[ViewVC] Diff of: cvs/gvpe/src/vpn

Comparing gvpe/src/vpn_dns.C (file contents):
Revision 1.3 by pcg, Tue Mar 1 06:27:20 2005 UTC vs.
Revision 1.53 by root, Tue Oct 18 10:54:17 2011 UTC

…		…
1	/*	1	/*
2	vpn_dns.C -- handle the dns tunnel part of the protocol.	2	vpn_dns.C -- handle the dns tunnel part of the protocol.
3	Copyright (C) 2003-2004 Marc Lehmann <pcg@goof.com>	3	Copyright (C) 2003-2011 Marc Lehmann <gvpe@schmorp.de>
4		4
		5	This file is part of GVPE.
		6
5	This program is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
6	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
7	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
8	(at your option) any later version.	10	option) any later version.
9		11
10	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
11	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
12	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
13	GNU General Public License for more details.	15	Public License for more details.
14		16
15	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
16	along with this program; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
17	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
18	*/	30	*/
		31
		32	// TODO: EDNS0 option to increase dns mtu?
		33	// TODO: re-write dns packet parsing/creation using a safe mem-buffer
		34	// to ensure no buffer overflows or similar problems.
19		35
20	#include "config.h"	36	#include "config.h"
21		37
22	#if ENABLE_DNS	38	#if ENABLE_DNS
23		39
24	// dns processing is EXTREMELY ugly. For obvious(?) reasons.	40	// dns processing is EXTREMELY ugly. For obvious(?) reasons.
25	// it's a hack, use only in emergency situations please.	41	// it's a hack, use only in emergency situations please.
26		42
27	#include <cstring>	43	#include <cstring>
		44	#include <cassert>
28		45
29	#include <sys/types.h>	46	#include <sys/types.h>
30	#include <sys/socket.h>	47	#include <sys/socket.h>
31	#include <sys/wait.h>	48	#include <sys/wait.h>
32	#include <sys/uio.h>	49	#include <sys/uio.h>
35	#include <unistd.h>	52	#include <unistd.h>
36	#include <fcntl.h>	53	#include <fcntl.h>
37		54
38	#include <map>	55	#include <map>
39		56
		57	#include <cstdio> /* bug in libgmp: gmp.h relies on cstdio being included */
		58	#include <gmp.h>
		59
40	#include "netcompat.h"	60	#include "netcompat.h"
41		61
42	#include "vpn.h"	62	#include "vpn.h"
43		63
44	#define MIN_RETRY 1.	64	#define MIN_POLL_INTERVAL 0.025 // poll at most this often when no data received
45	#define MAX_RETRY 60.	65	#define MAX_POLL_INTERVAL 1. // how often to poll minimally when the server has no data
46		66
47	#define MAX_OUTSTANDING 10 // max. outstanding requests	67	#define INITIAL_TIMEOUT 0.1 // retry timeouts
		68	#define INITIAL_SYN_TIMEOUT 2. // retry timeout for initial syn
48		69
49	/*	70	#define MAX_SEND_INTERVAL 5. // optimistic?
50		71
51	protocol, in shorthand :)	72	#define MAX_WINDOW 1000 // max. for MAX_OUTSTANDING, and backlog
		73	#define MAX_BACKLOG (64*1024) // size of gvpe protocol backlog (bytes), must be > MAXSIZE
52		74
53	client -> server <req> ANY?	75	#define MAX_DOMAIN_SIZE 235 // 255 is legal limit, but bind doesn't compress well
54	server -> client <req> TXT <rep>	76	// 240 leaves about 4 bytes of server reply data
		77	// every request byte less give room for two reply bytes
55		78
56	<req> is dns64-encoded <client-id:12><recv-seqno:10>[<send-seqno:10><data>]	79	#define SEQNO_MASK 0x3fff
57	<rep> is dns64-encoded <0:12><recv-seqno:10>[<send-seqno:10><data>]	80	#define SEQNO_EQ(a,b) ( 0 == ( ((a) ^ (b)) & SEQNO_MASK) )
58
59	if <client-id> is zero, the connection will be configured:
60
61	<0:12><0:4>client-id:12><default-ttl:8><max-size:16><flags:16>
62
63	*/
64		81
65	#define MAX_LBL_SIZE 63	82	#define MAX_LBL_SIZE 63
66	#define MAX_PKT_SIZE 512	83	#define MAX_PKT_SIZE 512
67		84
		85	#define RR_TYPE_A 1
		86	#define RR_TYPE_NULL 10
68	#define RR_TYPE_TXT 16	87	#define RR_TYPE_TXT 16
		88	#define RR_TYPE_AAAA 28
69	#define RR_TYPE_ANY 255	89	#define RR_TYPE_ANY 255
		90
70	#define RR_CLASS_IN 1	91	#define RR_CLASS_IN 1
71		92
72	// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative)	93	#define CMD_IP_1 207
73	struct dns64	94	#define CMD_IP_2 46
74	{	95	#define CMD_IP_3 236
75	static const char encode_chars[64 + 1];
76	static s8 decode_chars[256];
77		96
78	static int encode_len (int bytes) { return (bytes * 8 + 5) / 6; }	97	#define CMD_IP_RST 29 // some error, reset and retry
79	static int decode_len (int bytes) { return (bytes * 6) / 8; }	98	#define CMD_IP_REJ 32 // do not want you
80	static void encode (char dst, u8 src, int len);	99	#define CMD_IP_SYN 113 // connection established
81	static void decode (u8 dst, char src, int len);	100	#define CMD_IP_CSE 213 // connection established, but likely case mismatch
82		101
83	dns64 ();	102	static bool
84	} dns64;	103	is_uc (char c)
85
86	const char dns64::encode_chars[64 + 1] = "0123456789-abcdefghijklmnopqrstuvwxyz_ABCDEFGHIJKLMNOPQRSTUVWXYZ";
87	s8 dns64::decode_chars[256];
88
89	dns64::dns64 ()
90	{	104	{
91	for (int i = 0; i < 64; i++)	105	return 'A' <= c && c <= 'Z';
92	decode_chars [encode_chars [i]] = i + 1;
93	}	106	}
94		107
95	void dns64::encode (char dst, u8 src, int len)	108	static bool
		109	is_lc (char c)
96	{	110	{
97	// slow, but easy to debug	111	return 'a' <= c && c <= 'z';
98	unsigned int accum, bits = 0;	112	}
		113
		114	// works for cmaps up to 255 (not 256!)
		115	struct charmap
		116	{
		117	enum { INVALID = (u8)255 };
		118
		119	char encode [256]; // index => char
		120	u8 decode [256]; // char => index
		121	unsigned int size;
		122
		123	charmap (const char *cmap);
		124	};
		125
		126	charmap::charmap (const char *cmap)
		127	{
		128	char *enc = encode;
		129	u8 *dec = decode;
		130
		131	memset (enc, (char) 0, 256);
		132	memset (dec, (char)INVALID, 256);
		133
		134	for (size = 0; cmap [size]; size++)
		135	{
		136	char c = cmap [size];
		137
		138	enc [size] = c;
		139	dec [(u8)c] = size;
		140
		141	// allow lowercase/uppercase aliases if possible
		142	if (is_uc (c) && dec [c + ('a' - 'A')] == INVALID) dec [c + ('a' - 'A')] = size;
		143	if (is_lc (c) && dec [c - ('a' - 'A')] == INVALID) dec [c - ('a' - 'A')] = size;
		144	}
		145
		146	assert (size < 256);
		147	}
		148
		149	#define MAX_DEC_LEN 500
		150	#define MAX_ENC_LEN (MAX_DEC_LEN * 2)
		151	#define MAX_LIMBS ((MAX_DEC_LEN * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
		152
		153	// ugly. minimum base is 16(!)
		154	struct basecoder
		155	{
		156	charmap cmap;
		157	unsigned int enc_len [MAX_DEC_LEN];
		158	unsigned int dec_len [MAX_ENC_LEN];
		159
		160	unsigned int encode_len (unsigned int len) const;
		161	unsigned int decode_len (unsigned int len) const;
		162
		163	unsigned int encode (char dst, u8 src, unsigned int len) const;
		164	unsigned int decode (u8 dst, char src, unsigned int len) const;
		165
		166	basecoder (const char *cmap);
		167	};
		168
		169	basecoder::basecoder (const char *cmap)
		170	: cmap (cmap)
		171	{
		172	for (unsigned int len = 0; len < MAX_DEC_LEN; ++len)
		173	{
		174	u8 src [MAX_DEC_LEN];
		175	u8 dst [MAX_ENC_LEN];
		176
		177	memset (src, 255, len);
		178
		179	mp_limb_t m [MAX_LIMBS];
		180	mp_size_t n;
		181
		182	n = mpn_set_str (m, src, len, 256);
		183	n = mpn_get_str (dst, this->cmap.size, m, n);
		184
		185	for (int i = 0; !dst [i]; ++i)
		186	n--;
		187
		188	enc_len [len] = n;
		189	dec_len [n] = len;
		190	}
		191	}
		192
		193	unsigned int
		194	basecoder::encode_len (unsigned int len) const
		195	{
		196	return enc_len [len];
		197	}
		198
		199	unsigned int
		200	basecoder::decode_len (unsigned int len) const
		201	{
		202	while (len && !dec_len [len])
		203	--len;
		204
		205	return dec_len [len];
		206	}
		207
		208	unsigned int
		209	basecoder::encode (char dst, u8 src, unsigned int len) const
		210	{
		211	if (!len \|\| len > MAX_DEC_LEN)
		212	return 0;
		213
		214	int elen = encode_len (len);
		215
		216	mp_limb_t m [MAX_LIMBS];
		217	mp_size_t n;
		218
		219	u8 dst_ [MAX_ENC_LEN];
		220
		221	n = mpn_set_str (m, src, len, 256);
		222	n = mpn_get_str (dst_, cmap.size, m, n);
		223
		224	int plen = elen; // for padding
		225
		226	while (n < plen)
		227	{
		228	*dst++ = cmap.encode [0];
		229	plen--;
		230	}
		231
		232	for (unsigned int i = n - plen; i < n; ++i)
		233	*dst++ = cmap.encode [dst_ [i]];
		234
		235	return elen;
		236	}
		237
		238	unsigned int
		239	basecoder::decode (u8 dst, char src, unsigned int len) const
		240	{
		241	if (!len \|\| len > MAX_ENC_LEN)
		242	return 0;
		243
		244	u8 src_ [MAX_ENC_LEN];
		245	unsigned int elen = 0;
99		246
100	while (len--)	247	while (len--)
101	{	248	{
102	accum <<= 8;	249	u8 val = cmap.decode [(u8)*src++];
103	accum \|= *src++;
104	bits += 8;
105		250
106	while (bits >= 6)	251	if (val != charmap::INVALID)
107	{	252	src_ [elen++] = val;
108	*dst++ = encode_chars [(accum >> (bits - 6)) & 63];	253	}
109	bits -= 6;	254
110	}	255	int dlen = decode_len (elen);
		256
		257	mp_limb_t m [MAX_LIMBS];
		258	mp_size_t n;
		259
		260	u8 dst_ [MAX_DEC_LEN];
		261
		262	n = mpn_set_str (m, src_, elen, cmap.size);
		263	n = mpn_get_str (dst_, 256, m, n);
		264
		265	if (n < dlen)
111	}	266	{
		267	memset (dst, 0, dlen - n);
		268	memcpy (dst + dlen - n, dst_, n);
		269	}
		270	else
		271	memcpy (dst, dst_ + n - dlen, dlen);
112		272
113	if (bits)	273	return dlen;
114	*dst++ = encode_chars [(accum << (6 - bits)) & 63];
115	}	274	}
116		275
117	void dns64::decode (u8 dst, char src, int len)	276	#if 0
118	{	277	struct test { test (); } test;
119	// slow, but easy to debug
120	unsigned int accum, bits = 0;
121		278
122	while (len--)	279	test::test ()
		280	{
		281	basecoder cdc ("0123456789abcdefghijklmnopqrstuvwxyz");
		282
		283	u8 in[] = "0123456789abcdefghijklmnopqrstuvwxyz";
		284	static char enc[200];
		285	static u8 dec[200];
		286
		287	for (int i = 1; i < 20; i++)
123	{	288	{
124	s8 chr = decode_chars [(u8)*src++];	289	int elen = cdc.encode (enc, in, i);
		290	int dlen = cdc.decode (dec, enc, elen);
125		291
		292	printf ("%d>%d>%d (%s>%s)\n", i, elen, dlen, enc, dec);
		293	}
		294	abort ();
		295	}
		296	#endif
126		297
127	if (!chr)	298	static basecoder cdc62 ("dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI"); // a-zA-Z0-9
		299	static basecoder cdc36 ("dPhZr06QmJkB34tSvL81xAeF92wGyO57uCnI"); // a-z0-9 for case-changers
		300	static basecoder cdc26 ("dPhZrQmJkBtSvLxAeFwGyOuCnI"); // a-z
		301
		302	/////////////////////////////////////////////////////////////////////////////
		303
		304	#define HDRSIZE 5
		305
		306	inline void
		307	encode_header (char *data, int clientid, int seqno, int retry = 0)
		308	{
		309	assert (clientid < 256);
		310
		311	seqno &= SEQNO_MASK;
		312
		313	u8 hdr[3] = {
		314	seqno,
		315	(seqno >> 8) \| (retry << 6),
		316	clientid,
		317	};
		318
		319	cdc36.encode (data, hdr, 3);
		320	}
		321
		322	inline void
		323	decode_header (char *data, int &clientid, int &seqno)
		324	{
		325	u8 hdr[3];
		326
		327	cdc36.decode (hdr, data, HDRSIZE);
		328
		329	clientid = hdr[2];
		330	seqno = ((hdr[1] << 8) \| hdr[0]) & SEQNO_MASK;
		331	}
		332
		333	/////////////////////////////////////////////////////////////////////////////
		334
		335	struct byte_stream
		336	{
		337	u8 *data;
		338	int maxsize;
		339	int fill;
		340
		341	byte_stream (int maxsize);
		342	~byte_stream ();
		343
		344	bool empty () { return !fill; }
		345	int size () { return fill; }
		346
		347	bool put (u8 *data, unsigned int datalen);
		348	bool put (vpn_packet *pkt);
		349	vpn_packet *get ();
		350
		351	u8 *begin () { return data; }
		352	void remove (int count);
		353	};
		354
		355	byte_stream::byte_stream (int maxsize)
		356	: maxsize (maxsize), fill (0)
		357	{
		358	data = new u8 [maxsize];
		359	}
		360
		361	byte_stream::~byte_stream ()
		362	{
		363	delete data;
		364	}
		365
		366	void
		367	byte_stream::remove (int count)
		368	{
		369	if (count > fill)
		370	assert (count <= fill);
		371
		372	memmove (data, data + count, fill -= count);
		373	}
		374
		375	bool
		376	byte_stream::put (u8 *data, unsigned int datalen)
		377	{
		378	if (maxsize - fill < datalen)
		379	return false;
		380
		381	memcpy (this->data + fill, data, datalen); fill += datalen;
		382
		383	return true;
		384	}
		385
		386	bool
		387	byte_stream::put (vpn_packet *pkt)
		388	{
		389	if (maxsize - fill < pkt->len + 2)
		390	return false;
		391
		392	data [fill++] = pkt->len >> 8;
		393	data [fill++] = pkt->len;
		394
		395	memcpy (data + fill, pkt->at (0), pkt->len); fill += pkt->len;
		396
		397	return true;
		398	}
		399
		400	vpn_packet *byte_stream::get ()
		401	{
		402	unsigned int len;
		403
		404	for (;;)
		405	{
		406	len = (data [0] << 8) \| data [1];
		407
		408	if (len <= MAXSIZE \|\| fill < 2)
128	break;	409	break;
129		410
130	accum <<= 6;	411	// TODO: handle this better than skipping, e.g. by reset
131	accum \|= chr - 1;	412	slog (L_DEBUG, _("DNS: corrupted packet stream skipping a byte..."));
132	bits += 6;	413	remove (1);
133		414	}
134	while (bits >= 8)
135	{	415
136	*dst++ = accum >> (bits - 8);	416	if (fill < len + 2)
137	bits -= 8;	417	return 0;
138	}	418
139	}	419	vpn_packet *pkt = new vpn_packet;
		420
		421	pkt->len = len;
		422	memcpy (pkt->at (0), data + 2, len);
		423	remove (len + 2);
		424
		425	return pkt;
140	}	426	}
141		427
142	/////////////////////////////////////////////////////////////////////////////	428	/////////////////////////////////////////////////////////////////////////////
143		429
144	#define FLAG_QUERY ( 0 << 15)	430	#define FLAG_QUERY ( 0 << 15)
145	#define FLAG_RESPONSE ( 1 << 15)	431	#define FLAG_RESPONSE ( 1 << 15)
146	#define FLAG_OP_MASK (15 << 14)	432	#define FLAG_OP_MASK (15 << 11)
147	#define FLAG_OP_QUERY ( 0 << 11)	433	#define FLAG_OP_QUERY ( 0 << 11)
148	#define FLAG_AA ( 1 << 10)	434	#define FLAG_AA ( 1 << 10)
149	#define FLAG_TC ( 1 << 9)	435	#define FLAG_TC ( 1 << 9)
150	#define FLAG_RD ( 1 << 8)	436	#define FLAG_RD ( 1 << 8)
151	#define FLAG_RA ( 1 << 7)	437	#define FLAG_RA ( 1 << 7)
		438	#define FLAG_AUTH ( 1 << 5)
152	#define FLAG_RCODE_MASK (15 << 0)	439	#define FLAG_RCODE_MASK (15 << 0)
153	#define FLAG_RCODE_OK ( 0 << 0)	440	#define FLAG_RCODE_OK ( 0 << 0)
154	#define FLAG_RCODE_FORMERR ( 1 << 0)	441	#define FLAG_RCODE_FORMERR ( 1 << 0)
155	#define FLAG_RCODE_SERVFAIL ( 2 << 0)	442	#define FLAG_RCODE_SERVFAIL ( 2 << 0)
156	#define FLAG_RCODE_NXDOMAIN ( 3 << 0)	443	#define FLAG_RCODE_NXDOMAIN ( 3 << 0)
157	#define FLAG_RCODE_REFUSED ( 5 << 0)	444	#define FLAG_RCODE_REFUSED ( 5 << 0)
158		445
159	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY \| FLAG_OP_QUERY \| FLAG_RD)	446	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY \| FLAG_OP_QUERY \| FLAG_RD)
160	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE \| FLAG_OP_QUERY \| FLAG_AA \| FLAG_RD)	447	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE \| FLAG_OP_QUERY \| FLAG_AA \| FLAG_RD \| FLAG_RA)
		448
		449	struct dns_cfg
		450	{
		451	static int next_uid;
		452
		453	u8 chksum;
		454	u8 rrtype;
		455	u16 uid; // to make request unique
		456
		457	u8 version;
		458	u8 flags;
		459	u16 max_size;
		460
		461	u8 id1, id2, id3, id4;
		462
		463	u16 client;
		464	u8 def_ttl;
		465	u8 r0;
		466
		467	u8 syn_cdc; // cdc en/decoder for syn (A?) requests
		468	u8 hdr_cdc; // cdc en/decoder for regular request headers
		469	u8 req_cdc; // cdc en/decoder for regular (ANY?) request data
		470	u8 rep_cdc; // cdc en/decoder for regular (TXT) replies, 0 == 8 bit encoding
		471
		472	u8 r1, r2, r3, r4;
		473
		474	void reset (int clientid);
		475	bool valid ();
		476	u8 get_chksum ();
		477	};
		478
		479	int dns_cfg::next_uid;
		480
		481	void
		482	dns_cfg::reset (int clientid)
		483	{
		484	// this ID must result in some mixed-case characters in cdc26-encoding
		485	id1 = 'G';
		486	id2 = 'V';
		487	id3 = 'P';
		488	id4 = 'E';
		489
		490	version = 2;
		491
		492	rrtype = RR_TYPE_TXT;
		493	flags = 0;
		494	def_ttl = 0;
		495	syn_cdc = 26;
		496	hdr_cdc = 36;
		497	req_cdc = conf.dns_case_preserving ? 62 : 36;
		498	rep_cdc = 0;
		499	max_size = htons (MAX_PKT_SIZE);
		500	client = htons (clientid);
		501	uid = ++next_uid;
		502
		503	r0 = r1 = r2 = r3 = r4 = 0;
		504
		505	chksum = get_chksum ();
		506	}
		507
		508	// simple but not trivial chksum
		509	u8
		510	dns_cfg::get_chksum ()
		511	{
		512	unsigned int sum = 0xff00; // only 16 bits required
		513
		514	u8 old_chksum = chksum;
		515	chksum = 0;
		516
		517	for (unsigned int i = 0; i < sizeof (*this); ++i)
		518	sum += ((u8 )this)[i] (i + 1);
		519
		520	chksum = old_chksum;
		521
		522	return sum + (sum >> 8);
		523	}
		524
		525	bool
		526	dns_cfg::valid ()
		527	{
		528	// although the protocol itself allows for some configurability,
		529	// only the following encoding/decoding settings are implemented.
		530	return id1 == 'G'
		531	&& id2 == 'V'
		532	&& id3 == 'P'
		533	&& id4 == 'E'
		534	&& version == 2
		535	&& syn_cdc == 26
		536	&& hdr_cdc == 36
		537	&& (req_cdc == 36 \|\| req_cdc == 62)
		538	&& rep_cdc == 0
		539	&& chksum == get_chksum ();
		540	}
161		541
162	struct dns_packet : net_packet	542	struct dns_packet : net_packet
163	{	543	{
164	u16 id;	544	u16 id;
165	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4	545	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
166	u16 qdcount, ancount, nscount, arcount;	546	u16 qdcount, ancount, nscount, arcount;
167		547
168	u8 data[MAXSIZE - 6 * 2];	548	u8 data [MAXSIZE - 6 * 2];
169		549
170	int decode_label (char *data, int size, int &offs);	550	int decode_label (char *data, int size, int &offs);
171	};	551	};
172		552
		553	int
173	int dns_packet::decode_label (char *data, int size, int &offs)	554	dns_packet::decode_label (char *data, int size, int &offs)
174	{	555	{
175	char *orig = data;	556	char *orig = data;
176		557
177	memset (data, 0, size);	558	memset (data, 0, size);
178		559
…		…
204	return data - orig;	585	return data - orig;
205	}	586	}
206		587
207	/////////////////////////////////////////////////////////////////////////////	588	/////////////////////////////////////////////////////////////////////////////
208		589
		590	static
		591	u16 next_id ()
		592	{
		593	static u16 dns_id = 0; // TODO: should be per-vpn
		594
		595	#if 1
		596	if (!dns_id)
		597	dns_id = time (0);
		598
		599	// the simplest lsfr with periodicity 65535 i could find
		600	dns_id = (dns_id << 1)
		601	\| (((dns_id >> 1)
		602	^ (dns_id >> 2)
		603	^ (dns_id >> 4)
		604	^ (dns_id >> 15)) & 1);
		605
		606	return dns_id;
		607	#else
		608	dns_id++;//D
		609
		610	return htons (dns_id);
		611	#endif
		612	}
		613
209	struct dns_req	614	struct dns_rcv;
		615	struct dns_snd;
		616
		617	struct dns_connection
		618	{
		619	connection *c;
		620	struct vpn *vpn;
		621
		622	dns_cfg cfg;
		623
		624	bool established;
		625	const basecoder *cdc;
		626
		627	tstamp last_received;
		628	tstamp last_sent;
		629	double min_latency;
		630	double poll_interval, send_interval;
		631
		632	vector<dns_rcv *> rcvpq;
		633
		634	byte_stream rcvdq; int rcvseq; int repseq;
		635	byte_stream snddq; int sndseq;
		636
		637	inline void time_cb (ev::timer &w, int revents); ev::timer tw;
		638	void receive_rep (dns_rcv *r);
		639
		640	void reset (); // quite like tcp RST
		641	void set_cfg (); // to be called after any cfg changes
		642
		643	dns_connection (connection *c);
		644	~dns_connection ();
		645	};
		646
		647	struct dns_snd
210	{	648	{
211	dns_packet *pkt;	649	dns_packet *pkt;
212	tstamp next;	650	tstamp timeout, sent;
213	int retry;	651	int retry;
		652	struct dns_connection *dns;
		653	int seqno;
		654	bool stdhdr;
214		655
215	dns_req (connection c, vpn_packet p, int &offs);	656	void gen_stream_req (int seqno, byte_stream &stream);
		657	void gen_syn_req ();
		658
		659	dns_snd (dns_connection *dns);
		660	~dns_snd ();
216	};	661	};
217		662
		663	dns_snd::dns_snd (dns_connection *dns)
		664	: dns (dns)
		665	{
		666	timeout = 0;
		667	retry = 0;
		668	seqno = 0;
		669	sent = ev_now ();
		670	stdhdr = false;
		671
		672	pkt = new dns_packet;
		673
		674	pkt->id = next_id ();
		675	}
		676
		677	dns_snd::~dns_snd ()
		678	{
		679	delete pkt;
		680	}
		681
		682	static void
		683	append_domain (dns_packet &pkt, int &offs, const char *domain)
		684	{
		685	// add tunnel domain
		686	for (;;)
		687	{
		688	const char *end = strchr (domain, '.');
		689
		690	if (!end)
		691	end = domain + strlen (domain);
		692
		693	int len = end - domain;
		694
		695	pkt [offs++] = len;
		696	memcpy (pkt.at (offs), domain, len);
		697	offs += len;
		698
		699	if (!*end)
		700	break;
		701
		702	domain = end + 1;
		703	}
		704	}
		705
		706	void
		707	dns_snd::gen_stream_req (int seqno, byte_stream &stream)
		708	{
		709	stdhdr = true;
		710	this->seqno = seqno;
		711
		712	timeout = ev_now () + INITIAL_TIMEOUT;
		713
		714	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
		715	pkt->qdcount = htons (1);
		716
		717	int offs = 6*2;
		718	int dlen = MAX_DOMAIN_SIZE - (strlen (dns->c->conf->domain) + 2);
		719	// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
		720	// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra
		721
		722	char enc[256], *encp = enc;
		723	encode_header (enc, THISNODE->id, seqno);
		724
		725	int datalen = dns->cdc->decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE - HDRSIZE);
		726
		727	if (datalen > stream.size ())
		728	datalen = stream.size ();
		729
		730	int enclen = dns->cdc->encode (enc + HDRSIZE, stream.begin (), datalen) + HDRSIZE;
		731	stream.remove (datalen);
		732
		733	while (enclen)
		734	{
		735	int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;
		736
		737	(*pkt)[offs++] = lbllen;
		738	memcpy (pkt->at (offs), encp, lbllen);
		739
		740	offs += lbllen;
		741	encp += lbllen;
		742
		743	enclen -= lbllen;
		744	}
		745
		746	append_domain (*pkt, offs, dns->c->conf->domain);
		747
		748	(*pkt)[offs++] = 0;
		749	(pkt)[offs++] = RR_TYPE_ANY >> 8; (pkt)[offs++] = RR_TYPE_ANY;
		750	(pkt)[offs++] = RR_CLASS_IN >> 8; (pkt)[offs++] = RR_CLASS_IN;
		751
		752	pkt->len = offs;
		753	}
		754
		755	void
		756	dns_snd::gen_syn_req ()
		757	{
		758	timeout = ev_now () + INITIAL_SYN_TIMEOUT;
		759
		760	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
		761	pkt->qdcount = htons (1);
		762
		763	int offs = 6 * 2;
		764
		765	int elen = cdc26.encode ((char )pkt->at (offs + 1), (u8 )&dns->cfg, sizeof (dns_cfg));
		766
		767	assert (elen <= MAX_LBL_SIZE);
		768
		769	(*pkt)[offs] = elen;
		770	offs += elen + 1;
		771	append_domain (*pkt, offs, dns->c->conf->domain);
		772
		773	(*pkt)[offs++] = 0;
		774	(pkt)[offs++] = RR_TYPE_A >> 8; (pkt)[offs++] = RR_TYPE_A;
		775	(pkt)[offs++] = RR_CLASS_IN >> 8; (pkt)[offs++] = RR_CLASS_IN;
		776
		777	pkt->len = offs;
		778	}
		779
218	struct dns_rep	780	struct dns_rcv
219	{	781	{
		782	int seqno;
		783	dns_packet *pkt; // reply packet
		784	u8 data [MAXSIZE]; // actually part of the reply packet...
		785	int datalen;
		786
		787	dns_rcv (int seqno, u8 *data, int datalen);
		788	~dns_rcv ();
220	};	789	};
221		790
222	static u16 dns_id; // TODO: should be per-vpn	791	dns_rcv::dns_rcv (int seqno, u8 *data, int datalen)
223		792	: seqno (seqno), pkt (new dns_packet), datalen (datalen)
224	dns_req::dns_req (connection c, vpn_packet p, int &offs)
225	{	793	{
226	next = 0;	794	memcpy (this->data, data, datalen);
227	retry = 0;	795	}
228		796
229	pkt = new dns_packet;	797	dns_rcv::~dns_rcv ()
230		798	{
231	pkt->id = dns_id++;	799	delete pkt;
232	pkt->flags = DEFAULT_CLIENT_FLAGS;
233	pkt->qdcount = htons (1 * 0);
234	pkt->ancount = 0;
235	pkt->nscount = 0;
236	pkt->arcount = 0;
237
238	offs += 10000;
239
240	c->dns_sndq.push_back (this);
241	}	800	}
242		801
243	/////////////////////////////////////////////////////////////////////////////	802	/////////////////////////////////////////////////////////////////////////////
244		803
245	struct dns_cfg	804	dns_connection::dns_connection (connection *c)
		805	: c (c)
		806	, rcvdq (MAX_BACKLOG * 2)
		807	, snddq (MAX_BACKLOG)
246	{	808	{
247	u8 id1, id2, id3;	809	tw.set<dns_connection, &dns_connection::time_cb> (this);
248	u8 def_ttl;
249	u8 unused1;
250	u16 max_size;
251	u8 flags1, flags2;
252	};
253		810
254	// reply to client-poll	811	vpn = c->vpn;
255	void dnsv4_poll (dns_packet *pkt, int &offs)
256	{
257	int dlen = MAX_PKT_SIZE - offs - 2;
258		812
259	(*pkt) [offs++] = 0;	813	reset ();
260	(*pkt) [offs++] = 5;	814	}
261	memcpy (&((*pkt)[offs]), "\01H\02\xff\x00", 5);
262	offs += 5;
263		815
264	pkt->ancount = htons (1);	816	dns_connection::~dns_connection ()
265	pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_OK);	817	{
266		818	reset ();
267	printf ("we have room for %d bytes\n", dlen);
268	}	819	}
269		820
270	void	821	void
		822	dns_connection::reset ()
		823	{
		824	while (!rcvpq.empty ())
		825	{
		826	delete rcvpq.back ();
		827	rcvpq.pop_back ();
		828	}
		829
		830	for (int i = vpn->dns_sndpq.size (); i--; )
		831	if (vpn->dns_sndpq [i]->dns == this)
		832	{
		833	vpn->dns_sndpq [i] = vpn->dns_sndpq.back ();
		834	vpn->dns_sndpq.pop_back ();
		835	}
		836
		837	established = false;
		838
		839	rcvseq = repseq = sndseq = 0;
		840
		841	last_sent = 0;
		842	poll_interval = 0.5; // starting here
		843	send_interval = 0.5; // starting rate
		844	min_latency = INITIAL_TIMEOUT;
		845	}
		846
		847	void
		848	dns_connection::set_cfg ()
		849	{
		850	cdc = cfg.req_cdc == 36 ? &cdc36 : &cdc62;
		851	}
		852
		853	void
		854	dns_connection::receive_rep (dns_rcv *r)
		855	{
		856	if (r->datalen)
		857	poll_interval = max (poll_interval * (1. / 1.2), MIN_POLL_INTERVAL);
		858	else
		859	poll_interval = min (poll_interval * 1.1, MAX_POLL_INTERVAL);
		860
		861	rcvpq.push_back (r);
		862
		863	redo:
		864
		865	// find next packet
		866	for (vector<dns_rcv *>::iterator i = rcvpq.end (); i-- != rcvpq.begin (); )
		867	if (SEQNO_EQ (rcvseq, (*i)->seqno))
		868	{
		869	//printf ("seqno eq %x %x\n", rcvseq, (*i)->seqno);//D
		870	// enter the packet into our input stream
		871	r = *i;
		872
		873	// remove the oldest packet, look forward, as it's oldest first
		874	for (vector<dns_rcv *>::iterator j = rcvpq.begin (); j != rcvpq.end (); ++j)
		875	if (SEQNO_EQ ((*j)->seqno, rcvseq - MAX_WINDOW))
		876	{
		877	//printf ("seqno RR %x %x\n", (*j)->seqno, rcvseq - MAX_WINDOW);//D
		878	delete *j;
		879	rcvpq.erase (j);
		880	break;
		881	}
		882
		883	rcvseq = (rcvseq + 1) & SEQNO_MASK;
		884
		885	if (!rcvdq.put (r->data, r->datalen))
		886	{
		887	// MUST never overflow, can be caused by data corruption, TODO
		888	slog (L_CRIT, "DNS: !rcvdq.put (r->data, r->datalen)");
		889	reset ();
		890	return;
		891	}
		892
		893	while (vpn_packet *pkt = rcvdq.get ())
		894	{
		895	sockinfo si;
		896	si.host = htonl (c->conf->id); si.port = 0; si.prot = PROT_DNSv4;
		897
		898	vpn->recv_vpn_packet (pkt, si);
		899	delete pkt;
		900	}
		901
		902	// check for further packets
		903	goto redo;
		904	}
		905	}
		906
		907	void
		908	vpn::dnsv4_server (dns_packet &pkt)
		909	{
		910	u16 flags = ntohs (pkt.flags);
		911
		912	int offs = 6 * 2; // skip header
		913
		914	pkt.flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_FORMERR);
		915
		916	if (0 == (flags & (FLAG_RESPONSE \| FLAG_OP_MASK))
		917	&& pkt.qdcount == htons (1))
		918	{
		919	char qname [MAXSIZE];
		920	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
		921
		922	u16 qtype = pkt [offs++] << 8; qtype \|= pkt [offs++];
		923	u16 qclass = pkt [offs++] << 8; qclass \|= pkt [offs++];
		924
		925	pkt.qdcount = htons (1);
		926	pkt.ancount = 0;
		927	pkt.nscount = 0; // should be self, as other nameservers reply like this
		928	pkt.arcount = 0; // a record for self, as other nameservers reply like this
		929
		930	pkt.flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_SERVFAIL);
		931
		932	int dlen = strlen (THISNODE->domain);
		933
		934	if (qclass == RR_CLASS_IN
		935	&& qlen > dlen + 1
		936	&& !memcmp (qname + qlen - (dlen + 1), THISNODE->domain, dlen))
		937	{
		938	// now generate reply
		939	pkt.ancount = htons (1); // one answer RR
		940	pkt.flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_OK);
		941
		942	if ((qtype == RR_TYPE_ANY
		943	\|\| qtype == RR_TYPE_TXT
		944	\|\| qtype == RR_TYPE_NULL)
		945	&& qlen > dlen + 1 + HDRSIZE)
		946	{
		947	// correct class, domain: parse
		948	int client, seqno;
		949	decode_header (qname, client, seqno);
		950
		951	if (0 < client && client <= conns.size ())
		952	{
		953	connection *c = conns [client - 1];
		954	dns_connection *dns = c->dns;
		955	dns_rcv *rcv;
		956
		957	if (dns)
		958	{
		959	u8 data[MAXSIZE];
		960	int datalen = dns->cdc->decode (data, qname + HDRSIZE, qlen - (dlen + 1 + HDRSIZE));
		961
		962	for (vector<dns_rcv *>::iterator i = dns->rcvpq.end (); i-- != dns->rcvpq.begin (); )
		963	if (SEQNO_EQ ((*i)->seqno, seqno))
		964	{
		965	// already seen that request: simply reply with the cached reply
		966	dns_rcv r = i;
		967
		968	slog (L_DEBUG, "DNS: duplicate packet received ID %d, SEQ %d", htons (r->pkt->id), seqno);
		969
		970	// refresh header & id, as the retry count could have changed
		971	memcpy (r->pkt->at (6 * 2 + 1), pkt.at (6 * 2 + 1), HDRSIZE);
		972	r->pkt->id = pkt.id;
		973
		974	memcpy (pkt.at (0), r->pkt->at (0), offs = r->pkt->len);
		975
		976	goto duplicate_request;
		977	}
		978
		979	// new packet, queue
		980	rcv = new dns_rcv (seqno, data, datalen);
		981	dns->receive_rep (rcv);
		982	}
		983
		984	{
		985	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
		986
		987	int rtype = dns ? dns->cfg.rrtype : RR_TYPE_A;
		988	pkt [offs++] = rtype >> 8; pkt [offs++] = rtype; // type
		989	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
		990	pkt [offs++] = 0; pkt [offs++] = 0;
		991	pkt [offs++] = 0; pkt [offs++] = dns ? dns->cfg.def_ttl : 0; // TTL
		992
		993	int rdlen_offs = offs += 2;
		994
		995	if (dns)
		996	{
		997	int dlen = ntohs (dns->cfg.max_size) - offs;
		998
		999	// bind doesn't compress well, so reduce further by one label length
		1000	dlen -= qlen;
		1001
		1002	// only put data into in-order sequence packets, if
		1003	// we receive out-of-order packets we generate empty
		1004	// replies
		1005	//printf ("%d - %d & %x (=%d) < %d\n", seqno, dns->repseq, SEQNO_MASK, (seqno - dns->repseq) & SEQNO_MASK, MAX_WINDOW);//D
		1006	if (((seqno - dns->repseq) & SEQNO_MASK) <= MAX_WINDOW)
		1007	{
		1008	dns->repseq = seqno;
		1009
		1010	while (dlen > 1 && !dns->snddq.empty ())
		1011	{
		1012	int txtlen = dlen <= 255 ? dlen - 1 : 255;
		1013
		1014	if (txtlen > dns->snddq.size ())
		1015	txtlen = dns->snddq.size ();
		1016
		1017	pkt[offs++] = txtlen;
		1018	memcpy (pkt.at (offs), dns->snddq.begin (), txtlen);
		1019	offs += txtlen;
		1020	dns->snddq.remove (txtlen);
		1021
		1022	dlen -= txtlen + 1;
		1023	}
		1024	}
		1025
		1026	// avoid completely empty TXT rdata
		1027	if (offs == rdlen_offs)
		1028	pkt[offs++] = 0;
		1029
		1030	slog (L_NOISE, "DNS: snddq %d", dns->snddq.size ());
		1031	}
		1032	else
		1033	{
		1034	// send RST
		1035	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		1036	pkt [offs++] = CMD_IP_RST;
		1037	}
		1038
		1039	int rdlen = offs - rdlen_offs;
		1040
		1041	pkt [rdlen_offs - 2] = rdlen >> 8;
		1042	pkt [rdlen_offs - 1] = rdlen;
		1043
		1044	if (dns)
		1045	{
		1046	// now update dns_rcv copy
		1047	rcv->pkt->len = offs;
		1048	memcpy (rcv->pkt->at (0), pkt.at (0), offs);
		1049	}
		1050	}
		1051
		1052	duplicate_request: ;
		1053	}
		1054	else
		1055	pkt.flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_FORMERR);
		1056	}
		1057	else if (qtype == RR_TYPE_A
		1058	&& qlen > dlen + 1 + cdc26.encode_len (sizeof (dns_cfg)))
		1059	{
		1060	dns_cfg cfg;
		1061	cdc26.decode ((u8 *)&cfg, qname, cdc26.encode_len (sizeof (dns_cfg)));
		1062	int client = ntohs (cfg.client);
		1063
		1064	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
		1065
		1066	pkt [offs++] = RR_TYPE_A >> 8; pkt [offs++] = RR_TYPE_A; // type
		1067	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
		1068	pkt [offs++] = 0; pkt [offs++] = 0;
		1069	pkt [offs++] = 0; pkt [offs++] = cfg.def_ttl; // TTL
		1070	pkt [offs++] = 0; pkt [offs++] = 4; // rdlength
		1071
		1072	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		1073	pkt [offs++] = CMD_IP_REJ;
		1074
		1075	if (0 < client && client <= conns.size ())
		1076	{
		1077	connection *c = conns [client - 1];
		1078
		1079	if (cfg.valid ())
		1080	{
		1081	slog (L_INFO, _("DNS: client %d connects (version %d, req_cdc %d)"), client, cfg.version, cfg.req_cdc);
		1082
		1083	// check for any encoding mismatches - hints at a case problem
		1084	char qname2 [MAX_ENC_LEN];
		1085	cdc26.encode (qname2, (u8 *)&cfg, sizeof (dns_cfg));
		1086
		1087	delete c->dns;
		1088
		1089	pkt [offs - 1] = memcmp (qname, qname2, cdc26.encode_len (sizeof (dns_cfg)))
		1090	? CMD_IP_CSE : CMD_IP_SYN;
		1091
		1092	c->dns = new dns_connection (c);
		1093	c->dns->cfg = cfg;
		1094	c->dns->set_cfg ();
		1095	}
		1096	}
		1097	}
		1098	}
		1099
		1100	pkt.len = offs;
		1101	}
		1102	}
		1103
		1104	void
		1105	vpn::dnsv4_client (dns_packet &pkt)
		1106	{
		1107	u16 flags = ntohs (pkt.flags);
		1108	int offs = 6 * 2; // skip header
		1109
		1110	pkt.qdcount = ntohs (pkt.qdcount);
		1111	pkt.ancount = ntohs (pkt.ancount);
		1112
		1113	// go through our request list and find the corresponding request
		1114	for (vector<dns_snd *>::iterator i = dns_sndpq.begin ();
		1115	i != dns_sndpq.end ();
		1116	++i)
		1117	if ((*i)->pkt->id == pkt.id)
		1118	{
		1119	dns_connection dns = (i)->dns;
		1120	connection *c = dns->c;
		1121	int seqno = (*i)->seqno;
		1122	u8 data[MAXSIZE], *datap = data;
		1123	//printf ("rcv pkt %x\n", seqno);//D
		1124
		1125	if ((*i)->retry)
		1126	{
		1127	dns->send_interval *= 1.01;
		1128	if (dns->send_interval > MAX_SEND_INTERVAL)
		1129	dns->send_interval = MAX_SEND_INTERVAL;
		1130	}
		1131	else
		1132	{
		1133	#if 0
		1134	dns->send_interval *= 0.999;
		1135	#endif
		1136	// the latency surely puts an upper bound on
		1137	// the minimum send interval
		1138	double latency = ev_now () - (*i)->sent;
		1139
		1140	if (latency < dns->min_latency)
		1141	dns->min_latency = latency;
		1142
		1143	if (dns->send_interval > dns->min_latency * conf.dns_overlap_factor)
		1144	dns->send_interval = dns->min_latency * conf.dns_overlap_factor;
		1145
		1146	if (dns->send_interval < conf.dns_send_interval)
		1147	dns->send_interval = conf.dns_send_interval;
		1148	}
		1149
		1150	delete *i;
		1151	dns_sndpq.erase (i);
		1152
		1153	if (flags & FLAG_RESPONSE && !(flags & FLAG_OP_MASK))
		1154	{
		1155	char qname[MAXSIZE];
		1156
		1157	while (pkt.qdcount-- && offs < MAXSIZE - 4)
		1158	{
		1159	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
		1160	offs += 4; // skip qtype, qclass
		1161	}
		1162
		1163	while (pkt.ancount-- && offs < MAXSIZE - 10 && datap)
		1164	{
		1165	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
		1166
		1167	u16 qtype = pkt [offs++] << 8; qtype \|= pkt [offs++];
		1168	u16 qclass = pkt [offs++] << 8; qclass \|= pkt [offs++];
		1169	u32 ttl = pkt [offs++] << 24;
		1170	ttl \|= pkt [offs++] << 16;
		1171	ttl \|= pkt [offs++] << 8;
		1172	ttl \|= pkt [offs++];
		1173	u16 rdlen = pkt [offs++] << 8; rdlen \|= pkt [offs++];
		1174
		1175	if (qtype == RR_TYPE_NULL \|\| qtype == RR_TYPE_TXT \|\| qtype == dns->cfg.rrtype)
		1176	{
		1177	if (rdlen <= MAXSIZE - offs)
		1178	{
		1179	// decode bytes, finally
		1180
		1181	while (rdlen)
		1182	{
		1183	int txtlen = pkt [offs++];
		1184
		1185	assert (txtlen + offs < MAXSIZE - 1);
		1186
		1187	memcpy (datap, pkt.at (offs), txtlen);
		1188	datap += txtlen; offs += txtlen;
		1189
		1190	rdlen -= txtlen + 1;
		1191	}
		1192	}
		1193	}
		1194	else if (qtype == RR_TYPE_A)
		1195	{
		1196	u8 ip [4];
		1197
		1198	ip [0] = pkt [offs++];
		1199	ip [1] = pkt [offs++];
		1200	ip [2] = pkt [offs++];
		1201	ip [3] = pkt [offs++];
		1202
		1203	if (ip [0] == CMD_IP_1
		1204	&& ip [1] == CMD_IP_2
		1205	&& ip [2] == CMD_IP_3)
		1206	{
		1207	slog (L_TRACE, _("DNS: got tunnel meta command %02x"), ip [3]);
		1208
		1209	if (ip [3] == CMD_IP_RST)
		1210	{
		1211	slog (L_DEBUG, _("DNS: got tunnel RST request."));
		1212
		1213	dns->reset ();
		1214	return;
		1215	}
		1216	else if (ip [3] == CMD_IP_SYN)
		1217	{
		1218	slog (L_DEBUG, _("DNS: got tunnel SYN reply, server likes us."));
		1219	dns->established = true;
		1220	}
		1221	else if (ip [3] == CMD_IP_CSE)
		1222	{
		1223	if (conf.dns_case_preserving)
		1224	{
		1225	slog (L_INFO, _("DNS: got tunnel CSE reply, globally downgrading to case-insensitive protocol."));
		1226	conf.dns_case_preserving = false;
		1227	dns->reset ();
		1228	return;
		1229	}
		1230	else
		1231	{
		1232	slog (L_DEBUG, _("DNS: got tunnel CSE reply, server likes us."));
		1233	dns->established = true;
		1234	}
		1235	}
		1236	else if (ip [3] == CMD_IP_REJ)
		1237	{
		1238	slog (L_ERR, _("DNS: got tunnel REJ reply, server does not like us."));
		1239	dns->tw.start (60.);
		1240	}
		1241	else
		1242	{
		1243	slog (L_INFO, _("DNS: got unknown meta command %02x"), ip [3]);
		1244	dns->tw.start (60.);
		1245	}
		1246	}
		1247	else
		1248	slog (L_INFO, _("DNS: got spurious a record %d.%d.%d.%d"),
		1249	ip [0], ip [1], ip [2], ip [3]);
		1250
		1251	return;
		1252	}
		1253
		1254	int client, rseqno;
		1255	decode_header (qname, client, rseqno);
		1256
		1257	if (client != THISNODE->id)
		1258	{
		1259	slog (L_INFO, _("DNS: got dns tunnel response with wrong clientid, ignoring"));
		1260	datap = 0;
		1261	}
		1262	else if (rseqno != seqno)
		1263	{
		1264	slog (L_DEBUG, _("DNS: got dns tunnel response with wrong seqno, badly caching nameserver?"));
		1265	datap = 0;
		1266	}
		1267	}
		1268	}
		1269
		1270	// todo: pkt now used
		1271	if (datap)
		1272	dns->receive_rep (new dns_rcv (seqno, data, datap - data));
		1273
		1274	break;
		1275	}
		1276	}
		1277
		1278	void
271	vpn::dnsv4_ev (io_watcher &w, short revents)	1279	vpn::dnsv4_ev (ev::io &w, int revents)
272	{	1280	{
273	if (revents & EVENT_READ)	1281	if (revents & EV_READ)
274	{	1282	{
275	dns_packet *pkt = new dns_packet;	1283	dns_packet *pkt = new dns_packet;
276	struct sockaddr_in sa;	1284	struct sockaddr_in sa;
277	socklen_t sa_len = sizeof (sa);	1285	socklen_t sa_len = sizeof (sa);
278		1286
279	int len = recvfrom (w.fd, &((pkt)[0]), MAXSIZE, 0, (sockaddr )&sa, &sa_len);	1287	pkt->len = recvfrom (w.fd, pkt->at (0), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
280	pkt->len = len;
281		1288
282	u16 flags = ntohs (pkt->flags);	1289	if (pkt->len > 0)
283
284	if (THISNODE->dns_port)
285	{	1290	{
286	// server	1291	if (ntohs (pkt->flags) & FLAG_RESPONSE)
287	pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_FORMERR);	1292	dnsv4_client (*pkt);
288		1293	else
289	int offs = 6 * 2; // skip header
290
291	if (!(flags & (FLAG_RESPONSE \| FLAG_OP_MASK \| FLAG_TC))
292	&& pkt->qdcount == htons (1))
293	{	1294	{
294	char qname[MAXSIZE];	1295	dnsv4_server (*pkt);
295	int qlen = pkt->decode_label ((char *)qname, MAXSIZE, offs);	1296	sendto (w.fd, pkt->at (0), pkt->len, 0, (sockaddr *)&sa, sa_len);
296
297	printf ("rcvd packet len %d, id%04x flags%04x q%04x a%04x n%04x a%04x <%s>\n", len,
298	pkt->id, flags, pkt->qdcount, pkt->ancount, pkt->nscount, pkt->arcount, qname);//D
299
300	u16 qtype = (pkt) [offs++] << 8; qtype \|= (pkt) [offs++];
301	u16 qclass = (pkt) [offs++] << 8; qclass \|= (pkt) [offs++];
302
303	pkt->qdcount = htons (1);
304	pkt->ancount = 0;
305	pkt->nscount = 0; // should be self, as other nameservers reply like this
306	pkt->arcount = 0; // a record for self, as other nameservers reply like this
307
308	pkt->flags = htons (DEFAULT_SERVER_FLAGS \| FLAG_RCODE_NXDOMAIN);
309
310	int dlen = strlen (THISNODE->domain);
311
312	if (qclass == RR_CLASS_IN
313	&& (qtype == RR_TYPE_ANY \|\| qtype == RR_TYPE_TXT)
314	&& qlen > dlen + 1
315	&& !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen))
316	{
317	// correct class, now generate reply
318	pkt->ancount = htons (1); // one answer RR
319
320	(*pkt) [offs++] = 0xc0;
321	(pkt) [offs++] = 6 2; // same as in query section
322
323	(pkt) [offs++] = RR_TYPE_TXT >> 8; (pkt) [offs++] = RR_TYPE_TXT;
324	(pkt) [offs++] = RR_CLASS_IN >> 8; (pkt) [offs++] = RR_CLASS_IN;
325
326	(pkt) [offs++] = 0; (pkt) [offs++] = 0;
327	(pkt) [offs++] = 0; (pkt) [offs++] = 0; // TTL
328
329	dnsv4_poll (pkt, offs);
330	printf ("correct class\n");
331	}
332	}	1297	}
333		1298
334	sendto (w.fd, &((pkt)[0]), offs, 0, (sockaddr )&sa, sa_len);	1299	delete pkt;
		1300	}
		1301	}
		1302	}
		1303
		1304	bool
		1305	vpn::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
		1306	{
		1307	int client = ntohl (si.host);
		1308
		1309	assert (0 < client && client <= conns.size ());
		1310
		1311	connection *c = conns [client - 1];
		1312
		1313	if (!c->dns)
		1314	c->dns = new dns_connection (c);
		1315
		1316	if (c->dns->snddq.put (pkt))
		1317	{
		1318	min_it (c->dns->poll_interval, 0.25);
		1319	c->dns->tw ();
		1320	}
		1321
		1322	// always return true even if the buffer overflows
		1323	return true;
		1324	}
		1325
		1326	void
		1327	dns_connection::time_cb (ev::timer &w, int revents)
		1328	{
		1329	// servers have to be polled
		1330	if (THISNODE->dns_port)
		1331	return;
		1332
		1333	// check for timeouts and (re)transmit
		1334	tstamp next = 86400 * 365;
		1335	dns_snd *send = 0;
		1336
		1337	for (vector<dns_snd *>::iterator i = vpn->dns_sndpq.begin ();
		1338	i != vpn->dns_sndpq.end ();
		1339	++i)
		1340	{
		1341	dns_snd r = i;
		1342
		1343	if (r->timeout <= ev_now ())
		1344	{
		1345	if (!send)
		1346	{
		1347	send = r;
		1348
		1349	r->retry++;
		1350	r->timeout = ev_now () + r->retry * min_latency * conf.dns_timeout_factor;
		1351	//printf ("RETRY %x (%d, %f)\n", r->seqno, r->retry, r->timeout - ev_now ());//D
		1352
		1353	// the following code changes the query section a bit, forcing
		1354	// the forwarder to generate a new request
		1355	if (r->stdhdr)
		1356	encode_header ((char )r->pkt->at (6 2 + 1), THISNODE->id, r->seqno, r->retry);
		1357	}
335	}	1358	}
336	else	1359	else
		1360	min_it (next, r->timeout - ev_now ());
		1361	}
		1362
		1363	if (!send)
		1364	{
		1365	// generate a new packet, if wise
		1366
		1367	if (!established)
337	{	1368	{
338	// client	1369	if (vpn->dns_sndpq.empty ())
		1370	{
		1371	send = new dns_snd (this);
		1372
		1373	cfg.reset (THISNODE->id);
		1374	set_cfg ();
		1375	send->gen_syn_req ();
		1376	}
339	}	1377	}
340	}	1378	else if (vpn->dns_sndpq.size () < conf.dns_max_outstanding
341	}	1379	&& !SEQNO_EQ (rcvseq, sndseq - (MAX_WINDOW - 1)))
342
343	bool
344	connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
345	{
346	if (dns_sndq.size () >= MAX_OUTSTANDING)
347	return false;
348
349	// split vpn packet into dns packets, add to sndq
350	for (int offs = 0; offs < pkt->len; )
351	new dns_req (this, pkt, offs);
352
353	// force transmit
354	dnsv4_cb (dnsv4_tw);
355
356	return true;
357	}
358
359	void
360	connection::dnsv4_cb (time_watcher &w)
361	{
362	// check for timeouts and (re)transmit
363	tstamp next = NOW + 60;
364
365	slog (L_NOISE, _("dnsv4, %d packets in send queue\n"), dns_sndq.size ());
366
367	if (dns_sndq.empty ())
368	{
369	next = NOW + 1;
370	// push poll packet
371	}
372
373	for (vector<dns_req *>::iterator i = dns_sndq.begin ();
374	i != dns_sndq.end ();
375	++i)
376	{
377	dns_req r = i;
378
379	if (r->next <= NOW)
380	{	1380	{
381	slog (L_NOISE, _("dnsv4, send req %d\n"), r->pkt->id);	1381	if (last_sent + send_interval <= ev_now ())
382	r->retry++;	1382	{
383	r->next = NOW + r->retry;	1383	//printf ("sending data request etc.\n"); //D
		1384	if (!snddq.empty ())
		1385	min_it (next, send_interval);
		1386
		1387	send = new dns_snd (this);
		1388	send->gen_stream_req (sndseq, snddq);
		1389	send->timeout = ev_now () + min_latency * conf.dns_timeout_factor;
		1390	//printf ("SEND %x (%f)\n", send->seqno, send->timeout - ev_now (), min_latency, conf.dns_timeout_factor);//D
		1391
		1392	sndseq = (sndseq + 1) & SEQNO_MASK;
		1393	}
		1394	else
		1395	min_it (next, last_sent + send_interval - ev_now ());
384	}	1396	}
385		1397
386	if (r->next < next)	1398	if (send)
387	next = r->next;	1399	vpn->dns_sndpq.push_back (send);
		1400	}
		1401
		1402	if (send)
388	}	1403	{
		1404	last_sent = ev_now ();
		1405	sendto (vpn->dnsv4_fd,
		1406	send->pkt->at (0), send->pkt->len, 0,
		1407	vpn->dns_forwarder.sav4 (), vpn->dns_forwarder.salenv4 ());
		1408	}
389		1409
390	printf ("%f next\n", next);	1410	min_it (next, last_sent + max (poll_interval, send_interval) - ev_now ());
		1411
		1412	slog (L_NOISE, "DNS: pi %f si %f N %f (%d:%d %d)",
		1413	poll_interval, send_interval, next - ev_now (),
		1414	vpn->dns_sndpq.size (), snddq.size (),
		1415	rcvpq.size ());
		1416
391	w.start (next);	1417	w.start (next);
392	}	1418	}
393		1419
394	#endif	1420	#endif
395		1421

Diff Legend

-–
+Removed lines
-+
+Added lines
-<
+Changed lines
->
+Changed lines

Comparing gvpe/src/vpn_dns.C (file contents): Revision 1.3 by pcg, Tue Mar 1 06:27:20 2005 UTC vs. Revision 1.53 by root, Tue Oct 18 10:54:17 2011 UTC

Diff Legend

Comparing gvpe/src/vpn_dns.C (file contents):
Revision 1.3 by pcg, Tue Mar 1 06:27:20 2005 UTC vs.
Revision 1.53 by root, Tue Oct 18 10:54:17 2011 UTC