2006-06-05 21:47:09 +03:00
|
|
|
/*
|
2014-06-01 09:46:42 +03:00
|
|
|
* Copyright (c) 2006-2014 Erik Ekman <yarrick@kryo.se>,
|
|
|
|
* 2006-2009 Bjorn Andersson <flex@kryo.se>
|
2006-06-05 21:47:09 +03:00
|
|
|
*
|
|
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
|
|
* copyright notice and this permission notice appear in all copies.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdint.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <string.h>
|
2014-05-29 19:37:40 +03:00
|
|
|
#include <strings.h>
|
2006-06-05 21:47:09 +03:00
|
|
|
#include <signal.h>
|
|
|
|
#include <unistd.h>
|
2008-07-12 15:26:41 +03:00
|
|
|
#include <sys/param.h>
|
2007-06-17 14:46:05 +03:00
|
|
|
#include <sys/time.h>
|
2009-01-25 00:19:11 +02:00
|
|
|
#include <fcntl.h>
|
|
|
|
#include <time.h>
|
|
|
|
#include <zlib.h>
|
|
|
|
|
2009-09-20 12:09:18 +03:00
|
|
|
#include "common.h"
|
|
|
|
|
2009-01-25 00:19:11 +02:00
|
|
|
#ifdef WINDOWS32
|
|
|
|
#include "windows.h"
|
2009-03-07 02:00:58 +02:00
|
|
|
#include <winsock2.h>
|
2009-01-25 00:19:11 +02:00
|
|
|
#else
|
|
|
|
#include <arpa/nameser.h>
|
|
|
|
#ifdef DARWIN
|
2009-09-19 11:32:57 +03:00
|
|
|
#define BIND_8_COMPAT
|
|
|
|
#include <arpa/nameser_compat.h>
|
2009-01-25 00:19:11 +02:00
|
|
|
#endif
|
2008-12-25 18:56:13 +02:00
|
|
|
#define _XPG4_2
|
2007-02-11 12:47:31 +02:00
|
|
|
#include <netinet/in_systm.h>
|
2007-02-11 02:50:02 +02:00
|
|
|
#include <netinet/ip.h>
|
2009-01-25 00:19:11 +02:00
|
|
|
#include <grp.h>
|
|
|
|
#include <sys/uio.h>
|
|
|
|
#include <pwd.h>
|
|
|
|
#include <netdb.h>
|
2009-02-15 20:24:12 +02:00
|
|
|
#include <syslog.h>
|
2008-08-06 00:53:19 +03:00
|
|
|
#endif
|
2006-06-05 21:47:09 +03:00
|
|
|
|
|
|
|
#include "dns.h"
|
2007-06-09 19:18:59 +03:00
|
|
|
#include "encoding.h"
|
|
|
|
#include "base32.h"
|
2008-09-14 14:34:56 +03:00
|
|
|
#include "base64.h"
|
2009-12-29 22:00:57 +02:00
|
|
|
#include "base64u.h"
|
|
|
|
#include "base128.h"
|
2007-02-11 13:21:18 +02:00
|
|
|
#include "user.h"
|
2006-11-18 18:08:47 +02:00
|
|
|
#include "login.h"
|
2007-02-04 17:21:55 +02:00
|
|
|
#include "tun.h"
|
2008-08-08 00:18:15 +03:00
|
|
|
#include "fw_query.h"
|
2006-11-18 18:08:47 +02:00
|
|
|
#include "version.h"
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2013-12-23 11:48:46 +02:00
|
|
|
#ifdef HAVE_SYSTEMD
|
|
|
|
# include <systemd/sd-daemon.h>
|
|
|
|
#endif
|
|
|
|
|
2009-01-25 19:16:00 +02:00
|
|
|
#ifdef WINDOWS32
|
2009-02-21 12:07:10 +02:00
|
|
|
WORD req_version = MAKEWORD(2, 2);
|
2009-01-25 19:16:00 +02:00
|
|
|
WSADATA wsa_data;
|
|
|
|
#endif
|
|
|
|
|
2009-09-19 11:09:12 +03:00
|
|
|
#define PASSWORD_ENV_VAR "IODINED_PASS"
|
|
|
|
|
2007-07-12 18:50:06 +03:00
|
|
|
static int running = 1;
|
|
|
|
static char *topdomain;
|
|
|
|
static char password[33];
|
|
|
|
static struct encoder *b32;
|
2009-09-20 18:11:16 +03:00
|
|
|
static struct encoder *b64;
|
2009-12-29 22:00:57 +02:00
|
|
|
static struct encoder *b64u;
|
|
|
|
static struct encoder *b128;
|
2009-01-04 14:39:28 +02:00
|
|
|
static int created_users;
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2008-07-13 01:39:29 +03:00
|
|
|
static int check_ip;
|
2007-07-12 18:50:06 +03:00
|
|
|
static int my_mtu;
|
|
|
|
static in_addr_t my_ip;
|
2009-01-04 14:39:28 +02:00
|
|
|
static int netmask;
|
2006-06-23 10:58:36 +03:00
|
|
|
|
2008-09-14 16:21:11 +03:00
|
|
|
static in_addr_t ns_ip;
|
|
|
|
|
2008-08-08 00:18:15 +03:00
|
|
|
static int bind_port;
|
2008-08-06 01:37:40 +03:00
|
|
|
static int debug;
|
|
|
|
|
2008-07-12 15:26:41 +03:00
|
|
|
#if !defined(BSD) && !defined(__GLIBC__)
|
|
|
|
static char *__progname;
|
|
|
|
#endif
|
|
|
|
|
2009-08-06 22:48:55 +03:00
|
|
|
static int read_dns(int, int, struct query *);
|
2009-09-20 18:11:16 +03:00
|
|
|
static void write_dns(int, struct query *, char *, int, char);
|
2009-09-21 00:10:41 +03:00
|
|
|
static void handle_full_packet(int, int, int);
|
2007-02-04 17:46:06 +02:00
|
|
|
|
2012-09-03 11:34:27 +03:00
|
|
|
/* Ask externalip.net webservice to get external ip */
|
|
|
|
static int get_external_ip(struct in_addr *ip)
|
|
|
|
{
|
|
|
|
int sock;
|
|
|
|
struct addrinfo *addr;
|
|
|
|
int res;
|
2014-01-30 00:12:22 +02:00
|
|
|
const char *getstr = "GET /ip/ HTTP/1.0\r\n"
|
|
|
|
/* HTTP 1.0 to avoid chunked transfer coding */
|
|
|
|
"Host: api.externalip.net\r\n\r\n";
|
2012-09-03 11:34:27 +03:00
|
|
|
char buf[512];
|
|
|
|
char *b;
|
|
|
|
int len;
|
|
|
|
|
|
|
|
res = getaddrinfo("api.externalip.net", "80", NULL, &addr);
|
|
|
|
if (res < 0) return 1;
|
|
|
|
|
|
|
|
sock = socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol);
|
|
|
|
if (sock < 0) {
|
|
|
|
freeaddrinfo(addr);
|
|
|
|
return 2;
|
|
|
|
}
|
|
|
|
|
|
|
|
res = connect(sock, addr->ai_addr, addr->ai_addrlen);
|
|
|
|
freeaddrinfo(addr);
|
|
|
|
if (res < 0) return 3;
|
|
|
|
|
|
|
|
res = write(sock, getstr, strlen(getstr));
|
|
|
|
if (res != strlen(getstr)) return 4;
|
|
|
|
|
2014-01-30 00:12:22 +02:00
|
|
|
/* Zero buf before receiving, leave at least one zero at the end */
|
|
|
|
memset(buf, 0, sizeof(buf));
|
|
|
|
res = read(sock, buf, sizeof(buf) - 1);
|
2012-09-03 11:34:27 +03:00
|
|
|
if (res < 0) return 5;
|
|
|
|
len = res;
|
|
|
|
|
|
|
|
res = close(sock);
|
|
|
|
if (res < 0) return 6;
|
|
|
|
|
|
|
|
b = buf;
|
|
|
|
while (len > 9) {
|
|
|
|
/* Look for split between headers and data */
|
|
|
|
if (strncmp("\r\n\r\n", b, 4) == 0) break;
|
|
|
|
b++;
|
|
|
|
len--;
|
|
|
|
}
|
|
|
|
if (len < 10) return 7;
|
|
|
|
b += 4;
|
|
|
|
|
|
|
|
res = inet_aton(b, ip);
|
|
|
|
return (res == 0);
|
|
|
|
}
|
|
|
|
|
2006-06-05 21:47:09 +03:00
|
|
|
static void
|
2014-06-01 09:34:18 +03:00
|
|
|
sigint(int sig)
|
2007-02-04 19:00:20 +02:00
|
|
|
{
|
2006-06-05 21:47:09 +03:00
|
|
|
running = 0;
|
|
|
|
}
|
|
|
|
|
2009-02-15 20:24:12 +02:00
|
|
|
#ifdef WINDOWS32
|
|
|
|
#define LOG_EMERG 0
|
|
|
|
#define LOG_ALERT 1
|
|
|
|
#define LOG_CRIT 2
|
|
|
|
#define LOG_ERR 3
|
|
|
|
#define LOG_WARNING 4
|
|
|
|
#define LOG_NOTICE 5
|
|
|
|
#define LOG_INFO 6
|
|
|
|
#define LOG_DEBUG 7
|
|
|
|
static void
|
|
|
|
syslog(int a, const char *str, ...)
|
|
|
|
{
|
|
|
|
/* TODO: implement (add to event log), move to common.c */
|
|
|
|
;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2008-08-05 17:47:51 +03:00
|
|
|
static int
|
2009-01-10 22:23:50 +02:00
|
|
|
check_user_and_ip(int userid, struct query *q)
|
2008-08-05 17:47:51 +03:00
|
|
|
{
|
|
|
|
struct sockaddr_in *tempin;
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Note: duplicate in handle_raw_login() except IP-address check */
|
|
|
|
|
2009-01-10 22:23:50 +02:00
|
|
|
if (userid < 0 || userid >= created_users ) {
|
2014-06-01 09:34:18 +03:00
|
|
|
return 1;
|
2009-01-10 22:23:50 +02:00
|
|
|
}
|
2009-09-20 18:11:16 +03:00
|
|
|
if (!users[userid].active || users[userid].disabled) {
|
2009-01-10 22:23:50 +02:00
|
|
|
return 1;
|
|
|
|
}
|
2009-08-06 23:42:26 +03:00
|
|
|
if (users[userid].last_pkt + 60 < time(NULL)) {
|
|
|
|
return 1;
|
|
|
|
}
|
2009-01-10 22:23:50 +02:00
|
|
|
|
|
|
|
/* return early if IP checking is disabled */
|
|
|
|
if (!check_ip) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-08-05 17:47:51 +03:00
|
|
|
tempin = (struct sockaddr_in *) &(q->from);
|
|
|
|
return memcmp(&(users[userid].host), &(tempin->sin_addr), sizeof(struct in_addr));
|
|
|
|
}
|
|
|
|
|
2009-08-06 23:42:26 +03:00
|
|
|
static void
|
|
|
|
send_raw(int fd, char *buf, int buflen, int user, int cmd, struct query *q)
|
|
|
|
{
|
|
|
|
char packet[4096];
|
|
|
|
int len;
|
|
|
|
|
|
|
|
len = MIN(sizeof(packet) - RAW_HDR_LEN, buflen);
|
|
|
|
|
|
|
|
memcpy(packet, raw_header, RAW_HDR_LEN);
|
2009-08-15 15:43:02 +03:00
|
|
|
if (len) {
|
|
|
|
memcpy(&packet[RAW_HDR_LEN], buf, len);
|
|
|
|
}
|
2009-08-06 23:42:26 +03:00
|
|
|
|
|
|
|
len += RAW_HDR_LEN;
|
|
|
|
packet[RAW_HDR_CMD] = cmd | (user & 0x0F);
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
if (debug >= 2) {
|
2014-06-01 09:34:18 +03:00
|
|
|
fprintf(stderr, "TX-raw: client %s, cmd %d, %d bytes\n",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q->from, q->fromlen), cmd, len);
|
2009-12-29 22:00:57 +02:00
|
|
|
}
|
|
|
|
|
2014-02-05 23:36:53 +02:00
|
|
|
sendto(fd, packet, len, 0, (struct sockaddr *) &q->from, q->fromlen);
|
2009-08-06 23:42:26 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
static void
|
|
|
|
start_new_outpacket(int userid, char *data, int datalen)
|
|
|
|
/* Copies data to .outpacket and resets all counters.
|
|
|
|
data is expected to be compressed already. */
|
|
|
|
{
|
|
|
|
datalen = MIN(datalen, sizeof(users[userid].outpacket.data));
|
|
|
|
memcpy(users[userid].outpacket.data, data, datalen);
|
|
|
|
users[userid].outpacket.len = datalen;
|
|
|
|
users[userid].outpacket.offset = 0;
|
|
|
|
users[userid].outpacket.sentlen = 0;
|
|
|
|
users[userid].outpacket.seqno = (users[userid].outpacket.seqno + 1) & 7;
|
|
|
|
users[userid].outpacket.fragment = 0;
|
|
|
|
users[userid].outfragresent = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef OUTPACKETQ_LEN
|
|
|
|
|
|
|
|
static int
|
|
|
|
save_to_outpacketq(int userid, char *data, int datalen)
|
|
|
|
/* Find space in outpacket-queue and store data (expected compressed already).
|
|
|
|
Returns: 1 = okay, 0 = no space. */
|
|
|
|
{
|
|
|
|
int fill;
|
|
|
|
|
|
|
|
if (users[userid].outpacketq_filled >= OUTPACKETQ_LEN)
|
|
|
|
/* no space */
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
fill = users[userid].outpacketq_nexttouse +
|
|
|
|
users[userid].outpacketq_filled;
|
|
|
|
if (fill >= OUTPACKETQ_LEN)
|
|
|
|
fill -= OUTPACKETQ_LEN;
|
|
|
|
|
|
|
|
datalen = MIN(datalen, sizeof(users[userid].outpacketq[fill].data));
|
|
|
|
memcpy(users[userid].outpacketq[fill].data, data, datalen);
|
|
|
|
users[userid].outpacketq[fill].len = datalen;
|
|
|
|
|
|
|
|
users[userid].outpacketq_filled++;
|
|
|
|
|
|
|
|
if (debug >= 3)
|
|
|
|
fprintf(stderr, " Qstore, now %d\n",
|
|
|
|
users[userid].outpacketq_filled);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
get_from_outpacketq(int userid)
|
|
|
|
/* Starts new outpacket from queue, if any.
|
|
|
|
Returns: 1 = okay, 0 = no packets were waiting. */
|
|
|
|
{
|
|
|
|
int use;
|
|
|
|
|
|
|
|
if (users[userid].outpacketq_filled <= 0)
|
|
|
|
/* no packets */
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
use = users[userid].outpacketq_nexttouse;
|
|
|
|
|
|
|
|
start_new_outpacket(userid, users[userid].outpacketq[use].data,
|
|
|
|
users[userid].outpacketq[use].len);
|
|
|
|
|
|
|
|
use++;
|
|
|
|
if (use >= OUTPACKETQ_LEN)
|
|
|
|
use = 0;
|
|
|
|
users[userid].outpacketq_nexttouse = use;
|
|
|
|
users[userid].outpacketq_filled--;
|
|
|
|
|
|
|
|
if (debug >= 3)
|
|
|
|
fprintf(stderr, " Qget, now %d\n",
|
|
|
|
users[userid].outpacketq_filled);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* OUTPACKETQ_LEN */
|
|
|
|
|
|
|
|
#ifdef DNSCACHE_LEN
|
|
|
|
|
|
|
|
/* On the DNS cache:
|
|
|
|
|
|
|
|
This cache is implemented to better handle the aggressively impatient DNS
|
|
|
|
servers that very quickly re-send requests when we choose to not
|
|
|
|
immediately answer them in lazy mode. This cache works much better than
|
|
|
|
pruning(=dropping) the improper requests, since the DNS server will
|
|
|
|
actually get an answer instead of silence.
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
Because of the CMC in both ping and upstream data, unwanted cache hits
|
|
|
|
are prevented. Data-CMC is only 36 counts, so our cache length should
|
|
|
|
not exceed 36/2=18 packets. (This quick rule assumes all packets are
|
|
|
|
otherwise equal, which they arent: up/downstream seq/frag, tcp sequence
|
|
|
|
number, and of course data.)
|
2009-09-21 00:10:41 +03:00
|
|
|
*/
|
|
|
|
|
|
|
|
static void
|
|
|
|
save_to_dnscache(int userid, struct query *q, char *answer, int answerlen)
|
|
|
|
/* Store answer in our little DNS cache. */
|
|
|
|
{
|
|
|
|
int fill;
|
|
|
|
|
|
|
|
if (answerlen > sizeof(users[userid].dnscache_answer[fill]))
|
|
|
|
return; /* can't store this */
|
|
|
|
|
|
|
|
fill = users[userid].dnscache_lastfilled + 1;
|
|
|
|
if (fill >= DNSCACHE_LEN)
|
|
|
|
fill = 0;
|
|
|
|
|
|
|
|
memcpy(&(users[userid].dnscache_q[fill]), q, sizeof(struct query));
|
|
|
|
memcpy(users[userid].dnscache_answer[fill], answer, answerlen);
|
|
|
|
users[userid].dnscache_answerlen[fill] = answerlen;
|
|
|
|
|
|
|
|
users[userid].dnscache_lastfilled = fill;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
answer_from_dnscache(int dns_fd, int userid, struct query *q)
|
|
|
|
/* Checks cache and sends repeated answer if we alreay saw this query recently.
|
|
|
|
Returns: 1 = answer sent, drop this query, 0 = no answer sent, this is
|
|
|
|
a new query. */
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
int use;
|
|
|
|
|
|
|
|
for (i = 0; i < DNSCACHE_LEN ; i++) {
|
|
|
|
/* Try cache most-recent-first */
|
|
|
|
use = users[userid].dnscache_lastfilled - i;
|
|
|
|
if (use < 0)
|
|
|
|
use += DNSCACHE_LEN;
|
|
|
|
|
|
|
|
if (users[userid].dnscache_q[use].id == 0)
|
|
|
|
continue;
|
|
|
|
if (users[userid].dnscache_answerlen[use] <= 0)
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (users[userid].dnscache_q[use].type != q->type ||
|
|
|
|
strcmp(users[userid].dnscache_q[use].name, q->name))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
/* okay, match */
|
2009-12-29 22:00:57 +02:00
|
|
|
if (debug >= 1)
|
|
|
|
fprintf(stderr, "OUT user %d %s from dnscache\n", userid, q->name);
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
write_dns(dns_fd, q, users[userid].dnscache_answer[use],
|
|
|
|
users[userid].dnscache_answerlen[use],
|
|
|
|
users[userid].downenc);
|
|
|
|
|
|
|
|
q->id = 0; /* this query was used */
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* here only when no match found */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* DNSCACHE_LEN */
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
static inline void
|
|
|
|
save_to_qmem(unsigned char *qmem_cmc, unsigned short *qmem_type, int qmem_len,
|
|
|
|
int *qmem_lastfilled, unsigned char *cmc_to_add,
|
|
|
|
unsigned short type_to_add)
|
|
|
|
/* Remember query to check for duplicates */
|
|
|
|
{
|
|
|
|
int fill;
|
|
|
|
|
|
|
|
fill = *qmem_lastfilled + 1;
|
|
|
|
if (fill >= qmem_len)
|
|
|
|
fill = 0;
|
|
|
|
|
|
|
|
memcpy(qmem_cmc + fill * 4, cmc_to_add, 4);
|
|
|
|
qmem_type[fill] = type_to_add;
|
|
|
|
*qmem_lastfilled = fill;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void
|
|
|
|
save_to_qmem_pingordata(int userid, struct query *q)
|
|
|
|
{
|
|
|
|
/* Our CMC is a bit more than the "official" CMC; we store 4 bytes
|
|
|
|
just because we can, and because it may prevent some false matches.
|
|
|
|
For ping, we save the 4 decoded bytes: userid + seq/frag + CMC.
|
|
|
|
For data, we save the 4 _un_decoded chars in lowercase: seq/frag's
|
|
|
|
+ 1 char CMC; that last char is non-Base32.
|
|
|
|
*/
|
|
|
|
|
|
|
|
char cmc[8];
|
|
|
|
int i;
|
|
|
|
|
|
|
|
if (q->name[0] == 'P' || q->name[0] == 'p') {
|
|
|
|
/* Ping packet */
|
|
|
|
|
|
|
|
size_t cmcsize = sizeof(cmc);
|
|
|
|
char *cp = strchr(q->name, '.');
|
|
|
|
|
|
|
|
if (cp == NULL)
|
|
|
|
return; /* illegal hostname; shouldn't happen */
|
|
|
|
|
|
|
|
/* We already unpacked in handle_null_request(), but that's
|
|
|
|
lost now... Note: b32 directly, we want no undotify here! */
|
|
|
|
i = b32->decode(cmc, &cmcsize, q->name + 1, (cp - q->name) - 1);
|
|
|
|
|
|
|
|
if (i < 4)
|
|
|
|
return; /* illegal ping; shouldn't happen */
|
|
|
|
|
|
|
|
save_to_qmem(users[userid].qmemping_cmc,
|
|
|
|
users[userid].qmemping_type, QMEMPING_LEN,
|
|
|
|
&users[userid].qmemping_lastfilled,
|
|
|
|
(void *) cmc, q->type);
|
|
|
|
} else {
|
|
|
|
/* Data packet, hopefully not illegal */
|
|
|
|
if (strlen(q->name) < 5)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* We store CMC in lowercase; if routing via multiple parallel
|
|
|
|
DNS servers, one may do case-switch and another may not,
|
|
|
|
and we still want to detect duplicates.
|
|
|
|
Data-header is always base32, so case-swap won't hurt.
|
|
|
|
*/
|
|
|
|
for (i = 0; i < 4; i++)
|
|
|
|
if (q->name[i+1] >= 'A' && q->name[i+1] <= 'Z')
|
|
|
|
cmc[i] = q->name[i+1] + ('a' - 'A');
|
|
|
|
else
|
|
|
|
cmc[i] = q->name[i+1];
|
|
|
|
|
|
|
|
save_to_qmem(users[userid].qmemdata_cmc,
|
|
|
|
users[userid].qmemdata_type, QMEMDATA_LEN,
|
|
|
|
&users[userid].qmemdata_lastfilled,
|
|
|
|
(void *) cmc, q->type);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
answer_from_qmem(int dns_fd, struct query *q, unsigned char *qmem_cmc,
|
|
|
|
unsigned short *qmem_type, int qmem_len,
|
|
|
|
unsigned char *cmc_to_check)
|
|
|
|
/* Checks query memory and sends an (illegal) answer if this is a duplicate.
|
|
|
|
Returns: 1 = answer sent, drop this query, 0 = no answer sent, this is
|
|
|
|
not a duplicate. */
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (i = 0; i < qmem_len ; i++) {
|
|
|
|
|
|
|
|
if (qmem_type[i] == T_UNSET)
|
|
|
|
continue;
|
|
|
|
if (qmem_type[i] != q->type)
|
|
|
|
continue;
|
|
|
|
if (memcmp(qmem_cmc + i * 4, cmc_to_check, 4))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
/* okay, match */
|
|
|
|
if (debug >= 1)
|
|
|
|
fprintf(stderr, "OUT from qmem for %s == duplicate, sending illegal reply\n", q->name);
|
|
|
|
|
|
|
|
write_dns(dns_fd, q, "x", 1, 'T');
|
|
|
|
|
|
|
|
q->id = 0; /* this query was used */
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* here only when no match found */
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int
|
|
|
|
answer_from_qmem_data(int dns_fd, int userid, struct query *q)
|
|
|
|
/* Quick helper function to keep handle_null_request() clean */
|
|
|
|
{
|
|
|
|
char cmc[4];
|
|
|
|
int i;
|
|
|
|
|
|
|
|
for (i = 0; i < 4; i++)
|
|
|
|
if (q->name[i+1] >= 'A' && q->name[i+1] <= 'Z')
|
|
|
|
cmc[i] = q->name[i+1] + ('a' - 'A');
|
|
|
|
else
|
|
|
|
cmc[i] = q->name[i+1];
|
|
|
|
|
|
|
|
return answer_from_qmem(dns_fd, q, users[userid].qmemdata_cmc,
|
|
|
|
users[userid].qmemdata_type, QMEMDATA_LEN,
|
|
|
|
(void *) cmc);
|
|
|
|
}
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
static int
|
|
|
|
send_chunk_or_dataless(int dns_fd, int userid, struct query *q)
|
|
|
|
/* Sends current fragment to user, or dataless packet if there is no
|
|
|
|
current fragment available (-> normal "quiet" ping reply).
|
|
|
|
Does not update anything, except:
|
|
|
|
- discards q always (query is used)
|
|
|
|
- forgets entire users[userid].outpacket if it was sent in one go,
|
|
|
|
and then tries to get new packet from outpacket-queue
|
|
|
|
Returns: 1 = can call us again immediately, new packet from queue;
|
|
|
|
0 = don't call us again for now.
|
|
|
|
*/
|
|
|
|
{
|
|
|
|
char pkt[4096];
|
|
|
|
int datalen = 0;
|
|
|
|
int last = 0;
|
|
|
|
|
|
|
|
/* If re-sent too many times, drop entire packet */
|
|
|
|
if (users[userid].outpacket.len > 0 &&
|
|
|
|
users[userid].outfragresent > 5) {
|
|
|
|
users[userid].outpacket.len = 0;
|
|
|
|
users[userid].outpacket.offset = 0;
|
|
|
|
users[userid].outpacket.sentlen = 0;
|
|
|
|
users[userid].outfragresent = 0;
|
|
|
|
|
|
|
|
#ifdef OUTPACKETQ_LEN
|
|
|
|
/* Maybe more in queue, use immediately */
|
|
|
|
get_from_outpacketq(userid);
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
if (users[userid].outpacket.len > 0) {
|
|
|
|
datalen = MIN(users[userid].fragsize, users[userid].outpacket.len - users[userid].outpacket.offset);
|
|
|
|
datalen = MIN(datalen, sizeof(pkt)-2);
|
|
|
|
|
|
|
|
memcpy(&pkt[2], users[userid].outpacket.data + users[userid].outpacket.offset, datalen);
|
|
|
|
users[userid].outpacket.sentlen = datalen;
|
|
|
|
last = (users[userid].outpacket.len == users[userid].outpacket.offset + datalen);
|
|
|
|
|
|
|
|
users[userid].outfragresent++;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Build downstream data header (see doc/proto_xxxxxxxx.txt) */
|
|
|
|
|
|
|
|
/* First byte is 1 bit compression flag, 3 bits upstream seqno, 4 bits upstream fragment */
|
|
|
|
pkt[0] = (1<<7) | ((users[userid].inpacket.seqno & 7) << 4) |
|
|
|
|
(users[userid].inpacket.fragment & 15);
|
|
|
|
/* Second byte is 3 bits downstream seqno, 4 bits downstream fragment, 1 bit last flag */
|
2014-06-01 09:34:18 +03:00
|
|
|
pkt[1] = ((users[userid].outpacket.seqno & 7) << 5) |
|
2009-09-21 00:10:41 +03:00
|
|
|
((users[userid].outpacket.fragment & 15) << 1) | (last & 1);
|
|
|
|
|
|
|
|
if (debug >= 1) {
|
|
|
|
fprintf(stderr, "OUT pkt seq# %d, frag %d (last=%d), offset %d, fragsize %d, total %d, to user %d\n",
|
2014-06-01 09:34:18 +03:00
|
|
|
users[userid].outpacket.seqno & 7, users[userid].outpacket.fragment & 15,
|
2009-09-21 00:10:41 +03:00
|
|
|
last, users[userid].outpacket.offset, datalen, users[userid].outpacket.len, userid);
|
|
|
|
}
|
|
|
|
write_dns(dns_fd, q, pkt, datalen + 2, users[userid].downenc);
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
if (q->id2 != 0) {
|
|
|
|
q->id = q->id2;
|
|
|
|
q->fromlen = q->fromlen2;
|
|
|
|
memcpy(&(q->from), &(q->from2), q->fromlen2);
|
|
|
|
if (debug >= 1)
|
|
|
|
fprintf(stderr, "OUT again to last duplicate\n");
|
|
|
|
write_dns(dns_fd, q, pkt, datalen + 2, users[userid].downenc);
|
|
|
|
}
|
|
|
|
|
|
|
|
save_to_qmem_pingordata(userid, q);
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
#ifdef DNSCACHE_LEN
|
|
|
|
save_to_dnscache(userid, q, pkt, datalen + 2);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
q->id = 0; /* this query is used */
|
|
|
|
|
|
|
|
if (datalen > 0 && datalen == users[userid].outpacket.len) {
|
|
|
|
/* Whole packet was sent in one chunk, dont wait for ack */
|
|
|
|
users[userid].outpacket.len = 0;
|
|
|
|
users[userid].outpacket.offset = 0;
|
|
|
|
users[userid].outpacket.sentlen = 0;
|
|
|
|
users[userid].outfragresent = 0;
|
|
|
|
|
|
|
|
#ifdef OUTPACKETQ_LEN
|
|
|
|
/* Maybe more in queue, prepare for next time */
|
|
|
|
if (get_from_outpacketq(userid) == 1) {
|
|
|
|
if (debug >= 3)
|
|
|
|
fprintf(stderr, " Chunk & fromqueue: callagain\n");
|
|
|
|
return 1; /* call us again */
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0; /* don't call us again */
|
|
|
|
}
|
|
|
|
|
2006-06-05 21:47:09 +03:00
|
|
|
static int
|
2007-02-04 19:00:20 +02:00
|
|
|
tunnel_tun(int tun_fd, int dns_fd)
|
|
|
|
{
|
2007-02-11 00:17:11 +02:00
|
|
|
unsigned long outlen;
|
2007-02-11 12:42:57 +02:00
|
|
|
struct ip *header;
|
2007-02-04 19:00:20 +02:00
|
|
|
char out[64*1024];
|
|
|
|
char in[64*1024];
|
2007-02-11 02:50:02 +02:00
|
|
|
int userid;
|
2007-02-04 19:00:20 +02:00
|
|
|
int read;
|
|
|
|
|
|
|
|
if ((read = read_tun(tun_fd, in, sizeof(in))) <= 0)
|
|
|
|
return 0;
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2007-02-11 02:50:02 +02:00
|
|
|
/* find target ip in packet, in is padded with 4 bytes TUN header */
|
2007-02-11 12:42:57 +02:00
|
|
|
header = (struct ip*) (in + 4);
|
|
|
|
userid = find_user_by_ip(header->ip_dst.s_addr);
|
2007-02-11 02:50:02 +02:00
|
|
|
if (userid < 0)
|
|
|
|
return 0;
|
2007-02-04 19:00:20 +02:00
|
|
|
|
|
|
|
outlen = sizeof(out);
|
2007-02-11 00:17:11 +02:00
|
|
|
compress2((uint8_t*)out, &outlen, (uint8_t*)in, read, 9);
|
2007-02-04 19:00:20 +02:00
|
|
|
|
2009-08-06 23:42:26 +03:00
|
|
|
if (users[userid].conn == CONN_DNS_NULL) {
|
2009-09-21 00:10:41 +03:00
|
|
|
#ifdef OUTPACKETQ_LEN
|
|
|
|
/* If a packet is being sent, try storing the new one in the queue.
|
|
|
|
If the queue is full, drop the packet. TCP will hopefully notice
|
|
|
|
and reduce the packet rate. */
|
|
|
|
if (users[userid].outpacket.len > 0) {
|
|
|
|
save_to_outpacketq(userid, out, outlen);
|
2009-08-06 23:42:26 +03:00
|
|
|
return 0;
|
|
|
|
}
|
2009-09-21 00:10:41 +03:00
|
|
|
#endif
|
|
|
|
|
|
|
|
start_new_outpacket(userid, out, outlen);
|
|
|
|
|
|
|
|
/* Start sending immediately if query is waiting */
|
|
|
|
if (users[userid].q_sendrealsoon.id != 0)
|
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon);
|
|
|
|
else if (users[userid].q.id != 0)
|
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q);
|
|
|
|
|
|
|
|
return outlen;
|
2009-08-06 23:42:26 +03:00
|
|
|
} else { /* CONN_RAW_UDP */
|
|
|
|
send_raw(dns_fd, out, outlen, userid, RAW_HDR_CMD_DATA, &users[userid].q);
|
2008-07-12 14:36:39 +03:00
|
|
|
return outlen;
|
2007-02-11 13:51:30 +02:00
|
|
|
}
|
2007-02-04 19:00:20 +02:00
|
|
|
}
|
|
|
|
|
2007-02-11 00:17:11 +02:00
|
|
|
typedef enum {
|
|
|
|
VERSION_ACK,
|
2007-02-11 02:50:02 +02:00
|
|
|
VERSION_NACK,
|
|
|
|
VERSION_FULL
|
2007-02-11 00:17:11 +02:00
|
|
|
} version_ack_t;
|
|
|
|
|
|
|
|
static void
|
2008-08-07 17:16:12 +03:00
|
|
|
send_version_response(int fd, version_ack_t ack, uint32_t payload, int userid, struct query *q)
|
2007-02-11 00:17:11 +02:00
|
|
|
{
|
2007-02-11 02:50:02 +02:00
|
|
|
char out[9];
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2007-02-11 00:17:11 +02:00
|
|
|
switch (ack) {
|
|
|
|
case VERSION_ACK:
|
|
|
|
strncpy(out, "VACK", sizeof(out));
|
|
|
|
break;
|
|
|
|
case VERSION_NACK:
|
|
|
|
strncpy(out, "VNAK", sizeof(out));
|
|
|
|
break;
|
2007-02-11 02:50:02 +02:00
|
|
|
case VERSION_FULL:
|
|
|
|
strncpy(out, "VFUL", sizeof(out));
|
|
|
|
break;
|
2007-02-11 00:17:11 +02:00
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2007-02-11 00:17:11 +02:00
|
|
|
out[4] = ((payload >> 24) & 0xff);
|
|
|
|
out[5] = ((payload >> 16) & 0xff);
|
|
|
|
out[6] = ((payload >> 8) & 0xff);
|
|
|
|
out[7] = ((payload) & 0xff);
|
2008-08-07 17:16:12 +03:00
|
|
|
out[8] = userid & 0xff;
|
2007-02-11 00:17:11 +02:00
|
|
|
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(fd, q, out, sizeof(out), users[userid].downenc);
|
2007-02-11 00:17:11 +02:00
|
|
|
}
|
|
|
|
|
2009-01-04 15:53:32 +02:00
|
|
|
static void
|
2009-09-21 00:10:41 +03:00
|
|
|
process_downstream_ack(int userid, int down_seq, int down_frag)
|
|
|
|
/* Process acks from downstream fragments.
|
|
|
|
After this, .offset and .fragment are updated (if ack correct),
|
|
|
|
or .len is set to zero when all is done.
|
|
|
|
*/
|
2008-12-12 00:39:06 +02:00
|
|
|
{
|
2009-09-21 00:10:41 +03:00
|
|
|
if (users[userid].outpacket.len <= 0)
|
|
|
|
/* No packet to apply acks to */
|
2009-01-05 18:25:54 +02:00
|
|
|
return;
|
2008-12-12 00:39:06 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
if (users[userid].outpacket.seqno != down_seq ||
|
|
|
|
users[userid].outpacket.fragment != down_frag)
|
|
|
|
/* Not the ack we're waiting for; probably duplicate of old
|
|
|
|
ack, happens a lot with ping packets */
|
|
|
|
return;
|
2009-01-05 18:25:54 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
/* Received proper ack */
|
|
|
|
users[userid].outpacket.offset += users[userid].outpacket.sentlen;
|
|
|
|
users[userid].outpacket.sentlen = 0;
|
|
|
|
users[userid].outpacket.fragment++;
|
|
|
|
users[userid].outfragresent = 0;
|
2009-01-05 18:25:54 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
/* Is packet done? */
|
2009-12-29 22:00:57 +02:00
|
|
|
if (users[userid].outpacket.offset >= users[userid].outpacket.len) {
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].outpacket.len = 0;
|
|
|
|
users[userid].outpacket.offset = 0;
|
|
|
|
users[userid].outpacket.fragment--; /* unneeded ++ above */
|
2009-12-29 22:00:57 +02:00
|
|
|
/* ^keep last seqno/frag, are always returned on pings */
|
2009-09-21 00:10:41 +03:00
|
|
|
/* users[userid].outfragresent = 0; already above */
|
2009-01-05 18:25:54 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
#ifdef OUTPACKETQ_LEN
|
|
|
|
/* Possibly get new packet from queue */
|
|
|
|
get_from_outpacketq(userid);
|
|
|
|
#endif
|
2008-12-12 00:39:06 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-08-06 00:53:19 +03:00
|
|
|
static void
|
2008-08-07 19:49:22 +03:00
|
|
|
handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len)
|
2007-12-01 23:55:48 +02:00
|
|
|
{
|
2007-12-02 01:02:06 +02:00
|
|
|
struct in_addr tempip;
|
2008-08-07 19:49:22 +03:00
|
|
|
char in[512];
|
2007-12-02 01:02:06 +02:00
|
|
|
char logindata[16];
|
2006-08-25 00:23:29 +03:00
|
|
|
char out[64*1024];
|
2007-06-09 19:18:59 +03:00
|
|
|
char unpacked[64*1024];
|
2007-12-02 01:02:06 +02:00
|
|
|
char *tmp[2];
|
2007-02-11 02:50:02 +02:00
|
|
|
int userid;
|
2008-08-06 00:53:19 +03:00
|
|
|
int read;
|
2007-02-04 19:00:20 +02:00
|
|
|
|
2007-02-11 02:50:02 +02:00
|
|
|
userid = -1;
|
2008-08-07 19:49:22 +03:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
/* Everything here needs at least two chars in the name */
|
|
|
|
if (domain_len < 2)
|
|
|
|
return;
|
|
|
|
|
2008-08-07 19:49:22 +03:00
|
|
|
memcpy(in, q->name, MIN(domain_len, sizeof(in)));
|
2008-08-06 00:53:19 +03:00
|
|
|
|
2007-02-04 19:00:20 +02:00
|
|
|
if(in[0] == 'V' || in[0] == 'v') {
|
2009-08-15 22:28:48 +03:00
|
|
|
int version = 0;
|
|
|
|
|
2008-08-07 19:49:22 +03:00
|
|
|
read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32);
|
2007-12-02 01:02:06 +02:00
|
|
|
/* Version greeting, compare and send ack/nak */
|
2014-06-01 09:34:18 +03:00
|
|
|
if (read > 4) {
|
2007-12-02 01:02:06 +02:00
|
|
|
/* Received V + 32bits version */
|
|
|
|
version = (((unpacked[0] & 0xff) << 24) |
|
|
|
|
((unpacked[1] & 0xff) << 16) |
|
|
|
|
((unpacked[2] & 0xff) << 8) |
|
|
|
|
((unpacked[3] & 0xff)));
|
|
|
|
}
|
|
|
|
|
|
|
|
if (version == VERSION) {
|
|
|
|
userid = find_available_user();
|
|
|
|
if (userid >= 0) {
|
2009-12-29 22:00:57 +02:00
|
|
|
int i;
|
2008-08-05 17:47:51 +03:00
|
|
|
struct sockaddr_in *tempin;
|
|
|
|
|
2007-12-02 01:02:06 +02:00
|
|
|
users[userid].seed = rand();
|
2008-08-05 17:47:51 +03:00
|
|
|
/* Store remote IP number */
|
2008-08-06 00:53:19 +03:00
|
|
|
tempin = (struct sockaddr_in *) &(q->from);
|
2008-08-05 17:47:51 +03:00
|
|
|
memcpy(&(users[userid].host), &(tempin->sin_addr), sizeof(struct in_addr));
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-08-06 00:53:19 +03:00
|
|
|
memcpy(&(users[userid].q), q, sizeof(struct query));
|
2007-12-02 01:02:06 +02:00
|
|
|
users[userid].encoder = get_base32_encoder();
|
2009-09-20 18:11:16 +03:00
|
|
|
users[userid].downenc = 'T';
|
2008-08-07 17:16:12 +03:00
|
|
|
send_version_response(dns_fd, VERSION_ACK, users[userid].seed, userid, q);
|
2009-02-15 20:24:12 +02:00
|
|
|
syslog(LOG_INFO, "accepted version for user #%d from %s",
|
2014-02-06 20:39:16 +02:00
|
|
|
userid, format_addr(&q->from, q->fromlen));
|
2007-12-02 01:02:06 +02:00
|
|
|
users[userid].q.id = 0;
|
2009-12-29 22:00:57 +02:00
|
|
|
users[userid].q.id2 = 0;
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].q_sendrealsoon.id = 0;
|
2009-12-29 22:00:57 +02:00
|
|
|
users[userid].q_sendrealsoon.id2 = 0;
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].q_sendrealsoon_new = 0;
|
2009-09-20 18:11:16 +03:00
|
|
|
users[userid].outpacket.len = 0;
|
|
|
|
users[userid].outpacket.offset = 0;
|
|
|
|
users[userid].outpacket.sentlen = 0;
|
|
|
|
users[userid].outpacket.seqno = 0;
|
|
|
|
users[userid].outpacket.fragment = 0;
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].outfragresent = 0;
|
2009-09-20 18:11:16 +03:00
|
|
|
users[userid].inpacket.len = 0;
|
|
|
|
users[userid].inpacket.offset = 0;
|
|
|
|
users[userid].inpacket.seqno = 0;
|
|
|
|
users[userid].inpacket.fragment = 0;
|
|
|
|
users[userid].fragsize = 100; /* very safe */
|
2009-09-21 00:10:39 +03:00
|
|
|
users[userid].conn = CONN_DNS_NULL;
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].lazy = 0;
|
|
|
|
#ifdef OUTPACKETQ_LEN
|
|
|
|
users[userid].outpacketq_nexttouse = 0;
|
|
|
|
users[userid].outpacketq_filled = 0;
|
|
|
|
#endif
|
|
|
|
#ifdef DNSCACHE_LEN
|
|
|
|
{
|
|
|
|
for (i = 0; i < DNSCACHE_LEN; i++) {
|
|
|
|
users[userid].dnscache_q[i].id = 0;
|
|
|
|
users[userid].dnscache_answerlen[i] = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
users[userid].dnscache_lastfilled = 0;
|
|
|
|
#endif
|
2009-12-29 22:00:57 +02:00
|
|
|
for (i = 0; i < QMEMPING_LEN; i++)
|
|
|
|
users[userid].qmemping_type[i] = T_UNSET;
|
|
|
|
users[userid].qmemping_lastfilled = 0;
|
|
|
|
for (i = 0; i < QMEMDATA_LEN; i++)
|
|
|
|
users[userid].qmemdata_type[i] = T_UNSET;
|
|
|
|
users[userid].qmemdata_lastfilled = 0;
|
2007-12-02 01:02:06 +02:00
|
|
|
} else {
|
|
|
|
/* No space for another user */
|
2009-01-04 14:39:28 +02:00
|
|
|
send_version_response(dns_fd, VERSION_FULL, created_users, 0, q);
|
2014-06-01 09:34:18 +03:00
|
|
|
syslog(LOG_INFO, "dropped user from %s, server full",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q->from, q->fromlen));
|
2007-12-02 01:02:06 +02:00
|
|
|
}
|
|
|
|
} else {
|
2008-08-07 17:16:12 +03:00
|
|
|
send_version_response(dns_fd, VERSION_NACK, VERSION, 0, q);
|
2014-06-01 09:34:18 +03:00
|
|
|
syslog(LOG_INFO, "dropped user from %s, sent bad version %08X",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q->from, q->fromlen), version);
|
2007-12-02 01:02:06 +02:00
|
|
|
}
|
2008-08-07 19:49:22 +03:00
|
|
|
return;
|
2007-02-04 19:00:20 +02:00
|
|
|
} else if(in[0] == 'L' || in[0] == 'l') {
|
2008-08-07 19:49:22 +03:00
|
|
|
read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32);
|
2009-12-29 22:00:57 +02:00
|
|
|
if (read < 17) {
|
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2007-12-02 01:02:06 +02:00
|
|
|
/* Login phase, handle auth */
|
|
|
|
userid = unpacked[0];
|
|
|
|
|
2009-01-10 22:23:50 +02:00
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2009-02-15 20:24:12 +02:00
|
|
|
syslog(LOG_WARNING, "dropped login request from user #%d from unexpected source %s",
|
2014-02-06 20:39:16 +02:00
|
|
|
userid, format_addr(&q->from, q->fromlen));
|
2009-01-10 22:23:50 +02:00
|
|
|
return;
|
2007-12-02 01:02:06 +02:00
|
|
|
} else {
|
2009-01-10 22:23:50 +02:00
|
|
|
users[userid].last_pkt = time(NULL);
|
|
|
|
login_calculate(logindata, 16, password, users[userid].seed);
|
|
|
|
|
2007-12-02 01:02:06 +02:00
|
|
|
if (read >= 18 && (memcmp(logindata, unpacked+1, 16) == 0)) {
|
2009-01-04 14:39:28 +02:00
|
|
|
/* Login ok, send ip/mtu/netmask info */
|
2007-12-02 01:02:06 +02:00
|
|
|
|
|
|
|
tempip.s_addr = my_ip;
|
|
|
|
tmp[0] = strdup(inet_ntoa(tempip));
|
|
|
|
tempip.s_addr = users[userid].tun_ip;
|
|
|
|
tmp[1] = strdup(inet_ntoa(tempip));
|
|
|
|
|
2014-06-01 09:34:18 +03:00
|
|
|
read = snprintf(out, sizeof(out), "%s-%s-%d-%d",
|
2009-01-04 14:39:28 +02:00
|
|
|
tmp[0], tmp[1], my_mtu, netmask);
|
2007-12-02 01:02:06 +02:00
|
|
|
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, out, read, users[userid].downenc);
|
2008-08-06 00:53:19 +03:00
|
|
|
q->id = 0;
|
2009-02-15 20:24:12 +02:00
|
|
|
syslog(LOG_NOTICE, "accepted password from user #%d, given IP %s", userid, tmp[1]);
|
2007-12-02 01:02:06 +02:00
|
|
|
|
|
|
|
free(tmp[1]);
|
|
|
|
free(tmp[0]);
|
|
|
|
} else {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "LNAK", 4, 'T');
|
2009-02-15 20:24:12 +02:00
|
|
|
syslog(LOG_WARNING, "rejected login request from user #%d from %s, bad password",
|
2014-02-06 20:39:16 +02:00
|
|
|
userid, format_addr(&q->from, q->fromlen));
|
2007-12-02 01:02:06 +02:00
|
|
|
}
|
|
|
|
}
|
2008-08-07 19:49:22 +03:00
|
|
|
return;
|
2009-06-11 22:52:42 +03:00
|
|
|
} else if(in[0] == 'I' || in[0] == 'i') {
|
|
|
|
/* Request for IP number */
|
|
|
|
in_addr_t replyaddr;
|
|
|
|
unsigned addr;
|
|
|
|
char reply[5];
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-06-11 22:52:42 +03:00
|
|
|
userid = b32_8to5(in[1]);
|
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2009-06-11 22:52:42 +03:00
|
|
|
return; /* illegal id */
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ns_ip != INADDR_ANY) {
|
|
|
|
/* If set, use assigned external ip (-n option) */
|
|
|
|
replyaddr = ns_ip;
|
|
|
|
} else {
|
|
|
|
/* otherwise return destination ip from packet */
|
|
|
|
memcpy(&replyaddr, &q->destination.s_addr, sizeof(in_addr_t));
|
|
|
|
}
|
|
|
|
|
|
|
|
addr = htonl(replyaddr);
|
|
|
|
reply[0] = 'I';
|
|
|
|
reply[1] = (addr >> 24) & 0xFF;
|
|
|
|
reply[2] = (addr >> 16) & 0xFF;
|
|
|
|
reply[3] = (addr >> 8) & 0xFF;
|
|
|
|
reply[4] = (addr >> 0) & 0xFF;
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, reply, sizeof(reply), 'T');
|
2007-07-12 11:31:29 +03:00
|
|
|
} else if(in[0] == 'Z' || in[0] == 'z') {
|
2008-09-14 14:34:56 +03:00
|
|
|
/* Check for case conservation and chars not allowed according to RFC */
|
2007-07-12 11:31:29 +03:00
|
|
|
|
|
|
|
/* Reply with received hostname as data */
|
2009-09-20 18:11:16 +03:00
|
|
|
/* No userid here, reply with lowest-grade downenc */
|
|
|
|
write_dns(dns_fd, q, in, domain_len, 'T');
|
2008-08-06 00:53:19 +03:00
|
|
|
return;
|
2008-09-14 14:34:56 +03:00
|
|
|
} else if(in[0] == 'S' || in[0] == 's') {
|
|
|
|
int codec;
|
|
|
|
struct encoder *enc;
|
2009-06-12 08:44:34 +03:00
|
|
|
if (domain_len < 3) { /* len at least 3, example: "S15" */
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
2008-09-14 14:34:56 +03:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
userid = b32_8to5(in[1]);
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-01-10 22:23:50 +02:00
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2008-09-14 14:34:56 +03:00
|
|
|
return; /* illegal id */
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
codec = b32_8to5(in[2]);
|
|
|
|
|
2008-09-14 14:34:56 +03:00
|
|
|
switch (codec) {
|
|
|
|
case 5: /* 5 bits per byte = base32 */
|
|
|
|
enc = get_base32_encoder();
|
|
|
|
user_switch_codec(userid, enc);
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc);
|
2008-09-14 14:34:56 +03:00
|
|
|
break;
|
|
|
|
case 6: /* 6 bits per byte = base64 */
|
|
|
|
enc = get_base64_encoder();
|
|
|
|
user_switch_codec(userid, enc);
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc);
|
|
|
|
break;
|
2009-12-29 22:00:57 +02:00
|
|
|
case 26: /* "2nd" 6 bits per byte = base64u, with underscore */
|
|
|
|
enc = get_base64u_encoder();
|
|
|
|
user_switch_codec(userid, enc);
|
|
|
|
write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc);
|
|
|
|
break;
|
|
|
|
case 7: /* 7 bits per byte = base128 */
|
|
|
|
enc = get_base128_encoder();
|
|
|
|
user_switch_codec(userid, enc);
|
|
|
|
write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc);
|
|
|
|
break;
|
2009-09-20 18:11:16 +03:00
|
|
|
default:
|
|
|
|
write_dns(dns_fd, q, "BADCODEC", 8, users[userid].downenc);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return;
|
|
|
|
} else if(in[0] == 'O' || in[0] == 'o') {
|
2009-12-29 22:00:57 +02:00
|
|
|
if (domain_len < 3) { /* len at least 3, example: "O1T" */
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
userid = b32_8to5(in[1]);
|
|
|
|
|
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
|
|
|
return; /* illegal id */
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (in[2]) {
|
|
|
|
case 'T':
|
|
|
|
case 't':
|
|
|
|
users[userid].downenc = 'T';
|
|
|
|
write_dns(dns_fd, q, "Base32", 6, users[userid].downenc);
|
|
|
|
break;
|
|
|
|
case 'S':
|
|
|
|
case 's':
|
|
|
|
users[userid].downenc = 'S';
|
|
|
|
write_dns(dns_fd, q, "Base64", 6, users[userid].downenc);
|
|
|
|
break;
|
2009-12-29 22:00:57 +02:00
|
|
|
case 'U':
|
|
|
|
case 'u':
|
|
|
|
users[userid].downenc = 'U';
|
|
|
|
write_dns(dns_fd, q, "Base64u", 7, users[userid].downenc);
|
|
|
|
break;
|
|
|
|
case 'V':
|
|
|
|
case 'v':
|
|
|
|
users[userid].downenc = 'V';
|
|
|
|
write_dns(dns_fd, q, "Base128", 7, users[userid].downenc);
|
|
|
|
break;
|
2009-09-20 18:11:16 +03:00
|
|
|
case 'R':
|
|
|
|
case 'r':
|
|
|
|
users[userid].downenc = 'R';
|
|
|
|
write_dns(dns_fd, q, "Raw", 3, users[userid].downenc);
|
2008-09-14 14:34:56 +03:00
|
|
|
break;
|
2009-09-21 00:10:41 +03:00
|
|
|
case 'L':
|
|
|
|
case 'l':
|
|
|
|
users[userid].lazy = 1;
|
|
|
|
write_dns(dns_fd, q, "Lazy", 4, users[userid].downenc);
|
|
|
|
break;
|
|
|
|
case 'I':
|
|
|
|
case 'i':
|
|
|
|
users[userid].lazy = 0;
|
|
|
|
write_dns(dns_fd, q, "Immediate", 9, users[userid].downenc);
|
|
|
|
break;
|
2008-09-14 14:34:56 +03:00
|
|
|
default:
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADCODEC", 8, users[userid].downenc);
|
2008-09-14 14:34:56 +03:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
return;
|
2009-12-29 22:00:57 +02:00
|
|
|
} else if(in[0] == 'Y' || in[0] == 'y') {
|
|
|
|
int i;
|
|
|
|
char *datap;
|
|
|
|
int datalen;
|
|
|
|
|
|
|
|
if (domain_len < 6) { /* len at least 6, example: "YTxCMC" */
|
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
i = b32_8to5(in[2]); /* check variant */
|
|
|
|
|
|
|
|
switch (i) {
|
|
|
|
case 1:
|
|
|
|
datap = DOWNCODECCHECK1;
|
|
|
|
datalen = DOWNCODECCHECK1_LEN;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (in[1]) {
|
|
|
|
case 'T':
|
|
|
|
case 't':
|
|
|
|
if (q->type == T_TXT ||
|
|
|
|
q->type == T_SRV || q->type == T_MX ||
|
|
|
|
q->type == T_CNAME || q->type == T_A) {
|
|
|
|
write_dns(dns_fd, q, datap, datalen, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 'S':
|
|
|
|
case 's':
|
|
|
|
if (q->type == T_TXT ||
|
|
|
|
q->type == T_SRV || q->type == T_MX ||
|
|
|
|
q->type == T_CNAME || q->type == T_A) {
|
|
|
|
write_dns(dns_fd, q, datap, datalen, 'S');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 'U':
|
|
|
|
case 'u':
|
|
|
|
if (q->type == T_TXT ||
|
|
|
|
q->type == T_SRV || q->type == T_MX ||
|
|
|
|
q->type == T_CNAME || q->type == T_A) {
|
|
|
|
write_dns(dns_fd, q, datap, datalen, 'U');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 'V':
|
|
|
|
case 'v':
|
|
|
|
if (q->type == T_TXT ||
|
|
|
|
q->type == T_SRV || q->type == T_MX ||
|
|
|
|
q->type == T_CNAME || q->type == T_A) {
|
|
|
|
write_dns(dns_fd, q, datap, datalen, 'V');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case 'R':
|
|
|
|
case 'r':
|
|
|
|
if (q->type == T_NULL || q->type == T_TXT) {
|
|
|
|
write_dns(dns_fd, q, datap, datalen, 'R');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* if still here, then codec not available */
|
|
|
|
write_dns(dns_fd, q, "BADCODEC", 8, 'T');
|
|
|
|
return;
|
|
|
|
|
2009-01-10 18:22:51 +02:00
|
|
|
} else if(in[0] == 'R' || in[0] == 'r') {
|
|
|
|
int req_frag_size;
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
if (domain_len < 16) { /* we'd better have some chars for data... */
|
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2009-01-10 18:22:51 +02:00
|
|
|
/* Downstream fragsize probe packet */
|
|
|
|
userid = (b32_8to5(in[1]) >> 1) & 15;
|
2009-01-10 22:23:50 +02:00
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2009-01-10 18:22:51 +02:00
|
|
|
return; /* illegal id */
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-01-10 18:22:51 +02:00
|
|
|
req_frag_size = ((b32_8to5(in[1]) & 1) << 10) | ((b32_8to5(in[2]) & 31) << 5) | (b32_8to5(in[3]) & 31);
|
2014-06-01 09:34:18 +03:00
|
|
|
if (req_frag_size < 2 || req_frag_size > 2047) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADFRAG", 7, users[userid].downenc);
|
2009-01-10 18:22:51 +02:00
|
|
|
} else {
|
|
|
|
char buf[2048];
|
2009-09-20 18:11:16 +03:00
|
|
|
int i;
|
2009-12-29 22:00:57 +02:00
|
|
|
unsigned int v = ((unsigned int) rand()) & 0xff ;
|
2009-01-10 18:22:51 +02:00
|
|
|
|
|
|
|
memset(buf, 0, sizeof(buf));
|
|
|
|
buf[0] = (req_frag_size >> 8) & 0xff;
|
|
|
|
buf[1] = req_frag_size & 0xff;
|
2009-09-20 18:11:16 +03:00
|
|
|
/* make checkable pseudo-random sequence */
|
|
|
|
buf[2] = 107;
|
2009-12-29 22:00:57 +02:00
|
|
|
for (i = 3; i < 2048; i++, v = (v + 107) & 0xff)
|
|
|
|
buf[i] = v;
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, buf, req_frag_size, users[userid].downenc);
|
2009-01-10 18:22:51 +02:00
|
|
|
}
|
|
|
|
return;
|
2009-01-05 21:47:59 +02:00
|
|
|
} else if(in[0] == 'N' || in[0] == 'n') {
|
|
|
|
int max_frag_size;
|
|
|
|
|
|
|
|
read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32);
|
2009-12-29 22:00:57 +02:00
|
|
|
|
|
|
|
if (read < 3) {
|
|
|
|
write_dns(dns_fd, q, "BADLEN", 6, 'T');
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2009-01-05 21:47:59 +02:00
|
|
|
/* Downstream fragsize packet */
|
|
|
|
userid = unpacked[0];
|
2009-01-10 22:23:50 +02:00
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2009-01-05 21:47:59 +02:00
|
|
|
return; /* illegal id */
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-01-05 21:47:59 +02:00
|
|
|
max_frag_size = ((unpacked[1] & 0xff) << 8) | (unpacked[2] & 0xff);
|
2014-06-01 09:34:18 +03:00
|
|
|
if (max_frag_size < 2) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADFRAG", 7, users[userid].downenc);
|
2009-01-05 21:47:59 +02:00
|
|
|
} else {
|
|
|
|
users[userid].fragsize = max_frag_size;
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, &unpacked[1], 2, users[userid].downenc);
|
2009-01-05 21:47:59 +02:00
|
|
|
}
|
|
|
|
return;
|
2008-12-12 00:39:06 +02:00
|
|
|
} else if(in[0] == 'P' || in[0] == 'p') {
|
|
|
|
int dn_seq;
|
|
|
|
int dn_frag;
|
2009-09-21 00:10:41 +03:00
|
|
|
int didsend = 0;
|
|
|
|
|
|
|
|
/* We can't handle id=0, that's "no packet" to us. So drop
|
|
|
|
request completely. Note that DNS servers rewrite the id.
|
|
|
|
We'll drop 1 in 64k times. If DNS server retransmits with
|
|
|
|
different id, then all okay.
|
|
|
|
Else client won't retransmit, and we'll just keep the
|
|
|
|
previous ping in cache, no problem either. */
|
|
|
|
if (q->id == 0)
|
|
|
|
return;
|
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32);
|
2009-09-21 00:10:41 +03:00
|
|
|
if (read < 4)
|
|
|
|
return;
|
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
/* Ping packet, store userid */
|
|
|
|
userid = unpacked[0];
|
2009-01-10 22:23:50 +02:00
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2008-12-12 00:39:06 +02:00
|
|
|
return; /* illegal id */
|
|
|
|
}
|
2009-09-21 00:10:41 +03:00
|
|
|
|
|
|
|
#ifdef DNSCACHE_LEN
|
|
|
|
/* Check if cached */
|
2009-12-29 22:00:57 +02:00
|
|
|
if (answer_from_dnscache(dns_fd, userid, q))
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
#endif
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Check if duplicate (and not in full dnscache any more) */
|
|
|
|
if (answer_from_qmem(dns_fd, q, users[userid].qmemping_cmc,
|
|
|
|
users[userid].qmemping_type, QMEMPING_LEN,
|
|
|
|
(void *) unpacked))
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* Check if duplicate of waiting queries; impatient DNS relays
|
|
|
|
like to re-try early and often (with _different_ .id!) */
|
|
|
|
if (users[userid].q.id != 0 &&
|
2009-09-21 00:10:41 +03:00
|
|
|
q->type == users[userid].q.type &&
|
|
|
|
!strcmp(q->name, users[userid].q.name) &&
|
|
|
|
users[userid].lazy) {
|
2009-12-29 22:00:57 +02:00
|
|
|
/* We have this ping already, and it's waiting to be
|
|
|
|
answered. Always keep the last duplicate, since the
|
|
|
|
relay may have forgotten its first version already.
|
|
|
|
Our answer will go to both.
|
|
|
|
(If we already sent an answer, qmem/cache will
|
|
|
|
have triggered.) */
|
2009-09-21 00:10:41 +03:00
|
|
|
if (debug >= 2) {
|
2009-12-29 22:00:57 +02:00
|
|
|
fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, remembering\n",
|
2009-09-21 00:10:41 +03:00
|
|
|
userid);
|
|
|
|
}
|
2009-12-29 22:00:57 +02:00
|
|
|
users[userid].q.id2 = q->id;
|
|
|
|
users[userid].q.fromlen2 = q->fromlen;
|
|
|
|
memcpy(&(users[userid].q.from2), &(q->from), q->fromlen);
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
if (users[userid].q_sendrealsoon.id != 0 &&
|
|
|
|
q->type == users[userid].q_sendrealsoon.type &&
|
|
|
|
!strcmp(q->name, users[userid].q_sendrealsoon.name)) {
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Outer select loop will send answer immediately,
|
|
|
|
to both queries. */
|
2009-09-21 00:10:41 +03:00
|
|
|
if (debug >= 2) {
|
2009-12-29 22:00:57 +02:00
|
|
|
fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, remembering\n",
|
2009-09-21 00:10:41 +03:00
|
|
|
userid);
|
|
|
|
}
|
2009-12-29 22:00:57 +02:00
|
|
|
users[userid].q_sendrealsoon.id2 = q->id;
|
|
|
|
users[userid].q_sendrealsoon.fromlen2 = q->fromlen;
|
|
|
|
memcpy(&(users[userid].q_sendrealsoon.from2),
|
|
|
|
&(q->from), q->fromlen);
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
dn_seq = unpacked[1] >> 4;
|
|
|
|
dn_frag = unpacked[1] & 15;
|
|
|
|
|
2009-01-05 18:25:54 +02:00
|
|
|
if (debug >= 1) {
|
2009-09-21 00:10:41 +03:00
|
|
|
fprintf(stderr, "PING pkt from user %d, ack for downstream %d/%d\n",
|
|
|
|
userid, dn_seq, dn_frag);
|
2009-01-05 18:25:54 +02:00
|
|
|
}
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
process_downstream_ack(userid, dn_seq, dn_frag);
|
|
|
|
|
|
|
|
if (debug >= 3) {
|
|
|
|
fprintf(stderr, "PINGret (if any) will ack upstream %d/%d\n",
|
|
|
|
users[userid].inpacket.seqno, users[userid].inpacket.fragment);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* If there is a query that must be returned real soon, do it.
|
|
|
|
May contain new downstream data if the ping had a new ack.
|
|
|
|
Otherwise, may also be re-sending old data. */
|
|
|
|
if (users[userid].q_sendrealsoon.id != 0) {
|
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We need to store a new query, so if there still is an
|
|
|
|
earlier query waiting, always send a reply to finish it.
|
|
|
|
May contain new downstream data if the ping had a new ack.
|
|
|
|
Otherwise, may also be re-sending old data.
|
|
|
|
(This is duplicate data if we had q_sendrealsoon above.) */
|
2009-01-05 18:25:54 +02:00
|
|
|
if (users[userid].q.id != 0) {
|
2009-09-21 00:10:41 +03:00
|
|
|
didsend = 1;
|
|
|
|
if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q) == 1)
|
|
|
|
/* new packet from queue, send immediately */
|
|
|
|
didsend = 0;
|
2009-01-05 18:25:54 +02:00
|
|
|
}
|
2008-12-12 00:39:06 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
/* Save new query and time info */
|
2008-12-12 00:39:06 +02:00
|
|
|
memcpy(&(users[userid].q), q, sizeof(struct query));
|
|
|
|
users[userid].last_pkt = time(NULL);
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
/* If anything waiting and we didn't already send above, send
|
|
|
|
it now. And always send immediately if we're not lazy
|
|
|
|
(then above won't have sent at all). */
|
|
|
|
if ((!didsend && users[userid].outpacket.len > 0) ||
|
|
|
|
!users[userid].lazy)
|
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q);
|
|
|
|
|
2007-02-04 19:00:20 +02:00
|
|
|
} else if((in[0] >= '0' && in[0] <= '9')
|
|
|
|
|| (in[0] >= 'a' && in[0] <= 'f')
|
|
|
|
|| (in[0] >= 'A' && in[0] <= 'F')) {
|
2009-09-21 00:10:41 +03:00
|
|
|
int up_seq, up_frag, dn_seq, dn_frag, lastfrag;
|
|
|
|
int upstream_ok = 1;
|
|
|
|
int didsend = 0;
|
2009-08-15 22:35:07 +03:00
|
|
|
int code = -1;
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Need 5char header + >=1 char data */
|
|
|
|
if (domain_len < 6)
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
|
|
|
|
/* We can't handle id=0, that's "no packet" to us. So drop
|
|
|
|
request completely. Note that DNS servers rewrite the id.
|
|
|
|
We'll drop 1 in 64k times. If DNS server retransmits with
|
|
|
|
different id, then all okay.
|
|
|
|
Else client doesn't get our ack, and will retransmit in
|
|
|
|
1 second. */
|
|
|
|
if (q->id == 0)
|
|
|
|
return;
|
|
|
|
|
2007-02-04 19:00:20 +02:00
|
|
|
if ((in[0] >= '0' && in[0] <= '9'))
|
|
|
|
code = in[0] - '0';
|
|
|
|
if ((in[0] >= 'a' && in[0] <= 'f'))
|
|
|
|
code = in[0] - 'a' + 10;
|
|
|
|
if ((in[0] >= 'A' && in[0] <= 'F'))
|
|
|
|
code = in[0] - 'A' + 10;
|
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
userid = code;
|
2009-01-10 22:23:50 +02:00
|
|
|
/* Check user and sending ip number */
|
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(dns_fd, q, "BADIP", 5, 'T');
|
2009-09-21 00:10:41 +03:00
|
|
|
return; /* illegal id */
|
|
|
|
}
|
2009-01-05 18:25:54 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
#ifdef DNSCACHE_LEN
|
|
|
|
/* Check if cached */
|
2009-12-29 22:00:57 +02:00
|
|
|
if (answer_from_dnscache(dns_fd, userid, q))
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
#endif
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Check if duplicate (and not in full dnscache any more) */
|
|
|
|
if (answer_from_qmem_data(dns_fd, userid, q))
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
2009-12-29 22:00:57 +02:00
|
|
|
|
|
|
|
/* Check if duplicate of waiting queries; impatient DNS relays
|
|
|
|
like to re-try early and often (with _different_ .id!) */
|
|
|
|
if (users[userid].q.id != 0 &&
|
|
|
|
q->type == users[userid].q.type &&
|
2014-06-01 09:34:18 +03:00
|
|
|
!strcmp(q->name, users[userid].q.name) &&
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].lazy) {
|
2009-12-29 22:00:57 +02:00
|
|
|
/* We have this packet already, and it's waiting to be
|
|
|
|
answered. Always keep the last duplicate, since the
|
|
|
|
relay may have forgotten its first version already.
|
|
|
|
Our answer will go to both.
|
|
|
|
(If we already sent an answer, qmem/cache will
|
|
|
|
have triggered.) */
|
2009-09-21 00:10:41 +03:00
|
|
|
if (debug >= 2) {
|
2009-12-29 22:00:57 +02:00
|
|
|
fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, remembering\n",
|
2009-09-21 00:10:41 +03:00
|
|
|
userid);
|
2008-12-14 19:21:27 +02:00
|
|
|
}
|
2009-12-29 22:00:57 +02:00
|
|
|
users[userid].q.id2 = q->id;
|
|
|
|
users[userid].q.fromlen2 = q->fromlen;
|
|
|
|
memcpy(&(users[userid].q.from2), &(q->from), q->fromlen);
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
if (users[userid].q_sendrealsoon.id != 0 &&
|
|
|
|
q->type == users[userid].q_sendrealsoon.type &&
|
|
|
|
!strcmp(q->name, users[userid].q_sendrealsoon.name)) {
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Outer select loop will send answer immediately,
|
|
|
|
to both queries. */
|
2009-09-21 00:10:41 +03:00
|
|
|
if (debug >= 2) {
|
2009-12-29 22:00:57 +02:00
|
|
|
fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, remembering\n",
|
2009-09-21 00:10:41 +03:00
|
|
|
userid);
|
2008-12-12 00:39:06 +02:00
|
|
|
}
|
2009-12-29 22:00:57 +02:00
|
|
|
users[userid].q_sendrealsoon.id2 = q->id;
|
|
|
|
users[userid].q_sendrealsoon.fromlen2 = q->fromlen;
|
|
|
|
memcpy(&(users[userid].q_sendrealsoon.from2),
|
|
|
|
&(q->from), q->fromlen);
|
2009-09-21 00:10:41 +03:00
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
|
|
|
|
/* Decode data header */
|
|
|
|
up_seq = (b32_8to5(in[1]) >> 2) & 7;
|
|
|
|
up_frag = ((b32_8to5(in[1]) & 3) << 2) | ((b32_8to5(in[2]) >> 3) & 3);
|
|
|
|
dn_seq = (b32_8to5(in[2]) & 7);
|
|
|
|
dn_frag = b32_8to5(in[3]) >> 1;
|
|
|
|
lastfrag = b32_8to5(in[3]) & 1;
|
|
|
|
|
|
|
|
process_downstream_ack(userid, dn_seq, dn_frag);
|
|
|
|
|
2014-06-01 09:34:18 +03:00
|
|
|
if (up_seq == users[userid].inpacket.seqno &&
|
2009-09-21 00:10:41 +03:00
|
|
|
up_frag <= users[userid].inpacket.fragment) {
|
|
|
|
/* Got repeated old packet _with data_, probably
|
|
|
|
because client didn't receive our ack. So re-send
|
|
|
|
our ack(+data) immediately to keep things flowing
|
|
|
|
fast.
|
|
|
|
If it's a _really_ old frag, it's a nameserver
|
|
|
|
that tries again, and sending our current (non-
|
|
|
|
matching) fragno won't be a problem. */
|
|
|
|
if (debug >= 1) {
|
|
|
|
fprintf(stderr, "IN pkt seq# %d, frag %d, dropped duplicate frag\n",
|
|
|
|
up_seq, up_frag);
|
|
|
|
}
|
|
|
|
upstream_ok = 0;
|
|
|
|
}
|
|
|
|
else if (up_seq != users[userid].inpacket.seqno &&
|
|
|
|
recent_seqno(users[userid].inpacket.seqno, up_seq)) {
|
|
|
|
/* Duplicate of recent upstream data packet; probably
|
|
|
|
need to answer this to keep DNS server happy */
|
|
|
|
if (debug >= 1) {
|
|
|
|
fprintf(stderr, "IN pkt seq# %d, frag %d, dropped duplicate recent seqno\n",
|
|
|
|
up_seq, up_frag);
|
|
|
|
}
|
|
|
|
upstream_ok = 0;
|
|
|
|
}
|
|
|
|
else if (up_seq != users[userid].inpacket.seqno) {
|
|
|
|
/* Really new packet has arrived, no recent duplicate */
|
|
|
|
/* Forget any old packet, even if incomplete */
|
|
|
|
users[userid].inpacket.seqno = up_seq;
|
2008-12-12 00:39:06 +02:00
|
|
|
users[userid].inpacket.fragment = up_frag;
|
2009-09-21 00:10:41 +03:00
|
|
|
users[userid].inpacket.len = 0;
|
|
|
|
users[userid].inpacket.offset = 0;
|
|
|
|
} else {
|
|
|
|
/* seq is same, frag is higher; don't care about
|
|
|
|
missing fragments, TCP checksum will fail */
|
|
|
|
users[userid].inpacket.fragment = up_frag;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (debug >= 3) {
|
|
|
|
fprintf(stderr, "INpack with upstream %d/%d, we are going to ack upstream %d/%d\n",
|
|
|
|
up_seq, up_frag,
|
|
|
|
users[userid].inpacket.seqno, users[userid].inpacket.fragment);
|
|
|
|
}
|
2008-12-12 00:39:06 +02:00
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
if (upstream_ok) {
|
2009-12-29 22:00:57 +02:00
|
|
|
/* decode with this user's encoding */
|
|
|
|
read = unpack_data(unpacked, sizeof(unpacked), &(in[5]), domain_len - 5,
|
2007-06-09 19:18:59 +03:00
|
|
|
users[userid].encoder);
|
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
/* copy to packet buffer, update length */
|
2009-09-21 00:10:41 +03:00
|
|
|
read = MIN(read, sizeof(users[userid].inpacket.data) - users[userid].inpacket.offset);
|
2007-06-09 19:18:59 +03:00
|
|
|
memcpy(users[userid].inpacket.data + users[userid].inpacket.offset, unpacked, read);
|
|
|
|
users[userid].inpacket.len += read;
|
|
|
|
users[userid].inpacket.offset += read;
|
2007-02-04 19:00:20 +02:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 1) {
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "IN pkt seq# %d, frag %d (last=%d), fragsize %d, total %d, from user %d\n",
|
2008-12-12 00:39:06 +02:00
|
|
|
up_seq, up_frag, lastfrag, read, users[userid].inpacket.len, userid);
|
|
|
|
}
|
2009-09-21 00:10:41 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if (upstream_ok && lastfrag) { /* packet is complete */
|
|
|
|
handle_full_packet(tun_fd, dns_fd, userid);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* If there is a query that must be returned real soon, do it.
|
|
|
|
Includes an ack of the just received upstream fragment,
|
|
|
|
may contain new data. */
|
|
|
|
if (users[userid].q_sendrealsoon.id != 0) {
|
|
|
|
didsend = 1;
|
|
|
|
if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon) == 1)
|
|
|
|
/* new packet from queue, send immediately */
|
|
|
|
didsend = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* If we already have an earlier query waiting, we need to
|
|
|
|
get rid of it to store the new query.
|
|
|
|
- If we have new data waiting and not yet sent above,
|
|
|
|
send immediately.
|
|
|
|
- If this wasn't the last upstream fragment, then we expect
|
|
|
|
more, so ack immediately if we didn't already.
|
|
|
|
- If we are in non-lazy mode, there should be no query
|
|
|
|
waiting, but if there is, send immediately.
|
|
|
|
- In all other cases (mostly the last-fragment cases),
|
|
|
|
we can afford to wait just a tiny little while for the
|
|
|
|
TCP ack to arrive from our tun. Note that this works best
|
|
|
|
when there is only one client.
|
|
|
|
*/
|
|
|
|
if (users[userid].q.id != 0) {
|
|
|
|
if ((users[userid].outpacket.len > 0 && !didsend) ||
|
|
|
|
(upstream_ok && !lastfrag && !didsend) ||
|
|
|
|
(!upstream_ok && !didsend) ||
|
2009-12-29 22:00:57 +02:00
|
|
|
!users[userid].lazy) {
|
2009-09-21 00:10:41 +03:00
|
|
|
didsend = 1;
|
|
|
|
if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q) == 1)
|
|
|
|
/* new packet from queue, send immediately */
|
|
|
|
didsend = 0;
|
|
|
|
} else {
|
|
|
|
memcpy(&(users[userid].q_sendrealsoon),
|
|
|
|
&(users[userid].q),
|
|
|
|
sizeof(struct query));
|
|
|
|
users[userid].q_sendrealsoon_new = 1;
|
|
|
|
users[userid].q.id = 0; /* used */
|
|
|
|
didsend = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Save new query and time info */
|
|
|
|
memcpy(&(users[userid].q), q, sizeof(struct query));
|
|
|
|
users[userid].last_pkt = time(NULL);
|
|
|
|
|
|
|
|
/* If we still need to ack this upstream frag, do it to keep
|
|
|
|
upstream flowing.
|
|
|
|
- If we have new data waiting and not yet sent above,
|
|
|
|
send immediately.
|
|
|
|
- If this wasn't the last upstream fragment, then we expect
|
|
|
|
more, so ack immediately if we didn't already or are
|
|
|
|
in non-lazy mode.
|
|
|
|
- If this was the last fragment, and we didn't ack already
|
|
|
|
or are in non-lazy mode, send the ack after just a tiny
|
|
|
|
little while so that the TCP ack may have arrived from
|
|
|
|
our tun device.
|
|
|
|
- In all other cases, don't send anything now.
|
|
|
|
*/
|
2009-12-29 22:00:57 +02:00
|
|
|
if (users[userid].outpacket.len > 0 && !didsend)
|
2009-09-21 00:10:41 +03:00
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q);
|
|
|
|
else if (!didsend || !users[userid].lazy) {
|
|
|
|
if (upstream_ok && lastfrag) {
|
|
|
|
memcpy(&(users[userid].q_sendrealsoon),
|
|
|
|
&(users[userid].q),
|
|
|
|
sizeof(struct query));
|
|
|
|
users[userid].q_sendrealsoon_new = 1;
|
|
|
|
users[userid].q.id = 0; /* used */
|
|
|
|
} else {
|
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q);
|
2007-02-04 19:00:20 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2008-08-06 00:53:19 +03:00
|
|
|
}
|
|
|
|
|
2008-09-09 23:55:13 +03:00
|
|
|
static void
|
|
|
|
handle_ns_request(int dns_fd, struct query *q)
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Mostly identical to handle_a_request() below */
|
2008-09-09 23:55:13 +03:00
|
|
|
{
|
|
|
|
char buf[64*1024];
|
|
|
|
int len;
|
|
|
|
|
2008-09-14 16:21:11 +03:00
|
|
|
if (ns_ip != INADDR_ANY) {
|
2009-06-11 22:52:42 +03:00
|
|
|
/* If ns_ip set, overwrite destination addr with it.
|
|
|
|
* Destination addr will be sent as additional record (A, IN) */
|
2008-09-14 16:21:11 +03:00
|
|
|
memcpy(&q->destination.s_addr, &ns_ip, sizeof(in_addr_t));
|
|
|
|
}
|
|
|
|
|
2008-09-09 23:55:13 +03:00
|
|
|
len = dns_encode_ns_response(buf, sizeof(buf), q, topdomain);
|
2009-09-20 18:11:16 +03:00
|
|
|
if (len < 1) {
|
|
|
|
warnx("dns_encode_ns_response doesn't fit");
|
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 2) {
|
2014-06-01 09:34:18 +03:00
|
|
|
fprintf(stderr, "TX: client %s, type %d, name %s, %d bytes NS reply\n",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q->from, q->fromlen), q->type, q->name, len);
|
2008-09-10 00:09:06 +03:00
|
|
|
}
|
2008-09-09 23:55:13 +03:00
|
|
|
if (sendto(dns_fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen) <= 0) {
|
|
|
|
warn("ns reply send error");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
static void
|
|
|
|
handle_a_request(int dns_fd, struct query *q, int fakeip)
|
|
|
|
/* Mostly identical to handle_ns_request() above */
|
|
|
|
{
|
|
|
|
char buf[64*1024];
|
|
|
|
int len;
|
|
|
|
|
|
|
|
if (fakeip) {
|
|
|
|
in_addr_t ip = inet_addr("127.0.0.1");
|
|
|
|
memcpy(&q->destination.s_addr, &ip, sizeof(in_addr_t));
|
|
|
|
|
|
|
|
} else if (ns_ip != INADDR_ANY) {
|
|
|
|
/* If ns_ip set, overwrite destination addr with it.
|
|
|
|
* Destination addr will be sent as additional record (A, IN) */
|
|
|
|
memcpy(&q->destination.s_addr, &ns_ip, sizeof(in_addr_t));
|
|
|
|
}
|
|
|
|
|
|
|
|
len = dns_encode_a_response(buf, sizeof(buf), q);
|
|
|
|
if (len < 1) {
|
|
|
|
warnx("dns_encode_a_response doesn't fit");
|
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
if (debug >= 2) {
|
|
|
|
fprintf(stderr, "TX: client %s, type %d, name %s, %d bytes A reply\n",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q->from, q->fromlen), q->type, q->name, len);
|
2009-12-29 22:00:57 +02:00
|
|
|
}
|
|
|
|
if (sendto(dns_fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen) <= 0) {
|
|
|
|
warn("a reply send error");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2008-08-08 00:18:15 +03:00
|
|
|
static void
|
|
|
|
forward_query(int bind_fd, struct query *q)
|
|
|
|
{
|
|
|
|
char buf[64*1024];
|
|
|
|
int len;
|
|
|
|
struct fw_query fwq;
|
|
|
|
struct sockaddr_in *myaddr;
|
|
|
|
in_addr_t newaddr;
|
|
|
|
|
|
|
|
len = dns_encode(buf, sizeof(buf), q, QR_QUERY, q->name, strlen(q->name));
|
2009-09-20 18:11:16 +03:00
|
|
|
if (len < 1) {
|
|
|
|
warnx("dns_encode doesn't fit");
|
|
|
|
return;
|
|
|
|
}
|
2008-08-08 00:18:15 +03:00
|
|
|
|
|
|
|
/* Store sockaddr for q->id */
|
|
|
|
memcpy(&(fwq.addr), &(q->from), q->fromlen);
|
|
|
|
fwq.addrlen = q->fromlen;
|
|
|
|
fwq.id = q->id;
|
|
|
|
fw_query_put(&fwq);
|
|
|
|
|
|
|
|
newaddr = inet_addr("127.0.0.1");
|
|
|
|
myaddr = (struct sockaddr_in *) &(q->from);
|
|
|
|
memcpy(&(myaddr->sin_addr), &newaddr, sizeof(in_addr_t));
|
|
|
|
myaddr->sin_port = htons(bind_port);
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 2) {
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "TX: NS reply \n");
|
2008-08-08 00:18:15 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if (sendto(bind_fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen) <= 0) {
|
|
|
|
warn("forward query error");
|
|
|
|
}
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-08-06 00:53:19 +03:00
|
|
|
static int
|
2008-08-08 00:18:15 +03:00
|
|
|
tunnel_bind(int bind_fd, int dns_fd)
|
|
|
|
{
|
|
|
|
char packet[64*1024];
|
2014-02-06 20:39:16 +02:00
|
|
|
struct sockaddr_storage from;
|
2009-01-25 22:03:45 +02:00
|
|
|
socklen_t fromlen;
|
2008-08-08 00:18:15 +03:00
|
|
|
struct fw_query *query;
|
2009-02-09 22:44:08 +02:00
|
|
|
unsigned short id;
|
2008-08-08 00:18:15 +03:00
|
|
|
int r;
|
|
|
|
|
|
|
|
fromlen = sizeof(struct sockaddr);
|
2014-06-01 09:34:18 +03:00
|
|
|
r = recvfrom(bind_fd, packet, sizeof(packet), 0,
|
2008-09-09 22:55:45 +03:00
|
|
|
(struct sockaddr*)&from, &fromlen);
|
2008-08-08 00:18:15 +03:00
|
|
|
|
|
|
|
if (r <= 0)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
id = dns_get_id(packet, r);
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 2) {
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "RX: Got response on query %u from DNS\n", (id & 0xFFFF));
|
2008-08-08 00:18:15 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Get sockaddr from id */
|
|
|
|
fw_query_get(id, &query);
|
2013-05-20 20:30:43 +03:00
|
|
|
if (!query) {
|
|
|
|
if (debug >= 2) {
|
|
|
|
fprintf(stderr, "Lost sender of id %u, dropping reply\n", (id & 0xFFFF));
|
|
|
|
}
|
2008-08-08 00:18:15 +03:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 2) {
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "TX: client %s id %u, %d bytes\n",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&query->addr, query->addrlen), (id & 0xffff), r);
|
2008-08-08 00:18:15 +03:00
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
|
|
|
if (sendto(dns_fd, packet, r, 0, (const struct sockaddr *) &(query->addr),
|
2008-09-09 22:55:45 +03:00
|
|
|
query->addrlen) <= 0) {
|
2008-08-08 00:18:15 +03:00
|
|
|
warn("forward reply error");
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
tunnel_dns(int tun_fd, int dns_fd, int bind_fd)
|
2008-08-06 00:53:19 +03:00
|
|
|
{
|
|
|
|
struct query q;
|
|
|
|
int read;
|
2008-08-07 19:49:22 +03:00
|
|
|
int domain_len;
|
2010-11-25 19:40:35 +02:00
|
|
|
int inside_topdomain = 0;
|
2008-08-06 00:53:19 +03:00
|
|
|
|
2009-08-06 22:48:55 +03:00
|
|
|
if ((read = read_dns(dns_fd, tun_fd, &q)) <= 0)
|
2008-08-06 00:53:19 +03:00
|
|
|
return 0;
|
2008-08-06 01:37:40 +03:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 2) {
|
2014-06-01 09:34:18 +03:00
|
|
|
fprintf(stderr, "RX: client %s, type %d, name %s\n",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q.from, q.fromlen), q.type, q.name);
|
2008-08-06 01:37:40 +03:00
|
|
|
}
|
2009-12-29 22:00:57 +02:00
|
|
|
|
|
|
|
domain_len = strlen(q.name) - strlen(topdomain);
|
|
|
|
if (domain_len >= 0 && !strcasecmp(q.name + domain_len, topdomain))
|
|
|
|
inside_topdomain = 1;
|
|
|
|
/* require dot before topdomain */
|
|
|
|
if (domain_len >= 1 && q.name[domain_len - 1] != '.')
|
|
|
|
inside_topdomain = 0;
|
|
|
|
|
2008-08-07 19:49:22 +03:00
|
|
|
if (inside_topdomain) {
|
|
|
|
/* This is a query we can handle */
|
2009-09-20 18:11:16 +03:00
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Handle A-type query for ns.topdomain, possibly caused
|
|
|
|
by our proper response to any NS request */
|
|
|
|
if (domain_len == 3 && q.type == T_A &&
|
|
|
|
(q.name[0] == 'n' || q.name[0] == 'N') &&
|
|
|
|
(q.name[1] == 's' || q.name[1] == 'S') &&
|
|
|
|
q.name[2] == '.') {
|
|
|
|
handle_a_request(dns_fd, &q, 0);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Handle A-type query for www.topdomain, for anyone that's
|
|
|
|
poking around */
|
|
|
|
if (domain_len == 4 && q.type == T_A &&
|
|
|
|
(q.name[0] == 'w' || q.name[0] == 'W') &&
|
|
|
|
(q.name[1] == 'w' || q.name[1] == 'W') &&
|
|
|
|
(q.name[2] == 'w' || q.name[2] == 'W') &&
|
|
|
|
q.name[3] == '.') {
|
|
|
|
handle_a_request(dns_fd, &q, 1);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-08-07 19:49:22 +03:00
|
|
|
switch (q.type) {
|
|
|
|
case T_NULL:
|
2014-06-09 21:05:29 +03:00
|
|
|
case T_PRIVATE:
|
2009-09-20 18:11:16 +03:00
|
|
|
case T_CNAME:
|
|
|
|
case T_A:
|
|
|
|
case T_MX:
|
2009-12-29 22:00:57 +02:00
|
|
|
case T_SRV:
|
2009-09-20 18:11:16 +03:00
|
|
|
case T_TXT:
|
|
|
|
/* encoding is "transparent" here */
|
2008-08-07 19:49:22 +03:00
|
|
|
handle_null_request(tun_fd, dns_fd, &q, domain_len);
|
|
|
|
break;
|
2008-09-09 23:55:13 +03:00
|
|
|
case T_NS:
|
|
|
|
handle_ns_request(dns_fd, &q);
|
|
|
|
break;
|
2008-08-07 19:49:22 +03:00
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
/* Forward query to other port ? */
|
2008-08-08 00:18:15 +03:00
|
|
|
if (bind_fd) {
|
|
|
|
forward_query(bind_fd, &q);
|
|
|
|
}
|
2008-08-06 00:53:19 +03:00
|
|
|
}
|
2007-02-04 19:00:20 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2013-12-23 22:58:28 +02:00
|
|
|
tunnel(int tun_fd, int dns_fd, int bind_fd, int max_idle_time)
|
2007-02-04 19:00:20 +02:00
|
|
|
{
|
|
|
|
struct timeval tv;
|
|
|
|
fd_set fds;
|
2006-08-25 00:23:29 +03:00
|
|
|
int i;
|
2009-09-21 00:10:41 +03:00
|
|
|
int userid;
|
2013-12-23 22:58:28 +02:00
|
|
|
time_t last_action = time(NULL);
|
2006-08-25 00:23:29 +03:00
|
|
|
|
2006-06-05 21:47:09 +03:00
|
|
|
while (running) {
|
2008-08-08 00:18:15 +03:00
|
|
|
int maxfd;
|
2009-09-21 00:10:41 +03:00
|
|
|
tv.tv_sec = 10; /* doesn't really matter */
|
|
|
|
tv.tv_usec = 0;
|
|
|
|
|
|
|
|
/* Adjust timeout if there is anything to send realsoon.
|
|
|
|
Clients won't be sending new data until we send our ack,
|
|
|
|
so don't keep them waiting long. This only triggers at
|
|
|
|
final upstream fragments, which is about once per eight
|
|
|
|
requests during heavy upstream traffic.
|
|
|
|
20msec: ~8 packs every 1/50sec = ~400 DNSreq/sec,
|
|
|
|
or ~1200bytes every 1/50sec = ~0.5 Mbit/sec upstream */
|
2011-04-23 21:55:59 +03:00
|
|
|
for (userid = 0; userid < created_users; userid++) {
|
2009-09-21 00:10:41 +03:00
|
|
|
if (users[userid].active && !users[userid].disabled &&
|
|
|
|
users[userid].last_pkt + 60 > time(NULL)) {
|
|
|
|
users[userid].q_sendrealsoon_new = 0;
|
|
|
|
if (users[userid].q_sendrealsoon.id != 0) {
|
|
|
|
tv.tv_sec = 0;
|
|
|
|
tv.tv_usec = 20000;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2006-06-05 21:47:09 +03:00
|
|
|
|
|
|
|
FD_ZERO(&fds);
|
2008-08-08 00:18:15 +03:00
|
|
|
|
|
|
|
FD_SET(dns_fd, &fds);
|
|
|
|
maxfd = dns_fd;
|
|
|
|
|
|
|
|
if (bind_fd) {
|
|
|
|
/* wait for replies from real DNS */
|
|
|
|
FD_SET(bind_fd, &fds);
|
|
|
|
maxfd = MAX(bind_fd, maxfd);
|
|
|
|
}
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
/* Don't read from tun if no users can accept data anyway;
|
|
|
|
tun queue/TCP buffers are larger than our outpacket-queues */
|
2007-02-11 15:39:32 +02:00
|
|
|
if(!all_users_waiting_to_send()) {
|
2006-06-06 01:36:05 +03:00
|
|
|
FD_SET(tun_fd, &fds);
|
2008-08-08 00:18:15 +03:00
|
|
|
maxfd = MAX(tun_fd, maxfd);
|
2007-02-11 15:39:32 +02:00
|
|
|
}
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2008-08-08 00:18:15 +03:00
|
|
|
i = select(maxfd + 1, &fds, NULL, NULL, &tv);
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2006-06-05 21:47:09 +03:00
|
|
|
if(i < 0) {
|
2014-06-01 09:34:18 +03:00
|
|
|
if (running)
|
2006-06-05 21:47:09 +03:00
|
|
|
warn("select");
|
|
|
|
return 1;
|
|
|
|
}
|
2008-09-14 15:44:55 +03:00
|
|
|
|
2013-12-23 22:58:28 +02:00
|
|
|
if (i==0) {
|
|
|
|
if (max_idle_time) {
|
|
|
|
/* only trigger the check if that's worth ( ie, no need to loop over if there
|
|
|
|
is something to send */
|
|
|
|
if (last_action + max_idle_time < time(NULL)) {
|
|
|
|
for (userid = 0; userid < created_users; userid++) {
|
|
|
|
last_action = ( users[userid].last_pkt > last_action ) ? users[userid].last_pkt : last_action;
|
|
|
|
}
|
|
|
|
if (last_action + max_idle_time < time(NULL)) {
|
|
|
|
fprintf(stderr, "Idling since too long, shutting down...\n");
|
|
|
|
running = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2008-09-14 15:44:55 +03:00
|
|
|
} else {
|
2009-08-06 22:48:55 +03:00
|
|
|
if (FD_ISSET(tun_fd, &fds)) {
|
2008-09-14 15:44:55 +03:00
|
|
|
tunnel_tun(tun_fd, dns_fd);
|
|
|
|
}
|
2009-08-06 22:48:55 +03:00
|
|
|
if (FD_ISSET(dns_fd, &fds)) {
|
2008-09-14 15:44:55 +03:00
|
|
|
tunnel_dns(tun_fd, dns_fd, bind_fd);
|
2014-06-01 09:34:18 +03:00
|
|
|
}
|
2009-08-06 22:48:55 +03:00
|
|
|
if (FD_ISSET(bind_fd, &fds)) {
|
2008-09-14 15:44:55 +03:00
|
|
|
tunnel_bind(bind_fd, dns_fd);
|
|
|
|
}
|
2008-08-08 00:18:15 +03:00
|
|
|
}
|
2009-09-21 00:10:41 +03:00
|
|
|
|
|
|
|
/* Send realsoon's if tun or dns didn't already */
|
2011-04-23 21:55:59 +03:00
|
|
|
for (userid = 0; userid < created_users; userid++)
|
2009-09-21 00:10:41 +03:00
|
|
|
if (users[userid].active && !users[userid].disabled &&
|
|
|
|
users[userid].last_pkt + 60 > time(NULL) &&
|
|
|
|
users[userid].q_sendrealsoon.id != 0 &&
|
|
|
|
users[userid].conn == CONN_DNS_NULL &&
|
|
|
|
!users[userid].q_sendrealsoon_new)
|
|
|
|
send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon);
|
2006-06-05 21:47:09 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-06-14 16:31:35 +03:00
|
|
|
static void
|
2009-09-21 00:10:41 +03:00
|
|
|
handle_full_packet(int tun_fd, int dns_fd, int userid)
|
2009-08-06 22:48:55 +03:00
|
|
|
{
|
|
|
|
unsigned long outlen;
|
|
|
|
char out[64*1024];
|
|
|
|
int touser;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
outlen = sizeof(out);
|
2014-06-01 09:34:18 +03:00
|
|
|
ret = uncompress((uint8_t*)out, &outlen,
|
2009-08-06 22:48:55 +03:00
|
|
|
(uint8_t*)users[userid].inpacket.data, users[userid].inpacket.len);
|
|
|
|
|
|
|
|
if (ret == Z_OK) {
|
|
|
|
struct ip *hdr;
|
|
|
|
|
|
|
|
hdr = (struct ip*) (out + 4);
|
|
|
|
touser = find_user_by_ip(hdr->ip_dst.s_addr);
|
|
|
|
|
|
|
|
if (touser == -1) {
|
|
|
|
/* send the uncompressed packet to tun device */
|
|
|
|
write_tun(tun_fd, out, outlen);
|
|
|
|
} else {
|
2009-09-21 00:10:41 +03:00
|
|
|
/* send the compressed(!) packet to other client */
|
2012-02-06 21:28:42 +02:00
|
|
|
if (users[touser].conn == CONN_DNS_NULL) {
|
|
|
|
if (users[touser].outpacket.len == 0) {
|
|
|
|
start_new_outpacket(touser,
|
|
|
|
users[userid].inpacket.data,
|
|
|
|
users[userid].inpacket.len);
|
|
|
|
|
|
|
|
/* Start sending immediately if query is waiting */
|
|
|
|
if (users[touser].q_sendrealsoon.id != 0)
|
|
|
|
send_chunk_or_dataless(dns_fd, touser, &users[touser].q_sendrealsoon);
|
|
|
|
else if (users[touser].q.id != 0)
|
|
|
|
send_chunk_or_dataless(dns_fd, touser, &users[touser].q);
|
2009-09-21 00:10:41 +03:00
|
|
|
#ifdef OUTPACKETQ_LEN
|
2012-02-06 21:28:42 +02:00
|
|
|
} else {
|
|
|
|
save_to_outpacketq(touser,
|
|
|
|
users[userid].inpacket.data,
|
|
|
|
users[userid].inpacket.len);
|
2009-09-21 00:10:41 +03:00
|
|
|
#endif
|
2012-02-06 21:28:42 +02:00
|
|
|
}
|
|
|
|
} else{ /* CONN_RAW_UDP */
|
|
|
|
send_raw(dns_fd, users[userid].inpacket.data,
|
|
|
|
users[userid].inpacket.len, touser,
|
|
|
|
RAW_HDR_CMD_DATA, &users[touser].q);
|
2009-08-06 22:48:55 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
2009-09-21 00:10:41 +03:00
|
|
|
if (debug >= 1)
|
|
|
|
fprintf(stderr, "Discarded data, uncompress() result: %d\n", ret);
|
2009-08-06 22:48:55 +03:00
|
|
|
}
|
2009-09-21 00:10:41 +03:00
|
|
|
|
|
|
|
/* This packet is done */
|
|
|
|
users[userid].inpacket.len = 0;
|
|
|
|
users[userid].inpacket.offset = 0;
|
2009-08-06 22:48:55 +03:00
|
|
|
}
|
|
|
|
|
2009-06-14 16:31:35 +03:00
|
|
|
static void
|
2009-08-06 22:48:55 +03:00
|
|
|
handle_raw_login(char *packet, int len, struct query *q, int fd, int userid)
|
2009-06-14 16:31:35 +03:00
|
|
|
{
|
|
|
|
char myhash[16];
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-08-06 22:48:55 +03:00
|
|
|
if (len < 16) return;
|
2009-06-14 16:31:35 +03:00
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* can't use check_user_and_ip() since IP address will be different,
|
|
|
|
so duplicate here except IP address */
|
|
|
|
if (userid < 0 || userid >= created_users) return;
|
|
|
|
if (!users[userid].active || users[userid].disabled) return;
|
|
|
|
if (users[userid].last_pkt + 60 < time(NULL)) return;
|
|
|
|
|
|
|
|
if (debug >= 1) {
|
|
|
|
fprintf(stderr, "IN login raw, len %d, from user %d\n",
|
|
|
|
len, userid);
|
|
|
|
}
|
2009-06-14 16:31:35 +03:00
|
|
|
|
2009-08-06 22:48:55 +03:00
|
|
|
/* User sends hash of seed + 1 */
|
2009-06-14 16:31:35 +03:00
|
|
|
login_calculate(myhash, 16, password, users[userid].seed + 1);
|
|
|
|
if (memcmp(packet, myhash, 16) == 0) {
|
2009-08-06 22:48:55 +03:00
|
|
|
struct sockaddr_in *tempin;
|
|
|
|
|
|
|
|
/* Update query and time info for user */
|
|
|
|
users[userid].last_pkt = time(NULL);
|
|
|
|
memcpy(&(users[userid].q), q, sizeof(struct query));
|
|
|
|
|
|
|
|
/* Store remote IP number */
|
|
|
|
tempin = (struct sockaddr_in *) &(q->from);
|
|
|
|
memcpy(&(users[userid].host), &(tempin->sin_addr), sizeof(struct in_addr));
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-06-14 16:31:35 +03:00
|
|
|
/* Correct hash, reply with hash of seed - 1 */
|
2009-08-06 22:48:55 +03:00
|
|
|
user_set_conn_type(userid, CONN_RAW_UDP);
|
2009-06-14 16:31:35 +03:00
|
|
|
login_calculate(myhash, 16, password, users[userid].seed - 1);
|
2009-08-06 22:48:55 +03:00
|
|
|
send_raw(fd, myhash, 16, userid, RAW_HDR_CMD_LOGIN, q);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
handle_raw_data(char *packet, int len, struct query *q, int dns_fd, int tun_fd, int userid)
|
|
|
|
{
|
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
|
|
|
return;
|
2009-06-14 16:31:35 +03:00
|
|
|
}
|
2009-08-06 22:48:55 +03:00
|
|
|
|
|
|
|
/* Update query and time info for user */
|
|
|
|
users[userid].last_pkt = time(NULL);
|
|
|
|
memcpy(&(users[userid].q), q, sizeof(struct query));
|
|
|
|
|
|
|
|
/* copy to packet buffer, update length */
|
|
|
|
users[userid].inpacket.offset = 0;
|
|
|
|
memcpy(users[userid].inpacket.data, packet, len);
|
|
|
|
users[userid].inpacket.len = len;
|
|
|
|
|
|
|
|
if (debug >= 1) {
|
|
|
|
fprintf(stderr, "IN pkt raw, total %d, from user %d\n",
|
|
|
|
users[userid].inpacket.len, userid);
|
|
|
|
}
|
|
|
|
|
2009-09-21 00:10:41 +03:00
|
|
|
handle_full_packet(tun_fd, dns_fd, userid);
|
2009-06-14 16:31:35 +03:00
|
|
|
}
|
|
|
|
|
2009-08-15 15:43:02 +03:00
|
|
|
static void
|
|
|
|
handle_raw_ping(struct query *q, int dns_fd, int userid)
|
|
|
|
{
|
|
|
|
if (check_user_and_ip(userid, q) != 0) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Update query and time info for user */
|
|
|
|
users[userid].last_pkt = time(NULL);
|
|
|
|
memcpy(&(users[userid].q), q, sizeof(struct query));
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
if (debug >= 1) {
|
|
|
|
fprintf(stderr, "IN ping raw, from user %d\n", userid);
|
|
|
|
}
|
|
|
|
|
2009-08-15 15:43:02 +03:00
|
|
|
/* Send ping reply */
|
|
|
|
send_raw(dns_fd, NULL, 0, userid, RAW_HDR_CMD_PING, q);
|
|
|
|
}
|
|
|
|
|
2009-06-14 16:31:35 +03:00
|
|
|
static int
|
2009-08-06 22:48:55 +03:00
|
|
|
raw_decode(char *packet, int len, struct query *q, int dns_fd, int tun_fd)
|
2009-06-14 16:31:35 +03:00
|
|
|
{
|
2009-08-06 22:48:55 +03:00
|
|
|
int raw_user;
|
|
|
|
|
2009-06-14 16:31:35 +03:00
|
|
|
/* minimum length */
|
|
|
|
if (len < RAW_HDR_LEN) return 0;
|
|
|
|
/* should start with header */
|
|
|
|
if (memcmp(packet, raw_header, RAW_HDR_IDENT_LEN)) return 0;
|
|
|
|
|
2009-08-06 22:48:55 +03:00
|
|
|
raw_user = RAW_HDR_GET_USR(packet);
|
|
|
|
switch (RAW_HDR_GET_CMD(packet)) {
|
|
|
|
case RAW_HDR_CMD_LOGIN:
|
|
|
|
/* Login challenge */
|
|
|
|
handle_raw_login(&packet[RAW_HDR_LEN], len - RAW_HDR_LEN, q, dns_fd, raw_user);
|
|
|
|
break;
|
|
|
|
case RAW_HDR_CMD_DATA:
|
|
|
|
/* Data packet */
|
|
|
|
handle_raw_data(&packet[RAW_HDR_LEN], len - RAW_HDR_LEN, q, dns_fd, tun_fd, raw_user);
|
|
|
|
break;
|
2009-08-15 15:43:02 +03:00
|
|
|
case RAW_HDR_CMD_PING:
|
|
|
|
/* Keepalive packet */
|
|
|
|
handle_raw_ping(q, dns_fd, raw_user);
|
|
|
|
break;
|
2009-08-06 22:48:55 +03:00
|
|
|
default:
|
|
|
|
warnx("Unhandled raw command %02X from user %d", RAW_HDR_GET_CMD(packet), raw_user);
|
|
|
|
break;
|
2009-06-14 16:31:35 +03:00
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2007-02-04 17:46:06 +02:00
|
|
|
static int
|
2009-08-06 22:48:55 +03:00
|
|
|
read_dns(int fd, int tun_fd, struct query *q) /* FIXME: tun_fd is because of raw_decode() below */
|
2007-02-04 17:46:06 +02:00
|
|
|
{
|
|
|
|
struct sockaddr_in from;
|
2009-01-25 18:42:28 +02:00
|
|
|
socklen_t addrlen;
|
2008-08-08 01:12:10 +03:00
|
|
|
char packet[64*1024];
|
2009-01-25 00:19:11 +02:00
|
|
|
int r;
|
|
|
|
#ifndef WINDOWS32
|
2008-08-08 01:12:10 +03:00
|
|
|
char address[96];
|
|
|
|
struct msghdr msg;
|
|
|
|
struct iovec iov;
|
|
|
|
struct cmsghdr *cmsg;
|
2007-02-04 17:46:06 +02:00
|
|
|
|
|
|
|
addrlen = sizeof(struct sockaddr);
|
2008-08-08 01:12:10 +03:00
|
|
|
iov.iov_base = packet;
|
|
|
|
iov.iov_len = sizeof(packet);
|
|
|
|
|
|
|
|
msg.msg_name = (caddr_t) &from;
|
|
|
|
msg.msg_namelen = (unsigned) addrlen;
|
|
|
|
msg.msg_iov = &iov;
|
|
|
|
msg.msg_iovlen = 1;
|
|
|
|
msg.msg_control = address;
|
|
|
|
msg.msg_controllen = sizeof(address);
|
|
|
|
msg.msg_flags = 0;
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-08-08 01:12:10 +03:00
|
|
|
r = recvmsg(fd, &msg, 0);
|
2009-01-25 00:19:11 +02:00
|
|
|
#else
|
|
|
|
addrlen = sizeof(struct sockaddr);
|
2009-01-25 18:42:28 +02:00
|
|
|
r = recvfrom(fd, packet, sizeof(packet), 0, (struct sockaddr*)&from, &addrlen);
|
2009-01-25 00:19:11 +02:00
|
|
|
#endif /* !WINDOWS32 */
|
2007-02-04 17:46:06 +02:00
|
|
|
|
|
|
|
if (r > 0) {
|
2009-06-14 16:31:35 +03:00
|
|
|
memcpy((struct sockaddr*)&q->from, (struct sockaddr*)&from, addrlen);
|
|
|
|
q->fromlen = addrlen;
|
|
|
|
|
|
|
|
/* TODO do not handle raw packets here! */
|
2009-08-06 22:48:55 +03:00
|
|
|
if (raw_decode(packet, r, q, fd, tun_fd)) {
|
2009-06-14 16:31:35 +03:00
|
|
|
return 0;
|
|
|
|
}
|
2009-06-14 14:14:40 +03:00
|
|
|
if (dns_decode(NULL, 0, q, QR_QUERY, packet, r) < 0) {
|
|
|
|
return 0;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-01-25 00:19:11 +02:00
|
|
|
#ifndef WINDOWS32
|
2014-06-01 09:34:18 +03:00
|
|
|
for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
|
|
|
|
cmsg = CMSG_NXTHDR(&msg, cmsg)) {
|
|
|
|
|
|
|
|
if (cmsg->cmsg_level == IPPROTO_IP &&
|
|
|
|
cmsg->cmsg_type == DSTADDR_SOCKOPT) {
|
|
|
|
|
|
|
|
q->destination = *dstaddr(cmsg);
|
2008-08-08 01:12:10 +03:00
|
|
|
break;
|
2014-06-01 09:34:18 +03:00
|
|
|
}
|
2008-08-08 01:12:10 +03:00
|
|
|
}
|
2009-01-25 00:19:11 +02:00
|
|
|
#endif
|
2009-01-25 00:12:00 +02:00
|
|
|
|
2008-08-06 00:53:19 +03:00
|
|
|
return strlen(q->name);
|
2014-06-01 09:34:18 +03:00
|
|
|
} else if (r < 0) {
|
2007-02-04 19:00:20 +02:00
|
|
|
/* Error */
|
2007-07-12 16:01:18 +03:00
|
|
|
warn("read dns");
|
2007-02-04 17:46:06 +02:00
|
|
|
}
|
|
|
|
|
2008-08-06 00:53:19 +03:00
|
|
|
return 0;
|
2007-02-04 17:46:06 +02:00
|
|
|
}
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
static size_t
|
|
|
|
write_dns_nameenc(char *buf, size_t buflen, char *data, int datalen, char downenc)
|
|
|
|
/* Returns #bytes of data that were encoded */
|
|
|
|
{
|
|
|
|
static int td1 = 0;
|
|
|
|
static int td2 = 0;
|
|
|
|
size_t space;
|
|
|
|
char *b;
|
|
|
|
|
|
|
|
/* Make a rotating topdomain to prevent filtering */
|
|
|
|
td1+=3;
|
|
|
|
td2+=7;
|
|
|
|
if (td1>=26) td1-=26;
|
|
|
|
if (td2>=25) td2-=25;
|
|
|
|
|
|
|
|
/* encode data,datalen to CNAME/MX answer
|
|
|
|
(adapted from build_hostname() in encoding.c)
|
|
|
|
*/
|
|
|
|
|
|
|
|
space = MIN(0xFF, buflen) - 4 - 2;
|
|
|
|
/* -1 encoding type, -3 ".xy", -2 for safety */
|
|
|
|
|
2013-12-23 19:04:06 +02:00
|
|
|
memset(buf, 0, buflen);
|
2009-12-29 22:00:57 +02:00
|
|
|
|
|
|
|
if (downenc == 'S') {
|
|
|
|
buf[0] = 'i';
|
|
|
|
if (!b64->places_dots())
|
|
|
|
space -= (space / 57); /* space for dots */
|
|
|
|
b64->encode(buf+1, &space, data, datalen);
|
|
|
|
if (!b64->places_dots())
|
|
|
|
inline_dotify(buf, buflen);
|
|
|
|
} else if (downenc == 'U') {
|
|
|
|
buf[0] = 'j';
|
|
|
|
if (!b64u->places_dots())
|
|
|
|
space -= (space / 57); /* space for dots */
|
|
|
|
b64u->encode(buf+1, &space, data, datalen);
|
|
|
|
if (!b64u->places_dots())
|
|
|
|
inline_dotify(buf, buflen);
|
|
|
|
} else if (downenc == 'V') {
|
|
|
|
buf[0] = 'k';
|
|
|
|
if (!b128->places_dots())
|
|
|
|
space -= (space / 57); /* space for dots */
|
|
|
|
b128->encode(buf+1, &space, data, datalen);
|
|
|
|
if (!b128->places_dots())
|
|
|
|
inline_dotify(buf, buflen);
|
|
|
|
} else {
|
|
|
|
buf[0] = 'h';
|
|
|
|
if (!b32->places_dots())
|
|
|
|
space -= (space / 57); /* space for dots */
|
|
|
|
b32->encode(buf+1, &space, data, datalen);
|
|
|
|
if (!b32->places_dots())
|
|
|
|
inline_dotify(buf, buflen);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Add dot (if it wasn't there already) and topdomain */
|
|
|
|
b = buf;
|
|
|
|
b += strlen(buf) - 1;
|
2014-06-01 09:34:18 +03:00
|
|
|
if (*b != '.')
|
2009-12-29 22:00:57 +02:00
|
|
|
*++b = '.';
|
|
|
|
b++;
|
|
|
|
|
|
|
|
*b = 'a' + td1;
|
|
|
|
b++;
|
|
|
|
*b = 'a' + td2;
|
|
|
|
b++;
|
|
|
|
*b = '\0';
|
|
|
|
|
|
|
|
return space;
|
|
|
|
}
|
|
|
|
|
2007-02-05 19:49:30 +02:00
|
|
|
static void
|
2009-09-20 18:11:16 +03:00
|
|
|
write_dns(int fd, struct query *q, char *data, int datalen, char downenc)
|
2007-02-05 19:49:30 +02:00
|
|
|
{
|
|
|
|
char buf[64*1024];
|
2009-09-20 18:11:16 +03:00
|
|
|
int len = 0;
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
if (q->type == T_CNAME || q->type == T_A) {
|
2009-09-20 18:11:16 +03:00
|
|
|
char cnamebuf[1024]; /* max 255 */
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
write_dns_nameenc(cnamebuf, sizeof(cnamebuf),
|
|
|
|
data, datalen, downenc);
|
|
|
|
|
|
|
|
len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, cnamebuf,
|
|
|
|
sizeof(cnamebuf));
|
|
|
|
} else if (q->type == T_MX || q->type == T_SRV) {
|
|
|
|
char mxbuf[64*1024];
|
|
|
|
char *b = mxbuf;
|
|
|
|
int offset = 0;
|
|
|
|
int res;
|
|
|
|
|
|
|
|
while (1) {
|
|
|
|
res = write_dns_nameenc(b, sizeof(mxbuf) - (b - mxbuf),
|
|
|
|
data + offset,
|
|
|
|
datalen - offset, downenc);
|
|
|
|
if (res < 1) {
|
|
|
|
/* nothing encoded */
|
|
|
|
b++; /* for final \0 */
|
|
|
|
break;
|
|
|
|
}
|
2009-09-20 18:11:16 +03:00
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
b = b + strlen(b) + 1;
|
2009-09-20 18:11:16 +03:00
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
offset += res;
|
|
|
|
if (offset >= datalen)
|
|
|
|
break;
|
2009-09-20 18:11:16 +03:00
|
|
|
}
|
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
/* Add final \0 */
|
2009-09-20 18:11:16 +03:00
|
|
|
*b = '\0';
|
2007-02-05 19:49:30 +02:00
|
|
|
|
2009-12-29 22:00:57 +02:00
|
|
|
len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, mxbuf,
|
|
|
|
sizeof(mxbuf));
|
|
|
|
} else if (q->type == T_TXT) {
|
2009-09-20 18:11:16 +03:00
|
|
|
/* TXT with base32 */
|
|
|
|
char txtbuf[64*1024];
|
|
|
|
size_t space = sizeof(txtbuf) - 1;;
|
|
|
|
|
|
|
|
memset(txtbuf, 0, sizeof(txtbuf));
|
|
|
|
|
|
|
|
if (downenc == 'S') {
|
2009-12-29 22:00:57 +02:00
|
|
|
txtbuf[0] = 's'; /* plain base64(Sixty-four) */
|
2009-09-20 18:11:16 +03:00
|
|
|
len = b64->encode(txtbuf+1, &space, data, datalen);
|
|
|
|
}
|
2009-12-29 22:00:57 +02:00
|
|
|
else if (downenc == 'U') {
|
|
|
|
txtbuf[0] = 'u'; /* Base64 with Underscore */
|
|
|
|
len = b64u->encode(txtbuf+1, &space, data, datalen);
|
|
|
|
}
|
|
|
|
else if (downenc == 'V') {
|
|
|
|
txtbuf[0] = 'v'; /* Base128 */
|
|
|
|
len = b128->encode(txtbuf+1, &space, data, datalen);
|
|
|
|
}
|
2009-09-20 18:11:16 +03:00
|
|
|
else if (downenc == 'R') {
|
2009-12-29 22:00:57 +02:00
|
|
|
txtbuf[0] = 'r'; /* Raw binary data */
|
2009-09-20 18:11:16 +03:00
|
|
|
len = MIN(datalen, sizeof(txtbuf) - 1);
|
|
|
|
memcpy(txtbuf + 1, data, len);
|
|
|
|
} else {
|
2009-12-29 22:00:57 +02:00
|
|
|
txtbuf[0] = 't'; /* plain base32(Thirty-two) */
|
2009-09-20 18:11:16 +03:00
|
|
|
len = b32->encode(txtbuf+1, &space, data, datalen);
|
|
|
|
}
|
|
|
|
len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, txtbuf, len+1);
|
|
|
|
} else {
|
|
|
|
/* Normal NULL-record encode */
|
|
|
|
len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, data, datalen);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (len < 1) {
|
|
|
|
warnx("dns_encode doesn't fit");
|
|
|
|
return;
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-12-12 00:39:06 +02:00
|
|
|
if (debug >= 2) {
|
2014-06-01 09:34:18 +03:00
|
|
|
fprintf(stderr, "TX: client %s, type %d, name %s, %d bytes data\n",
|
2014-02-06 20:39:16 +02:00
|
|
|
format_addr(&q->from, q->fromlen), q->type, q->name, datalen);
|
2008-08-06 01:37:40 +03:00
|
|
|
}
|
|
|
|
|
2007-02-05 19:49:30 +02:00
|
|
|
sendto(fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen);
|
|
|
|
}
|
|
|
|
|
2006-06-09 23:35:26 +03:00
|
|
|
static void
|
|
|
|
usage() {
|
2006-08-25 00:26:40 +03:00
|
|
|
extern char *__progname;
|
|
|
|
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "Usage: %s [-v] [-h] [-c] [-s] [-f] [-D] [-u user] "
|
2009-06-24 20:28:13 +03:00
|
|
|
"[-t chrootdir] [-d device] [-m mtu] [-z context] "
|
2009-08-16 00:52:49 +03:00
|
|
|
"[-l ip address to listen on] [-p port] [-n external ip] "
|
2013-12-23 22:58:28 +02:00
|
|
|
"[-b dnsport] [-P password] [-F pidfile] [-i max idle time] "
|
2009-08-16 00:52:49 +03:00
|
|
|
"tunnel_ip[/netmask] topdomain\n", __progname);
|
2006-06-09 23:35:26 +03:00
|
|
|
exit(2);
|
|
|
|
}
|
|
|
|
|
2006-06-11 16:14:57 +03:00
|
|
|
static void
|
|
|
|
help() {
|
2006-08-25 00:26:40 +03:00
|
|
|
extern char *__progname;
|
|
|
|
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "iodine IP over DNS tunneling server\n");
|
|
|
|
fprintf(stderr, "Usage: %s [-v] [-h] [-c] [-s] [-f] [-D] [-u user] "
|
2009-06-24 20:28:13 +03:00
|
|
|
"[-t chrootdir] [-d device] [-m mtu] [-z context] "
|
2009-08-16 00:52:49 +03:00
|
|
|
"[-l ip address to listen on] [-p port] [-n external ip] [-b dnsport] [-P password] "
|
|
|
|
"[-F pidfile] tunnel_ip[/netmask] topdomain\n", __progname);
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, " -v to print version info and exit\n");
|
|
|
|
fprintf(stderr, " -h to print this help and exit\n");
|
|
|
|
fprintf(stderr, " -c to disable check of client IP/port on each request\n");
|
|
|
|
fprintf(stderr, " -s to skip creating and configuring the tun device, "
|
2008-09-09 22:55:45 +03:00
|
|
|
"which then has to be created manually\n");
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, " -f to keep running in foreground\n");
|
|
|
|
fprintf(stderr, " -D to increase debug level\n");
|
2009-12-29 22:00:57 +02:00
|
|
|
fprintf(stderr, " (using -DD in UTF-8 terminal: \"LC_ALL=C luit iodined -DD ...\")\n");
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, " -u name to drop privileges and run as user 'name'\n");
|
|
|
|
fprintf(stderr, " -t dir to chroot to directory dir\n");
|
|
|
|
fprintf(stderr, " -d device to set tunnel device name\n");
|
|
|
|
fprintf(stderr, " -m mtu to set tunnel device mtu\n");
|
2009-06-24 20:28:13 +03:00
|
|
|
fprintf(stderr, " -z context to apply SELinux context after initialization\n");
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, " -l ip address to listen on for incoming dns traffic "
|
2008-09-09 22:55:45 +03:00
|
|
|
"(default 0.0.0.0)\n");
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, " -p port to listen on for incoming dns traffic (default 53)\n");
|
|
|
|
fprintf(stderr, " -n ip to respond with to NS queries\n");
|
|
|
|
fprintf(stderr, " -b port to forward normal DNS queries to (on localhost)\n");
|
|
|
|
fprintf(stderr, " -P password used for authentication (max 32 chars will be used)\n");
|
2009-08-16 00:52:49 +03:00
|
|
|
fprintf(stderr, " -F pidfile to write pid to a file\n");
|
2013-12-23 22:58:28 +02:00
|
|
|
fprintf(stderr, " -i maximum idle time before shutting down\n");
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "tunnel_ip is the IP number of the local tunnel interface.\n");
|
|
|
|
fprintf(stderr, " /netmask sets the size of the tunnel network.\n");
|
|
|
|
fprintf(stderr, "topdomain is the FQDN that is delegated to this server.\n");
|
2006-06-11 16:14:57 +03:00
|
|
|
exit(0);
|
|
|
|
}
|
|
|
|
|
2006-06-11 16:27:48 +03:00
|
|
|
static void
|
|
|
|
version() {
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "iodine IP over DNS tunneling server\n");
|
2014-01-29 21:25:45 +02:00
|
|
|
fprintf(stderr, "Git version: %s\n", GITREVISION);
|
2006-06-11 16:27:48 +03:00
|
|
|
exit(0);
|
|
|
|
}
|
|
|
|
|
2006-06-05 21:47:09 +03:00
|
|
|
int
|
|
|
|
main(int argc, char **argv)
|
|
|
|
{
|
2009-02-15 20:24:12 +02:00
|
|
|
extern char *__progname;
|
2014-02-05 23:36:53 +02:00
|
|
|
char *listen_ip;
|
2014-05-31 11:06:44 +03:00
|
|
|
char *errormsg;
|
2009-01-25 00:19:11 +02:00
|
|
|
#ifndef WINDOWS32
|
2007-07-12 16:46:58 +03:00
|
|
|
struct passwd *pw;
|
2009-01-25 00:19:11 +02:00
|
|
|
#endif
|
2007-07-12 16:46:58 +03:00
|
|
|
int foreground;
|
2006-06-09 23:35:26 +03:00
|
|
|
char *username;
|
2007-07-12 16:46:58 +03:00
|
|
|
char *newroot;
|
2009-06-24 20:28:13 +03:00
|
|
|
char *context;
|
2006-06-24 13:28:24 +03:00
|
|
|
char *device;
|
2009-08-16 00:52:49 +03:00
|
|
|
char *pidfile;
|
2007-07-12 16:46:58 +03:00
|
|
|
int dnsd_fd;
|
|
|
|
int tun_fd;
|
2008-08-08 00:18:15 +03:00
|
|
|
|
2014-06-01 09:34:18 +03:00
|
|
|
/* settings for forwarding normal DNS to
|
2008-08-08 00:18:15 +03:00
|
|
|
* local real DNS server */
|
|
|
|
int bind_fd;
|
|
|
|
int bind_enable;
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2007-07-12 16:46:58 +03:00
|
|
|
int choice;
|
2006-11-05 15:18:57 +02:00
|
|
|
int port;
|
2007-07-12 16:46:58 +03:00
|
|
|
int mtu;
|
2008-07-12 14:45:22 +03:00
|
|
|
int skipipconfig;
|
2009-01-04 14:39:28 +02:00
|
|
|
char *netsize;
|
2012-09-03 11:34:27 +03:00
|
|
|
int ns_get_externalip;
|
2009-06-24 19:40:51 +03:00
|
|
|
int retval;
|
2013-12-23 22:58:28 +02:00
|
|
|
int max_idle_time = 0;
|
2014-02-05 23:36:53 +02:00
|
|
|
struct sockaddr_storage dnsaddr;
|
|
|
|
int dnsaddr_len;
|
2013-12-23 11:48:46 +02:00
|
|
|
#ifdef HAVE_SYSTEMD
|
|
|
|
int nb_fds;
|
|
|
|
#endif
|
2006-06-09 23:35:26 +03:00
|
|
|
|
2009-08-15 22:35:07 +03:00
|
|
|
#ifndef WINDOWS32
|
2009-08-15 22:28:48 +03:00
|
|
|
pw = NULL;
|
2009-08-15 22:35:07 +03:00
|
|
|
#endif
|
2014-05-31 11:06:44 +03:00
|
|
|
errormsg = NULL;
|
2006-06-09 23:35:26 +03:00
|
|
|
username = NULL;
|
2006-06-11 18:24:20 +03:00
|
|
|
newroot = NULL;
|
2009-06-24 20:28:13 +03:00
|
|
|
context = NULL;
|
2006-06-24 13:28:24 +03:00
|
|
|
device = NULL;
|
2006-06-11 16:05:41 +03:00
|
|
|
foreground = 0;
|
2008-08-08 00:18:15 +03:00
|
|
|
bind_enable = 0;
|
|
|
|
bind_fd = 0;
|
2009-12-29 22:00:57 +02:00
|
|
|
mtu = 1130; /* Very many relays give fragsize 1150 or slightly
|
|
|
|
higher for NULL; tun/zlib adds ~17 bytes. */
|
2014-02-05 23:36:53 +02:00
|
|
|
listen_ip = NULL;
|
2006-11-05 15:18:57 +02:00
|
|
|
port = 53;
|
2008-09-14 16:21:11 +03:00
|
|
|
ns_ip = INADDR_ANY;
|
2012-09-03 11:34:27 +03:00
|
|
|
ns_get_externalip = 0;
|
2008-07-13 01:39:29 +03:00
|
|
|
check_ip = 1;
|
2008-07-12 14:45:22 +03:00
|
|
|
skipipconfig = 0;
|
2008-08-06 01:37:40 +03:00
|
|
|
debug = 0;
|
2009-01-04 14:03:35 +02:00
|
|
|
netmask = 27;
|
2009-08-16 00:52:49 +03:00
|
|
|
pidfile = NULL;
|
2006-06-11 21:43:37 +03:00
|
|
|
|
2007-06-09 19:18:59 +03:00
|
|
|
b32 = get_base32_encoder();
|
2009-09-20 18:11:16 +03:00
|
|
|
b64 = get_base64_encoder();
|
2009-12-29 22:00:57 +02:00
|
|
|
b64u = get_base64u_encoder();
|
|
|
|
b128 = get_base128_encoder();
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-06-24 19:40:51 +03:00
|
|
|
retval = 0;
|
|
|
|
|
2009-01-25 19:16:00 +02:00
|
|
|
#ifdef WINDOWS32
|
|
|
|
WSAStartup(req_version, &wsa_data);
|
|
|
|
#endif
|
2007-06-09 19:18:59 +03:00
|
|
|
|
2008-07-12 15:26:41 +03:00
|
|
|
#if !defined(BSD) && !defined(__GLIBC__)
|
|
|
|
__progname = strrchr(argv[0], '/');
|
|
|
|
if (__progname == NULL)
|
|
|
|
__progname = argv[0];
|
|
|
|
else
|
|
|
|
__progname++;
|
|
|
|
#endif
|
|
|
|
|
2007-07-12 16:46:58 +03:00
|
|
|
memset(password, 0, sizeof(password));
|
2006-11-19 02:41:42 +02:00
|
|
|
srand(time(NULL));
|
2008-08-08 00:18:15 +03:00
|
|
|
fw_query_init();
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2013-12-23 22:58:28 +02:00
|
|
|
while ((choice = getopt(argc, argv, "vcsfhDu:t:d:m:l:p:n:b:P:z:F:i:")) != -1) {
|
2006-06-09 23:35:26 +03:00
|
|
|
switch(choice) {
|
2006-06-11 16:27:48 +03:00
|
|
|
case 'v':
|
|
|
|
version();
|
|
|
|
break;
|
2008-07-13 01:39:29 +03:00
|
|
|
case 'c':
|
|
|
|
check_ip = 0;
|
|
|
|
break;
|
2008-07-12 14:45:22 +03:00
|
|
|
case 's':
|
|
|
|
skipipconfig = 1;
|
|
|
|
break;
|
2006-06-11 16:05:41 +03:00
|
|
|
case 'f':
|
|
|
|
foreground = 1;
|
|
|
|
break;
|
2006-06-11 16:14:57 +03:00
|
|
|
case 'h':
|
|
|
|
help();
|
|
|
|
break;
|
2008-08-06 01:37:40 +03:00
|
|
|
case 'D':
|
|
|
|
debug++;
|
|
|
|
break;
|
2006-06-09 23:35:26 +03:00
|
|
|
case 'u':
|
|
|
|
username = optarg;
|
|
|
|
break;
|
2006-06-11 17:29:36 +03:00
|
|
|
case 't':
|
|
|
|
newroot = optarg;
|
|
|
|
break;
|
2006-06-24 13:28:24 +03:00
|
|
|
case 'd':
|
|
|
|
device = optarg;
|
|
|
|
break;
|
2006-06-11 18:24:20 +03:00
|
|
|
case 'm':
|
|
|
|
mtu = atoi(optarg);
|
|
|
|
break;
|
2006-08-12 01:52:36 +03:00
|
|
|
case 'l':
|
2014-02-05 23:36:53 +02:00
|
|
|
listen_ip = optarg;
|
2006-08-12 01:52:36 +03:00
|
|
|
break;
|
2006-11-05 15:18:57 +02:00
|
|
|
case 'p':
|
|
|
|
port = atoi(optarg);
|
|
|
|
break;
|
2008-09-14 16:21:11 +03:00
|
|
|
case 'n':
|
2012-09-03 11:34:27 +03:00
|
|
|
if (optarg && strcmp("auto", optarg) == 0) {
|
|
|
|
ns_get_externalip = 1;
|
|
|
|
} else {
|
|
|
|
ns_ip = inet_addr(optarg);
|
|
|
|
}
|
2008-09-14 16:21:11 +03:00
|
|
|
break;
|
2008-08-08 00:18:15 +03:00
|
|
|
case 'b':
|
|
|
|
bind_enable = 1;
|
|
|
|
bind_port = atoi(optarg);
|
|
|
|
break;
|
2009-08-16 00:52:49 +03:00
|
|
|
case 'F':
|
|
|
|
pidfile = optarg;
|
2014-06-01 09:34:18 +03:00
|
|
|
break;
|
2013-12-23 22:58:28 +02:00
|
|
|
case 'i':
|
|
|
|
max_idle_time = atoi(optarg);
|
|
|
|
break;
|
2006-11-18 18:08:47 +02:00
|
|
|
case 'P':
|
2007-08-26 18:47:32 +03:00
|
|
|
strncpy(password, optarg, sizeof(password));
|
|
|
|
password[sizeof(password)-1] = 0;
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2007-07-12 16:46:58 +03:00
|
|
|
/* XXX: find better way of cleaning up ps(1) */
|
2014-06-01 09:34:18 +03:00
|
|
|
memset(optarg, 0, strlen(optarg));
|
2006-11-18 18:08:47 +02:00
|
|
|
break;
|
2009-06-24 20:28:13 +03:00
|
|
|
case 'z':
|
|
|
|
context = optarg;
|
|
|
|
break;
|
2006-06-09 23:35:26 +03:00
|
|
|
default:
|
|
|
|
usage();
|
2006-06-11 17:33:59 +03:00
|
|
|
break;
|
2006-06-09 23:35:26 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
argc -= optind;
|
|
|
|
argv += optind;
|
2007-02-04 22:37:36 +02:00
|
|
|
|
2009-01-24 17:50:54 +02:00
|
|
|
check_superuser(usage);
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2014-06-01 09:34:18 +03:00
|
|
|
if (argc != 2)
|
2006-06-09 23:35:26 +03:00
|
|
|
usage();
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-01-04 14:39:28 +02:00
|
|
|
netsize = strchr(argv[0], '/');
|
|
|
|
if (netsize) {
|
|
|
|
*netsize = 0;
|
|
|
|
netsize++;
|
|
|
|
netmask = atoi(netsize);
|
|
|
|
}
|
|
|
|
|
2008-09-14 16:21:11 +03:00
|
|
|
my_ip = inet_addr(argv[0]);
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-09-14 16:21:11 +03:00
|
|
|
if (my_ip == INADDR_NONE) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("Bad IP address to use inside tunnel.");
|
2008-09-14 16:21:11 +03:00
|
|
|
usage();
|
|
|
|
}
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2007-02-04 22:37:36 +02:00
|
|
|
topdomain = strdup(argv[1]);
|
2014-05-31 11:06:44 +03:00
|
|
|
if(check_topdomain(topdomain, &errormsg)) {
|
|
|
|
warnx("Invalid topdomain: %s", errormsg);
|
2007-07-12 02:25:03 +03:00
|
|
|
usage();
|
2014-05-31 11:06:44 +03:00
|
|
|
/* NOTREACHED */
|
2007-07-12 02:25:03 +03:00
|
|
|
}
|
2007-02-04 22:37:36 +02:00
|
|
|
|
2007-07-12 18:48:05 +03:00
|
|
|
if (username != NULL) {
|
2009-01-25 00:19:11 +02:00
|
|
|
#ifndef WINDOWS32
|
2007-07-12 18:48:05 +03:00
|
|
|
if ((pw = getpwnam(username)) == NULL) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("User %s does not exist!", username);
|
2006-06-11 15:18:49 +03:00
|
|
|
usage();
|
|
|
|
}
|
2009-01-25 00:19:11 +02:00
|
|
|
#endif
|
2006-06-11 15:18:49 +03:00
|
|
|
}
|
|
|
|
|
2008-07-12 14:41:01 +03:00
|
|
|
if (mtu <= 0) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("Bad MTU given.");
|
2006-06-11 18:24:20 +03:00
|
|
|
usage();
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2008-07-12 14:41:01 +03:00
|
|
|
if(port < 1 || port > 65535) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("Bad port number given.");
|
2008-07-12 14:41:01 +03:00
|
|
|
usage();
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2014-02-05 23:36:53 +02:00
|
|
|
if (port != 53) {
|
|
|
|
fprintf(stderr, "ALERT! Other dns servers expect you to run on port 53.\n");
|
|
|
|
fprintf(stderr, "You must manually forward port 53 to port %d for things to work.\n", port);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (debug) {
|
|
|
|
fprintf(stderr, "Debug level %d enabled, will stay in foreground.\n", debug);
|
|
|
|
fprintf(stderr, "Add more -D switches to set higher debug level.\n");
|
|
|
|
foreground = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
dnsaddr_len = get_addr(listen_ip, port, AF_INET, AI_PASSIVE | AI_NUMERICHOST, &dnsaddr);
|
|
|
|
if (dnsaddr_len < 0) {
|
|
|
|
warnx("Bad IP address to listen on.");
|
|
|
|
usage();
|
|
|
|
}
|
|
|
|
|
2008-08-08 00:18:15 +03:00
|
|
|
if(bind_enable) {
|
2014-02-05 23:36:53 +02:00
|
|
|
in_addr_t dns_ip = ((struct sockaddr_in *) &dnsaddr)->sin_addr.s_addr;
|
2009-07-16 11:44:04 +03:00
|
|
|
if (bind_port < 1 || bind_port > 65535) {
|
|
|
|
warnx("Bad DNS server port number given.");
|
|
|
|
usage();
|
|
|
|
/* NOTREACHED */
|
|
|
|
}
|
|
|
|
/* Avoid forwarding loops */
|
2014-02-05 23:36:53 +02:00
|
|
|
if (bind_port == port && (dns_ip == INADDR_ANY || dns_ip == htonl(0x7f000001L))) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("Forward port is same as listen port (%d), will create a loop!", bind_port);
|
|
|
|
fprintf(stderr, "Use -l to set listen ip to avoid this.\n");
|
2008-08-08 00:18:15 +03:00
|
|
|
usage();
|
|
|
|
/* NOTREACHED */
|
|
|
|
}
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "Requests for domains outside of %s will be forwarded to port %d\n",
|
2008-08-08 00:18:15 +03:00
|
|
|
topdomain, bind_port);
|
|
|
|
}
|
2006-06-11 18:24:20 +03:00
|
|
|
|
2012-09-03 11:34:27 +03:00
|
|
|
if (ns_get_externalip) {
|
|
|
|
struct in_addr extip;
|
|
|
|
int res = get_external_ip(&extip);
|
|
|
|
if (res) {
|
|
|
|
fprintf(stderr, "Failed to get external IP via web service.\n");
|
|
|
|
exit(3);
|
|
|
|
}
|
|
|
|
ns_ip = extip.s_addr;
|
|
|
|
fprintf(stderr, "Using %s as external IP.\n", inet_ntoa(extip));
|
|
|
|
}
|
|
|
|
|
2008-09-14 16:21:11 +03:00
|
|
|
if (ns_ip == INADDR_NONE) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("Bad IP address to return as nameserver.");
|
2008-09-14 16:21:11 +03:00
|
|
|
usage();
|
|
|
|
}
|
2009-01-04 14:03:35 +02:00
|
|
|
if (netmask > 30 || netmask < 8) {
|
2009-07-16 11:44:04 +03:00
|
|
|
warnx("Bad netmask (%d bits). Use 8-30 bits.", netmask);
|
2009-01-04 14:03:35 +02:00
|
|
|
usage();
|
|
|
|
}
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-09-19 11:09:12 +03:00
|
|
|
if (strlen(password) == 0) {
|
|
|
|
if (NULL != getenv(PASSWORD_ENV_VAR))
|
|
|
|
snprintf(password, sizeof(password), "%s", getenv(PASSWORD_ENV_VAR));
|
|
|
|
else
|
|
|
|
read_password(password, sizeof(password));
|
|
|
|
}
|
2006-11-18 18:08:47 +02:00
|
|
|
|
2010-02-08 18:50:45 +02:00
|
|
|
created_users = init_users(my_ip, netmask);
|
|
|
|
|
2009-06-24 19:40:51 +03:00
|
|
|
if ((tun_fd = open_tun(device)) == -1) {
|
|
|
|
retval = 1;
|
2006-06-11 18:24:20 +03:00
|
|
|
goto cleanup0;
|
2009-06-24 19:40:51 +03:00
|
|
|
}
|
|
|
|
if (!skipipconfig) {
|
2010-03-02 00:05:55 +02:00
|
|
|
const char *other_ip = users_get_first_ip();
|
|
|
|
if (tun_setip(argv[0], other_ip, netmask) != 0 || tun_setmtu(mtu) != 0) {
|
2009-06-24 19:40:51 +03:00
|
|
|
retval = 1;
|
2010-03-02 00:05:55 +02:00
|
|
|
free((void*) other_ip);
|
2008-07-12 14:45:22 +03:00
|
|
|
goto cleanup1;
|
2009-06-24 19:40:51 +03:00
|
|
|
}
|
2010-03-02 00:05:55 +02:00
|
|
|
free((void*) other_ip);
|
2009-06-24 19:40:51 +03:00
|
|
|
}
|
2013-12-23 11:48:46 +02:00
|
|
|
#ifdef HAVE_SYSTEMD
|
|
|
|
nb_fds = sd_listen_fds(0);
|
|
|
|
if (nb_fds > 1) {
|
2009-06-24 19:40:51 +03:00
|
|
|
retval = 1;
|
2013-12-23 11:48:46 +02:00
|
|
|
warnx("Too many file descriptors received!\n");
|
|
|
|
goto cleanup1;
|
|
|
|
} else if (nb_fds == 1) {
|
|
|
|
dnsd_fd = SD_LISTEN_FDS_START;
|
|
|
|
} else {
|
|
|
|
#endif
|
2014-02-05 23:36:53 +02:00
|
|
|
if ((dnsd_fd = open_dns(&dnsaddr, dnsaddr_len)) < 0) {
|
2013-12-23 11:48:46 +02:00
|
|
|
retval = 1;
|
|
|
|
goto cleanup2;
|
|
|
|
}
|
|
|
|
#ifdef HAVE_SYSTEMD
|
2009-06-24 19:40:51 +03:00
|
|
|
}
|
2013-12-23 11:48:46 +02:00
|
|
|
#endif
|
2009-06-24 19:40:51 +03:00
|
|
|
if (bind_enable) {
|
2014-02-05 23:36:53 +02:00
|
|
|
if ((bind_fd = open_dns_from_host(NULL, 0, AF_INET, 0)) < 0) {
|
2009-06-24 19:40:51 +03:00
|
|
|
retval = 1;
|
2008-08-08 00:18:15 +03:00
|
|
|
goto cleanup3;
|
2009-06-24 19:40:51 +03:00
|
|
|
}
|
|
|
|
}
|
2006-06-23 10:58:36 +03:00
|
|
|
|
|
|
|
my_mtu = mtu;
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-01-04 14:03:35 +02:00
|
|
|
if (created_users < USERS) {
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "Limiting to %d simultaneous users because of netmask /%d\n",
|
2009-01-04 14:03:35 +02:00
|
|
|
created_users, netmask);
|
|
|
|
}
|
2009-02-28 16:35:03 +02:00
|
|
|
fprintf(stderr, "Listening to dns for domain %s\n", topdomain);
|
2006-06-11 17:42:19 +03:00
|
|
|
|
2014-06-01 09:34:18 +03:00
|
|
|
if (foreground == 0)
|
2007-11-27 22:11:43 +02:00
|
|
|
do_detach();
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2009-08-16 00:52:49 +03:00
|
|
|
if (pidfile != NULL)
|
|
|
|
do_pidfile(pidfile);
|
|
|
|
|
2010-02-08 18:09:45 +02:00
|
|
|
#ifdef FREEBSD
|
|
|
|
tzsetwall();
|
|
|
|
#endif
|
2010-02-08 18:13:17 +02:00
|
|
|
#ifndef WINDOWS32
|
2010-02-08 18:09:45 +02:00
|
|
|
openlog( __progname, LOG_NDELAY, LOG_DAEMON );
|
2010-02-08 18:13:17 +02:00
|
|
|
#endif
|
2010-02-08 18:09:45 +02:00
|
|
|
|
2007-07-12 16:36:24 +03:00
|
|
|
if (newroot != NULL)
|
|
|
|
do_chroot(newroot);
|
2006-06-11 16:05:41 +03:00
|
|
|
|
2006-06-05 21:47:09 +03:00
|
|
|
signal(SIGINT, sigint);
|
2007-07-12 18:48:05 +03:00
|
|
|
if (username != NULL) {
|
2009-01-25 00:19:11 +02:00
|
|
|
#ifndef WINDOWS32
|
2008-07-12 15:05:59 +03:00
|
|
|
gid_t gids[1];
|
|
|
|
gids[0] = pw->pw_gid;
|
|
|
|
if (setgroups(1, gids) < 0 || setgid(pw->pw_gid) < 0 || setuid(pw->pw_uid) < 0) {
|
2007-07-12 18:48:05 +03:00
|
|
|
warnx("Could not switch to user %s!\n", username);
|
2006-06-09 23:35:26 +03:00
|
|
|
usage();
|
|
|
|
}
|
2009-01-25 00:19:11 +02:00
|
|
|
#endif
|
2006-06-09 23:35:26 +03:00
|
|
|
}
|
2009-02-15 20:24:12 +02:00
|
|
|
|
2009-06-24 20:28:13 +03:00
|
|
|
if (context != NULL)
|
|
|
|
do_setcon(context);
|
|
|
|
|
2009-02-15 20:24:12 +02:00
|
|
|
syslog(LOG_INFO, "started, listening on port %d", port);
|
2014-06-01 09:34:18 +03:00
|
|
|
|
2013-12-23 22:58:28 +02:00
|
|
|
tunnel(tun_fd, dnsd_fd, bind_fd, max_idle_time);
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2009-02-15 20:24:12 +02:00
|
|
|
syslog(LOG_INFO, "stopping");
|
2008-08-08 00:18:15 +03:00
|
|
|
cleanup3:
|
|
|
|
close_dns(bind_fd);
|
2006-06-11 17:42:19 +03:00
|
|
|
cleanup2:
|
2006-06-11 22:54:23 +03:00
|
|
|
close_dns(dnsd_fd);
|
2006-06-11 17:42:19 +03:00
|
|
|
cleanup1:
|
2014-06-01 09:34:18 +03:00
|
|
|
close_tun(tun_fd);
|
2006-06-11 18:24:20 +03:00
|
|
|
cleanup0:
|
2006-06-05 21:47:09 +03:00
|
|
|
|
2009-06-24 19:40:51 +03:00
|
|
|
return retval;
|
2006-06-05 21:47:09 +03:00
|
|
|
}
|