2 net.c -- most of the network code
3 Copyright (C) 1998,1999,2000 Ivo Timmermans <itimmermans@bigfoot.com>,
4 2000 Guus Sliepen <guus@sliepen.warande.net>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 2 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program; if not, write to the Free Software
18 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 $Id: net.c,v 1.35.4.81 2000/11/24 23:13:02 guus Exp $
28 #include <netinet/in.h>
32 #include <sys/signal.h>
34 #include <sys/types.h>
37 #include <sys/ioctl.h>
38 /* SunOS really wants sys/socket.h BEFORE net/if.h,
39 and FreeBSD wants these lines below the rest. */
40 #include <arpa/inet.h>
41 #include <sys/socket.h>
44 #ifdef HAVE_OPENSSL_RAND_H
45 # include <openssl/rand.h>
50 #ifdef HAVE_OPENSSL_EVP_H
51 # include <openssl/evp.h>
56 #ifdef HAVE_OPENSSL_ERR_H
57 # include <openssl/err.h>
63 #include LINUX_IF_TUN_H
70 #include "connection.h"
82 int taptype = TAP_TYPE_ETHERTAP;
84 int total_tap_out = 0;
85 int total_socket_in = 0;
86 int total_socket_out = 0;
88 config_t *upstreamcfg;
89 static int seconds_till_retry;
98 int xsend(connection_t *cl, vpn_packet_t *inpkt)
104 outpkt.len = inpkt->len;
106 /* Encrypt the packet */
108 EVP_EncryptInit(&ctx, cl->cipher_pkttype, cl->cipher_pktkey, cl->cipher_pktkey + cl->cipher_pkttype->key_len);
109 EVP_EncryptUpdate(&ctx, outpkt.data, &outlen, inpkt->data, inpkt->len);
110 EVP_EncryptFinal(&ctx, outpkt.data + outlen, &outpad);
111 outlen += outpad + 2;
114 outlen = outpkt.len + 2;
115 memcpy(&outpkt, inpkt, outlen);
118 if(debug_lvl >= DEBUG_TRAFFIC)
119 syslog(LOG_ERR, _("Sending packet of %d bytes to %s (%s)"),
120 outlen, cl->name, cl->hostname);
122 total_socket_out += outlen;
124 if((send(cl->socket, (char *) &(outpkt.len), outlen, 0)) < 0)
126 syslog(LOG_ERR, _("Error sending packet to %s (%s): %m"),
127 cl->name, cl->hostname);
134 int xrecv(connection_t *cl, vpn_packet_t *inpkt)
140 outpkt.len = inpkt->len;
142 /* Decrypt the packet */
144 EVP_DecryptInit(&ctx, myself->cipher_pkttype, myself->cipher_pktkey, myself->cipher_pktkey + myself->cipher_pkttype->key_len);
145 EVP_DecryptUpdate(&ctx, outpkt.data, &outlen, inpkt->data, inpkt->len + 8);
146 EVP_DecryptFinal(&ctx, outpkt.data + outlen, &outpad);
150 outlen = outpkt.len+2;
151 memcpy(&outpkt, inpkt, outlen);
154 if(debug_lvl >= DEBUG_TRAFFIC)
155 syslog(LOG_ERR, _("Writing packet of %d bytes to tap device"),
158 /* Fix mac address */
160 memcpy(outpkt.data, mymac.net.mac.address.x, 6);
162 if(taptype == TAP_TYPE_TUNTAP)
164 if(write(tap_fd, outpkt.data, outpkt.len) < 0)
165 syslog(LOG_ERR, _("Can't write to tun/tap device: %m"));
167 total_tap_out += outpkt.len;
171 if(write(tap_fd, outpkt.data - 2, outpkt.len + 2) < 0)
172 syslog(LOG_ERR, _("Can't write to ethertap device: %m"));
174 total_tap_out += outpkt.len + 2;
181 add the given packet of size s to the
182 queue q, be it the send or receive queue
184 void add_queue(packet_queue_t **q, void *packet, size_t s)
188 e = xmalloc(sizeof(*e));
189 e->packet = xmalloc(s);
190 memcpy(e->packet, packet, s);
194 *q = xmalloc(sizeof(**q));
195 (*q)->head = (*q)->tail = NULL;
198 e->next = NULL; /* We insert at the tail */
200 if((*q)->tail) /* Do we have a tail? */
202 (*q)->tail->next = e;
203 e->prev = (*q)->tail;
205 else /* No tail -> no head too */
215 /* Remove a queue element */
216 void del_queue(packet_queue_t **q, queue_element_t *e)
221 if(e->next) /* There is a successor, so we are not tail */
223 if(e->prev) /* There is a predecessor, so we are not head */
225 e->next->prev = e->prev;
226 e->prev->next = e->next;
228 else /* We are head */
230 e->next->prev = NULL;
231 (*q)->head = e->next;
234 else /* We are tail (or all alone!) */
236 if(e->prev) /* We are not alone :) */
238 e->prev->next = NULL;
239 (*q)->tail = e->prev;
253 flush a queue by calling function for
254 each packet, and removing it when that
255 returned a zero exit code
257 void flush_queue(connection_t *cl, packet_queue_t **pq,
258 int (*function)(connection_t*,vpn_packet_t*))
260 queue_element_t *p, *next = NULL;
262 for(p = (*pq)->head; p != NULL; )
266 if(!function(cl, p->packet))
272 if(debug_lvl >= DEBUG_TRAFFIC)
273 syslog(LOG_DEBUG, _("Queue flushed"));
278 flush the send&recv queues
279 void because nothing goes wrong here, packets
280 remain in the queue if something goes wrong
282 void flush_queues(connection_t *cl)
287 if(debug_lvl >= DEBUG_TRAFFIC)
288 syslog(LOG_DEBUG, _("Flushing send queue for %s (%s)"),
289 cl->name, cl->hostname);
290 flush_queue(cl, &(cl->sq), xsend);
295 if(debug_lvl >= DEBUG_TRAFFIC)
296 syslog(LOG_DEBUG, _("Flushing receive queue for %s (%s)"),
297 cl->name, cl->hostname);
298 flush_queue(cl, &(cl->rq), xrecv);
304 send a packet to the given vpn ip.
306 int send_packet(ip_t to, vpn_packet_t *packet)
311 if((subnet = lookup_subnet_ipv4(to)) == NULL)
313 if(debug_lvl >= DEBUG_TRAFFIC)
315 syslog(LOG_NOTICE, _("Trying to look up %d.%d.%d.%d in connection list failed!"),
326 if(debug_lvl >= DEBUG_TRAFFIC)
328 syslog(LOG_NOTICE, _("Packet with destination %d.%d.%d.%d is looping back to us!"),
335 /* If we ourselves have indirectdata flag set, we should send only to our uplink! */
337 /* FIXME - check for indirection and reprogram it The Right Way(tm) this time. */
339 /* Connections are now opened beforehand...
341 if(!cl->status.dataopen)
342 if(setup_vpn_connection(cl) < 0)
344 syslog(LOG_ERR, _("Could not open UDP connection to %s (%s)"),
345 cl->name, cl->hostname);
350 if(!cl->status.validkey)
352 /* FIXME: Don't queue until everything else is fixed.
353 if(debug_lvl >= DEBUG_TRAFFIC)
354 syslog(LOG_INFO, _("No valid key known yet for %s (%s), queueing packet"),
355 cl->name, cl->hostname);
356 add_queue(&(cl->sq), packet, packet->len + 2);
358 if(!cl->status.waitingforkey)
359 send_req_key(myself, cl); /* Keys should be sent to the host running the tincd */
363 if(!cl->status.active)
365 /* FIXME: Don't queue until everything else is fixed.
366 if(debug_lvl >= DEBUG_TRAFFIC)
367 syslog(LOG_INFO, _("%s (%s) is not ready, queueing packet"),
368 cl->name, cl->hostname);
369 add_queue(&(cl->sq), packet, packet->len + 2);
371 return 0; /* We don't want to mess up, do we? */
374 /* can we send it? can we? can we? huh? */
376 return xsend(cl, packet);
380 open the local ethertap device
382 int setup_tap_fd(void)
385 const char *tapfname;
392 if((cfg = get_config_val(config, config_tapdevice)))
393 tapfname = cfg->data.ptr;
396 tapfname = "/dev/misc/net/tun";
398 tapfname = "/dev/tap0";
401 if((nfd = open(tapfname, O_RDWR | O_NONBLOCK)) < 0)
403 syslog(LOG_ERR, _("Could not open %s: %m"), tapfname);
409 /* Set default MAC address for ethertap devices */
411 taptype = TAP_TYPE_ETHERTAP;
412 mymac.type = SUBNET_MAC;
413 mymac.net.mac.address.x[0] = 0xfe;
414 mymac.net.mac.address.x[1] = 0xfd;
415 mymac.net.mac.address.x[2] = 0x00;
416 mymac.net.mac.address.x[3] = 0x00;
417 mymac.net.mac.address.x[4] = 0x00;
418 mymac.net.mac.address.x[5] = 0x00;
421 /* Ok now check if this is an old ethertap or a new tun/tap thingie */
422 memset(&ifr, 0, sizeof(ifr));
424 ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
426 strncpy(ifr.ifr_name, netname, IFNAMSIZ);
428 if (!ioctl(tap_fd, TUNSETIFF, (void *) &ifr))
430 syslog(LOG_INFO, _("%s is a new style tun/tap device"), tapfname);
431 taptype = TAP_TYPE_TUNTAP;
439 set up the socket that we listen on for incoming
442 int setup_listen_meta_socket(int port)
445 struct sockaddr_in a;
449 if((nfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
451 syslog(LOG_ERR, _("Creating metasocket failed: %m"));
455 if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
458 syslog(LOG_ERR, _("System call `%s' failed: %m"),
463 if(setsockopt(nfd, SOL_SOCKET, SO_KEEPALIVE, &one, sizeof(one)))
466 syslog(LOG_ERR, _("System call `%s' failed: %m"),
471 flags = fcntl(nfd, F_GETFL);
472 if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
475 syslog(LOG_ERR, _("System call `%s' failed: %m"),
480 if((cfg = get_config_val(config, config_interface)))
482 if(setsockopt(nfd, SOL_SOCKET, SO_KEEPALIVE, cfg->data.ptr, strlen(cfg->data.ptr)))
485 syslog(LOG_ERR, _("Unable to bind listen socket to interface %s: %m"), cfg->data.ptr);
490 memset(&a, 0, sizeof(a));
491 a.sin_family = AF_INET;
492 a.sin_port = htons(port);
494 if((cfg = get_config_val(config, config_interfaceip)))
495 a.sin_addr.s_addr = htonl(cfg->data.ip->address);
497 a.sin_addr.s_addr = htonl(INADDR_ANY);
499 if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
502 syslog(LOG_ERR, _("Can't bind to port %hd/tcp: %m"), port);
509 syslog(LOG_ERR, _("System call `%s' failed: %m"),
518 setup the socket for incoming encrypted
521 int setup_vpn_in_socket(int port)
524 struct sockaddr_in a;
527 if((nfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0)
530 syslog(LOG_ERR, _("Creating socket failed: %m"));
534 if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
537 syslog(LOG_ERR, _("System call `%s' failed: %m"),
542 flags = fcntl(nfd, F_GETFL);
543 if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
546 syslog(LOG_ERR, _("System call `%s' failed: %m"),
551 memset(&a, 0, sizeof(a));
552 a.sin_family = AF_INET;
553 a.sin_port = htons(port);
554 a.sin_addr.s_addr = htonl(INADDR_ANY);
556 if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
559 syslog(LOG_ERR, _("Can't bind to port %hd/udp: %m"), port);
567 setup an outgoing meta (tcp) socket
569 int setup_outgoing_meta_socket(connection_t *cl)
572 struct sockaddr_in a;
575 if(debug_lvl >= DEBUG_CONNECTIONS)
576 syslog(LOG_INFO, _("Trying to connect to %s"), cl->hostname);
578 if((cfg = get_config_val(cl->config, config_port)) == NULL)
581 cl->port = cfg->data.val;
583 cl->meta_socket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
584 if(cl->meta_socket == -1)
586 syslog(LOG_ERR, _("Creating socket for %s port %d failed: %m"),
587 cl->hostname, cl->port);
591 a.sin_family = AF_INET;
592 a.sin_port = htons(cl->port);
593 a.sin_addr.s_addr = htonl(cl->address);
595 if(connect(cl->meta_socket, (struct sockaddr *)&a, sizeof(a)) == -1)
597 close(cl->meta_socket);
598 syslog(LOG_ERR, _("%s port %hd: %m"), cl->hostname, cl->port);
602 flags = fcntl(cl->meta_socket, F_GETFL);
603 if(fcntl(cl->meta_socket, F_SETFL, flags | O_NONBLOCK) < 0)
605 close(cl->meta_socket);
606 syslog(LOG_ERR, _("fcntl for %s port %d: %m"),
607 cl->hostname, cl->port);
611 if(debug_lvl >= DEBUG_CONNECTIONS)
612 syslog(LOG_INFO, _("Connected to %s port %hd"),
613 cl->hostname, cl->port);
621 setup an outgoing connection. It's not
622 necessary to also open an udp socket as
623 well, because the other host will initiate
624 an authentication sequence during which
625 we will do just that.
627 int setup_outgoing_connection(char *name)
635 syslog(LOG_ERR, _("Invalid name for outgoing connection"));
639 ncn = new_connection();
640 asprintf(&ncn->name, "%s", name);
642 if(read_host_config(ncn))
644 syslog(LOG_ERR, _("Error reading host configuration file for %s"));
645 free_connection(ncn);
649 if(!(cfg = get_config_val(ncn->config, config_address)))
651 syslog(LOG_ERR, _("No address specified for %s"));
652 free_connection(ncn);
656 if(!(h = gethostbyname(cfg->data.ptr)))
658 syslog(LOG_ERR, _("Error looking up `%s': %m"), cfg->data.ptr);
659 free_connection(ncn);
663 ncn->address = ntohl(*((ip_t*)(h->h_addr_list[0])));
664 ncn->hostname = hostlookup(htonl(ncn->address));
666 if(setup_outgoing_meta_socket(ncn) < 0)
668 syslog(LOG_ERR, _("Could not set up a meta connection to %s"),
670 free_connection(ncn);
674 ncn->status.outgoing = 1;
675 ncn->buffer = xmalloc(MAXBUFSIZE);
677 ncn->last_ping_time = time(NULL);
687 Configure connection_t myself and set up the local sockets (listen only)
689 int setup_myself(void)
695 myself = new_connection();
697 asprintf(&myself->hostname, "MYSELF"); /* FIXME? Do hostlookup on ourselves? */
699 myself->protocol_version = PROT_CURRENT;
701 if(!(cfg = get_config_val(config, config_name))) /* Not acceptable */
703 syslog(LOG_ERR, _("Name for tinc daemon required!"));
707 asprintf(&myself->name, "%s", (char*)cfg->data.val);
709 if(check_id(myself->name))
711 syslog(LOG_ERR, _("Invalid name for myself!"));
715 if(!(cfg = get_config_val(config, config_privatekey)))
717 syslog(LOG_ERR, _("Private key for tinc daemon required!"));
722 myself->rsa_key = RSA_new();
723 BN_hex2bn(&myself->rsa_key->d, cfg->data.ptr);
724 BN_hex2bn(&myself->rsa_key->e, "FFFF");
727 if(read_host_config(myself))
729 syslog(LOG_ERR, _("Cannot open host configuration file for myself!"));
733 if(!(cfg = get_config_val(myself->config, config_publickey)))
735 syslog(LOG_ERR, _("Public key for tinc daemon required!"));
740 BN_hex2bn(&myself->rsa_key->n, cfg->data.ptr);
743 if(RSA_check_key(myself->rsa_key) != 1)
745 syslog(LOG_ERR, _("Invalid public/private keypair!"));
749 if(!(cfg = get_config_val(myself->config, config_port)))
752 myself->port = cfg->data.val;
754 if((cfg = get_config_val(myself->config, config_indirectdata)))
755 if(cfg->data.val == stupid_true)
756 myself->flags |= EXPORTINDIRECTDATA;
758 if((cfg = get_config_val(myself->config, config_tcponly)))
759 if(cfg->data.val == stupid_true)
760 myself->flags |= TCPONLY;
762 /* Read in all the subnets specified in the host configuration file */
764 for(next = myself->config; (cfg = get_config_val(next, config_subnet)); next = cfg->next)
767 net->type = SUBNET_IPV4;
768 net->net.ipv4.address = cfg->data.ip->address;
769 net->net.ipv4.mask = cfg->data.ip->mask;
771 /* Teach newbies what subnets are... */
773 if((net->net.ipv4.address & net->net.ipv4.mask) != net->net.ipv4.address)
775 syslog(LOG_ERR, _("Network address and subnet mask do not match!"));
779 subnet_add(myself, net);
782 if((myself->meta_socket = setup_listen_meta_socket(myself->port)) < 0)
784 syslog(LOG_ERR, _("Unable to set up a listening socket!"));
788 /* Generate packet encryption key */
790 myself->cipher_pkttype = EVP_bf_cfb();
792 myself->cipher_pktkeylength = myself->cipher_pkttype->key_len + myself->cipher_pkttype->iv_len;
794 myself->cipher_pktkey = (char *)xmalloc(myself->cipher_pktkeylength);
795 RAND_bytes(myself->cipher_pktkey, myself->cipher_pktkeylength);
797 if(!(cfg = get_config_val(config, config_keyexpire)))
800 keylifetime = cfg->data.val;
802 keyexpires = time(NULL) + keylifetime;
804 /* Activate ourselves */
806 myself->status.active = 1;
808 syslog(LOG_NOTICE, _("Ready: listening on port %hd"), myself->port);
814 sigalrm_handler(int a)
818 cfg = get_config_val(upstreamcfg, config_connectto);
820 if(!cfg && upstreamcfg == config)
821 /* No upstream IP given, we're listen only. */
826 upstreamcfg = cfg->next;
827 if(!setup_outgoing_connection(cfg->data.ptr)) /* function returns 0 when there are no problems */
829 signal(SIGALRM, SIG_IGN);
832 cfg = get_config_val(upstreamcfg, config_connectto); /* Or else we try the next ConnectTo line */
835 signal(SIGALRM, sigalrm_handler);
836 upstreamcfg = config;
837 seconds_till_retry += 5;
838 if(seconds_till_retry > MAXTIMEOUT) /* Don't wait more than MAXTIMEOUT seconds. */
839 seconds_till_retry = MAXTIMEOUT;
840 syslog(LOG_ERR, _("Still failed to connect to other, will retry in %d seconds"),
842 alarm(seconds_till_retry);
847 setup all initial network connections
849 int setup_network_connections(void)
856 if((cfg = get_config_val(config, config_pingtimeout)) == NULL)
860 timeout = cfg->data.val;
867 if(setup_tap_fd() < 0)
870 /* Run tinc-up script to further initialize the tap interface */
871 execute_script("tinc-up");
873 if(setup_myself() < 0)
876 if(!(cfg = get_config_val(config, config_connectto)))
877 /* No upstream IP given, we're listen only. */
882 upstreamcfg = cfg->next;
883 if(!setup_outgoing_connection(cfg->data.ptr)) /* function returns 0 when there are no problems */
885 cfg = get_config_val(upstreamcfg, config_connectto); /* Or else we try the next ConnectTo line */
888 signal(SIGALRM, sigalrm_handler);
889 upstreamcfg = config;
890 seconds_till_retry = MAXTIMEOUT;
891 syslog(LOG_NOTICE, _("Trying to re-establish outgoing connection in %d seconds"), seconds_till_retry);
892 alarm(seconds_till_retry);
898 close all open network connections
900 void close_network_connections(void)
905 RBL_FOREACH(connection_tree, rbl)
907 p = (connection_t *)rbl->data;
908 p->status.active = 0;
909 terminate_connection(p);
913 if(myself->status.active)
915 close(myself->meta_socket);
916 free_connection(myself);
922 /* Execute tinc-down script right after shutting down the interface */
923 execute_script("tinc-down");
925 destroy_connection_tree();
931 create a data (udp) socket
933 int setup_vpn_connection(connection_t *cl)
936 struct sockaddr_in a;
939 if(debug_lvl >= DEBUG_TRAFFIC)
940 syslog(LOG_DEBUG, _("Opening UDP socket to %s"), cl->hostname);
942 nfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
945 syslog(LOG_ERR, _("Creating UDP socket failed: %m"));
949 if(setsockopt(nfd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
952 syslog(LOG_ERR, _("System call `%s' failed: %m"),
957 flags = fcntl(nfd, F_GETFL);
958 if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
961 syslog(LOG_ERR, _("System call `%s' failed: %m"),
966 memset(&a, 0, sizeof(a));
967 a.sin_family = AF_INET;
968 a.sin_port = htons(myself->port);
969 a.sin_addr.s_addr = htonl(INADDR_ANY);
971 if(bind(nfd, (struct sockaddr *)&a, sizeof(struct sockaddr)))
974 syslog(LOG_ERR, _("Can't bind to port %hd/udp: %m"), myself->port);
978 a.sin_family = AF_INET;
979 a.sin_port = htons(cl->port);
980 a.sin_addr.s_addr = htonl(cl->address);
982 if(connect(nfd, (struct sockaddr *)&a, sizeof(a)) == -1)
985 syslog(LOG_ERR, _("Connecting to %s port %d failed: %m"),
986 cl->hostname, cl->port);
990 flags = fcntl(nfd, F_GETFL);
991 if(fcntl(nfd, F_SETFL, flags | O_NONBLOCK) < 0)
994 syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m %s (%s)"), __FILE__, __LINE__, nfd,
995 cl->name, cl->hostname);
1000 cl->status.dataopen = 1;
1006 handle an incoming tcp connect call and open
1009 connection_t *create_new_connection(int sfd)
1012 struct sockaddr_in ci;
1013 int len = sizeof(ci);
1015 p = new_connection();
1017 if(getpeername(sfd, (struct sockaddr *) &ci, (socklen_t *) &len) < 0)
1019 syslog(LOG_ERR, _("System call `%s' failed: %m"),
1025 p->address = ntohl(ci.sin_addr.s_addr);
1026 p->hostname = hostlookup(ci.sin_addr.s_addr);
1027 p->meta_socket = sfd;
1029 p->buffer = xmalloc(MAXBUFSIZE);
1031 p->last_ping_time = time(NULL);
1033 if(debug_lvl >= DEBUG_CONNECTIONS)
1034 syslog(LOG_NOTICE, _("Connection from %s port %d"),
1035 p->hostname, htons(ci.sin_port));
1037 p->allow_request = ID;
1043 put all file descriptors in an fd_set array
1045 void build_fdset(fd_set *fs)
1052 RBL_FOREACH(connection_tree, rbl)
1054 p = (connection_t *)rbl->data;
1056 FD_SET(p->meta_socket, fs);
1057 if(p->status.dataopen)
1058 FD_SET(p->socket, fs);
1061 FD_SET(myself->meta_socket, fs);
1067 receive incoming data from the listening
1068 udp socket and write it to the ethertap
1069 device after being decrypted
1071 int handle_incoming_vpn_data(connection_t *cl)
1074 int x, l = sizeof(x);
1077 if(getsockopt(cl->socket, SOL_SOCKET, SO_ERROR, &x, &l) < 0)
1079 syslog(LOG_ERR, _("This is a bug: %s:%d: %d:%m"),
1080 __FILE__, __LINE__, cl->socket);
1085 syslog(LOG_ERR, _("Incoming data socket error: %s"), strerror(x));
1089 if((lenin = recv(cl->socket, (char *) &(pkt.len), MTU, 0)) <= 0)
1091 syslog(LOG_ERR, _("Receiving packet failed: %m"));
1095 if(debug_lvl >= DEBUG_TRAFFIC)
1097 syslog(LOG_DEBUG, _("Received packet of %d bytes from %s (%s)"), lenin,
1098 cl->name, cl->hostname);
1102 return xrecv(cl, &pkt);
1106 terminate a connection and notify the other
1107 end before closing the sockets
1109 void terminate_connection(connection_t *cl)
1115 if(cl->status.remove)
1118 cl->status.remove = 1;
1120 if(debug_lvl >= DEBUG_CONNECTIONS)
1121 syslog(LOG_NOTICE, _("Closing connection with %s (%s)"),
1122 cl->name, cl->hostname);
1127 close(cl->meta_socket);
1129 /* Find all connections that were lost because they were behind cl
1130 (the connection that was dropped). */
1133 RBL_FOREACH(connection_tree, rbl)
1135 p = (connection_t *)rbl->data;
1136 if(p->nexthop == cl && p != cl)
1137 terminate_connection(p);
1140 /* Inform others of termination if it was still active */
1142 if(cl->status.active)
1143 RBL_FOREACH(connection_tree, rbl)
1145 p = (connection_t *)rbl->data;
1146 if(p->status.meta && p->status.active && p!=cl)
1147 send_del_host(p, cl); /* Sounds like recursion, but p does not have a meta connection :) */
1150 /* Remove the associated subnets */
1152 RBL_FOREACH(cl->subnet_tree, rbl)
1154 subnet = (subnet_t *)rbl->data;
1158 /* Check if this was our outgoing connection */
1160 if(cl->status.outgoing && cl->status.active)
1162 signal(SIGALRM, sigalrm_handler);
1163 seconds_till_retry = 5;
1164 alarm(seconds_till_retry);
1165 syslog(LOG_NOTICE, _("Trying to re-establish outgoing connection in 5 seconds"));
1170 cl->status.active = 0;
1175 Check if the other end is active.
1176 If we have sent packets, but didn't receive any,
1177 then possibly the other end is dead. We send a
1178 PING request over the meta connection. If the other
1179 end does not reply in time, we consider them dead
1180 and close the connection.
1182 void check_dead_connections(void)
1190 RBL_FOREACH(connection_tree, rbl)
1192 cl = (connection_t *)rbl->data;
1193 if(cl->status.active && cl->status.meta)
1195 if(cl->last_ping_time + timeout < now)
1197 if(cl->status.pinged)
1199 if(debug_lvl >= DEBUG_PROTOCOL)
1200 syslog(LOG_INFO, _("%s (%s) didn't respond to PING"),
1201 cl->name, cl->hostname);
1202 cl->status.timeout = 1;
1203 terminate_connection(cl);
1216 accept a new tcp connect and create a
1219 int handle_new_meta_connection()
1222 struct sockaddr client;
1223 int nfd, len = sizeof(client);
1225 if((nfd = accept(myself->meta_socket, &client, &len)) < 0)
1227 syslog(LOG_ERR, _("Accepting a new connection failed: %m"));
1231 if(!(ncn = create_new_connection(nfd)))
1235 syslog(LOG_NOTICE, _("Closed attempted connection"));
1239 connection_add(ncn);
1245 check all connections to see if anything
1246 happened on their sockets
1248 void check_network_activity(fd_set *f)
1253 RBL_FOREACH(connection_tree, rbl)
1255 p = (connection_t *)rbl->data;
1257 if(p->status.remove)
1260 if(p->status.dataopen)
1261 if(FD_ISSET(p->socket, f))
1263 handle_incoming_vpn_data(p);
1265 /* Old error stuff (FIXME: copy this to handle_incoming_vpn_data()
1267 getsockopt(p->socket, SOL_SOCKET, SO_ERROR, &x, &l);
1268 syslog(LOG_ERR, _("Outgoing data socket error for %s (%s): %s"),
1269 p->name, p->hostname, strerror(x));
1270 terminate_connection(p);
1276 if(FD_ISSET(p->meta_socket, f))
1277 if(receive_meta(p) < 0)
1279 terminate_connection(p);
1284 if(FD_ISSET(myself->meta_socket, f))
1285 handle_new_meta_connection();
1290 read, encrypt and send data that is
1291 available through the ethertap device
1293 void handle_tap_input(void)
1298 if(taptype == TAP_TYPE_TUNTAP)
1300 if((lenin = read(tap_fd, vp.data, MTU)) <= 0)
1302 syslog(LOG_ERR, _("Error while reading from tun/tap device: %m"));
1309 if((lenin = read(tap_fd, vp.data - 2, MTU)) <= 0)
1311 syslog(LOG_ERR, _("Error while reading from ethertap device: %m"));
1317 total_tap_in += lenin;
1321 if(debug_lvl >= DEBUG_TRAFFIC)
1322 syslog(LOG_WARNING, _("Received short packet from tap device"));
1326 if(debug_lvl >= DEBUG_TRAFFIC)
1328 syslog(LOG_DEBUG, _("Read packet of length %d from tap device"), vp.len);
1331 send_packet(ntohl(*((unsigned long*)(&vp.data[30]))), &vp);
1336 this is where it all happens...
1338 void main_loop(void)
1343 time_t last_ping_check;
1346 last_ping_check = time(NULL);
1350 tv.tv_sec = timeout;
1353 prune_connection_tree();
1356 if((r = select(FD_SETSIZE, &fset, NULL, NULL, &tv)) < 0)
1358 if(errno != EINTR) /* because of alarm */
1360 syslog(LOG_ERR, _("Error while waiting for input: %m"));
1367 syslog(LOG_INFO, _("Rereading configuration file and restarting in 5 seconds"));
1369 close_network_connections();
1370 clear_config(&config);
1372 if(read_server_config())
1374 syslog(LOG_ERR, _("Unable to reread configuration file, exiting"));
1380 if(setup_network_connections())
1388 /* Let's check if everybody is still alive */
1390 if(last_ping_check + timeout < t)
1392 check_dead_connections();
1393 last_ping_check = time(NULL);
1395 /* Should we regenerate our key? */
1399 if(debug_lvl >= DEBUG_STATUS)
1400 syslog(LOG_INFO, _("Regenerating symmetric key"));
1402 RAND_bytes(myself->cipher_pktkey, myself->cipher_pktkeylength);
1403 send_key_changed(myself, NULL);
1404 keyexpires = time(NULL) + keylifetime;
1410 check_network_activity(&fset);
1412 /* local tap data */
1413 if(FD_ISSET(tap_fd, &fset))