gvpe/src/vpn.C

/*
    vpn.C -- handle the protocol, encryption, handshaking etc.
    Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
 
    This file is part of GVPE.

    GVPE is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with gvpe; if not, write to the Free Software
    Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include "config.h"

#include <list>

#include <cstdio>
#include <cstring>
#include <cstdlib>

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <errno.h>
#include <time.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/socket.h>

#include "netcompat.h"

#include "pidfile.h"

#include "connection.h"
#include "util.h"
#include "vpn.h"

vpn network; // THE vpn (bad design...)

/////////////////////////////////////////////////////////////////////////////

const char *vpn::script_if_up ()
{
  // the tunnel device mtu should be the physical mtu - overhead
  // the tricky part is rounding to the cipher key blocksize
  int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
  mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
  mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
  mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again

  char *env;
  asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
  asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
  asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
  asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
  asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
  asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
  asprintf (&env, "MTU=%d", mtu); putenv (env);
  asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",
            0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,
            THISNODE->id & 0xff);
  putenv (env);

  return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
}

int
vpn::setup ()
{
  ipv4_fd = -1;

  if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
    {
      ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);

      if (ipv4_fd < 0)
        return -1;

      fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);

#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
      // this I really consider a linux bug. I am neither connected
      // nor do I fragment myself. Linux still sets DF and doesn't
      // fragment for me sometimes.
      {
        int oval = IP_PMTUDISC_DONT;
        setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
      }
#endif

      sockinfo si (THISNODE, PROT_IPv4);

      if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));
          exit (EXIT_FAILURE);
        }

      ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);
    }

  udpv4_fd = -1;

  if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
    {
      udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);

      if (udpv4_fd < 0)
        return -1;

      fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);

      // standard daemon practise...
      {
        int oval = 1;
        setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
      }

#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
      // this I really consider a linux bug. I am neither connected
      // nor do I fragment myself. Linux still sets DF and doesn't
      // fragment for me sometimes.
      {
        int oval = IP_PMTUDISC_DONT;
        setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
      }
#endif

      sockinfo si (THISNODE, PROT_UDPv4);

      if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (EXIT_FAILURE);
        }

      udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);
    }

  icmpv4_fd = -1;

#if ENABLE_ICMP
  if (THISNODE->protocols & PROT_ICMPv4)
    {
      icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);

      if (icmpv4_fd < 0)
        return -1;

      fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);

#ifdef ICMP_FILTER
      {
        icmp_filter oval;
        oval.data = 0xffffffff;
        if (::conf.icmp_type < 32)
          oval.data &= ~(1 << ::conf.icmp_type);

        setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
      }
#endif

#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
      // this I really consider a linux bug. I am neither connected
      // nor do I fragment myself. Linux still sets DF and doesn't
      // fragment for me sometimes.
      {
        int oval = IP_PMTUDISC_DONT;
        setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
      }
#endif

      sockinfo si (THISNODE, PROT_ICMPv4);

      if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (EXIT_FAILURE);
        }

      icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);
    }
#endif

  tcpv4_fd = -1;

#if ENABLE_TCP
  if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
    {
      tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);

      if (tcpv4_fd < 0)
        return -1;

      fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);

      // standard daemon practise...
      {
        int oval = 1;
        setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
      }

      sockinfo si (THISNODE, PROT_TCPv4);

      if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (EXIT_FAILURE);
        }

      if (listen (tcpv4_fd, 5))
        {
          slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (EXIT_FAILURE);
        }

      tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);
    }
#endif

#if ENABLE_DNS
  if (THISNODE->protocols & PROT_DNSv4)
    {
      dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);

      dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);

      if (dnsv4_fd < 0)
        return -1;

      // standard daemon practise...
      {
        int oval = 1;
        setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
      }

      sockinfo si (THISNODE, PROT_DNSv4);

      if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
        {
          slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));
          exit (EXIT_FAILURE);
        }

      dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);
    }
#endif

  tap = new tap_device ();
  if (!tap) //D this, of course, never catches
    {
      slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
      exit (EXIT_FAILURE);
    }
  
  run_script (run_script_cb (this, &vpn::script_if_up), true);

  tap_ev_watcher.start (tap->fd, EVENT_READ);

  reconnect_all ();

  return 0;
}

bool
vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
#if defined(SOL_IP) && defined(IP_TOS)
  setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
#endif
  sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());

  return true;
}

static u16
ipv4_checksum (u16 *data, unsigned int len)
{
  // use 32 bit accumulator and fold back carry bits at the end
  u32 sum = 0;

  while (len > 1)
    {
      sum += *data++;
      len -= 2;
    }

  // odd byte left?
  if (len)
    sum += *(u8 *)data;

  // add back carry bits
  sum = (sum >> 16) + (sum & 0xffff);   // lo += hi
  sum += (sum >> 16);                   // carry

  return ~sum;
}

#if ENABLE_ICMP
bool
vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
#if defined(SOL_IP) && defined(IP_TOS)
  setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
#endif

  pkt->unshift_hdr (4);

  icmp_header *hdr = (icmp_header *)&((*pkt)[0]);
  hdr->type = ::conf.icmp_type;
  hdr->code = 255;
  hdr->checksum = 0;
  hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);

  sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());

  return true;
}
#endif

bool
vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
#if defined(SOL_IP) && defined(IP_TOS)
  setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
#endif
  sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());

  return true;
}

void
vpn::inject_data_packet (tap_packet *pkt, int dst)
{
  if (dst)
    {
      // unicast
      if (dst != THISNODE->id)
        conns[dst - 1]->inject_data_packet (pkt);
    }
  else
    {
      // broadcast, this is ugly, but due to the security policy
      // we have to connect to all hosts...
      for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
        if ((*c)->conf != THISNODE)
          (*c)->inject_data_packet (pkt, true);
  }
}

void
vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
{
  unsigned int src = pkt->src ();
  unsigned int dst = pkt->dst ();

  slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
        (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);

  if (src == 0 || src > conns.size ()
      || dst > conns.size ()
      || pkt->typ () >= vpn_packet::PT_MAX)
    slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
          (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
  else if (dst > conns.size ())
    slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
          (const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
  else
    {
      connection *c = conns[src - 1];

      if (dst == 0)
        slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),
              c->conf->nodename, (const char *)rsi);
      else if (dst != THISNODE->id)
        {
          if (THISNODE->routerprio)
            // the tos setting gets lost here. who cares.
            conns[dst - 1]->inject_vpn_packet (pkt);
          else
            slog (L_WARN,
                  _("%s(%s): forwarding request (=> %s), but we are no router"),
                  c->conf->nodename, (const char *)rsi,
                  conns[dst - 1]->conf->nodename);
        }
      else
        c->recv_vpn_packet (pkt, rsi);
    }
}

void
vpn::ipv4_ev (io_watcher &w, short revents)
{
  if (revents & EVENT_READ)
    {
      vpn_packet *pkt = new vpn_packet;
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);
      int len;

      len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);

      sockinfo si(sa, PROT_IPv4);

      if (len > 0)
        {
          pkt->len = len;

          // raw sockets deliver the ipv4, but don't expect it on sends
          // this is slow, but...
          pkt->skip_hdr (IP_OVERHEAD);

          recv_vpn_packet (pkt, si);
        }
      else
        {
          // probably ECONNRESET or somesuch
          slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
        }

      delete pkt;
    }
  else
    {
      slog (L_ERR,
              _("FATAL: unknown revents %08x in socket, terminating\n"),
              revents);
      exit (EXIT_FAILURE);
    }
}

#if ENABLE_ICMP
void
vpn::icmpv4_ev (io_watcher &w, short revents)
{
  if (revents & EVENT_READ)
    {
      vpn_packet *pkt = new vpn_packet;
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);
      int len;

      len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);

      sockinfo si(sa, PROT_ICMPv4);

      if (len > 0)
        {
          pkt->len = len;

          icmp_header *hdr = (icmp_header *)&((*pkt)[IP_OVERHEAD]);

          if (hdr->type == ::conf.icmp_type
              && hdr->code == 255)
            {
              // raw sockets deliver the ipv4, but don't expect it on sends
              // this is slow, but...
              pkt->skip_hdr (ICMP_OVERHEAD);

              recv_vpn_packet (pkt, si);
            }
        }
      else
        {
          // probably ECONNRESET or somesuch
          slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
        }

      delete pkt;
    }
  else
    {
      slog (L_ERR,
              _("FATAL: unknown revents %08x in socket, terminating\n"),
              revents);
      exit (EXIT_FAILURE);
    }
}
#endif

void
vpn::udpv4_ev (io_watcher &w, short revents)
{
  if (revents & EVENT_READ)
    {
      vpn_packet *pkt = new vpn_packet;
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);
      int len;

      len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);

      sockinfo si(sa, PROT_UDPv4);

      if (len > 0)
        {
          pkt->len = len;

          recv_vpn_packet (pkt, si);
        }
      else
        {
          // probably ECONNRESET or somesuch
          slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));
        }

      delete pkt;
    }
  else
    {
      slog (L_ERR,
              _("FATAL: unknown revents %08x in socket, terminating\n"),
              revents);
      exit (EXIT_FAILURE);
    }
}

void
vpn::tap_ev (io_watcher &w, short revents)
{
  if (revents & EVENT_READ)
    {
      /* process data */
      tap_packet *pkt;

      pkt = tap->recv ();

      if (!pkt)
        return;

      if (pkt->len > 14)
        {
          int dst = mac2id (pkt->dst);
          int src = mac2id (pkt->src);

          if (src != THISNODE->id)
            {
              slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting."));
              exit (EXIT_FAILURE);
            }

          if (dst == THISNODE->id)
            {
              slog (L_ERR, _("FATAL: tap packet destined for current node received, exiting."));
              exit (EXIT_FAILURE);
            }

          if (dst > conns.size ())
            slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
          else
            inject_data_packet (pkt, dst);
        }

      delete pkt;
    }
  else
    abort ();
}

void
vpn::event_cb (time_watcher &w)
{
  if (events)
    {
      if (events & EVENT_SHUTDOWN)
        {
          slog (L_INFO, _("preparing shutdown..."));

          shutdown_all ();
          remove_pid (conf.pidfilename);
          slog (L_INFO, _("terminating"));
          exit (EXIT_SUCCESS);
        }

      if (events & EVENT_RECONNECT)
        {
          slog (L_INFO, _("forced reconnect"));

          reconnect_all ();
        }

      events = 0;
    }
}

void
vpn::shutdown_all ()
{
  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
    (*c)->shutdown ();
}

void
vpn::reconnect_all ()
{
  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
    delete *c;

  conns.clear ();

  connection_init ();

  for (configuration::node_vector::iterator i = conf.nodes.begin ();
       i != conf.nodes.end (); ++i)
    {
      connection *conn = new connection (this, *i);
      conns.push_back (conn);
      conn->establish_connection ();
    }
}

connection *vpn::find_router ()
{
  u32 prio = 1;
  connection *router = 0;

  for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
    {
      connection *c = *i;

      if (c->conf->routerprio > prio
          && c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use
          && c->ictx && c->octx
          && c->conf != THISNODE)                  // redundant, since ictx==octx==0 always on thisnode
        {
          prio = c->conf->routerprio;
          router = c;
        }
    }

  return router;
}

void vpn::send_connect_request (int id)
{
  connection *c = find_router ();

  if (c)
    c->send_connect_request (id);
  else
    // no router found, aggressively connect to all routers
    for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
      if ((*i)->conf->routerprio && (*i)->conf != THISNODE)
        (*i)->establish_connection ();
}

void
connection::dump_status ()
{
  slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
  slog (L_NOTICE, _("  connectmode %d (%d) / sockaddr %s / minor %d"),
        connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
  slog (L_NOTICE, _("  ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
        (long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
  slog (L_NOTICE, _("  establish_conn %ld / rekey %ld / keepalive %ld"),
        (long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
}

void
vpn::dump_status ()
{
  slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);

  for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
    (*c)->dump_status ();

  slog (L_NOTICE, _("END status dump"));
}

vpn::vpn (void)
: event            (this, &vpn::event_cb)
, udpv4_ev_watcher (this, &vpn::udpv4_ev)
, ipv4_ev_watcher  (this, &vpn::ipv4_ev)
#if ENABLE_TCP
, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)
#endif
#if ENABLE_ICMP
, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)
#endif
#if ENABLE_DNS
, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)
#endif
, tap_ev_watcher   (this, &vpn::tap_ev)
{
}

vpn::~vpn ()
{
}

Revision:	1.29
Committed:	Fri Mar 4 04:52:38 2005 UTC (19 years, 2 months ago) by pcg
Content type:	text/plain
Branch:	MAIN
Changes since 1.28:	+2 -0 lines
Log Message:	* empty log message *
#	Content
1	/*
2	vpn.C -- handle the protocol, encryption, handshaking etc.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4
5	This file is part of GVPE.
6
7	GVPE is free software; you can redistribute it and/or modify
8	it under the terms of the GNU General Public License as published by
9	the Free Software Foundation; either version 2 of the License, or
10	(at your option) any later version.
11
12	This program is distributed in the hope that it will be useful,
13	but WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15	GNU General Public License for more details.
16
17	You should have received a copy of the GNU General Public License
18	along with gvpe; if not, write to the Free Software
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20	*/
21
22	#include "config.h"
23
24	#include <list>
25
26	#include <cstdio>
27	#include <cstring>
28	#include <cstdlib>
29
30	#include <sys/types.h>
31	#include <sys/socket.h>
32	#include <sys/wait.h>
33	#include <errno.h>
34	#include <time.h>
35	#include <unistd.h>
36	#include <fcntl.h>
37	#include <sys/socket.h>
38
39	#include "netcompat.h"
40
41	#include "pidfile.h"
42
43	#include "connection.h"
44	#include "util.h"
45	#include "vpn.h"
46
47	vpn network; // THE vpn (bad design...)
48
49	/////////////////////////////////////////////////////////////////////////////
50
51	const char *vpn::script_if_up ()
52	{
53	// the tunnel device mtu should be the physical mtu - overhead
54	// the tricky part is rounding to the cipher key blocksize
55	int mtu = conf.mtu - ETH_OVERHEAD - VPE_OVERHEAD - MAX_OVERHEAD;
56	mtu += ETH_OVERHEAD - 6 - 6; // now we have the data portion
57	mtu -= mtu % EVP_CIPHER_block_size (CIPHER); // round
58	mtu -= ETH_OVERHEAD - 6 - 6; // and get interface mtu again
59
60	char *env;
61	asprintf (&env, "CONFBASE=%s", confbase); putenv (env);
62	asprintf (&env, "NODENAME=%s", THISNODE->nodename); putenv (env);
63	asprintf (&env, "NODEID=%d", THISNODE->id); putenv (env);
64	asprintf (&env, "IFNAME=%s", tap->interface ()); putenv (env);
65	asprintf (&env, "IFTYPE=%s", IFTYPE); putenv (env);
66	asprintf (&env, "IFSUBTYPE=%s", IFSUBTYPE); putenv (env);
67	asprintf (&env, "MTU=%d", mtu); putenv (env);
68	asprintf (&env, "MAC=%02x:%02x:%02x:%02x:%02x:%02x",
69	0xfe, 0xfd, 0x80, 0x00, THISNODE->id >> 8,
70	THISNODE->id & 0xff);
71	putenv (env);
72
73	return ::conf.script_if_up ? ::conf.script_if_up : "if-up";
74	}
75
76	int
77	vpn::setup ()
78	{
79	ipv4_fd = -1;
80
81	if (THISNODE->protocols & PROT_IPv4 && ::conf.ip_proto)
82	{
83	ipv4_fd = socket (PF_INET, SOCK_RAW, ::conf.ip_proto);
84
85	if (ipv4_fd < 0)
86	return -1;
87
88	fcntl (ipv4_fd, F_SETFL, O_NONBLOCK);
89
90	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
91	// this I really consider a linux bug. I am neither connected
92	// nor do I fragment myself. Linux still sets DF and doesn't
93	// fragment for me sometimes.
94	{
95	int oval = IP_PMTUDISC_DONT;
96	setsockopt (ipv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
97	}
98	#endif
99
100	sockinfo si (THISNODE, PROT_IPv4);
101
102	if (bind (ipv4_fd, si.sav4 (), si.salenv4 ()))
103	{
104	slog (L_ERR, _("can't bind ipv4 socket on %s: %s"), (const char *)si, strerror (errno));
105	exit (EXIT_FAILURE);
106	}
107
108	ipv4_ev_watcher.start (ipv4_fd, EVENT_READ);
109	}
110
111	udpv4_fd = -1;
112
113	if (THISNODE->protocols & PROT_UDPv4 && THISNODE->udp_port)
114	{
115	udpv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
116
117	if (udpv4_fd < 0)
118	return -1;
119
120	fcntl (udpv4_fd, F_SETFL, O_NONBLOCK);
121
122	// standard daemon practise...
123	{
124	int oval = 1;
125	setsockopt (udpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
126	}
127
128	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
129	// this I really consider a linux bug. I am neither connected
130	// nor do I fragment myself. Linux still sets DF and doesn't
131	// fragment for me sometimes.
132	{
133	int oval = IP_PMTUDISC_DONT;
134	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
135	}
136	#endif
137
138	sockinfo si (THISNODE, PROT_UDPv4);
139
140	if (bind (udpv4_fd, si.sav4 (), si.salenv4 ()))
141	{
142	slog (L_ERR, _("can't bind udpv4 on %s: %s"), (const char *)si, strerror (errno));
143	exit (EXIT_FAILURE);
144	}
145
146	udpv4_ev_watcher.start (udpv4_fd, EVENT_READ);
147	}
148
149	icmpv4_fd = -1;
150
151	#if ENABLE_ICMP
152	if (THISNODE->protocols & PROT_ICMPv4)
153	{
154	icmpv4_fd = socket (PF_INET, SOCK_RAW, IPPROTO_ICMP);
155
156	if (icmpv4_fd < 0)
157	return -1;
158
159	fcntl (icmpv4_fd, F_SETFL, O_NONBLOCK);
160
161	#ifdef ICMP_FILTER
162	{
163	icmp_filter oval;
164	oval.data = 0xffffffff;
165	if (::conf.icmp_type < 32)
166	oval.data &= ~(1 << ::conf.icmp_type);
167
168	setsockopt (icmpv4_fd, SOL_RAW, ICMP_FILTER, &oval, sizeof oval);
169	}
170	#endif
171
172	#if defined(SOL_IP) && defined(IP_MTU_DISCOVER)
173	// this I really consider a linux bug. I am neither connected
174	// nor do I fragment myself. Linux still sets DF and doesn't
175	// fragment for me sometimes.
176	{
177	int oval = IP_PMTUDISC_DONT;
178	setsockopt (udpv4_fd, SOL_IP, IP_MTU_DISCOVER, &oval, sizeof oval);
179	}
180	#endif
181
182	sockinfo si (THISNODE, PROT_ICMPv4);
183
184	if (bind (icmpv4_fd, si.sav4 (), si.salenv4 ()))
185	{
186	slog (L_ERR, _("can't bind icmpv4 on %s: %s"), (const char *)si, strerror (errno));
187	exit (EXIT_FAILURE);
188	}
189
190	icmpv4_ev_watcher.start (icmpv4_fd, EVENT_READ);
191	}
192	#endif
193
194	tcpv4_fd = -1;
195
196	#if ENABLE_TCP
197	if (THISNODE->protocols & PROT_TCPv4 && THISNODE->tcp_port)
198	{
199	tcpv4_fd = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);
200
201	if (tcpv4_fd < 0)
202	return -1;
203
204	fcntl (tcpv4_fd, F_SETFL, O_NONBLOCK);
205
206	// standard daemon practise...
207	{
208	int oval = 1;
209	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
210	}
211
212	sockinfo si (THISNODE, PROT_TCPv4);
213
214	if (bind (tcpv4_fd, si.sav4 (), si.salenv4 ()))
215	{
216	slog (L_ERR, _("can't bind tcpv4 on %s: %s"), (const char *)si, strerror (errno));
217	exit (EXIT_FAILURE);
218	}
219
220	if (listen (tcpv4_fd, 5))
221	{
222	slog (L_ERR, _("can't listen tcpv4 on %s: %s"), (const char *)si, strerror (errno));
223	exit (EXIT_FAILURE);
224	}
225
226	tcpv4_ev_watcher.start (tcpv4_fd, EVENT_READ);
227	}
228	#endif
229
230	#if ENABLE_DNS
231	if (THISNODE->protocols & PROT_DNSv4)
232	{
233	dns_forwarder.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
234
235	dnsv4_fd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP);
236
237	if (dnsv4_fd < 0)
238	return -1;
239
240	// standard daemon practise...
241	{
242	int oval = 1;
243	setsockopt (tcpv4_fd, SOL_SOCKET, SO_REUSEADDR, &oval, sizeof oval);
244	}
245
246	sockinfo si (THISNODE, PROT_DNSv4);
247
248	if (bind (dnsv4_fd, si.sav4 (), si.salenv4 ()))
249	{
250	slog (L_ERR, _("can't bind dnsv4 on %s: %s"), (const char *)si, strerror (errno));
251	exit (EXIT_FAILURE);
252	}
253
254	dnsv4_ev_watcher.start (dnsv4_fd, EVENT_READ);
255	}
256	#endif
257
258	tap = new tap_device ();
259	if (!tap) //D this, of course, never catches
260	{
261	slog (L_ERR, _("cannot create network interface '%s'"), conf.ifname);
262	exit (EXIT_FAILURE);
263	}
264
265	run_script (run_script_cb (this, &vpn::script_if_up), true);
266
267	tap_ev_watcher.start (tap->fd, EVENT_READ);
268
269	reconnect_all ();
270
271	return 0;
272	}
273
274	bool
275	vpn::send_ipv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
276	{
277	#if defined(SOL_IP) && defined(IP_TOS)
278	setsockopt (ipv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
279	#endif
280	sendto (ipv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
281
282	return true;
283	}
284
285	static u16
286	ipv4_checksum (u16 *data, unsigned int len)
287	{
288	// use 32 bit accumulator and fold back carry bits at the end
289	u32 sum = 0;
290
291	while (len > 1)
292	{
293	sum += *data++;
294	len -= 2;
295	}
296
297	// odd byte left?
298	if (len)
299	sum += (u8 )data;
300
301	// add back carry bits
302	sum = (sum >> 16) + (sum & 0xffff); // lo += hi
303	sum += (sum >> 16); // carry
304
305	return ~sum;
306	}
307
308	#if ENABLE_ICMP
309	bool
310	vpn::send_icmpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
311	{
312	#if defined(SOL_IP) && defined(IP_TOS)
313	setsockopt (icmpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
314	#endif
315
316	pkt->unshift_hdr (4);
317
318	icmp_header hdr = (icmp_header )&((*pkt)[0]);
319	hdr->type = ::conf.icmp_type;
320	hdr->code = 255;
321	hdr->checksum = 0;
322	hdr->checksum = ipv4_checksum ((u16 *)hdr, pkt->len);
323
324	sendto (icmpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
325
326	return true;
327	}
328	#endif
329
330	bool
331	vpn::send_udpv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
332	{
333	#if defined(SOL_IP) && defined(IP_TOS)
334	setsockopt (udpv4_fd, SOL_IP, IP_TOS, &tos, sizeof tos);
335	#endif
336	sendto (udpv4_fd, &((*pkt)[0]), pkt->len, 0, si.sav4 (), si.salenv4 ());
337
338	return true;
339	}
340
341	void
342	vpn::inject_data_packet (tap_packet *pkt, int dst)
343	{
344	if (dst)
345	{
346	// unicast
347	if (dst != THISNODE->id)
348	conns[dst - 1]->inject_data_packet (pkt);
349	}
350	else
351	{
352	// broadcast, this is ugly, but due to the security policy
353	// we have to connect to all hosts...
354	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
355	if ((*c)->conf != THISNODE)
356	(*c)->inject_data_packet (pkt, true);
357	}
358	}
359
360	void
361	vpn::recv_vpn_packet (vpn_packet *pkt, const sockinfo &rsi)
362	{
363	unsigned int src = pkt->src ();
364	unsigned int dst = pkt->dst ();
365
366	slog (L_NOISE, _("<<?/%s received possible vpn packet type %d from %d to %d, length %d"),
367	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst (), pkt->len);
368
369	if (src == 0 \|\| src > conns.size ()
370	\|\| dst > conns.size ()
371	\|\| pkt->typ () >= vpn_packet::PT_MAX)
372	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
373	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
374	else if (dst > conns.size ())
375	slog (L_WARN, _("(%s): received corrupted packet type %d (src %d, dst %d)"),
376	(const char *)rsi, pkt->typ (), pkt->src (), pkt->dst ());
377	else
378	{
379	connection *c = conns[src - 1];
380
381	if (dst == 0)
382	slog (L_WARN, _("%s(%s): received broadcast (protocol violation)"),
383	c->conf->nodename, (const char *)rsi);
384	else if (dst != THISNODE->id)
385	{
386	if (THISNODE->routerprio)
387	// the tos setting gets lost here. who cares.
388	conns[dst - 1]->inject_vpn_packet (pkt);
389	else
390	slog (L_WARN,
391	_("%s(%s): forwarding request (=> %s), but we are no router"),
392	c->conf->nodename, (const char *)rsi,
393	conns[dst - 1]->conf->nodename);
394	}
395	else
396	c->recv_vpn_packet (pkt, rsi);
397	}
398	}
399
400	void
401	vpn::ipv4_ev (io_watcher &w, short revents)
402	{
403	if (revents & EVENT_READ)
404	{
405	vpn_packet *pkt = new vpn_packet;
406	struct sockaddr_in sa;
407	socklen_t sa_len = sizeof (sa);
408	int len;
409
410	len = recvfrom (w.fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
411
412	sockinfo si(sa, PROT_IPv4);
413
414	if (len > 0)
415	{
416	pkt->len = len;
417
418	// raw sockets deliver the ipv4, but don't expect it on sends
419	// this is slow, but...
420	pkt->skip_hdr (IP_OVERHEAD);
421
422	recv_vpn_packet (pkt, si);
423	}
424	else
425	{
426	// probably ECONNRESET or somesuch
427	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
428	}
429
430	delete pkt;
431	}
432	else
433	{
434	slog (L_ERR,
435	_("FATAL: unknown revents %08x in socket, terminating\n"),
436	revents);
437	exit (EXIT_FAILURE);
438	}
439	}
440
441	#if ENABLE_ICMP
442	void
443	vpn::icmpv4_ev (io_watcher &w, short revents)
444	{
445	if (revents & EVENT_READ)
446	{
447	vpn_packet *pkt = new vpn_packet;
448	struct sockaddr_in sa;
449	socklen_t sa_len = sizeof (sa);
450	int len;
451
452	len = recvfrom (w.fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
453
454	sockinfo si(sa, PROT_ICMPv4);
455
456	if (len > 0)
457	{
458	pkt->len = len;
459
460	icmp_header hdr = (icmp_header )&((*pkt)[IP_OVERHEAD]);
461
462	if (hdr->type == ::conf.icmp_type
463	&& hdr->code == 255)
464	{
465	// raw sockets deliver the ipv4, but don't expect it on sends
466	// this is slow, but...
467	pkt->skip_hdr (ICMP_OVERHEAD);
468
469	recv_vpn_packet (pkt, si);
470	}
471	}
472	else
473	{
474	// probably ECONNRESET or somesuch
475	slog (L_DEBUG, _("%s: %s"), (const char *)si, strerror (errno));
476	}
477
478	delete pkt;
479	}
480	else
481	{
482	slog (L_ERR,
483	_("FATAL: unknown revents %08x in socket, terminating\n"),
484	revents);
485	exit (EXIT_FAILURE);
486	}
487	}
488	#endif
489
490	void
491	vpn::udpv4_ev (io_watcher &w, short revents)
492	{
493	if (revents & EVENT_READ)
494	{
495	vpn_packet *pkt = new vpn_packet;
496	struct sockaddr_in sa;
497	socklen_t sa_len = sizeof (sa);
498	int len;
499
500	len = recvfrom (w.fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
501
502	sockinfo si(sa, PROT_UDPv4);
503
504	if (len > 0)
505	{
506	pkt->len = len;
507
508	recv_vpn_packet (pkt, si);
509	}
510	else
511	{
512	// probably ECONNRESET or somesuch
513	slog (L_DEBUG, _("%s: fd %d, %s"), (const char *)si, w.fd, strerror (errno));
514	}
515
516	delete pkt;
517	}
518	else
519	{
520	slog (L_ERR,
521	_("FATAL: unknown revents %08x in socket, terminating\n"),
522	revents);
523	exit (EXIT_FAILURE);
524	}
525	}
526
527	void
528	vpn::tap_ev (io_watcher &w, short revents)
529	{
530	if (revents & EVENT_READ)
531	{
532	/* process data */
533	tap_packet *pkt;
534
535	pkt = tap->recv ();
536
537	if (!pkt)
538	return;
539
540	if (pkt->len > 14)
541	{
542	int dst = mac2id (pkt->dst);
543	int src = mac2id (pkt->src);
544
545	if (src != THISNODE->id)
546	{
547	slog (L_ERR, _("FATAL: tap packet not originating on current node received, exiting."));
548	exit (EXIT_FAILURE);
549	}
550
551	if (dst == THISNODE->id)
552	{
553	slog (L_ERR, _("FATAL: tap packet destined for current node received, exiting."));
554	exit (EXIT_FAILURE);
555	}
556
557	if (dst > conns.size ())
558	slog (L_ERR, _("tap packet for unknown node %d received, ignoring."), dst);
559	else
560	inject_data_packet (pkt, dst);
561	}
562
563	delete pkt;
564	}
565	else
566	abort ();
567	}
568
569	void
570	vpn::event_cb (time_watcher &w)
571	{
572	if (events)
573	{
574	if (events & EVENT_SHUTDOWN)
575	{
576	slog (L_INFO, _("preparing shutdown..."));
577
578	shutdown_all ();
579	remove_pid (conf.pidfilename);
580	slog (L_INFO, _("terminating"));
581	exit (EXIT_SUCCESS);
582	}
583
584	if (events & EVENT_RECONNECT)
585	{
586	slog (L_INFO, _("forced reconnect"));
587
588	reconnect_all ();
589	}
590
591	events = 0;
592	}
593	}
594
595	void
596	vpn::shutdown_all ()
597	{
598	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
599	(*c)->shutdown ();
600	}
601
602	void
603	vpn::reconnect_all ()
604	{
605	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
606	delete *c;
607
608	conns.clear ();
609
610	connection_init ();
611
612	for (configuration::node_vector::iterator i = conf.nodes.begin ();
613	i != conf.nodes.end (); ++i)
614	{
615	connection conn = new connection (this, i);
616	conns.push_back (conn);
617	conn->establish_connection ();
618	}
619	}
620
621	connection *vpn::find_router ()
622	{
623	u32 prio = 1;
624	connection *router = 0;
625
626	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
627	{
628	connection c = i;
629
630	if (c->conf->routerprio > prio
631	&& c->connectmode == conf_node::C_ALWAYS // so we don't drop the connection if in use
632	&& c->ictx && c->octx
633	&& c->conf != THISNODE) // redundant, since ictx==octx==0 always on thisnode
634	{
635	prio = c->conf->routerprio;
636	router = c;
637	}
638	}
639
640	return router;
641	}
642
643	void vpn::send_connect_request (int id)
644	{
645	connection *c = find_router ();
646
647	if (c)
648	c->send_connect_request (id);
649	else
650	// no router found, aggressively connect to all routers
651	for (conns_vector::iterator i = conns.begin (); i != conns.end (); ++i)
652	if ((i)->conf->routerprio && (i)->conf != THISNODE)
653	(*i)->establish_connection ();
654	}
655
656	void
657	connection::dump_status ()
658	{
659	slog (L_NOTICE, _("node %s (id %d)"), conf->nodename, conf->id);
660	slog (L_NOTICE, _(" connectmode %d (%d) / sockaddr %s / minor %d"),
661	connectmode, conf->connectmode, (const char *)si, (int)prot_minor);
662	slog (L_NOTICE, _(" ictx/octx %08lx/%08lx / oseqno %d / retry_cnt %d"),
663	(long)ictx, (long)octx, (int)oseqno, (int)retry_cnt);
664	slog (L_NOTICE, _(" establish_conn %ld / rekey %ld / keepalive %ld"),
665	(long)(establish_connection.at), (long)(rekey.at), (long)(keepalive.at));
666	}
667
668	void
669	vpn::dump_status ()
670	{
671	slog (L_NOTICE, _("BEGIN status dump (%ld)"), (long)NOW);
672
673	for (conns_vector::iterator c = conns.begin (); c != conns.end (); ++c)
674	(*c)->dump_status ();
675
676	slog (L_NOTICE, _("END status dump"));
677	}
678
679	vpn::vpn (void)
680	: event (this, &vpn::event_cb)
681	, udpv4_ev_watcher (this, &vpn::udpv4_ev)
682	, ipv4_ev_watcher (this, &vpn::ipv4_ev)
683	#if ENABLE_TCP
684	, tcpv4_ev_watcher (this, &vpn::tcpv4_ev)
685	#endif
686	#if ENABLE_ICMP
687	, icmpv4_ev_watcher(this, &vpn::icmpv4_ev)
688	#endif
689	#if ENABLE_DNS
690	, dnsv4_ev_watcher (this, &vpn::dnsv4_ev)
691	#endif
692	, tap_ev_watcher (this, &vpn::tap_ev)
693	{
694	}
695
696	vpn::~vpn ()
697	{
698	}
699