don't expect it on sends 651 // raw sockets deliver the ipv4 header, but don't expect it on sends
556 pkt->skip_hdr (IP_OVERHEAD); 652 pkt->skip_hdr (pkt->ipv4_hdr_len ());
557 653
558 recv_vpn_packet (pkt, si); 654 recv_vpn_packet (pkt, si);
559 } 655 }
560 else 656 else
561 { 657 {
… …
598 if (hdr->type == ::conf.icmp_type 694 if (hdr->type == ::conf.icmp_type
599 && hdr->code == 255) 695 && hdr->code == 255)
600 { 696 {
601 // raw sockets deliver the ipv4, but don't expect it on sends 697 // raw sockets deliver the ipv4, but don't expect it on sends
602 // this is slow, but... 698 // this is slow, but...
603 pkt->skip_hdr (ICMP_OVERHEAD); 699 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
604 700
605 recv_vpn_packet (pkt, si); 701 recv_vpn_packet (pkt, si);
606 } 702 }
607 } 703 }
608 else 704 else
… …
750 846
751 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 847 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
752 (*c)->establish_connection (); 848 (*c)->establish_connection ();
753} 849}
754 850
851bool
755bool vpn::can_direct (conf_node *src, conf_node *dst) const 852vpn::can_direct (conf_node *src, conf_node *dst) const
756{ 853{
757 return src != dst 854 return src != dst
758 && src->may_direct (dst) 855 && src->may_direct (dst)
759 && dst->may_direct (src) 856 && dst->may_direct (src)
760 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS) 857 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
761 || (src->protocols & dst->connectable_protocols ())); 858 || (src->protocols & dst->connectable_protocols ()));
762} 859}
763 860
764// only works for indirect and routed connections: find a router 861// only works for indirect and routed connections: find a router
765// from THISNODE to dst 862// from THISNODE to dst
863connection *
766connection *vpn::find_router_for (const connection *dst) 864vpn::find_router_for (const connection *dst)
767{ 865{
768 connection *router = 0; 866 connection *router = 0;
769 867
770 // first try to find a router with a direct connection 868 // first try to find a router with a direct connection, route there
869 // regardless of any other considerations.
771 { 870 {
772 u32 prio = 1; 871 u32 prio = 1;
773 872
774 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 873 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
775 { 874 {
776 connection *c = *i; 875 connection *c = *i;
777 876
778 if (c->conf->routerprio > prio 877 if (c->conf->routerprio > prio
779 && c->conf != THISNODE 878 && c->conf != THISNODE
780 && c != dst
781 && can_direct (c->conf, dst->conf)) 879 && can_direct (c->conf, dst->conf)
880 && c->ictx && c->octx)
782 { 881 {
783 if (c->ictx && c->octx)
784 {
785 prio = c->conf->routerprio; 882 prio = c->conf->routerprio;
786 router = c; 883 router = c;
787 }
788 else
789 c->establish_connection ();
790 } 884 }
791 } 885 }
792 } 886 }
793 887
794 if (router) 888 if (router)
795 return router; 889 return router;
796 890
797 // second try find the router with the highest priority higher than ours 891 // second try find the router with the highest priority, higher than ours
798 { 892 {
799 u32 prio = 1; 893 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
800 894
801 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 895 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
802 { 896 {
803 connection *c = *i; 897 connection *c = *i;
804 898
805 if (c->conf->routerprio > prio 899 if (c->conf->routerprio > prio
806 && c->conf->routerprio > THISNODE->routerprio
807 && c != dst 900 && c != dst
808 && c->conf != THISNODE) 901 && c->conf != THISNODE
902 && c->ictx && c->octx)
809 { 903 {
810 if (c->ictx && c->octx)
811 {
812 prio = c->conf->routerprio; 904 prio = c->conf->routerprio;
813 router = c; 905 router = c;
814 }
815 else
816 c->establish_connection ();
817 } 906 }
818 } 907 }
819 } 908 }
909
820 return router; 910 return router;
821} 911}
822 912
913void
823void vpn::connection_established (connection *c) 914vpn::connection_established (connection *c)
824{ 915{
825 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 916 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
826 { 917 {
827 connection *o = *i; 918 connection *o = *i;
828 919
829 if (!o->is_direct
830 && o->si.valid () 920 if (o->si.valid ()
831 && c->si != o->si 921 && c->si != o->si
832 && c == find_router_for (o)) 922 && c == find_router_for (o)
923 && !can_direct (THISNODE, o->conf))
833 { 924 {
834 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."), 925 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
835 o->conf->nodename, c->conf->nodename); 926 o->conf->nodename, c->conf->nodename);
836 o->rekey (); 927 o->rekey ();
837 } 928 }
838 } 929 }
839} 930}
840 931
932void
841void vpn::send_connect_request (connection *c) 933vpn::send_connect_request (connection *c)
842{ 934{
843 connection *r = find_router_for (c); 935 connection *r = find_router_for (c);
844 936
845 if (r) 937 if (r)
846 { 938 {
847 slog (L_TRACE, _("%s: no way to connect, sending mediated connection request via %s."), 939 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
848 c->conf->nodename, r->conf->nodename); 940 c->conf->nodename, r->conf->nodename);
849 r->send_connect_request (c->conf->id); 941 r->send_connect_request (c->conf->id);
850 } 942 }
851 else 943 else
852 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect."), 944 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
853 c->conf->nodename); 945 c->conf->nodename);
854} 946}
855 947
856void 948void
857connection::dump_status () 949connection::dump_status ()

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines