gvpe/src/vpn_dns.C

/*
    vpn_dns.C -- handle the dns tunnel part of the protocol.
    Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include "config.h"

#if ENABLE_DNS

// dns processing is EXTREMELY ugly. For obvious(?) reasons.
// it's a hack, use only in emergency situations please.

#include <cstring>

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/uio.h>
#include <errno.h>
#include <time.h>
#include <unistd.h>
#include <fcntl.h>

#include <map>

#include "netcompat.h"

#include "vpn.h"

#define MIN_RETRY 1.
#define MAX_RETRY 60.

#define MAX_OUTSTANDING 40 // max. outstanding requests
#define MAX_WINDOW      100 // max. for MAX_OUTSTANDING
#define MAX_RATE        1000 // requests/s
#define MAX_BACKLOG     (10*1024) // size of protocol backlog, must be > MAXSIZE

#define MAX_DOMAIN_SIZE 220 // 255 is legal limit, but bind doesn't compress well
// 240 leaves about 4 bytes of server reply data
// every two request byte sless give room for one reply byte

#define SEQNO_MASK 0xffff

/*

protocol, in shorthand :)

client -> server <req>  ANY?
server -> client <req>  TXT <rep>

<req> is dns64-encoded <client-id:12><recv-seqno:10>[<send-seqno:10><data>]
<rep> is dns64-encoded <0:12><recv-seqno:10>[<send-seqno:10><data>]

if <client-id> is zero, the connection will be configured:

<0:12><0:4>client-id:12><default-ttl:8><max-size:16><flags:16>

*/

#define MAX_LBL_SIZE 63
#define MAX_PKT_SIZE 512

#define RR_TYPE_TXT 16
#define RR_TYPE_ANY 255
#define RR_CLASS_IN 1

// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative)
struct dns64
{
  static const char encode_chars[64 + 1];
  static s8 decode_chars[256];

  static int encode_len (int bytes) { return (bytes * 8 + 5) / 6; }
  static int decode_len (int bytes) { return (bytes * 6) / 8; }
  static int encode (char *dst, u8 *src, int len);
  static int decode (u8 *dst, char *src, int len);

  dns64 ();
} dns64;

const char dns64::encode_chars[64 + 1] = "_4B9dLphHzrqQmGjkTbJt5svlZX8xSaReEYfwKgF1DP2W6NyVOU70IouACcMn3i-";
s8 dns64::decode_chars[256];

dns64::dns64 ()
{
  for (int i = 0; i < 64; i++)
    decode_chars [encode_chars [i]] = i + 1;
}

int dns64::encode (char *dst, u8 *src, int len)
{
  // slow, but easy to debug
  char *beg = dst;
  unsigned int accum, bits = 0;

  while (len--)
    {
      accum <<= 8;
      accum  |= *src++;
      bits   += 8;

      while (bits >= 6)
        {
          *dst++ = encode_chars [(accum >> (bits - 6)) & 63];
          bits  -= 6;
        }
    }

  if (bits)
    *dst++ = encode_chars [(accum << (6 - bits)) & 63];

  return dst - beg;
}

int dns64::decode (u8 *dst, char *src, int len)
{
  // slow, but easy to debug
  u8 *beg = dst;
  unsigned int accum, bits = 0;

  while (len--)
    {
      s8 chr = decode_chars [(u8)*src++];

      if (!chr)
        continue;

      accum <<= 6;
      accum  |= chr - 1;
      bits   += 6;

      while (bits >= 8)
        {
          *dst++ = accum >> (bits - 8);
          bits  -= 8;
        }
    }

  return dst - beg;
}

/////////////////////////////////////////////////////////////////////////////

struct byte_stream
{
  u8 *data;
  int maxsize;
  int fill;

  byte_stream (int maxsize);
  ~byte_stream ();

  bool empty () { return !fill; }
  int size () { return fill; }

  bool put (u8 *data, unsigned int datalen);
  bool put (vpn_packet *pkt);
  vpn_packet *get ();

  u8 *begin () { return data; }
  void remove (int count);
};

byte_stream::byte_stream (int maxsize)
: maxsize (maxsize), fill (0)
{
  data = new u8 [maxsize];
}

byte_stream::~byte_stream ()
{
  delete data;
}

void byte_stream::remove (int count)
{
  if (count > fill)
    abort ();

  memmove (data, data + count, fill -= count);
}

bool byte_stream::put (u8 *data, unsigned int datalen)
{
  if (maxsize - fill < datalen)
    return false;

  memcpy (this->data + fill, data, datalen); fill += datalen;

  return true;
}

bool byte_stream::put (vpn_packet *pkt)
{
  if (maxsize - fill < pkt->len + 2)
    return false;

  data [fill++] = pkt->len >> 8;
  data [fill++] = pkt->len;

  memcpy (data + fill, &((*pkt)[0]), pkt->len); fill += pkt->len;

  return true;
}

vpn_packet *byte_stream::get ()
{
  int len = (data [0] << 8) | data [1];

  printf ("get len %d, fill %d\n", len, fill);//D

  if (len > MAXSIZE && fill >= 2)
    abort (); // TODO handle this gracefully, connection reset

  if (fill < len + 2)
    return 0;

  vpn_packet *pkt = new vpn_packet;

  pkt->len = len;
  memcpy (&((*pkt)[0]), data + 2, len);
  remove (len + 2);

  return pkt;
}

/////////////////////////////////////////////////////////////////////////////

#define FLAG_QUERY    ( 0 << 15)
#define FLAG_RESPONSE ( 1 << 15)
#define FLAG_OP_MASK  (15 << 14)
#define FLAG_OP_QUERY ( 0 << 11)
#define FLAG_AA       ( 1 << 10)
#define FLAG_TC       ( 1 <<  9)
#define FLAG_RD       ( 1 <<  8)
#define FLAG_RA       ( 1 <<  7)
#define FLAG_AUTH     ( 1 <<  5)
#define FLAG_RCODE_MASK     (15 << 0)
#define FLAG_RCODE_OK       ( 0 << 0)
#define FLAG_RCODE_FORMERR  ( 1 << 0)
#define FLAG_RCODE_SERVFAIL ( 2 << 0)
#define FLAG_RCODE_NXDOMAIN ( 3 << 0)
#define FLAG_RCODE_REFUSED  ( 5 << 0)

#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)
#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)

struct dns_packet : net_packet
{
  u16 id;
  u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
  u16 qdcount, ancount, nscount, arcount;

  u8 data[MAXSIZE - 6 * 2];

  int decode_label (char *data, int size, int &offs);
};

int dns_packet::decode_label (char *data, int size, int &offs)
{
  char *orig = data;

  memset (data, 0, size);

  while (offs < size - 1)
    {
      u8 len = (*this)[offs++];

      if (!len)
        break;
      else if (len < 64)
        {
          if (size < len + 1 || offs + len >= MAXSIZE - 1)
            break;

          memcpy (data, &((*this)[offs]), len);

          data += len; size -= len; offs += len;
          *data++ = '.'; size--;
        }
      else
        {
          int offs2 = ((len & 63) << 8) + (*this)[offs++];

          data += decode_label (data, size, offs2);
          break;
        }
    }

  return data - orig;
}

/////////////////////////////////////////////////////////////////////////////

struct dns_req
{
  dns_packet *pkt;
  tstamp next;
  int retry;
  connection *conn;
  int seqno;

  dns_req (connection *c);
  void gen_stream_req (int seqno, byte_stream *stream);
};

static u16 dns_id = 12098; // TODO: should be per-vpn

static u16 next_id ()
{
  // the simplest lsfr with periodicity 65535 i could find
  dns_id = (dns_id << 1)
           | (((dns_id >> 1)
               ^ (dns_id >> 2)
               ^ (dns_id >> 4)
               ^ (dns_id >> 15)) & 1);

  return dns_id;
}

dns_req::dns_req (connection *c)
: conn (c)
{
  next = 0;
  retry = 0;

  pkt = new dns_packet;

  pkt->id = next_id ();
}

void dns_req::gen_stream_req (int seqno, byte_stream *stream)
{
  this->seqno = seqno;

  pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
  pkt->qdcount = htons (1);

  int offs = 6*2;
  int dlen = MAX_DOMAIN_SIZE - strlen (THISNODE->domain) - 2;
  // MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
  // so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra

  u8 data[256]; //TODO

  data[0] = THISNODE->id; //TODO
  data[1] = seqno >> 8; //TODO
  data[2] = seqno; //TODO

  int datalen = dns64::decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE) - 3;

  if (datalen > stream->size ())
    datalen = stream->size ();

  char enc[256], *encp = enc;
  
  memcpy (data + 3, stream->begin (), datalen);
  int enclen = dns64::encode (enc, data, datalen + 3);
  stream->remove (datalen);

  while (enclen)
    {
      int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;

      (*pkt)[offs++] = lbllen;
      memcpy (pkt->at (offs), encp, lbllen);

      offs += lbllen;
      encp += lbllen;

      enclen -= lbllen;
    }

  const char *suffix = THISNODE->domain;

  // add tunnel domain
  for (;;)
    {
      const char *end = strchr (suffix, '.');

      if (!end)
        end = suffix + strlen (suffix);

      int len = end - suffix;

      (*pkt)[offs++] = len;
      memcpy (&((*pkt)[offs]), suffix, len);
      offs += len;

      if (!*end)
        break;

      suffix = end + 1;
    }

  (*pkt)[offs++] = 0;
  (*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;
  (*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;

  pkt->len = offs;
}

struct dns_rcv
{
  int seqno;
  dns_packet *pkt; // reply packet
  u8 data [MAXSIZE]; // actually part of the reply packet...
  int datalen;

  dns_rcv (int seqno, dns_packet *req, u8 *data, int datalen);
  ~dns_rcv ();
};

dns_rcv::dns_rcv (int seqno, dns_packet *req, u8 *data, int datalen)
: seqno (seqno), pkt (new dns_packet), datalen (datalen)
{
  memcpy (this->data, data, datalen);
  pkt->len = req->len;
  memcpy (pkt->at (0), req->at (0), req->len);
}

dns_rcv::~dns_rcv ()
{
  delete pkt;
}

/////////////////////////////////////////////////////////////////////////////

struct dns_cfg
{
  u8 id1, id2, id3;
  u8 def_ttl;
  u8 unused1;
  u16 max_size;
  u8 flags1, flags2;
};

void connection::dnsv4_receive_rep (struct dns_rcv *r)
{
  dns_rcvpq.push_back (r);

  redo:

  for (vector<dns_rcv *>::iterator i = dns_rcvpq.begin ();
       i != dns_rcvpq.end ();
       ++i)
    if (dns_rcvseq == (*i)->seqno)
      {
        dns_rcv *r = *i;

        dns_rcvseq = (dns_rcvseq + 1) & SEQNO_MASK;

        if (!dns_snddq && !dns_rcvdq)
          {
            dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
            dns_snddq = new byte_stream (MAX_BACKLOG);

            dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
          }

        if (!dns_rcvdq->put (r->data, r->datalen))
          abort (); // MUST never overflow, can be caused by data corruption, TODO

        while (vpn_packet *pkt = dns_rcvdq->get ())
          {
            sockinfo si;
            si.host = 0; si.port = 0; si.prot = PROT_DNSv4;

            vpn->recv_vpn_packet (pkt, si);
          }
      }
    else if ((u32)dns_rcvseq - MAX_WINDOW - (u32)(*i)->seqno < MAX_WINDOW * 2)
      {
        dns_rcvpq.erase (i);
        goto redo;
      }
}

dns_packet *
vpn::dnsv4_server (dns_packet *pkt)
{
  u16 flags = ntohs (pkt->flags);

  //memcpy (&((*rep)[0]), &((*pkt)[0]), pkt->len);
  int offs = 6 * 2; // skip header

  pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);

  if (!(flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))
      && pkt->qdcount == htons (1))
    {
      char qname[MAXSIZE];
      int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);

      u16 qtype  = (*pkt) [offs++] << 8; qtype  |= (*pkt) [offs++];
      u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];

      pkt->qdcount = htons (1);
      pkt->ancount = 0;
      pkt->nscount = 0; // should be self, as other nameservers reply like this
      pkt->arcount = 0; // a record for self, as other nameservers reply like this

      pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_NXDOMAIN);

      int dlen = strlen (THISNODE->domain);

      if (qclass == RR_CLASS_IN
          && (qtype == RR_TYPE_ANY || qtype == RR_TYPE_TXT)
          && qlen > dlen + 1
          && !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen))
        {
          // correct class, domain: parse
          u8 data[MAXSIZE];
          int datalen = dns64::decode (data, qname, qlen - dlen - 1);

          int client = data[0];
          int seqno  = ((data[1] << 8) | data[2]) & SEQNO_MASK;

          if (0 < client && client <= conns.size ())
            {
              connection *c = conns [client - 1];

              for (vector<dns_rcv *>::iterator i = c->dns_rcvpq.begin ();
                   i != c->dns_rcvpq.end ();
                   ++i)
                if ((*i)->seqno == seqno)
                  {
                    // already seen that request, just reply with the original reply
                    dns_rcv *r = *i;

                    offs = r->pkt->len;
                    memcpy (pkt->at (0), r->pkt->at (0), offs);
                    goto duplicate_request;
                  }

              // new packet, queue
              c->dnsv4_receive_rep (new dns_rcv (seqno, pkt, data + 3, datalen - 3));

              // now generate reply
              pkt->ancount = htons (1); // one answer RR
              pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);

              (*pkt) [offs++] = 0xc0;
              (*pkt) [offs++] = 6 * 2; // same as in query section

              (*pkt) [offs++] = RR_TYPE_TXT >> 8; (*pkt) [offs++] = RR_TYPE_TXT;
              (*pkt) [offs++] = RR_CLASS_IN >> 8; (*pkt) [offs++] = RR_CLASS_IN;

              (*pkt) [offs++] = 0; (*pkt) [offs++] = 0;
              (*pkt) [offs++] = 0; (*pkt) [offs++] = 0; // TTL

              int dlen = MAX_PKT_SIZE - offs - 2;

              // bind doesn't compress well, so reduce further by one label length
              dlen -= qlen;

              int rdlen_offs = offs += 2;

              while (c->dns_snddq
                     && !c->dns_snddq->empty ()
                     && dlen > 1)
                {
                  int txtlen = dlen <= 255 ? dlen - 1 : 255;

                  if (txtlen > c->dns_snddq->size ())
                    txtlen = c->dns_snddq->size ();

                  (*pkt)[offs++] = txtlen;
                  memcpy (pkt->at (offs), c->dns_snddq->begin (), txtlen);
                  offs += txtlen;
                  c->dns_snddq->remove (txtlen);

                  dlen -= txtlen + 1;
                }

              // avoid empty TXT rdata
              if (offs == rdlen_offs)
                (*pkt)[offs++] = 0;

              int rdlen = offs - rdlen_offs;

              (*pkt) [rdlen_offs - 2] = rdlen >> 8;
              (*pkt) [rdlen_offs - 1] = rdlen;

              duplicate_request: ;
            }
          else
            pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
        }
    }
  else
    offs = pkt->len;

  pkt->len = offs;
  return pkt;
}

void
vpn::dnsv4_client (dns_packet *pkt)
{
  u16 flags = ntohs (pkt->flags);
  int offs = 6 * 2; // skip header

  pkt->qdcount = ntohs (pkt->qdcount);
  pkt->ancount = ntohs (pkt->ancount);

  // go through our request list and find the corresponding request
  for (vector<dns_req *>::iterator i = dns_sndpq.begin ();
       i != dns_sndpq.end ();
       ++i)
    if ((*i)->pkt->id == pkt->id)
      {
        connection *c = (*i)->conn;
        int seqno = (*i)->seqno;
        u8 data[MAXSIZE], *datap = data;

        delete *i;
        dns_sndpq.erase (i);

        if (flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))
          {
            char qname[MAXSIZE];

            while (pkt->qdcount-- && offs < MAXSIZE - 4)
              {
                int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);
                offs += 4; // skip qtype, qclass
              }

            while (pkt->ancount-- && offs < MAXSIZE - 10)
              {
                pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);

                u16 qtype  = (*pkt) [offs++] << 8; qtype  |= (*pkt) [offs++];
                u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];
                u32 ttl  = (*pkt) [offs++] << 24;
                    ttl |= (*pkt) [offs++] << 16;
                    ttl |= (*pkt) [offs++] <<  8;
                    ttl |= (*pkt) [offs++];

                u16 rdlen = (*pkt) [offs++] << 8; rdlen |= (*pkt) [offs++];

                if (rdlen <= MAXSIZE - offs)
                  {
                    // decode bytes, finally

                    while (rdlen)
                      {
                        int txtlen = (*pkt) [offs++];

                        assert (txtlen + offs < MAXSIZE - 1);

                        memcpy (datap, pkt->at (offs), txtlen);
                        datap += txtlen; offs += txtlen;

                        rdlen -= txtlen + 1;
                      }

                  }

              }
          }

        if (datap != data)
          printf ("%02x %02x %02x %02x\n",
              data[0],
              data[1],
              data[2],
              data[3]);

        printf ("recv %d,%d\n", pkt->id, seqno, datap - data);//D
        c->dnsv4_receive_rep (new dns_rcv (seqno, pkt, data, datap - data));

        break;
      }

  delete pkt;
}

void
vpn::dnsv4_ev (io_watcher &w, short revents)
{
  if (revents & EVENT_READ)
    {
      dns_packet *pkt = new dns_packet;
      struct sockaddr_in sa;
      socklen_t sa_len = sizeof (sa);

      pkt->len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);

      if (pkt->len > 0)
        {
          if (pkt->flags & htons (FLAG_TC))
            {
              slog (L_WARN, _("DNS request/response truncated, check protocol settings."));
              //TODO connection reset
            }

          if (THISNODE->dns_port)
            {
              pkt = dnsv4_server (pkt);
              sendto (w.fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)&sa, sa_len);
            }
          else
            dnsv4_client (pkt);
        }
    }
}

bool
connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
{
  // never initialized
  if (!dns_snddq && !dns_rcvdq)
    {
      dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
      dns_snddq = new byte_stream (MAX_BACKLOG);

      //dns_rcvseq = dns_sndseq = 0;

      dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
    }
  
  if (!dns_snddq->put (pkt))
    return false;

  // start timer if neccessary
  if (!THISNODE->dns_port && !dnsv4_tw.active)
    dnsv4_cb (dnsv4_tw);

  return true;
}

void
connection::dnsv4_cb (time_watcher &w)
{
  // check for timeouts and (re)transmit
  tstamp next = NOW + 60;
  dns_req *send = 0;
  
  for (vector<dns_req *>::iterator i = vpn->dns_sndpq.begin ();
       i != vpn->dns_sndpq.end ();
       ++i)
    {
      dns_req *r = *i;

      if (r->next <= NOW)
        {
          if (!send)
            {
              send = r;

              if (r->retry)//D
                printf ("req %d, retry %d\n", r->pkt->id, r->retry);
              r->retry++;
              r->next = NOW + r->retry;
            }
        }

      if (r->next < next)
        next = r->next;
    }

  if (!send
      && vpn->dns_sndpq.size () < MAX_OUTSTANDING)
    {
      send = new dns_req (this);
      send->gen_stream_req (dns_sndseq, dns_snddq);
      vpn->dns_sndpq.push_back (send);

      dns_sndseq = (dns_sndseq + 1) & SEQNO_MASK;
    }

  tstamp min_next = NOW + (1. / (tstamp)MAX_RATE);

  if (send)
    {
      dns_packet *pkt = send->pkt;

      next = min_next;

      sendto (vpn->dnsv4_fd, &((*pkt)[0]), pkt->len, 0, dns_si.sav4 (), dns_si.salenv4 ());
    }
  else if (next < min_next)
    next = min_next;

  w.start (next);
}

#endif

Revision:	1.5
Committed:	Thu Mar 3 07:24:57 2005 UTC (19 years, 2 months ago) by pcg
Content type:	text/plain
Branch:	MAIN
Changes since 1.4:	+258 -104 lines
Log Message:	* empty log message *
#	User	Rev	Content
1	pcg	1.1	/*
2			vpn_dns.C -- handle the dns tunnel part of the protocol.
3			Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>
4
5			This program is free software; you can redistribute it and/or modify
6			it under the terms of the GNU General Public License as published by
7			the Free Software Foundation; either version 2 of the License, or
8			(at your option) any later version.
9
10			This program is distributed in the hope that it will be useful,
11			but WITHOUT ANY WARRANTY; without even the implied warranty of
12			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13			GNU General Public License for more details.
14
15			You should have received a copy of the GNU General Public License
16			along with this program; if not, write to the Free Software
17			Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
18			*/
19
20			#include "config.h"
21
22			#if ENABLE_DNS
23
24			// dns processing is EXTREMELY ugly. For obvious(?) reasons.
25			// it's a hack, use only in emergency situations please.
26
27			#include <cstring>
28
29			#include <sys/types.h>
30			#include <sys/socket.h>
31			#include <sys/wait.h>
32			#include <sys/uio.h>
33			#include <errno.h>
34			#include <time.h>
35			#include <unistd.h>
36			#include <fcntl.h>
37
38			#include <map>
39
40			#include "netcompat.h"
41
42			#include "vpn.h"
43
44			#define MIN_RETRY 1.
45			#define MAX_RETRY 60.
46
47	pcg	1.5	#define MAX_OUTSTANDING 40 // max. outstanding requests
48	pcg	1.4	#define MAX_WINDOW 100 // max. for MAX_OUTSTANDING
49	pcg	1.5	#define MAX_RATE 1000 // requests/s
50			#define MAX_BACKLOG (10*1024) // size of protocol backlog, must be > MAXSIZE
51
52			#define MAX_DOMAIN_SIZE 220 // 255 is legal limit, but bind doesn't compress well
53			// 240 leaves about 4 bytes of server reply data
54			// every two request byte sless give room for one reply byte
55
56			#define SEQNO_MASK 0xffff
57	pcg	1.1
58			/*
59
60			protocol, in shorthand :)
61
62	pcg	1.2	client -> server <req> ANY?
63			server -> client <req> TXT <rep>
64	pcg	1.1
65	pcg	1.2	<req> is dns64-encoded <client-id:12><recv-seqno:10>[<send-seqno:10><data>]
66			<rep> is dns64-encoded <0:12><recv-seqno:10>[<send-seqno:10><data>]
67
68			if <client-id> is zero, the connection will be configured:
69
70			<0:12><0:4>client-id:12><default-ttl:8><max-size:16><flags:16>
71	pcg	1.1
72			*/
73
74	pcg	1.2	#define MAX_LBL_SIZE 63
75			#define MAX_PKT_SIZE 512
76
77			#define RR_TYPE_TXT 16
78			#define RR_TYPE_ANY 255
79			#define RR_CLASS_IN 1
80
81			// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative)
82			struct dns64
83			{
84			static const char encode_chars[64 + 1];
85			static s8 decode_chars[256];
86
87			static int encode_len (int bytes) { return (bytes * 8 + 5) / 6; }
88			static int decode_len (int bytes) { return (bytes * 6) / 8; }
89	pcg	1.4	static int encode (char dst, u8 src, int len);
90			static int decode (u8 dst, char src, int len);
91	pcg	1.2
92			dns64 ();
93			} dns64;
94
95	pcg	1.5	const char dns64::encode_chars[64 + 1] = "_4B9dLphHzrqQmGjkTbJt5svlZX8xSaReEYfwKgF1DP2W6NyVOU70IouACcMn3i-";
96	pcg	1.2	s8 dns64::decode_chars[256];
97
98			dns64::dns64 ()
99			{
100			for (int i = 0; i < 64; i++)
101			decode_chars [encode_chars [i]] = i + 1;
102			}
103
104	pcg	1.4	int dns64::encode (char dst, u8 src, int len)
105	pcg	1.2	{
106			// slow, but easy to debug
107	pcg	1.4	char *beg = dst;
108	pcg	1.2	unsigned int accum, bits = 0;
109
110			while (len--)
111			{
112			accum <<= 8;
113			accum \|= *src++;
114			bits += 8;
115
116			while (bits >= 6)
117			{
118			*dst++ = encode_chars [(accum >> (bits - 6)) & 63];
119			bits -= 6;
120			}
121			}
122
123			if (bits)
124			*dst++ = encode_chars [(accum << (6 - bits)) & 63];
125	pcg	1.4
126			return dst - beg;
127	pcg	1.2	}
128
129	pcg	1.4	int dns64::decode (u8 dst, char src, int len)
130	pcg	1.2	{
131			// slow, but easy to debug
132	pcg	1.4	u8 *beg = dst;
133	pcg	1.2	unsigned int accum, bits = 0;
134
135			while (len--)
136			{
137			s8 chr = decode_chars [(u8)*src++];
138
139			if (!chr)
140	pcg	1.5	continue;
141	pcg	1.2
142			accum <<= 6;
143			accum \|= chr - 1;
144			bits += 6;
145
146			while (bits >= 8)
147			{
148			*dst++ = accum >> (bits - 8);
149			bits -= 8;
150			}
151			}
152	pcg	1.4
153			return dst - beg;
154			}
155
156			/////////////////////////////////////////////////////////////////////////////
157
158			struct byte_stream
159			{
160			u8 *data;
161			int maxsize;
162			int fill;
163
164			byte_stream (int maxsize);
165			~byte_stream ();
166
167			bool empty () { return !fill; }
168			int size () { return fill; }
169
170	pcg	1.5	bool put (u8 *data, unsigned int datalen);
171	pcg	1.4	bool put (vpn_packet *pkt);
172			vpn_packet *get ();
173
174			u8 *begin () { return data; }
175			void remove (int count);
176			};
177
178			byte_stream::byte_stream (int maxsize)
179			: maxsize (maxsize), fill (0)
180			{
181			data = new u8 [maxsize];
182			}
183
184			byte_stream::~byte_stream ()
185			{
186			delete data;
187			}
188
189			void byte_stream::remove (int count)
190			{
191			if (count > fill)
192			abort ();
193
194			memmove (data, data + count, fill -= count);
195			}
196
197	pcg	1.5	bool byte_stream::put (u8 *data, unsigned int datalen)
198			{
199			if (maxsize - fill < datalen)
200			return false;
201
202			memcpy (this->data + fill, data, datalen); fill += datalen;
203
204			return true;
205			}
206
207	pcg	1.4	bool byte_stream::put (vpn_packet *pkt)
208			{
209			if (maxsize - fill < pkt->len + 2)
210			return false;
211
212			data [fill++] = pkt->len >> 8;
213			data [fill++] = pkt->len;
214
215			memcpy (data + fill, &((*pkt)[0]), pkt->len); fill += pkt->len;
216
217			return true;
218			}
219
220			vpn_packet *byte_stream::get ()
221			{
222			int len = (data [0] << 8) \| data [1];
223
224	pcg	1.5	printf ("get len %d, fill %d\n", len, fill);//D
225
226			if (len > MAXSIZE && fill >= 2)
227			abort (); // TODO handle this gracefully, connection reset
228
229	pcg	1.4	if (fill < len + 2)
230			return 0;
231
232			vpn_packet *pkt = new vpn_packet;
233	pcg	1.5
234			pkt->len = len;
235	pcg	1.4	memcpy (&((*pkt)[0]), data + 2, len);
236			remove (len + 2);
237
238			return pkt;
239	pcg	1.2	}
240
241	pcg	1.3	/////////////////////////////////////////////////////////////////////////////
242
243	pcg	1.2	#define FLAG_QUERY ( 0 << 15)
244			#define FLAG_RESPONSE ( 1 << 15)
245			#define FLAG_OP_MASK (15 << 14)
246			#define FLAG_OP_QUERY ( 0 << 11)
247			#define FLAG_AA ( 1 << 10)
248			#define FLAG_TC ( 1 << 9)
249			#define FLAG_RD ( 1 << 8)
250			#define FLAG_RA ( 1 << 7)
251	pcg	1.5	#define FLAG_AUTH ( 1 << 5)
252	pcg	1.2	#define FLAG_RCODE_MASK (15 << 0)
253			#define FLAG_RCODE_OK ( 0 << 0)
254			#define FLAG_RCODE_FORMERR ( 1 << 0)
255			#define FLAG_RCODE_SERVFAIL ( 2 << 0)
256			#define FLAG_RCODE_NXDOMAIN ( 3 << 0)
257			#define FLAG_RCODE_REFUSED ( 5 << 0)
258
259			#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY \| FLAG_OP_QUERY \| FLAG_RD)
260	pcg	1.5	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE \| FLAG_OP_QUERY \| FLAG_AA \| FLAG_RD \| FLAG_RA)
261	pcg	1.2
262			struct dns_packet : net_packet
263			{
264			u16 id;
265			u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
266			u16 qdcount, ancount, nscount, arcount;
267
268			u8 data[MAXSIZE - 6 * 2];
269
270			int decode_label (char *data, int size, int &offs);
271			};
272
273			int dns_packet::decode_label (char *data, int size, int &offs)
274			{
275			char *orig = data;
276
277			memset (data, 0, size);
278
279			while (offs < size - 1)
280			{
281			u8 len = (*this)[offs++];
282
283			if (!len)
284			break;
285			else if (len < 64)
286			{
287			if (size < len + 1 \|\| offs + len >= MAXSIZE - 1)
288			break;
289
290			memcpy (data, &((*this)[offs]), len);
291
292			data += len; size -= len; offs += len;
293			*data++ = '.'; size--;
294			}
295			else
296			{
297			int offs2 = ((len & 63) << 8) + (*this)[offs++];
298
299			data += decode_label (data, size, offs2);
300			break;
301			}
302			}
303
304			return data - orig;
305			}
306
307	pcg	1.3	/////////////////////////////////////////////////////////////////////////////
308
309			struct dns_req
310			{
311			dns_packet *pkt;
312			tstamp next;
313			int retry;
314	pcg	1.4	connection *conn;
315	pcg	1.5	int seqno;
316	pcg	1.3
317	pcg	1.5	dns_req (connection *c);
318			void gen_stream_req (int seqno, byte_stream *stream);
319	pcg	1.3	};
320
321	pcg	1.5	static u16 dns_id = 12098; // TODO: should be per-vpn
322
323			static u16 next_id ()
324	pcg	1.3	{
325	pcg	1.5	// the simplest lsfr with periodicity 65535 i could find
326			dns_id = (dns_id << 1)
327			\| (((dns_id >> 1)
328			^ (dns_id >> 2)
329			^ (dns_id >> 4)
330			^ (dns_id >> 15)) & 1);
331	pcg	1.3
332	pcg	1.5	return dns_id;
333			}
334	pcg	1.3
335	pcg	1.5	dns_req::dns_req (connection *c)
336	pcg	1.4	: conn (c)
337	pcg	1.3	{
338			next = 0;
339			retry = 0;
340
341			pkt = new dns_packet;
342
343	pcg	1.5	pkt->id = next_id ();
344			}
345
346			void dns_req::gen_stream_req (int seqno, byte_stream *stream)
347			{
348			this->seqno = seqno;
349
350			pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
351	pcg	1.4	pkt->qdcount = htons (1);
352	pcg	1.3
353	pcg	1.4	int offs = 6*2;
354	pcg	1.5	int dlen = MAX_DOMAIN_SIZE - strlen (THISNODE->domain) - 2;
355			// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
356			// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra
357
358			u8 data[256]; //TODO
359	pcg	1.4
360	pcg	1.5	data[0] = THISNODE->id; //TODO
361			data[1] = seqno >> 8; //TODO
362			data[2] = seqno; //TODO
363	pcg	1.4
364	pcg	1.5	int datalen = dns64::decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE) - 3;
365	pcg	1.4
366	pcg	1.5	if (datalen > stream->size ())
367			datalen = stream->size ();
368	pcg	1.4
369	pcg	1.5	char enc[256], *encp = enc;
370
371			memcpy (data + 3, stream->begin (), datalen);
372			int enclen = dns64::encode (enc, data, datalen + 3);
373			stream->remove (datalen);
374	pcg	1.4
375	pcg	1.5	while (enclen)
376			{
377			int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;
378
379			(*pkt)[offs++] = lbllen;
380			memcpy (pkt->at (offs), encp, lbllen);
381	pcg	1.4
382	pcg	1.5	offs += lbllen;
383			encp += lbllen;
384	pcg	1.4
385	pcg	1.5	enclen -= lbllen;
386	pcg	1.4	}
387
388			const char *suffix = THISNODE->domain;
389	pcg	1.3
390	pcg	1.4	// add tunnel domain
391			for (;;)
392			{
393			const char *end = strchr (suffix, '.');
394
395			if (!end)
396			end = suffix + strlen (suffix);
397
398			int len = end - suffix;
399
400			(*pkt)[offs++] = len;
401			memcpy (&((*pkt)[offs]), suffix, len);
402			offs += len;
403
404			if (!*end)
405			break;
406
407			suffix = end + 1;
408			}
409
410			(*pkt)[offs++] = 0;
411			(pkt)[offs++] = RR_TYPE_ANY >> 8; (pkt)[offs++] = RR_TYPE_ANY;
412			(pkt)[offs++] = RR_CLASS_IN >> 8; (pkt)[offs++] = RR_CLASS_IN;
413
414			pkt->len = offs;
415	pcg	1.5	}
416
417			struct dns_rcv
418			{
419			int seqno;
420			dns_packet *pkt; // reply packet
421			u8 data [MAXSIZE]; // actually part of the reply packet...
422			int datalen;
423
424			dns_rcv (int seqno, dns_packet req, u8 data, int datalen);
425			~dns_rcv ();
426			};
427
428			dns_rcv::dns_rcv (int seqno, dns_packet req, u8 data, int datalen)
429			: seqno (seqno), pkt (new dns_packet), datalen (datalen)
430			{
431			memcpy (this->data, data, datalen);
432			pkt->len = req->len;
433			memcpy (pkt->at (0), req->at (0), req->len);
434			}
435	pcg	1.4
436	pcg	1.5	dns_rcv::~dns_rcv ()
437			{
438			delete pkt;
439	pcg	1.3	}
440
441			/////////////////////////////////////////////////////////////////////////////
442
443	pcg	1.2	struct dns_cfg
444			{
445			u8 id1, id2, id3;
446			u8 def_ttl;
447			u8 unused1;
448			u16 max_size;
449			u8 flags1, flags2;
450			};
451
452	pcg	1.5	void connection::dnsv4_receive_rep (struct dns_rcv *r)
453			{
454			dns_rcvpq.push_back (r);
455
456			redo:
457
458			for (vector<dns_rcv *>::iterator i = dns_rcvpq.begin ();
459			i != dns_rcvpq.end ();
460			++i)
461			if (dns_rcvseq == (*i)->seqno)
462			{
463			dns_rcv r = i;
464
465			dns_rcvseq = (dns_rcvseq + 1) & SEQNO_MASK;
466
467			if (!dns_snddq && !dns_rcvdq)
468			{
469			dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
470			dns_snddq = new byte_stream (MAX_BACKLOG);
471
472			dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
473			}
474
475			if (!dns_rcvdq->put (r->data, r->datalen))
476			abort (); // MUST never overflow, can be caused by data corruption, TODO
477
478			while (vpn_packet *pkt = dns_rcvdq->get ())
479			{
480			sockinfo si;
481			si.host = 0; si.port = 0; si.prot = PROT_DNSv4;
482
483			vpn->recv_vpn_packet (pkt, si);
484			}
485			}
486			else if ((u32)dns_rcvseq - MAX_WINDOW - (u32)(i)->seqno < MAX_WINDOW 2)
487			{
488			dns_rcvpq.erase (i);
489			goto redo;
490			}
491			}
492
493	pcg	1.4	dns_packet *
494			vpn::dnsv4_server (dns_packet *pkt)
495	pcg	1.2	{
496	pcg	1.4	u16 flags = ntohs (pkt->flags);
497	pcg	1.2
498	pcg	1.4	//memcpy (&((rep)[0]), &((pkt)[0]), pkt->len);
499			int offs = 6 * 2; // skip header
500	pcg	1.2
501	pcg	1.4	pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_FORMERR);
502	pcg	1.2
503	pcg	1.4	if (!(flags & (FLAG_RESPONSE \| FLAG_OP_MASK \| FLAG_TC))
504			&& pkt->qdcount == htons (1))
505			{
506			char qname[MAXSIZE];
507			int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);
508
509			u16 qtype = (pkt) [offs++] << 8; qtype \|= (pkt) [offs++];
510			u16 qclass = (pkt) [offs++] << 8; qclass \|= (pkt) [offs++];
511	pcg	1.2
512	pcg	1.4	pkt->qdcount = htons (1);
513			pkt->ancount = 0;
514			pkt->nscount = 0; // should be self, as other nameservers reply like this
515			pkt->arcount = 0; // a record for self, as other nameservers reply like this
516	pcg	1.2
517	pcg	1.4	pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_NXDOMAIN);
518	pcg	1.2
519	pcg	1.4	int dlen = strlen (THISNODE->domain);
520	pcg	1.2
521	pcg	1.4	if (qclass == RR_CLASS_IN
522			&& (qtype == RR_TYPE_ANY \|\| qtype == RR_TYPE_TXT)
523			&& qlen > dlen + 1
524			&& !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen))
525	pcg	1.2	{
526	pcg	1.5	// correct class, domain: parse
527	pcg	1.4	u8 data[MAXSIZE];
528			int datalen = dns64::decode (data, qname, qlen - dlen - 1);
529	pcg	1.2
530	pcg	1.5	int client = data[0];
531			int seqno = ((data[1] << 8) \| data[2]) & SEQNO_MASK;
532	pcg	1.2
533	pcg	1.5	if (0 < client && client <= conns.size ())
534			{
535			connection *c = conns [client - 1];
536
537			for (vector<dns_rcv *>::iterator i = c->dns_rcvpq.begin ();
538			i != c->dns_rcvpq.end ();
539			++i)
540			if ((*i)->seqno == seqno)
541			{
542			// already seen that request, just reply with the original reply
543			dns_rcv r = i;
544	pcg	1.4
545	pcg	1.5	offs = r->pkt->len;
546			memcpy (pkt->at (0), r->pkt->at (0), offs);
547			goto duplicate_request;
548			}
549	pcg	1.4
550	pcg	1.5	// new packet, queue
551			c->dnsv4_receive_rep (new dns_rcv (seqno, pkt, data + 3, datalen - 3));
552	pcg	1.4
553	pcg	1.5	// now generate reply
554			pkt->ancount = htons (1); // one answer RR
555			pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_OK);
556	pcg	1.4
557	pcg	1.5	(*pkt) [offs++] = 0xc0;
558			(pkt) [offs++] = 6 2; // same as in query section
559	pcg	1.4
560	pcg	1.5	(pkt) [offs++] = RR_TYPE_TXT >> 8; (pkt) [offs++] = RR_TYPE_TXT;
561			(pkt) [offs++] = RR_CLASS_IN >> 8; (pkt) [offs++] = RR_CLASS_IN;
562	pcg	1.2
563	pcg	1.5	(pkt) [offs++] = 0; (pkt) [offs++] = 0;
564			(pkt) [offs++] = 0; (pkt) [offs++] = 0; // TTL
565	pcg	1.2
566	pcg	1.5	int dlen = MAX_PKT_SIZE - offs - 2;
567	pcg	1.2
568	pcg	1.5	// bind doesn't compress well, so reduce further by one label length
569			dlen -= qlen;
570	pcg	1.2
571	pcg	1.5	int rdlen_offs = offs += 2;
572	pcg	1.2
573	pcg	1.5	while (c->dns_snddq
574			&& !c->dns_snddq->empty ()
575			&& dlen > 1)
576			{
577			int txtlen = dlen <= 255 ? dlen - 1 : 255;
578	pcg	1.2
579	pcg	1.5	if (txtlen > c->dns_snddq->size ())
580			txtlen = c->dns_snddq->size ();
581	pcg	1.2
582	pcg	1.5	(*pkt)[offs++] = txtlen;
583			memcpy (pkt->at (offs), c->dns_snddq->begin (), txtlen);
584			offs += txtlen;
585			c->dns_snddq->remove (txtlen);
586	pcg	1.2
587	pcg	1.5	dlen -= txtlen + 1;
588			}
589	pcg	1.2
590	pcg	1.5	// avoid empty TXT rdata
591			if (offs == rdlen_offs)
592			(*pkt)[offs++] = 0;
593	pcg	1.2
594	pcg	1.5	int rdlen = offs - rdlen_offs;
595	pcg	1.2
596	pcg	1.5	(*pkt) [rdlen_offs - 2] = rdlen >> 8;
597			(*pkt) [rdlen_offs - 1] = rdlen;
598	pcg	1.4
599	pcg	1.5	duplicate_request: ;
600			}
601			else
602			pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_FORMERR);
603	pcg	1.2	}
604	pcg	1.4	}
605	pcg	1.5	else
606			offs = pkt->len;
607	pcg	1.4
608			pkt->len = offs;
609			return pkt;
610			}
611
612			void
613			vpn::dnsv4_client (dns_packet *pkt)
614			{
615			u16 flags = ntohs (pkt->flags);
616			int offs = 6 * 2; // skip header
617
618			pkt->qdcount = ntohs (pkt->qdcount);
619			pkt->ancount = ntohs (pkt->ancount);
620
621	pcg	1.5	// go through our request list and find the corresponding request
622	pcg	1.4	for (vector<dns_req *>::iterator i = dns_sndpq.begin ();
623			i != dns_sndpq.end ();
624			++i)
625			if ((*i)->pkt->id == pkt->id)
626			{
627			connection c = (i)->conn;
628	pcg	1.5	int seqno = (*i)->seqno;
629			u8 data[MAXSIZE], *datap = data;
630
631	pcg	1.4	delete *i;
632			dns_sndpq.erase (i);
633
634			if (flags & (FLAG_RESPONSE \| FLAG_OP_MASK \| FLAG_TC))
635			{
636			char qname[MAXSIZE];
637
638			while (pkt->qdcount-- && offs < MAXSIZE - 4)
639			{
640			int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);
641			offs += 4; // skip qtype, qclass
642			}
643
644			while (pkt->ancount-- && offs < MAXSIZE - 10)
645			{
646			pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);
647
648			u16 qtype = (pkt) [offs++] << 8; qtype \|= (pkt) [offs++];
649			u16 qclass = (pkt) [offs++] << 8; qclass \|= (pkt) [offs++];
650			u32 ttl = (*pkt) [offs++] << 24;
651			ttl \|= (*pkt) [offs++] << 16;
652			ttl \|= (*pkt) [offs++] << 8;
653			ttl \|= (*pkt) [offs++];
654
655			u16 rdlen = (pkt) [offs++] << 8; rdlen \|= (pkt) [offs++];
656
657	pcg	1.5	if (rdlen <= MAXSIZE - offs)
658			{
659			// decode bytes, finally
660
661			while (rdlen)
662			{
663			int txtlen = (*pkt) [offs++];
664
665			assert (txtlen + offs < MAXSIZE - 1);
666
667			memcpy (datap, pkt->at (offs), txtlen);
668			datap += txtlen; offs += txtlen;
669	pcg	1.4
670	pcg	1.5	rdlen -= txtlen + 1;
671			}
672	pcg	1.4
673			}
674	pcg	1.5
675	pcg	1.4	}
676			}
677
678	pcg	1.5	if (datap != data)
679			printf ("%02x %02x %02x %02x\n",
680			data[0],
681			data[1],
682			data[2],
683			data[3]);
684
685			printf ("recv %d,%d\n", pkt->id, seqno, datap - data);//D
686			c->dnsv4_receive_rep (new dns_rcv (seqno, pkt, data, datap - data));
687
688	pcg	1.4	break;
689			}
690	pcg	1.5
691			delete pkt;
692	pcg	1.4	}
693
694			void
695			vpn::dnsv4_ev (io_watcher &w, short revents)
696			{
697			if (revents & EVENT_READ)
698			{
699			dns_packet *pkt = new dns_packet;
700			struct sockaddr_in sa;
701			socklen_t sa_len = sizeof (sa);
702
703			pkt->len = recvfrom (w.fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);
704
705			if (pkt->len > 0)
706	pcg	1.5	{
707			if (pkt->flags & htons (FLAG_TC))
708			{
709			slog (L_WARN, _("DNS request/response truncated, check protocol settings."));
710			//TODO connection reset
711			}
712
713			if (THISNODE->dns_port)
714			{
715			pkt = dnsv4_server (pkt);
716			sendto (w.fd, &((pkt)[0]), pkt->len, 0, (sockaddr )&sa, sa_len);
717			}
718			else
719			dnsv4_client (pkt);
720			}
721	pcg	1.1	}
722			}
723
724			bool
725	pcg	1.3	connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
726			{
727	pcg	1.4	// never initialized
728			if (!dns_snddq && !dns_rcvdq)
729			{
730			dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
731			dns_snddq = new byte_stream (MAX_BACKLOG);
732
733	pcg	1.5	//dns_rcvseq = dns_sndseq = 0;
734	pcg	1.4
735			dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
736			}
737
738			if (!dns_snddq->put (pkt))
739	pcg	1.3	return false;
740
741	pcg	1.4	// start timer if neccessary
742	pcg	1.5	if (!THISNODE->dns_port && !dnsv4_tw.active)
743	pcg	1.4	dnsv4_cb (dnsv4_tw);
744	pcg	1.3
745			return true;
746			}
747
748			void
749			connection::dnsv4_cb (time_watcher &w)
750	pcg	1.1	{
751	pcg	1.3	// check for timeouts and (re)transmit
752			tstamp next = NOW + 60;
753	pcg	1.4	dns_req *send = 0;
754	pcg	1.3
755	pcg	1.4	for (vector<dns_req *>::iterator i = vpn->dns_sndpq.begin ();
756			i != vpn->dns_sndpq.end ();
757	pcg	1.3	++i)
758			{
759			dns_req r = i;
760
761			if (r->next <= NOW)
762			{
763	pcg	1.4	if (!send)
764			{
765			send = r;
766
767	pcg	1.5	if (r->retry)//D
768			printf ("req %d, retry %d\n", r->pkt->id, r->retry);
769	pcg	1.4	r->retry++;
770			r->next = NOW + r->retry;
771			}
772	pcg	1.3	}
773
774			if (r->next < next)
775			next = r->next;
776			}
777
778	pcg	1.4	if (!send
779			&& vpn->dns_sndpq.size () < MAX_OUTSTANDING)
780	pcg	1.5	{
781			send = new dns_req (this);
782			send->gen_stream_req (dns_sndseq, dns_snddq);
783			vpn->dns_sndpq.push_back (send);
784
785			dns_sndseq = (dns_sndseq + 1) & SEQNO_MASK;
786			}
787	pcg	1.4
788			tstamp min_next = NOW + (1. / (tstamp)MAX_RATE);
789
790			if (send)
791			{
792			dns_packet *pkt = send->pkt;
793
794			next = min_next;
795
796			sendto (vpn->dnsv4_fd, &((*pkt)[0]), pkt->len, 0, dns_si.sav4 (), dns_si.salenv4 ());
797			}
798			else if (next < min_next)
799			next = min_next;
800
801	pcg	1.3	w.start (next);
802	pcg	1.1	}
803
804			#endif
805