ViewVC Help

View File | Revision Log | Show Annotations | Download File

/cvs/gvpe/src/vpn_dns.C

Comparing gvpe/src/vpn_dns.C (file contents):
Revision 1.5 by pcg, Thu Mar 3 07:24:57 2005 UTC vs.
Revision 1.48 by pcg, Tue Jul 28 00:42:14 2009 UTC

1	/*	1	/*
2	vpn_dns.C -- handle the dns tunnel part of the protocol.	2	vpn_dns.C -- handle the dns tunnel part of the protocol.
3	Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>	3	Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4		4
		5	This file is part of GVPE.
		6
5	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
6	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
7	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
8	(at your option) any later version.	10	option) any later version.
9		11
10	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
11	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
12	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13	GNU General Public License for more details.	15	Public License for more details.
14		16
15	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
16	along with this program; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
17	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
18	*/	30	*/
		31
		32	// TODO: EDNS0 option to increase dns mtu?
		33	// TODO: re-write dns packet parsing/creation using a safe mem-buffer
		34	// to ensure no buffer overflows or similar problems.
19		35
20	#include "config.h"	36	#include "config.h"
21		37
22	#if ENABLE_DNS	38	#if ENABLE_DNS
23		39
24	// dns processing is EXTREMELY ugly. For obvious(?) reasons.	40	// dns processing is EXTREMELY ugly. For obvious(?) reasons.
25	// it's a hack, use only in emergency situations please.	41	// it's a hack, use only in emergency situations please.
26		42
27	#include <cstring>	43	#include <cstring>
		44	#include <cassert>
28		45
29	#include <sys/types.h>	46	#include <sys/types.h>
30	#include <sys/socket.h>	47	#include <sys/socket.h>
31	#include <sys/wait.h>	48	#include <sys/wait.h>
32	#include <sys/uio.h>	49	#include <sys/uio.h>
…		…
35	#include <unistd.h>	52	#include <unistd.h>
36	#include <fcntl.h>	53	#include <fcntl.h>
37		54
38	#include <map>	55	#include <map>
39		56
		57	#include <cstdio> /* bug in libgmp: gmp.h relies on cstdio being included */
		58	#include <gmp.h>
		59
40	#include "netcompat.h"	60	#include "netcompat.h"
41		61
42	#include "vpn.h"	62	#include "vpn.h"
43		63
44	#define MIN_RETRY 1.	64	#define MAX_POLL_INTERVAL 5. // how often to poll minimally when the server has no data
45	#define MAX_RETRY 60.	65	#define ACTIVITY_INTERVAL 5.
46		66
47	#define MAX_OUTSTANDING 40 // max. outstanding requests	67	#define INITIAL_TIMEOUT 0.1 // retry timeouts
		68	#define INITIAL_SYN_TIMEOUT 2. // retry timeout for initial syn
		69
		70	#define MAX_SEND_INTERVAL 2. // optimistic?
		71
48	#define MAX_WINDOW 100 // max. for MAX_OUTSTANDING	72	#define MAX_WINDOW 1000 // max. for MAX_OUTSTANDING, and backlog
49	#define MAX_RATE 1000 // requests/s
50	#define MAX_BACKLOG (10*1024) // size of protocol backlog, must be > MAXSIZE	73	#define MAX_BACKLOG (64*1024) // size of gvpe protocol backlog (bytes), must be > MAXSIZE
51		74
52	#define MAX_DOMAIN_SIZE 220 // 255 is legal limit, but bind doesn't compress well	75	#define MAX_DOMAIN_SIZE 240 // 255 is legal limit, but bind doesn't compress well
53	// 240 leaves about 4 bytes of server reply data	76	// 240 leaves about 4 bytes of server reply data
54	// every two request byte sless give room for one reply byte	77	// every request byte less give room for two reply bytes
55		78
56	#define SEQNO_MASK 0xffff	79	#define SEQNO_MASK 0x3fff
57		80	#define SEQNO_EQ(a,b) ( 0 == ( ((a) ^ (b)) & SEQNO_MASK) )
58	/*
59
60	protocol, in shorthand :)
61
62	client -> server <req> ANY?
63	server -> client <req> TXT <rep>
64
65	<req> is dns64-encoded <client-id:12><recv-seqno:10>[<send-seqno:10><data>]
66	<rep> is dns64-encoded <0:12><recv-seqno:10>[<send-seqno:10><data>]
67
68	if <client-id> is zero, the connection will be configured:
69
70	<0:12><0:4>client-id:12><default-ttl:8><max-size:16><flags:16>
71
72	*/
73		81
74	#define MAX_LBL_SIZE 63	82	#define MAX_LBL_SIZE 63
75	#define MAX_PKT_SIZE 512	83	#define MAX_PKT_SIZE 512
76		84
		85	#define RR_TYPE_A 1
		86	#define RR_TYPE_NULL 10
77	#define RR_TYPE_TXT 16	87	#define RR_TYPE_TXT 16
		88	#define RR_TYPE_AAAA 28
78	#define RR_TYPE_ANY 255	89	#define RR_TYPE_ANY 255
		90
79	#define RR_CLASS_IN 1	91	#define RR_CLASS_IN 1
80		92
81	// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative)	93	#define CMD_IP_1 207
82	struct dns64	94	#define CMD_IP_2 46
83	{	95	#define CMD_IP_3 236
84	static const char encode_chars[64 + 1];	96	#define CMD_IP_RST 29
85	static s8 decode_chars[256];	97	#define CMD_IP_SYN 113
		98	#define CMD_IP_REJ 32
86		99
87	static int encode_len (int bytes) { return (bytes * 8 + 5) / 6; }	100	// works for cmaps up to 255 (not 256!)
88	static int decode_len (int bytes) { return (bytes * 6) / 8; }	101	struct charmap
		102	{
		103	enum { INVALID = (u8)255 };
		104
		105	char encode [256]; // index => char
		106	u8 decode [256]; // char => index
		107	unsigned int size;
		108
		109	charmap (const char *cmap);
		110	};
		111
		112	charmap::charmap (const char *cmap)
		113	{
		114	char *enc = encode;
		115	u8 *dec = decode;
		116
		117	memset (enc, (char) 0, 256);
		118	memset (dec, (char)INVALID, 256);
		119
		120	for (size = 0; cmap [size]; size++)
		121	{
		122	enc [size] = cmap [size];
		123	dec [(u8)enc [size]] = size;
		124	}
		125
		126	assert (size < 256);
		127	}
		128
		129	#define MAX_DEC_LEN 500
		130	#define MAX_ENC_LEN (MAX_DEC_LEN * 2)
		131	#define MAX_LIMBS ((MAX_DEC_LEN * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
		132
		133	// ugly. minimum base is 16(!)
		134	struct basecoder
		135	{
		136	charmap cmap;
		137	unsigned int enc_len [MAX_DEC_LEN];
		138	unsigned int dec_len [MAX_ENC_LEN];
		139
		140	unsigned int encode_len (unsigned int len);
		141	unsigned int decode_len (unsigned int len);
		142
89	static int encode (char *dst, u8 *src, int len);	143	unsigned int encode (char *dst, u8 *src, unsigned int len);
90	static int decode (u8 *dst, char *src, int len);	144	unsigned int decode (u8 *dst, char *src, unsigned int len);
91		145
92	dns64 ();	146	basecoder (const char *cmap);
93	} dns64;	147	};
94		148
95	const char dns64::encode_chars[64 + 1] = "_4B9dLphHzrqQmGjkTbJt5svlZX8xSaReEYfwKgF1DP2W6NyVOU70IouACcMn3i-";	149	basecoder::basecoder (const char *cmap)
96	s8 dns64::decode_chars[256];	150	: cmap (cmap)
97
98	dns64::dns64 ()
99	{	151	{
100	for (int i = 0; i < 64; i++)	152	for (unsigned int len = 0; len < MAX_DEC_LEN; ++len)
101	decode_chars [encode_chars [i]] = i + 1;	153	{
102	}	154	u8 src [MAX_DEC_LEN];
		155	u8 dst [MAX_ENC_LEN];
103		156
104	int dns64::encode (char *dst, u8 *src, int len)	157	memset (src, 255, len);
		158
		159	mp_limb_t m [MAX_LIMBS];
		160	mp_size_t n;
		161
		162	n = mpn_set_str (m, src, len, 256);
		163	n = mpn_get_str (dst, this->cmap.size, m, n);
		164
		165	for (int i = 0; !dst [i]; ++i)
		166	n--;
		167
		168	enc_len [len] = n;
		169	dec_len [n] = len;
		170	}
		171	}
		172
		173	unsigned int basecoder::encode_len (unsigned int len)
105	{	174	{
106	// slow, but easy to debug	175	return enc_len [len];
107	char *beg = dst;	176	}
108	unsigned int accum, bits = 0;	177
		178	unsigned int basecoder::decode_len (unsigned int len)
		179	{
		180	while (len && !dec_len [len])
		181	--len;
		182
		183	return dec_len [len];
		184	}
		185
		186	unsigned int basecoder::encode (char *dst, u8 *src, unsigned int len)
		187	{
		188	if (!len || len > MAX_DEC_LEN)
		189	return 0;
		190
		191	int elen = encode_len (len);
		192
		193	mp_limb_t m [MAX_LIMBS];
		194	mp_size_t n;
		195
		196	u8 dst_ [MAX_ENC_LEN];
		197
		198	n = mpn_set_str (m, src, len, 256);
		199	n = mpn_get_str (dst_, cmap.size, m, n);
		200
		201	int plen = elen; // for padding
		202
		203	while (n < plen)
		204	{
		205	*dst++ = cmap.encode [0];
		206	plen--;
		207	}
		208
		209	for (unsigned int i = n - plen; i < n; ++i)
		210	*dst++ = cmap.encode [dst_ [i]];
		211
		212	return elen;
		213	}
		214
		215	unsigned int basecoder::decode (u8 *dst, char *src, unsigned int len)
		216	{
		217	if (!len || len > MAX_ENC_LEN)
		218	return 0;
		219
		220	u8 src_ [MAX_ENC_LEN];
		221	unsigned int elen = 0;
109		222
110	while (len--)	223	while (len--)
111	{	224	{
112	accum <<= 8;	225	u8 val = cmap.decode [(u8)*src++];
113	accum |= *src++;
114	bits += 8;
115		226
116	while (bits >= 6)	227	if (val != charmap::INVALID)
117	{	228	src_ [elen++] = val;
118	*dst++ = encode_chars [(accum >> (bits - 6)) & 63];	229	}
119	bits -= 6;	230
120	}	231	int dlen = decode_len (elen);
		232
		233	mp_limb_t m [MAX_LIMBS];
		234	mp_size_t n;
		235
		236	u8 dst_ [MAX_DEC_LEN];
		237
		238	n = mpn_set_str (m, src_, elen, cmap.size);
		239	n = mpn_get_str (dst_, 256, m, n);
		240
		241	if (n < dlen)
121	}	242	{
		243	memset (dst, 0, dlen - n);
		244	memcpy (dst + dlen - n, dst_, n);
		245	}
		246	else
		247	memcpy (dst, dst_ + n - dlen, dlen);
122		248
123	if (bits)	249	return dlen;
124	*dst++ = encode_chars [(accum << (6 - bits)) & 63];
125
126	return dst - beg;
127	}	250	}
128		251
129	int dns64::decode (u8 *dst, char *src, int len)	252	#if 0
130	{	253	struct test { test (); } test;
131	// slow, but easy to debug
132	u8 *beg = dst;
133	unsigned int accum, bits = 0;
134		254
135	while (len--)	255	test::test ()
		256	{
		257	basecoder cdc ("0123456789abcdefghijklmnopqrstuvwxyz");
		258
		259	u8 in[] = "0123456789abcdefghijklmnopqrstuvwxyz";
		260	static char enc[200];
		261	static u8 dec[200];
		262
		263	for (int i = 1; i < 20; i++)
136	{	264	{
137	s8 chr = decode_chars [(u8)*src++];	265	int elen = cdc.encode (enc, in, i);
		266	int dlen = cdc.decode (dec, enc, elen);
138		267
139	if (!chr)	268	printf ("%d>%d>%d (%s>%s)\n", i, elen, dlen, enc, dec);
140	continue;
141
142	accum <<= 6;
143	accum |= chr - 1;
144	bits += 6;
145
146	while (bits >= 8)
147	{
148	*dst++ = accum >> (bits - 8);
149	bits -= 8;
150	}
151	}	269	}
		270	abort ();
		271	}
		272	#endif
152		273
153	return dst - beg;	274	//static basecoder cdc64 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI-");
		275	//static basecoder cdc63 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
		276	static basecoder cdc62 ("dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
		277	//static basecoder cdc36 ("dphzr06qmjkb34tsvl81xaef92wgyo57ucni"); // unused as of yet
		278	static basecoder cdc26 ("dPhZrQmJkBtSvLxAeFwGyO");
		279
		280	/////////////////////////////////////////////////////////////////////////////
		281
		282	#define HDRSIZE 6
		283
		284	inline void encode_header (char *data, int clientid, int seqno, int retry = 0)
		285	{
		286	seqno &= SEQNO_MASK;
		287
		288	u8 hdr[3] = {
		289	clientid,
		290	(seqno >> 8) | (retry << 6),
		291	seqno,
		292	};
		293
		294	assert (clientid < 256);
		295
		296	cdc26.encode (data, hdr, 3);
		297	}
		298
		299	inline void decode_header (char *data, int &clientid, int &seqno)
		300	{
		301	u8 hdr[3];
		302
		303	cdc26.decode (hdr, data, HDRSIZE);
		304
		305	clientid = hdr[0];
		306	seqno = ((hdr[1] << 8) | hdr[2]) & SEQNO_MASK;
154	}	307	}
155		308
156	/////////////////////////////////////////////////////////////////////////////	309	/////////////////////////////////////////////////////////////////////////////
157		310
158	struct byte_stream	311	struct byte_stream
…		…
187	}	340	}
188		341
189	void byte_stream::remove (int count)	342	void byte_stream::remove (int count)
190	{	343	{
191	if (count > fill)	344	if (count > fill)
192	abort ();	345	assert (count <= fill);
193		346
194	memmove (data, data + count, fill -= count);	347	memmove (data, data + count, fill -= count);
195	}	348	}
196		349
197	bool byte_stream::put (u8 *data, unsigned int datalen)	350	bool byte_stream::put (u8 *data, unsigned int datalen)
…		…
210	return false;	363	return false;
211		364
212	data [fill++] = pkt->len >> 8;	365	data [fill++] = pkt->len >> 8;
213	data [fill++] = pkt->len;	366	data [fill++] = pkt->len;
214		367
215	memcpy (data + fill, &((*pkt)[0]), pkt->len); fill += pkt->len;	368	memcpy (data + fill, pkt->at (0), pkt->len); fill += pkt->len;
216		369
217	return true;	370	return true;
218	}	371	}
219		372
220	vpn_packet *byte_stream::get ()	373	vpn_packet *byte_stream::get ()
221	{	374	{
		375	unsigned int len;
		376
		377	for (;;)
		378	{
222	int len = (data [0] << 8) | data [1];	379	len = (data [0] << 8) | data [1];
223		380
224	printf ("get len %d, fill %d\n", len, fill);//D
225
226	if (len > MAXSIZE && fill >= 2)	381	if (len <= MAXSIZE || fill < 2)
227	abort (); // TODO handle this gracefully, connection reset	382	break;
228		383
		384	// TODO: handle this better than skipping, e.g. by reset
		385	slog (L_DEBUG, _("DNS: corrupted packet stream skipping a byte..."));
		386	remove (1);
		387	}
		388
229	if (fill < len + 2)	389	if (fill < len + 2)
230	return 0;	390	return 0;
231		391
232	vpn_packet *pkt = new vpn_packet;	392	vpn_packet *pkt = new vpn_packet;
233		393
234	pkt->len = len;	394	pkt->len = len;
235	memcpy (&((*pkt)[0]), data + 2, len);	395	memcpy (pkt->at (0), data + 2, len);
236	remove (len + 2);	396	remove (len + 2);
237		397
238	return pkt;	398	return pkt;
239	}	399	}
240		400
241	/////////////////////////////////////////////////////////////////////////////	401	/////////////////////////////////////////////////////////////////////////////
242		402
243	#define FLAG_QUERY ( 0 << 15)	403	#define FLAG_QUERY ( 0 << 15)
244	#define FLAG_RESPONSE ( 1 << 15)	404	#define FLAG_RESPONSE ( 1 << 15)
245	#define FLAG_OP_MASK (15 << 14)	405	#define FLAG_OP_MASK (15 << 11)
246	#define FLAG_OP_QUERY ( 0 << 11)	406	#define FLAG_OP_QUERY ( 0 << 11)
247	#define FLAG_AA ( 1 << 10)	407	#define FLAG_AA ( 1 << 10)
248	#define FLAG_TC ( 1 << 9)	408	#define FLAG_TC ( 1 << 9)
249	#define FLAG_RD ( 1 << 8)	409	#define FLAG_RD ( 1 << 8)
250	#define FLAG_RA ( 1 << 7)	410	#define FLAG_RA ( 1 << 7)
…		…
257	#define FLAG_RCODE_REFUSED ( 5 << 0)	417	#define FLAG_RCODE_REFUSED ( 5 << 0)
258		418
259	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)	419	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)
260	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)	420	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)
261		421
		422	struct dns_cfg
		423	{
		424	static int next_uid;
		425
		426	u8 id1, id2, id3, id4;
		427
		428	u8 version;
		429	u8 flags;
		430	u8 rrtype;
		431	u8 def_ttl;
		432
		433	u16 client;
		434	u16 uid; // to make request unique
		435
		436	u16 max_size;
		437	u8 seq_cdc;
		438	u8 req_cdc;
		439
		440	u8 rep_cdc;
		441	u8 delay; // time in 0.01s units that the server may delay replying packets
		442	u8 r3, r4;
		443
		444	u8 r5, r6, r7, r8;
		445
		446	void reset (int clientid);
		447	bool valid ();
		448	};
		449
		450	int dns_cfg::next_uid;
		451
		452	void dns_cfg::reset (int clientid)
		453	{
		454	id1 = 'G';
		455	id2 = 'V';
		456	id3 = 'P';
		457	id4 = 'E';
		458
		459	version = 1;
		460
		461	rrtype = RR_TYPE_TXT;
		462	flags = 0;
		463	def_ttl = 0;
		464	seq_cdc = 26;
		465	req_cdc = 62;
		466	rep_cdc = 0;
		467	max_size = htons (MAX_PKT_SIZE);
		468	client = htons (clientid);
		469	uid = next_uid++;
		470	delay = 0;
		471
		472	r3 = r4 = 0;
		473	r4 = r5 = r6 = r7 = 0;
		474	}
		475
		476	bool dns_cfg::valid ()
		477	{
		478	// although the protocol itself allows for some configurability,
		479	// only the following encoding/decoding settings are implemented.
		480	return id1 == 'G'
		481	&& id2 == 'V'
		482	&& id3 == 'P'
		483	&& id4 == 'E'
		484	&& seq_cdc == 26
		485	&& req_cdc == 62
		486	&& rep_cdc == 0
		487	&& version == 1;
		488	}
		489
262	struct dns_packet : net_packet	490	struct dns_packet : net_packet
263	{	491	{
264	u16 id;	492	u16 id;
265	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4	493	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
266	u16 qdcount, ancount, nscount, arcount;	494	u16 qdcount, ancount, nscount, arcount;
267		495
268	u8 data[MAXSIZE - 6 * 2];	496	u8 data [MAXSIZE - 6 * 2];
269		497
270	int decode_label (char *data, int size, int &offs);	498	int decode_label (char *data, int size, int &offs);
271	};	499	};
272		500
273	int dns_packet::decode_label (char *data, int size, int &offs)	501	int dns_packet::decode_label (char *data, int size, int &offs)
…		…
304	return data - orig;	532	return data - orig;
305	}	533	}
306		534
307	/////////////////////////////////////////////////////////////////////////////	535	/////////////////////////////////////////////////////////////////////////////
308		536
309	struct dns_req
310	{
311	dns_packet *pkt;
312	tstamp next;
313	int retry;
314	connection *conn;
315	int seqno;
316
317	dns_req (connection *c);
318	void gen_stream_req (int seqno, byte_stream *stream);
319	};
320
321	static u16 dns_id = 12098; // TODO: should be per-vpn	537	static u16 dns_id = 0; // TODO: should be per-vpn
322		538
323	static u16 next_id ()	539	static u16 next_id ()
324	{	540	{
		541	if (!dns_id)
		542	dns_id = time (0);
		543
325	// the simplest lsfr with periodicity 65535 i could find	544	// the simplest lsfr with periodicity 65535 i could find
326	dns_id = (dns_id << 1)	545	dns_id = (dns_id << 1)
327	| (((dns_id >> 1)	546	| (((dns_id >> 1)
328	^ (dns_id >> 2)	547	^ (dns_id >> 2)
329	^ (dns_id >> 4)	548	^ (dns_id >> 4)
330	^ (dns_id >> 15)) & 1);	549	^ (dns_id >> 15)) & 1);
331		550
332	return dns_id;	551	return dns_id;
333	}	552	}
334		553
335	dns_req::dns_req (connection *c)	554	struct dns_rcv;
336	: conn (c)	555	struct dns_snd;
		556
		557	struct dns_connection
337	{	558	{
338	next = 0;	559	connection *c;
		560	struct vpn *vpn;
		561
		562	dns_cfg cfg;
		563
		564	bool established;
		565
		566	tstamp last_received;
		567	tstamp last_sent;
		568	double min_latency;
		569	double poll_interval, send_interval;
		570
		571	vector<dns_rcv *> rcvpq;
		572
		573	byte_stream rcvdq; int rcvseq; int repseq;
		574	byte_stream snddq; int sndseq;
		575
		576	inline void time_cb (ev::timer &w, int revents); ev::timer tw;
		577	void receive_rep (dns_rcv *r);
		578
		579	dns_connection (connection *c);
		580	~dns_connection ();
		581	};
		582
		583	struct dns_snd
		584	{
		585	dns_packet *pkt;
		586	tstamp timeout, sent;
		587	int retry;
		588	struct dns_connection *dns;
		589	int seqno;
		590	bool stdhdr;
		591
		592	void gen_stream_req (int seqno, byte_stream &stream);
		593	void gen_syn_req ();
		594
		595	dns_snd (dns_connection *dns);
		596	~dns_snd ();
		597	};
		598
		599	dns_snd::dns_snd (dns_connection *dns)
		600	: dns (dns)
		601	{
		602	timeout = 0;
339	retry = 0;	603	retry = 0;
		604	seqno = 0;
		605	sent = ev_now ();
		606	stdhdr = false;
340		607
341	pkt = new dns_packet;	608	pkt = new dns_packet;
342		609
343	pkt->id = next_id ();	610	pkt->id = next_id ();
344	}	611	}
345		612
		613	dns_snd::~dns_snd ()
		614	{
		615	delete pkt;
		616	}
		617
		618	static void append_domain (dns_packet &pkt, int &offs, const char *domain)
		619	{
		620	// add tunnel domain
		621	for (;;)
		622	{
		623	const char *end = strchr (domain, '.');
		624
		625	if (!end)
		626	end = domain + strlen (domain);
		627
		628	int len = end - domain;
		629
		630	pkt [offs++] = len;
		631	memcpy (pkt.at (offs), domain, len);
		632	offs += len;
		633
		634	if (!*end)
		635	break;
		636
		637	domain = end + 1;
		638	}
		639	}
		640
346	void dns_req::gen_stream_req (int seqno, byte_stream *stream)	641	void dns_snd::gen_stream_req (int seqno, byte_stream &stream)
347	{	642	{
		643	stdhdr = true;
348	this->seqno = seqno;	644	this->seqno = seqno;
		645
		646	timeout = ev_now () + INITIAL_TIMEOUT;
349		647
350	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);	648	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
351	pkt->qdcount = htons (1);	649	pkt->qdcount = htons (1);
352		650
353	int offs = 6*2;	651	int offs = 6*2;
354	int dlen = MAX_DOMAIN_SIZE - strlen (THISNODE->domain) - 2;	652	int dlen = MAX_DOMAIN_SIZE - (strlen (dns->c->conf->domain) + 2);
355	// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,	653	// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
356	// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra	654	// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra
357		655
358	u8 data[256]; //TODO
359
360	data[0] = THISNODE->id; //TODO
361	data[1] = seqno >> 8; //TODO
362	data[2] = seqno; //TODO
363
364	int datalen = dns64::decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE) - 3;
365
366	if (datalen > stream->size ())
367	datalen = stream->size ();
368
369	char enc[256], *encp = enc;	656	char enc[256], *encp = enc;
370		657	encode_header (enc, THISNODE->id, seqno);
371	memcpy (data + 3, stream->begin (), datalen);	658
372	int enclen = dns64::encode (enc, data, datalen + 3);	659	int datalen = cdc62.decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE - HDRSIZE);
		660
		661	if (datalen > stream.size ())
		662	datalen = stream.size ();
		663
		664	int enclen = cdc62.encode (enc + HDRSIZE, stream.begin (), datalen) + HDRSIZE;
373	stream->remove (datalen);	665	stream.remove (datalen);
374		666
375	while (enclen)	667	while (enclen)
376	{	668	{
377	int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;	669	int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;
378		670
…		…
383	encp += lbllen;	675	encp += lbllen;
384		676
385	enclen -= lbllen;	677	enclen -= lbllen;
386	}	678	}
387		679
388	const char *suffix = THISNODE->domain;	680	append_domain (*pkt, offs, dns->c->conf->domain);
389
390	// add tunnel domain
391	for (;;)
392	{
393	const char *end = strchr (suffix, '.');
394
395	if (!end)
396	end = suffix + strlen (suffix);
397
398	int len = end - suffix;
399
400	(*pkt)[offs++] = len;
401	memcpy (&((*pkt)[offs]), suffix, len);
402	offs += len;
403
404	if (!*end)
405	break;
406
407	suffix = end + 1;
408	}
409		681
410	(*pkt)[offs++] = 0;	682	(*pkt)[offs++] = 0;
411	(*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;	683	(*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;
		684	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
		685
		686	pkt->len = offs;
		687	}
		688
		689	void dns_snd::gen_syn_req ()
		690	{
		691	timeout = ev_now () + INITIAL_SYN_TIMEOUT;
		692
		693	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
		694	pkt->qdcount = htons (1);
		695
		696	int offs = 6 * 2;
		697
		698	int elen = cdc26.encode ((char *)pkt->at (offs + 1), (u8 *)&dns->cfg, sizeof (dns_cfg));
		699
		700	assert (elen <= MAX_LBL_SIZE);
		701
		702	(*pkt)[offs] = elen;
		703	offs += elen + 1;
		704	append_domain (*pkt, offs, dns->c->conf->domain);
		705
		706	(*pkt)[offs++] = 0;
		707	(*pkt)[offs++] = RR_TYPE_A >> 8; (*pkt)[offs++] = RR_TYPE_A;
412	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;	708	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
413		709
414	pkt->len = offs;	710	pkt->len = offs;
415	}	711	}
416		712
…		…
419	int seqno;	715	int seqno;
420	dns_packet *pkt; // reply packet	716	dns_packet *pkt; // reply packet
421	u8 data [MAXSIZE]; // actually part of the reply packet...	717	u8 data [MAXSIZE]; // actually part of the reply packet...
422	int datalen;	718	int datalen;
423		719
424	dns_rcv (int seqno, dns_packet *req, u8 *data, int datalen);	720	dns_rcv (int seqno, u8 *data, int datalen);
425	~dns_rcv ();	721	~dns_rcv ();
426	};	722	};
427		723
428	dns_rcv::dns_rcv (int seqno, dns_packet *req, u8 *data, int datalen)	724	dns_rcv::dns_rcv (int seqno, u8 *data, int datalen)
429	: seqno (seqno), pkt (new dns_packet), datalen (datalen)	725	: seqno (seqno), pkt (new dns_packet), datalen (datalen)
430	{	726	{
431	memcpy (this->data, data, datalen);	727	memcpy (this->data, data, datalen);
432	pkt->len = req->len;
433	memcpy (pkt->at (0), req->at (0), req->len);
434	}	728	}
435		729
436	dns_rcv::~dns_rcv ()	730	dns_rcv::~dns_rcv ()
437	{	731	{
438	delete pkt;	732	delete pkt;
439	}	733	}
440		734
441	/////////////////////////////////////////////////////////////////////////////	735	/////////////////////////////////////////////////////////////////////////////
442		736
443	struct dns_cfg	737	dns_connection::dns_connection (connection *c)
		738	: c (c)
		739	, rcvdq (MAX_BACKLOG * 2)
		740	, snddq (MAX_BACKLOG)
444	{	741	{
445	u8 id1, id2, id3;	742	tw.set<dns_connection, &dns_connection::time_cb> (this);
446	u8 def_ttl;
447	u8 unused1;
448	u16 max_size;
449	u8 flags1, flags2;
450	};
451		743
		744	vpn = c->vpn;
		745
		746	established = false;
		747
		748	rcvseq = repseq = sndseq = 0;
		749
		750	last_sent = last_received = 0;
		751	poll_interval = 0.5; // starting here
		752	send_interval = 0.5; // starting rate
		753	min_latency = INITIAL_TIMEOUT;
		754	}
		755
		756	dns_connection::~dns_connection ()
		757	{
		758	for (vector<dns_rcv *>::iterator i = rcvpq.begin ();
		759	i != rcvpq.end ();
		760	++i)
		761	delete *i;
		762	}
		763
452	void connection::dnsv4_receive_rep (struct dns_rcv *r)	764	void dns_connection::receive_rep (dns_rcv *r)
453	{	765	{
		766	if (r->datalen)
		767	{
		768	last_received = ev_now ();
		769	tw ();
		770
		771	poll_interval = send_interval;
		772	}
		773	else
		774	{
		775	poll_interval *= 1.5;
		776
		777	if (poll_interval > MAX_POLL_INTERVAL)
		778	poll_interval = MAX_POLL_INTERVAL;
		779	}
		780
454	dns_rcvpq.push_back (r);	781	rcvpq.push_back (r);
455		782
456	redo:	783	redo:
457		784
		785	// find next packet
458	for (vector<dns_rcv *>::iterator i = dns_rcvpq.begin ();	786	for (vector<dns_rcv *>::iterator i = rcvpq.end (); i-- != rcvpq.begin (); )
459	i != dns_rcvpq.end ();
460	++i)
461	if (dns_rcvseq == (*i)->seqno)	787	if (SEQNO_EQ (rcvseq, (*i)->seqno))
462	{	788	{
		789	//printf ("seqno eq %x %x\n", rcvseq, (*i)->seqno);//D
		790	// enter the packet into our input stream
463	dns_rcv *r = *i;	791	r = *i;
464		792
		793	// remove the oldest packet, look forward, as it's oldest first
		794	for (vector<dns_rcv *>::iterator j = rcvpq.begin (); j != rcvpq.end (); ++j)
		795	if (SEQNO_EQ ((*j)->seqno, rcvseq - MAX_WINDOW))
		796	{
		797	//printf ("seqno RR %x %x\n", (*j)->seqno, rcvseq - MAX_WINDOW);//D
		798	delete *j;
		799	rcvpq.erase (j);
		800	break;
		801	}
		802
465	dns_rcvseq = (dns_rcvseq + 1) & SEQNO_MASK;	803	rcvseq = (rcvseq + 1) & SEQNO_MASK;
466		804
467	if (!dns_snddq && !dns_rcvdq)	805	if (!rcvdq.put (r->data, r->datalen))
468	{	806	{
469	dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);	807	slog (L_ERR, "DNS: !rcvdq.put (r->data, r->datalen)");
470	dns_snddq = new byte_stream (MAX_BACKLOG);	808	abort (); // MUST never overflow, can be caused by data corruption, TODO
471
472	dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);
473	}	809	}
474		810
475	if (!dns_rcvdq->put (r->data, r->datalen))
476	abort (); // MUST never overflow, can be caused by data corruption, TODO
477
478	while (vpn_packet *pkt = dns_rcvdq->get ())	811	while (vpn_packet *pkt = rcvdq.get ())
479	{	812	{
480	sockinfo si;	813	sockinfo si;
481	si.host = 0; si.port = 0; si.prot = PROT_DNSv4;	814	si.host = htonl (c->conf->id); si.port = 0; si.prot = PROT_DNSv4;
482		815
483	vpn->recv_vpn_packet (pkt, si);	816	vpn->recv_vpn_packet (pkt, si);
		817
		818	delete pkt;
484	}	819	}
485	}	820
486	else if ((u32)dns_rcvseq - MAX_WINDOW - (u32)(*i)->seqno < MAX_WINDOW * 2)	821	// check for further packets
487	{
488	dns_rcvpq.erase (i);
489	goto redo;	822	goto redo;
490	}	823	}
491	}	824	}
492		825
493	dns_packet *	826	void
494	vpn::dnsv4_server (dns_packet *pkt)	827	vpn::dnsv4_server (dns_packet &pkt)
495	{	828	{
496	u16 flags = ntohs (pkt->flags);	829	u16 flags = ntohs (pkt.flags);
497		830
498	//memcpy (&((*rep)[0]), &((*pkt)[0]), pkt->len);
499	int offs = 6 * 2; // skip header	831	int offs = 6 * 2; // skip header
500		832
501	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);	833	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
502		834
503	if (!(flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))	835	if (0 == (flags & (FLAG_RESPONSE | FLAG_OP_MASK))
504	&& pkt->qdcount == htons (1))	836	&& pkt.qdcount == htons (1))
505	{	837	{
506	char qname[MAXSIZE];	838	char qname [MAXSIZE];
507	int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	839	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
508		840
509	u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++];	841	u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
510	u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];	842	u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
511		843
512	pkt->qdcount = htons (1);	844	pkt.qdcount = htons (1);
513	pkt->ancount = 0;	845	pkt.ancount = 0;
514	pkt->nscount = 0; // should be self, as other nameservers reply like this	846	pkt.nscount = 0; // should be self, as other nameservers reply like this
515	pkt->arcount = 0; // a record for self, as other nameservers reply like this	847	pkt.arcount = 0; // a record for self, as other nameservers reply like this
516		848
517	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_NXDOMAIN);	849	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_SERVFAIL);
518		850
519	int dlen = strlen (THISNODE->domain);	851	int dlen = strlen (THISNODE->domain);
520		852
521	if (qclass == RR_CLASS_IN	853	if (qclass == RR_CLASS_IN
522	&& (qtype == RR_TYPE_ANY || qtype == RR_TYPE_TXT)
523	&& qlen > dlen + 1	854	&& qlen > dlen + 1
524	&& !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen))	855	&& !memcmp (qname + qlen - (dlen + 1), THISNODE->domain, dlen))
525	{	856	{
526	// correct class, domain: parse	857	// now generate reply
527	u8 data[MAXSIZE];	858	pkt.ancount = htons (1); // one answer RR
528	int datalen = dns64::decode (data, qname, qlen - dlen - 1);	859	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);
529		860
530	int client = data[0];	861	if ((qtype == RR_TYPE_ANY
531	int seqno = ((data[1] << 8) | data[2]) & SEQNO_MASK;	862	|| qtype == RR_TYPE_TXT
532		863	|| qtype == RR_TYPE_NULL)
533	if (0 < client && client <= conns.size ())	864	&& qlen > dlen + 1 + HDRSIZE)
534	{	865	{
		866	// correct class, domain: parse
		867	int client, seqno;
		868	decode_header (qname, client, seqno);
		869
		870	u8 data[MAXSIZE];
		871	int datalen = cdc62.decode (data, qname + HDRSIZE, qlen - (dlen + 1 + HDRSIZE));
		872
		873	if (0 < client && client <= conns.size ())
		874	{
535	connection *c = conns [client - 1];	875	connection *c = conns [client - 1];
		876	dns_connection *dns = c->dns;
		877	dns_rcv *rcv;
536		878
537	for (vector<dns_rcv *>::iterator i = c->dns_rcvpq.begin ();	879	if (dns)
538	i != c->dns_rcvpq.end ();
539	++i)	880	{
		881	for (vector<dns_rcv *>::iterator i = dns->rcvpq.end (); i-- != dns->rcvpq.begin (); )
540	if ((*i)->seqno == seqno)	882	if (SEQNO_EQ ((*i)->seqno, seqno))
		883	{
		884	// already seen that request: simply reply with the cached reply
		885	dns_rcv *r = *i;
		886
		887	slog (L_DEBUG, "DNS: duplicate packet received ID %d, SEQ %d", htons (r->pkt->id), seqno);
		888
		889	// refresh header & id, as the retry count could have changed
		890	memcpy (r->pkt->at (6 * 2 + 1), pkt.at (6 * 2 + 1), HDRSIZE);
		891	r->pkt->id = pkt.id;
		892
		893	memcpy (pkt.at (0), r->pkt->at (0), offs = r->pkt->len);
		894
		895	goto duplicate_request;
		896	}
		897
		898	// new packet, queue
		899	rcv = new dns_rcv (seqno, data, datalen);
		900	dns->receive_rep (rcv);
		901	}
		902
541	{	903	{
542	// already seen that request, just reply with the original reply	904	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
543	dns_rcv *r = *i;
544		905
		906	int rtype = dns ? dns->cfg.rrtype : RR_TYPE_A;
		907	pkt [offs++] = rtype >> 8; pkt [offs++] = rtype; // type
		908	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
		909	pkt [offs++] = 0; pkt [offs++] = 0;
		910	pkt [offs++] = 0; pkt [offs++] = dns ? dns->cfg.def_ttl : 0; // TTL
		911
		912	int rdlen_offs = offs += 2;
		913
		914	if (dns)
		915	{
		916	int dlen = ntohs (dns->cfg.max_size) - offs;
		917
		918	// bind doesn't compress well, so reduce further by one label length
		919	dlen -= qlen;
		920
		921	// only put data into in-order sequence packets, if
		922	// we receive out-of-order packets we generate empty
		923	// replies
		924	//printf ("%d - %d & %x (=%d) < %d\n", seqno, dns->repseq, SEQNO_MASK, (seqno - dns->repseq) & SEQNO_MASK, MAX_WINDOW);//D
		925	if (((seqno - dns->repseq) & SEQNO_MASK) <= MAX_WINDOW)
		926	{
		927	dns->repseq = seqno;
		928
		929	while (dlen > 1 && !dns->snddq.empty ())
		930	{
		931	int txtlen = dlen <= 255 ? dlen - 1 : 255;
		932
		933	if (txtlen > dns->snddq.size ())
		934	txtlen = dns->snddq.size ();
		935
		936	pkt[offs++] = txtlen;
		937	memcpy (pkt.at (offs), dns->snddq.begin (), txtlen);
		938	offs += txtlen;
		939	dns->snddq.remove (txtlen);
		940
		941	dlen -= txtlen + 1;
		942	}
		943	}
		944
		945	// avoid completely empty TXT rdata
		946	if (offs == rdlen_offs)
		947	pkt[offs++] = 0;
		948
		949	slog (L_NOISE, "DNS: snddq %d", dns->snddq.size ());
		950	}
		951	else
		952	{
		953	// send RST
		954	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		955	pkt [offs++] = CMD_IP_RST;
		956	}
		957
		958	int rdlen = offs - rdlen_offs;
		959
		960	pkt [rdlen_offs - 2] = rdlen >> 8;
		961	pkt [rdlen_offs - 1] = rdlen;
		962
		963	if (dns)
		964	{
		965	// now update dns_rcv copy
545	offs = r->pkt->len;	966	rcv->pkt->len = offs;
546	memcpy (pkt->at (0), r->pkt->at (0), offs);	967	memcpy (rcv->pkt->at (0), pkt.at (0), offs);
547	goto duplicate_request;	968	}
548	}	969	}
549		970
550	// new packet, queue	971	duplicate_request: ;
551	c->dnsv4_receive_rep (new dns_rcv (seqno, pkt, data + 3, datalen - 3));	972	}
552		973	else
553	// now generate reply
554	pkt->ancount = htons (1); // one answer RR
555	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);	974	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
		975	}
		976	else if (qtype == RR_TYPE_A
		977	&& qlen > dlen + 1 + cdc26.encode_len (sizeof (dns_cfg)))
		978	{
		979	dns_cfg cfg;
		980	cdc26.decode ((u8 *)&cfg, qname, cdc26.encode_len (sizeof (dns_cfg)));
		981	int client = ntohs (cfg.client);
556		982
557	(*pkt) [offs++] = 0xc0;
558	(*pkt) [offs++] = 6 * 2; // same as in query section	983	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
559		984
560	(*pkt) [offs++] = RR_TYPE_TXT >> 8; (*pkt) [offs++] = RR_TYPE_TXT;	985	pkt [offs++] = RR_TYPE_A >> 8; pkt [offs++] = RR_TYPE_A; // type
561	(*pkt) [offs++] = RR_CLASS_IN >> 8; (*pkt) [offs++] = RR_CLASS_IN;	986	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
562
563	(*pkt) [offs++] = 0; (*pkt) [offs++] = 0;	987	pkt [offs++] = 0; pkt [offs++] = 0;
564	(*pkt) [offs++] = 0; (*pkt) [offs++] = 0; // TTL	988	pkt [offs++] = 0; pkt [offs++] = cfg.def_ttl; // TTL
		989	pkt [offs++] = 0; pkt [offs++] = 4; // rdlength
565		990
566	int dlen = MAX_PKT_SIZE - offs - 2;	991	slog (L_INFO, _("DNS: client %d connects"), client);
567		992
568	// bind doesn't compress well, so reduce further by one label length	993	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
569	dlen -= qlen;	994	pkt [offs++] = CMD_IP_REJ;
570		995
571	int rdlen_offs = offs += 2;	996	if (0 < client && client <= conns.size ())
572
573	while (c->dns_snddq
574	&& !c->dns_snddq->empty ()
575	&& dlen > 1)
576	{	997	{
577	int txtlen = dlen <= 255 ? dlen - 1 : 255;	998	connection *c = conns [client - 1];
578		999
579	if (txtlen > c->dns_snddq->size ())	1000	if (cfg.valid ())
580	txtlen = c->dns_snddq->size ();	1001	{
		1002	pkt [offs - 1] = CMD_IP_SYN;
581		1003
582	(*pkt)[offs++] = txtlen;	1004	delete c->dns;
583	memcpy (pkt->at (offs), c->dns_snddq->begin (), txtlen);	1005	c->dns = new dns_connection (c);
584	offs += txtlen;	1006	c->dns->cfg = cfg;
585	c->dns_snddq->remove (txtlen);	1007	}
586
587	dlen -= txtlen + 1;
588	}	1008	}
589
590	// avoid empty TXT rdata
591	if (offs == rdlen_offs)
592	(*pkt)[offs++] = 0;
593
594	int rdlen = offs - rdlen_offs;
595
596	(*pkt) [rdlen_offs - 2] = rdlen >> 8;
597	(*pkt) [rdlen_offs - 1] = rdlen;
598
599	duplicate_request: ;
600	}	1009	}
601	else
602	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
603	}	1010	}
604	}
605	else
606	offs = pkt->len;
607		1011
608	pkt->len = offs;	1012	pkt.len = offs;
609	return pkt;	1013	}
610	}	1014	}
611		1015
612	void	1016	void
613	vpn::dnsv4_client (dns_packet *pkt)	1017	vpn::dnsv4_client (dns_packet &pkt)
614	{	1018	{
615	u16 flags = ntohs (pkt->flags);	1019	u16 flags = ntohs (pkt.flags);
616	int offs = 6 * 2; // skip header	1020	int offs = 6 * 2; // skip header
617		1021
618	pkt->qdcount = ntohs (pkt->qdcount);	1022	pkt.qdcount = ntohs (pkt.qdcount);
619	pkt->ancount = ntohs (pkt->ancount);	1023	pkt.ancount = ntohs (pkt.ancount);
620		1024
621	// go through our request list and find the corresponding request	1025	// go through our request list and find the corresponding request
622	for (vector<dns_req *>::iterator i = dns_sndpq.begin ();	1026	for (vector<dns_snd *>::iterator i = dns_sndpq.begin ();
623	i != dns_sndpq.end ();	1027	i != dns_sndpq.end ();
624	++i)	1028	++i)
625	if ((*i)->pkt->id == pkt->id)	1029	if ((*i)->pkt->id == pkt.id)
626	{	1030	{
		1031	dns_connection *dns = (*i)->dns;
627	connection *c = (*i)->conn;	1032	connection *c = dns->c;
628	int seqno = (*i)->seqno;	1033	int seqno = (*i)->seqno;
629	u8 data[MAXSIZE], *datap = data;	1034	u8 data[MAXSIZE], *datap = data;
		1035	//printf ("rcv pkt %x\n", seqno);//D
		1036
		1037	if ((*i)->retry)
		1038	{
		1039	dns->send_interval *= 1.01;
		1040	if (dns->send_interval > MAX_SEND_INTERVAL)
		1041	dns->send_interval = MAX_SEND_INTERVAL;
		1042	}
		1043	else
		1044	{
		1045	#if 0
		1046	dns->send_interval *= 0.999;
		1047	#endif
		1048	// the latency surely puts an upper bound on
		1049	// the minimum send interval
		1050	double latency = ev_now () - (*i)->sent;
		1051
		1052	if (latency < dns->min_latency)
		1053	dns->min_latency = latency;
		1054
		1055	if (dns->send_interval > dns->min_latency * conf.dns_overlap_factor)
		1056	dns->send_interval = dns->min_latency * conf.dns_overlap_factor;
		1057
		1058	if (dns->send_interval < conf.dns_send_interval)
		1059	dns->send_interval = conf.dns_send_interval;
		1060	}
630		1061
631	delete *i;	1062	delete *i;
632	dns_sndpq.erase (i);	1063	dns_sndpq.erase (i);
633		1064
634	if (flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))	1065	if (flags & FLAG_RESPONSE && !(flags & FLAG_OP_MASK))
635	{	1066	{
636	char qname[MAXSIZE];	1067	char qname[MAXSIZE];
637		1068
638	while (pkt->qdcount-- && offs < MAXSIZE - 4)	1069	while (pkt.qdcount-- && offs < MAXSIZE - 4)
639	{	1070	{
640	int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	1071	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
641	offs += 4; // skip qtype, qclass	1072	offs += 4; // skip qtype, qclass
642	}	1073	}
643		1074
644	while (pkt->ancount-- && offs < MAXSIZE - 10)	1075	while (pkt.ancount-- && offs < MAXSIZE - 10 && datap)
645	{	1076	{
646	pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	1077	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
647		1078
648	u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++];	1079	u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
649	u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];	1080	u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
650	u32 ttl = (*pkt) [offs++] << 24;	1081	u32 ttl = pkt [offs++] << 24;
651	ttl |= (*pkt) [offs++] << 16;	1082	ttl |= pkt [offs++] << 16;
652	ttl |= (*pkt) [offs++] << 8;	1083	ttl |= pkt [offs++] << 8;
653	ttl |= (*pkt) [offs++];	1084	ttl |= pkt [offs++];
654
655	u16 rdlen = (*pkt) [offs++] << 8; rdlen |= (*pkt) [offs++];	1085	u16 rdlen = pkt [offs++] << 8; rdlen |= pkt [offs++];
656		1086
657	if (rdlen <= MAXSIZE - offs)	1087	if (qtype == RR_TYPE_NULL || qtype == RR_TYPE_TXT)
658	{	1088	{
659	// decode bytes, finally	1089	if (rdlen <= MAXSIZE - offs)
660
661	while (rdlen)
662	{	1090	{
		1091	// decode bytes, finally
		1092
		1093	while (rdlen)
		1094	{
663	int txtlen = (*pkt) [offs++];	1095	int txtlen = pkt [offs++];
664		1096
665	assert (txtlen + offs < MAXSIZE - 1);	1097	assert (txtlen + offs < MAXSIZE - 1);
666		1098
667	memcpy (datap, pkt->at (offs), txtlen);	1099	memcpy (datap, pkt.at (offs), txtlen);
668	datap += txtlen; offs += txtlen;	1100	datap += txtlen; offs += txtlen;
669		1101
670	rdlen -= txtlen + 1;	1102	rdlen -= txtlen + 1;
		1103	}
671	}	1104	}
672
673	}	1105	}
		1106	else if (qtype == RR_TYPE_A)
		1107	{
		1108	u8 ip [4];
674		1109
		1110	ip [0] = pkt [offs++];
		1111	ip [1] = pkt [offs++];
		1112	ip [2] = pkt [offs++];
		1113	ip [3] = pkt [offs++];
		1114
		1115	if (ip [0] == CMD_IP_1
		1116	&& ip [1] == CMD_IP_2
		1117	&& ip [2] == CMD_IP_3)
		1118	{
		1119	slog (L_TRACE, _("DNS: got tunnel meta command %02x"), ip [3]);
		1120
		1121	if (ip [3] == CMD_IP_RST)
		1122	{
		1123	slog (L_DEBUG, _("DNS: got tunnel RST request"));
		1124
		1125	delete dns; c->dns = 0;
		1126
		1127	return;
		1128	}
		1129	else if (ip [3] == CMD_IP_SYN)
		1130	{
		1131	slog (L_DEBUG, _("DNS: got tunnel SYN reply, server likes us."));
		1132	dns->established = true;
		1133	}
		1134	else if (ip [3] == CMD_IP_REJ)
		1135	{
		1136	slog (L_DEBUG, _("DNS: got tunnel REJ reply, server does not like us, aborting."));
		1137	abort ();
		1138	}
		1139	else
		1140	slog (L_INFO, _("DNS: got unknown meta command %02x"), ip [3]);
		1141	}
		1142	else
		1143	slog (L_INFO, _("DNS: got spurious a record %d.%d.%d.%d"),
		1144	ip [0], ip [1], ip [2], ip [3]);
		1145
		1146	return;
		1147	}
		1148
		1149	int client, rseqno;
		1150	decode_header (qname, client, rseqno);
		1151
		1152	if (client != THISNODE->id)
		1153	{
		1154	slog (L_INFO, _("DNS: got dns tunnel response with wrong clientid, ignoring"));
		1155	datap = 0;
		1156	}
		1157	else if (rseqno != seqno)
		1158	{
		1159	slog (L_DEBUG, _("DNS: got dns tunnel response with wrong seqno, badly caching nameserver?"));
		1160	datap = 0;
		1161	}
675	}	1162	}
676	}	1163	}
677		1164
		1165	// todo: pkt now used
678	if (datap != data)	1166	if (datap)
679	printf ("%02x %02x %02x %02x\n",
680	data[0],
681	data[1],
682	data[2],
683	data[3]);
684
685	printf ("recv %d,%d\n", pkt->id, seqno, datap - data);//D
686	c->dnsv4_receive_rep (new dns_rcv (seqno, pkt, data, datap - data));	1167	dns->receive_rep (new dns_rcv (seqno, data, datap - data));
687		1168
688	break;	1169	break;
689	}	1170	}
690
691	delete pkt;
692	}	1171	}
693		1172
694	void	1173	void
695	vpn::dnsv4_ev (io_watcher &w, short revents)	1174	vpn::dnsv4_ev (ev::io &w, int revents)
696	{	1175	{
697	if (revents & EVENT_READ)	1176	if (revents & EV_READ)
698	{	1177	{
699	dns_packet *pkt = new dns_packet;	1178	dns_packet *pkt = new dns_packet;
700	struct sockaddr_in sa;	1179	struct sockaddr_in sa;
701	socklen_t sa_len = sizeof (sa);	1180	socklen_t sa_len = sizeof (sa);
702		1181
703	pkt->len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);	1182	pkt->len = recvfrom (w.fd, pkt->at (0), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
704		1183
705	if (pkt->len > 0)	1184	if (pkt->len > 0)
706	{	1185	{
707	if (pkt->flags & htons (FLAG_TC))	1186	if (ntohs (pkt->flags) & FLAG_RESPONSE)
		1187	dnsv4_client (*pkt);
		1188	else
708	{	1189	{
709	slog (L_WARN, _("DNS request/response truncated, check protocol settings."));	1190	dnsv4_server (*pkt);
710	//TODO connection reset	1191	sendto (w.fd, pkt->at (0), pkt->len, 0, (sockaddr *)&sa, sa_len);
711	}	1192	}
712		1193
713	if (THISNODE->dns_port)	1194	delete pkt;
714	{
715	pkt = dnsv4_server (pkt);
716	sendto (w.fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)&sa, sa_len);
717	}
718	else
719	dnsv4_client (pkt);
720	}	1195	}
721	}	1196	}
722	}	1197	}
723		1198
724	bool	1199	bool
725	connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	1200	vpn::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
726	{	1201	{
727	// never initialized	1202	int client = ntohl (si.host);
728	if (!dns_snddq && !dns_rcvdq)
729	{
730	dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
731	dns_snddq = new byte_stream (MAX_BACKLOG);
732		1203
733	//dns_rcvseq = dns_sndseq = 0;	1204	assert (0 < client && client <= conns.size ());
734		1205
735	dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	1206	connection *c = conns [client - 1];
736	}	1207
		1208	if (!c->dns)
		1209	c->dns = new dns_connection (c);
737		1210
738	if (!dns_snddq->put (pkt))	1211	if (c->dns->snddq.put (pkt))
739	return false;	1212	c->dns->tw ();
740		1213
741	// start timer if neccessary	1214	// always return true even if the buffer overflows
742	if (!THISNODE->dns_port && !dnsv4_tw.active)
743	dnsv4_cb (dnsv4_tw);
744
745	return true;	1215	return true;
746	}	1216	}
747		1217
748	void	1218	void
749	connection::dnsv4_cb (time_watcher &w)	1219	connection::dnsv4_reset_connection ()
750	{	1220	{
		1221	//delete dns; dns = 0; //TODO
		1222	}
		1223
		1224	#define NEXT(w) do { if (next > (w)) next = w; } while (0)
		1225
		1226	void
		1227	dns_connection::time_cb (ev::timer &w, int revents)
		1228	{
		1229	// servers have to be polled
		1230	if (THISNODE->dns_port)
		1231	return;
		1232
751	// check for timeouts and (re)transmit	1233	// check for timeouts and (re)transmit
752	tstamp next = NOW + 60;	1234	tstamp next = ev::now () + poll_interval;
753	dns_req *send = 0;	1235	dns_snd *send = 0;
754		1236
755	for (vector<dns_req *>::iterator i = vpn->dns_sndpq.begin ();	1237	for (vector<dns_snd *>::iterator i = vpn->dns_sndpq.begin ();
756	i != vpn->dns_sndpq.end ();	1238	i != vpn->dns_sndpq.end ();
757	++i)	1239	++i)
758	{	1240	{
759	dns_req *r = *i;	1241	dns_snd *r = *i;
760		1242
761	if (r->next <= NOW)	1243	if (r->timeout <= ev_now ())
762	{	1244	{
763	if (!send)	1245	if (!send)
764	{	1246	{
765	send = r;	1247	send = r;
766		1248
767	if (r->retry)//D
768	printf ("req %d, retry %d\n", r->pkt->id, r->retry);
769	r->retry++;	1249	r->retry++;
770	r->next = NOW + r->retry;	1250	r->timeout = ev_now () + (r->retry * min_latency * conf.dns_timeout_factor);
		1251	//printf ("RETRY %x (%d, %f)\n", r->seqno, r->retry, r->timeout - ev_now ());//D
		1252
		1253	// the following code changes the query section a bit, forcing
		1254	// the forwarder to generate a new request
		1255	if (r->stdhdr)
		1256	encode_header ((char *)r->pkt->at (6 * 2 + 1), THISNODE->id, r->seqno, r->retry);
771	}	1257	}
772	}	1258	}
773		1259	else
774	if (r->next < next)	1260	NEXT (r->timeout);
775	next = r->next;
776	}	1261	}
777		1262
778	if (!send	1263	if (!send)
779	&& vpn->dns_sndpq.size () < MAX_OUTSTANDING)
780	{	1264	{
		1265	// generate a new packet, if wise
		1266
		1267	if (!established)
		1268	{
		1269	if (vpn->dns_sndpq.empty ())
		1270	{
781	send = new dns_req (this);	1271	send = new dns_snd (this);
		1272
		1273	cfg.reset (THISNODE->id);
		1274	send->gen_syn_req ();
		1275	}
		1276	}
		1277	else if (vpn->dns_sndpq.size () < conf.dns_max_outstanding
		1278	&& !SEQNO_EQ (rcvseq, sndseq - (MAX_WINDOW - 1)))
		1279	{
		1280	if (last_sent + send_interval <= ev_now ())
		1281	{
		1282	//printf ("sending data request etc.\n"); //D
		1283	if (!snddq.empty () || last_received + 1. > ev_now ())
		1284	{
		1285	poll_interval = send_interval;
		1286	NEXT (ev_now () + send_interval);
		1287	}
		1288
		1289	send = new dns_snd (this);
782	send->gen_stream_req (dns_sndseq, dns_snddq);	1290	send->gen_stream_req (sndseq, snddq);
		1291	send->timeout = ev_now () + min_latency * conf.dns_timeout_factor;
		1292	//printf ("SEND %x (%f)\n", send->seqno, send->timeout - ev_now (), min_latency, conf.dns_timeout_factor);//D
		1293
		1294	sndseq = (sndseq + 1) & SEQNO_MASK;
		1295	}
		1296	else
		1297	NEXT (last_sent + send_interval);
		1298	}
		1299
		1300	if (send)
783	vpn->dns_sndpq.push_back (send);	1301	vpn->dns_sndpq.push_back (send);
784
785	dns_sndseq = (dns_sndseq + 1) & SEQNO_MASK;
786	}	1302	}
787
788	tstamp min_next = NOW + (1. / (tstamp)MAX_RATE);
789		1303
790	if (send)	1304	if (send)
791	{	1305	{
792	dns_packet *pkt = send->pkt;	1306	last_sent = ev_now ();
793		1307	sendto (vpn->dnsv4_fd,
794	next = min_next;	1308	send->pkt->at (0), send->pkt->len, 0,
795		1309	vpn->dns_forwarder.sav4 (), vpn->dns_forwarder.salenv4 ());
796	sendto (vpn->dnsv4_fd, &((*pkt)[0]), pkt->len, 0, dns_si.sav4 (), dns_si.salenv4 ());
797	}	1310	}
798	else if (next < min_next)
799	next = min_next;
800		1311
801	w.start (next);	1312	slog (L_NOISE, "DNS: pi %f si %f N %f (%d:%d %d)",
		1313	poll_interval, send_interval, next - ev_now (),
		1314	vpn->dns_sndpq.size (), snddq.size (),
		1315	rcvpq.size ());
		1316
		1317	// TODO: no idea when this happens, but when next < ev_now (), we have a problem
		1318	// doesn't seem to happen anymore
		1319	if (next < ev_now () + 0.001)
		1320	next = ev_now () + 0.1;
		1321
		1322	w.start (next - ev_now ());
802	}	1323	}
803		1324
804	#endif	1325	#endif
805		1326

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines