[ViewVC] Diff of: cvs/gvpe/src/vpn.C

Comparing gvpe/src/vpn.C (file contents):
Revision 1.52 by pcg, Sun Aug 10 22:18:58 2008 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

 /*
     vpn.C -- handle the protocol, encryption, handshaking etc.
-    Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
+    Copyright (C) 2003-2008,2010,2011,2013 Marc Lehmann <gvpe@schmorp.de>
     This file is part of GVPE.
     GVPE is free software; you can redistribute it and/or modify it
     under the terms of the GNU General Public License as published by the
 #include <cstdlib>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/wait.h>
+#include <sys/stat.h>
 #include <errno.h>
 #include <time.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/socket.h>
 #include "connection.h"
 #include "util.h"
 #include "vpn.h"
+using namespace std;
 vpn network; // THE vpn (bad design...)
+/////////////////////////////////////////////////////////////////////////////
+// hopefully temporary workaround for rare buffer full conditions
+// if it happens, usually instantly retrying or retrying ~5ms later
+// is good enough with current network technologies/kernels
+static ssize_t
+xsendto (int fd, const void *buf, size_t len, int flags,
+         const struct sockaddr *sa, socklen_t salen)
+{
+  ssize_t res;
+  for (int retry = 0; retry <= 13; ++retry) // ~100ms
+    {
+      res = sendto (fd, buf, len, flags, sa, salen);
+      if (res >= 0 || errno != ENOBUFS)
+        break;
+      struct timespec ts = { 0, 1000 * retry };
+      nanosleep (&ts, 0);
+    }
+  return res;
+}
 /////////////////////////////////////////////////////////////////////////////
 static void inline
 set_tos (int fd, int &tos_prev, int tos)
 {
   // the tunnel device mtu should be the physical mtu - overhead
   // the tricky part is rounding to the cipher key blocksize
   int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
   mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
-  mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
+  mtu -= mtu % BLOCK_SIZE (CIPHER); // round
   mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
   char *env;
   asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
   asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
 inline const char *
 vpn::script_if_up ()
 {
   script_init_env ();
-  char *filename;
+  return conf.config_filename (::conf.script_if_up, "if-up");
-  asprintf (&filename,
+}
-            "%s/%s",
-            confbase,
-            ::conf.script_if_up ? ::conf.script_if_up : "if-up");
-  return filename;
+int
+vpn::setup_socket (u8 prot, int family, int type, int proto)
+{
+  int fd = socket (family, type, proto);
+  if (fd < 0)
+    {
+      slog (L_ERR, _("unable to create %s socket: %s."), strprotocol (prot), strerror (errno));
+      return fd;
+    }
+  fcntl (fd, F_SETFL, O_NONBLOCK);
+  fcntl (fd, F_SETFD, FD_CLOEXEC);
+#ifdef SO_MARK
+  if (::conf.nfmark)
+    if (setsockopt (fd, SOL_SOCKET, SO_MARK, &::conf.nfmark, sizeof ::conf.nfmark))
+      slog (L_WARN, _("unable to set nfmark on %s socket: %s"), strprotocol (prot), strerror (errno));
+#endif
+  return fd;
 }
 int
 vpn::setup ()
 {
   ipv4_tos = -1;
   ipv4_fd  = -1;
   if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
     {
-      ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
+      ipv4_fd = setup_socket (PROT_IPv4, PF_INET, SOCK_RAW, ::conf.ip_proto);
       if (ipv4_fd < 0)
         return -1;
-      fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
-      fcntl (ipv4_fd, F_SETFD, FD_CLOEXEC);
 #if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
       // this I really consider a linux bug. I am neither connected
       // nor do I fragment myself. Linux still sets DF and doesn't
       // fragment for me sometimes.
       sockinfo si (THISNODE, PROT_IPv4);
       if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
         {
           slog (L_ERR, _("can't bind ipv4 socket on %s: %s, exiting."), (const char *)si, strerror (errno));
-          exit (EXIT_FAILURE);
+          return -1;
         }
       ipv4_ev_watcher.start (ipv4_fd, EV_READ);
       ++success;
     }
   udpv4_tos = -1;
   udpv4_fd  = -1;
   if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
     {
-      udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
+      udpv4_fd = setup_socket (PROT_UDPv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
       if (udpv4_fd < 0)
         return -1;
-      fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
-      fcntl (udpv4_fd, F_SETFD, FD_CLOEXEC);
       // standard daemon practise...
       {
         int oval = 1;
         setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
       sockinfo si (THISNODE, PROT_UDPv4);
       if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
         {
           slog (L_ERR, _("can't bind udpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
-          exit (EXIT_FAILURE);
+          return -1;
         }
       udpv4_ev_watcher.start (udpv4_fd, EV_READ);
       ++success;
     }
   icmpv4_fd  = -1;
 #if ENABLE_ICMP
   if (THISNODE->protocols & PROT_ICMPv4)
     {
-      icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
+      icmpv4_fd = setup_socket (PROT_ICMPv4, PF_INET, SOCK_RAW, IPPROTO_ICMP);
       if (icmpv4_fd < 0)
         return -1;
-      fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
+// no clue where trhis is actually defined
-      fcntl (icmpv4_fd, F_SETFD, FD_CLOEXEC);
+#if !defined(ICMP_FILTER) && defined(__linux)
+  #define ICMP_FILTER 1
+#endif
 #ifdef ICMP_FILTER
       {
-        icmp_filter oval;
+        uint32_t oval;
-        oval.data = 0xffffffff;
+        oval = 0;
         if (::conf.icmp_type < 32)
-          oval.data &= ~(1 << ::conf.icmp_type);
+          oval |= 1 << ::conf.icmp_type;
+        oval = ~oval;
         setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
       }
 #endif
       sockinfo si (THISNODE, PROT_ICMPv4);
       if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
         {
           slog (L_ERR, _("can't bind icmpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
-          exit (EXIT_FAILURE);
+          return -1;
         }
       icmpv4_ev_watcher.start (icmpv4_fd, EV_READ);
       ++success;
     }
   tcpv4_fd = -1;
 #if ENABLE_TCP
   if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
     {
-      tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);
+      tcpv4_fd = setup_socket (PROT_TCPv4, PF_INET, SOCK_STREAM, IPPROTO_TCP);
       if (tcpv4_fd < 0)
         return -1;
-      fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
-      fcntl (tcpv4_fd, F_SETFD, FD_CLOEXEC);
       // standard daemon practise...
       {
         int oval = 1;
         setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
       }
       sockinfo si (THISNODE, PROT_TCPv4);
       if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
         {
           slog (L_ERR, _("can't bind tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
-          exit (EXIT_FAILURE);
+          return -1;
         }
       if (listen (tcpv4_fd, 5))
         {
           slog (L_ERR, _("can't listen tcpv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
-          exit (EXIT_FAILURE);
+          return -1;
         }
       tcpv4_ev_watcher.start (tcpv4_fd, EV_READ);
       ++success;
     }
 #if ENABLE_DNS
   if (THISNODE->protocols & PROT_DNSv4)
     {
       dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
-      dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
+      dnsv4_fd = setup_socket (PROT_DNSv4, PF_INET, SOCK_DGRAM, IPPROTO_UDP);
       if (dnsv4_fd < 0)
         return -1;
-      fcntl (dnsv4_fd, F_SETFL, O_NONBLOCK);
-      fcntl (dnsv4_fd, F_SETFD, FD_CLOEXEC);
 # if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
       // this I really consider a linux bug. I am neither connected
       // nor do I fragment myself. Linux still sets DF and doesn't
       // fragment for me sometimes.
                    PROT_DNSv4);
       if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
         {
           slog (L_ERR, _("can't bind dnsv4 on %s: %s, exiting."), (const char *)si, strerror (errno));
-          exit (EXIT_FAILURE);
+          return -1;
         }
       dnsv4_ev_watcher.start (dnsv4_fd, EV_READ);
       ++success;
     }
   /////////////////////////////////////////////////////////////////////////////
   if (!success)
     {
-      slog (L_ERR, _("no protocols enabled, exiting."));
+      slog (L_ERR, _("no protocols enabled."));
-      exit (EXIT_FAILURE);
+      return -1;
     }
   reconnect_all ();
   /////////////////////////////////////////////////////////////////////////////
   tap = new tap_device ();
   if (!tap) //D this, of course, never catches
     {
-      slog (L_ERR, _("cannot create network interface '%s', exiting."), conf.ifname);
+      slog (L_ERR, _("cannot create network interface '%s'."), conf.ifname);
-      exit (EXIT_FAILURE);
+      return -1;
     }
   fcntl (tap->fd, F_SETFD, FD_CLOEXEC);
   run_script_cb cb;
   cb.set<vpn, &vpn::script_if_init> (this);
   if (tap->if_up () &&
       !run_script (cb, true))
     {
-      slog (L_ERR, _("interface initialization command '%s' failed, exiting."),
+      slog (L_ERR, _("interface initialization command '%s' failed."),
             tap->if_up ());
-      exit (EXIT_FAILURE);
+      return -1;
     }
   cb.set<vpn, &vpn::script_if_up> (this);
   if (!run_script (cb, true))
     {
-      slog (L_ERR, _("if-up command execution failed, exiting."));
+      slog (L_ERR, _("if-up command execution failed."));
-      exit (EXIT_FAILURE);
+      return -1;
     }
   tap_ev_watcher.start (tap->fd, EV_READ);
   return 0;
+}
+bool
+vpn::drop_privileges ()
+{
+  if (::conf.change_root)
+    {
+      if (!strcmp (::conf.change_root, "/"))
+        {
+          char dir [L_tmpnam];
+          if (!tmpnam (dir))
+            {
+              slog (L_CRIT, _("unable to create anonymous root path."));
+              return false;
+            }
+          if (mkdir (dir, 0700))
+            {
+              slog (L_CRIT, _("unable to create anonymous root directory."));
+              return false;
+            }
+          if (chdir (dir))
+            {
+              slog (L_CRIT, _("unable to change to anonymous root directory."));
+              return false;
+            }
+          if (rmdir (dir))
+            slog (L_ERR, _("unable to remove anonymous root directory, continuing."));
+        }
+      else
+        {
+          if (chdir (::conf.change_root))
+            {
+              slog (L_CRIT, _("%s: unable to change to specified root directory."), ::conf.change_root);
+              return false;
+            }
+        }
+      if (chroot ("."))
+        {
+          slog (L_CRIT, _("unable to set new root directory."));
+          return false;
+        }
+      if (chdir ("/"))
+        {
+          slog (L_CRIT, _("unable to set cwd to new root directory."));
+          return false;
+        }
+    }
+  if (::conf.change_gid)
+    if (setgid (::conf.change_gid))
+      {
+        slog (L_CRIT, _("unable to change group id to %d."), ::conf.change_gid);
+        return false;
+      }
+  if (::conf.change_uid)
+    if (setuid (::conf.change_uid))
+      {
+        slog (L_CRIT, _("unable to change user id to %d."), ::conf.change_uid);
+        return false;
+      }
+  return true;
 }
 bool
 vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
 {
   set_tos (ipv4_fd, ipv4_tos, tos);
-  sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
+  xsendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
   return true;
 }
 static u16
   hdr->code = 255;
   hdr->checksum = 0;
   hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
   set_tos (icmpv4_fd, icmpv4_tos, tos);
-  sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
+  xsendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
   return true;
 }
 #endif
 bool
 vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
 {
   set_tos (udpv4_fd, udpv4_tos, tos);
-  sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
+  xsendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
   return true;
 }
 void
         (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
   if (src == 0 || src > conns.size ()
       || dst > conns.size ()
       || pkt->typ () >= vpn_packet::PT_MAX)
-    slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
-          (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
-  else if (dst > conns.size ())
     slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)."),
           (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
   else
     {
       connection *c = conns[src - 1];
 vpn::send_vpn_packet (vpn_packet *pkt, const sockinfo &si, int tos)
 {
   switch (si.prot)
     {
       case PROT_IPv4:
-        return send_ipv4_packet (pkt, si, tos);
+        return send_ipv4_packet   (pkt, si, tos);
       case PROT_UDPv4:
-        return send_udpv4_packet (pkt, si, tos);
+        return send_udpv4_packet  (pkt, si, tos);
 #if ENABLE_TCP
       case PROT_TCPv4:
-        return send_tcpv4_packet (pkt, si, tos);
+        return send_tcpv4_packet  (pkt, si, tos);
 #endif
 #if ENABLE_ICMP
       case PROT_ICMPv4:
         return send_icmpv4_packet (pkt, si, tos);
 #endif
 #if ENABLE_DNS
       case PROT_DNSv4:
-        return send_dnsv4_packet (pkt, si, tos);
+        return send_dnsv4_packet  (pkt, si, tos);
 #endif
       default:
         slog (L_CRIT, _("%s: FATAL: trying to send packet with unsupported protocol."), (const char *)si);
     }
       if (len > 0)
         {
           pkt->len = len;
           // raw sockets deliver the ipv4 header, but don't expect it on sends
-          pkt->skip_hdr (IP_OVERHEAD);
+          pkt->skip_hdr (pkt->ipv4_hdr_len ());
           recv_vpn_packet (pkt, si);
         }
       else
         {
           if (hdr->type == ::conf.icmp_type
               && hdr->code == 255)
             {
               // raw sockets deliver the ipv4, but don't expect it on sends
               // this is slow, but...
-              pkt->skip_hdr (ICMP_OVERHEAD);
+              pkt->skip_hdr (pkt->ipv4_hdr_len () + (ICMP_OVERHEAD - IP_OVERHEAD));
               recv_vpn_packet (pkt, si);
             }
         }
       else
   for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
     (*c)->establish_connection ();
 }
+bool
-bool vpn::can_direct (conf_node *src, conf_node *dst) const
+vpn::can_direct (conf_node *src, conf_node *dst) const
 {
   return src != dst
       && src->may_direct (dst)
       && dst->may_direct (src)
       && (((src->protocols & dst->protocols) && src->connectmode == conf_node::C_ALWAYS)
           || (src->protocols & dst->connectable_protocols ()));
 }
 // only works for indirect and routed connections: find a router
 // from THISNODE to dst
+connection *
-connection *vpn::find_router_for (const connection *dst)
+vpn::find_router_for (const connection *dst)
 {
   connection *router = 0;
   // first try to find a router with a direct connection, route there
   // regardless of any other considerations.
   }
   return router;
 }
+void
-void vpn::connection_established (connection *c)
+vpn::connection_established (connection *c)
 {
   for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
     {
       connection *o = *i;
-      if (!o->is_direct
-          && o->si.valid ()
+      if (o->si.valid ()
           && c->si != o->si
-          && c == find_router_for (o))
+          && c == find_router_for (o)
+          && !can_direct (THISNODE, o->conf))
         {
           slog (L_DEBUG, _("%s: can now route packets via %s, re-keying connection."),
                 o->conf->nodename, c->conf->nodename);
           o->rekey ();
         }
     }
 }
+void
-void vpn::send_connect_request (connection *c)
+vpn::send_connect_request (connection *c)
 {
   connection *r = find_router_for (c);
   if (r)
     {
-      slog (L_TRACE, _("%s: no way to connect, sending mediated connection request via %s."),
+      slog (L_TRACE, _("%s: no address known, sending mediated connection request via %s."),
             c->conf->nodename, r->conf->nodename);
       r->send_connect_request (c->conf->id);
     }
   else
-    slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect."),
+    slog (L_DEBUG, _("%s: no way to connect and no router found: unable to connect at this time."),
           c->conf->nodename);
 }
 void
 connection::dump_status ()

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn.C (file contents): Revision 1.52 by pcg, Sun Aug 10 22:18:58 2008 UTC vs. Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC

Diff Legend

Comparing gvpe/src/vpn.C (file contents):
Revision 1.52 by pcg, Sun Aug 10 22:18:58 2008 UTC vs.
Revision 1.71 by root, Thu Oct 6 03:25:54 2022 UTC