ViewVC Help

View File | Revision Log | Show Annotations | Download File

/cvs/gvpe/src/vpn_dns.C

Comparing gvpe/src/vpn_dns.C (file contents):
Revision 1.4 by pcg, Wed Mar 2 05:49:31 2005 UTC vs.
Revision 1.48 by pcg, Tue Jul 28 00:42:14 2009 UTC

1	/*	1	/*
2	vpn_dns.C -- handle the dns tunnel part of the protocol.	2	vpn_dns.C -- handle the dns tunnel part of the protocol.
3	Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>	3	Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4		4
		5	This file is part of GVPE.
		6
5	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
6	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
7	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
8	(at your option) any later version.	10	option) any later version.
9		11
10	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
11	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
12	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13	GNU General Public License for more details.	15	Public License for more details.
14		16
15	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
16	along with this program; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
17	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
18	*/	30	*/
		31
		32	// TODO: EDNS0 option to increase dns mtu?
		33	// TODO: re-write dns packet parsing/creation using a safe mem-buffer
		34	// to ensure no buffer overflows or similar problems.
19		35
20	#include "config.h"	36	#include "config.h"
21		37
22	#if ENABLE_DNS	38	#if ENABLE_DNS
23		39
24	// dns processing is EXTREMELY ugly. For obvious(?) reasons.	40	// dns processing is EXTREMELY ugly. For obvious(?) reasons.
25	// it's a hack, use only in emergency situations please.	41	// it's a hack, use only in emergency situations please.
26		42
27	#include <cstring>	43	#include <cstring>
		44	#include <cassert>
28		45
29	#include <sys/types.h>	46	#include <sys/types.h>
30	#include <sys/socket.h>	47	#include <sys/socket.h>
31	#include <sys/wait.h>	48	#include <sys/wait.h>
32	#include <sys/uio.h>	49	#include <sys/uio.h>
…		…
35	#include <unistd.h>	52	#include <unistd.h>
36	#include <fcntl.h>	53	#include <fcntl.h>
37		54
38	#include <map>	55	#include <map>
39		56
		57	#include <cstdio> /* bug in libgmp: gmp.h relies on cstdio being included */
		58	#include <gmp.h>
		59
40	#include "netcompat.h"	60	#include "netcompat.h"
41		61
42	#include "vpn.h"	62	#include "vpn.h"
43		63
44	#define MIN_RETRY 1.	64	#define MAX_POLL_INTERVAL 5. // how often to poll minimally when the server has no data
45	#define MAX_RETRY 60.	65	#define ACTIVITY_INTERVAL 5.
46		66
47	#define MAX_OUTSTANDING 10 // max. outstanding requests	67	#define INITIAL_TIMEOUT 0.1 // retry timeouts
		68	#define INITIAL_SYN_TIMEOUT 2. // retry timeout for initial syn
		69
		70	#define MAX_SEND_INTERVAL 2. // optimistic?
		71
48	#define MAX_WINDOW 100 // max. for MAX_OUTSTANDING	72	#define MAX_WINDOW 1000 // max. for MAX_OUTSTANDING, and backlog
49	#define MAX_RATE 1 // requests/s
50	#define MAX_BACKLOG (10*1024) // size of protocol backlog	73	#define MAX_BACKLOG (64*1024) // size of gvpe protocol backlog (bytes), must be > MAXSIZE
51		74
52	/*	75	#define MAX_DOMAIN_SIZE 240 // 255 is legal limit, but bind doesn't compress well
		76	// 240 leaves about 4 bytes of server reply data
		77	// every request byte less give room for two reply bytes
53		78
54	protocol, in shorthand :)	79	#define SEQNO_MASK 0x3fff
55		80	#define SEQNO_EQ(a,b) ( 0 == ( ((a) ^ (b)) & SEQNO_MASK) )
56	client -> server <req> ANY?
57	server -> client <req> TXT <rep>
58
59	<req> is dns64-encoded <client-id:12><recv-seqno:10>[<send-seqno:10><data>]
60	<rep> is dns64-encoded <0:12><recv-seqno:10>[<send-seqno:10><data>]
61
62	if <client-id> is zero, the connection will be configured:
63
64	<0:12><0:4>client-id:12><default-ttl:8><max-size:16><flags:16>
65
66	*/
67		81
68	#define MAX_LBL_SIZE 63	82	#define MAX_LBL_SIZE 63
69	#define MAX_PKT_SIZE 512	83	#define MAX_PKT_SIZE 512
70		84
		85	#define RR_TYPE_A 1
		86	#define RR_TYPE_NULL 10
71	#define RR_TYPE_TXT 16	87	#define RR_TYPE_TXT 16
		88	#define RR_TYPE_AAAA 28
72	#define RR_TYPE_ANY 255	89	#define RR_TYPE_ANY 255
		90
73	#define RR_CLASS_IN 1	91	#define RR_CLASS_IN 1
74		92
75	// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative)	93	#define CMD_IP_1 207
76	struct dns64	94	#define CMD_IP_2 46
77	{	95	#define CMD_IP_3 236
78	static const char encode_chars[64 + 1];	96	#define CMD_IP_RST 29
79	static s8 decode_chars[256];	97	#define CMD_IP_SYN 113
		98	#define CMD_IP_REJ 32
80		99
81	static int encode_len (int bytes) { return (bytes * 8 + 5) / 6; }	100	// works for cmaps up to 255 (not 256!)
82	static int decode_len (int bytes) { return (bytes * 6) / 8; }	101	struct charmap
		102	{
		103	enum { INVALID = (u8)255 };
		104
		105	char encode [256]; // index => char
		106	u8 decode [256]; // char => index
		107	unsigned int size;
		108
		109	charmap (const char *cmap);
		110	};
		111
		112	charmap::charmap (const char *cmap)
		113	{
		114	char *enc = encode;
		115	u8 *dec = decode;
		116
		117	memset (enc, (char) 0, 256);
		118	memset (dec, (char)INVALID, 256);
		119
		120	for (size = 0; cmap [size]; size++)
		121	{
		122	enc [size] = cmap [size];
		123	dec [(u8)enc [size]] = size;
		124	}
		125
		126	assert (size < 256);
		127	}
		128
		129	#define MAX_DEC_LEN 500
		130	#define MAX_ENC_LEN (MAX_DEC_LEN * 2)
		131	#define MAX_LIMBS ((MAX_DEC_LEN * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
		132
		133	// ugly. minimum base is 16(!)
		134	struct basecoder
		135	{
		136	charmap cmap;
		137	unsigned int enc_len [MAX_DEC_LEN];
		138	unsigned int dec_len [MAX_ENC_LEN];
		139
		140	unsigned int encode_len (unsigned int len);
		141	unsigned int decode_len (unsigned int len);
		142
83	static int encode (char *dst, u8 *src, int len);	143	unsigned int encode (char *dst, u8 *src, unsigned int len);
84	static int decode (u8 *dst, char *src, int len);	144	unsigned int decode (u8 *dst, char *src, unsigned int len);
85		145
86	dns64 ();	146	basecoder (const char *cmap);
87	} dns64;	147	};
88		148
89	const char dns64::encode_chars[64 + 1] = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-";	149	basecoder::basecoder (const char *cmap)
90	s8 dns64::decode_chars[256];	150	: cmap (cmap)
91
92	dns64::dns64 ()
93	{	151	{
94	for (int i = 0; i < 64; i++)	152	for (unsigned int len = 0; len < MAX_DEC_LEN; ++len)
95	decode_chars [encode_chars [i]] = i + 1;	153	{
96	}	154	u8 src [MAX_DEC_LEN];
		155	u8 dst [MAX_ENC_LEN];
97		156
98	int dns64::encode (char *dst, u8 *src, int len)	157	memset (src, 255, len);
		158
		159	mp_limb_t m [MAX_LIMBS];
		160	mp_size_t n;
		161
		162	n = mpn_set_str (m, src, len, 256);
		163	n = mpn_get_str (dst, this->cmap.size, m, n);
		164
		165	for (int i = 0; !dst [i]; ++i)
		166	n--;
		167
		168	enc_len [len] = n;
		169	dec_len [n] = len;
		170	}
		171	}
		172
		173	unsigned int basecoder::encode_len (unsigned int len)
99	{	174	{
100	// slow, but easy to debug	175	return enc_len [len];
101	char *beg = dst;	176	}
102	unsigned int accum, bits = 0;	177
		178	unsigned int basecoder::decode_len (unsigned int len)
		179	{
		180	while (len && !dec_len [len])
		181	--len;
		182
		183	return dec_len [len];
		184	}
		185
		186	unsigned int basecoder::encode (char *dst, u8 *src, unsigned int len)
		187	{
		188	if (!len || len > MAX_DEC_LEN)
		189	return 0;
		190
		191	int elen = encode_len (len);
		192
		193	mp_limb_t m [MAX_LIMBS];
		194	mp_size_t n;
		195
		196	u8 dst_ [MAX_ENC_LEN];
		197
		198	n = mpn_set_str (m, src, len, 256);
		199	n = mpn_get_str (dst_, cmap.size, m, n);
		200
		201	int plen = elen; // for padding
		202
		203	while (n < plen)
		204	{
		205	*dst++ = cmap.encode [0];
		206	plen--;
		207	}
		208
		209	for (unsigned int i = n - plen; i < n; ++i)
		210	*dst++ = cmap.encode [dst_ [i]];
		211
		212	return elen;
		213	}
		214
		215	unsigned int basecoder::decode (u8 *dst, char *src, unsigned int len)
		216	{
		217	if (!len || len > MAX_ENC_LEN)
		218	return 0;
		219
		220	u8 src_ [MAX_ENC_LEN];
		221	unsigned int elen = 0;
103		222
104	while (len--)	223	while (len--)
105	{	224	{
106	accum <<= 8;	225	u8 val = cmap.decode [(u8)*src++];
107	accum |= *src++;
108	bits += 8;
109		226
110	while (bits >= 6)	227	if (val != charmap::INVALID)
111	{	228	src_ [elen++] = val;
112	*dst++ = encode_chars [(accum >> (bits - 6)) & 63];	229	}
113	bits -= 6;	230
114	}	231	int dlen = decode_len (elen);
		232
		233	mp_limb_t m [MAX_LIMBS];
		234	mp_size_t n;
		235
		236	u8 dst_ [MAX_DEC_LEN];
		237
		238	n = mpn_set_str (m, src_, elen, cmap.size);
		239	n = mpn_get_str (dst_, 256, m, n);
		240
		241	if (n < dlen)
115	}	242	{
		243	memset (dst, 0, dlen - n);
		244	memcpy (dst + dlen - n, dst_, n);
		245	}
		246	else
		247	memcpy (dst, dst_ + n - dlen, dlen);
116		248
117	if (bits)	249	return dlen;
118	*dst++ = encode_chars [(accum << (6 - bits)) & 63];
119
120	return dst - beg;
121	}	250	}
122		251
123	int dns64::decode (u8 *dst, char *src, int len)	252	#if 0
124	{	253	struct test { test (); } test;
125	// slow, but easy to debug
126	u8 *beg = dst;
127	unsigned int accum, bits = 0;
128		254
129	while (len--)	255	test::test ()
		256	{
		257	basecoder cdc ("0123456789abcdefghijklmnopqrstuvwxyz");
		258
		259	u8 in[] = "0123456789abcdefghijklmnopqrstuvwxyz";
		260	static char enc[200];
		261	static u8 dec[200];
		262
		263	for (int i = 1; i < 20; i++)
130	{	264	{
131	s8 chr = decode_chars [(u8)*src++];	265	int elen = cdc.encode (enc, in, i);
		266	int dlen = cdc.decode (dec, enc, elen);
132		267
133	if (!chr)	268	printf ("%d>%d>%d (%s>%s)\n", i, elen, dlen, enc, dec);
134	break;
135
136	accum <<= 6;
137	accum |= chr - 1;
138	bits += 6;
139
140	while (bits >= 8)
141	{
142	*dst++ = accum >> (bits - 8);
143	bits -= 8;
144	}
145	}	269	}
		270	abort ();
		271	}
		272	#endif
146		273
147	return dst - beg;	274	//static basecoder cdc64 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI-");
		275	//static basecoder cdc63 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
		276	static basecoder cdc62 ("dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
		277	//static basecoder cdc36 ("dphzr06qmjkb34tsvl81xaef92wgyo57ucni"); // unused as of yet
		278	static basecoder cdc26 ("dPhZrQmJkBtSvLxAeFwGyO");
		279
		280	/////////////////////////////////////////////////////////////////////////////
		281
		282	#define HDRSIZE 6
		283
		284	inline void encode_header (char *data, int clientid, int seqno, int retry = 0)
		285	{
		286	seqno &= SEQNO_MASK;
		287
		288	u8 hdr[3] = {
		289	clientid,
		290	(seqno >> 8) | (retry << 6),
		291	seqno,
		292	};
		293
		294	assert (clientid < 256);
		295
		296	cdc26.encode (data, hdr, 3);
		297	}
		298
		299	inline void decode_header (char *data, int &clientid, int &seqno)
		300	{
		301	u8 hdr[3];
		302
		303	cdc26.decode (hdr, data, HDRSIZE);
		304
		305	clientid = hdr[0];
		306	seqno = ((hdr[1] << 8) | hdr[2]) & SEQNO_MASK;
148	}	307	}
149		308
150	/////////////////////////////////////////////////////////////////////////////	309	/////////////////////////////////////////////////////////////////////////////
151		310
152	struct byte_stream	311	struct byte_stream
…		…
159	~byte_stream ();	318	~byte_stream ();
160		319
161	bool empty () { return !fill; }	320	bool empty () { return !fill; }
162	int size () { return fill; }	321	int size () { return fill; }
163		322
		323	bool put (u8 *data, unsigned int datalen);
164	bool put (vpn_packet *pkt);	324	bool put (vpn_packet *pkt);
165	vpn_packet *get ();	325	vpn_packet *get ();
166		326
167	u8 *begin () { return data; }	327	u8 *begin () { return data; }
168	void remove (int count);	328	void remove (int count);
…		…
180	}	340	}
181		341
182	void byte_stream::remove (int count)	342	void byte_stream::remove (int count)
183	{	343	{
184	if (count > fill)	344	if (count > fill)
185	abort ();	345	assert (count <= fill);
186		346
187	memmove (data, data + count, fill -= count);	347	memmove (data, data + count, fill -= count);
		348	}
		349
		350	bool byte_stream::put (u8 *data, unsigned int datalen)
		351	{
		352	if (maxsize - fill < datalen)
		353	return false;
		354
		355	memcpy (this->data + fill, data, datalen); fill += datalen;
		356
		357	return true;
188	}	358	}
189		359
190	bool byte_stream::put (vpn_packet *pkt)	360	bool byte_stream::put (vpn_packet *pkt)
191	{	361	{
192	if (maxsize - fill < pkt->len + 2)	362	if (maxsize - fill < pkt->len + 2)
193	return false;	363	return false;
194		364
195	data [fill++] = pkt->len >> 8;	365	data [fill++] = pkt->len >> 8;
196	data [fill++] = pkt->len;	366	data [fill++] = pkt->len;
197		367
198	memcpy (data + fill, &((*pkt)[0]), pkt->len); fill += pkt->len;	368	memcpy (data + fill, pkt->at (0), pkt->len); fill += pkt->len;
199		369
200	return true;	370	return true;
201	}	371	}
202		372
203	vpn_packet *byte_stream::get ()	373	vpn_packet *byte_stream::get ()
204	{	374	{
		375	unsigned int len;
		376
		377	for (;;)
		378	{
205	int len = (data [0] << 8) | data [1];	379	len = (data [0] << 8) | data [1];
206		380
		381	if (len <= MAXSIZE || fill < 2)
		382	break;
		383
		384	// TODO: handle this better than skipping, e.g. by reset
		385	slog (L_DEBUG, _("DNS: corrupted packet stream skipping a byte..."));
		386	remove (1);
		387	}
		388
207	if (fill < len + 2)	389	if (fill < len + 2)
208	return 0;	390	return 0;
209		391
210	vpn_packet *pkt = new vpn_packet;	392	vpn_packet *pkt = new vpn_packet;
		393
		394	pkt->len = len;
211	memcpy (&((*pkt)[0]), data + 2, len);	395	memcpy (pkt->at (0), data + 2, len);
212	remove (len + 2);	396	remove (len + 2);
213		397
214	return pkt;	398	return pkt;
215	}	399	}
216		400
217	/////////////////////////////////////////////////////////////////////////////	401	/////////////////////////////////////////////////////////////////////////////
218		402
219	#define FLAG_QUERY ( 0 << 15)	403	#define FLAG_QUERY ( 0 << 15)
220	#define FLAG_RESPONSE ( 1 << 15)	404	#define FLAG_RESPONSE ( 1 << 15)
221	#define FLAG_OP_MASK (15 << 14)	405	#define FLAG_OP_MASK (15 << 11)
222	#define FLAG_OP_QUERY ( 0 << 11)	406	#define FLAG_OP_QUERY ( 0 << 11)
223	#define FLAG_AA ( 1 << 10)	407	#define FLAG_AA ( 1 << 10)
224	#define FLAG_TC ( 1 << 9)	408	#define FLAG_TC ( 1 << 9)
225	#define FLAG_RD ( 1 << 8)	409	#define FLAG_RD ( 1 << 8)
226	#define FLAG_RA ( 1 << 7)	410	#define FLAG_RA ( 1 << 7)
		411	#define FLAG_AUTH ( 1 << 5)
227	#define FLAG_RCODE_MASK (15 << 0)	412	#define FLAG_RCODE_MASK (15 << 0)
228	#define FLAG_RCODE_OK ( 0 << 0)	413	#define FLAG_RCODE_OK ( 0 << 0)
229	#define FLAG_RCODE_FORMERR ( 1 << 0)	414	#define FLAG_RCODE_FORMERR ( 1 << 0)
230	#define FLAG_RCODE_SERVFAIL ( 2 << 0)	415	#define FLAG_RCODE_SERVFAIL ( 2 << 0)
231	#define FLAG_RCODE_NXDOMAIN ( 3 << 0)	416	#define FLAG_RCODE_NXDOMAIN ( 3 << 0)
232	#define FLAG_RCODE_REFUSED ( 5 << 0)	417	#define FLAG_RCODE_REFUSED ( 5 << 0)
233		418
234	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)	419	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)
235	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD)	420	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)
		421
		422	struct dns_cfg
		423	{
		424	static int next_uid;
		425
		426	u8 id1, id2, id3, id4;
		427
		428	u8 version;
		429	u8 flags;
		430	u8 rrtype;
		431	u8 def_ttl;
		432
		433	u16 client;
		434	u16 uid; // to make request unique
		435
		436	u16 max_size;
		437	u8 seq_cdc;
		438	u8 req_cdc;
		439
		440	u8 rep_cdc;
		441	u8 delay; // time in 0.01s units that the server may delay replying packets
		442	u8 r3, r4;
		443
		444	u8 r5, r6, r7, r8;
		445
		446	void reset (int clientid);
		447	bool valid ();
		448	};
		449
		450	int dns_cfg::next_uid;
		451
		452	void dns_cfg::reset (int clientid)
		453	{
		454	id1 = 'G';
		455	id2 = 'V';
		456	id3 = 'P';
		457	id4 = 'E';
		458
		459	version = 1;
		460
		461	rrtype = RR_TYPE_TXT;
		462	flags = 0;
		463	def_ttl = 0;
		464	seq_cdc = 26;
		465	req_cdc = 62;
		466	rep_cdc = 0;
		467	max_size = htons (MAX_PKT_SIZE);
		468	client = htons (clientid);
		469	uid = next_uid++;
		470	delay = 0;
		471
		472	r3 = r4 = 0;
		473	r4 = r5 = r6 = r7 = 0;
		474	}
		475
		476	bool dns_cfg::valid ()
		477	{
		478	// although the protocol itself allows for some configurability,
		479	// only the following encoding/decoding settings are implemented.
		480	return id1 == 'G'
		481	&& id2 == 'V'
		482	&& id3 == 'P'
		483	&& id4 == 'E'
		484	&& seq_cdc == 26
		485	&& req_cdc == 62
		486	&& rep_cdc == 0
		487	&& version == 1;
		488	}
236		489
237	struct dns_packet : net_packet	490	struct dns_packet : net_packet
238	{	491	{
239	u16 id;	492	u16 id;
240	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4	493	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
241	u16 qdcount, ancount, nscount, arcount;	494	u16 qdcount, ancount, nscount, arcount;
242		495
243	u8 data[MAXSIZE - 6 * 2];	496	u8 data [MAXSIZE - 6 * 2];
244		497
245	int decode_label (char *data, int size, int &offs);	498	int decode_label (char *data, int size, int &offs);
246	};	499	};
247		500
248	int dns_packet::decode_label (char *data, int size, int &offs)	501	int dns_packet::decode_label (char *data, int size, int &offs)
…		…
279	return data - orig;	532	return data - orig;
280	}	533	}
281		534
282	/////////////////////////////////////////////////////////////////////////////	535	/////////////////////////////////////////////////////////////////////////////
283		536
		537	static u16 dns_id = 0; // TODO: should be per-vpn
		538
		539	static u16 next_id ()
		540	{
		541	if (!dns_id)
		542	dns_id = time (0);
		543
		544	// the simplest lsfr with periodicity 65535 i could find
		545	dns_id = (dns_id << 1)
		546	| (((dns_id >> 1)
		547	^ (dns_id >> 2)
		548	^ (dns_id >> 4)
		549	^ (dns_id >> 15)) & 1);
		550
		551	return dns_id;
		552	}
		553
284	struct dns_req	554	struct dns_rcv;
		555	struct dns_snd;
		556
		557	struct dns_connection
		558	{
		559	connection *c;
		560	struct vpn *vpn;
		561
		562	dns_cfg cfg;
		563
		564	bool established;
		565
		566	tstamp last_received;
		567	tstamp last_sent;
		568	double min_latency;
		569	double poll_interval, send_interval;
		570
		571	vector<dns_rcv *> rcvpq;
		572
		573	byte_stream rcvdq; int rcvseq; int repseq;
		574	byte_stream snddq; int sndseq;
		575
		576	inline void time_cb (ev::timer &w, int revents); ev::timer tw;
		577	void receive_rep (dns_rcv *r);
		578
		579	dns_connection (connection *c);
		580	~dns_connection ();
		581	};
		582
		583	struct dns_snd
285	{	584	{
286	dns_packet *pkt;	585	dns_packet *pkt;
287	tstamp next;	586	tstamp timeout, sent;
288	int retry;	587	int retry;
289	connection *conn;	588	struct dns_connection *dns;
		589	int seqno;
		590	bool stdhdr;
290		591
291	dns_req (connection *c, int seqno, byte_stream *stream);	592	void gen_stream_req (int seqno, byte_stream &stream);
		593	void gen_syn_req ();
		594
		595	dns_snd (dns_connection *dns);
		596	~dns_snd ();
292	};	597	};
293		598
294	struct dns_rep	599	dns_snd::dns_snd (dns_connection *dns)
		600	: dns (dns)
295	{	601	{
296	};	602	timeout = 0;
297
298	static u16 dns_id; // TODO: should be per-vpn
299
300	dns_req::dns_req (connection *c, int seqno, byte_stream *stream)
301	: conn (c)
302	{
303	next = 0;
304	retry = 0;	603	retry = 0;
		604	seqno = 0;
		605	sent = ev_now ();
		606	stdhdr = false;
305		607
306	pkt = new dns_packet;	608	pkt = new dns_packet;
307		609
308	pkt->id = dns_id++;	610	pkt->id = next_id ();
309	pkt->flags = DEFAULT_CLIENT_FLAGS;	611	}
310	pkt->qdcount = htons (1);
311	pkt->ancount = 0;
312	pkt->nscount = 0;
313	pkt->arcount = 0;
314		612
315	int offs = 6*2;	613	dns_snd::~dns_snd ()
316	int dlen = 255 - strlen (THISNODE->domain) - 1; // here we always have room for the max. label length	614	{
		615	delete pkt;
		616	}
317		617
318	u8 lbl[64]; //D	618	static void append_domain (dns_packet &pkt, int &offs, const char *domain)
319	char enc[65];	619	{
320	int lbllen = 3;
321	lbl[0] = c->conf->id; //D
322	lbl[1] = seqno >> 8; //D
323	lbl[2] = seqno; //D
324
325	while (dlen > 0)
326	{
327	int sndlen = dlen;
328
329	if (sndlen + lbllen > dns64::decode_len (MAX_LBL_SIZE))
330	sndlen = dns64::decode_len (MAX_LBL_SIZE) - lbllen;
331
332	if (sndlen > stream->size ())
333	sndlen = stream->size ();
334
335	if (sndlen + lbllen == 0)
336	break;
337
338	memcpy (lbl + lbllen, stream->begin (), sndlen);
339	stream->remove (sndlen);
340	lbllen += sndlen;
341
342	dns64::encode (enc, lbl, lbllen);
343
344	int elen = dns64::encode_len (lbllen);
345	(*pkt)[offs++] = elen;
346	memcpy (&((*pkt)[offs]), enc, elen);
347	offs += elen;
348	dlen -= elen + 1;
349
350	lbllen = 0;
351	}
352
353	const char *suffix = THISNODE->domain;
354
355	// add tunnel domain	620	// add tunnel domain
356	for (;;)	621	for (;;)
357	{	622	{
358	const char *end = strchr (suffix, '.');	623	const char *end = strchr (domain, '.');
359		624
360	if (!end)	625	if (!end)
361	end = suffix + strlen (suffix);	626	end = domain + strlen (domain);
362		627
363	int len = end - suffix;	628	int len = end - domain;
364		629
365	(*pkt)[offs++] = len;	630	pkt [offs++] = len;
366	memcpy (&((*pkt)[offs]), suffix, len);	631	memcpy (pkt.at (offs), domain, len);
367	offs += len;	632	offs += len;
368		633
369	if (!*end)	634	if (!*end)
370	break;	635	break;
371		636
372	suffix = end + 1;	637	domain = end + 1;
		638	}
		639	}
		640
		641	void dns_snd::gen_stream_req (int seqno, byte_stream &stream)
		642	{
		643	stdhdr = true;
		644	this->seqno = seqno;
		645
		646	timeout = ev_now () + INITIAL_TIMEOUT;
		647
		648	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
		649	pkt->qdcount = htons (1);
		650
		651	int offs = 6*2;
		652	int dlen = MAX_DOMAIN_SIZE - (strlen (dns->c->conf->domain) + 2);
		653	// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
		654	// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra
		655
		656	char enc[256], *encp = enc;
		657	encode_header (enc, THISNODE->id, seqno);
		658
		659	int datalen = cdc62.decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE - HDRSIZE);
		660
		661	if (datalen > stream.size ())
		662	datalen = stream.size ();
		663
		664	int enclen = cdc62.encode (enc + HDRSIZE, stream.begin (), datalen) + HDRSIZE;
		665	stream.remove (datalen);
		666
		667	while (enclen)
373	}	668	{
		669	int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;
		670
		671	(*pkt)[offs++] = lbllen;
		672	memcpy (pkt->at (offs), encp, lbllen);
		673
		674	offs += lbllen;
		675	encp += lbllen;
		676
		677	enclen -= lbllen;
		678	}
		679
		680	append_domain (*pkt, offs, dns->c->conf->domain);
374		681
375	(*pkt)[offs++] = 0;	682	(*pkt)[offs++] = 0;
376	(*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;	683	(*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;
377	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;	684	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
378		685
379	pkt->len = offs;	686	pkt->len = offs;
		687	}
380		688
381	c->vpn->dns_sndpq.push_back (this);	689	void dns_snd::gen_syn_req ()
		690	{
		691	timeout = ev_now () + INITIAL_SYN_TIMEOUT;
		692
		693	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
		694	pkt->qdcount = htons (1);
		695
		696	int offs = 6 * 2;
		697
		698	int elen = cdc26.encode ((char *)pkt->at (offs + 1), (u8 *)&dns->cfg, sizeof (dns_cfg));
		699
		700	assert (elen <= MAX_LBL_SIZE);
		701
		702	(*pkt)[offs] = elen;
		703	offs += elen + 1;
		704	append_domain (*pkt, offs, dns->c->conf->domain);
		705
		706	(*pkt)[offs++] = 0;
		707	(*pkt)[offs++] = RR_TYPE_A >> 8; (*pkt)[offs++] = RR_TYPE_A;
		708	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
		709
		710	pkt->len = offs;
		711	}
		712
		713	struct dns_rcv
		714	{
		715	int seqno;
		716	dns_packet *pkt; // reply packet
		717	u8 data [MAXSIZE]; // actually part of the reply packet...
		718	int datalen;
		719
		720	dns_rcv (int seqno, u8 *data, int datalen);
		721	~dns_rcv ();
		722	};
		723
		724	dns_rcv::dns_rcv (int seqno, u8 *data, int datalen)
		725	: seqno (seqno), pkt (new dns_packet), datalen (datalen)
		726	{
		727	memcpy (this->data, data, datalen);
		728	}
		729
		730	dns_rcv::~dns_rcv ()
		731	{
		732	delete pkt;
382	}	733	}
383		734
384	/////////////////////////////////////////////////////////////////////////////	735	/////////////////////////////////////////////////////////////////////////////
385		736
386	struct dns_cfg	737	dns_connection::dns_connection (connection *c)
		738	: c (c)
		739	, rcvdq (MAX_BACKLOG * 2)
		740	, snddq (MAX_BACKLOG)
387	{	741	{
388	u8 id1, id2, id3;	742	tw.set<dns_connection, &dns_connection::time_cb> (this);
389	u8 def_ttl;
390	u8 unused1;
391	u16 max_size;
392	u8 flags1, flags2;
393	};
394		743
395	dns_packet *	744	vpn = c->vpn;
		745
		746	established = false;
		747
		748	rcvseq = repseq = sndseq = 0;
		749
		750	last_sent = last_received = 0;
		751	poll_interval = 0.5; // starting here
		752	send_interval = 0.5; // starting rate
		753	min_latency = INITIAL_TIMEOUT;
		754	}
		755
		756	dns_connection::~dns_connection ()
		757	{
		758	for (vector<dns_rcv *>::iterator i = rcvpq.begin ();
		759	i != rcvpq.end ();
		760	++i)
		761	delete *i;
		762	}
		763
		764	void dns_connection::receive_rep (dns_rcv *r)
		765	{
		766	if (r->datalen)
		767	{
		768	last_received = ev_now ();
		769	tw ();
		770
		771	poll_interval = send_interval;
		772	}
		773	else
		774	{
		775	poll_interval *= 1.5;
		776
		777	if (poll_interval > MAX_POLL_INTERVAL)
		778	poll_interval = MAX_POLL_INTERVAL;
		779	}
		780
		781	rcvpq.push_back (r);
		782
		783	redo:
		784
		785	// find next packet
		786	for (vector<dns_rcv *>::iterator i = rcvpq.end (); i-- != rcvpq.begin (); )
		787	if (SEQNO_EQ (rcvseq, (*i)->seqno))
		788	{
		789	//printf ("seqno eq %x %x\n", rcvseq, (*i)->seqno);//D
		790	// enter the packet into our input stream
		791	r = *i;
		792
		793	// remove the oldest packet, look forward, as it's oldest first
		794	for (vector<dns_rcv *>::iterator j = rcvpq.begin (); j != rcvpq.end (); ++j)
		795	if (SEQNO_EQ ((*j)->seqno, rcvseq - MAX_WINDOW))
		796	{
		797	//printf ("seqno RR %x %x\n", (*j)->seqno, rcvseq - MAX_WINDOW);//D
		798	delete *j;
		799	rcvpq.erase (j);
		800	break;
		801	}
		802
		803	rcvseq = (rcvseq + 1) & SEQNO_MASK;
		804
		805	if (!rcvdq.put (r->data, r->datalen))
		806	{
		807	slog (L_ERR, "DNS: !rcvdq.put (r->data, r->datalen)");
		808	abort (); // MUST never overflow, can be caused by data corruption, TODO
		809	}
		810
		811	while (vpn_packet *pkt = rcvdq.get ())
		812	{
		813	sockinfo si;
		814	si.host = htonl (c->conf->id); si.port = 0; si.prot = PROT_DNSv4;
		815
		816	vpn->recv_vpn_packet (pkt, si);
		817
		818	delete pkt;
		819	}
		820
		821	// check for further packets
		822	goto redo;
		823	}
		824	}
		825
		826	void
396	vpn::dnsv4_server (dns_packet *pkt)	827	vpn::dnsv4_server (dns_packet &pkt)
397	{	828	{
398	u16 flags = ntohs (pkt->flags);	829	u16 flags = ntohs (pkt.flags);
399		830
400	//memcpy (&((*rep)[0]), &((*pkt)[0]), pkt->len);
401	int offs = 6 * 2; // skip header	831	int offs = 6 * 2; // skip header
402		832
403	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);	833	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
404		834
405	if (!(flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))	835	if (0 == (flags & (FLAG_RESPONSE | FLAG_OP_MASK))
406	&& pkt->qdcount == htons (1))	836	&& pkt.qdcount == htons (1))
407	{	837	{
408	char qname[MAXSIZE];	838	char qname [MAXSIZE];
409	int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	839	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
410		840
411	printf ("rcvd packet len %d, id%04x flags%04x q%04x a%04x n%04x a%04x <%s>\n", pkt->len,
412	pkt->id, flags, pkt->qdcount, pkt->ancount, pkt->nscount, pkt->arcount, qname);//D
413
414	u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++];	841	u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
415	u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];	842	u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
416		843
417	pkt->qdcount = htons (1);	844	pkt.qdcount = htons (1);
418	pkt->ancount = 0;	845	pkt.ancount = 0;
419	pkt->nscount = 0; // should be self, as other nameservers reply like this	846	pkt.nscount = 0; // should be self, as other nameservers reply like this
420	pkt->arcount = 0; // a record for self, as other nameservers reply like this	847	pkt.arcount = 0; // a record for self, as other nameservers reply like this
421		848
422	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_NXDOMAIN);	849	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_SERVFAIL);
423		850
424	int dlen = strlen (THISNODE->domain);	851	int dlen = strlen (THISNODE->domain);
425		852
426	if (qclass == RR_CLASS_IN	853	if (qclass == RR_CLASS_IN
427	&& (qtype == RR_TYPE_ANY || qtype == RR_TYPE_TXT)
428	&& qlen > dlen + 1	854	&& qlen > dlen + 1
429	&& !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen))	855	&& !memcmp (qname + qlen - (dlen + 1), THISNODE->domain, dlen))
430	{	856	{
431	// correct class, domain, parse
432	u8 data[MAXSIZE];
433	int datalen = dns64::decode (data, qname, qlen - dlen - 1);
434
435	for (int i = 0; i < datalen; i++)
436	printf ("%02x ", data[i]);
437	printf ("\n");
438
439
440
441
442	#if 0
443	// now generate reply	857	// now generate reply
444	rep->ancount = htons (1); // one answer RR	858	pkt.ancount = htons (1); // one answer RR
445	rep->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);	859	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);
446		860
447	(*rep) [offs++] = 0xc0;	861	if ((qtype == RR_TYPE_ANY
448	(*rep) [offs++] = 6 * 2; // same as in query section	862	|| qtype == RR_TYPE_TXT
449		863	|| qtype == RR_TYPE_NULL)
450	(*rep) [offs++] = RR_TYPE_TXT >> 8; (*rep) [offs++] = RR_TYPE_TXT;	864	&& qlen > dlen + 1 + HDRSIZE)
451	(*rep) [offs++] = RR_CLASS_IN >> 8; (*rep) [offs++] = RR_CLASS_IN;
452
453	(*rep) [offs++] = 0; (*rep) [offs++] = 0;
454	(*rep) [offs++] = 0; (*rep) [offs++] = 0; // TTL
455
456	int dlen = MAX_PKT_SIZE - offs - 2;
457
458	printf ("we have room for %d bytes\n", dlen);
459
460	int rdlen_offs = offs += 2;
461
462	u8 txt[255];
463	txt[0] = 0;
464	txt[1] = 0;
465
466	int txtlen = 2;
467
468	while (dlen > 1)
469	{	865	{
470	int sndlen = --dlen;	866	// correct class, domain: parse
		867	int client, seqno;
		868	decode_header (qname, client, seqno);
471		869
472	if (sndlen + txtlen > 255)	870	u8 data[MAXSIZE];
473	sndlen = 255 - txtlen;	871	int datalen = cdc62.decode (data, qname + HDRSIZE, qlen - (dlen + 1 + HDRSIZE));
474		872
475	sndlen = 0;	873	if (0 < client && client <= conns.size ())
		874	{
		875	connection *c = conns [client - 1];
		876	dns_connection *dns = c->dns;
		877	dns_rcv *rcv;
476		878
477	(*rep)[offs++] = sndlen + txtlen;	879	if (dns)
478	memcpy (&((*rep)[offs]), txt, txtlen);	880	{
		881	for (vector<dns_rcv *>::iterator i = dns->rcvpq.end (); i-- != dns->rcvpq.begin (); )
		882	if (SEQNO_EQ ((*i)->seqno, seqno))
		883	{
		884	// already seen that request: simply reply with the cached reply
		885	dns_rcv *r = *i;
		886
		887	slog (L_DEBUG, "DNS: duplicate packet received ID %d, SEQ %d", htons (r->pkt->id), seqno);
		888
		889	// refresh header & id, as the retry count could have changed
		890	memcpy (r->pkt->at (6 * 2 + 1), pkt.at (6 * 2 + 1), HDRSIZE);
		891	r->pkt->id = pkt.id;
		892
		893	memcpy (pkt.at (0), r->pkt->at (0), offs = r->pkt->len);
		894
		895	goto duplicate_request;
		896	}
		897
		898	// new packet, queue
		899	rcv = new dns_rcv (seqno, data, datalen);
		900	dns->receive_rep (rcv);
		901	}
		902
		903	{
		904	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
		905
		906	int rtype = dns ? dns->cfg.rrtype : RR_TYPE_A;
		907	pkt [offs++] = rtype >> 8; pkt [offs++] = rtype; // type
		908	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
		909	pkt [offs++] = 0; pkt [offs++] = 0;
		910	pkt [offs++] = 0; pkt [offs++] = dns ? dns->cfg.def_ttl : 0; // TTL
		911
		912	int rdlen_offs = offs += 2;
		913
		914	if (dns)
		915	{
		916	int dlen = ntohs (dns->cfg.max_size) - offs;
		917
		918	// bind doesn't compress well, so reduce further by one label length
		919	dlen -= qlen;
		920
		921	// only put data into in-order sequence packets, if
		922	// we receive out-of-order packets we generate empty
		923	// replies
		924	//printf ("%d - %d & %x (=%d) < %d\n", seqno, dns->repseq, SEQNO_MASK, (seqno - dns->repseq) & SEQNO_MASK, MAX_WINDOW);//D
		925	if (((seqno - dns->repseq) & SEQNO_MASK) <= MAX_WINDOW)
		926	{
		927	dns->repseq = seqno;
		928
		929	while (dlen > 1 && !dns->snddq.empty ())
		930	{
		931	int txtlen = dlen <= 255 ? dlen - 1 : 255;
		932
		933	if (txtlen > dns->snddq.size ())
		934	txtlen = dns->snddq.size ();
		935
		936	pkt[offs++] = txtlen;
		937	memcpy (pkt.at (offs), dns->snddq.begin (), txtlen);
479	offs += txtlen;	938	offs += txtlen;
		939	dns->snddq.remove (txtlen);
480		940
481	//if (sndlen + txtlen > dns_snddq.	941	dlen -= txtlen + 1;
		942	}
		943	}
		944
		945	// avoid completely empty TXT rdata
		946	if (offs == rdlen_offs)
		947	pkt[offs++] = 0;
		948
		949	slog (L_NOISE, "DNS: snddq %d", dns->snddq.size ());
		950	}
		951	else
		952	{
		953	// send RST
		954	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		955	pkt [offs++] = CMD_IP_RST;
		956	}
		957
		958	int rdlen = offs - rdlen_offs;
		959
		960	pkt [rdlen_offs - 2] = rdlen >> 8;
		961	pkt [rdlen_offs - 1] = rdlen;
		962
		963	if (dns)
		964	{
		965	// now update dns_rcv copy
		966	rcv->pkt->len = offs;
		967	memcpy (rcv->pkt->at (0), pkt.at (0), offs);
		968	}
		969	}
		970
		971	duplicate_request: ;
		972	}
		973	else
		974	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
482	}	975	}
		976	else if (qtype == RR_TYPE_A
		977	&& qlen > dlen + 1 + cdc26.encode_len (sizeof (dns_cfg)))
		978	{
		979	dns_cfg cfg;
		980	cdc26.decode ((u8 *)&cfg, qname, cdc26.encode_len (sizeof (dns_cfg)));
		981	int client = ntohs (cfg.client);
483		982
484	int rdlen = offs - rdlen_offs;	983	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
485		984
486	(*rep) [rdlen_offs - 2] = rdlen >> 8;	985	pkt [offs++] = RR_TYPE_A >> 8; pkt [offs++] = RR_TYPE_A; // type
487	(*rep) [rdlen_offs - 1] = rdlen;	986	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
488	#endif	987	pkt [offs++] = 0; pkt [offs++] = 0;
		988	pkt [offs++] = 0; pkt [offs++] = cfg.def_ttl; // TTL
		989	pkt [offs++] = 0; pkt [offs++] = 4; // rdlength
		990
		991	slog (L_INFO, _("DNS: client %d connects"), client);
		992
		993	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		994	pkt [offs++] = CMD_IP_REJ;
		995
		996	if (0 < client && client <= conns.size ())
		997	{
		998	connection *c = conns [client - 1];
		999
		1000	if (cfg.valid ())
		1001	{
		1002	pkt [offs - 1] = CMD_IP_SYN;
		1003
		1004	delete c->dns;
		1005	c->dns = new dns_connection (c);
		1006	c->dns->cfg = cfg;
		1007	}
		1008	}
		1009	}
489	}	1010	}
490	}
491		1011
492	pkt->len = offs;	1012	pkt.len = offs;
493	return pkt;	1013	}
494	}	1014	}
495		1015
496	void	1016	void
497	vpn::dnsv4_client (dns_packet *pkt)	1017	vpn::dnsv4_client (dns_packet &pkt)
498	{	1018	{
499	u16 flags = ntohs (pkt->flags);	1019	u16 flags = ntohs (pkt.flags);
500	int offs = 6 * 2; // skip header	1020	int offs = 6 * 2; // skip header
501		1021
502	pkt->qdcount = ntohs (pkt->qdcount);	1022	pkt.qdcount = ntohs (pkt.qdcount);
503	pkt->ancount = ntohs (pkt->ancount);	1023	pkt.ancount = ntohs (pkt.ancount);
504		1024
		1025	// go through our request list and find the corresponding request
505	for (vector<dns_req *>::iterator i = dns_sndpq.begin ();	1026	for (vector<dns_snd *>::iterator i = dns_sndpq.begin ();
506	i != dns_sndpq.end ();	1027	i != dns_sndpq.end ();
507	++i)	1028	++i)
508	if ((*i)->pkt->id == pkt->id)	1029	if ((*i)->pkt->id == pkt.id)
509	{	1030	{
		1031	dns_connection *dns = (*i)->dns;
510	connection *c = (*i)->conn;	1032	connection *c = dns->c;
511	printf ("GOT RESPONSE id %x %p\n", pkt->id, c);//D	1033	int seqno = (*i)->seqno;
		1034	u8 data[MAXSIZE], *datap = data;
		1035	//printf ("rcv pkt %x\n", seqno);//D
		1036
		1037	if ((*i)->retry)
		1038	{
		1039	dns->send_interval *= 1.01;
		1040	if (dns->send_interval > MAX_SEND_INTERVAL)
		1041	dns->send_interval = MAX_SEND_INTERVAL;
		1042	}
		1043	else
		1044	{
		1045	#if 0
		1046	dns->send_interval *= 0.999;
		1047	#endif
		1048	// the latency surely puts an upper bound on
		1049	// the minimum send interval
		1050	double latency = ev_now () - (*i)->sent;
		1051
		1052	if (latency < dns->min_latency)
		1053	dns->min_latency = latency;
		1054
		1055	if (dns->send_interval > dns->min_latency * conf.dns_overlap_factor)
		1056	dns->send_interval = dns->min_latency * conf.dns_overlap_factor;
		1057
		1058	if (dns->send_interval < conf.dns_send_interval)
		1059	dns->send_interval = conf.dns_send_interval;
		1060	}
		1061
512	delete *i;	1062	delete *i;
513	dns_sndpq.erase (i);	1063	dns_sndpq.erase (i);
514		1064
515	if (flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))	1065	if (flags & FLAG_RESPONSE && !(flags & FLAG_OP_MASK))
516	{	1066	{
517	char qname[MAXSIZE];	1067	char qname[MAXSIZE];
518		1068
519	while (pkt->qdcount-- && offs < MAXSIZE - 4)	1069	while (pkt.qdcount-- && offs < MAXSIZE - 4)
520	{	1070	{
521	int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	1071	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
522	offs += 4; // skip qtype, qclass	1072	offs += 4; // skip qtype, qclass
523	}	1073	}
524		1074
525	while (pkt->ancount-- && offs < MAXSIZE - 10)	1075	while (pkt.ancount-- && offs < MAXSIZE - 10 && datap)
526	{	1076	{
527	pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	1077	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
528		1078
529	u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++];	1079	u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
530	u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];	1080	u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
531	u32 ttl = (*pkt) [offs++] << 24;	1081	u32 ttl = pkt [offs++] << 24;
532	ttl |= (*pkt) [offs++] << 16;	1082	ttl |= pkt [offs++] << 16;
533	ttl |= (*pkt) [offs++] << 8;	1083	ttl |= pkt [offs++] << 8;
534	ttl |= (*pkt) [offs++];	1084	ttl |= pkt [offs++];
535
536	u16 rdlen = (*pkt) [offs++] << 8; rdlen |= (*pkt) [offs++];	1085	u16 rdlen = pkt [offs++] << 8; rdlen |= pkt [offs++];
537		1086
538	printf ("REPLY %d:%d TTL %d RD %d\n", qtype, qclass, ttl, rdlen);	1087	if (qtype == RR_TYPE_NULL || qtype == RR_TYPE_TXT)
539
540	offs += rdlen;
541
542	if (MAXSIZE - offs < rdlen)
543	{	1088	{
		1089	if (rdlen <= MAXSIZE - offs)
		1090	{
544	// decode bytes, finally	1091	// decode bytes, finally
		1092
		1093	while (rdlen)
		1094	{
		1095	int txtlen = pkt [offs++];
		1096
		1097	assert (txtlen + offs < MAXSIZE - 1);
		1098
		1099	memcpy (datap, pkt.at (offs), txtlen);
		1100	datap += txtlen; offs += txtlen;
		1101
		1102	rdlen -= txtlen + 1;
		1103	}
		1104	}
		1105	}
		1106	else if (qtype == RR_TYPE_A)
		1107	{
		1108	u8 ip [4];
		1109
		1110	ip [0] = pkt [offs++];
		1111	ip [1] = pkt [offs++];
		1112	ip [2] = pkt [offs++];
		1113	ip [3] = pkt [offs++];
		1114
		1115	if (ip [0] == CMD_IP_1
		1116	&& ip [1] == CMD_IP_2
		1117	&& ip [2] == CMD_IP_3)
		1118	{
		1119	slog (L_TRACE, _("DNS: got tunnel meta command %02x"), ip [3]);
		1120
		1121	if (ip [3] == CMD_IP_RST)
		1122	{
		1123	slog (L_DEBUG, _("DNS: got tunnel RST request"));
		1124
		1125	delete dns; c->dns = 0;
		1126
		1127	return;
		1128	}
		1129	else if (ip [3] == CMD_IP_SYN)
		1130	{
		1131	slog (L_DEBUG, _("DNS: got tunnel SYN reply, server likes us."));
		1132	dns->established = true;
		1133	}
		1134	else if (ip [3] == CMD_IP_REJ)
		1135	{
		1136	slog (L_DEBUG, _("DNS: got tunnel REJ reply, server does not like us, aborting."));
		1137	abort ();
		1138	}
		1139	else
		1140	slog (L_INFO, _("DNS: got unknown meta command %02x"), ip [3]);
		1141	}
		1142	else
		1143	slog (L_INFO, _("DNS: got spurious a record %d.%d.%d.%d"),
		1144	ip [0], ip [1], ip [2], ip [3]);
		1145
		1146	return;
		1147	}
		1148
		1149	int client, rseqno;
		1150	decode_header (qname, client, rseqno);
		1151
		1152	if (client != THISNODE->id)
		1153	{
		1154	slog (L_INFO, _("DNS: got dns tunnel response with wrong clientid, ignoring"));
		1155	datap = 0;
		1156	}
		1157	else if (rseqno != seqno)
		1158	{
		1159	slog (L_DEBUG, _("DNS: got dns tunnel response with wrong seqno, badly caching nameserver?"));
		1160	datap = 0;
545	}	1161	}
546	}	1162	}
547	}	1163	}
548		1164
		1165	// todo: pkt now used
		1166	if (datap)
		1167	dns->receive_rep (new dns_rcv (seqno, data, datap - data));
		1168
549	break;	1169	break;
550	}	1170	}
551	}	1171	}
552		1172
553	void	1173	void
554	vpn::dnsv4_ev (io_watcher &w, short revents)	1174	vpn::dnsv4_ev (ev::io &w, int revents)
555	{	1175	{
556	if (revents & EVENT_READ)	1176	if (revents & EV_READ)
557	{	1177	{
558	dns_packet *pkt = new dns_packet;	1178	dns_packet *pkt = new dns_packet;
559	struct sockaddr_in sa;	1179	struct sockaddr_in sa;
560	socklen_t sa_len = sizeof (sa);	1180	socklen_t sa_len = sizeof (sa);
561		1181
562	pkt->len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);	1182	pkt->len = recvfrom (w.fd, pkt->at (0), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
563		1183
564	if (pkt->len > 0)	1184	if (pkt->len > 0)
565	if (THISNODE->dns_port)
566	{	1185	{
567	pkt = dnsv4_server (pkt);	1186	if (ntohs (pkt->flags) & FLAG_RESPONSE)
568	sendto (w.fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)&sa, sa_len);
569	}
570	else
571	dnsv4_client (pkt);	1187	dnsv4_client (*pkt);
		1188	else
		1189	{
		1190	dnsv4_server (*pkt);
		1191	sendto (w.fd, pkt->at (0), pkt->len, 0, (sockaddr *)&sa, sa_len);
		1192	}
		1193
		1194	delete pkt;
		1195	}
572	}	1196	}
573	}	1197	}
574		1198
575	bool	1199	bool
576	connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	1200	vpn::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
577	{	1201	{
578	// never initialized	1202	int client = ntohl (si.host);
579	if (!dns_snddq && !dns_rcvdq)
580	{
581	dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
582	dns_snddq = new byte_stream (MAX_BACKLOG);
583		1203
584	dns_rcvseq = dns_sndseq = 0;	1204	assert (0 < client && client <= conns.size ());
585		1205
586	dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	1206	connection *c = conns [client - 1];
587	}	1207
		1208	if (!c->dns)
		1209	c->dns = new dns_connection (c);
588		1210
589	if (!dns_snddq->put (pkt))	1211	if (c->dns->snddq.put (pkt))
590	return false;	1212	c->dns->tw ();
591		1213
592	// start timer if neccessary	1214	// always return true even if the buffer overflows
593	if (!dnsv4_tw.active)
594	dnsv4_cb (dnsv4_tw);
595
596	return true;	1215	return true;
597	}	1216	}
598		1217
599	void	1218	void
600	connection::dnsv4_cb (time_watcher &w)	1219	connection::dnsv4_reset_connection ()
601	{	1220	{
		1221	//delete dns; dns = 0; //TODO
		1222	}
		1223
		1224	#define NEXT(w) do { if (next > (w)) next = w; } while (0)
		1225
		1226	void
		1227	dns_connection::time_cb (ev::timer &w, int revents)
		1228	{
		1229	// servers have to be polled
		1230	if (THISNODE->dns_port)
		1231	return;
		1232
602	// check for timeouts and (re)transmit	1233	// check for timeouts and (re)transmit
603	tstamp next = NOW + 60;	1234	tstamp next = ev::now () + poll_interval;
604	dns_req *send = 0;	1235	dns_snd *send = 0;
605		1236
606	slog (L_NOISE, _("dnsv4, %d packets in send queue\n"), vpn->dns_sndpq.size ());
607
608	for (vector<dns_req *>::iterator i = vpn->dns_sndpq.begin ();	1237	for (vector<dns_snd *>::iterator i = vpn->dns_sndpq.begin ();
609	i != vpn->dns_sndpq.end ();	1238	i != vpn->dns_sndpq.end ();
610	++i)	1239	++i)
611	{	1240	{
612	dns_req *r = *i;	1241	dns_snd *r = *i;
613		1242
614	if (r->next <= NOW)	1243	if (r->timeout <= ev_now ())
615	{	1244	{
616	if (!send)	1245	if (!send)
617	{	1246	{
618	send = r;	1247	send = r;
619		1248
620	slog (L_NOISE, _("dnsv4, send req %d\n"), r->pkt->id);
621	r->retry++;	1249	r->retry++;
622	r->next = NOW + r->retry;	1250	r->timeout = ev_now () + (r->retry * min_latency * conf.dns_timeout_factor);
		1251	//printf ("RETRY %x (%d, %f)\n", r->seqno, r->retry, r->timeout - ev_now ());//D
		1252
		1253	// the following code changes the query section a bit, forcing
		1254	// the forwarder to generate a new request
		1255	if (r->stdhdr)
		1256	encode_header ((char *)r->pkt->at (6 * 2 + 1), THISNODE->id, r->seqno, r->retry);
623	}	1257	}
624	}	1258	}
625		1259	else
626	if (r->next < next)	1260	NEXT (r->timeout);
627	next = r->next;
628	}	1261	}
629		1262
630	if (!send	1263	if (!send)
631	&& vpn->dns_sndpq.size () < MAX_OUTSTANDING)	1264	{
632	send = new dns_req (this, dns_sndseq++, dns_snddq);	1265	// generate a new packet, if wise
633		1266
634	tstamp min_next = NOW + (1. / (tstamp)MAX_RATE);	1267	if (!established)
		1268	{
		1269	if (vpn->dns_sndpq.empty ())
		1270	{
		1271	send = new dns_snd (this);
		1272
		1273	cfg.reset (THISNODE->id);
		1274	send->gen_syn_req ();
		1275	}
		1276	}
		1277	else if (vpn->dns_sndpq.size () < conf.dns_max_outstanding
		1278	&& !SEQNO_EQ (rcvseq, sndseq - (MAX_WINDOW - 1)))
		1279	{
		1280	if (last_sent + send_interval <= ev_now ())
		1281	{
		1282	//printf ("sending data request etc.\n"); //D
		1283	if (!snddq.empty () || last_received + 1. > ev_now ())
		1284	{
		1285	poll_interval = send_interval;
		1286	NEXT (ev_now () + send_interval);
		1287	}
		1288
		1289	send = new dns_snd (this);
		1290	send->gen_stream_req (sndseq, snddq);
		1291	send->timeout = ev_now () + min_latency * conf.dns_timeout_factor;
		1292	//printf ("SEND %x (%f)\n", send->seqno, send->timeout - ev_now (), min_latency, conf.dns_timeout_factor);//D
		1293
		1294	sndseq = (sndseq + 1) & SEQNO_MASK;
		1295	}
		1296	else
		1297	NEXT (last_sent + send_interval);
		1298	}
		1299
		1300	if (send)
		1301	vpn->dns_sndpq.push_back (send);
		1302	}
635		1303
636	if (send)	1304	if (send)
637	{	1305	{
638	dns_packet *pkt = send->pkt;	1306	last_sent = ev_now ();
639		1307	sendto (vpn->dnsv4_fd,
640	next = min_next;	1308	send->pkt->at (0), send->pkt->len, 0,
641		1309	vpn->dns_forwarder.sav4 (), vpn->dns_forwarder.salenv4 ());
642	sendto (vpn->dnsv4_fd, &((*pkt)[0]), pkt->len, 0, dns_si.sav4 (), dns_si.salenv4 ());
643	}	1310	}
644	else if (next < min_next)
645	next = min_next;
646		1311
647	w.start (next);	1312	slog (L_NOISE, "DNS: pi %f si %f N %f (%d:%d %d)",
		1313	poll_interval, send_interval, next - ev_now (),
		1314	vpn->dns_sndpq.size (), snddq.size (),
		1315	rcvpq.size ());
		1316
		1317	// TODO: no idea when this happens, but when next < ev_now (), we have a problem
		1318	// doesn't seem to happen anymore
		1319	if (next < ev_now () + 0.001)
		1320	next = ev_now () + 0.1;
		1321
		1322	w.start (next - ev_now ());
648	}	1323	}
649		1324
650	#endif	1325	#endif
651		1326

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines