ViewVC Help

View File | Revision Log | Show Annotations | Download File

/cvs/gvpe/src/vpn_dns.C

Comparing gvpe/src/vpn_dns.C (file contents):
Revision 1.8 by pcg, Fri Mar 4 03:43:09 2005 UTC vs.
Revision 1.54 by root, Tue Oct 18 11:07:28 2011 UTC

1	/*	1	/*
2	vpn_dns.C -- handle the dns tunnel part of the protocol.	2	vpn_dns.C -- handle the dns tunnel part of the protocol.
3	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>	3	Copyright (C) 2003-2011 Marc Lehmann <gvpe@schmorp.de>
4		4
5	This file is part of GVPE.	5	This file is part of GVPE.
6		6
7	GVPE is free software; you can redistribute it and/or modify	7	GVPE is free software; you can redistribute it and/or modify it
8	it under the terms of the GNU General Public License as published by	8	under the terms of the GNU General Public License as published by the
9	the Free Software Foundation; either version 2 of the License, or	9	Free Software Foundation; either version 3 of the License, or (at your
10	(at your option) any later version.	10	option) any later version.
11		11
12	This program is distributed in the hope that it will be useful,	12	This program is distributed in the hope that it will be useful, but
13	but WITHOUT ANY WARRANTY; without even the implied warranty of	13	WITHOUT ANY WARRANTY; without even the implied warranty of
14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the	14	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
15	GNU General Public License for more details.	15	Public License for more details.
16		16
17	You should have received a copy of the GNU General Public License	17	You should have received a copy of the GNU General Public License along
18	along with gvpe; if not, write to the Free Software	18	with this program; if not, see <http://www.gnu.org/licenses/>.
19	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA	19
		20	Additional permission under GNU GPL version 3 section 7
		21
		22	If you modify this Program, or any covered work, by linking or
		23	combining it with the OpenSSL project's OpenSSL library (or a modified
		24	version of that library), containing parts covered by the terms of the
		25	OpenSSL or SSLeay licenses, the licensors of this Program grant you
		26	additional permission to convey the resulting work. Corresponding
		27	Source for a non-source form of such a combination shall include the
		28	source code for the parts of OpenSSL used as well as that of the
		29	covered work.
20	*/	30	*/
		31
		32	// TODO: EDNS0 option to increase dns mtu?
		33	// TODO: re-write dns packet parsing/creation using a safe mem-buffer
		34	// to ensure no buffer overflows or similar problems.
21		35
22	#include "config.h"	36	#include "config.h"
23		37
24	#if ENABLE_DNS	38	#if ENABLE_DNS
25		39
26	// dns processing is EXTREMELY ugly. For obvious(?) reasons.	40	// dns processing is EXTREMELY ugly. For obvious(?) reasons.
27	// it's a hack, use only in emergency situations please.	41	// it's a hack, use only in emergency situations please.
28		42
29	#include <cstring>	43	#include <cstring>
		44	#include <cassert>
30		45
31	#include <sys/types.h>	46	#include <sys/types.h>
32	#include <sys/socket.h>	47	#include <sys/socket.h>
33	#include <sys/wait.h>	48	#include <sys/wait.h>
34	#include <sys/uio.h>	49	#include <sys/uio.h>
…		…
37	#include <unistd.h>	52	#include <unistd.h>
38	#include <fcntl.h>	53	#include <fcntl.h>
39		54
40	#include <map>	55	#include <map>
41		56
		57	#include <cstdio> /* bug in libgmp: gmp.h relies on cstdio being included */
42	#include <gmp.h>	58	#include <gmp.h>
43		59
44	#include "netcompat.h"	60	#include "netcompat.h"
45		61
46	#include "vpn.h"	62	#include "vpn.h"
47		63
48	#define MIN_RETRY 1.	64	#define MIN_POLL_INTERVAL 0.025 // poll at most this often when no data received
49	#define MAX_RETRY 60.	65	#define MAX_POLL_INTERVAL 1. // how often to poll minimally when the server has no data
50		66
51	#define MAX_OUTSTANDING 400 // max. outstanding requests	67	#define INITIAL_TIMEOUT 0.1 // retry timeouts
		68	#define INITIAL_SYN_TIMEOUT 2. // retry timeout for initial syn
		69
		70	#define MAX_SEND_INTERVAL 5. // optimistic?
		71
52	#define MAX_WINDOW 1000 // max. for MAX_OUTSTANDING	72	#define MAX_WINDOW 1000 // max. for MAX_OUTSTANDING, and backlog
53	#define MAX_RATE 10000 // requests/s
54	#define MAX_BACKLOG (10*1024) // size of protocol backlog, must be > MAXSIZE	73	#define MAX_BACKLOG (64*1024) // size of gvpe protocol backlog (bytes), must be > MAXSIZE
55		74
56	#define MAX_DOMAIN_SIZE 220 // 255 is legal limit, but bind doesn't compress well	75	#define MAX_DOMAIN_SIZE 235 // 255 is legal limit, but bind doesn't compress well
57	// 240 leaves about 4 bytes of server reply data	76	// 240 leaves about 4 bytes of server reply data
58	// every two request byte sless give room for one reply byte	77	// every request byte less give room for two reply bytes
59		78
60	// seqno has 12 bits (3 bytes a 4 bits in the header)
61	#define SEQNO_MASK 0x7fff	79	#define SEQNO_MASK 0x3fff
62	#define SEQNO_EQ(a,b) ( 0 == ( ((a) ^ (b)) & SEQNO_MASK) )	80	#define SEQNO_EQ(a,b) ( 0 == ( ((a) ^ (b)) & SEQNO_MASK) )
63		81
64	#define MAX_LBL_SIZE 63	82	#define MAX_LBL_SIZE 63
65	#define MAX_PKT_SIZE 512	83	#define MAX_PKT_SIZE 512
66		84
		85	#define RR_TYPE_A 1
		86	#define RR_TYPE_NULL 10
67	#define RR_TYPE_TXT 16	87	#define RR_TYPE_TXT 16
		88	#define RR_TYPE_AAAA 28
68	#define RR_TYPE_ANY 255	89	#define RR_TYPE_ANY 255
		90
69	#define RR_CLASS_IN 1	91	#define RR_CLASS_IN 1
		92
		93	#define CMD_IP_1 207
		94	#define CMD_IP_2 46
		95	#define CMD_IP_3 236
		96
		97	#define CMD_IP_RST 29 // some error, reset and retry
		98	#define CMD_IP_REJ 32 // do not want you
		99	#define CMD_IP_SYN 113 // connection established
		100	#define CMD_IP_CSE 213 // connection established, but likely case mismatch
		101
		102	static bool
		103	is_uc (char c)
		104	{
		105	return 'A' <= c && c <= 'Z';
		106	}
		107
		108	static bool
		109	is_lc (char c)
		110	{
		111	return 'a' <= c && c <= 'z';
		112	}
70		113
71	// works for cmaps up to 255 (not 256!)	114	// works for cmaps up to 255 (not 256!)
72	struct charmap	115	struct charmap
73	{	116	{
74	enum { INVALID = (u8)255 };	117	enum { INVALID = (u8)255 };
…		…
88	memset (enc, (char) 0, 256);	131	memset (enc, (char) 0, 256);
89	memset (dec, (char)INVALID, 256);	132	memset (dec, (char)INVALID, 256);
90		133
91	for (size = 0; cmap [size]; size++)	134	for (size = 0; cmap [size]; size++)
92	{	135	{
		136	char c = cmap [size];
		137
93	enc [size] = cmap [size];	138	enc [size] = c;
94	dec [(u8)enc [size]] = size;	139	dec [(u8)c] = size;
		140
		141	// allow lowercase/uppercase aliases if possible
		142	if (is_uc (c) && dec [c + ('a' - 'A')] == INVALID) dec [c + ('a' - 'A')] = size;
		143	if (is_lc (c) && dec [c - ('a' - 'A')] == INVALID) dec [c - ('a' - 'A')] = size;
95	}	144	}
96		145
97	assert (size < 256);	146	assert (size < 256);
98	}	147	}
99		148
…		…
106	{	155	{
107	charmap cmap;	156	charmap cmap;
108	unsigned int enc_len [MAX_DEC_LEN];	157	unsigned int enc_len [MAX_DEC_LEN];
109	unsigned int dec_len [MAX_ENC_LEN];	158	unsigned int dec_len [MAX_ENC_LEN];
110		159
111	unsigned int encode_len (unsigned int len);	160	unsigned int encode_len (unsigned int len) const;
112	unsigned int decode_len (unsigned int len);	161	unsigned int decode_len (unsigned int len) const;
113		162
114	unsigned int encode (char *dst, u8 *src, unsigned int len);	163	unsigned int encode (char *dst, u8 *src, unsigned int len) const;
115	unsigned int decode (u8 *dst, char *src, unsigned int len);	164	unsigned int decode (u8 *dst, char *src, unsigned int len) const;
116		165
117	basecoder (const char *cmap);	166	basecoder (const char *cmap);
118	};	167	};
119		168
120	basecoder::basecoder (const char *cmap)	169	basecoder::basecoder (const char *cmap)
…		…
139	enc_len [len] = n;	188	enc_len [len] = n;
140	dec_len [n] = len;	189	dec_len [n] = len;
141	}	190	}
142	}	191	}
143		192
		193	unsigned int
144	unsigned int basecoder::encode_len (unsigned int len)	194	basecoder::encode_len (unsigned int len) const
145	{	195	{
146	return enc_len [len];	196	return enc_len [len];
147	}	197	}
148		198
		199	unsigned int
149	unsigned int basecoder::decode_len (unsigned int len)	200	basecoder::decode_len (unsigned int len) const
150	{	201	{
151	while (len && !dec_len [len])	202	while (len && !dec_len [len])
152	--len;	203	--len;
153		204
154	return dec_len [len];	205	return dec_len [len];
155	}	206	}
156		207
		208	unsigned int
157	unsigned int basecoder::encode (char *dst, u8 *src, unsigned int len)	209	basecoder::encode (char *dst, u8 *src, unsigned int len) const
158	{	210	{
159	if (!len)	211	if (!len || len > MAX_DEC_LEN)
160	return 0;	212	return 0;
161		213
162	int elen = encode_len (len);	214	int elen = encode_len (len);
163		215
164	mp_limb_t m [MAX_LIMBS];	216	mp_limb_t m [MAX_LIMBS];
…		…
181	*dst++ = cmap.encode [dst_ [i]];	233	*dst++ = cmap.encode [dst_ [i]];
182		234
183	return elen;	235	return elen;
184	}	236	}
185		237
		238	unsigned int
186	unsigned int basecoder::decode (u8 *dst, char *src, unsigned int len)	239	basecoder::decode (u8 *dst, char *src, unsigned int len) const
187	{	240	{
188	if (!len)	241	if (!len || len > MAX_ENC_LEN)
189	return 0;	242	return 0;
190		243
191	u8 src_ [MAX_ENC_LEN];	244	u8 src_ [MAX_ENC_LEN];
192	unsigned int elen = 0;	245	unsigned int elen = 0;
193		246
…		…
240	}	293	}
241	abort ();	294	abort ();
242	}	295	}
243	#endif	296	#endif
244		297
245	// the following sequence has been crafted to
246	// a) look somewhat random
247	// b) the even (and odd) indices never share the same character as upper/lowercase
248	// the "_" is not valid but widely accepted (all octets should be supported, but let's be conservative)
249	// the other sequences are obviously derived
250	//static basecoder cdc63 ("_dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");
251	static basecoder cdc62 ("dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI");	298	static basecoder cdc62 ("dDpPhHzZrR06QqMmjJkKBb34TtSsvVlL81xXaAeEFf92WwGgYyoO57UucCNniI"); // a-zA-Z0-9
252	//static basecoder cdc36 ("dphzr06qmjkb34tsvl81xaef92wgyo57ucni"); // unused as of yet	299	static basecoder cdc36 ("dPhZr06QmJkB34tSvL81xAeF92wGyO57uCnI"); // a-z0-9 for case-changers
253	static basecoder cdc26 ("dPhZrQmJkBtSvLxAeFwGyO");	300	static basecoder cdc26 ("dPhZrQmJkBtSvLxAeFwGyOuCnI"); // a-z
254		301
255	/////////////////////////////////////////////////////////////////////////////	302	/////////////////////////////////////////////////////////////////////////////
256		303
257	#define HDRSIZE 6	304	#define HDRSIZE 5
258		305
		306	inline void
259	inline void encode_header (char *data, int clientid, int seqno)	307	encode_header (char *data, int clientid, int seqno, int retry = 0)
260	{	308	{
261	u8 hdr[3] = { clientid, seqno >> 8, seqno };
262
263	assert (clientid < 256);	309	assert (clientid < 256);
264		310
		311	seqno &= SEQNO_MASK;
		312
		313	u8 hdr[3] = {
		314	seqno,
		315	(seqno >> 8) | (retry << 6),
		316	clientid,
		317	};
		318
265	cdc26.encode (data, hdr, 3);	319	cdc36.encode (data, hdr, 3);
266	}	320	}
267		321
		322	inline void
268	inline void decode_header (char *data, int &clientid, int &seqno)	323	decode_header (char *data, int &clientid, int &seqno)
269	{	324	{
270	u8 hdr[3];	325	u8 hdr[3];
271		326
272	cdc26.decode (hdr, data, HDRSIZE);	327	cdc36.decode (hdr, data, HDRSIZE);
273		328
274	printf ("DEC %02x %02x %02x %02x\n", hdr[0], hdr[1], hdr[2], hdr[3]);
275
276	clientid = hdr[0];	329	clientid = hdr[2];
277	seqno = (hdr[1] << 8) | hdr[2];	330	seqno = ((hdr[1] << 8) | hdr[0]) & SEQNO_MASK;
278	}	331	}
279		332
280	/////////////////////////////////////////////////////////////////////////////	333	/////////////////////////////////////////////////////////////////////////////
281		334
282	struct byte_stream	335	struct byte_stream
…		…
308	byte_stream::~byte_stream ()	361	byte_stream::~byte_stream ()
309	{	362	{
310	delete data;	363	delete data;
311	}	364	}
312		365
		366	void
313	void byte_stream::remove (int count)	367	byte_stream::remove (int count)
314	{	368	{
315	if (count > fill)	369	if (count > fill)
316	abort ();	370	assert (count <= fill);
317		371
318	memmove (data, data + count, fill -= count);	372	memmove (data, data + count, fill -= count);
319	}	373	}
320		374
		375	bool
321	bool byte_stream::put (u8 *data, unsigned int datalen)	376	byte_stream::put (u8 *data, unsigned int datalen)
322	{	377	{
323	if (maxsize - fill < datalen)	378	if (maxsize - fill < datalen)
324	return false;	379	return false;
325		380
326	memcpy (this->data + fill, data, datalen); fill += datalen;	381	memcpy (this->data + fill, data, datalen); fill += datalen;
327		382
328	return true;	383	return true;
329	}	384	}
330		385
		386	bool
331	bool byte_stream::put (vpn_packet *pkt)	387	byte_stream::put (vpn_packet *pkt)
332	{	388	{
333	if (maxsize - fill < pkt->len + 2)	389	if (maxsize - fill < pkt->len + 2)
334	return false;	390	return false;
335		391
336	data [fill++] = pkt->len >> 8;	392	data [fill++] = pkt->len >> 8;
337	data [fill++] = pkt->len;	393	data [fill++] = pkt->len;
338		394
339	memcpy (data + fill, &((*pkt)[0]), pkt->len); fill += pkt->len;	395	memcpy (data + fill, pkt->at (0), pkt->len); fill += pkt->len;
340		396
341	return true;	397	return true;
342	}	398	}
343		399
344	vpn_packet *byte_stream::get ()	400	vpn_packet *byte_stream::get ()
345	{	401	{
		402	if (fill < 2)
		403	return 0;
		404
		405	unsigned int len;
		406
		407	for (;;)
		408	{
346	int len = (data [0] << 8) | data [1];	409	len = (data [0] << 8) | data [1];
347		410
348	if (len > MAXSIZE && fill >= 2)	411	if (len <= MAXSIZE)
349	abort (); // TODO handle this gracefully, connection reset	412	break;
350		413
		414	// TODO: handle this better than skipping, e.g. by reset
		415	slog (L_DEBUG, _("DNS: corrupted packet (%02x %02x) stream skipping a byte..."), data [0], data [1]);
		416	remove (1);
		417	}
		418
351	if (fill < len + 2)	419	if (fill < len + 2)
352	return 0;	420	return 0;
353		421
354	vpn_packet *pkt = new vpn_packet;	422	vpn_packet *pkt = new vpn_packet;
355		423
356	pkt->len = len;	424	pkt->len = len;
357	memcpy (&((*pkt)[0]), data + 2, len);	425	memcpy (pkt->at (0), data + 2, len);
358	remove (len + 2);	426	remove (len + 2);
359		427
360	return pkt;	428	return pkt;
361	}	429	}
362		430
363	/////////////////////////////////////////////////////////////////////////////	431	/////////////////////////////////////////////////////////////////////////////
364		432
365	#define FLAG_QUERY ( 0 << 15)	433	#define FLAG_QUERY ( 0 << 15)
366	#define FLAG_RESPONSE ( 1 << 15)	434	#define FLAG_RESPONSE ( 1 << 15)
367	#define FLAG_OP_MASK (15 << 14)	435	#define FLAG_OP_MASK (15 << 11)
368	#define FLAG_OP_QUERY ( 0 << 11)	436	#define FLAG_OP_QUERY ( 0 << 11)
369	#define FLAG_AA ( 1 << 10)	437	#define FLAG_AA ( 1 << 10)
370	#define FLAG_TC ( 1 << 9)	438	#define FLAG_TC ( 1 << 9)
371	#define FLAG_RD ( 1 << 8)	439	#define FLAG_RD ( 1 << 8)
372	#define FLAG_RA ( 1 << 7)	440	#define FLAG_RA ( 1 << 7)
…		…
379	#define FLAG_RCODE_REFUSED ( 5 << 0)	447	#define FLAG_RCODE_REFUSED ( 5 << 0)
380		448
381	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)	449	#define DEFAULT_CLIENT_FLAGS (FLAG_QUERY | FLAG_OP_QUERY | FLAG_RD)
382	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)	450	#define DEFAULT_SERVER_FLAGS (FLAG_RESPONSE | FLAG_OP_QUERY | FLAG_AA | FLAG_RD | FLAG_RA)
383		451
		452	struct dns_cfg
		453	{
		454	static int next_uid;
		455
		456	u8 chksum;
		457	u8 rrtype;
		458	u16 uid; // to make request unique
		459
		460	u8 version;
		461	u8 flags;
		462	u16 max_size;
		463
		464	u8 id1, id2, id3, id4;
		465
		466	u16 client;
		467	u8 def_ttl;
		468	u8 r0;
		469
		470	u8 syn_cdc; // cdc en/decoder for syn (A?) requests
		471	u8 hdr_cdc; // cdc en/decoder for regular request headers
		472	u8 req_cdc; // cdc en/decoder for regular (ANY?) request data
		473	u8 rep_cdc; // cdc en/decoder for regular (TXT) replies, 0 == 8 bit encoding
		474
		475	u8 r1, r2, r3, r4;
		476
		477	void reset (int clientid);
		478	bool valid ();
		479	u8 get_chksum ();
		480	};
		481
		482	int dns_cfg::next_uid;
		483
		484	void
		485	dns_cfg::reset (int clientid)
		486	{
		487	// this ID must result in some mixed-case characters in cdc26-encoding
		488	id1 = 'G';
		489	id2 = 'V';
		490	id3 = 'P';
		491	id4 = 'E';
		492
		493	version = 2;
		494
		495	rrtype = RR_TYPE_TXT;
		496	flags = 0;
		497	def_ttl = 0;
		498	syn_cdc = 26;
		499	hdr_cdc = 36;
		500	req_cdc = conf.dns_case_preserving ? 62 : 36;
		501	rep_cdc = 0;
		502	max_size = htons (MAX_PKT_SIZE);
		503	client = htons (clientid);
		504	uid = ++next_uid;
		505
		506	r0 = r1 = r2 = r3 = r4 = 0;
		507
		508	chksum = get_chksum ();
		509	}
		510
		511	// simple but not trivial chksum
		512	u8
		513	dns_cfg::get_chksum ()
		514	{
		515	unsigned int sum = 0xff00; // only 16 bits required
		516
		517	u8 old_chksum = chksum;
		518	chksum = 0;
		519
		520	for (unsigned int i = 0; i < sizeof (*this); ++i)
		521	sum += ((u8 *)this)[i] * (i + 1);
		522
		523	chksum = old_chksum;
		524
		525	return sum + (sum >> 8);
		526	}
		527
		528	bool
		529	dns_cfg::valid ()
		530	{
		531	// although the protocol itself allows for some configurability,
		532	// only the following encoding/decoding settings are implemented.
		533	return id1 == 'G'
		534	&& id2 == 'V'
		535	&& id3 == 'P'
		536	&& id4 == 'E'
		537	&& version == 2
		538	&& syn_cdc == 26
		539	&& hdr_cdc == 36
		540	&& (req_cdc == 36 || req_cdc == 62)
		541	&& rep_cdc == 0
		542	&& chksum == get_chksum ();
		543	}
		544
384	struct dns_packet : net_packet	545	struct dns_packet : net_packet
385	{	546	{
386	u16 id;	547	u16 id;
387	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4	548	u16 flags; // QR:1 Opcode:4 AA:1 TC:1 RD:1 RA:1 Z:3 RCODE:4
388	u16 qdcount, ancount, nscount, arcount;	549	u16 qdcount, ancount, nscount, arcount;
389		550
390	u8 data[MAXSIZE - 6 * 2];	551	u8 data [MAXSIZE - 6 * 2];
391		552
392	int decode_label (char *data, int size, int &offs);	553	int decode_label (char *data, int size, int &offs);
393	};	554	};
394		555
		556	int
395	int dns_packet::decode_label (char *data, int size, int &offs)	557	dns_packet::decode_label (char *data, int size, int &offs)
396	{	558	{
397	char *orig = data;	559	char *orig = data;
398		560
399	memset (data, 0, size);	561	memset (data, 0, size);
400		562
…		…
426	return data - orig;	588	return data - orig;
427	}	589	}
428		590
429	/////////////////////////////////////////////////////////////////////////////	591	/////////////////////////////////////////////////////////////////////////////
430		592
431	struct dns_req	593	static
		594	u16 next_id ()
432	{	595	{
433	dns_packet *pkt;
434	tstamp next;
435	int retry;
436	connection *conn;
437	int seqno;
438
439	dns_req (connection *c);
440	void gen_stream_req (int seqno, byte_stream *stream);
441	};
442
443	static u16 dns_id = 12098; // TODO: should be per-vpn	596	static u16 dns_id = 0; // TODO: should be per-vpn
444		597
445	static u16 next_id ()	598	#if 1
446	{	599	if (!dns_id)
		600	dns_id = time (0);
		601
447	// the simplest lsfr with periodicity 65535 i could find	602	// the simplest lsfr with periodicity 65535 i could find
448	dns_id = (dns_id << 1)	603	dns_id = (dns_id << 1)
449	| (((dns_id >> 1)	604	| (((dns_id >> 1)
450	^ (dns_id >> 2)	605	^ (dns_id >> 2)
451	^ (dns_id >> 4)	606	^ (dns_id >> 4)
452	^ (dns_id >> 15)) & 1);	607	^ (dns_id >> 15)) & 1);
453		608
454	return dns_id;	609	return dns_id;
455	}	610	#else
		611	dns_id++;//D
456		612
457	dns_req::dns_req (connection *c)	613	return htons (dns_id);
458	: conn (c)	614	#endif
		615	}
		616
		617	struct dns_rcv;
		618	struct dns_snd;
		619
		620	struct dns_connection
459	{	621	{
460	next = 0;	622	connection *c;
		623	struct vpn *vpn;
		624
		625	dns_cfg cfg;
		626
		627	bool established;
		628	const basecoder *cdc;
		629
		630	tstamp last_received;
		631	tstamp last_sent;
		632	double min_latency;
		633	double poll_interval, send_interval;
		634
		635	vector<dns_rcv *> rcvpq;
		636
		637	byte_stream rcvdq; int rcvseq; int repseq;
		638	byte_stream snddq; int sndseq;
		639
		640	inline void time_cb (ev::timer &w, int revents); ev::timer tw;
		641	void receive_rep (dns_rcv *r);
		642
		643	void reset (); // quite like tcp RST
		644	void set_cfg (); // to be called after any cfg changes
		645
		646	dns_connection (connection *c);
		647	~dns_connection ();
		648	};
		649
		650	struct dns_snd
		651	{
		652	dns_packet *pkt;
		653	tstamp timeout, sent;
		654	int retry;
		655	struct dns_connection *dns;
		656	int seqno;
		657	bool stdhdr;
		658
		659	void gen_stream_req (int seqno, byte_stream &stream);
		660	void gen_syn_req ();
		661
		662	dns_snd (dns_connection *dns);
		663	~dns_snd ();
		664	};
		665
		666	dns_snd::dns_snd (dns_connection *dns)
		667	: dns (dns)
		668	{
		669	timeout = 0;
461	retry = 0;	670	retry = 0;
		671	seqno = 0;
		672	sent = ev_now ();
		673	stdhdr = false;
462		674
463	pkt = new dns_packet;	675	pkt = new dns_packet;
464		676
465	pkt->id = next_id ();	677	pkt->id = next_id ();
466	}	678	}
467		679
		680	dns_snd::~dns_snd ()
		681	{
		682	delete pkt;
		683	}
		684
		685	static void
		686	append_domain (dns_packet &pkt, int &offs, const char *domain)
		687	{
		688	// add tunnel domain
		689	for (;;)
		690	{
		691	const char *end = strchr (domain, '.');
		692
		693	if (!end)
		694	end = domain + strlen (domain);
		695
		696	int len = end - domain;
		697
		698	pkt [offs++] = len;
		699	memcpy (pkt.at (offs), domain, len);
		700	offs += len;
		701
		702	if (!*end)
		703	break;
		704
		705	domain = end + 1;
		706	}
		707	}
		708
		709	void
468	void dns_req::gen_stream_req (int seqno, byte_stream *stream)	710	dns_snd::gen_stream_req (int seqno, byte_stream &stream)
469	{	711	{
		712	stdhdr = true;
470	this->seqno = seqno;	713	this->seqno = seqno;
		714
		715	timeout = ev_now () + INITIAL_TIMEOUT;
471		716
472	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);	717	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
473	pkt->qdcount = htons (1);	718	pkt->qdcount = htons (1);
474		719
475	int offs = 6*2;	720	int offs = 6*2;
476	int dlen = MAX_DOMAIN_SIZE - (strlen (THISNODE->domain) + 2);	721	int dlen = MAX_DOMAIN_SIZE - (strlen (dns->c->conf->domain) + 2);
477	// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,	722	// MAX_DOMAIN_SIZE is technically 255, but bind doesn't compress responses well,
478	// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra	723	// so we need to have space for 2*MAX_DOMAIN_SIZE + header + extra
479		724
480	char enc[256], *encp = enc;	725	char enc[256], *encp = enc;
481	encode_header (enc, THISNODE->id, seqno);	726	encode_header (enc, THISNODE->id, seqno);
482		727
483	int datalen = cdc62.decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE - HDRSIZE);	728	int datalen = dns->cdc->decode_len (dlen - (dlen + MAX_LBL_SIZE - 1) / MAX_LBL_SIZE - HDRSIZE);
484		729
485	if (datalen > stream->size ())	730	if (datalen > stream.size ())
486	datalen = stream->size ();	731	datalen = stream.size ();
487		732
488	int enclen = cdc62.encode (enc + HDRSIZE, stream->begin (), datalen) + HDRSIZE;	733	int enclen = dns->cdc->encode (enc + HDRSIZE, stream.begin (), datalen) + HDRSIZE;
489
490	printf ("cdc62.encode %d->%d:%02x %02x %02x %02x\n", datalen, enclen,
491	stream->begin ()[0],
492	stream->begin ()[1],
493	stream->begin ()[2],
494	stream->begin ()[3]);
495
496	stream->remove (datalen);	734	stream.remove (datalen);
497		735
498	while (enclen)	736	while (enclen)
499	{	737	{
500	int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;	738	int lbllen = enclen < MAX_LBL_SIZE ? enclen : MAX_LBL_SIZE;
501		739
…		…
506	encp += lbllen;	744	encp += lbllen;
507		745
508	enclen -= lbllen;	746	enclen -= lbllen;
509	}	747	}
510		748
511	const char *suffix = THISNODE->domain;	749	append_domain (*pkt, offs, dns->c->conf->domain);
512
513	// add tunnel domain
514	for (;;)
515	{
516	const char *end = strchr (suffix, '.');
517
518	if (!end)
519	end = suffix + strlen (suffix);
520
521	int len = end - suffix;
522
523	(*pkt)[offs++] = len;
524	memcpy (&((*pkt)[offs]), suffix, len);
525	offs += len;
526
527	if (!*end)
528	break;
529
530	suffix = end + 1;
531	}
532		750
533	(*pkt)[offs++] = 0;	751	(*pkt)[offs++] = 0;
534	(*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;	752	(*pkt)[offs++] = RR_TYPE_ANY >> 8; (*pkt)[offs++] = RR_TYPE_ANY;
		753	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
		754
		755	pkt->len = offs;
		756	}
		757
		758	void
		759	dns_snd::gen_syn_req ()
		760	{
		761	timeout = ev_now () + INITIAL_SYN_TIMEOUT;
		762
		763	pkt->flags = htons (DEFAULT_CLIENT_FLAGS);
		764	pkt->qdcount = htons (1);
		765
		766	int offs = 6 * 2;
		767
		768	int elen = cdc26.encode ((char *)pkt->at (offs + 1), (u8 *)&dns->cfg, sizeof (dns_cfg));
		769
		770	assert (elen <= MAX_LBL_SIZE);
		771
		772	(*pkt)[offs] = elen;
		773	offs += elen + 1;
		774	append_domain (*pkt, offs, dns->c->conf->domain);
		775
		776	(*pkt)[offs++] = 0;
		777	(*pkt)[offs++] = RR_TYPE_A >> 8; (*pkt)[offs++] = RR_TYPE_A;
535	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;	778	(*pkt)[offs++] = RR_CLASS_IN >> 8; (*pkt)[offs++] = RR_CLASS_IN;
536		779
537	pkt->len = offs;	780	pkt->len = offs;
538	}	781	}
539		782
…		…
558	{	801	{
559	delete pkt;	802	delete pkt;
560	}	803	}
561		804
562	/////////////////////////////////////////////////////////////////////////////	805	/////////////////////////////////////////////////////////////////////////////
563		806
564	struct dns_cfg	807	dns_connection::dns_connection (connection *c)
		808	: c (c)
		809	, rcvdq (MAX_BACKLOG * 2)
		810	, snddq (MAX_BACKLOG)
565	{	811	{
566	u8 id1, id2, id3;	812	tw.set<dns_connection, &dns_connection::time_cb> (this);
567	u8 def_ttl;
568	u8 unused1;
569	u16 max_size;
570	u8 flags1, flags2;
571	};
572		813
		814	vpn = c->vpn;
		815
		816	reset ();
		817	}
		818
		819	dns_connection::~dns_connection ()
		820	{
		821	reset ();
		822	}
		823
		824	void
		825	dns_connection::reset ()
		826	{
		827	while (!rcvpq.empty ())
		828	{
		829	delete rcvpq.back ();
		830	rcvpq.pop_back ();
		831	}
		832
		833	for (int i = vpn->dns_sndpq.size (); i--; )
		834	if (vpn->dns_sndpq [i]->dns == this)
		835	{
		836	vpn->dns_sndpq [i] = vpn->dns_sndpq.back ();
		837	vpn->dns_sndpq.pop_back ();
		838	}
		839
		840	established = false;
		841
		842	rcvseq = repseq = sndseq = 0;
		843
		844	last_sent = 0;
		845	poll_interval = 0.5; // starting here
		846	send_interval = 0.5; // starting rate
		847	min_latency = INITIAL_TIMEOUT;
		848	}
		849
		850	void
		851	dns_connection::set_cfg ()
		852	{
		853	cdc = cfg.req_cdc == 36 ? &cdc36 : &cdc62;
		854	}
		855
		856	void
573	void connection::dnsv4_receive_rep (struct dns_rcv *r)	857	dns_connection::receive_rep (dns_rcv *r)
574	{	858	{
		859	if (r->datalen)
		860	poll_interval = max (poll_interval * (1. / 1.2), MIN_POLL_INTERVAL);
		861	else
		862	poll_interval = min (poll_interval * 1.1, MAX_POLL_INTERVAL);
		863
575	dns_rcvpq.push_back (r);	864	rcvpq.push_back (r);
576		865
577	printf ("%d got inketc %d (%02x %02x %02x %02x)\n", THISNODE->id, r->seqno
578	,r->data[0]
579	,r->data[1]
580	,r->data[2]
581	,r->data[3]
582	);
583	redo:	866	redo:
584		867
585	// find next packet	868	// find next packet
586	for (vector<dns_rcv *>::iterator i = dns_rcvpq.end (); i-- != dns_rcvpq.begin (); )	869	for (vector<dns_rcv *>::iterator i = rcvpq.end (); i-- != rcvpq.begin (); )
587	if (SEQNO_EQ (dns_rcvseq, (*i)->seqno))	870	if (SEQNO_EQ (rcvseq, (*i)->seqno))
588	{	871	{
		872	//printf ("seqno eq %x %x\n", rcvseq, (*i)->seqno);//D
589	// enter the packet into our input stream	873	// enter the packet into our input stream
590	r = *i;	874	r = *i;
591		875
592	printf ("%d checking for older packet %d\n", THISNODE->id, dns_rcvseq);
593	// remove the oldest packet, look forward, as it's oldest first	876	// remove the oldest packet, look forward, as it's oldest first
594	for (vector<dns_rcv *>::iterator j = dns_rcvpq.begin (); j != dns_rcvpq.end (); ++j)	877	for (vector<dns_rcv *>::iterator j = rcvpq.begin (); j != rcvpq.end (); ++j)
595	if (SEQNO_EQ ((*j)->seqno, dns_rcvseq - MAX_WINDOW))	878	if (SEQNO_EQ ((*j)->seqno, rcvseq - MAX_WINDOW))
596	{	879	{
597	printf ("%d removing %d\n", THISNODE->id, (*j)->seqno);	880	//printf ("seqno RR %x %x\n", (*j)->seqno, rcvseq - MAX_WINDOW);//D
598	delete *j;	881	delete *j;
599	dns_rcvpq.erase (j);	882	rcvpq.erase (j);
600	break;	883	break;
601	}	884	}
602		885
603	dns_rcvseq = (dns_rcvseq + 1) & SEQNO_MASK;	886	rcvseq = (rcvseq + 1) & SEQNO_MASK;
604		887
605	if (!dns_snddq && !dns_rcvdq)	888	if (!rcvdq.put (r->data, r->datalen))
606	{	889	{
607	dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);	890	// MUST never overflow, can be caused by data corruption, TODO
608	dns_snddq = new byte_stream (MAX_BACKLOG);	891	slog (L_CRIT, "DNS: !rcvdq.put (r->data, r->datalen)");
609		892	reset ();
610	dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	893	return;
611	}	894	}
612		895
613	if (!dns_rcvdq->put (r->data, r->datalen))
614	abort (); // MUST never overflow, can be caused by data corruption, TODO
615
616	while (vpn_packet *pkt = dns_rcvdq->get ())	896	while (vpn_packet *pkt = rcvdq.get ())
617	{	897	{
618	sockinfo si;	898	sockinfo si;
619	si.host = 0; si.port = 0; si.prot = PROT_DNSv4;	899	si.host = htonl (c->conf->id); si.port = 0; si.prot = PROT_DNSv4;
620		900
621	vpn->recv_vpn_packet (pkt, si);	901	vpn->recv_vpn_packet (pkt, si);
		902	delete pkt;
622	}	903	}
623		904
624	// check for further packets	905	// check for further packets
625	goto redo;	906	goto redo;
626	}	907	}
627	}	908	}
628		909
629	dns_packet *	910	void
630	vpn::dnsv4_server (dns_packet *pkt)	911	vpn::dnsv4_server (dns_packet &pkt)
631	{	912	{
632	u16 flags = ntohs (pkt->flags);	913	u16 flags = ntohs (pkt.flags);
633		914
634	//memcpy (&((*rep)[0]), &((*pkt)[0]), pkt->len);
635	int offs = 6 * 2; // skip header	915	int offs = 6 * 2; // skip header
636		916
637	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);	917	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
638		918
639	if (!(flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))	919	if (0 == (flags & (FLAG_RESPONSE | FLAG_OP_MASK))
640	&& pkt->qdcount == htons (1))	920	&& pkt.qdcount == htons (1))
641	{	921	{
642	char qname[MAXSIZE];	922	char qname [MAXSIZE];
643	int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	923	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
644		924
645	u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++];	925	u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
646	u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];	926	u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
647		927
648	pkt->qdcount = htons (1);	928	pkt.qdcount = htons (1);
649	pkt->ancount = 0;	929	pkt.ancount = 0;
650	pkt->nscount = 0; // should be self, as other nameservers reply like this	930	pkt.nscount = 0; // should be self, as other nameservers reply like this
651	pkt->arcount = 0; // a record for self, as other nameservers reply like this	931	pkt.arcount = 0; // a record for self, as other nameservers reply like this
652		932
653	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_NXDOMAIN);	933	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_SERVFAIL);
654		934
655	int dlen = strlen (THISNODE->domain);	935	int dlen = strlen (THISNODE->domain);
656		936
657	if (qclass == RR_CLASS_IN	937	if (qclass == RR_CLASS_IN
658	&& (qtype == RR_TYPE_ANY || qtype == RR_TYPE_TXT)
659	&& qlen > dlen + 1 + HDRSIZE	938	&& qlen > dlen + 1
660	&& !memcmp (qname + qlen - dlen - 1, THISNODE->domain, dlen))	939	&& !memcmp (qname + qlen - (dlen + 1), THISNODE->domain, dlen))
661	{	940	{
662	// correct class, domain: parse	941	// now generate reply
663	int client, seqno;	942	pkt.ancount = htons (1); // one answer RR
664	decode_header (qname, client, seqno);	943	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);
665		944
666	u8 data[MAXSIZE];	945	if ((qtype == RR_TYPE_ANY
667	int datalen = cdc62.decode (data, qname + HDRSIZE, qlen - (dlen + 1 + HDRSIZE));	946	|| qtype == RR_TYPE_TXT
668		947	|| qtype == RR_TYPE_NULL)
669	printf ("cdc62.decode %d(%d): %02x %02x %02x %02x\n",
670	qlen - (dlen + 1 + HDRSIZE), datalen	948	&& qlen > dlen + 1 + HDRSIZE)
671	,data[0]
672	,data[1]
673	,data[2]
674	,data[3]);
675
676	printf ("SRV got %d <%.*s>\n", seqno, qlen, qname + HDRSIZE);//D
677	printf ("SRV got %d <%.*s>\n", seqno, qlen - (dlen + 1 + HDRSIZE), qname + HDRSIZE);//D
678
679	if (0 < client && client <= conns.size ())
680	{	949	{
		950	// correct class, domain: parse
		951	int client, seqno;
		952	decode_header (qname, client, seqno);
		953
		954	if (0 < client && client <= conns.size ())
		955	{
681	connection *c = conns [client - 1];	956	connection *c = conns [client - 1];
		957	dns_connection *dns = c->dns;
		958	dns_rcv *rcv;
682		959
		960	if (dns)
		961	{
		962	u8 data[MAXSIZE];
		963	int datalen = dns->cdc->decode (data, qname + HDRSIZE, qlen - (dlen + 1 + HDRSIZE));
		964
683	for (vector<dns_rcv *>::iterator i = c->dns_rcvpq.end (); i-- != c->dns_rcvpq.begin (); )	965	for (vector<dns_rcv *>::iterator i = dns->rcvpq.end (); i-- != dns->rcvpq.begin (); )
684	if (SEQNO_EQ ((*i)->seqno, seqno))	966	if (SEQNO_EQ ((*i)->seqno, seqno))
		967	{
		968	// already seen that request: simply reply with the cached reply
		969	dns_rcv *r = *i;
		970
		971	slog (L_DEBUG, "DNS: duplicate packet received ID %d, SEQ %d", htons (r->pkt->id), seqno);
		972
		973	// refresh header & id, as the retry count could have changed
		974	memcpy (r->pkt->at (6 * 2 + 1), pkt.at (6 * 2 + 1), HDRSIZE);
		975	r->pkt->id = pkt.id;
		976
		977	memcpy (pkt.at (0), r->pkt->at (0), offs = r->pkt->len);
		978
		979	goto duplicate_request;
		980	}
		981
		982	// new packet, queue
		983	rcv = new dns_rcv (seqno, data, datalen);
		984	dns->receive_rep (rcv);
		985	}
		986
685	{	987	{
686	// already seen that request: simply reply with the cached reply	988	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
687	dns_rcv *r = *i;
688		989
689	printf ("DUPLICATE %d\n", htons (r->pkt->id));//D	990	int rtype = dns ? dns->cfg.rrtype : RR_TYPE_A;
		991	pkt [offs++] = rtype >> 8; pkt [offs++] = rtype; // type
		992	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
		993	pkt [offs++] = 0; pkt [offs++] = 0;
		994	pkt [offs++] = 0; pkt [offs++] = dns ? dns->cfg.def_ttl : 0; // TTL
690		995
691	memcpy (pkt->at (0), r->pkt->at (0), offs = r->pkt->len);	996	int rdlen_offs = offs += 2;
692	pkt->id = r->pkt->id;	997
693	goto duplicate_request;	998	if (dns)
		999	{
		1000	int dlen = ntohs (dns->cfg.max_size) - offs;
		1001
		1002	// bind doesn't compress well, so reduce further by one label length
		1003	dlen -= qlen;
		1004
		1005	// only put data into in-order sequence packets, if
		1006	// we receive out-of-order packets we generate empty
		1007	// replies
		1008	//printf ("%d - %d & %x (=%d) < %d\n", seqno, dns->repseq, SEQNO_MASK, (seqno - dns->repseq) & SEQNO_MASK, MAX_WINDOW);//D
		1009	if (((seqno - dns->repseq) & SEQNO_MASK) <= MAX_WINDOW)
		1010	{
		1011	dns->repseq = seqno;
		1012
		1013	while (dlen > 1 && !dns->snddq.empty ())
		1014	{
		1015	int txtlen = dlen <= 255 ? dlen - 1 : 255;
		1016
		1017	if (txtlen > dns->snddq.size ())
		1018	txtlen = dns->snddq.size ();
		1019
		1020	pkt[offs++] = txtlen;
		1021	memcpy (pkt.at (offs), dns->snddq.begin (), txtlen);
		1022	offs += txtlen;
		1023	dns->snddq.remove (txtlen);
		1024
		1025	dlen -= txtlen + 1;
		1026	}
		1027	}
		1028
		1029	// avoid completely empty TXT rdata
		1030	if (offs == rdlen_offs)
		1031	pkt[offs++] = 0;
		1032
		1033	slog (L_NOISE, "DNS: snddq %d", dns->snddq.size ());
		1034	}
		1035	else
		1036	{
		1037	// send RST
		1038	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		1039	pkt [offs++] = CMD_IP_RST;
		1040	}
		1041
		1042	int rdlen = offs - rdlen_offs;
		1043
		1044	pkt [rdlen_offs - 2] = rdlen >> 8;
		1045	pkt [rdlen_offs - 1] = rdlen;
		1046
		1047	if (dns)
		1048	{
		1049	// now update dns_rcv copy
		1050	rcv->pkt->len = offs;
		1051	memcpy (rcv->pkt->at (0), pkt.at (0), offs);
		1052	}
694	}	1053	}
695		1054
696	// new packet, queue	1055	duplicate_request: ;
697	dns_rcv *rcv = new dns_rcv (seqno, data, datalen);	1056	}
698	c->dnsv4_receive_rep (rcv);	1057	else
699
700	// now generate reply
701	pkt->ancount = htons (1); // one answer RR
702	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_OK);	1058	pkt.flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
		1059	}
		1060	else if (qtype == RR_TYPE_A
		1061	&& qlen > dlen + 1 + cdc26.encode_len (sizeof (dns_cfg)))
		1062	{
		1063	dns_cfg cfg;
		1064	cdc26.decode ((u8 *)&cfg, qname, cdc26.encode_len (sizeof (dns_cfg)));
		1065	int client = ntohs (cfg.client);
703		1066
704	(*pkt) [offs++] = 0xc0;
705	(*pkt) [offs++] = 6 * 2; // same as in query section	1067	pkt [offs++] = 0xc0; pkt [offs++] = 6 * 2; // refer to name in query section
706		1068
707	(*pkt) [offs++] = RR_TYPE_TXT >> 8; (*pkt) [offs++] = RR_TYPE_TXT;	1069	pkt [offs++] = RR_TYPE_A >> 8; pkt [offs++] = RR_TYPE_A; // type
708	(*pkt) [offs++] = RR_CLASS_IN >> 8; (*pkt) [offs++] = RR_CLASS_IN;	1070	pkt [offs++] = RR_CLASS_IN >> 8; pkt [offs++] = RR_CLASS_IN; // class
709
710	(*pkt) [offs++] = 0; (*pkt) [offs++] = 0;	1071	pkt [offs++] = 0; pkt [offs++] = 0;
711	(*pkt) [offs++] = 0; (*pkt) [offs++] = 0; // TTL	1072	pkt [offs++] = 0; pkt [offs++] = cfg.def_ttl; // TTL
		1073	pkt [offs++] = 0; pkt [offs++] = 4; // rdlength
712		1074
713	int dlen = MAX_PKT_SIZE - offs - 2;	1075	pkt [offs++] = CMD_IP_1; pkt [offs++] = CMD_IP_2; pkt [offs++] = CMD_IP_3;
		1076	pkt [offs++] = CMD_IP_REJ;
714		1077
715	// bind doesn't compress well, so reduce further by one label length	1078	if (0 < client && client <= conns.size ())
716	dlen -= qlen;
717
718	int rdlen_offs = offs += 2;
719
720	while (c->dns_snddq
721	&& !c->dns_snddq->empty ()
722	&& dlen > 1)
723	{	1079	{
724	int txtlen = dlen <= 255 ? dlen - 1 : 255;	1080	connection *c = conns [client - 1];
725		1081
726	if (txtlen > c->dns_snddq->size ())	1082	if (cfg.valid ())
		1083	{
		1084	slog (L_INFO, _("DNS: client %d connects (version %d, req_cdc %d)"), client, cfg.version, cfg.req_cdc);
		1085
		1086	// check for any encoding mismatches - hints at a case problem
		1087	char qname2 [MAX_ENC_LEN];
		1088	cdc26.encode (qname2, (u8 *)&cfg, sizeof (dns_cfg));
		1089
		1090	delete c->dns;
		1091
		1092	pkt [offs - 1] = memcmp (qname, qname2, cdc26.encode_len (sizeof (dns_cfg)))
		1093	? CMD_IP_CSE : CMD_IP_SYN;
		1094
		1095	c->dns = new dns_connection (c);
		1096	c->dns->cfg = cfg;
727	txtlen = c->dns_snddq->size ();	1097	c->dns->set_cfg ();
728		1098	}
729	(*pkt)[offs++] = txtlen;
730	memcpy (pkt->at (offs), c->dns_snddq->begin (), txtlen);
731	offs += txtlen;
732	c->dns_snddq->remove (txtlen);
733
734	dlen -= txtlen + 1;
735	}	1099	}
736
737	// avoid empty TXT rdata
738	if (offs == rdlen_offs)
739	(*pkt)[offs++] = 0;
740
741	int rdlen = offs - rdlen_offs;
742
743	(*pkt) [rdlen_offs - 2] = rdlen >> 8;
744	(*pkt) [rdlen_offs - 1] = rdlen;
745
746	// now update dns_rcv copy
747	rcv->pkt->len = offs;
748	memcpy (rcv->pkt->at (0), pkt->at (0), offs);
749
750	duplicate_request: ;
751	}	1100	}
752	else
753	pkt->flags = htons (DEFAULT_SERVER_FLAGS | FLAG_RCODE_FORMERR);
754	}	1101	}
755		1102
756	pkt->len = offs;	1103	pkt.len = offs;
757	}	1104	}
758
759	return pkt;
760	}	1105	}
761		1106
762	void	1107	void
763	vpn::dnsv4_client (dns_packet *pkt)	1108	vpn::dnsv4_client (dns_packet &pkt)
764	{	1109	{
765	u16 flags = ntohs (pkt->flags);	1110	u16 flags = ntohs (pkt.flags);
766	int offs = 6 * 2; // skip header	1111	int offs = 6 * 2; // skip header
767		1112
768	pkt->qdcount = ntohs (pkt->qdcount);	1113	pkt.qdcount = ntohs (pkt.qdcount);
769	pkt->ancount = ntohs (pkt->ancount);	1114	pkt.ancount = ntohs (pkt.ancount);
770		1115
771	// go through our request list and find the corresponding request	1116	// go through our request list and find the corresponding request
772	for (vector<dns_req *>::iterator i = dns_sndpq.begin ();	1117	for (vector<dns_snd *>::iterator i = dns_sndpq.begin ();
773	i != dns_sndpq.end ();	1118	i != dns_sndpq.end ();
774	++i)	1119	++i)
775	if ((*i)->pkt->id == pkt->id)	1120	if ((*i)->pkt->id == pkt.id)
776	{	1121	{
		1122	dns_connection *dns = (*i)->dns;
777	connection *c = (*i)->conn;	1123	connection *c = dns->c;
778	int seqno = (*i)->seqno;	1124	int seqno = (*i)->seqno;
779	u8 data[MAXSIZE], *datap = data;	1125	u8 data[MAXSIZE], *datap = data;
		1126	//printf ("rcv pkt %x\n", seqno);//D
		1127
		1128	if ((*i)->retry)
		1129	{
		1130	dns->send_interval *= 1.01;
		1131	if (dns->send_interval > MAX_SEND_INTERVAL)
		1132	dns->send_interval = MAX_SEND_INTERVAL;
		1133	}
		1134	else
		1135	{
		1136	#if 0
		1137	dns->send_interval *= 0.999;
		1138	#endif
		1139	// the latency surely puts an upper bound on
		1140	// the minimum send interval
		1141	double latency = ev_now () - (*i)->sent;
		1142
		1143	if (latency < dns->min_latency)
		1144	dns->min_latency = latency;
		1145
		1146	if (dns->send_interval > dns->min_latency * conf.dns_overlap_factor)
		1147	dns->send_interval = dns->min_latency * conf.dns_overlap_factor;
		1148
		1149	if (dns->send_interval < conf.dns_send_interval)
		1150	dns->send_interval = conf.dns_send_interval;
		1151	}
780		1152
781	delete *i;	1153	delete *i;
782	dns_sndpq.erase (i);	1154	dns_sndpq.erase (i);
783		1155
784	if (flags & (FLAG_RESPONSE | FLAG_OP_MASK | FLAG_TC))	1156	if (flags & FLAG_RESPONSE && !(flags & FLAG_OP_MASK))
785	{	1157	{
786	char qname[MAXSIZE];	1158	char qname[MAXSIZE];
787		1159
788	while (pkt->qdcount-- && offs < MAXSIZE - 4)	1160	while (pkt.qdcount-- && offs < MAXSIZE - 4)
789	{	1161	{
790	int qlen = pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	1162	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
791	offs += 4; // skip qtype, qclass	1163	offs += 4; // skip qtype, qclass
792	}	1164	}
793		1165
794	while (pkt->ancount-- && offs < MAXSIZE - 10)	1166	while (pkt.ancount-- && offs < MAXSIZE - 10 && datap)
795	{	1167	{
796	int qlen = //D
797	pkt->decode_label ((char *)qname, MAXSIZE - offs, offs);	1168	int qlen = pkt.decode_label ((char *)qname, MAXSIZE - offs, offs);
798		1169
799	printf ("got reply to <%.*s>\n", qlen, qname);//D
800
801	u16 qtype = (*pkt) [offs++] << 8; qtype |= (*pkt) [offs++];	1170	u16 qtype = pkt [offs++] << 8; qtype |= pkt [offs++];
802	u16 qclass = (*pkt) [offs++] << 8; qclass |= (*pkt) [offs++];	1171	u16 qclass = pkt [offs++] << 8; qclass |= pkt [offs++];
803	u32 ttl = (*pkt) [offs++] << 24;	1172	u32 ttl = pkt [offs++] << 24;
804	ttl |= (*pkt) [offs++] << 16;	1173	ttl |= pkt [offs++] << 16;
805	ttl |= (*pkt) [offs++] << 8;	1174	ttl |= pkt [offs++] << 8;
806	ttl |= (*pkt) [offs++];	1175	ttl |= pkt [offs++];
807
808	u16 rdlen = (*pkt) [offs++] << 8; rdlen |= (*pkt) [offs++];	1176	u16 rdlen = pkt [offs++] << 8; rdlen |= pkt [offs++];
809		1177
810	if (rdlen <= MAXSIZE - offs)	1178	if (qtype == RR_TYPE_NULL || qtype == RR_TYPE_TXT || qtype == dns->cfg.rrtype)
811	{	1179	{
812	// decode bytes, finally	1180	if (rdlen <= MAXSIZE - offs)
813
814	while (rdlen)
815	{	1181	{
		1182	// decode bytes, finally
		1183
		1184	while (rdlen)
		1185	{
816	int txtlen = (*pkt) [offs++];	1186	int txtlen = pkt [offs++];
817		1187
818	assert (txtlen + offs < MAXSIZE - 1);	1188	assert (txtlen + offs < MAXSIZE - 1);
819		1189
820	memcpy (datap, pkt->at (offs), txtlen);	1190	memcpy (datap, pkt.at (offs), txtlen);
821	datap += txtlen; offs += txtlen;	1191	datap += txtlen; offs += txtlen;
822		1192
823	rdlen -= txtlen + 1;	1193	rdlen -= txtlen + 1;
		1194	}
824	}	1195	}
825
826	}	1196	}
		1197	else if (qtype == RR_TYPE_A)
		1198	{
		1199	u8 ip [4];
827		1200
		1201	ip [0] = pkt [offs++];
		1202	ip [1] = pkt [offs++];
		1203	ip [2] = pkt [offs++];
		1204	ip [3] = pkt [offs++];
		1205
		1206	if (ip [0] == CMD_IP_1
		1207	&& ip [1] == CMD_IP_2
		1208	&& ip [2] == CMD_IP_3)
		1209	{
		1210	slog (L_TRACE, _("DNS: got tunnel meta command %02x"), ip [3]);
		1211
		1212	if (ip [3] == CMD_IP_RST)
		1213	{
		1214	slog (L_DEBUG, _("DNS: got tunnel RST request."));
		1215
		1216	dns->reset ();
		1217	return;
		1218	}
		1219	else if (ip [3] == CMD_IP_SYN)
		1220	{
		1221	slog (L_DEBUG, _("DNS: got tunnel SYN reply, server likes us."));
		1222	dns->established = true;
		1223	}
		1224	else if (ip [3] == CMD_IP_CSE)
		1225	{
		1226	if (conf.dns_case_preserving)
		1227	{
		1228	slog (L_INFO, _("DNS: got tunnel CSE reply, globally downgrading to case-insensitive protocol."));
		1229	conf.dns_case_preserving = false;
		1230	dns->reset ();
		1231	return;
		1232	}
		1233	else
		1234	{
		1235	slog (L_DEBUG, _("DNS: got tunnel CSE reply, server likes us."));
		1236	dns->established = true;
		1237	}
		1238	}
		1239	else if (ip [3] == CMD_IP_REJ)
		1240	{
		1241	slog (L_ERR, _("DNS: got tunnel REJ reply, server does not like us."));
		1242	dns->tw.start (60.);
		1243	}
		1244	else
		1245	{
		1246	slog (L_INFO, _("DNS: got unknown meta command %02x"), ip [3]);
		1247	dns->tw.start (60.);
		1248	}
		1249	}
		1250	else
		1251	slog (L_INFO, _("DNS: got spurious a record %d.%d.%d.%d"),
		1252	ip [0], ip [1], ip [2], ip [3]);
		1253
		1254	return;
		1255	}
		1256
		1257	int client, rseqno;
		1258	decode_header (qname, client, rseqno);
		1259
		1260	if (client != THISNODE->id)
		1261	{
		1262	slog (L_INFO, _("DNS: got dns tunnel response with wrong clientid, ignoring"));
		1263	datap = 0;
		1264	}
		1265	else if (rseqno != seqno)
		1266	{
		1267	slog (L_DEBUG, _("DNS: got dns tunnel response with wrong seqno, badly caching nameserver?"));
		1268	datap = 0;
		1269	}
828	}	1270	}
829	}	1271	}
830		1272
831	// todo: pkt now used	1273	// todo: pkt now used
		1274	if (datap)
832	c->dnsv4_receive_rep (new dns_rcv (seqno, data, datap - data));	1275	dns->receive_rep (new dns_rcv (seqno, data, datap - data));
833		1276
834	break;	1277	break;
835	}	1278	}
836
837	delete pkt;
838	}	1279	}
839		1280
840	void	1281	void
841	vpn::dnsv4_ev (io_watcher &w, short revents)	1282	vpn::dnsv4_ev (ev::io &w, int revents)
842	{	1283	{
843	if (revents & EVENT_READ)	1284	if (revents & EV_READ)
844	{	1285	{
845	dns_packet *pkt = new dns_packet;	1286	dns_packet *pkt = new dns_packet;
846	struct sockaddr_in sa;	1287	struct sockaddr_in sa;
847	socklen_t sa_len = sizeof (sa);	1288	socklen_t sa_len = sizeof (sa);
848		1289
849	pkt->len = recvfrom (w.fd, &((*pkt)[0]), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);	1290	pkt->len = recvfrom (w.fd, pkt->at (0), MAXSIZE, 0, (sockaddr *)&sa, &sa_len);
850		1291
851	if (pkt->len > 0)	1292	if (pkt->len > 0)
852	{	1293	{
853	if (pkt->flags & htons (FLAG_TC))	1294	if (ntohs (pkt->flags) & FLAG_RESPONSE)
		1295	dnsv4_client (*pkt);
		1296	else
854	{	1297	{
855	slog (L_WARN, _("DNS request/response truncated, check protocol settings."));	1298	dnsv4_server (*pkt);
856	//TODO connection reset	1299	sendto (w.fd, pkt->at (0), pkt->len, 0, (sockaddr *)&sa, sa_len);
857	}	1300	}
858		1301
859	if (THISNODE->dns_port)	1302	delete pkt;
860	{
861	pkt = dnsv4_server (pkt);
862	sendto (w.fd, &((*pkt)[0]), pkt->len, 0, (sockaddr *)&sa, sa_len);
863	}
864	else
865	dnsv4_client (pkt);
866	}	1303	}
867	}	1304	}
868	}	1305	}
869		1306
870	bool	1307	bool
871	connection::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)	1308	vpn::send_dnsv4_packet (vpn_packet *pkt, const sockinfo &si, int tos)
872	{	1309	{
873	// never initialized	1310	int client = ntohl (si.host);
874	if (!dns_snddq && !dns_rcvdq)
875	{
876	dns_rcvdq = new byte_stream (MAX_BACKLOG * 2);
877	dns_snddq = new byte_stream (MAX_BACKLOG);
878		1311
879	//dns_rcvseq = dns_sndseq = 0;	1312	assert (0 < client && client <= conns.size ());
880		1313
881	dns_si.set (::conf.dns_forw_host, ::conf.dns_forw_port, PROT_DNSv4);	1314	connection *c = conns [client - 1];
882	}	1315
		1316	if (!c->dns)
		1317	c->dns = new dns_connection (c);
883		1318
884	if (!dns_snddq->put (pkt))	1319	if (c->dns->snddq.put (pkt))
885	return false;	1320	{
		1321	min_it (c->dns->poll_interval, 0.25);
		1322	c->dns->tw ();
		1323	}
886		1324
887	// start timer if neccessary	1325	// always return true even if the buffer overflows
888	if (!THISNODE->dns_port && !dnsv4_tw.active)
889	dnsv4_cb (dnsv4_tw);
890
891	return true;	1326	return true;
892	}	1327	}
893		1328
894	void	1329	void
895	connection::dnsv4_cb (time_watcher &w)	1330	dns_connection::time_cb (ev::timer &w, int revents)
896	{	1331	{
		1332	// servers have to be polled
		1333	if (THISNODE->dns_port)
		1334	return;
		1335
897	// check for timeouts and (re)transmit	1336	// check for timeouts and (re)transmit
898	tstamp next = NOW + 60;	1337	tstamp next = 86400 * 365;
899	dns_req *send = 0;	1338	dns_snd *send = 0;
900		1339
901	for (vector<dns_req *>::iterator i = vpn->dns_sndpq.begin ();	1340	for (vector<dns_snd *>::iterator i = vpn->dns_sndpq.begin ();
902	i != vpn->dns_sndpq.end ();	1341	i != vpn->dns_sndpq.end ();
903	++i)	1342	++i)
904	{	1343	{
905	dns_req *r = *i;	1344	dns_snd *r = *i;
906		1345
907	if (r->next <= NOW)	1346	if (r->timeout <= ev_now ())
908	{	1347	{
909	if (!send)	1348	if (!send)
910	{	1349	{
911	send = r;	1350	send = r;
912		1351
913	if (r->retry)//D
914	printf ("req %d:%d, retry %d\n", r->seqno, r->pkt->id, r->retry);
915	r->retry++;	1352	r->retry++;
916	r->next = NOW + r->retry;	1353	r->timeout = ev_now () + r->retry * min_latency * conf.dns_timeout_factor;
		1354	//printf ("RETRY %x (%d, %f)\n", r->seqno, r->retry, r->timeout - ev_now ());//D
		1355
		1356	// the following code changes the query section a bit, forcing
		1357	// the forwarder to generate a new request
		1358	if (r->stdhdr)
		1359	encode_header ((char *)r->pkt->at (6 * 2 + 1), THISNODE->id, r->seqno, r->retry);
917	}	1360	}
918	}	1361	}
919		1362	else
920	if (r->next < next)	1363	min_it (next, r->timeout - ev_now ());
921	next = r->next;
922	}	1364	}
923		1365
924	if (!send	1366	if (!send)
925	&& vpn->dns_sndpq.size () < MAX_OUTSTANDING)
926	{	1367	{
		1368	// generate a new packet, if wise
		1369
		1370	if (!established)
		1371	{
		1372	if (vpn->dns_sndpq.empty ())
		1373	{
927	send = new dns_req (this);	1374	send = new dns_snd (this);
		1375
		1376	cfg.reset (THISNODE->id);
		1377	set_cfg ();
		1378	send->gen_syn_req ();
		1379	}
		1380	}
		1381	else if (vpn->dns_sndpq.size () < conf.dns_max_outstanding
		1382	&& !SEQNO_EQ (rcvseq, sndseq - (MAX_WINDOW - 1)))
		1383	{
		1384	if (last_sent + send_interval <= ev_now ())
		1385	{
		1386	//printf ("sending data request etc.\n"); //D
		1387	if (!snddq.empty ())
		1388	min_it (next, send_interval);
		1389
		1390	send = new dns_snd (this);
928	send->gen_stream_req (dns_sndseq, dns_snddq);	1391	send->gen_stream_req (sndseq, snddq);
		1392	send->timeout = ev_now () + min_latency * conf.dns_timeout_factor;
		1393	//printf ("SEND %x (%f)\n", send->seqno, send->timeout - ev_now (), min_latency, conf.dns_timeout_factor);//D
		1394
		1395	sndseq = (sndseq + 1) & SEQNO_MASK;
		1396	}
		1397	else
		1398	min_it (next, last_sent + send_interval - ev_now ());
		1399	}
		1400
		1401	if (send)
929	vpn->dns_sndpq.push_back (send);	1402	vpn->dns_sndpq.push_back (send);
930
931	dns_sndseq = (dns_sndseq + 1) & SEQNO_MASK;
932	}	1403	}
933
934	tstamp min_next = NOW + (1. / (tstamp)MAX_RATE);
935		1404
936	if (send)	1405	if (send)
937	{	1406	{
938	dns_packet *pkt = send->pkt;	1407	last_sent = ev_now ();
939		1408	sendto (vpn->dnsv4_fd,
940	next = min_next;	1409	send->pkt->at (0), send->pkt->len, 0,
941		1410	vpn->dns_forwarder.sav4 (), vpn->dns_forwarder.salenv4 ());
942	sendto (vpn->dnsv4_fd, &((*pkt)[0]), pkt->len, 0, dns_si.sav4 (), dns_si.salenv4 ());
943	}	1411	}
944	else if (next < min_next)	1412
945	next = min_next;	1413	min_it (next, last_sent + max (poll_interval, send_interval) - ev_now ());
		1414
		1415	slog (L_NOISE, "DNS: pi %f si %f N %f (%d:%d %d)",
		1416	poll_interval, send_interval, next - ev_now (),
		1417	vpn->dns_sndpq.size (), snddq.size (),
		1418	rcvpq.size ());
946		1419
947	w.start (next);	1420	w.start (next);
948	}	1421	}
949		1422
950	#endif	1423	#endif

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines