ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn.C
(Generate patch)

Comparing gvpe/src/vpn.C (file contents):
Revision 1.32 by pcg, Mon Mar 7 01:31:26 2005 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

1/* 1/*
2 vpn.C -- handle the protocol, encryption, handshaking etc. 2 vpn.C -- handle the protocol, encryption, handshaking etc.
3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de> 3 Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE. 5 This file is part of GVPE.
6 6
7 GVPE is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
8 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
9 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
10 (at your option) any later version. 10 option) any later version.
11 11
12 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
13 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15 GNU General Public License for more details. 15 Public License for more details.
16 16
17 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
18 along with gvpe; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
20*/ 30*/
21 31
22#include "config.h" 32#include "config.h"
23 33
24#include <list> 34#include <list>
… …
28#include <cstdlib> 38#include <cstdlib>
29 39
30#include <sys/types.h> 40#include <sys/types.h>
31#include <sys/socket.h> 41#include <sys/socket.h>
32#include <sys/wait.h> 42#include <sys/wait.h>
43#include <sys/stat.h>
33#include <errno.h> 44#include <errno.h>
34#include <time.h> 45#include <time.h>
35#include <unistd.h> 46#include <unistd.h>
36#include <fcntl.h> 47#include <fcntl.h>
37#include <sys/socket.h> 48#include <sys/socket.h>
… …
42 53
43#include "connection.h" 54#include "connection.h"
44#include "util.h" 55#include "util.h"
45#include "vpn.h" 56#include "vpn.h"
46 57
58using namespace std;
59
47vpn network; // THE vpn (bad design...) 60vpn network; // THE vpn (bad design...)
48 61
49///////////////////////////////////////////////////////////////////////////// 62/////////////////////////////////////////////////////////////////////////////
50 63
51const char *vpn::script_if_up () 64// hopefully temporary workaround for rare buffer full conditions
65// if it happens, usually instantly retrying or retrying ~5ms later
66// is good enough with current network technologies/kernels
67
68static ssize_t
69xsendto (int fd, const void *buf, size_t len, int flags,
70 const struct sockaddr *sa, socklen_t salen)
71{
72 ssize_t res;
73
74 for (int retry = 0; retry <= 13; ++retry) // ~100ms
75 {
76 res = sendto (fd, buf, len, flags, sa, salen);
77
78 if (res >= 0 || errno != ENOBUFS)
79 break;
80
81 struct timespec ts = { 0, 1000 * retry };
82 nanosleep (&ts, 0);
83 }
84
85 return res;
86}
87
88/////////////////////////////////////////////////////////////////////////////
89
90static void inline
91set_tos (int fd, int &tos_prev, int tos)
92{
93#if defined(SOL_IP) && defined(IP_TOS)
94 if (tos_prev == tos)
95 return;
96
97 tos_prev = tos;
98 setsockopt (fd, SOL_IP, IP_TOS, &tos, sizeof tos);
99#endif
100}
101
102void
103vpn::script_init_env ()
52{ 104{
53 // the tunnel device mtu should be the physical mtu - overhead 105 // the tunnel device mtu should be the physical mtu - overhead
54 // the tricky part is rounding to the cipher key blocksize 106 // the tricky part is rounding to the cipher key blocksize
55 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD; 107 int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion 108 mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57 mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round 109 mtu -= mtu % BLOCK_SIZE (CIPHER); // round
58 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again 110 mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59 111
60 char *env; 112 char *env;
61 asprintf (&env, "CONFBASE=%s", confbase); putenv (env); 113 asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62 asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env); 114 asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env); 115 asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env); 116 asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67 asprintf (&env, "MTU=%d", mtu); putenv (env); 117 asprintf (&env, "MTU=%d", mtu); putenv (env);
68 asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x", 118 asprintf (&env, "NODES=%d", conns.size ()); putenv (env);
69 0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8, 119 asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
70 THISNODE->id & 0xff);
71 putenv (env);
72 120
73 return ::conf.script_if_up ? ::conf.script_if_up : "if-up"; 121 conns [THISNODE->id - 1]->script_init_env ("");
122
123 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
124 {
125 char ext[16];
126 snprintf (ext, 16, "_%d", (*c)->conf->id);
127 (*c)->script_init_env (ext);
128 }
129}
130
131inline const char *
132vpn::script_if_init ()
133{
134 script_init_env ();
135
136 return tap->if_up ();
137}
138
139inline const char *
140vpn::script_if_up ()
141{
142 script_init_env ();
143
144 return conf.config_filename (::conf.script_if_up, "if-up");
145}
146
147int
148vpn::setup_socket (u8 prot, int family, int type, int proto)
149{
150 int fd = socket (family, type, proto);
151
152 if (fd < 0)
153 {
154 slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
155 return fd;
156 }
157
158 fcntl (fd, F_SETFL, O_NONBLOCK);
159 fcntl (fd, F_SETFD, FD_CLOEXEC);
160
161#ifdef SO_MARK
162 if (::conf.nfmark)
163 if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
164 slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
165#endif
166
167 return fd;
74} 168}
75 169
76int 170int
77vpn::setup () 171vpn::setup ()
78{ 172{
173 int success = 0;
174
175 ipv4_tos = -1;
79 ipv4_fd = -1; 176 ipv4_fd = -1;
80 177
81 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto) 178 if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82 { 179 {
83 ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto); 180 ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
84 181
85 if (ipv4_fd < 0) 182 if (ipv4_fd < 0)
86 return -1; 183 return -1;
87
88 fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89 184
90#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 185#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91 // this I really consider a linux bug. I am neither connected 186 // this I really consider a linux bug. I am neither connected
92 // nor do I fragment myself. Linux still sets DF and doesn't 187 // nor do I fragment myself. Linux still sets DF and doesn't
93 // fragment for me sometimes. 188 // fragment for me sometimes.
… …
99 194
100 sockinfo si (THISNODE, PROT_IPv4); 195 sockinfo si (THISNODE, PROT_IPv4);
101 196
102 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ())) 197 if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103 { 198 {
104 slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno)); 199 slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
105 exit (EXIT_FAILURE); 200 return -1;
106 } 201 }
107 202
108 ipv4_ev_watcher.start (ipv4_fd, EVENT_READ); 203 ipv4_ev_watcher.start (ipv4_fd, EV_READ);
204 ++success;
109 } 205 }
206 else
207 THISNODE->protocols &= ~PROT_IPv4;
110 208
209 udpv4_tos = -1;
111 udpv4_fd = -1; 210 udpv4_fd = -1;
112 211
113 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port) 212 if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114 { 213 {
115 udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 214 udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116 215
117 if (udpv4_fd < 0) 216 if (udpv4_fd < 0)
118 return -1; 217 return -1;
119
120 fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121 218
122 // standard daemon practise... 219 // standard daemon practise...
123 { 220 {
124 int oval = 1; 221 int oval = 1;
125 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 222 setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
137 234
138 sockinfo si (THISNODE, PROT_UDPv4); 235 sockinfo si (THISNODE, PROT_UDPv4);
139 236
140 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ())) 237 if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141 { 238 {
142 slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno)); 239 slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
143 exit (EXIT_FAILURE); 240 return -1;
144 } 241 }
145 242
146 udpv4_ev_watcher.start (udpv4_fd, EVENT_READ); 243 udpv4_ev_watcher.start (udpv4_fd, EV_READ);
244 ++success;
147 } 245 }
246 else
247 THISNODE->protocols &= ~PROT_UDPv4;
148 248
249 icmpv4_tos = -1;
149 icmpv4_fd = -1; 250 icmpv4_fd = -1;
150 251
151#if ENABLE_ICMP 252#if ENABLE_ICMP
152 if (THISNODE->protocols & PROT_ICMPv4) 253 if (THISNODE->protocols & PROT_ICMPv4)
153 { 254 {
154 icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP); 255 icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
155 256
156 if (icmpv4_fd < 0) 257 if (icmpv4_fd < 0)
157 return -1; 258 return -1;
158 259
159 fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK); 260// no clue where trhis is actually defined
261#if !defined(ICMP_FILTER) && defined(__linux)
262 #define ICMP_FILTER 1
263#endif
160 264
161#ifdef ICMP_FILTER 265#ifdef ICMP_FILTER
162 { 266 {
163 icmp_filter oval; 267 uint32_t oval;
164 oval.data = 0xffffffff; 268 oval = 0;
165 if (::conf.icmp_type < 32) 269 if (::conf.icmp_type < 32)
166 oval.data &= ~(1 << ::conf.icmp_type); 270 oval |= 1 << ::conf.icmp_type;
271 oval = ~oval;
167 272
168 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval); 273 setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
169 } 274 }
170#endif 275#endif
171 276
… …
173 // this I really consider a linux bug. I am neither connected 278 // this I really consider a linux bug. I am neither connected
174 // nor do I fragment myself. Linux still sets DF and doesn't 279 // nor do I fragment myself. Linux still sets DF and doesn't
175 // fragment for me sometimes. 280 // fragment for me sometimes.
176 { 281 {
177 int oval = IP_PMTUDISC_DONT; 282 int oval = IP_PMTUDISC_DONT;
178 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 283 setsockopt (icmpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179 } 284 }
180#endif 285#endif
181 286
182 sockinfo si (THISNODE, PROT_ICMPv4); 287 sockinfo si (THISNODE, PROT_ICMPv4);
183 288
184 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ())) 289 if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185 { 290 {
186 slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno)); 291 slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
187 exit (EXIT_FAILURE); 292 return -1;
188 } 293 }
189 294
190 icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ); 295 icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
296 ++success;
191 } 297 }
192#endif 298#endif
193 299
194 tcpv4_fd = -1; 300 tcpv4_fd = -1;
195 301
196#if ENABLE_TCP 302#if ENABLE_TCP
197 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port) 303 if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198 { 304 {
199 tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP); 305 tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
200 306
201 if (tcpv4_fd < 0) 307 if (tcpv4_fd < 0)
202 return -1; 308 return -1;
203 309
204 fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205
206 // standard daemon practise... 310 // standard daemon practise...
207 { 311 {
208 int oval = 1; 312 int oval = 1;
209 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 313 setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
210 } 314 }
211 315
212 sockinfo si (THISNODE, PROT_TCPv4); 316 sockinfo si (THISNODE, PROT_TCPv4);
213 317
214 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ())) 318 if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215 { 319 {
216 slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 320 slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
217 exit (EXIT_FAILURE); 321 return -1;
218 } 322 }
219 323
220 if (listen (tcpv4_fd, 5)) 324 if (listen (tcpv4_fd, 5))
221 { 325 {
222 slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno)); 326 slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
223 exit (EXIT_FAILURE); 327 return -1;
224 } 328 }
225 329
226 tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ); 330 tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
331 ++success;
227 } 332 }
333 else
334 THISNODE->protocols &= ~PROT_TCPv4;
228#endif 335#endif
336
337 dnsv4_tos = -1;
338 dnsv4_fd = -1;
229 339
230#if ENABLE_DNS 340#if ENABLE_DNS
231 if (THISNODE->protocols & PROT_DNSv4) 341 if (THISNODE->protocols & PROT_DNSv4)
232 { 342 {
233 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 343 dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234 344
235 dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP); 345 dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236 346
237 if (dnsv4_fd < 0) 347 if (dnsv4_fd < 0)
238 return -1; 348 return -1;
239 349
240#if defined(SOL_IP) && defined(IP_MTU_DISCOVER) 350# if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
241 // this I really consider a linux bug. I am neither connected 351 // this I really consider a linux bug. I am neither connected
242 // nor do I fragment myself. Linux still sets DF and doesn't 352 // nor do I fragment myself. Linux still sets DF and doesn't
243 // fragment for me sometimes. 353 // fragment for me sometimes.
244 { 354 {
245 int oval = IP_PMTUDISC_DONT; 355 int oval = IP_PMTUDISC_DONT;
246 setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval); 356 setsockopt (dnsv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
247 } 357 }
248#endif 358# endif
249 359
250 // standard daemon practise... 360 // standard daemon practise...
251 { 361 {
252 int oval = 1; 362 int oval = 1;
253 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval); 363 setsockopt (dnsv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
… …
257 THISNODE->dns_hostname ? THISNODE->dns_port : 0, 367 THISNODE->dns_hostname ? THISNODE->dns_port : 0,
258 PROT_DNSv4); 368 PROT_DNSv4);
259 369
260 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ())) 370 if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
261 { 371 {
262 slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno)); 372 slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
263 exit (EXIT_FAILURE); 373 return -1;
264 } 374 }
265 375
266 dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ); 376 dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
377 ++success;
378 }
379#endif
380
381 /////////////////////////////////////////////////////////////////////////////
382
383 if (!success)
267 } 384 {
268#endif 385 slog (L_ERR, _("no protocols enabled."));
386 return -1;
387 }
388
389 reconnect_all ();
390
391 /////////////////////////////////////////////////////////////////////////////
269 392
270 tap = new tap_device (); 393 tap = new tap_device ();
271 if (!tap) //D this, of course, never catches 394 if (!tap) //D this, of course, never catches
272 { 395 {
273 slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname); 396 slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
274 exit (EXIT_FAILURE); 397 return -1;
275 } 398 }
276 399
277 run_script (run_script_cb (this, &vpn::script_if_up), true); 400 fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
278 401
402 run_script_cb cb;
403 cb.set<vpn, &vpn::script_if_init> (this);
404
405 if (tap->if_up () &&
406 !run_script (cb, true))
407 {
408 slog (L_ERR, _("interface initialization command '%s' failed."),
409 tap->if_up ());
410 return -1;
411 }
412
413 cb.set<vpn, &vpn::script_if_up> (this);
414 if (!run_script (cb, true))
415 {
416 slog (L_ERR, _("if-up command execution failed."));
417 return -1;
418 }
419
279 tap_ev_watcher.start (tap->fd, EVENT_READ); 420 tap_ev_watcher.start (tap->fd, EV_READ);
280
281 reconnect_all ();
282 421
283 return 0; 422 return 0;
423}
424
425bool
426vpn::drop_privileges ()
427{
428 if (::conf.change_root)
429 {
430 if (!strcmp (::conf.change_root, "/"))
431 {
432 char dir [L_tmpnam];
433 if (!tmpnam (dir))
434 {
435 slog (L_CRIT, _("unable to create anonymous root path."));
436 return false;
437 }
438
439 if (mkdir (dir, 0700))
440 {
441 slog (L_CRIT, _("unable to create anonymous root directory."));
442 return false;
443 }
444
445 if (chdir (dir))
446 {
447 slog (L_CRIT, _("unable to change to anonymous root directory."));
448 return false;
449 }
450
451 if (rmdir (dir))
452 slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
453 }
454 else
455 {
456 if (chdir (::conf.change_root))
457 {
458 slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
459 return false;
460 }
461 }
462
463 if (chroot ("."))
464 {
465 slog (L_CRIT, _("unable to set new root directory."));
466 return false;
467 }
468
469 if (chdir ("/"))
470 {
471 slog (L_CRIT, _("unable to set cwd to new root directory."));
472 return false;
473 }
474 }
475
476 if (::conf.change_gid)
477 if (setgid (::conf.change_gid))
478 {
479 slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
480 return false;
481 }
482
483 if (::conf.change_uid)
484 if (setuid (::conf.change_uid))
485 {
486 slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
487 return false;
488 }
489
490 return true;
284} 491}
285 492
286bool 493bool
287vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 494vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
288{ 495{
289#if defined(SOL_IP) && defined(IP_TOS) 496 set_tos (ipv4_fd, ipv4_tos, tos);
290 setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
291#endif
292 sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 497 xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
293 498
294 return true; 499 return true;
295} 500}
296 501
297static u16 502static u16
… …
319 524
320#if ENABLE_ICMP 525#if ENABLE_ICMP
321bool 526bool
322vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 527vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
323{ 528{
324#if defined(SOL_IP) && defined(IP_TOS)
325 setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
326#endif
327
328 pkt->unshift_hdr (4); 529 pkt->unshift_hdr (4);
329 530
330 icmp_header *hdr = (icmp_header *)&((*pkt)[0]); 531 icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
331 hdr->type = ::conf.icmp_type; 532 hdr->type = ::conf.icmp_type;
332 hdr->code = 255; 533 hdr->code = 255;
333 hdr->checksum = 0; 534 hdr->checksum = 0;
334 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len); 535 hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
335 536
537 set_tos (icmpv4_fd, icmpv4_tos, tos);
336 sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 538 xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
337 539
338 return true; 540 return true;
339} 541}
340#endif 542#endif
341 543
342bool 544bool
343vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 545vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
344{ 546{
345#if defined(SOL_IP) && defined(IP_TOS) 547 set_tos (udpv4_fd, udpv4_tos, tos);
346 setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
347#endif
348 sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ()); 548 xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
349 549
350 return true; 550 return true;
351} 551}
352 552
353void 553void
… …
363 { 563 {
364 // broadcast, this is ugly, but due to the security policy 564 // broadcast, this is ugly, but due to the security policy
365 // we have to connect to all hosts... 565 // we have to connect to all hosts...
366 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 566 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
367 if ((*c)->conf != THISNODE) 567 if ((*c)->conf != THISNODE)
368 (*c)->inject_data_packet (pkt, true); 568 (*c)->inject_data_packet (pkt);
369 } 569 }
370} 570}
371 571
372void 572void
373vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi) 573vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
374{ 574{
375 unsigned int src = pkt->src (); 575 unsigned int src = pkt->src ();
376 unsigned int dst = pkt->dst (); 576 unsigned int dst = pkt->dst ();
377 577
378 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"), 578 slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d."),
379 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len); 579 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
380 580
381 if (src == 0 || src > conns.size () 581 if (src == 0 || src > conns.size ()
382 || dst > conns.size () 582 || dst > conns.size ()
383 || pkt->typ () >= vpn_packet::PT_MAX) 583 || pkt->typ () >= vpn_packet::PT_MAX)
384 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"), 584 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
385 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
386 else if (dst > conns.size ())
387 slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
388 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ()); 585 (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
389 else 586 else
390 { 587 {
391 connection *c = conns[src - 1]; 588 connection *c = conns[src - 1];
392 589
393 if (dst == 0) 590 if (dst == 0)
394 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"), 591 slog (L_WARN, _("%s(%s): received broadcast (protocol violation)."),
395 c->conf->nodename, (const char *)rsi); 592 c->conf->nodename, (const char *)rsi);
396 else if (dst != THISNODE->id) 593 else if (dst != THISNODE->id)
397 { 594 {
398 if (THISNODE->routerprio) 595 if (THISNODE->routerprio)
399 // the tos setting gets lost here. who cares. 596 // the tos setting gets lost here. who cares.
400 conns[dst - 1]->inject_vpn_packet (pkt); 597 conns[dst - 1]->inject_vpn_packet (pkt);
401 else 598 else
402 slog (L_WARN, 599 slog (L_WARN,
403 _("%s(%s): forwarding request (=> %s), but we are no router"), 600 _("%s(%s): request to forward packet to %s, but we are no router (config mismatch?)."),
404 c->conf->nodename, (const char *)rsi, 601 c->conf->nodename, (const char *)rsi,
405 conns[dst - 1]->conf->nodename); 602 conns[dst - 1]->conf->nodename);
406 } 603 }
407 else 604 else
408 c->recv_vpn_packet (pkt, rsi); 605 c->recv_vpn_packet (pkt, rsi);
… …
413vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos) 610vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
414{ 611{
415 switch (si.prot) 612 switch (si.prot)
416 { 613 {
417 case PROT_IPv4: 614 case PROT_IPv4:
418 return send_ipv4_packet (pkt, si, tos); 615 return send_ipv4_packet (pkt, si, tos);
616
419 case PROT_UDPv4: 617 case PROT_UDPv4:
420 return send_udpv4_packet (pkt, si, tos); 618 return send_udpv4_packet (pkt, si, tos);
619
421#if ENABLE_TCP 620#if ENABLE_TCP
422 case PROT_TCPv4: 621 case PROT_TCPv4:
423 return send_tcpv4_packet (pkt, si, tos); 622 return send_tcpv4_packet (pkt, si, tos);
424#endif 623#endif
425#if ENABLE_ICMP 624#if ENABLE_ICMP
426 case PROT_ICMPv4: 625 case PROT_ICMPv4:
427 return send_icmpv4_packet (pkt, si, tos); 626 return send_icmpv4_packet (pkt, si, tos);
428#endif 627#endif
429#if ENABLE_DNS 628#if ENABLE_DNS
430 case PROT_DNSv4: 629 case PROT_DNSv4:
431 return send_dnsv4_packet (pkt, si, tos); 630 return send_dnsv4_packet (pkt, si, tos);
432#endif 631#endif
433
434 default: 632 default:
435 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol"), (const char *)si); 633 slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
436 } 634 }
437 635
438 return false; 636 return false;
439} 637}
440 638
441void 639inline void
442vpn::ipv4_ev (io_watcher &w, short revents) 640vpn::ipv4_ev (ev::io &w, int revents)
443{ 641{
444 if (revents & EVENT_READ) 642 if (revents & EV_READ)
445 { 643 {
446 vpn_packet *pkt = new vpn_packet; 644 vpn_packet *pkt = new vpn_packet;
447 struct sockaddr_in sa; 645 struct sockaddr_in sa;
448 socklen_t sa_len = sizeof (sa); 646 socklen_t sa_len = sizeof (sa);
449 int len; 647 int len;
… …
455 if (len > 0) 653 if (len > 0)
456 { 654 {
457 pkt->len = len; 655 pkt->len = len;
458 656
459 // raw sockets deliver the ipv4 header, but don't expect it on sends 657 // raw sockets deliver the ipv4 header, but don't expect it on sends
460 pkt->skip_hdr (IP_OVERHEAD); 658 pkt->skip_hdr (pkt->ipv4_hdr_len ());
461 659
462 recv_vpn_packet (pkt, si); 660 recv_vpn_packet (pkt, si);
463 } 661 }
464 else 662 else
465 { 663 {
466 // probably ECONNRESET or somesuch 664 // probably ECONNRESET or somesuch
467 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 665 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
468 } 666 }
469 667
470 delete pkt; 668 delete pkt;
471 } 669 }
472 else 670 else
473 { 671 {
474 slog (L_ERR, 672 slog (L_ERR,
475 _("FATAL: unknown revents %08x in socket, terminating\n"), 673 _("FATAL: unknown revents %08x in socket, exiting.\n"),
476 revents); 674 revents);
477 exit (EXIT_FAILURE); 675 exit (EXIT_FAILURE);
478 } 676 }
479} 677}
480 678
481#if ENABLE_ICMP 679#if ENABLE_ICMP
482void 680inline void
483vpn::icmpv4_ev (io_watcher &w, short revents) 681vpn::icmpv4_ev (ev::io &w, int revents)
484{ 682{
485 if (revents & EVENT_READ) 683 if (revents & EV_READ)
486 { 684 {
487 vpn_packet *pkt = new vpn_packet; 685 vpn_packet *pkt = new vpn_packet;
488 struct sockaddr_in sa; 686 struct sockaddr_in sa;
489 socklen_t sa_len = sizeof (sa); 687 socklen_t sa_len = sizeof (sa);
490 int len; 688 int len;
… …
502 if (hdr->type == ::conf.icmp_type 700 if (hdr->type == ::conf.icmp_type
503 && hdr->code == 255) 701 && hdr->code == 255)
504 { 702 {
505 // raw sockets deliver the ipv4, but don't expect it on sends 703 // raw sockets deliver the ipv4, but don't expect it on sends
506 // this is slow, but... 704 // this is slow, but...
507 pkt->skip_hdr (ICMP_OVERHEAD); 705 pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
508 706
509 recv_vpn_packet (pkt, si); 707 recv_vpn_packet (pkt, si);
510 } 708 }
511 } 709 }
512 else 710 else
513 { 711 {
514 // probably ECONNRESET or somesuch 712 // probably ECONNRESET or somesuch
515 slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno)); 713 slog (L_DEBUG, _("%s: %s."), (const char *)si, strerror (errno));
516 } 714 }
517 715
518 delete pkt; 716 delete pkt;
519 } 717 }
520 else 718 else
521 { 719 {
522 slog (L_ERR, 720 slog (L_ERR,
523 _("FATAL: unknown revents %08x in socket, terminating\n"), 721 _("FATAL: unknown revents %08x in socket, exiting.\n"),
524 revents); 722 revents);
525 exit (EXIT_FAILURE); 723 exit (EXIT_FAILURE);
526 } 724 }
527} 725}
528#endif 726#endif
529 727
530void 728inline void
531vpn::udpv4_ev (io_watcher &w, short revents) 729vpn::udpv4_ev (ev::io &w, int revents)
532{ 730{
533 if (revents & EVENT_READ) 731 if (revents & EV_READ)
534 { 732 {
535 vpn_packet *pkt = new vpn_packet; 733 vpn_packet *pkt = new vpn_packet;
536 struct sockaddr_in sa; 734 struct sockaddr_in sa;
537 socklen_t sa_len = sizeof (sa); 735 socklen_t sa_len = sizeof (sa);
538 int len; 736 int len;
… …
548 recv_vpn_packet (pkt, si); 746 recv_vpn_packet (pkt, si);
549 } 747 }
550 else 748 else
551 { 749 {
552 // probably ECONNRESET or somesuch 750 // probably ECONNRESET or somesuch
553 slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno)); 751 slog (L_DEBUG, _("%s: fd %d, %s."), (const char *)si, w.fd, strerror (errno));
554 } 752 }
555 753
556 delete pkt; 754 delete pkt;
557 } 755 }
558 else 756 else
559 { 757 {
560 slog (L_ERR, 758 slog (L_ERR,
561 _("FATAL: unknown revents %08x in socket, terminating\n"), 759 _("FATAL: unknown revents %08x in socket, exiting.\n"),
562 revents); 760 revents);
563 exit (EXIT_FAILURE); 761 exit (EXIT_FAILURE);
564 } 762 }
565} 763}
566 764
567void 765inline void
568vpn::tap_ev (io_watcher &w, short revents) 766vpn::tap_ev (ev::io &w, int revents)
569{ 767{
570 if (revents & EVENT_READ) 768 if (revents & EV_READ)
571 { 769 {
572 /* process data */ 770 /* process data */
573 tap_packet *pkt; 771 tap_packet *pkt;
574 772
575 pkt = tap->recv (); 773 pkt = tap->recv ();
… …
604 } 802 }
605 else 803 else
606 abort (); 804 abort ();
607} 805}
608 806
609void 807inline void
610vpn::event_cb (time_watcher &w) 808vpn::event_cb (ev::timer &w, int)
611{ 809{
612 if (events) 810 if (events)
613 { 811 {
614 if (events & EVENT_SHUTDOWN) 812 if (events & EVENT_SHUTDOWN)
615 { 813 {
616 slog (L_INFO, _("preparing shutdown...")); 814 slog (L_INFO, _("preparing shutdown..."));
617 815
618 shutdown_all (); 816 shutdown_all ();
619 remove_pid (conf.pidfilename); 817 remove_pid (conf.pidfilename);
620 slog (L_INFO, _("terminating")); 818 slog (L_INFO, _("exiting."));
621 exit (EXIT_SUCCESS); 819 exit (EXIT_SUCCESS);
622 } 820 }
623 821
624 if (events & EVENT_RECONNECT) 822 if (events & EVENT_RECONNECT)
625 { 823 {
626 slog (L_INFO, _("forced reconnect")); 824 slog (L_INFO, _("forced reconnect."));
627 825
628 reconnect_all (); 826 reconnect_all ();
629 } 827 }
630 828
631 events = 0; 829 events = 0;
… …
647 845
648 conns.clear (); 846 conns.clear ();
649 847
650 connection_init (); 848 connection_init ();
651 849
652 for (configuration::node_vector::iterator i = conf.nodes.begin (); 850 for (configuration::node_vector::iterator i = conf.nodes.begin (); i != conf.nodes.end (); ++i)
653 i != conf.nodes.end (); ++i) 851 conns.push_back (new connection (this, *i));
654 { 852
655 connection *conn = new connection (this, *i); 853 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
656 conns.push_back (conn);
657 conn->establish_connection (); 854 (*c)->establish_connection ();
658 }
659} 855}
660 856
661connection *vpn::find_router () 857bool
858vpn::can_direct (conf_node *src, conf_node *dst) const
662{ 859{
663 u32 prio = 1; 860 return src != dst
861 && src->may_direct (dst)
862 && dst->may_direct (src)
863 && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
864 || (src->protocols & dst->connectable_protocols ()));
865}
866
867// only works for indirect and routed connections: find a router
868// from THISNODE to dst
869connection *
870vpn::find_router_for (const connection *dst)
871{
664 connection *router = 0; 872 connection *router = 0;
665 873
874 // first try to find a router with a direct connection, route there
875 // regardless of any other considerations.
876 {
877 u32 prio = 1;
878
879 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
880 {
881 connection *c = *i;
882
883 if (c->conf->routerprio > prio
884 && c->conf != THISNODE
885 && can_direct (c->conf, dst->conf)
886 && c->ictx && c->octx)
887 {
888 prio = c->conf->routerprio;
889 router = c;
890 }
891 }
892 }
893
894 if (router)
895 return router;
896
897 // second try find the router with the highest priority, higher than ours
898 {
899 u32 prio = THISNODE->routerprio ? THISNODE->routerprio : 1;
900
901 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
902 {
903 connection *c = *i;
904
905 if (c->conf->routerprio > prio
906 && c != dst
907 && c->conf != THISNODE
908 && c->ictx && c->octx)
909 {
910 prio = c->conf->routerprio;
911 router = c;
912 }
913 }
914 }
915
916 return router;
917}
918
919void
920vpn::connection_established (connection *c)
921{
666 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 922 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
667 { 923 {
668 connection *c = *i; 924 connection *o = *i;
669 925
670 if (c->conf->routerprio > prio 926 if (o->si.valid ()
671 && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use 927 && c->si != o->si
672 && c->ictx && c->octx 928 && c == find_router_for (o)
673 && c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode 929 && !can_direct (THISNODE, o->conf))
674 {
675 prio = c->conf->routerprio;
676 router = c;
677 } 930 {
931 slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
932 o->conf->nodename, c->conf->nodename);
933 o->rekey ();
934 }
678 } 935 }
679
680 return router;
681} 936}
682 937
938void
683void vpn::send_connect_request (int id) 939vpn::send_connect_request (connection *c)
684{ 940{
685 connection *c = find_router (); 941 connection *r = find_router_for (c);
686 942
687 if (c) 943 if (r)
944 {
945 slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
946 c->conf->nodename, r->conf->nodename);
688 c->send_connect_request (id); 947 r->send_connect_request (c->conf->id);
948 }
689 else 949 else
690 // no router found, aggressively connect to all routers 950 slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
691 for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i) 951 c->conf->nodename);
692 if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
693 (*i)->establish_connection ();
694} 952}
695 953
696void 954void
697connection::dump_status () 955connection::dump_status ()
698{ 956{
699 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id); 957 slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
700 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"), 958 slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
701 connectmode, conf->connectmode, (const char *)si, (int)prot_minor); 959 connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
702 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"), 960 slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
703 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt); 961 (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
704 slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
705 (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
706} 962}
707 963
708void 964void
709vpn::dump_status () 965vpn::dump_status ()
710{ 966{
711 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW); 967 slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)ev_now ());
712 968
713 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c) 969 for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
714 (*c)->dump_status (); 970 (*c)->dump_status ();
715 971
716 slog (L_NOTICE, _("END status dump")); 972 slog (L_NOTICE, _("END status dump"));
717} 973}
718 974
719vpn::vpn (void) 975vpn::vpn (void)
976{
720: event (this, &vpn::event_cb) 977 event .set<vpn, &vpn::event_cb > (this);
721, udpv4_ev_watcher (this, &vpn::udpv4_ev) 978 udpv4_ev_watcher .set<vpn, &vpn::udpv4_ev > (this);
722, ipv4_ev_watcher (this, &vpn::ipv4_ev) 979 ipv4_ev_watcher .set<vpn, &vpn::ipv4_ev > (this);
723#if ENABLE_TCP 980#if ENABLE_TCP
724, tcpv4_ev_watcher (this, &vpn::tcpv4_ev) 981 tcpv4_ev_watcher .set<vpn, &vpn::tcpv4_ev > (this);
725#endif 982#endif
726#if ENABLE_ICMP 983#if ENABLE_ICMP
727, icmpv4_ev_watcher(this, &vpn::icmpv4_ev) 984 icmpv4_ev_watcher.set<vpn, &vpn::icmpv4_ev> (this);
728#endif 985#endif
729#if ENABLE_DNS 986#if ENABLE_DNS
730, dnsv4_ev_watcher (this, &vpn::dnsv4_ev) 987 dnsv4_ev_watcher .set<vpn, &vpn::dnsv4_ev > (this);
731#endif 988#endif
732, tap_ev_watcher (this, &vpn::tap_ev) 989 tap_ev_watcher .set<vpn, &vpn::tap_ev > (this);
733{
734} 990}
735 991
736vpn::~vpn () 992vpn::~vpn ()
737{ 993{
738} 994}

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines