ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/vpn_dns.C
(Generate patch)

Comparing gvpe/src/vpn_dns.C (file contents):
Revision 1.4 by pcg, Wed Mar 2 05:49:31 2005 UTC vs.
Revision 1.50 by root, Sun Mar 6 13:49:50 2011 UTC

1/* 1/*
2 vpn_dns.C -- handle the dns tunnel part of the protocol. 2 vpn_dns.C -- handle the dns tunnel part of the protocol.
3 Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com> 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 4
5 This file is part of GVPE.
6
5 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
6 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
7 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
8 (at your option) any later version. 10 option) any later version.
9 11
10 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
11 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13 GNU General Public License for more details. 15 Public License for more details.
14 16
15 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
16 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
17 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
18*/ 30*/
31
32// TODO: EDNS0 option to increase dns mtu?
33// TODO: re-write dns packet parsing/creation using a safe mem-buffer
34// to ensure no buffer overflows or similar problems.
19 35
20#include "config.h" 36#include "config.h"
21 37
22#if ENABLE_DNS 38#if ENABLE_DNS
23 39
24// dns processing is EXTREMELY ugly. For obvious(?) reasons. 40// dns processing is EXTREMELY ugly. For obvious(?) reasons.
25// it's a hack, use only in emergency situations please. 41// it's a hack, use only in emergency situations please.
26 42
27#include <cstring> 43#include <cstring>
44#include <cassert>
28 45
29#include <sys/types.h> 46#include <sys/types.h>
30#include <sys/socket.h> 47#include <sys/socket.h>
31#include <sys/wait.h> 48#include <sys/wait.h>
32#include <sys/uio.h> 49#include <sys/uio.h>
… …
35#include <unistd.h> 52#include <unistd.h>
36#include <fcntl.h> 53#include <fcntl.h>
37 54
38#include <map> 55#include <map>
39 56
57#include <cstdio> /* bug in libgmp: gmp.h relies on cstdio being included */
58#include <gmp.h>
59
40#include "netcompat.h" 60#include "netcompat.h"
41 61
42#include "vpn.h" 62#include "vpn.h"
43 63
44#define MIN_RETRY 1. 64#define MAX_POLL_INTERVAL 5. // how often to poll minimally when the server has no data
45#define MAX_RETRY 60. 65#define ACTIVITY_INTERVAL 5.
46 66
47#define MAX_OUTSTANDING 10 // max. outstanding requests 67#define INITIAL_TIMEOUT 0.1 // retry timeouts
68#define INITIAL_SYN_TIMEOUT 2. // retry timeout for initial syn
69
70#define MAX_SEND_INTERVAL 2. // optimistic?
71
48#define MAX_WINDOW 100 // max. for MAX_OUTSTANDING 72#define MAX_WINDOW 1000 // max. for MAX_OUTSTANDING, and backlog
49#define MAX_RATE 1 // requests/s
50#define MAX_BACKLOG (10*1024) // size of protocol backlog 73#define MAX_BACKLOG (64*1024) // size of gvpe protocol backlog (bytes), must be > MAXSIZE
51 74
52/* 75#define MAX_DOMAIN_SIZE 240 // 255 is legal limit, but bind doesn't compress well
76// 240 leaves about 4 bytes of server reply data
77// every request byte less give room for two reply bytes
53 78
54protocol, in shorthand :) 79#define SEQNO_MASK 0x3fff
55 80#define SEQNO_EQ(a,b) ( 0 == ( ((a) ^ (b)) & SEQNO_MASK) )
56client -> server <req> ANY?
57server -> client <req> TXT <rep>
58
59<req> is dns64-encoded <client-id:12><recv-seqno:10>[<send-seqno:10><data>]
60<rep> is dns64-encoded <0:12><recv-seqno:10>[<send-seqno:10><data>]
61
62if <client-id> is zero, the connection will be configured:
63
64<0:12><0:4>client-id:12><default-ttl:8><max-size:16><flags:16>
65
66*/
67 81
68#define MAX_LBL_SIZE 63 82#define MAX_LBL_SIZE 63
69#define MAX_PKT_SIZE 512 83#define MAX_PKT_SIZE 512
70 84
85#define RR_TYPE_A 1
86#define RR_TYPE_NULL 10
71#define RR_TYPE_TXT 16 87#define RR_TYPE_TXT 16
88#define RR_TYPE_AAAA 28
72#define RR_TYPE_ANY 255 89#define RR_TYPE_ANY 255
90
73#define RR_CLASS_IN 1 91#define RR_CLASS_IN 1
74 92
75// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative) 93#define CMD_IP_1 207
76struct dns64 94#define CMD_IP_2 46
77{ 95#define CMD_IP_3 236
78 static const char encode_chars[64 + 1]; 96#define CMD_IP_RST 29
79 static s8 decode_chars[256]; 97#define CMD_IP_SYN 113
98#define CMD_IP_REJ 32
80 99
81 static int encode_len (int bytes) { return (bytes * 8 + 5) / 6; } 100// works for cmaps up to 255 (not 256!)
82 static int decode_len (int bytes) { return (bytes * 6) / 8; } 101struct charmap
102{
103 enum { INVALID = (u8)255 };
104
105 char encode [256]; // index => char
106 u8 decode [256]; // char => index
107 unsigned int size;
108
109 charmap (const char *cmap);
110};
111
112charmap::charmap (const char *cmap)
113{
114 char *enc = encode;
115 u8 *dec = decode;
116
117 memset (enc, (char) 0, 256);
118 memset (dec, (char)INVALID, 256);
119
120 for (size = 0; cmap [size]; size++)
121 {
122 char c = cmap [size];
123
124 enc [size] = c;
125 dec [(u8)c] = size;
126
127 // allow lowercase/uppercase aliases if possible
128 if (c >= 'A' && c <= 'Z' && dec [c + ('a' - 'A')] == INVALID) dec [c + ('a' - 'A')] = size;
129 if (c >= 'a' && c <= 'z' && dec [c - ('a' - 'A')] == INVALID) dec [c - ('a' - 'A')] = size;
130 }
131
132 assert (size < 256);
133}
134
135#define MAX_DEC_LEN 500
136#define MAX_ENC_LEN (MAX_DEC_LEN * 2)
137#define MAX_LIMBS ((MAX_DEC_LEN * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
138
139// ugly. minimum base is 16(!)
140struct basecoder
141{
142 charmap cmap;
143 unsigned int enc_len [MAX_DEC_LEN];
144 unsigned int dec_len [MAX_ENC_LEN];
145
146 unsigned int encode_len (unsigned int len);
147 unsigned int decode_len (unsigned int len);
148
83 static int encode (char *dst, u8 *src, int len); 149 unsigned int encode (char *dst, u8 *src, unsigned int len);
84 static int decode (u8 *dst, char *src, int len); 150 unsigned int decode (u8 *dst, char *src, unsigned int len);
85 151
86 dns64 (); 152 basecoder (const char *cmap);
87} dns64; 153};
88 154
89const char dns64::encode_chars[64 + 1] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-"; 155basecoder::basecoder (const char *cmap)
90s8 dns64::decode_chars[256]; 156: cmap (cmap)
91
92dns64::dns64 ()
93{ 157{
94 for (int i = 0; i < 64; i++) 158 for (unsigned int len = 0; len < MAX_DEC_LEN; ++len)
95 decode_chars [encode_chars [i]] = i + 1; 159 {
96} 160 u8 src [MAX_DEC_LEN];
161 u8 dst [MAX_ENC_LEN];
97 162
163 memset (src, 255, len);
164
165 mp_limb_t m [MAX_LIMBS];
166 mp_size_t n;
167
168 n = mpn_set_str (m, src, len, 256);
169 n = mpn_get_str (dst, this->cmap.size, m, n);
170
171 for (int i = 0; !dst [i]; ++i)
172 n--;
173
174 enc_len [len] = n;
175 dec_len [n] = len;
176 }
177}
178
179unsigned int
180basecoder::encode_len (unsigned int len)
181{
182 return enc_len [len];
183}
184
185unsigned int
186basecoder::decode_len (unsigned int len)
187{
188 while (len && !dec_len [len])
189 --len;
190
191 return dec_len [len];
192}
193
194unsigned int
98int dns64::encode (char *dst, u8 *src, int len) 195basecoder::encode (char *dst, u8 *src, unsigned int len)
99{ 196{
100 // slow, but easy to debug 197 if (!len || len > MAX_DEC_LEN)
101 char *beg = dst; 198 return 0;
102 unsigned int accum, bits = 0; 199
200 int elen = encode_len (len);
201
202 mp_limb_t m [MAX_LIMBS];
203 mp_size_t n;
204
205 u8 dst_ [MAX_ENC_LEN];
206
207 n = mpn_set_str (m, src, len, 256);
208 n = mpn_get_str (dst_, cmap.size, m, n);
209
210 int plen = elen; // for padding
211
212 while (n < plen)
213 {
214 *dst++ = cmap.encode [0];
215 plen--;
216 }
217
218 for (unsigned int i = n - plen; i < n; ++i)
219 *dst++ = cmap.encode [dst_ [i]];
220
221 return elen;
222}
223
224unsigned int
225basecoder::decode (u8 *dst, char *src, unsigned int len)
226{
227 if (!len || len > MAX_ENC_LEN)
228 return 0;
229
230 u8 src_ [MAX_ENC_LEN];
231 unsigned int elen = 0;
103 232
104 while (len--) 233 while (len--)
105 { 234 {
106 accum <<= 8; 235 u8 val = cmap.decode [(u8)*src++];
107 accum |= *src++;
108 bits += 8;
109 236
110 while (bits >= 6) 237 if (val != charmap::INVALID)
111 { 238 src_ [elen++] = val;
112 *dst++ = encode_chars [(accum >> (bits - 6)) & 63]; 239 }
113 bits -= 6; 240
114 } 241 int dlen = decode_len (elen);
242
243 mp_limb_t m [MAX_LIMBS];
244 mp_size_t n;
245
246 u8 dst_ [MAX_DEC_LEN];
247
248 n = mpn_set_str (m, src_, elen, cmap.size);
249 n = mpn_get_str (dst_, 256, m, n);
250
251 if (n < dlen)
115 } 252 {
253 memset (dst, 0, dlen - n);
254 memcpy (dst + dlen - n, dst_, n);
255 }
256 else
257 memcpy (dst, dst_ + n - dlen, dlen);
116 258
117 if (bits) 259 return dlen;
118 *dst++ = encode_chars [(accum << (6 - bits)) & 63];
119
120 return dst - beg;
121} 260}
122 261
123int dns64::decode (u8 *dst, char *src, int len) 262#if 0
124{ 263struct test { test (); } test;
125 // slow, but easy to debug
126 u8 *beg = dst;
127 unsigned int accum, bits = 0;
128 264
129 while (len--) 265test::test ()
266{
267 basecoder cdc ("0123456789abcdefghijklmnopqrstuvwxyz");
268
269 u8 in[] = "0123456789abcdefghijklmnopqrstuvwxyz";
270 static char enc[200];
271 static u8 dec[200];
272
273 for (int i = 1; i < 20; i++)
130 { 274 {
131 s8 chr = decode_chars [(u8)*src++]; 275 int elen = cdc.encode (enc, in, i);
276 int dlen = cdc.decode (dec, enc, elen);
132 277
133 if (!chr) 278 printf ("%d>%d>%d (%s>%s)\n", i, elen, dlen, enc, dec);
134 break;
135
136 accum <<= 6;
137 accum |= chr - 1;
138 bits += 6;
139
140 while (bits >= 8)
141 {
142 *dst++ = accum >> (bits - 8);
143 bits -= 8;
144 }
145 } 279 }
280 abort ();
281}
282#endif
146 283
147 return dst - beg; 284//static basecoder cdc64 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI-");
285//static basecoder cdc63 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
286static basecoder cdc62 ("dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
287//static basecoder cdc36 ("dphzr06qmjkb34tsvl81xaef92wgyo57ucni"); // unused as of yet
288static basecoder cdc26 ("dPhZrQmJkBtSvLxAeFwGyO");
289
290/////////////////////////////////////////////////////////////////////////////
291
292#define HDRSIZE 6
293
294inline void
295encode_header (char *data, int clientid, int seqno, int retry = 0)
296{
297 seqno &= SEQNO_MASK;
298
299 u8 hdr[3] = {
300 clientid,
301 (seqno >> 8) | (retry << 6),
302 seqno,
303 };
304
305 assert (clientid < 256);
306
307 cdc26.encode (data, hdr, 3);
308}
309
310inline void
311decode_header (char *data, int &clientid, int &seqno)
312{
313 u8 hdr[3];
314
315 cdc26.decode (hdr, data, HDRSIZE);
316
317 clientid = hdr[0];
318 seqno = ((hdr[1] << 8) | hdr[2]) & SEQNO_MASK;
148} 319}
149 320
150///////////////////////////////////////////////////////////////////////////// 321/////////////////////////////////////////////////////////////////////////////
151 322
152struct byte_stream 323struct byte_stream
… …
159 ~byte_stream (); 330 ~byte_stream ();
160 331
161 bool empty () { return !fill; } 332 bool empty () { return !fill; }
162 int size () { return fill; } 333 int size () { return fill; }
163 334
335 bool put (u8 *data, unsigned int datalen);
164 bool put (vpn_packet *pkt); 336 bool put (vpn_packet *pkt);
165 vpn_packet *get (); 337 vpn_packet *get ();
166 338
167 u8 *begin () { return data; } 339 u8 *begin () { return data; }
168 void remove (int count); 340 void remove (int count);
… …
177byte_stream::~byte_stream () 349byte_stream::~byte_stream ()
178{ 350{
179 delete data; 351 delete data;
180} 352}
181 353
354void
182void byte_stream::remove (int count) 355byte_stream::remove (int count)
183{ 356{
184 if (count > fill) 357 if (count > fill)
185 abort (); 358 assert (count <= fill);
186 359
187 memmove (data, data + count, fill -= count); 360 memmove (data, data + count, fill -= count);
188} 361}
189 362
363bool
364byte_stream::put (u8 *data, unsigned int datalen)
365{
366 if (maxsize - fill < datalen)
367 return false;
368
369 memcpy (this->data + fill, data, datalen); fill += datalen;
370
371 return true;
372}
373
374bool
190bool byte_stream::put (vpn_packet *pkt) 375byte_stream::put (vpn_packet *pkt)
191{ 376{
192 if (maxsize - fill < pkt->len + 2) 377 if (maxsize - fill < pkt->len + 2)
193 return false; 378 return false;
194 379
195 data [fill++] = pkt->len >> 8; 380 data [fill++] = pkt->len >> 8;
196 data [fill++] = pkt->len; 381 data [fill++] = pkt->len;
197 382
198 memcpy (data + fill, &((*pkt)[0]), pkt->len); fill += pkt->len; 383 memcpy (data + fill, pkt->at (0), pkt->len); fill += pkt->len;
199 384
200 return true; 385 return true;
201} 386}
202 387
203vpn_packet *byte_stream::get () 388vpn_packet *byte_stream::get ()
204{ 389{
390 unsigned int len;
391
392 for (;;)
393 {
205 int len = (data [0] << 8) | data [1]; 394 len = (data [0] << 8) | data [1];
206 395
396 if (len <= MAXSIZE || fill < 2)
397 break;
398
399 // TODO: handle this better than skipping, e.g. by reset
400 slog (L_DEBUG, _("DNS: corrupted packet stream skipping a byte..."));
401 remove (1);
402 }
403
207 if (fill < len + 2) 404 if (fill < len + 2)
208 return 0; 405 return 0;
209 406
210 vpn_packet *pkt = new vpn_packet; 407 vpn_packet *pkt = new vpn_packet;
408
409 pkt->len = len;
211 memcpy (&((*pkt)[0]), data + 2, len); 410 memcpy (pkt->at (0), data + 2, len);
212 remove (len + 2); 411 remove (len + 2);
213 412
214 return pkt; 413 return pkt;
215} 414}
216 415
217///////////////////////////////////////////////////////////////////////////// 416/////////////////////////////////////////////////////////////////////////////
218 417
219#define FLAG_QUERY ( 0 << 15) 418#define FLAG_QUERY ( 0 << 15)
220#define FLAG_RESPONSE ( 1 << 15) 419#define FLAG_RESPONSE ( 1 << 15)
221#define FLAG_OP_MASK (15 << 14) 420#define FLAG_OP_MASK (15 << 11)
222#define FLAG_OP_QUERY ( 0 << 11) 421#define FLAG_OP_QUERY ( 0 << 11)
223#define FLAG_AA ( 1 << 10) 422#define FLAG_AA ( 1 << 10)
224#define FLAG_TC ( 1 << 9) 423#define FLAG_TC ( 1 << 9)
225#define FLAG_RD ( 1 << 8) 424#define FLAG_RD ( 1 << 8)
226#define FLAG_RA ( 1 << 7) 425#define FLAG_RA ( 1 << 7)
426#define FLAG_AUTH ( 1 << 5)
227#define FLAG_RCODE_MASK (15 << 0) 427#define FLAG_RCODE_MASK (15 << 0)
228#define FLAG_RCODE_OK ( 0 << 0) 428#define FLAG_RCODE_OK ( 0 << 0)
229#define FLAG_RCODE_FORMERR ( 1 << 0) 429#define FLAG_RCODE_FORMERR ( 1 << 0)
230#define FLAG_RCODE_SERVFAIL ( 2 << 0) 430#define FLAG_RCODE_SERVFAIL ( 2 << 0)
231#define FLAG_RCODE_NXDOMAIN ( 3 << 0) 431#define FLAG_RCODE_NXDOMAIN ( 3 << 0)
232#define FLAG_RCODE_REFUSED ( 5 << 0) 432#define FLAG_RCODE_REFUSED ( 5 << 0)
233 433
234#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD) 434#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)
235#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD) 435#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)
436
437struct dns_cfg
438{
439 static int next_uid;
440
441 u8 id1, id2, id3, id4;
442
443 u8 version;
444 u8 flags;
445 u8 rrtype;
446 u8 def_ttl;
447
448 u16 client;
449 u16 uid; // to make request unique
450
451 u16 max_size;
452 u8 seq_cdc;
453 u8 req_cdc;
454
455 u8 rep_cdc;
456 u8 delay; // time in 0.01s units that the server may delay replying packets
457 u8 r3, r4;
458
459 u8 r5, r6, r7, r8;
460
461 void reset (int clientid);
462 bool valid ();
463};
464
465int dns_cfg::next_uid;
466
467void
468dns_cfg::reset (int clientid)
469{
470 id1 = 'G';
471 id2 = 'V';
472 id3 = 'P';
473 id4 = 'E';
474
475 version = 1;
476
477 rrtype = RR_TYPE_TXT;
478 flags = 0;
479 def_ttl = 0;
480 seq_cdc = 26;
481 req_cdc = 62;
482 rep_cdc = 0;
483 max_size = htons (MAX_PKT_SIZE);
484 client = htons (clientid);
485 uid = next_uid++;
486 delay = 0;
487
488 r3 = r4 = 0;
489 r4 = r5 = r6 = r7 = 0;
490}
491
492bool
493dns_cfg::valid ()
494{
495 // although the protocol itself allows for some configurability,
496 // only the following encoding/decoding settings are implemented.
497 return id1 == 'G'
498 && id2 == 'V'
499 && id3 == 'P'
500 && id4 == 'E'
501 && seq_cdc == 26
502 && req_cdc == 62
503 && rep_cdc == 0
504 && version == 1;
505}
236 506
237struct dns_packet : net_packet 507struct dns_packet : net_packet
238{ 508{
239 u16 id; 509 u16 id;
240 u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4 510 u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
241 u16 qdcount, ancount, nscount, arcount; 511 u16 qdcount, ancount, nscount, arcount;
242 512
243 u8 data[MAXSIZE - 6 * 2]; 513 u8 data [MAXSIZE - 6 * 2];
244 514
245 int decode_label (char *data, int size, int &offs); 515 int decode_label (char *data, int size, int &offs);
246}; 516};
247 517
518int
248int dns_packet::decode_label (char *data, int size, int &offs) 519dns_packet::decode_label (char *data, int size, int &offs)
249{ 520{
250 char *orig = data; 521 char *orig = data;
251 522
252 memset (data, 0, size); 523 memset (data, 0, size);
253 524
… …
279 return data - orig; 550 return data - orig;
280} 551}
281 552
282///////////////////////////////////////////////////////////////////////////// 553/////////////////////////////////////////////////////////////////////////////
283 554
555static
556u16 next_id ()
557{
558 static u16 dns_id = 0; // TODO: should be per-vpn
559
560 if (!dns_id)
561 dns_id = time (0);
562
563 // the simplest lsfr with periodicity 65535 i could find
564 dns_id = (dns_id << 1)
565 | (((dns_id >> 1)
566 ^ (dns_id >> 2)
567 ^ (dns_id >> 4)
568 ^ (dns_id >> 15)) & 1);
569
570 return dns_id;
571}
572
284struct dns_req 573struct dns_rcv;
574struct dns_snd;
575
576struct dns_connection
577{
578 connection *c;
579 struct vpn *vpn;
580
581 dns_cfg cfg;
582
583 bool established;
584
585 tstamp last_received;
586 tstamp last_sent;
587 double min_latency;
588 double poll_interval, send_interval;
589
590 vector<dns_rcv *> rcvpq;
591
592 byte_stream rcvdq; int rcvseq; int repseq;
593 byte_stream snddq; int sndseq;
594
595 inline void time_cb (ev::timer &w, int revents); ev::timer tw;
596 void receive_rep (dns_rcv *r);
597
598 dns_connection (connection *c);
599 ~dns_connection ();
600};
601
602struct dns_snd
285{ 603{
286 dns_packet *pkt; 604 dns_packet *pkt;
287 tstamp next; 605 tstamp timeout, sent;
288 int retry; 606 int retry;
289 connection *conn; 607 struct dns_connection *dns;
608 int seqno;
609 bool stdhdr;
290 610
291 dns_req (connection *c, int seqno, byte_stream *stream); 611 void gen_stream_req (int seqno, byte_stream &stream);
612 void gen_syn_req ();
613
614 dns_snd (dns_connection *dns);
615 ~dns_snd ();
292}; 616};
293 617
294struct dns_rep 618dns_snd::dns_snd (dns_connection *dns)
619: dns (dns)
295{ 620{
296}; 621 timeout = 0;
297
298static u16 dns_id; // TODO: should be per-vpn
299
300dns_req::dns_req (connection *c, int seqno, byte_stream *stream)
301: conn (c)
302{
303 next = 0;
304 retry = 0; 622 retry = 0;
623 seqno = 0;
624 sent = ev_now ();
625 stdhdr = false;
305 626
306 pkt = new dns_packet; 627 pkt = new dns_packet;
307 628
308 pkt->id = dns_id++; 629 pkt->id = next_id ();
309 pkt->flags = DEFAULT_CLIENT_FLAGS; 630}
310 pkt->qdcount = htons (1);
311 pkt->ancount = 0;
312 pkt->nscount = 0;
313 pkt->arcount = 0;
314 631
315 int offs = 6*2; 632dns_snd::~dns_snd ()
316 int dlen = 255 - strlen (THISNODE->domain) - 1; // here we always have room for the max. label length 633{
634 delete pkt;
635}
317 636
318 u8 lbl[64]; //D 637static void
319 char enc[65]; 638append_domain (dns_packet &pkt, int &offs, const char *domain)
320 int lbllen = 3; 639{
321 lbl[0] = c->conf->id; //D
322 lbl[1] = seqno >> 8; //D
323 lbl[2] = seqno; //D
324
325 while (dlen > 0)
326 {
327 int sndlen = dlen;
328
329 if (sndlen + lbllen > dns64::decode_len (MAX_LBL_SIZE))
330 sndlen = dns64::decode_len (MAX_LBL_SIZE) - lbllen;
331
332 if (sndlen > stream->size ())
333 sndlen = stream->size ();
334
335 if (sndlen + lbllen == 0)
336 break;
337
338 memcpy (lbl + lbllen, stream->begin (), sndlen);
339 stream->remove (sndlen);
340 lbllen += sndlen;
341
342 dns64::encode (enc, lbl, lbllen);
343
344 int elen = dns64::encode_len (lbllen);
345 (*pkt)[offs++] = elen;
346 memcpy (&((*pkt)[offs]), enc, elen);
347 offs += elen;
348 dlen -= elen + 1;
349
350 lbllen = 0;
351 }
352
353 const char *suffix = THISNODE->domain;
354
355 // add tunnel domain 640 // add tunnel domain
356 for (;;) 641 for (;;)
357 { 642 {
358 const char *end = strchr (suffix, '.'); 643 const char *end = strchr (domain, '.');
359 644
360 if (!end) 645 if (!end)
361 end = suffix + strlen (suffix); 646 end = domain + strlen (domain);
362 647
363 int len = end - suffix; 648 int len = end - domain;
364 649
365 (*pkt)[offs++] = len; 650 pkt [offs++] = len;
366 memcpy (&((*pkt)[offs]), suffix, len); 651 memcpy (pkt.at (offs), domain, len);
367 offs += len; 652 offs += len;
368 653
369 if (!*end) 654 if (!*end)
370 break; 655 break;
371 656
372 suffix = end + 1; 657 domain = end + 1;
658 }
659}
660
661void
662dns_snd::gen_stream_req (int seqno, byte_stream &stream)
663{
664 stdhdr = true;
665 this->seqno = seqno;
666
667 timeout = ev_now () + INITIAL_TIMEOUT;
668
669 pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
670 pkt->qdcount = htons (1);
671
672 int offs = 6*2;
673 int dlen = MAX_DOMAIN_SIZE - (strlen (dns->c->conf->domain) + 2);
674 // MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
675 // so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra
676
677 char enc[256], *encp = enc;
678 encode_header (enc, THISNODE->id, seqno);
679
680 int datalen = cdc62.decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE - HDRSIZE);
681
682 if (datalen > stream.size ())
683 datalen = stream.size ();
684
685 int enclen = cdc62.encode (enc + HDRSIZE, stream.begin (), datalen) + HDRSIZE;
686 stream.remove (datalen);
687
688 while (enclen)
373 } 689 {
690 int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;
691
692 (*pkt)[offs++] = lbllen;
693 memcpy (pkt->at (offs), encp, lbllen);
694
695 offs += lbllen;
696 encp += lbllen;
697
698 enclen -= lbllen;
699 }
700
701 append_domain (*pkt, offs, dns->c->conf->domain);
374 702
375 (*pkt)[offs++] = 0; 703 (*pkt)[offs++] = 0;
376 (*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY; 704 (*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;
377 (*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN; 705 (*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
378 706
379 pkt->len = offs; 707 pkt->len = offs;
708}
380 709
381 c->vpn->dns_sndpq.push_back (this); 710void
711dns_snd::gen_syn_req ()
712{
713 timeout = ev_now () + INITIAL_SYN_TIMEOUT;
714
715 pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
716 pkt->qdcount = htons (1);
717
718 int offs = 6 * 2;
719
720 int elen = cdc26.encode ((char *)pkt->at (offs + 1), (u8 *)&dns->cfg, sizeof (dns_cfg));
721
722 assert (elen <= MAX_LBL_SIZE);
723
724 (*pkt)[offs] = elen;
725 offs += elen + 1;
726 append_domain (*pkt, offs, dns->c->conf->domain);
727
728 (*pkt)[offs++] = 0;
729 (*pkt)[offs++] = RR_TYPE_A >> 8; (*pkt)[offs++] = RR_TYPE_A;
730 (*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
731
732 pkt->len = offs;
733}
734
735struct dns_rcv
736{
737 int seqno;
738 dns_packet *pkt; // reply packet
739 u8 data [MAXSIZE]; // actually part of the reply packet...
740 int datalen;
741
742 dns_rcv (int seqno, u8 *data, int datalen);
743 ~dns_rcv ();
744};
745
746dns_rcv::dns_rcv (int seqno, u8 *data, int datalen)
747: seqno (seqno), pkt (new dns_packet), datalen (datalen)
748{
749 memcpy (this->data, data, datalen);
750}
751
752dns_rcv::~dns_rcv ()
753{
754 delete pkt;
382} 755}
383 756
384///////////////////////////////////////////////////////////////////////////// 757/////////////////////////////////////////////////////////////////////////////
385 758
386struct dns_cfg 759dns_connection::dns_connection (connection *c)
760: c (c)
761, rcvdq (MAX_BACKLOG * 2)
762, snddq (MAX_BACKLOG)
387{ 763{
388 u8 id1, id2, id3; 764 tw.set<dns_connection, &dns_connection::time_cb> (this);
389 u8 def_ttl;
390 u8 unused1;
391 u16 max_size;
392 u8 flags1, flags2;
393};
394 765
395dns_packet * 766 vpn = c->vpn;
767
768 established = false;
769
770 rcvseq = repseq = sndseq = 0;
771
772 last_sent = last_received = 0;
773 poll_interval = 0.5; // starting here
774 send_interval = 0.5; // starting rate
775 min_latency = INITIAL_TIMEOUT;
776}
777
778dns_connection::~dns_connection ()
779{
780 for (vector<dns_rcv *>::iterator i = rcvpq.begin ();
781 i != rcvpq.end ();
782 ++i)
783 delete *i;
784}
785
786void
787dns_connection::receive_rep (dns_rcv *r)
788{
789 if (r->datalen)
790 {
791 last_received = ev_now ();
792 tw ();
793
794 poll_interval = send_interval;
795 }
796 else
797 {
798 poll_interval *= 1.5;
799
800 if (poll_interval > MAX_POLL_INTERVAL)
801 poll_interval = MAX_POLL_INTERVAL;
802 }
803
804 rcvpq.push_back (r);
805
806 redo:
807
808 // find next packet
809 for (vector<dns_rcv *>::iterator i = rcvpq.end (); i-- != rcvpq.begin (); )
810 if (SEQNO_EQ (rcvseq, (*i)->seqno))
811 {
812 //printf ("seqno eq %x %x\n", rcvseq, (*i)->seqno);//D
813 // enter the packet into our input stream
814 r = *i;
815
816 // remove the oldest packet, look forward, as it's oldest first
817 for (vector<dns_rcv *>::iterator j = rcvpq.begin (); j != rcvpq.end (); ++j)
818 if (SEQNO_EQ ((*j)->seqno, rcvseq - MAX_WINDOW))
819 {
820 //printf ("seqno RR %x %x\n", (*j)->seqno, rcvseq - MAX_WINDOW);//D
821 delete *j;
822 rcvpq.erase (j);
823 break;
824 }
825
826 rcvseq = (rcvseq + 1) & SEQNO_MASK;
827
828 if (!rcvdq.put (r->data, r->datalen))
829 {
830 // MUST never overflow, can be caused by data corruption, TODO
831 slog (L_CRIT, "DNS: !rcvdq.put (r->data, r->datalen)");
832 c->dnsv4_reset_connection ();
833 return;
834 }
835
836 while (vpn_packet *pkt = rcvdq.get ())
837 {
838 sockinfo si;
839 si.host = htonl (c->conf->id); si.port = 0; si.prot = PROT_DNSv4;
840
841 vpn->recv_vpn_packet (pkt, si);
842 delete pkt;
843 }
844
845 // check for further packets
846 goto redo;
847 }
848}
849
850void
396vpn::dnsv4_server (dns_packet *pkt) 851vpn::dnsv4_server (dns_packet &pkt)
397{ 852{
398 u16 flags = ntohs (pkt->flags); 853 u16 flags = ntohs (pkt.flags);
399 854
400 //memcpy (&((*rep)[0]), &((*pkt)[0]), pkt->len);
401 int offs = 6 * 2; // skip header 855 int offs = 6 * 2; // skip header
402 856
403 pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR); 857 pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
404 858
405 if (!(flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC)) 859 if (0 == (flags & (FLAG_RESPONSE | FLAG_OP_MASK))
406 && pkt->qdcount == htons (1)) 860 && pkt.qdcount == htons (1))
407 { 861 {
408 char qname[MAXSIZE]; 862 char qname [MAXSIZE];
409 int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs); 863 int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
410 864
411 printf ("rcvd packet len %d, id%04x flags%04x q%04x a%04x n%04x a%04x <%s>\n", pkt->len,
412 pkt->id, flags, pkt->qdcount, pkt->ancount, pkt->nscount, pkt->arcount, qname);//D
413
414 u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++]; 865 u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
415 u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++]; 866 u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
416 867
417 pkt->qdcount = htons (1); 868 pkt.qdcount = htons (1);
418 pkt->ancount = 0; 869 pkt.ancount = 0;
419 pkt->nscount = 0; // should be self, as other nameservers reply like this 870 pkt.nscount = 0; // should be self, as other nameservers reply like this
420 pkt->arcount = 0; // a record for self, as other nameservers reply like this 871 pkt.arcount = 0; // a record for self, as other nameservers reply like this
421 872
422 pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_NXDOMAIN); 873 pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_SERVFAIL);
423 874
424 int dlen = strlen (THISNODE->domain); 875 int dlen = strlen (THISNODE->domain);
425 876
426 if (qclass == RR_CLASS_IN 877 if (qclass == RR_CLASS_IN
427 && (qtype == RR_TYPE_ANY || qtype == RR_TYPE_TXT)
428 && qlen > dlen + 1 878 && qlen > dlen + 1
429 && !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen)) 879 && !memcmp (qname + qlen - (dlen + 1), THISNODE->domain, dlen))
430 { 880 {
431 // correct class, domain, parse
432 u8 data[MAXSIZE];
433 int datalen = dns64::decode (data, qname, qlen - dlen - 1);
434
435 for (int i = 0; i < datalen; i++)
436 printf ("%02x ", data[i]);
437 printf ("\n");
438
439
440
441
442#if 0
443 // now generate reply 881 // now generate reply
444 rep->ancount = htons (1); // one answer RR 882 pkt.ancount = htons (1); // one answer RR
445 rep->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK); 883 pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);
446 884
447 (*rep) [offs++] = 0xc0; 885 if ((qtype == RR_TYPE_ANY
448 (*rep) [offs++] = 6 * 2; // same as in query section 886 || qtype == RR_TYPE_TXT
449 887 || qtype == RR_TYPE_NULL)
450 (*rep) [offs++] = RR_TYPE_TXT >> 8; (*rep) [offs++] = RR_TYPE_TXT; 888 && qlen > dlen + 1 + HDRSIZE)
451 (*rep) [offs++] = RR_CLASS_IN >> 8; (*rep) [offs++] = RR_CLASS_IN;
452
453 (*rep) [offs++] = 0; (*rep) [offs++] = 0;
454 (*rep) [offs++] = 0; (*rep) [offs++] = 0; // TTL
455
456 int dlen = MAX_PKT_SIZE - offs - 2;
457
458 printf ("we have room for %d bytes\n", dlen);
459
460 int rdlen_offs = offs += 2;
461
462 u8 txt[255];
463 txt[0] = 0;
464 txt[1] = 0;
465
466 int txtlen = 2;
467
468 while (dlen > 1)
469 { 889 {
470 int sndlen = --dlen; 890 // correct class, domain: parse
891 int client, seqno;
892 decode_header (qname, client, seqno);
471 893
472 if (sndlen + txtlen > 255) 894 u8 data[MAXSIZE];
473 sndlen = 255 - txtlen; 895 int datalen = cdc62.decode (data, qname + HDRSIZE, qlen - (dlen + 1 + HDRSIZE));
474 896
475 sndlen = 0; 897 if (0 < client && client <= conns.size ())
898 {
899 connection *c = conns [client - 1];
900 dns_connection *dns = c->dns;
901 dns_rcv *rcv;
476 902
477 (*rep)[offs++] = sndlen + txtlen; 903 if (dns)
478 memcpy (&((*rep)[offs]), txt, txtlen); 904 {
905 for (vector<dns_rcv *>::iterator i = dns->rcvpq.end (); i-- != dns->rcvpq.begin (); )
906 if (SEQNO_EQ ((*i)->seqno, seqno))
907 {
908 // already seen that request: simply reply with the cached reply
909 dns_rcv *r = *i;
910
911 slog (L_DEBUG, "DNS: duplicate packet received ID %d, SEQ %d", htons (r->pkt->id), seqno);
912
913 // refresh header & id, as the retry count could have changed
914 memcpy (r->pkt->at (6 * 2 + 1), pkt.at (6 * 2 + 1), HDRSIZE);
915 r->pkt->id = pkt.id;
916
917 memcpy (pkt.at (0), r->pkt->at (0), offs = r->pkt->len);
918
919 goto duplicate_request;
920 }
921
922 // new packet, queue
923 rcv = new dns_rcv (seqno, data, datalen);
924 dns->receive_rep (rcv);
925 }
926
927 {
928 pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
929
930 int rtype = dns ? dns->cfg.rrtype : RR_TYPE_A;
931 pkt [offs++] = rtype >> 8; pkt [offs++] = rtype; // type
932 pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
933 pkt [offs++] = 0; pkt [offs++] = 0;
934 pkt [offs++] = 0; pkt [offs++] = dns ? dns->cfg.def_ttl : 0; // TTL
935
936 int rdlen_offs = offs += 2;
937
938 if (dns)
939 {
940 int dlen = ntohs (dns->cfg.max_size) - offs;
941
942 // bind doesn't compress well, so reduce further by one label length
943 dlen -= qlen;
944
945 // only put data into in-order sequence packets, if
946 // we receive out-of-order packets we generate empty
947 // replies
948 //printf ("%d - %d & %x (=%d) < %d\n", seqno, dns->repseq, SEQNO_MASK, (seqno - dns->repseq) & SEQNO_MASK, MAX_WINDOW);//D
949 if (((seqno - dns->repseq) & SEQNO_MASK) <= MAX_WINDOW)
950 {
951 dns->repseq = seqno;
952
953 while (dlen > 1 && !dns->snddq.empty ())
954 {
955 int txtlen = dlen <= 255 ? dlen - 1 : 255;
956
957 if (txtlen > dns->snddq.size ())
958 txtlen = dns->snddq.size ();
959
960 pkt[offs++] = txtlen;
961 memcpy (pkt.at (offs), dns->snddq.begin (), txtlen);
479 offs += txtlen; 962 offs += txtlen;
963 dns->snddq.remove (txtlen);
480 964
481 //if (sndlen + txtlen > dns_snddq. 965 dlen -= txtlen + 1;
966 }
967 }
968
969 // avoid completely empty TXT rdata
970 if (offs == rdlen_offs)
971 pkt[offs++] = 0;
972
973 slog (L_NOISE, "DNS: snddq %d", dns->snddq.size ());
974 }
975 else
976 {
977 // send RST
978 pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
979 pkt [offs++] = CMD_IP_RST;
980 }
981
982 int rdlen = offs - rdlen_offs;
983
984 pkt [rdlen_offs - 2] = rdlen >> 8;
985 pkt [rdlen_offs - 1] = rdlen;
986
987 if (dns)
988 {
989 // now update dns_rcv copy
990 rcv->pkt->len = offs;
991 memcpy (rcv->pkt->at (0), pkt.at (0), offs);
992 }
993 }
994
995 duplicate_request: ;
996 }
997 else
998 pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
482 } 999 }
1000 else if (qtype == RR_TYPE_A
1001 && qlen > dlen + 1 + cdc26.encode_len (sizeof (dns_cfg)))
1002 {
1003 dns_cfg cfg;
1004 cdc26.decode ((u8 *)&cfg, qname, cdc26.encode_len (sizeof (dns_cfg)));
1005 int client = ntohs (cfg.client);
483 1006
484 int rdlen = offs - rdlen_offs; 1007 pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
485 1008
486 (*rep) [rdlen_offs - 2] = rdlen >> 8; 1009 pkt [offs++] = RR_TYPE_A >> 8; pkt [offs++] = RR_TYPE_A; // type
487 (*rep) [rdlen_offs - 1] = rdlen; 1010 pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
488#endif 1011 pkt [offs++] = 0; pkt [offs++] = 0;
1012 pkt [offs++] = 0; pkt [offs++] = cfg.def_ttl; // TTL
1013 pkt [offs++] = 0; pkt [offs++] = 4; // rdlength
1014
1015 slog (L_INFO, _("DNS: client %d connects"), client);
1016
1017 pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
1018 pkt [offs++] = CMD_IP_REJ;
1019
1020 if (0 < client && client <= conns.size ())
1021 {
1022 connection *c = conns [client - 1];
1023
1024 if (cfg.valid ())
1025 {
1026 pkt [offs - 1] = CMD_IP_SYN;
1027
1028 delete c->dns;
1029 c->dns = new dns_connection (c);
1030 c->dns->cfg = cfg;
1031 }
1032 }
1033 }
489 } 1034 }
490 }
491 1035
492 pkt->len = offs; 1036 pkt.len = offs;
493 return pkt; 1037 }
494} 1038}
495 1039
496void 1040void
497vpn::dnsv4_client (dns_packet *pkt) 1041vpn::dnsv4_client (dns_packet &pkt)
498{ 1042{
499 u16 flags = ntohs (pkt->flags); 1043 u16 flags = ntohs (pkt.flags);
500 int offs = 6 * 2; // skip header 1044 int offs = 6 * 2; // skip header
501 1045
502 pkt->qdcount = ntohs (pkt->qdcount); 1046 pkt.qdcount = ntohs (pkt.qdcount);
503 pkt->ancount = ntohs (pkt->ancount); 1047 pkt.ancount = ntohs (pkt.ancount);
504 1048
1049 // go through our request list and find the corresponding request
505 for (vector<dns_req *>::iterator i = dns_sndpq.begin (); 1050 for (vector<dns_snd *>::iterator i = dns_sndpq.begin ();
506 i != dns_sndpq.end (); 1051 i != dns_sndpq.end ();
507 ++i) 1052 ++i)
508 if ((*i)->pkt->id == pkt->id) 1053 if ((*i)->pkt->id == pkt.id)
509 { 1054 {
1055 dns_connection *dns = (*i)->dns;
510 connection *c = (*i)->conn; 1056 connection *c = dns->c;
511 printf ("GOT RESPONSE id %x %p\n", pkt->id, c);//D 1057 int seqno = (*i)->seqno;
1058 u8 data[MAXSIZE], *datap = data;
1059 //printf ("rcv pkt %x\n", seqno);//D
1060
1061 if ((*i)->retry)
1062 {
1063 dns->send_interval *= 1.01;
1064 if (dns->send_interval > MAX_SEND_INTERVAL)
1065 dns->send_interval = MAX_SEND_INTERVAL;
1066 }
1067 else
1068 {
1069#if 0
1070 dns->send_interval *= 0.999;
1071#endif
1072 // the latency surely puts an upper bound on
1073 // the minimum send interval
1074 double latency = ev_now () - (*i)->sent;
1075
1076 if (latency < dns->min_latency)
1077 dns->min_latency = latency;
1078
1079 if (dns->send_interval > dns->min_latency * conf.dns_overlap_factor)
1080 dns->send_interval = dns->min_latency * conf.dns_overlap_factor;
1081
1082 if (dns->send_interval < conf.dns_send_interval)
1083 dns->send_interval = conf.dns_send_interval;
1084 }
1085
512 delete *i; 1086 delete *i;
513 dns_sndpq.erase (i); 1087 dns_sndpq.erase (i);
514 1088
515 if (flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC)) 1089 if (flags & FLAG_RESPONSE && !(flags & FLAG_OP_MASK))
516 { 1090 {
517 char qname[MAXSIZE]; 1091 char qname[MAXSIZE];
518 1092
519 while (pkt->qdcount-- && offs < MAXSIZE - 4) 1093 while (pkt.qdcount-- && offs < MAXSIZE - 4)
520 { 1094 {
521 int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs); 1095 int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
522 offs += 4; // skip qtype, qclass 1096 offs += 4; // skip qtype, qclass
523 } 1097 }
524 1098
525 while (pkt->ancount-- && offs < MAXSIZE - 10) 1099 while (pkt.ancount-- && offs < MAXSIZE - 10 && datap)
526 { 1100 {
527 pkt->decode_label ((char *)qname, MAXSIZE - offs, offs); 1101 int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
528 1102
529 u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++]; 1103 u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
530 u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++]; 1104 u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
531 u32 ttl = (*pkt) [offs++] << 24; 1105 u32 ttl = pkt [offs++] << 24;
532 ttl |= (*pkt) [offs++] << 16; 1106 ttl |= pkt [offs++] << 16;
533 ttl |= (*pkt) [offs++] << 8; 1107 ttl |= pkt [offs++] << 8;
534 ttl |= (*pkt) [offs++]; 1108 ttl |= pkt [offs++];
535
536 u16 rdlen = (*pkt) [offs++] << 8; rdlen |= (*pkt) [offs++]; 1109 u16 rdlen = pkt [offs++] << 8; rdlen |= pkt [offs++];
537 1110
538 printf ("REPLY %d:%d TTL %d RD %d\n", qtype, qclass, ttl, rdlen); 1111 if (qtype == RR_TYPE_NULL || qtype == RR_TYPE_TXT)
539
540 offs += rdlen;
541
542 if (MAXSIZE - offs < rdlen)
543 { 1112 {
1113 if (rdlen <= MAXSIZE - offs)
1114 {
544 // decode bytes, finally 1115 // decode bytes, finally
1116
1117 while (rdlen)
1118 {
1119 int txtlen = pkt [offs++];
1120
1121 assert (txtlen + offs < MAXSIZE - 1);
1122
1123 memcpy (datap, pkt.at (offs), txtlen);
1124 datap += txtlen; offs += txtlen;
1125
1126 rdlen -= txtlen + 1;
1127 }
1128 }
1129 }
1130 else if (qtype == RR_TYPE_A)
1131 {
1132 u8 ip [4];
1133
1134 ip [0] = pkt [offs++];
1135 ip [1] = pkt [offs++];
1136 ip [2] = pkt [offs++];
1137 ip [3] = pkt [offs++];
1138
1139 if (ip [0] == CMD_IP_1
1140 && ip [1] == CMD_IP_2
1141 && ip [2] == CMD_IP_3)
1142 {
1143 slog (L_TRACE, _("DNS: got tunnel meta command %02x"), ip [3]);
1144
1145 if (ip [3] == CMD_IP_RST)
1146 {
1147 slog (L_DEBUG, _("DNS: got tunnel RST request"));
1148
1149 c->dnsv4_reset_connection ();
1150 }
1151 else if (ip [3] == CMD_IP_SYN)
1152 {
1153 slog (L_DEBUG, _("DNS: got tunnel SYN reply, server likes us."));
1154 dns->established = true;
1155 }
1156 else if (ip [3] == CMD_IP_REJ)
1157 slog (L_ERR, _("DNS: got tunnel REJ reply, server does not like us."));
1158 else
1159 slog (L_INFO, _("DNS: got unknown meta command %02x"), ip [3]);
1160 }
1161 else
1162 slog (L_INFO, _("DNS: got spurious a record %d.%d.%d.%d"),
1163 ip [0], ip [1], ip [2], ip [3]);
1164
1165 return;
1166 }
1167
1168 int client, rseqno;
1169 decode_header (qname, client, rseqno);
1170
1171 if (client != THISNODE->id)
1172 {
1173 slog (L_INFO, _("DNS: got dns tunnel response with wrong clientid, ignoring"));
1174 datap = 0;
1175 }
1176 else if (rseqno != seqno)
1177 {
1178 slog (L_DEBUG, _("DNS: got dns tunnel response with wrong seqno, badly caching nameserver?"));
1179 datap = 0;
545 } 1180 }
546 } 1181 }
547 } 1182 }
548 1183
1184 // todo: pkt now used
1185 if (datap)
1186 dns->receive_rep (new dns_rcv (seqno, data, datap - data));
1187
549 break; 1188 break;
550 } 1189 }
551} 1190}
552 1191
553void 1192void
554vpn::dnsv4_ev (io_watcher &w, short revents) 1193vpn::dnsv4_ev (ev::io &w, int revents)
555{ 1194{
556 if (revents & EVENT_READ) 1195 if (revents & EV_READ)
557 { 1196 {
558 dns_packet *pkt = new dns_packet; 1197 dns_packet *pkt = new dns_packet;
559 struct sockaddr_in sa; 1198 struct sockaddr_in sa;
560 socklen_t sa_len = sizeof (sa); 1199 socklen_t sa_len = sizeof (sa);
561 1200
562 pkt->len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len); 1201 pkt->len = recvfrom (w.fd, pkt->at (0), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
563 1202
564 if (pkt->len > 0) 1203 if (pkt->len > 0)
565 if (THISNODE->dns_port)
566 { 1204 {
567 pkt = dnsv4_server (pkt); 1205 if (ntohs (pkt->flags) & FLAG_RESPONSE)
568 sendto (w.fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)&sa, sa_len);
569 }
570 else
571 dnsv4_client (pkt); 1206 dnsv4_client (*pkt);
1207 else
1208 {
1209 dnsv4_server (*pkt);
1210 sendto (w.fd, pkt->at (0), pkt->len, 0, (sockaddr *)&sa, sa_len);
1211 }
1212
1213 delete pkt;
1214 }
572 } 1215 }
573} 1216}
574 1217
575bool 1218bool
576connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos) 1219vpn::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
577{ 1220{
578 // never initialized 1221 int client = ntohl (si.host);
579 if (!dns_snddq && !dns_rcvdq)
580 {
581 dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
582 dns_snddq = new byte_stream (MAX_BACKLOG);
583 1222
584 dns_rcvseq = dns_sndseq = 0; 1223 assert (0 < client && client <= conns.size ());
585 1224
586 dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4); 1225 connection *c = conns [client - 1];
587 } 1226
1227 if (!c->dns)
1228 c->dns = new dns_connection (c);
588 1229
589 if (!dns_snddq->put (pkt)) 1230 if (c->dns->snddq.put (pkt))
590 return false; 1231 c->dns->tw ();
591 1232
592 // start timer if neccessary 1233 // always return true even if the buffer overflows
593 if (!dnsv4_tw.active)
594 dnsv4_cb (dnsv4_tw);
595
596 return true; 1234 return true;
597} 1235}
598 1236
599void 1237void
600connection::dnsv4_cb (time_watcher &w) 1238connection::dnsv4_reset_connection ()
601{ 1239{
1240 //delete dns; dns = 0; //TODO
1241}
1242
1243#define NEXT(w) do { if (next > (w)) next = w; } while (0)
1244
1245void
1246dns_connection::time_cb (ev::timer &w, int revents)
1247{
1248 // servers have to be polled
1249 if (THISNODE->dns_port)
1250 return;
1251
602 // check for timeouts and (re)transmit 1252 // check for timeouts and (re)transmit
603 tstamp next = NOW + 60; 1253 tstamp next = ev::now () + poll_interval;
604 dns_req *send = 0; 1254 dns_snd *send = 0;
605 1255
606 slog (L_NOISE, _("dnsv4, %d packets in send queue\n"), vpn->dns_sndpq.size ());
607
608 for (vector<dns_req *>::iterator i = vpn->dns_sndpq.begin (); 1256 for (vector<dns_snd *>::iterator i = vpn->dns_sndpq.begin ();
609 i != vpn->dns_sndpq.end (); 1257 i != vpn->dns_sndpq.end ();
610 ++i) 1258 ++i)
611 { 1259 {
612 dns_req *r = *i; 1260 dns_snd *r = *i;
613 1261
614 if (r->next <= NOW) 1262 if (r->timeout <= ev_now ())
615 { 1263 {
616 if (!send) 1264 if (!send)
617 { 1265 {
618 send = r; 1266 send = r;
619 1267
620 slog (L_NOISE, _("dnsv4, send req %d\n"), r->pkt->id);
621 r->retry++; 1268 r->retry++;
622 r->next = NOW + r->retry; 1269 r->timeout = ev_now () + (r->retry * min_latency * conf.dns_timeout_factor);
1270 //printf ("RETRY %x (%d, %f)\n", r->seqno, r->retry, r->timeout - ev_now ());//D
1271
1272 // the following code changes the query section a bit, forcing
1273 // the forwarder to generate a new request
1274 if (r->stdhdr)
1275 encode_header ((char *)r->pkt->at (6 * 2 + 1), THISNODE->id, r->seqno, r->retry);
623 } 1276 }
624 } 1277 }
625 1278 else
626 if (r->next < next) 1279 NEXT (r->timeout);
627 next = r->next;
628 } 1280 }
629 1281
630 if (!send 1282 if (!send)
631 && vpn->dns_sndpq.size () < MAX_OUTSTANDING) 1283 {
632 send = new dns_req (this, dns_sndseq++, dns_snddq); 1284 // generate a new packet, if wise
633 1285
634 tstamp min_next = NOW + (1. / (tstamp)MAX_RATE); 1286 if (!established)
1287 {
1288 if (vpn->dns_sndpq.empty ())
1289 {
1290 send = new dns_snd (this);
1291
1292 cfg.reset (THISNODE->id);
1293 send->gen_syn_req ();
1294 }
1295 }
1296 else if (vpn->dns_sndpq.size () < conf.dns_max_outstanding
1297 && !SEQNO_EQ (rcvseq, sndseq - (MAX_WINDOW - 1)))
1298 {
1299 if (last_sent + send_interval <= ev_now ())
1300 {
1301 //printf ("sending data request etc.\n"); //D
1302 if (!snddq.empty () || last_received + 1. > ev_now ())
1303 {
1304 poll_interval = send_interval;
1305 NEXT (ev_now () + send_interval);
1306 }
1307
1308 send = new dns_snd (this);
1309 send->gen_stream_req (sndseq, snddq);
1310 send->timeout = ev_now () + min_latency * conf.dns_timeout_factor;
1311 //printf ("SEND %x (%f)\n", send->seqno, send->timeout - ev_now (), min_latency, conf.dns_timeout_factor);//D
1312
1313 sndseq = (sndseq + 1) & SEQNO_MASK;
1314 }
1315 else
1316 NEXT (last_sent + send_interval);
1317 }
1318
1319 if (send)
1320 vpn->dns_sndpq.push_back (send);
1321 }
635 1322
636 if (send) 1323 if (send)
637 { 1324 {
638 dns_packet *pkt = send->pkt; 1325 last_sent = ev_now ();
639 1326 sendto (vpn->dnsv4_fd,
640 next = min_next; 1327 send->pkt->at (0), send->pkt->len, 0,
641 1328 vpn->dns_forwarder.sav4 (), vpn->dns_forwarder.salenv4 ());
642 sendto (vpn->dnsv4_fd, &((*pkt)[0]), pkt->len, 0, dns_si.sav4 (), dns_si.salenv4 ());
643 } 1329 }
644 else if (next < min_next)
645 next = min_next;
646 1330
647 w.start (next); 1331 slog (L_NOISE, "DNS: pi %f si %f N %f (%d:%d %d)",
1332 poll_interval, send_interval, next - ev_now (),
1333 vpn->dns_sndpq.size (), snddq.size (),
1334 rcvpq.size ());
1335
1336 // TODO: no idea when this happens, but when next < ev_now (), we have a problem
1337 // doesn't seem to happen anymore
1338 if (next < ev_now () + 0.001)
1339 next = ev_now () + 0.1;
1340
1341 w.start (next - ev_now ());
648} 1342}
649 1343
650#endif 1344#endif
651 1345

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines