From 0de9a49038b0d814afa1e0db25f3d1c2a75d9a02 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 16 Aug 2009 12:30:26 +0000 Subject: [PATCH 01/49] Split the client code out from the file with the main() func --- src/Makefile | 2 +- src/client.c | 1131 +++++++++++++++++++++++++++++++++++++++++++++++++ src/client.h | 33 ++ src/iodine.c | 1141 +------------------------------------------------- src/login.c | 2 +- src/login.h | 2 +- src/util.c | 69 +++ src/util.h | 6 + 8 files changed, 1259 insertions(+), 1127 deletions(-) create mode 100644 src/client.c create mode 100644 src/client.h create mode 100644 src/util.c create mode 100644 src/util.h diff --git a/src/Makefile b/src/Makefile index e281142..3cfdea7 100644 --- a/src/Makefile +++ b/src/Makefile @@ -1,5 +1,5 @@ COMMONOBJS = tun.o dns.o read.o encoding.o login.o base32.o base64.o md5.o common.o -CLIENTOBJS = iodine.o +CLIENTOBJS = iodine.o client.o util.o CLIENT = ../bin/iodine SERVEROBJS = iodined.o user.o fw_query.o SERVER = ../bin/iodined diff --git a/src/client.c b/src/client.c new file mode 100644 index 0000000..bd516cf --- /dev/null +++ b/src/client.c @@ -0,0 +1,1131 @@ +/* + * Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#ifdef WINDOWS32 +#include "windows.h" +#include +#else +#include +#ifdef DARWIN +#include +#endif +#include +#include +#include +#include +#include +#include +#include +#endif + +#include "common.h" +#include "encoding.h" +#include "base32.h" +#include "base64.h" +#include "dns.h" +#include "login.h" +#include "tun.h" +#include "version.h" +#include "client.h" + +#define PING_TIMEOUT(t) ((t) >= (conn == CONN_DNS_NULL ? 1 : 20)) + +static int running; +static const char *password; + +static struct sockaddr_in nameserv; +static struct sockaddr_in raw_serv; +static const char *topdomain; + +static uint16_t rand_seed; +static int downstream_seqno; +static int downstream_fragment; +static int down_ack_seqno; +static int down_ack_fragment; + +/* Current up/downstream IP packet */ +static struct packet outpkt; +static struct packet inpkt; + +/* My userid at the server */ +static char userid; + +/* DNS id for next packet */ +static uint16_t chunkid; + +/* Base32 encoder used for non-data packets */ +static struct encoder *b32; + +/* The encoder used for data packets + * Defaults to Base32, can be changed after handshake */ +static struct encoder *dataenc; + +/* My connection mode */ +static enum connection conn; + +void +client_init() +{ + running = 1; + outpkt.seqno = 0; + inpkt.len = 0; + downstream_seqno = 0; + downstream_fragment = 0; + down_ack_seqno = 0; + down_ack_fragment = 0; + chunkid = 0; + b32 = get_base32_encoder(); + dataenc = get_base32_encoder(); + rand_seed = rand(); + conn = CONN_DNS_NULL; +} + +void +client_stop() +{ + running = 0; +} + +enum connection +client_get_conn() +{ + return conn; +} + +void +client_set_nameserver(const char *cp) +{ + struct in_addr addr; + + if (inet_aton(cp, &addr) != 1) + errx(1, "error parsing nameserver address: '%s'", cp); + + memset(&nameserv, 0, sizeof(nameserv)); + nameserv.sin_family = AF_INET; + nameserv.sin_port = htons(53); + nameserv.sin_addr = addr; +} + +void +client_set_topdomain(const char *cp) +{ + topdomain = cp; +} + +void +client_set_password(const char *cp) +{ + password = cp; +} + +const char * +client_get_raw_addr() +{ + return inet_ntoa(raw_serv.sin_addr); +} + +static void +send_query(int fd, char *hostname) +{ + char packet[4096]; + struct query q; + size_t len; + + q.id = ++chunkid; + q.type = T_NULL; + + len = dns_encode(packet, sizeof(packet), &q, QR_QUERY, hostname, strlen(hostname)); + + sendto(fd, packet, len, 0, (struct sockaddr*)&nameserv, sizeof(nameserv)); +} + +static void +send_raw(int fd, char *buf, int buflen, int user, int cmd) +{ + char packet[4096]; + int len; + + len = MIN(sizeof(packet) - RAW_HDR_LEN, buflen); + + memcpy(packet, raw_header, RAW_HDR_LEN); + if (len) { + memcpy(&packet[RAW_HDR_LEN], buf, len); + } + + len += RAW_HDR_LEN; + packet[RAW_HDR_CMD] = cmd | (user & 0x0F); + + sendto(fd, packet, len, 0, (struct sockaddr*)&raw_serv, sizeof(raw_serv)); +} + +static void +send_raw_data(int dns_fd) +{ + send_raw(dns_fd, outpkt.data, outpkt.len, userid, RAW_HDR_CMD_DATA); +} + +static int +build_hostname(char *buf, size_t buflen, + const char *data, const size_t datalen, + const char *topdomain, struct encoder *encoder) +{ + int encsize; + size_t space; + char *b; + + space = MIN(0xFF, buflen) - strlen(topdomain) - 7; + if (!encoder->places_dots()) + space -= (space / 57); /* space for dots */ + + memset(buf, 0, buflen); + + encsize = encoder->encode(buf, &space, data, datalen); + + if (!encoder->places_dots()) + inline_dotify(buf, buflen); + + b = buf; + b += strlen(buf); + + if (*b != '.') + *b++ = '.'; + + strncpy(b, topdomain, strlen(topdomain)+1); + + return space; +} + +static void +send_packet(int fd, char cmd, const char *data, const size_t datalen) +{ + char buf[4096]; + + buf[0] = cmd; + + build_hostname(buf + 1, sizeof(buf) - 1, data, datalen, topdomain, b32); + send_query(fd, buf); +} + +static int +is_sending() +{ + return (outpkt.len != 0); +} + +static void +send_chunk(int fd) +{ + char hex[] = "0123456789ABCDEF"; + char buf[4096]; + int avail; + int code; + char *p; + + p = outpkt.data; + p += outpkt.offset; + avail = outpkt.len - outpkt.offset; + + outpkt.sentlen = build_hostname(buf + 4, sizeof(buf) - 4, p, avail, topdomain, dataenc); + + /* Build upstream data header (see doc/proto_xxxxxxxx.txt) */ + + buf[0] = hex[userid & 15]; /* First byte is 4 bits userid */ + + code = ((outpkt.seqno & 7) << 2) | ((outpkt.fragment & 15) >> 2); + buf[1] = b32_5to8(code); /* Second byte is 3 bits seqno, 2 upper bits fragment count */ + + code = ((outpkt.fragment & 3) << 3) | (downstream_seqno & 7); + buf[2] = b32_5to8(code); /* Third byte is 2 bits lower fragment count, 3 bits downstream packet seqno */ + + code = ((downstream_fragment & 15) << 1) | (outpkt.sentlen == avail); + buf[3] = b32_5to8(code); /* Fourth byte is 4 bits downstream fragment count, 1 bit last frag flag */ + + down_ack_seqno = downstream_seqno; + down_ack_fragment = downstream_fragment; + + outpkt.fragment++; + send_query(fd, buf); +} + +static void +send_ping(int fd) +{ + if (conn == CONN_DNS_NULL) { + char data[4]; + + if (is_sending()) { + outpkt.sentlen = 0; + outpkt.offset = 0; + outpkt.len = 0; + } + + data[0] = userid; + data[1] = ((downstream_seqno & 7) << 4) | (downstream_fragment & 15); + data[2] = (rand_seed >> 8) & 0xff; + data[3] = (rand_seed >> 0) & 0xff; + + down_ack_seqno = downstream_seqno; + down_ack_fragment = downstream_fragment; + + rand_seed++; + + send_packet(fd, 'P', data, sizeof(data)); + } else { + send_raw(fd, NULL, 0, userid, RAW_HDR_CMD_PING); + } +} + +static int +read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed for raw handling */ +{ + struct sockaddr_in from; + char data[64*1024]; + socklen_t addrlen; + struct query q; + int r; + + addrlen = sizeof(struct sockaddr); + if ((r = recvfrom(dns_fd, data, sizeof(data), 0, + (struct sockaddr*)&from, &addrlen)) == -1) { + warn("recvfrom"); + return 0; + } + + if (conn == CONN_DNS_NULL) { + int rv; + + rv = dns_decode(buf, buflen, &q, QR_ANSWER, data, r); + + /* decode the data header, update seqno and frag before next request */ + if (rv >= 2) { + downstream_seqno = (buf[1] >> 5) & 7; + downstream_fragment = (buf[1] >> 1) & 15; + } + + + if (is_sending()) { + if (chunkid == q.id) { + /* Got ACK on sent packet */ + outpkt.offset += outpkt.sentlen; + if (outpkt.offset == outpkt.len) { + /* Packet completed */ + outpkt.offset = 0; + outpkt.len = 0; + outpkt.sentlen = 0; + + /* If the ack contains unacked frag number but no data, + * send a ping to ack the frag number and get more data*/ + if (rv == 2 && ( + downstream_seqno != down_ack_seqno || + downstream_fragment != down_ack_fragment + )) { + + send_ping(dns_fd); + } + } else { + /* More to send */ + send_chunk(dns_fd); + } + } + } + return rv; + } else { /* CONN_RAW_UDP */ + unsigned long datalen; + char buf[64*1024]; + + /* minimum length */ + if (r < RAW_HDR_LEN) return 0; + /* should start with header */ + if (memcmp(data, raw_header, RAW_HDR_IDENT_LEN)) return 0; + /* should be data packet */ + if (RAW_HDR_GET_CMD(data) != RAW_HDR_CMD_DATA) return 0; + /* should be my user id */ + if (RAW_HDR_GET_USR(data) != userid) return 0; + + r -= RAW_HDR_LEN; + datalen = sizeof(buf); + if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) &data[RAW_HDR_LEN], r) == Z_OK) { + write_tun(tun_fd, buf, datalen); + } + return 0; + } +} + + +static int +tunnel_tun(int tun_fd, int dns_fd) +{ + unsigned long outlen; + unsigned long inlen; + char out[64*1024]; + char in[64*1024]; + ssize_t read; + + if ((read = read_tun(tun_fd, in, sizeof(in))) <= 0) + return -1; + + outlen = sizeof(out); + inlen = read; + compress2((uint8_t*)out, &outlen, (uint8_t*)in, inlen, 9); + + memcpy(outpkt.data, out, MIN(outlen, sizeof(outpkt.data))); + outpkt.sentlen = 0; + outpkt.offset = 0; + outpkt.len = outlen; + outpkt.seqno++; + outpkt.fragment = 0; + + if (conn == CONN_DNS_NULL) { + send_chunk(dns_fd); + } else { + send_raw_data(dns_fd); + } + + return read; +} + +static int +tunnel_dns(int tun_fd, int dns_fd) +{ + unsigned long datalen; + char buf[64*1024]; + size_t read; + + if ((read = read_dns(dns_fd, tun_fd, buf, sizeof(buf))) <= 2) + return -1; + + if (downstream_seqno != inpkt.seqno) { + /* New packet */ + inpkt.seqno = downstream_seqno; + inpkt.fragment = downstream_fragment; + inpkt.len = 0; + } else if (downstream_fragment <= inpkt.fragment) { + /* Duplicate fragment */ + return -1; + } + inpkt.fragment = downstream_fragment; + + datalen = MIN(read - 2, sizeof(inpkt.data) - inpkt.len); + + /* Skip 2 byte data header and append to packet */ + memcpy(&inpkt.data[inpkt.len], &buf[2], datalen); + inpkt.len += datalen; + + if (buf[1] & 1) { /* If last fragment flag is set */ + /* Uncompress packet and send to tun */ + datalen = sizeof(buf); + if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) inpkt.data, inpkt.len) == Z_OK) { + write_tun(tun_fd, buf, datalen); + } + inpkt.len = 0; + } + + /* If we have nothing to send, send a ping to get more data */ + if (!is_sending()) + send_ping(dns_fd); + + return read; +} + +int +client_tunnel(int tun_fd, int dns_fd) +{ + struct timeval tv; + fd_set fds; + int rv; + int i; + int seconds; + + rv = 0; + seconds = 0; + + while (running) { + tv.tv_sec = 1; + tv.tv_usec = 0; + + + FD_ZERO(&fds); + if ((!is_sending()) || conn == CONN_RAW_UDP) { + FD_SET(tun_fd, &fds); + } + FD_SET(dns_fd, &fds); + + i = select(MAX(tun_fd, dns_fd) + 1, &fds, NULL, NULL, &tv); + + if (running == 0) + break; + + if (i < 0) + err(1, "select"); + + if (i == 0) { /* timeout */ + seconds++; + } else { + if (FD_ISSET(tun_fd, &fds)) { + seconds = 0; + if (tunnel_tun(tun_fd, dns_fd) <= 0) + continue; + } + if (FD_ISSET(dns_fd, &fds)) { + if (tunnel_dns(tun_fd, dns_fd) <= 0) + continue; + } + } + + if (PING_TIMEOUT(seconds)) { + send_ping(dns_fd); + seconds = 0; + } + } + + return rv; +} + +static void +send_login(int fd, char *login, int len) +{ + char data[19]; + + memset(data, 0, sizeof(data)); + data[0] = userid; + memcpy(&data[1], login, MIN(len, 16)); + + data[17] = (rand_seed >> 8) & 0xff; + data[18] = (rand_seed >> 0) & 0xff; + + rand_seed++; + + send_packet(fd, 'L', data, sizeof(data)); +} + +static void +send_fragsize_probe(int fd, int fragsize) +{ + char probedata[256]; + char buf[4096]; + + /* build a large query domain which is random and maximum size */ + memset(probedata, MIN(1, rand_seed & 0xff), sizeof(probedata)); + probedata[1] = MIN(1, (rand_seed >> 8) & 0xff); + rand_seed++; + build_hostname(buf + 4, sizeof(buf) - 4, probedata, sizeof(probedata), topdomain, dataenc); + + fragsize &= 2047; + + buf[0] = 'r'; /* Probe downstream fragsize packet */ + buf[1] = b32_5to8((userid << 1) | ((fragsize >> 10) & 1)); + buf[2] = b32_5to8((fragsize >> 5) & 31); + buf[3] = b32_5to8(fragsize & 31); + + send_query(fd, buf); +} + +static void +send_set_downstream_fragsize(int fd, int fragsize) +{ + char data[5]; + + data[0] = userid; + data[1] = (fragsize & 0xff00) >> 8; + data[2] = (fragsize & 0x00ff); + data[3] = (rand_seed >> 8) & 0xff; + data[4] = (rand_seed >> 0) & 0xff; + + rand_seed++; + + send_packet(fd, 'N', data, sizeof(data)); +} + +static void +send_version(int fd, uint32_t version) +{ + char data[6]; + + data[0] = (version >> 24) & 0xff; + data[1] = (version >> 16) & 0xff; + data[2] = (version >> 8) & 0xff; + data[3] = (version >> 0) & 0xff; + + data[4] = (rand_seed >> 8) & 0xff; + data[5] = (rand_seed >> 0) & 0xff; + + rand_seed++; + + send_packet(fd, 'V', data, sizeof(data)); +} + +static void +send_ip_request(int fd, int userid) +{ + char buf[512] = "I____."; + buf[1] = b32_5to8(userid); + + buf[2] = b32_5to8((rand_seed >> 10) & 0x1f); + buf[3] = b32_5to8((rand_seed >> 5) & 0x1f); + buf[4] = b32_5to8((rand_seed ) & 0x1f); + rand_seed++; + + strncat(buf, topdomain, 512 - strlen(buf)); + send_query(fd, buf); +} + +static void +send_raw_udp_login(int dns_fd, int userid, int seed) +{ + char buf[16]; + login_calculate(buf, 16, password, seed + 1); + + send_raw(dns_fd, buf, sizeof(buf), userid, RAW_HDR_CMD_LOGIN); +} + +static void +send_case_check(int fd) +{ + /* The '+' plus character is not allowed according to RFC. + * Expect to get SERVFAIL or similar if it is rejected. + */ + char buf[512] = "zZ+-aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyY1234."; + + strncat(buf, topdomain, 512 - strlen(buf)); + send_query(fd, buf); +} + +static void +send_codec_switch(int fd, int userid, int bits) +{ + char buf[512] = "S_____."; + buf[1] = b32_5to8(userid); + buf[2] = b32_5to8(bits); + + buf[3] = b32_5to8((rand_seed >> 10) & 0x1f); + buf[4] = b32_5to8((rand_seed >> 5) & 0x1f); + buf[5] = b32_5to8((rand_seed ) & 0x1f); + rand_seed++; + + strncat(buf, topdomain, 512 - strlen(buf)); + send_query(fd, buf); +} + +static int +handshake_version(int dns_fd, int *seed) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + uint32_t payload; + int i; + int r; + int read; + + for (i = 0; running && i < 5; i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_version(dns_fd, VERSION); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if(read <= 0) { + if (read == 0) { + warn("handshake read"); + } + /* if read < 0 then warning has been printed already */ + continue; + } + + if (read >= 9) { + payload = (((in[4] & 0xff) << 24) | + ((in[5] & 0xff) << 16) | + ((in[6] & 0xff) << 8) | + ((in[7] & 0xff))); + + if (strncmp("VACK", in, 4) == 0) { + *seed = payload; + userid = in[8]; + + fprintf(stderr, "Version ok, both using protocol v 0x%08x. You are user #%d\n", VERSION, userid); + return 0; + } else if (strncmp("VNAK", in, 4) == 0) { + warnx("You use protocol v 0x%08x, server uses v 0x%08x. Giving up", + VERSION, payload); + return 1; + } else if (strncmp("VFUL", in, 4) == 0) { + warnx("Server full, all %d slots are taken. Try again later", payload); + return 1; + } + } else + warnx("did not receive proper login challenge"); + } + + fprintf(stderr, "Retrying version check...\n"); + } + warnx("couldn't connect to server"); + return 1; +} + +static int +handshake_login(int dns_fd, int seed) +{ + struct timeval tv; + char in[4096]; + char login[16]; + char server[65]; + char client[65]; + int mtu; + fd_set fds; + int i; + int r; + int read; + + login_calculate(login, 16, password, seed); + + for (i=0; running && i<5 ;i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_login(dns_fd, login, 16); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if(read <= 0) { + warn("read"); + continue; + } + + if (read > 0) { + int netmask; + if (strncmp("LNAK", in, 4) == 0) { + fprintf(stderr, "Bad password\n"); + return 1; + } else if (sscanf(in, "%64[^-]-%64[^-]-%d-%d", + server, client, &mtu, &netmask) == 4) { + + server[64] = 0; + client[64] = 0; + if (tun_setip(client, netmask) == 0 && + tun_setmtu(mtu) == 0) { + return 0; + } else { + errx(4, "Failed to set IP and MTU"); + } + } else { + fprintf(stderr, "Received bad handshake\n"); + } + } + } + + fprintf(stderr, "Retrying login...\n"); + } + warnx("couldn't login to server"); + return 1; +} + +static int +handshake_raw_udp(int dns_fd, int seed) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int len; + unsigned remoteaddr = 0; + struct in_addr server; + + fprintf(stderr, "Testing raw UDP data to the server (skip with -r)\n"); + for (i=0; running && i<3 ;i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_ip_request(dns_fd, userid); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + len = read_dns(dns_fd, 0, in, sizeof(in)); + if (len == 5 && in[0] == 'I') { + /* Received IP address */ + remoteaddr = (in[1] & 0xff); + remoteaddr <<= 8; + remoteaddr |= (in[2] & 0xff); + remoteaddr <<= 8; + remoteaddr |= (in[3] & 0xff); + remoteaddr <<= 8; + remoteaddr |= (in[4] & 0xff); + server.s_addr = ntohl(remoteaddr); + break; + } + } else { + fprintf(stderr, "."); + fflush(stderr); + } + } + + if (!remoteaddr) { + fprintf(stderr, "Failed to get raw server IP, will use DNS mode.\n"); + return 0; + } + fprintf(stderr, "Server is at %s, trying raw login: ", inet_ntoa(server)); + fflush(stderr); + + /* Store address to iodined server */ + memset(&raw_serv, 0, sizeof(raw_serv)); + raw_serv.sin_family = AF_INET; + raw_serv.sin_port = htons(53); + raw_serv.sin_addr = server; + + /* do login against port 53 on remote server + * based on the old seed. If reply received, + * switch to raw udp mode */ + for (i=0; running && i<4 ;i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_raw_udp_login(dns_fd, userid, seed); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + /* recv() needed for windows, dont change to read() */ + len = recv(dns_fd, in, sizeof(in), 0); + if (len >= (16 + RAW_HDR_LEN)) { + char hash[16]; + login_calculate(hash, 16, password, seed - 1); + if (memcmp(in, raw_header, RAW_HDR_IDENT_LEN) == 0 + && RAW_HDR_GET_CMD(in) == RAW_HDR_CMD_LOGIN + && memcmp(&in[RAW_HDR_LEN], hash, sizeof(hash)) == 0) { + + fprintf(stderr, "OK\n"); + return 1; + } + } + } + fprintf(stderr, "."); + fflush(stderr); + } + + fprintf(stderr, "failed\n"); + return 0; +} + +static int +handshake_case_check(int dns_fd) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + int case_preserved; + + case_preserved = 0; + for (i=0; running && i<5 ;i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_case_check(dns_fd); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if (read > 0) { + if (in[0] == 'z' || in[0] == 'Z') { + if (read < (27 * 2)) { + fprintf(stderr, "Received short case check reply. Will use base32 encoder\n"); + return case_preserved; + } else { + int k; + + /* TODO enhance this, base128 is probably also possible */ + case_preserved = 1; + for (k = 0; k < 27 && case_preserved; k += 2) { + if (in[k] == in[k+1]) { + /* test string: zZ+-aAbBcCdDeE... */ + case_preserved = 0; + } + } + return case_preserved; + } + } else { + fprintf(stderr, "Received bad case check reply\n"); + } + } else { + fprintf(stderr, "Got error on case check, will use base32\n"); + return case_preserved; + } + } + + fprintf(stderr, "Retrying case check...\n"); + } + + fprintf(stderr, "No reply on case check, continuing\n"); + return case_preserved; +} + +static void +handshake_switch_codec(int dns_fd) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + + dataenc = get_base64_encoder(); + fprintf(stderr, "Switching to %s codec\n", dataenc->name); + /* Send to server that this user will use base64 from now on */ + for (i=0; running && i<5 ;i++) { + int bits; + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + bits = 6; /* base64 = 6 bits per byte */ + + send_codec_switch(dns_fd, userid, bits); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if (read > 0) { + if (strncmp("BADLEN", in, 6) == 0) { + fprintf(stderr, "Server got bad message length. "); + goto codec_revert; + } else if (strncmp("BADIP", in, 5) == 0) { + fprintf(stderr, "Server rejected sender IP address. "); + goto codec_revert; + } else if (strncmp("BADCODEC", in, 8) == 0) { + fprintf(stderr, "Server rejected the selected codec. "); + goto codec_revert; + } + in[read] = 0; /* zero terminate */ + fprintf(stderr, "Server switched to codec %s\n", in); + return; + } + } + fprintf(stderr, "Retrying codec switch...\n"); + } + fprintf(stderr, "No reply from server on codec switch. "); + +codec_revert: + fprintf(stderr, "Falling back to base32\n"); + dataenc = get_base32_encoder(); +} + +static int +handshake_autoprobe_fragsize(int dns_fd) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + int proposed_fragsize = 768; + int range = 768; + int max_fragsize = 0; + + max_fragsize = 0; + fprintf(stderr, "Autoprobing max downstream fragment size... (skip with -m fragsize)\n"); + while (running && range > 0 && (range >= 8 || !max_fragsize)) { + for (i=0; running && i<3 ;i++) { + tv.tv_sec = 1; + tv.tv_usec = 0; + send_fragsize_probe(dns_fd, proposed_fragsize); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if (read > 0) { + /* We got a reply */ + int acked_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); + if (acked_fragsize == proposed_fragsize) { + if (read == proposed_fragsize) { + fprintf(stderr, "%d ok.. ", acked_fragsize); + fflush(stderr); + max_fragsize = acked_fragsize; + } + } + if (strncmp("BADIP", in, 5) == 0) { + fprintf(stderr, "got BADIP.. "); + fflush(stderr); + } + break; + } + } + fprintf(stderr, "."); + fflush(stderr); + } + range >>= 1; + if (max_fragsize == proposed_fragsize) { + /* Try bigger */ + proposed_fragsize += range; + } else { + /* Try smaller */ + fprintf(stderr, "%d not ok.. ", proposed_fragsize); + fflush(stderr); + proposed_fragsize -= range; + } + } + if (!running) { + fprintf(stderr, "\n"); + warnx("stopped while autodetecting fragment size (Try probing manually with -m)"); + return 0; + } + if (range == 0) { + /* Tried all the way down to 2 and found no good size */ + fprintf(stderr, "\n"); + warnx("found no accepted fragment size. (Try probing manually with -m)"); + return 0; + } + fprintf(stderr, "will use %d\n", max_fragsize); + return max_fragsize; +} + +static void +handshake_set_fragsize(int dns_fd, int fragsize) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + + fprintf(stderr, "Setting downstream fragment size to max %d...\n", fragsize); + for (i=0; running && i<5 ;i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_set_downstream_fragsize(dns_fd, fragsize); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if (read > 0) { + int accepted_fragsize; + + if (strncmp("BADFRAG", in, 7) == 0) { + fprintf(stderr, "Server rejected fragsize. Keeping default."); + return; + } else if (strncmp("BADIP", in, 5) == 0) { + fprintf(stderr, "Server rejected sender IP address.\n"); + return; + } + + accepted_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); + return; + } + } + fprintf(stderr, "Retrying set fragsize...\n"); + } + fprintf(stderr, "No reply from server when setting fragsize. Keeping default.\n"); +} + +int +client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize) +{ + int seed; + int case_preserved; + int r; + + r = handshake_version(dns_fd, &seed); + if (r) { + return r; + } + + r = handshake_login(dns_fd, seed); + if (r) { + return r; + } + + if (raw_mode && handshake_raw_udp(dns_fd, seed)) { + conn = CONN_RAW_UDP; + } else { + if (raw_mode == 0) { + fprintf(stderr, "Skipping raw mode\n"); + } + case_preserved = handshake_case_check(dns_fd); + + if (case_preserved) { + handshake_switch_codec(dns_fd); + } + + if (autodetect_frag_size) { + fragsize = handshake_autoprobe_fragsize(dns_fd); + if (!fragsize) { + return 1; + } + } + + handshake_set_fragsize(dns_fd, fragsize); + } + + return 0; +} + diff --git a/src/client.h b/src/client.h new file mode 100644 index 0000000..0df4d3d --- /dev/null +++ b/src/client.h @@ -0,0 +1,33 @@ +/* + * Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef __CLIENT_H__ +#define __CLIENT_H__ + +void client_init(); +void client_stop(); + +enum connection client_get_conn(); +const char *client_get_raw_addr(); + +void client_set_nameserver(const char *cp); +void client_set_topdomain(const char *cp); +void client_set_password(const char *cp); + +int client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize); +int client_tunnel(int tun_fd, int dns_fd); + +#endif diff --git a/src/iodine.c b/src/iodine.c index da0aa79..d40c338 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -24,82 +24,26 @@ #include #include #include -#include #include #ifdef WINDOWS32 #include "windows.h" #include #else -#include -#ifdef DARWIN -#include -#endif -#include -#include -#include -#include #include #include -#include #endif #include "common.h" -#include "encoding.h" -#include "base32.h" -#include "base64.h" -#include "dns.h" -#include "login.h" #include "tun.h" -#include "version.h" +#include "client.h" +#include "util.h" #ifdef WINDOWS32 WORD req_version = MAKEWORD(2, 2); WSADATA wsa_data; #endif -#define PING_TIMEOUT(t) ((t) >= (conn == CONN_DNS_NULL ? 1 : 20)) - -static void send_ping(int fd); -static void send_chunk(int fd); -static void send_raw_data(int fd); -static int build_hostname(char *buf, size_t buflen, - const char *data, const size_t datalen, - const char *topdomain, struct encoder *encoder); - -static int running = 1; -static char password[33]; - -static struct sockaddr_in nameserv; -static struct sockaddr_in raw_serv; -static char *topdomain; - -static uint16_t rand_seed; -static int downstream_seqno; -static int downstream_fragment; -static int down_ack_seqno; -static int down_ack_fragment; - -/* Current up/downstream IP packet */ -static struct packet outpkt; -static struct packet inpkt; - -/* My userid at the server */ -static char userid; - -/* DNS id for next packet */ -static uint16_t chunkid; - -/* Base32 encoder used for non-data packets */ -static struct encoder *b32; - -/* The encoder used for data packets - * Defaults to Base32, can be changed after handshake */ -static struct encoder *dataenc; - -/* My connection mode */ -static enum connection conn; - #if !defined(BSD) && !defined(__GLIBC__) static char *__progname; #endif @@ -107,1050 +51,7 @@ static char *__progname; static void sighandler(int sig) { - running = 0; -} - -static void -send_query(int fd, char *hostname) -{ - char packet[4096]; - struct query q; - size_t len; - - q.id = ++chunkid; - q.type = T_NULL; - - len = dns_encode(packet, sizeof(packet), &q, QR_QUERY, hostname, strlen(hostname)); - - sendto(fd, packet, len, 0, (struct sockaddr*)&nameserv, sizeof(nameserv)); -} - -static void -send_raw(int fd, char *buf, int buflen, int user, int cmd) -{ - char packet[4096]; - int len; - - len = MIN(sizeof(packet) - RAW_HDR_LEN, buflen); - - memcpy(packet, raw_header, RAW_HDR_LEN); - if (len) { - memcpy(&packet[RAW_HDR_LEN], buf, len); - } - - len += RAW_HDR_LEN; - packet[RAW_HDR_CMD] = cmd | (user & 0x0F); - - sendto(fd, packet, len, 0, (struct sockaddr*)&raw_serv, sizeof(raw_serv)); -} - -static void -send_packet(int fd, char cmd, const char *data, const size_t datalen) -{ - char buf[4096]; - - buf[0] = cmd; - - build_hostname(buf + 1, sizeof(buf) - 1, data, datalen, topdomain, b32); - send_query(fd, buf); -} - -static int -build_hostname(char *buf, size_t buflen, - const char *data, const size_t datalen, - const char *topdomain, struct encoder *encoder) -{ - int encsize; - size_t space; - char *b; - - space = MIN(0xFF, buflen) - strlen(topdomain) - 7; - if (!encoder->places_dots()) - space -= (space / 57); /* space for dots */ - - memset(buf, 0, buflen); - - encsize = encoder->encode(buf, &space, data, datalen); - - if (!encoder->places_dots()) - inline_dotify(buf, buflen); - - b = buf; - b += strlen(buf); - - if (*b != '.') - *b++ = '.'; - - strncpy(b, topdomain, strlen(topdomain)+1); - - return space; -} - -static int -is_sending() -{ - return (outpkt.len != 0); -} - -static int -read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed for raw handling */ -{ - struct sockaddr_in from; - char data[64*1024]; - socklen_t addrlen; - struct query q; - int r; - - addrlen = sizeof(struct sockaddr); - if ((r = recvfrom(dns_fd, data, sizeof(data), 0, - (struct sockaddr*)&from, &addrlen)) == -1) { - warn("recvfrom"); - return 0; - } - - if (conn == CONN_DNS_NULL) { - int rv; - - rv = dns_decode(buf, buflen, &q, QR_ANSWER, data, r); - - /* decode the data header, update seqno and frag before next request */ - if (rv >= 2) { - downstream_seqno = (buf[1] >> 5) & 7; - downstream_fragment = (buf[1] >> 1) & 15; - } - - - if (is_sending()) { - if (chunkid == q.id) { - /* Got ACK on sent packet */ - outpkt.offset += outpkt.sentlen; - if (outpkt.offset == outpkt.len) { - /* Packet completed */ - outpkt.offset = 0; - outpkt.len = 0; - outpkt.sentlen = 0; - - /* If the ack contains unacked frag number but no data, - * send a ping to ack the frag number and get more data*/ - if (rv == 2 && ( - downstream_seqno != down_ack_seqno || - downstream_fragment != down_ack_fragment - )) { - - send_ping(dns_fd); - } - } else { - /* More to send */ - send_chunk(dns_fd); - } - } - } - return rv; - } else { /* CONN_RAW_UDP */ - unsigned long datalen; - char buf[64*1024]; - - /* minimum length */ - if (r < RAW_HDR_LEN) return 0; - /* should start with header */ - if (memcmp(data, raw_header, RAW_HDR_IDENT_LEN)) return 0; - /* should be data packet */ - if (RAW_HDR_GET_CMD(data) != RAW_HDR_CMD_DATA) return 0; - /* should be my user id */ - if (RAW_HDR_GET_USR(data) != userid) return 0; - - r -= RAW_HDR_LEN; - datalen = sizeof(buf); - if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) &data[RAW_HDR_LEN], r) == Z_OK) { - write_tun(tun_fd, buf, datalen); - } - return 0; - } -} - - -static int -tunnel_tun(int tun_fd, int dns_fd) -{ - unsigned long outlen; - unsigned long inlen; - char out[64*1024]; - char in[64*1024]; - ssize_t read; - - if ((read = read_tun(tun_fd, in, sizeof(in))) <= 0) - return -1; - - outlen = sizeof(out); - inlen = read; - compress2((uint8_t*)out, &outlen, (uint8_t*)in, inlen, 9); - - memcpy(outpkt.data, out, MIN(outlen, sizeof(outpkt.data))); - outpkt.sentlen = 0; - outpkt.offset = 0; - outpkt.len = outlen; - outpkt.seqno++; - outpkt.fragment = 0; - - if (conn == CONN_DNS_NULL) { - send_chunk(dns_fd); - } else { - send_raw_data(dns_fd); - } - - return read; -} - -static int -tunnel_dns(int tun_fd, int dns_fd) -{ - unsigned long datalen; - char buf[64*1024]; - size_t read; - - if ((read = read_dns(dns_fd, tun_fd, buf, sizeof(buf))) <= 2) - return -1; - - if (downstream_seqno != inpkt.seqno) { - /* New packet */ - inpkt.seqno = downstream_seqno; - inpkt.fragment = downstream_fragment; - inpkt.len = 0; - } else if (downstream_fragment <= inpkt.fragment) { - /* Duplicate fragment */ - return -1; - } - inpkt.fragment = downstream_fragment; - - datalen = MIN(read - 2, sizeof(inpkt.data) - inpkt.len); - - /* Skip 2 byte data header and append to packet */ - memcpy(&inpkt.data[inpkt.len], &buf[2], datalen); - inpkt.len += datalen; - - if (buf[1] & 1) { /* If last fragment flag is set */ - /* Uncompress packet and send to tun */ - datalen = sizeof(buf); - if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) inpkt.data, inpkt.len) == Z_OK) { - write_tun(tun_fd, buf, datalen); - } - inpkt.len = 0; - } - - /* If we have nothing to send, send a ping to get more data */ - if (!is_sending()) - send_ping(dns_fd); - - return read; -} - -static int -tunnel(int tun_fd, int dns_fd) -{ - struct timeval tv; - fd_set fds; - int rv; - int i; - int seconds; - - rv = 0; - seconds = 0; - - while (running) { - tv.tv_sec = 1; - tv.tv_usec = 0; - - - FD_ZERO(&fds); - if ((!is_sending()) || conn == CONN_RAW_UDP) { - FD_SET(tun_fd, &fds); - } - FD_SET(dns_fd, &fds); - - i = select(MAX(tun_fd, dns_fd) + 1, &fds, NULL, NULL, &tv); - - if (running == 0) - break; - - if (i < 0) - err(1, "select"); - - if (i == 0) { /* timeout */ - seconds++; - } else { - if (FD_ISSET(tun_fd, &fds)) { - seconds = 0; - if (tunnel_tun(tun_fd, dns_fd) <= 0) - continue; - } - if (FD_ISSET(dns_fd, &fds)) { - if (tunnel_dns(tun_fd, dns_fd) <= 0) - continue; - } - } - - if (PING_TIMEOUT(seconds)) { - send_ping(dns_fd); - seconds = 0; - } - } - - return rv; -} - -static void -send_raw_data(int dns_fd) -{ - send_raw(dns_fd, outpkt.data, outpkt.len, userid, RAW_HDR_CMD_DATA); -} - -static void -send_chunk(int fd) -{ - char hex[] = "0123456789ABCDEF"; - char buf[4096]; - int avail; - int code; - char *p; - - p = outpkt.data; - p += outpkt.offset; - avail = outpkt.len - outpkt.offset; - - outpkt.sentlen = build_hostname(buf + 4, sizeof(buf) - 4, p, avail, topdomain, dataenc); - - /* Build upstream data header (see doc/proto_xxxxxxxx.txt) */ - - buf[0] = hex[userid & 15]; /* First byte is 4 bits userid */ - - code = ((outpkt.seqno & 7) << 2) | ((outpkt.fragment & 15) >> 2); - buf[1] = b32_5to8(code); /* Second byte is 3 bits seqno, 2 upper bits fragment count */ - - code = ((outpkt.fragment & 3) << 3) | (downstream_seqno & 7); - buf[2] = b32_5to8(code); /* Third byte is 2 bits lower fragment count, 3 bits downstream packet seqno */ - - code = ((downstream_fragment & 15) << 1) | (outpkt.sentlen == avail); - buf[3] = b32_5to8(code); /* Fourth byte is 4 bits downstream fragment count, 1 bit last frag flag */ - - down_ack_seqno = downstream_seqno; - down_ack_fragment = downstream_fragment; - - outpkt.fragment++; - send_query(fd, buf); -} - -static void -send_login(int fd, char *login, int len) -{ - char data[19]; - - memset(data, 0, sizeof(data)); - data[0] = userid; - memcpy(&data[1], login, MIN(len, 16)); - - data[17] = (rand_seed >> 8) & 0xff; - data[18] = (rand_seed >> 0) & 0xff; - - rand_seed++; - - send_packet(fd, 'L', data, sizeof(data)); -} - -static void -send_ping(int fd) -{ - if (conn == CONN_DNS_NULL) { - char data[4]; - - if (is_sending()) { - outpkt.sentlen = 0; - outpkt.offset = 0; - outpkt.len = 0; - } - - data[0] = userid; - data[1] = ((downstream_seqno & 7) << 4) | (downstream_fragment & 15); - data[2] = (rand_seed >> 8) & 0xff; - data[3] = (rand_seed >> 0) & 0xff; - - down_ack_seqno = downstream_seqno; - down_ack_fragment = downstream_fragment; - - rand_seed++; - - send_packet(fd, 'P', data, sizeof(data)); - } else { - send_raw(fd, NULL, 0, userid, RAW_HDR_CMD_PING); - } -} - -static void -send_fragsize_probe(int fd, int fragsize) -{ - char probedata[256]; - char buf[4096]; - - /* build a large query domain which is random and maximum size */ - memset(probedata, MIN(1, rand_seed & 0xff), sizeof(probedata)); - probedata[1] = MIN(1, (rand_seed >> 8) & 0xff); - rand_seed++; - build_hostname(buf + 4, sizeof(buf) - 4, probedata, sizeof(probedata), topdomain, dataenc); - - fragsize &= 2047; - - buf[0] = 'r'; /* Probe downstream fragsize packet */ - buf[1] = b32_5to8((userid << 1) | ((fragsize >> 10) & 1)); - buf[2] = b32_5to8((fragsize >> 5) & 31); - buf[3] = b32_5to8(fragsize & 31); - - send_query(fd, buf); -} - -static void -send_set_downstream_fragsize(int fd, int fragsize) -{ - char data[5]; - - data[0] = userid; - data[1] = (fragsize & 0xff00) >> 8; - data[2] = (fragsize & 0x00ff); - data[3] = (rand_seed >> 8) & 0xff; - data[4] = (rand_seed >> 0) & 0xff; - - rand_seed++; - - send_packet(fd, 'N', data, sizeof(data)); -} - -static void -send_version(int fd, uint32_t version) -{ - char data[6]; - - data[0] = (version >> 24) & 0xff; - data[1] = (version >> 16) & 0xff; - data[2] = (version >> 8) & 0xff; - data[3] = (version >> 0) & 0xff; - - data[4] = (rand_seed >> 8) & 0xff; - data[5] = (rand_seed >> 0) & 0xff; - - rand_seed++; - - send_packet(fd, 'V', data, sizeof(data)); -} - -static void -send_ip_request(int fd, int userid) -{ - char buf[512] = "I____."; - buf[1] = b32_5to8(userid); - - buf[2] = b32_5to8((rand_seed >> 10) & 0x1f); - buf[3] = b32_5to8((rand_seed >> 5) & 0x1f); - buf[4] = b32_5to8((rand_seed ) & 0x1f); - rand_seed++; - - strncat(buf, topdomain, 512 - strlen(buf)); - send_query(fd, buf); -} - -static void -send_raw_udp_login(int dns_fd, int userid, int seed) -{ - char buf[16]; - login_calculate(buf, 16, password, seed + 1); - - send_raw(dns_fd, buf, sizeof(buf), userid, RAW_HDR_CMD_LOGIN); -} - -static void -send_case_check(int fd) -{ - /* The '+' plus character is not allowed according to RFC. - * Expect to get SERVFAIL or similar if it is rejected. - */ - char buf[512] = "zZ+-aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyY1234."; - - strncat(buf, topdomain, 512 - strlen(buf)); - send_query(fd, buf); -} - -static void -send_codec_switch(int fd, int userid, int bits) -{ - char buf[512] = "S_____."; - buf[1] = b32_5to8(userid); - buf[2] = b32_5to8(bits); - - buf[3] = b32_5to8((rand_seed >> 10) & 0x1f); - buf[4] = b32_5to8((rand_seed >> 5) & 0x1f); - buf[5] = b32_5to8((rand_seed ) & 0x1f); - rand_seed++; - - strncat(buf, topdomain, 512 - strlen(buf)); - send_query(fd, buf); -} - -static int -handshake_version(int dns_fd, int *seed) -{ - struct timeval tv; - char in[4096]; - fd_set fds; - uint32_t payload; - int i; - int r; - int read; - - for (i = 0; running && i < 5; i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - send_version(dns_fd, VERSION); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if(read <= 0) { - if (read == 0) { - warn("handshake read"); - } - /* if read < 0 then warning has been printed already */ - continue; - } - - if (read >= 9) { - payload = (((in[4] & 0xff) << 24) | - ((in[5] & 0xff) << 16) | - ((in[6] & 0xff) << 8) | - ((in[7] & 0xff))); - - if (strncmp("VACK", in, 4) == 0) { - *seed = payload; - userid = in[8]; - - fprintf(stderr, "Version ok, both using protocol v 0x%08x. You are user #%d\n", VERSION, userid); - return 0; - } else if (strncmp("VNAK", in, 4) == 0) { - warnx("You use protocol v 0x%08x, server uses v 0x%08x. Giving up", - VERSION, payload); - return 1; - } else if (strncmp("VFUL", in, 4) == 0) { - warnx("Server full, all %d slots are taken. Try again later", payload); - return 1; - } - } else - warnx("did not receive proper login challenge"); - } - - fprintf(stderr, "Retrying version check...\n"); - } - warnx("couldn't connect to server"); - return 1; -} - -static int -handshake_login(int dns_fd, int seed) -{ - struct timeval tv; - char in[4096]; - char login[16]; - char server[65]; - char client[65]; - int mtu; - fd_set fds; - int i; - int r; - int read; - - login_calculate(login, 16, password, seed); - - for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - send_login(dns_fd, login, 16); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if(read <= 0) { - warn("read"); - continue; - } - - if (read > 0) { - int netmask; - if (strncmp("LNAK", in, 4) == 0) { - fprintf(stderr, "Bad password\n"); - return 1; - } else if (sscanf(in, "%64[^-]-%64[^-]-%d-%d", - server, client, &mtu, &netmask) == 4) { - - server[64] = 0; - client[64] = 0; - if (tun_setip(client, netmask) == 0 && - tun_setmtu(mtu) == 0) { - return 0; - } else { - errx(4, "Failed to set IP and MTU"); - } - } else { - fprintf(stderr, "Received bad handshake\n"); - } - } - } - - fprintf(stderr, "Retrying login...\n"); - } - warnx("couldn't login to server"); - return 1; -} - -static int -handshake_raw_udp(int dns_fd, int seed) -{ - struct timeval tv; - char in[4096]; - fd_set fds; - int i; - int r; - int len; - unsigned remoteaddr = 0; - struct in_addr server; - - fprintf(stderr, "Testing raw UDP data to the server (skip with -r)\n"); - for (i=0; running && i<3 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - send_ip_request(dns_fd, userid); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - len = read_dns(dns_fd, 0, in, sizeof(in)); - if (len == 5 && in[0] == 'I') { - /* Received IP address */ - remoteaddr = (in[1] & 0xff); - remoteaddr <<= 8; - remoteaddr |= (in[2] & 0xff); - remoteaddr <<= 8; - remoteaddr |= (in[3] & 0xff); - remoteaddr <<= 8; - remoteaddr |= (in[4] & 0xff); - server.s_addr = ntohl(remoteaddr); - break; - } - } else { - fprintf(stderr, "."); - fflush(stderr); - } - } - - if (!remoteaddr) { - fprintf(stderr, "Failed to get raw server IP, will use DNS mode.\n"); - return 0; - } - fprintf(stderr, "Server is at %s, trying raw login: ", inet_ntoa(server)); - fflush(stderr); - - /* Store address to iodined server */ - memset(&raw_serv, 0, sizeof(raw_serv)); - raw_serv.sin_family = AF_INET; - raw_serv.sin_port = htons(53); - raw_serv.sin_addr = server; - - /* do login against port 53 on remote server - * based on the old seed. If reply received, - * switch to raw udp mode */ - for (i=0; running && i<4 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - send_raw_udp_login(dns_fd, userid, seed); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - /* recv() needed for windows, dont change to read() */ - len = recv(dns_fd, in, sizeof(in), 0); - if (len >= (16 + RAW_HDR_LEN)) { - char hash[16]; - login_calculate(hash, 16, password, seed - 1); - if (memcmp(in, raw_header, RAW_HDR_IDENT_LEN) == 0 - && RAW_HDR_GET_CMD(in) == RAW_HDR_CMD_LOGIN - && memcmp(&in[RAW_HDR_LEN], hash, sizeof(hash)) == 0) { - - fprintf(stderr, "OK\n"); - return 1; - } - } - } - fprintf(stderr, "."); - fflush(stderr); - } - - fprintf(stderr, "failed\n"); - return 0; -} - -static int -handshake_case_check(int dns_fd) -{ - struct timeval tv; - char in[4096]; - fd_set fds; - int i; - int r; - int read; - int case_preserved; - - case_preserved = 0; - for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - send_case_check(dns_fd); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if (read > 0) { - if (in[0] == 'z' || in[0] == 'Z') { - if (read < (27 * 2)) { - fprintf(stderr, "Received short case check reply. Will use base32 encoder\n"); - return case_preserved; - } else { - int k; - - /* TODO enhance this, base128 is probably also possible */ - case_preserved = 1; - for (k = 0; k < 27 && case_preserved; k += 2) { - if (in[k] == in[k+1]) { - /* test string: zZ+-aAbBcCdDeE... */ - case_preserved = 0; - } - } - return case_preserved; - } - } else { - fprintf(stderr, "Received bad case check reply\n"); - } - } else { - fprintf(stderr, "Got error on case check, will use base32\n"); - return case_preserved; - } - } - - fprintf(stderr, "Retrying case check...\n"); - } - - fprintf(stderr, "No reply on case check, continuing\n"); - return case_preserved; -} - -static void -handshake_switch_codec(int dns_fd) -{ - struct timeval tv; - char in[4096]; - fd_set fds; - int i; - int r; - int read; - - dataenc = get_base64_encoder(); - fprintf(stderr, "Switching to %s codec\n", dataenc->name); - /* Send to server that this user will use base64 from now on */ - for (i=0; running && i<5 ;i++) { - int bits; - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - bits = 6; /* base64 = 6 bits per byte */ - - send_codec_switch(dns_fd, userid, bits); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if (read > 0) { - if (strncmp("BADLEN", in, 6) == 0) { - fprintf(stderr, "Server got bad message length. "); - goto codec_revert; - } else if (strncmp("BADIP", in, 5) == 0) { - fprintf(stderr, "Server rejected sender IP address. "); - goto codec_revert; - } else if (strncmp("BADCODEC", in, 8) == 0) { - fprintf(stderr, "Server rejected the selected codec. "); - goto codec_revert; - } - in[read] = 0; /* zero terminate */ - fprintf(stderr, "Server switched to codec %s\n", in); - return; - } - } - fprintf(stderr, "Retrying codec switch...\n"); - } - fprintf(stderr, "No reply from server on codec switch. "); - -codec_revert: - fprintf(stderr, "Falling back to base32\n"); - dataenc = get_base32_encoder(); -} - -static int -handshake_autoprobe_fragsize(int dns_fd) -{ - struct timeval tv; - char in[4096]; - fd_set fds; - int i; - int r; - int read; - int proposed_fragsize = 768; - int range = 768; - int max_fragsize = 0; - - max_fragsize = 0; - fprintf(stderr, "Autoprobing max downstream fragment size... (skip with -m fragsize)\n"); - while (running && range > 0 && (range >= 8 || !max_fragsize)) { - for (i=0; running && i<3 ;i++) { - tv.tv_sec = 1; - tv.tv_usec = 0; - send_fragsize_probe(dns_fd, proposed_fragsize); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if (read > 0) { - /* We got a reply */ - int acked_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); - if (acked_fragsize == proposed_fragsize) { - if (read == proposed_fragsize) { - fprintf(stderr, "%d ok.. ", acked_fragsize); - fflush(stderr); - max_fragsize = acked_fragsize; - } - } - if (strncmp("BADIP", in, 5) == 0) { - fprintf(stderr, "got BADIP.. "); - fflush(stderr); - } - break; - } - } - fprintf(stderr, "."); - fflush(stderr); - } - range >>= 1; - if (max_fragsize == proposed_fragsize) { - /* Try bigger */ - proposed_fragsize += range; - } else { - /* Try smaller */ - fprintf(stderr, "%d not ok.. ", proposed_fragsize); - fflush(stderr); - proposed_fragsize -= range; - } - } - if (!running) { - fprintf(stderr, "\n"); - warnx("stopped while autodetecting fragment size (Try probing manually with -m)"); - return 0; - } - if (range == 0) { - /* Tried all the way down to 2 and found no good size */ - fprintf(stderr, "\n"); - warnx("found no accepted fragment size. (Try probing manually with -m)"); - return 0; - } - fprintf(stderr, "will use %d\n", max_fragsize); - return max_fragsize; -} - -static void -handshake_set_fragsize(int dns_fd, int fragsize) -{ - struct timeval tv; - char in[4096]; - fd_set fds; - int i; - int r; - int read; - - fprintf(stderr, "Setting downstream fragment size to max %d...\n", fragsize); - for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - send_set_downstream_fragsize(dns_fd, fragsize); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if (read > 0) { - int accepted_fragsize; - - if (strncmp("BADFRAG", in, 7) == 0) { - fprintf(stderr, "Server rejected fragsize. Keeping default."); - return; - } else if (strncmp("BADIP", in, 5) == 0) { - fprintf(stderr, "Server rejected sender IP address.\n"); - return; - } - - accepted_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); - return; - } - } - fprintf(stderr, "Retrying set fragsize...\n"); - } - fprintf(stderr, "No reply from server when setting fragsize. Keeping default.\n"); -} - -static int -handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize) -{ - int seed; - int case_preserved; - int r; - - r = handshake_version(dns_fd, &seed); - if (r) { - return r; - } - - r = handshake_login(dns_fd, seed); - if (r) { - return r; - } - - if (raw_mode && handshake_raw_udp(dns_fd, seed)) { - conn = CONN_RAW_UDP; - } else { - if (raw_mode == 0) { - fprintf(stderr, "Skipping raw mode\n"); - } - case_preserved = handshake_case_check(dns_fd); - - if (case_preserved) { - handshake_switch_codec(dns_fd); - } - - if (autodetect_frag_size) { - fragsize = handshake_autoprobe_fragsize(dns_fd); - if (!fragsize) { - return 1; - } - } - - handshake_set_fragsize(dns_fd, fragsize); - } - - return 0; -} - -static char * -get_resolvconf_addr() -{ - static char addr[16]; - char *rv; -#ifndef WINDOWS32 - char buf[80]; - FILE *fp; - - rv = NULL; - - if ((fp = fopen("/etc/resolv.conf", "r")) == NULL) - err(1, "/etc/resolve.conf"); - - while (feof(fp) == 0) { - fgets(buf, sizeof(buf), fp); - - if (sscanf(buf, "nameserver %15s", addr) == 1) { - rv = addr; - break; - } - } - - fclose(fp); -#else /* !WINDOWS32 */ - FIXED_INFO *fixed_info; - ULONG buflen; - DWORD ret; - - rv = NULL; - fixed_info = malloc(sizeof(FIXED_INFO)); - buflen = sizeof(FIXED_INFO); - - if (GetNetworkParams(fixed_info, &buflen) == ERROR_BUFFER_OVERFLOW) { - /* official ugly api workaround */ - free(fixed_info); - fixed_info = malloc(buflen); - } - - ret = GetNetworkParams(fixed_info, &buflen); - if (ret == NO_ERROR) { - strncpy(addr, fixed_info->DnsServerList.IpAddress.String, sizeof(addr)); - addr[15] = 0; - rv = addr; - } - free(fixed_info); -#endif - return rv; -} - -static void -set_nameserver(const char *cp) -{ - struct in_addr addr; - - if (inet_aton(cp, &addr) != 1) - errx(1, "error parsing nameserver address: '%s'", cp); - - memset(&nameserv, 0, sizeof(nameserv)); - nameserv.sin_family = AF_INET; - nameserv.sin_port = htons(53); - nameserv.sin_addr = addr; + client_stop(); } static void @@ -1204,10 +105,12 @@ int main(int argc, char **argv) { char *nameserv_addr; + char *topdomain; #ifndef WINDOWS32 struct passwd *pw; #endif char *username; + char password[33]; int foreground; char *newroot; char *context; @@ -1221,8 +124,8 @@ main(int argc, char **argv) int retval; int raw_mode; - memset(password, 0, 33); nameserv_addr = NULL; + topdomain = NULL; #ifndef WINDOWS32 pw = NULL; #endif @@ -1231,28 +134,19 @@ main(int argc, char **argv) newroot = NULL; context = NULL; device = NULL; - chunkid = 0; pidfile = NULL; - outpkt.seqno = 0; - inpkt.len = 0; - autodetect_frag_size = 1; max_downstream_frag_size = 3072; - raw_mode = 1; - - b32 = get_base32_encoder(); - dataenc = get_base32_encoder(); - conn = CONN_DNS_NULL; - retval = 0; + raw_mode = 1; #ifdef WINDOWS32 WSAStartup(req_version, &wsa_data); #endif srand((unsigned) time(NULL)); - rand_seed = rand(); + client_init(); #if !defined(BSD) && !defined(__GLIBC__) __progname = strrchr(argv[0], '/'); @@ -1335,7 +229,7 @@ main(int argc, char **argv) } if (nameserv_addr) { - set_nameserver(nameserv_addr); + client_set_nameserver(nameserv_addr); } else { usage(); /* NOTREACHED */ @@ -1353,6 +247,8 @@ main(int argc, char **argv) /* NOTREACHED */ } + client_set_topdomain(topdomain); + if (username != NULL) { #ifndef WINDOWS32 if ((pw = getpwnam(username)) == NULL) { @@ -1365,6 +261,8 @@ main(int argc, char **argv) if (strlen(password) == 0) read_password(password, sizeof(password)); + + client_set_password(password); if ((tun_fd = open_tun(device)) == -1) { retval = 1; @@ -1378,15 +276,15 @@ main(int argc, char **argv) signal(SIGINT, sighandler); signal(SIGTERM, sighandler); - if (handshake(dns_fd, raw_mode, autodetect_frag_size, max_downstream_frag_size)) { + if (client_handshake(dns_fd, raw_mode, autodetect_frag_size, max_downstream_frag_size)) { retval = 1; goto cleanup2; } - if (conn == CONN_DNS_NULL) { + if (client_get_conn() == CONN_DNS_NULL) { fprintf(stderr, "Sending queries for %s to %s\n", topdomain, nameserv_addr); } else { - fprintf(stderr, "Sending raw traffic directly to %s\n", inet_ntoa(raw_serv.sin_addr)); + fprintf(stderr, "Sending raw traffic directly to %s\n", client_get_raw_addr()); } if (foreground == 0) @@ -1413,12 +311,7 @@ main(int argc, char **argv) if (context != NULL) do_setcon(context); - downstream_seqno = 0; - downstream_fragment = 0; - down_ack_seqno = 0; - down_ack_fragment = 0; - - tunnel(tun_fd, dns_fd); + client_tunnel(tun_fd, dns_fd); cleanup2: close_dns(dns_fd); diff --git a/src/login.c b/src/login.c index cce0f31..c8827c3 100644 --- a/src/login.c +++ b/src/login.c @@ -29,7 +29,7 @@ * Needs a 16byte array for output, and 32 bytes password */ void -login_calculate(char *buf, int buflen, char *pass, int seed) +login_calculate(char *buf, int buflen, const char *pass, int seed) { unsigned char temp[32]; md5_state_t ctx; diff --git a/src/login.h b/src/login.h index df49074..840c920 100644 --- a/src/login.h +++ b/src/login.h @@ -17,7 +17,7 @@ #ifndef __LOGIN_H__ #define __LOGIN_H__ -void login_calculate(char *, int, char *, int); +void login_calculate(char *, int, const char *, int); #endif diff --git a/src/util.c b/src/util.c new file mode 100644 index 0000000..70ab90d --- /dev/null +++ b/src/util.c @@ -0,0 +1,69 @@ +/* + * Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include +#include "common.h" + +char * +get_resolvconf_addr() +{ + static char addr[16]; + char *rv; +#ifndef WINDOWS32 + char buf[80]; + FILE *fp; + + rv = NULL; + + if ((fp = fopen("/etc/resolv.conf", "r")) == NULL) + err(1, "/etc/resolve.conf"); + + while (feof(fp) == 0) { + fgets(buf, sizeof(buf), fp); + + if (sscanf(buf, "nameserver %15s", addr) == 1) { + rv = addr; + break; + } + } + + fclose(fp); +#else /* !WINDOWS32 */ + FIXED_INFO *fixed_info; + ULONG buflen; + DWORD ret; + + rv = NULL; + fixed_info = malloc(sizeof(FIXED_INFO)); + buflen = sizeof(FIXED_INFO); + + if (GetNetworkParams(fixed_info, &buflen) == ERROR_BUFFER_OVERFLOW) { + /* official ugly api workaround */ + free(fixed_info); + fixed_info = malloc(buflen); + } + + ret = GetNetworkParams(fixed_info, &buflen); + if (ret == NO_ERROR) { + strncpy(addr, fixed_info->DnsServerList.IpAddress.String, sizeof(addr)); + addr[15] = 0; + rv = addr; + } + free(fixed_info); +#endif + return rv; +} + diff --git a/src/util.h b/src/util.h new file mode 100644 index 0000000..f514139 --- /dev/null +++ b/src/util.h @@ -0,0 +1,6 @@ +#ifndef __UTIL_H__ +#define __UTIL_H__ + +char *get_resolvconf_addr(); + +#endif From f2293427820a5c8aeca2eb80d61e58d0e965c458 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 16 Aug 2009 12:33:28 +0000 Subject: [PATCH 02/49] Fix password reading --- src/iodine.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/iodine.c b/src/iodine.c index d40c338..c6e7797 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -130,6 +130,7 @@ main(int argc, char **argv) pw = NULL; #endif username = NULL; + memset(password, 0, 33); foreground = 0; newroot = NULL; context = NULL; From dfd74623a6de553d04b69c80320bd0efdc8b5813 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sat, 19 Sep 2009 08:09:12 +0000 Subject: [PATCH 03/49] #77, get password from env variable --- CHANGELOG | 2 ++ man/iodine.8 | 16 ++++++++++++++++ src/iodine.c | 10 ++++++++-- src/iodined.c | 10 ++++++++-- 4 files changed, 34 insertions(+), 4 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 633400d..af5d070 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -21,6 +21,8 @@ CHANGES: - Do not overwrite users CC/CFLAGS/LDFLAGS, only add to them. - Added -F option to write pidfile, based on patch from misc at mandriva.org. Fixes #70. + - Allow password to be set via environment variable, fixes #77. + Based on patch by logix. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 diff --git a/man/iodine.8 b/man/iodine.8 index ccd5085..a8d1af6 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -254,6 +254,22 @@ dig \-t NS foo123.tunnel.com .B MTU issues: These issues should be solved now, with automatic fragmentation of downstream packets. There should be no need to set the MTU explicitly on the server. +.SH ENVIRONMENT +.SS IODINE_PASS +If the environment variable +.B IODINE_PASS +is set, iodine will use the value it is set to as password instead of asking +for one. The +.B -P +option still has preference. +.SS IODINED_PASS +If the environment variable +.B IODINED_PASS +is set, iodined will use the value it is set to as password instead of asking +for one. The +.B -P +option still has preference. +.El .SH BUGS File bugs at http://dev.kryo.se/iodine/ .SH AUTHORS diff --git a/src/iodine.c b/src/iodine.c index c6e7797..27aaf46 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -48,6 +48,8 @@ WSADATA wsa_data; static char *__progname; #endif +#define PASSWORD_ENV_VAR "IODINE_PASS" + static void sighandler(int sig) { @@ -260,8 +262,12 @@ main(int argc, char **argv) #endif } - if (strlen(password) == 0) - read_password(password, sizeof(password)); + if (strlen(password) == 0) { + if (NULL != getenv(PASSWORD_ENV_VAR)) + snprintf(password, sizeof(password), "%s", getenv(PASSWORD_ENV_VAR)); + else + read_password(password, sizeof(password)); + } client_set_password(password); diff --git a/src/iodined.c b/src/iodined.c index 8e3b9d7..98aed88 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -65,6 +65,8 @@ WORD req_version = MAKEWORD(2, 2); WSADATA wsa_data; #endif +#define PASSWORD_ENV_VAR "IODINED_PASS" + static int running = 1; static char *topdomain; static char password[33]; @@ -1344,8 +1346,12 @@ main(int argc, char **argv) usage(); } - if (strlen(password) == 0) - read_password(password, sizeof(password)); + if (strlen(password) == 0) { + if (NULL != getenv(PASSWORD_ENV_VAR)) + snprintf(password, sizeof(password), "%s", getenv(PASSWORD_ENV_VAR)); + else + read_password(password, sizeof(password)); + } if ((tun_fd = open_tun(device)) == -1) { retval = 1; From bcd7c1c15c089d36a2a3a66ae7781c68a07351b7 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sat, 19 Sep 2009 08:24:59 +0000 Subject: [PATCH 04/49] #78, print server tunnel ip --- CHANGELOG | 1 + src/client.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index af5d070..3c27968 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -23,6 +23,7 @@ CHANGES: misc at mandriva.org. Fixes #70. - Allow password to be set via environment variable, fixes #77. Based on patch by logix. + - Client now prints server tunnel IP, fixes #78. Patch by logix. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 diff --git a/src/client.c b/src/client.c index bd516cf..6585d4c 100644 --- a/src/client.c +++ b/src/client.c @@ -742,6 +742,8 @@ handshake_login(int dns_fd, int seed) client[64] = 0; if (tun_setip(client, netmask) == 0 && tun_setmtu(mtu) == 0) { + + fprintf(stderr, "Server tunnel IP is %s\n", server); return 0; } else { errx(4, "Failed to set IP and MTU"); From 7ca260c319b4dd7c031c78643bab3df2d16b2cf0 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sat, 19 Sep 2009 08:32:57 +0000 Subject: [PATCH 05/49] #79 Fix build error on OSX 10.6 by Guillaume Rischard --- src/client.c | 3 ++- src/common.c | 3 ++- src/dns.c | 3 ++- src/iodined.c | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/src/client.c b/src/client.c index 6585d4c..0dc7464 100644 --- a/src/client.c +++ b/src/client.c @@ -33,7 +33,8 @@ #else #include #ifdef DARWIN -#include +#define BIND_8_COMPAT +#include #endif #include #include diff --git a/src/common.c b/src/common.c index a4ef691..b1f197b 100644 --- a/src/common.c +++ b/src/common.c @@ -34,7 +34,8 @@ #else #include #ifdef DARWIN -#include +#define BIND_8_COMPAT +#include #endif #include #include diff --git a/src/dns.c b/src/dns.c index 4b8199b..075016b 100644 --- a/src/dns.c +++ b/src/dns.c @@ -27,7 +27,8 @@ #else #include #ifdef DARWIN -#include +#define BIND_8_COMPAT +#include #endif #include #include diff --git a/src/iodined.c b/src/iodined.c index 98aed88..41ff353 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -33,7 +33,8 @@ #else #include #ifdef DARWIN -#include +#define BIND_8_COMPAT +#include #endif #define _XPG4_2 #include From 5c64a44d5e6fc3c7ddb043c7836940497c0d77a1 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sat, 19 Sep 2009 22:19:09 +0000 Subject: [PATCH 06/49] Updated changelog after #79 --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index 3c27968..c3329c3 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -24,6 +24,7 @@ CHANGES: - Allow password to be set via environment variable, fixes #77. Based on patch by logix. - Client now prints server tunnel IP, fixes #78. Patch by logix. + - Fix build error on Mac OS X 10.6, patch by G. Rischard. #79. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 From 94f1d670d470405dc531fd5b76b7d72c1cc74aea Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 08:43:48 +0000 Subject: [PATCH 07/49] Refactored to make it easier to add unit tests --- src/client.c | 34 ++-------------------------------- src/client.h | 2 +- src/common.h | 1 + src/encoding.c | 31 +++++++++++++++++++++++++++++++ src/encoding.h | 1 + src/iodine.c | 2 +- 6 files changed, 37 insertions(+), 34 deletions(-) diff --git a/src/client.c b/src/client.c index 0dc7464..046b2cd 100644 --- a/src/client.c +++ b/src/client.c @@ -120,7 +120,7 @@ client_get_conn() } void -client_set_nameserver(const char *cp) +client_set_nameserver(const char *cp, int port) { struct in_addr addr; @@ -129,7 +129,7 @@ client_set_nameserver(const char *cp) memset(&nameserv, 0, sizeof(nameserv)); nameserv.sin_family = AF_INET; - nameserv.sin_port = htons(53); + nameserv.sin_port = htons(port); nameserv.sin_addr = addr; } @@ -191,36 +191,6 @@ send_raw_data(int dns_fd) send_raw(dns_fd, outpkt.data, outpkt.len, userid, RAW_HDR_CMD_DATA); } -static int -build_hostname(char *buf, size_t buflen, - const char *data, const size_t datalen, - const char *topdomain, struct encoder *encoder) -{ - int encsize; - size_t space; - char *b; - - space = MIN(0xFF, buflen) - strlen(topdomain) - 7; - if (!encoder->places_dots()) - space -= (space / 57); /* space for dots */ - - memset(buf, 0, buflen); - - encsize = encoder->encode(buf, &space, data, datalen); - - if (!encoder->places_dots()) - inline_dotify(buf, buflen); - - b = buf; - b += strlen(buf); - - if (*b != '.') - *b++ = '.'; - - strncpy(b, topdomain, strlen(topdomain)+1); - - return space; -} static void send_packet(int fd, char cmd, const char *data, const size_t datalen) diff --git a/src/client.h b/src/client.h index 0df4d3d..865ae4f 100644 --- a/src/client.h +++ b/src/client.h @@ -23,7 +23,7 @@ void client_stop(); enum connection client_get_conn(); const char *client_get_raw_addr(); -void client_set_nameserver(const char *cp); +void client_set_nameserver(const char *cp, int port); void client_set_topdomain(const char *cp); void client_set_password(const char *cp); diff --git a/src/common.h b/src/common.h index 3570058..d5ecc4e 100644 --- a/src/common.h +++ b/src/common.h @@ -40,6 +40,7 @@ extern const unsigned char raw_header[RAW_HDR_LEN]; #include #endif +#define DNS_PORT 53 #ifndef MIN #define MIN(a,b) ((a)<(b)?(a):(b)) diff --git a/src/encoding.c b/src/encoding.c index 6878e5e..e92cfe5 100644 --- a/src/encoding.c +++ b/src/encoding.c @@ -15,8 +15,39 @@ */ #include +#include "common.h" #include "encoding.h" +int +build_hostname(char *buf, size_t buflen, + const char *data, const size_t datalen, + const char *topdomain, struct encoder *encoder) +{ + int encsize; + size_t space; + char *b; + + space = MIN(0xFF, buflen) - strlen(topdomain) - 7; + if (!encoder->places_dots()) + space -= (space / 57); /* space for dots */ + + memset(buf, 0, buflen); + + encsize = encoder->encode(buf, &space, data, datalen); + + if (!encoder->places_dots()) + inline_dotify(buf, buflen); + + b = buf; + b += strlen(buf); + + if (*b != '.') + *b++ = '.'; + + strncpy(b, topdomain, strlen(topdomain)+1); + + return space; +} int unpack_data(char *buf, size_t buflen, char *data, size_t datalen, struct encoder *enc) diff --git a/src/encoding.h b/src/encoding.h index dda2c13..d2ac4f2 100644 --- a/src/encoding.h +++ b/src/encoding.h @@ -27,6 +27,7 @@ struct encoder { int (*blocksize_encoded)(void); }; +int build_hostname(char *, size_t, const char *, const size_t, const char *, struct encoder *); int unpack_data(char *, size_t, char *, size_t, struct encoder *); int inline_dotify(char *, size_t); int inline_undotify(char *, size_t); diff --git a/src/iodine.c b/src/iodine.c index 27aaf46..8d12c04 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -232,7 +232,7 @@ main(int argc, char **argv) } if (nameserv_addr) { - client_set_nameserver(nameserv_addr); + client_set_nameserver(nameserv_addr, DNS_PORT); } else { usage(); /* NOTREACHED */ From 34c69866c96c4d91de6bf560279e28c509ba72e3 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 08:43:49 +0000 Subject: [PATCH 08/49] Added new test, found and fixed an actual bug --- src/encoding.c | 6 ++++- tests/encoding.c | 66 ++++++++++++++++++++++++++++++------------------ 2 files changed, 47 insertions(+), 25 deletions(-) diff --git a/src/encoding.c b/src/encoding.c index e92cfe5..11b2334 100644 --- a/src/encoding.c +++ b/src/encoding.c @@ -41,8 +41,12 @@ build_hostname(char *buf, size_t buflen, b = buf; b += strlen(buf); + /* move b back one step to see if the dot is there */ + b--; if (*b != '.') - *b++ = '.'; + *++b = '.'; + b++; + /* move b ahead of the string so we can copy to it */ strncpy(b, topdomain, strlen(topdomain)+1); diff --git a/tests/encoding.c b/tests/encoding.c index a5d04fa..38e8fab 100644 --- a/tests/encoding.c +++ b/tests/encoding.c @@ -21,8 +21,12 @@ #include "encoding.h" #include "test.h" +#include "base32.h" +#include "base64.h" -struct tuple +#define TUPLES 4 + +static struct tuple { char *a; char *b; @@ -39,40 +43,53 @@ struct tuple START_TEST(test_inline_dotify) { - unsigned i; char temp[1024]; char *b; - i = 0; - while (dottests[i].a) { - memset(temp, 0, sizeof(temp)); - strcpy(temp, dottests[i].a); - b = temp; - inline_dotify(b, sizeof(temp)); + memset(temp, 0, sizeof(temp)); + strcpy(temp, dottests[_i].a); + b = temp; + inline_dotify(b, sizeof(temp)); - fail_unless(strcmp(dottests[i].b, temp) == 0, - "'%s' != '%s'", temp, dottests[i].b); - i++; - } + fail_unless(strcmp(dottests[_i].b, temp) == 0, + "'%s' != '%s'", temp, dottests[_i].b); } END_TEST START_TEST(test_inline_undotify) { - unsigned i; char temp[1024]; char *b; - i = 0; - while (dottests[i].a) { - memset(temp, 0, sizeof(temp)); - strcpy(temp, dottests[i].b); - b = temp; - inline_undotify(b, sizeof(temp)); + memset(temp, 0, sizeof(temp)); + strcpy(temp, dottests[_i].b); + b = temp; + inline_undotify(b, sizeof(temp)); - fail_unless(strcmp(dottests[i].a, temp) == 0, - "'%s' != '%s'", temp, dottests[i].a); - i++; + fail_unless(strcmp(dottests[_i].a, temp) == 0, + "'%s' != '%s'", temp, dottests[_i].a); +} +END_TEST + +START_TEST(test_build_hostname) +{ + char data[256]; + char buf[1024]; + char *topdomain = "a.c"; + int buflen; + int i; + + for (i = 0; i < sizeof(data); i++) { + data[i] = i & 0xFF; + } + + buflen = sizeof(buf); + + for (i = 1; i < sizeof(data); i++) { + int len = build_hostname(buf, buflen, data, i, topdomain, get_base32_encoder()); + + fail_if(len > i); + fail_if(strstr(buf, ".."), "Found double dots when encoding data len %d! buf: %s", i, buf); } } END_TEST @@ -83,8 +100,9 @@ test_encoding_create_tests() TCase *tc; tc = tcase_create("Encoding"); - tcase_add_test(tc, test_inline_dotify); - tcase_add_test(tc, test_inline_undotify); + tcase_add_loop_test(tc, test_inline_dotify, 0, TUPLES); + tcase_add_loop_test(tc, test_inline_undotify, 0, TUPLES); + tcase_add_test(tc, test_build_hostname); return tc; } From 2c3fdf3346e45e8ffc13102bbdd26a7ab5a4aac5 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 09:01:47 +0000 Subject: [PATCH 09/49] Fix OpenBSD build error --- src/common.h | 1 + 1 file changed, 1 insertion(+) diff --git a/src/common.h b/src/common.h index d5ecc4e..12c91d2 100644 --- a/src/common.h +++ b/src/common.h @@ -34,6 +34,7 @@ extern const unsigned char raw_header[RAW_HDR_LEN]; #ifdef WINDOWS32 #include "windows.h" #else +#include #include #include #include From 593227a20eb562e474a5b0d38bbf655313208b77 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 09:05:09 +0000 Subject: [PATCH 10/49] Prune includes --- src/client.c | 5 ----- src/iodined.c | 5 ----- 2 files changed, 10 deletions(-) diff --git a/src/client.c b/src/client.c index 046b2cd..b4bf189 100644 --- a/src/client.c +++ b/src/client.c @@ -20,7 +20,6 @@ #include #include #include -#include #include #include #include @@ -36,10 +35,6 @@ #define BIND_8_COMPAT #include #endif -#include -#include -#include -#include #include #include #include diff --git a/src/iodined.c b/src/iodined.c index 41ff353..5e8cd2c 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -20,7 +20,6 @@ #include #include #include -#include #include #include #include @@ -37,10 +36,6 @@ #include #endif #define _XPG4_2 -#include -#include -#include -#include #include #include #include From d5deccb354f533e6ef0f0e60dff1ad33c1e8aeaa Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 09:09:18 +0000 Subject: [PATCH 11/49] Fix FreeBSD build error, remove more includes --- src/iodined.c | 3 ++- src/user.c | 5 ----- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/src/iodined.c b/src/iodined.c index 5e8cd2c..0ff8e25 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -26,6 +26,8 @@ #include #include +#include "common.h" + #ifdef WINDOWS32 #include "windows.h" #include @@ -45,7 +47,6 @@ #include #endif -#include "common.h" #include "dns.h" #include "encoding.h" #include "base32.h" diff --git a/src/user.c b/src/user.c index 54fcd35..32b35c1 100644 --- a/src/user.c +++ b/src/user.c @@ -21,16 +21,11 @@ #include #include #include -#include #include #ifdef WINDOWS32 #include #else -#include -#include -#include -#include #include #endif From 1c8f6e522f2be6a04cd60aa6abe2ce3bfd638537 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:03 +0000 Subject: [PATCH 12/49] #75, base32 decode uppercase --- src/base32.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/base32.c b/src/base32.c index 5ee0664..eff2e2b 100644 --- a/src/base32.c +++ b/src/base32.c @@ -26,6 +26,8 @@ static const char cb32[] = "abcdefghijklmnopqrstuvwxyz012345"; +static const char cb32_ucase[] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZ012345"; static unsigned char rev32[128]; static int base32_decode(void *, size_t *, const char *, size_t); @@ -80,6 +82,8 @@ base32_reverse_init() for (i = 0; i < 32; i++) { c = cb32[i]; rev32[(int) c] = i; + c = cb32_ucase[i]; + rev32[(int) c] = i; } reverse_init = 1; } From 26d59a98867ea84ab6b4918af4b4a374934b26d1 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:04 +0000 Subject: [PATCH 13/49] #75, add txt read/write --- src/read.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/read.h | 2 ++ 2 files changed, 63 insertions(+) diff --git a/src/read.c b/src/read.c index 51accb8..ff40382 100644 --- a/src/read.c +++ b/src/read.c @@ -125,6 +125,35 @@ readdata(char *packet, char **src, char *dst, size_t len) return len; } +int +readtxtbin(char *packet, char **src, size_t srcremain, char *dst, size_t dstremain) +{ + unsigned char *uc; + int tocopy; + int dstused = 0; + + while (srcremain > 0) + { + uc = (unsigned char*) (*src); + tocopy = *uc; + (*src)++; + srcremain--; + + if (tocopy > srcremain) + return 0; /* illegal, better have nothing */ + if (tocopy > dstremain) + return 0; /* doesn't fit, better have nothing */ + + memcpy(dst, *src, tocopy); + dst += tocopy; + (*src) += tocopy; + srcremain -= tocopy; + dstremain -= tocopy; + dstused += tocopy; + } + return dstused; +} + int putname(char **buf, size_t buflen, const char *host) { @@ -212,3 +241,35 @@ putdata(char **dst, char *data, size_t len) return len; } +int +puttxtbin(char **buf, size_t bufremain, char *from, size_t fromremain) +{ + unsigned char uc; + unsigned char *ucp = &uc; + char *cp = (char *) ucp; + int tocopy; + int bufused = 0; + + while (fromremain > 0) + { + tocopy = fromremain; + if (tocopy > 252) + tocopy = 252; /* allow off-by-1s in caches etc */ + if (tocopy + 1 > bufremain) + return -1; /* doesn't fit, better have nothing */ + + uc = tocopy; + **buf = *cp; + (*buf)++; + bufremain--; + bufused++; + + memcpy(*buf, from, tocopy); + (*buf) += tocopy; + from += tocopy; + bufremain -= tocopy; + fromremain -= tocopy; + bufused += tocopy; + } + return bufused; +} diff --git a/src/read.h b/src/read.h index a66063e..b33f3bb 100644 --- a/src/read.h +++ b/src/read.h @@ -21,11 +21,13 @@ int readname(char *, int, char **, char *, size_t); int readshort(char *, char **, short *); int readlong(char *, char **, uint32_t *); int readdata(char *, char **, char *, size_t); +int readtxtbin(char *, char **, size_t, char *, size_t); int putname(char **, size_t, const char *); int putbyte(char **, unsigned char); int putshort(char **, unsigned short); int putlong(char **, uint32_t); int putdata(char **, char *, size_t); +int puttxtbin(char **, size_t, char *, size_t); #endif From b9d4b37c874cfdeaaf4cddc551ab2666b77ec13c Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:06 +0000 Subject: [PATCH 14/49] #75, add win32 defines --- src/windows.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/windows.h b/src/windows.h index f930855..edcc164 100644 --- a/src/windows.h +++ b/src/windows.h @@ -28,9 +28,13 @@ typedef unsigned int in_addr_t; #define T_A DNS_TYPE_A #define T_NS DNS_TYPE_NS #define T_NULL DNS_TYPE_NULL +#define T_CNAME DNS_TYPE_CNAME +#define T_MX DNS_TYPE_MX +#define T_TXT DNS_TYPE_TXT #define C_IN 1 +#define FORMERR 1 #define SERVFAIL 2 #define NXDOMAIN 3 #define NOTIMP 4 From 3b47b8ad928aa3f5bc980709393ac4739b580bdb Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:07 +0000 Subject: [PATCH 15/49] #75 Add win32 defines for TXT and SRV --- src/windows.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/windows.h b/src/windows.h index edcc164..d7e03e1 100644 --- a/src/windows.h +++ b/src/windows.h @@ -25,6 +25,14 @@ typedef unsigned int in_addr_t; #include #include +/* Missing from the mingw headers */ +#ifndef DNS_TYPE_SRV +# define DNS_TYPE_SRV 33 +#endif +#ifndef DNS_TYPE_TXT +# define DNS_TYPE_TXT 16 +#endif + #define T_A DNS_TYPE_A #define T_NS DNS_TYPE_NS #define T_NULL DNS_TYPE_NULL From a02f7d776f66e8ebb981a8b8f8a832b5ae951f40 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:08 +0000 Subject: [PATCH 16/49] #75 add downenc per-user field --- src/user.h | 1 + 1 file changed, 1 insertion(+) diff --git a/src/user.h b/src/user.h index ba1e696..6058a8d 100644 --- a/src/user.h +++ b/src/user.h @@ -31,6 +31,7 @@ struct user { struct packet inpacket; struct packet outpacket; struct encoder *encoder; + char downenc; int out_acked_seqno; int out_acked_fragment; int fragsize; From 3703485c9c3d927cfe748f184b3bcdee2ac9c984 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:10 +0000 Subject: [PATCH 17/49] #75, update docs --- README | 32 +++++++++++++----- man/iodine.8 | 93 +++++++++++++++++++++++++++++++++++++++++++--------- 2 files changed, 101 insertions(+), 24 deletions(-) diff --git a/README b/README index 62cc771..2763731 100644 --- a/README +++ b/README @@ -70,14 +70,8 @@ add a route to the nameserver you use with the default gateway as gateway. Then replace the default gateway with the servers IP address within the DNS tunnel, and configure the server to do NAT. -MTU issues: -These issues should be solved now, with automatic fragmentation of downstream -packets. There should be no need to set the MTU explicitly on the server. - -If you have problems, try inspecting the traffic with network monitoring tools -and make sure that the relaying DNS server has not cached the response. A -cached error message could mean that you started the client before the server. -The -D option on the server can also show received and sent queries. +The DNS-response fragment size is normally autoprobed to get maximum bandwidth. +To force a specific value (and speed things up), use the -m option. The iodined server replies to NS requests sent for subdomains of the tunnel domain. If your domain is tunnel.com, send a NS request for foo.tunnel.com @@ -90,6 +84,21 @@ and one query can be max 256 chars. Each domain name part can be max 63 chars. So your domain name and subdomain should be as short as possible to allow maximum upstream throughput. +The default is to use DNS NULL-type queries, as this provides the largest +downstream bandwidth. If your DNS server blocks NULL requests, try TXT or +CNAME queries via the -T option. Also supported are A (returning CNAME) and +MX requests, but these may/will cause additional lookups by "smart" caching +nameservers to get an actual IP address, which may either slow down or fail +completely. DNS responses for non-NULL are Base32 encoded by default, which +should always work. For more bandwidth, try Base64 or Raw (TXT only) via the +-O option. If Base64/Raw doesn't work, you'll see many failures in the +fragment size autoprobe. + +If you have problems, try inspecting the traffic with network monitoring tools +and make sure that the relaying DNS server has not cached the response. A +cached error message could mean that you started the client before the server. +The -D (and -DD) option on the server can also show received and sent queries. + TIPS & TRICKS: @@ -99,6 +108,13 @@ use for instance iptables (on Linux) to forward the traffic: iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to :5353 (Sent in by Tom Schouten) +Iodined will reject data from clients that have not been active (data/pings) +for more than 60 seconds. In case of a long network outage or similar, just +stop iodine and restart (re-login), possibly multiple times until you get +your old IP address back. Once that's done, just wait a while, and you'll +eventually see the tunneled TCP traffic continue to flow from where it left +off before the outage. + PORTABILITY: diff --git a/man/iodine.8 b/man/iodine.8 index a8d1af6..2f08ff5 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -1,5 +1,5 @@ .\" groff -man -Tascii iodine.8 -.TH IODINE 8 "JUL 2008" "User Manuals" +.TH IODINE 8 "SEP 2009" "User Manuals" .SH NAME iodine, iodined \- tunnel IPv4 over DNS .SH SYNOPSIS @@ -23,6 +23,10 @@ iodine, iodined \- tunnel IPv4 over DNS .I context .B ] [-F .I pidfile +.B ] [-T +.I dnstype +.B ] [-O +.I downenc .B ] .B [ .I nameserver @@ -46,7 +50,7 @@ iodine, iodined \- tunnel IPv4 over DNS .B ] [-p .I port .B ] [-n -.I external ip +.I external_ip .B ] [-b .I dnsport .B ] [-P @@ -111,40 +115,78 @@ of the iodined host and test if it is reachable directly. If it is, traffic will be sent to the server instead of the DNS relay. .TP .B -m fragsize -Maximum downstream fragsize. Not setting this will cause the client to probe -the maximum accepted downstream packet size. +Force maximum downstream fragment size. Not setting this will cause the +client to automatically probe the maximum accepted downstream fragment size. +.TP +.B -T dnstype +DNS request type. +.I NULL +is default. If this doesn't work, try +.I TXT +(some less bandwidth) or +.I CNAME +(much less bandwidth). Also supported are +.I A +(returning CNAME) and +.I MX +requests, but these may/will cause additional lookups by "smart" caching +nameservers to get an actual IP address, which may either slow down or fail +completely. +.TP +.B -O downenc +Downstream encoding for all query type responses except NULL. +.I Base32 +is default and should always work. +.I Base64 +provides more bandwidth, but may not work on all nameservers. +For TXT queries, +.I Raw +will provide maximum performance. This will only work if the nameserver +path is fully 8-bit-clean for responses that are assumed to be "legible text". .SS Server Options: .TP .B -c -Disable checks on client IP on all incoming requests. +Disable checking the client IP address on all incoming requests. +By default, requests originating from non-matching IP adresses will be +rejected, however this will cause problems when requests are routed +via a cluster of DNS servers. .TP .B -s -Don't try to configure IP address or MTU. This should only be used if -you have already configured the device that will be used. +Don't try to configure IP address or MTU. +This should only be used if you have already configured the device that will be +used. .TP .B -D Increase debug level. Level 1 prints info about each RX/TX packet. +Implies the +.B -f +option. .TP .B -m mtu -Set 'mtu' as mtu size for the tunnel device. This will be sent to the client -on connect, and the client will use the same mtu. +Set 'mtu' as mtu size for the tun device. +This will be sent to the client on login, and the client will use the same mtu +for its tun device. Default 1200. Note that the DNS traffic will be +automatically fragmented when needed. .TP .B -l listen_ip -Make the server listen only on 'listen_ip' instead of on 0.0.0.0 for incoming -connections. +Make the server listen only on 'listen_ip' for incoming requests. +By default, incoming requests are accepted from all interfaces. .TP .B -p port Make the server listen on 'port' instead of 53 for traffic. .B Note: You must make sure the dns requests are forwarded to this port yourself. .TP -.B -n external ip +.B -n external_ip The IP address to return in NS responses. Default is to return the address used as destination in the query. .TP .B -b dnsport If this port is specified, all incoming requests not inside the tunnel domain will be forwarded to this port on localhost, to be handled by a real dns. +.B Note: +The forwarding is not fully transparent, and not advised for use +in production environments. .SS Client Arguments: .TP .B nameserver @@ -156,7 +198,7 @@ from the file. .TP .B topdomain -The dns traffic will be sent as querys of type NULL for subdomains under +The dns traffic will be sent as queries for subdomains under \'topdomain'. This is normally a subdomain to a domain you own. Use a short domain name to get better throughput. If .B nameserver @@ -165,17 +207,19 @@ must be the same on both the client and the server. .SS Server Arguments: .TP .B tunnel_ip[/netmask] -This is the servers ip address on the tunnel interface. The client will be ++This is the server's ip address on the tun interface. The client will be given the next ip number in the range. It is recommended to use the 10.0.0.0 or 172.16.0.0 ranges. The default netmask is /27, can be overriden by specifying it here. Using a smaller network will limit the number of concurrent users. .TP .B topdomain -The dns traffic will is expected to be sent as querys of type NULL for ++The dns traffic is expected to arrive as queries for subdomains under 'topdomain'. This is normally a subdomain to a domain you own. Use a short domain name to get better throughput. This argument must be -the same on both the client and the server. +the same on both the client and the server. Queries for domains other +than 'topdomain' will be forwarded when the \-b option is given, otherwise +they will be dropped. .SH EXAMPLES .SS Quickstart: .TP @@ -254,6 +298,20 @@ dig \-t NS foo123.tunnel.com .B MTU issues: These issues should be solved now, with automatic fragmentation of downstream packets. There should be no need to set the MTU explicitly on the server. +.SH SECURITY +Login is a relatively secure challenge-response MD5 hash, with the +password never passing the wire. +However, all other data is +.B NOT +encrypted in any way. The DNS traffic is also vulnerable to replay, +injection and man-in-the-middle attacks, especially when iodined is used +with the \-c option. Use of ssh or vpn tunneling is strongly recommended. +On both server and client, use +.I iptables +, +.I pf +or other firewlls to block all traffic coming in from the tun interfaces, +except to the used ssh or vpn ports. .SH ENVIRONMENT .SS IODINE_PASS If the environment variable @@ -270,6 +328,9 @@ for one. The .B -P option still has preference. .El +.SH SEE ALSO +The README file in the source distribution contains some more elaborate +information. .SH BUGS File bugs at http://dev.kryo.se/iodine/ .SH AUTHORS From 3940f4e5ff8d477845fb86c63bbc0d13343fcb71 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:11 +0000 Subject: [PATCH 18/49] #75, update docs --- doc/proto_00000501.txt | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/doc/proto_00000501.txt b/doc/proto_00000501.txt index fded6e2..486083a 100644 --- a/doc/proto_00000501.txt +++ b/doc/proto_00000501.txt @@ -63,6 +63,26 @@ Server sends: BADCODEC if not accepted. Client must then revert to Base32 BADLEN if length of query is too short +Options: +Client sends: + First byte o or O + 5 bits coded as Base32 char, meaning userid + 1 char, meaning option +Server sends: + Full name of option if accepted. After this, option immediately takes + effect in server. + BADCODEC if not accepted. Previous situation remains. + All options affect only the requesting client. + + Option chars: + t or T: Downstream encoding Base32, for TXT/CNAME/A/MX (default) + s or S: Downstream encoding Base64, for TXT/CNAME/A/MX + r or R: Downstream encoding Raw, for TXT/NULL (default for NULL) + If codec unsupported for request type, server will use Base32; note + that server will answer any mix of request types that a client sends. + Server may disregard this option; client must always use the downstream + encoding type indicated in every downstream DNS packet. + Probe downstream fragment size: Client sends: First byte r or R @@ -113,6 +133,19 @@ Base32 encoded header, then comes the payload data, encoded with chosen codec. Downstream data starts with 2 byte header. Then payload data, which may be compressed. +In NULL responses, downstream data is always raw. In all other response types, +downstream data is encoded (see Options above). +Encoding type is indicated by 1 prefix char: +TXT: + End result is always DNS-chopped (series of len-prefixed strings + <=255 bytes) + t or T: Base32 encoded before chop, decoded after un-chop + s or S: Base64 encoded before chop, decoded after un-chop + r or R: Raw no encoding, only DNS-chop +CNAME/A/MX: + h or H: Hostname encoded with Base32 + i or I: Hostname encoded with Base64 + Ping: Client sends: First byte p or P From bd4a4eb24ce6f46bec8c5b72312c0cfe2d599fe7 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:12 +0000 Subject: [PATCH 19/49] #75, update dns parsing --- src/dns.c | 184 +++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 154 insertions(+), 30 deletions(-) diff --git a/src/dns.c b/src/dns.c index 075016b..a11e130 100644 --- a/src/dns.c +++ b/src/dns.c @@ -39,6 +39,8 @@ #include "encoding.h" #include "read.h" +#define CHECKLEN(x) if (buflen - (p-buf) < (x)) return 0 + int dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_t datalen) { @@ -47,6 +49,9 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ char *p; int len; + if (buflen < sizeof(HEADER)) + return 0; + memset(buf, 0, buflen); header = (HEADER*)buf; @@ -68,29 +73,80 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ name = 0xc000 | ((p - buf) & 0x3fff); - putname(&p, sizeof(q->name), q->name); + /* Question section */ + putname(&p, buflen - (p - buf), q->name); + CHECKLEN(4); putshort(&p, q->type); putshort(&p, C_IN); + /* Answer section */ + CHECKLEN(10); putshort(&p, name); - putshort(&p, q->type); + if (q->type == T_A) + putshort(&p, T_CNAME); /* answer CNAME to A question */ + else + putshort(&p, q->type); putshort(&p, C_IN); - putlong(&p, 0); + putlong(&p, 0); /* TTL */ + if (q->type == T_CNAME || q->type == T_A || q->type == T_MX) + { + /* data is expected to be like "Hblabla.host.name.com\0" */ + + char *startp = p; + int namelen; + + p += 2; /* skip 2 bytes length */ + CHECKLEN(2); + if (q->type == T_MX) + putshort(&p, 10); /* preference */ + putname(&p, buflen - (p - buf), data); + CHECKLEN(0); + namelen = p - startp; + namelen -= 2; + putshort(&startp, namelen); + } + else if (q->type == T_TXT) + { + /* TXT has binary or base-X data */ + char *startp = p; + int txtlen; + + p += 2; /* skip 2 bytes length */ + puttxtbin(&p, buflen - (p - buf), data, datalen); + CHECKLEN(0); + txtlen = p - startp; + txtlen -= 2; + putshort(&startp, txtlen); + } + else + { + /* NULL has raw binary data */ + datalen = MIN(datalen, buflen - (p - buf)); + CHECKLEN(2); putshort(&p, datalen); + CHECKLEN(datalen); putdata(&p, data, datalen); + CHECKLEN(0); + } + break; case QR_QUERY: + /* Note that iodined also uses this for forward queries */ + header->qdcount = htons(1); header->arcount = htons(1); - putname(&p, datalen, data); + putname(&p, buflen - (p - buf), data); + CHECKLEN(4); putshort(&p, q->type); putshort(&p, C_IN); - /* EDNS0 */ + /* EDNS0 to advertise maximum response length + (even CNAME/A/MX, 255+255+header would be >512) */ + CHECKLEN(11); putbyte(&p, 0x00); /* Root */ putshort(&p, 0x0029); /* OPT */ putshort(&p, 0x1000); /* Payload size: 4096 */ @@ -107,6 +163,7 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ int dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomain) +/* Only used when iodined gets an NS type query */ { HEADER *header; int len; @@ -117,6 +174,9 @@ dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomai int domain_len; char *p; + if (buflen < sizeof(HEADER)) + return 0; + memset(buf, 0, buflen); header = (HEADER*)buf; @@ -148,33 +208,38 @@ dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomai topname = 0xc000 | ((p - buf + domain_len) & 0x3fff); /* Query section */ - putname(&p, sizeof(q->name), q->name); /* Name */ + putname(&p, buflen - (p - buf), q->name); /* Name */ + CHECKLEN(4); putshort(&p, q->type); /* Type */ putshort(&p, C_IN); /* Class */ /* Answer section */ + CHECKLEN(12); putshort(&p, name); /* Name */ putshort(&p, q->type); /* Type */ putshort(&p, C_IN); /* Class */ - putlong(&p, 0x3ea7d011); /* TTL */ + putlong(&p, 3600); /* TTL */ putshort(&p, 5); /* Data length */ /* pointer to ns.topdomain */ nsname = 0xc000 | ((p - buf) & 0x3fff); + CHECKLEN(5); putbyte(&p, 2); putbyte(&p, 'n'); putbyte(&p, 's'); putshort(&p, topname); /* Name Server */ /* Additional data (A-record of NS server) */ + CHECKLEN(12); putshort(&p, nsname); /* Name Server */ putshort(&p, T_A); /* Type */ putshort(&p, C_IN); /* Class */ - putlong(&p, 0x3ea7d011); /* TTL */ + putlong(&p, 3600); /* TTL */ putshort(&p, 4); /* Data length */ /* ugly hack to output IP address */ domain = (char *) &q->destination; + CHECKLEN(4); putbyte(&p, *domain++); putbyte(&p, *domain++); putbyte(&p, *domain++); @@ -184,6 +249,8 @@ dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomai return len; } +#undef CHECKLEN + unsigned short dns_get_id(char *packet, size_t packetlen) { @@ -196,6 +263,8 @@ dns_get_id(char *packet, size_t packetlen) return ntohs(header->id); } +#define CHECKLEN(x) if (packetlen - (data-packet) < (x)) return 0 + int dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, size_t packetlen) { @@ -235,27 +304,50 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz switch (qr) { case QR_ANSWER: - if(qdcount != 1 || ancount != 1) { + if(qdcount < 1 || ancount < 1) { + /* We may get both CNAME and A, then ancount=2 */ switch (header->rcode) { - case REFUSED: + case NOERROR: /* 0 */ + if (header->tc) + warnx("Got TRUNCATION as reply: response too long for DNS path"); + else + warnx("Got reply without error, but also without question and/or answer"); + break; + + case FORMERR: /* 1 */ + warnx("Got FORMERR as reply: server does not understand our request"); + break; + + case SERVFAIL: /* 2 */ + if (qdcount >= 1 + && packetlen >= sizeof(HEADER) + 2 + && (data[1] == 'r' || data[1] == 'R')) + warnx("Got SERVFAIL as reply on earlier fragsize autoprobe"); + else if (qdcount >= 1 + && packetlen >= sizeof(HEADER) + 2 + && (data[1] < '0' || data[1] > '9') + && (data[1] < 'a' || data[1] > 'f') + && (data[1] < 'A' || data[1] > 'F') + && data[1] != 'p' && data[1] != 'P') + warnx("Got SERVFAIL as reply on earlier config setting"); + else + warnx("Got SERVFAIL as reply: server failed or recursion timeout"); + break; + + case NXDOMAIN: /* 3 */ + warnx("Got NXDOMAIN as reply: domain does not exist"); + break; + + case NOTIMP: /* 4 */ + warnx("Got NOTIMP as reply: server does not support our request"); + break; + + case REFUSED: /* 5 */ warnx("Got REFUSED as reply"); break; - case NOTIMP: - warnx("Got NOTIMP as reply"); - break; - - case NXDOMAIN: - warnx("Got NXDOMAIN as reply"); - break; - - case SERVFAIL: - warnx("Got SERVFAIL as reply"); - break; - - case NOERROR: default: - warnx("no query or answer in reply packet"); + warnx("Got RCODE %u as reply", (unsigned int) header->rcode); break; } return -1; @@ -265,33 +357,65 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz q->id = id; readname(packet, packetlen, &data, name, sizeof(name)); + CHECKLEN(4); readshort(packet, &data, &type); readshort(packet, &data, &class); + /* Assume that first answer is NULL/CNAME that we wanted */ readname(packet, packetlen, &data, name, sizeof(name)); + CHECKLEN(10); readshort(packet, &data, &type); readshort(packet, &data, &class); readlong(packet, &data, &ttl); readshort(packet, &data, &rlen); - rv = MIN(rlen, sizeof(rdata)); - rv = readdata(packet, &data, rdata, rv); - if(type == T_NULL && rv >= 2 && buf) { - rv = MIN(rv, buflen); - memcpy(buf, rdata, rv); + if (type == T_NULL) { + rv = MIN(rlen, sizeof(rdata)); + rv = readdata(packet, &data, rdata, rv); + if (rv >= 2 && buf) { + rv = MIN(rv, buflen); + memcpy(buf, rdata, rv); + } + /* "else rv=0;" here? */ } + if ((type == T_CNAME || type == T_MX) && buf) { + if (type == T_MX) + data += 2; /* skip preference */ + memset(name, 0, sizeof(name)); + readname(packet, packetlen, &data, name, sizeof(name) - 1); + name[sizeof(name)-1] = '\0'; + strncpy(buf, name, buflen); + buf[buflen - 1] = '\0'; + rv = strlen(buf); + } + if (type == T_TXT && buf) { + rv = readtxtbin(packet, &data, rlen, rdata, sizeof(rdata)); + if (rv >= 1) { + rv = MIN(rv, buflen); + memcpy(buf, rdata, rv); + } + } + if (q != NULL) + q->type = type; break; case QR_QUERY: - if (qdcount != 1) { + if (qdcount < 1) { warnx("no question section in name query"); return -1; } + memset(name, 0, sizeof(name)); readname(packet, packetlen, &data, name, sizeof(name) - 1); name[sizeof(name)-1] = '\0'; + CHECKLEN(4); readshort(packet, &data, &type); readshort(packet, &data, &class); + if (q == NULL) { + rv = 0; + break; + } + strncpy(q->name, name, sizeof(q->name)); q->name[sizeof(q->name) - 1] = '\0'; q->type = type; From 83dfde0728029a15feb80f2ead4e32922893527e Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:14 +0000 Subject: [PATCH 20/49] #75, update client code --- src/client.c | 356 +++++++++++++++++++++++++++++++++++++++++++++------ src/util.c | 2 +- 2 files changed, 318 insertions(+), 40 deletions(-) diff --git a/src/client.c b/src/client.c index b4bf189..316a38b 100644 --- a/src/client.c +++ b/src/client.c @@ -14,6 +14,7 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +#include #include #include #include @@ -75,12 +76,20 @@ static char userid; /* DNS id for next packet */ static uint16_t chunkid; -/* Base32 encoder used for non-data packets */ +/* Base32 encoder used for non-data packets and replies */ static struct encoder *b32; +/* Base64 encoder for replies */ +static struct encoder *b64; /* The encoder used for data packets * Defaults to Base32, can be changed after handshake */ static struct encoder *dataenc; + +/* The encoder to use for downstream data */ +static char downenc = ' '; + +/* set query type to send */ +static unsigned short do_qtype = T_NULL; /* My connection mode */ static enum connection conn; @@ -95,10 +104,11 @@ client_init() downstream_fragment = 0; down_ack_seqno = 0; down_ack_fragment = 0; - chunkid = 0; + chunkid = ((unsigned int) rand()) & 0xFFFF; b32 = get_base32_encoder(); + b64 = get_base64_encoder(); dataenc = get_base32_encoder(); - rand_seed = rand(); + rand_seed = ((unsigned int) rand()) & 0xFFFF; conn = CONN_DNS_NULL; } @@ -140,6 +150,32 @@ client_set_password(const char *cp) password = cp; } +void +set_qtype(char *qtype) +{ + if (!strcasecmp(qtype, "NULL")) + do_qtype = T_NULL; + else if (!strcasecmp(qtype, "CNAME")) + do_qtype = T_CNAME; + else if (!strcasecmp(qtype, "A")) + do_qtype = T_A; + else if (!strcasecmp(qtype, "MX")) + do_qtype = T_MX; + else if (!strcasecmp(qtype, "TXT")) + do_qtype = T_TXT; +} + +void +set_downenc(char *encoding) +{ + if (!strcasecmp(encoding, "base32")) + downenc = 'T'; + else if (!strcasecmp(encoding, "base64")) + downenc = 'S'; + else if (!strcasecmp(encoding, "raw")) + downenc = 'R'; +} + const char * client_get_raw_addr() { @@ -153,10 +189,19 @@ send_query(int fd, char *hostname) struct query q; size_t len; - q.id = ++chunkid; - q.type = T_NULL; + chunkid += 7727; + if (chunkid == 0) + /* 0 is used as "no-query" in iodined.c */ + chunkid = 7727; + + q.id = chunkid; + q.type = do_qtype; len = dns_encode(packet, sizeof(packet), &q, QR_QUERY, hostname, strlen(hostname)); + if (len < 1) { + warnx("dns_encode doesn't fit"); + return; + } sendto(fd, packet, len, 0, (struct sockaddr*)&nameserv, sizeof(nameserv)); } @@ -207,7 +252,7 @@ is_sending() static void send_chunk(int fd) { - char hex[] = "0123456789ABCDEF"; + char hex[] = "0123456789abcdef"; char buf[4096]; int avail; int code; @@ -261,7 +306,7 @@ send_ping(int fd) rand_seed++; - send_packet(fd, 'P', data, sizeof(data)); + send_packet(fd, 'p', data, sizeof(data)); } else { send_raw(fd, NULL, 0, userid, RAW_HDR_CMD_PING); } @@ -288,6 +333,88 @@ read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed rv = dns_decode(buf, buflen, &q, QR_ANSWER, data, r); + if ((q.type == T_CNAME || q.type == T_MX || q.type == T_TXT) + && rv >= 1) + /* CNAME an also be returned from an A (or MX) question */ + { + size_t space; + + /* + * buf is a hostname or txt stream that we still need to + * decode to binary + * + * also update rv with the number of valid bytes + * + * data is unused here, and will certainly hold the smaller binary + */ + + switch (buf[0]) { + case 'h': /* Hostname with base32 */ + case 'H': + if (rv < 5) { + /* 1 byte H, 3 bytes ".xy", >=1 byte data */ + rv = 0; + break; + } + + rv -= 3; /* rv=strlen, strip ".xy" */ + rv = unpack_data (data, sizeof(data), buf + 1, rv - 1, b32); + /* this also does undotify */ + + rv = MIN(rv, buflen); + memcpy(buf, data, rv); + break; + case 'i': /* Hostname++ with base64 */ + case 'I': + if (rv < 5) { + /* 1 byte H, 3 bytes ".xy", >=1 byte data */ + rv = 0; + break; + } + + rv -= 3; /* rv=strlen, strip ".xy" */ + rv = unpack_data (data, sizeof(data), buf + 1, rv - 1, b64); + /* this also does undotify */ + + rv = MIN(rv, buflen); + memcpy(buf, data, rv); + break; + case 't': /* plain base32(Thirty-two) from TXT */ + case 'T': + if (rv < 2) { + rv = 0; + break; + } + + space = sizeof(data); + rv = b32->decode (data, &space, buf + 1, rv - 1); + rv = MIN(rv, buflen); + memcpy(buf, data, rv); + break; + case 's': /* plain base64(Sixty-four) from TXT */ + case 'S': + if (rv < 2) { + rv = 0; + break; + } + + space = sizeof(data); + rv = b64->decode (data, &space, buf + 1, rv - 1); + rv = MIN(rv, buflen); + memcpy(buf, data, rv); + break; + case 'r': /* Raw binary from TXT */ + case 'R': + rv--; /* rv>=1 already checked */ + memmove(buf, buf+1, rv); + break; + default: + warnx("Received unsupported encoding"); + rv = 0; + break; + } + } + /* decode the data header, update seqno and frag before next request */ if (rv >= 2) { downstream_seqno = (buf[1] >> 5) & 7; @@ -311,7 +438,7 @@ read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed downstream_seqno != down_ack_seqno || downstream_fragment != down_ack_fragment )) { - + send_ping(dns_fd); } } else { @@ -487,7 +614,7 @@ send_login(int fd, char *login, int len) rand_seed++; - send_packet(fd, 'L', data, sizeof(data)); + send_packet(fd, 'l', data, sizeof(data)); } static void @@ -496,9 +623,12 @@ send_fragsize_probe(int fd, int fragsize) char probedata[256]; char buf[4096]; - /* build a large query domain which is random and maximum size */ - memset(probedata, MIN(1, rand_seed & 0xff), sizeof(probedata)); - probedata[1] = MIN(1, (rand_seed >> 8) & 0xff); + /* + * build a large query domain which is random and maximum size, + * will also take up maximal space in the return packet + */ + memset(probedata, MAX(1, rand_seed & 0xff), sizeof(probedata)); + probedata[1] = MAX(1, (rand_seed >> 8) & 0xff); rand_seed++; build_hostname(buf + 4, sizeof(buf) - 4, probedata, sizeof(probedata), topdomain, dataenc); @@ -525,14 +655,14 @@ send_set_downstream_fragsize(int fd, int fragsize) rand_seed++; - send_packet(fd, 'N', data, sizeof(data)); + send_packet(fd, 'n', data, sizeof(data)); } static void send_version(int fd, uint32_t version) { char data[6]; - + data[0] = (version >> 24) & 0xff; data[1] = (version >> 16) & 0xff; data[2] = (version >> 8) & 0xff; @@ -585,7 +715,7 @@ send_case_check(int fd) static void send_codec_switch(int fd, int userid, int bits) { - char buf[512] = "S_____."; + char buf[512] = "s_____."; buf[1] = b32_5to8(userid); buf[2] = b32_5to8(bits); @@ -597,6 +727,23 @@ send_codec_switch(int fd, int userid, int bits) strncat(buf, topdomain, 512 - strlen(buf)); send_query(fd, buf); } + + +static void +send_downenc_switch(int fd, int userid) +{ + char buf[512] = "o_____."; + buf[1] = b32_5to8(userid); + buf[2] = tolower(downenc); + + buf[3] = b32_5to8((rand_seed >> 10) & 0x1f); + buf[4] = b32_5to8((rand_seed >> 5) & 0x1f); + buf[5] = b32_5to8((rand_seed ) & 0x1f); + rand_seed++; + + strncat(buf, topdomain, 512 - strlen(buf)); + send_query(fd, buf); +} static int handshake_version(int dns_fd, int *seed) @@ -657,7 +804,7 @@ handshake_version(int dns_fd, int *seed) fprintf(stderr, "Retrying version check...\n"); } - warnx("couldn't connect to server"); + warnx("couldn't connect to server (maybe other -T options will work)"); return 1; } @@ -891,7 +1038,7 @@ handshake_switch_codec(int dns_fd) int read; dataenc = get_base64_encoder(); - fprintf(stderr, "Switching to %s codec\n", dataenc->name); + fprintf(stderr, "Switching upstream to %s codec\n", dataenc->name); /* Send to server that this user will use base64 from now on */ for (i=0; running && i<5 ;i++) { int bits; @@ -922,7 +1069,7 @@ handshake_switch_codec(int dns_fd) goto codec_revert; } in[read] = 0; /* zero terminate */ - fprintf(stderr, "Server switched to codec %s\n", in); + fprintf(stderr, "Server switched upstream to codec %s\n", in); return; } } @@ -935,6 +1082,138 @@ codec_revert: dataenc = get_base32_encoder(); } +static void +handshake_switch_downenc(int dns_fd) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + char *dname; + + dname = "Base32"; + if (downenc == 'S') + dname = "Base64"; + else if (downenc == 'R') + dname = "Raw"; + + fprintf(stderr, "Switching downstream to codec %s\n", dname); + for (i=0; running && i<5 ;i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_downenc_switch(dns_fd, userid); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns(dns_fd, 0, in, sizeof(in)); + + if (read > 0) { + if (strncmp("BADLEN", in, 6) == 0) { + fprintf(stderr, "Server got bad message length. "); + goto codec_revert; + } else if (strncmp("BADIP", in, 5) == 0) { + fprintf(stderr, "Server rejected sender IP address. "); + goto codec_revert; + } else if (strncmp("BADCODEC", in, 8) == 0) { + fprintf(stderr, "Server rejected the selected codec. "); + goto codec_revert; + } + in[read] = 0; /* zero terminate */ + fprintf(stderr, "Server switched downstream to codec %s\n", in); + return; + } + } + fprintf(stderr, "Retrying codec switch...\n"); + } + fprintf(stderr, "No reply from server on codec switch. "); + +codec_revert: + fprintf(stderr, "Falling back to base32\n"); +} + + +static int +fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) +/* Returns: 0: keep checking, 1: break loop (either okay or definitely wrong) */ +{ + int acked_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); + static int nocheck_warned = 0; + + if (read >= 5 && strncmp("BADIP", in, 5) == 0) { + fprintf(stderr, "got BADIP (Try iodined -c)..\n"); + fflush(stderr); + return 0; /* maybe temporary error */ + } + + if (acked_fragsize != proposed_fragsize) { + /* + * got ack for wrong fragsize, maybe late response for + * earlier query, or ack corrupted + */ + return 0; + } + + if (read != proposed_fragsize) { + /* + * correctly acked fragsize but read too little (or too + * much): this fragsize is definitely not reliable + */ + return 1; + } + + /* here: read == proposed_fragsize == acked_fragsize */ + + /* test: */ + /* in[123] = 123; */ + + /* Check for corruption */ + if ((in[2] & 0xff) == 107) { + int okay = 1; + int i; + unsigned int v = in[3] & 0xff; + + for (i = 3; i < read; i++, v += 107) + if ((in[i] & 0xff) != (v & 0xff)) { + okay = 0; + break; + } + + if (okay) { + fprintf(stderr, "%d ok.. ", acked_fragsize); + fflush(stderr); + *max_fragsize = acked_fragsize; + return 1; + } else { + if (downenc != ' ' && downenc != 'T') + fprintf(stderr, "%d corrupted at %d.. (Try -O Base32)\n", acked_fragsize, i); + else + fprintf(stderr, "%d corrupted at %d.. ", acked_fragsize, i); + fflush(stderr); + return 1; + } + } /* always returns */ + + /* here when uncheckable, so assume correct */ + + if (read >= 3 && nocheck_warned == 0) { + fprintf(stderr, "(Old server version, cannot check for corruption)\n"); + fflush(stderr); + nocheck_warned = 1; + } + fprintf(stderr, "%d ok.. ", acked_fragsize); + fflush(stderr); + *max_fragsize = acked_fragsize; + return 1; +} + + static int handshake_autoprobe_fragsize(int dns_fd) { @@ -946,11 +1225,12 @@ handshake_autoprobe_fragsize(int dns_fd) int read; int proposed_fragsize = 768; int range = 768; - int max_fragsize = 0; + int max_fragsize; max_fragsize = 0; fprintf(stderr, "Autoprobing max downstream fragment size... (skip with -m fragsize)\n"); - while (running && range > 0 && (range >= 8 || !max_fragsize)) { + while (running && range > 0 && (range >= 8 || max_fragsize < 300)) { + /* stop the slow probing early when we have enough bytes anyway */ for (i=0; running && i<3 ;i++) { tv.tv_sec = 1; tv.tv_usec = 0; @@ -961,24 +1241,13 @@ handshake_autoprobe_fragsize(int dns_fd) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - if(r > 0) { + if(r >= 2) { read = read_dns(dns_fd, 0, in, sizeof(in)); if (read > 0) { /* We got a reply */ - int acked_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); - if (acked_fragsize == proposed_fragsize) { - if (read == proposed_fragsize) { - fprintf(stderr, "%d ok.. ", acked_fragsize); - fflush(stderr); - max_fragsize = acked_fragsize; - } - } - if (strncmp("BADIP", in, 5) == 0) { - fprintf(stderr, "got BADIP.. "); - fflush(stderr); - } - break; + if (fragsize_check(in, read, proposed_fragsize, &max_fragsize) == 1) + break; } } fprintf(stderr, "."); @@ -997,17 +1266,22 @@ handshake_autoprobe_fragsize(int dns_fd) } if (!running) { fprintf(stderr, "\n"); - warnx("stopped while autodetecting fragment size (Try probing manually with -m)"); + warnx("stopped while autodetecting fragment size (Try setting manually with -m)"); return 0; } - if (range == 0) { + if (max_fragsize <= 2) { /* Tried all the way down to 2 and found no good size */ fprintf(stderr, "\n"); - warnx("found no accepted fragment size. (Try probing manually with -m)"); + warnx("found no accepted fragment size. (Try forcing with -m, or try other -T or -O options)"); return 0; } - fprintf(stderr, "will use %d\n", max_fragsize); - return max_fragsize; + /* data header adds 2 bytes */ + fprintf(stderr, "will use %d-2=%d\n", max_fragsize, max_fragsize - 2); + + if (do_qtype != T_NULL && downenc == ' ') + fprintf(stderr, "(Maybe other -O options will increase throughput)\n"); + + return max_fragsize - 2; } static void @@ -1084,6 +1358,10 @@ client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsiz handshake_switch_codec(dns_fd); } + if (downenc != ' ') { + handshake_switch_downenc(dns_fd); + } + if (autodetect_frag_size) { fragsize = handshake_autoprobe_fragsize(dns_fd); if (!fragsize) { diff --git a/src/util.c b/src/util.c index 70ab90d..bc5fc8d 100644 --- a/src/util.c +++ b/src/util.c @@ -29,7 +29,7 @@ get_resolvconf_addr() rv = NULL; if ((fp = fopen("/etc/resolv.conf", "r")) == NULL) - err(1, "/etc/resolve.conf"); + err(1, "/etc/resolv.conf"); while (feof(fp) == 0) { fgets(buf, sizeof(buf), fp); From 8c082fe853d045992b3daca610e09f9b910341e7 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:15 +0000 Subject: [PATCH 21/49] #75, update client code --- src/client.h | 2 ++ src/iodine.c | 16 +++++++++++++--- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/src/client.h b/src/client.h index 865ae4f..e20c281 100644 --- a/src/client.h +++ b/src/client.h @@ -26,6 +26,8 @@ const char *client_get_raw_addr(); void client_set_nameserver(const char *cp, int port); void client_set_topdomain(const char *cp); void client_set_password(const char *cp); +void set_qtype(char *qtype); +void set_downenc(char *encoding); int client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize); int client_tunnel(int tun_fd, int dns_fd); diff --git a/src/iodine.c b/src/iodine.c index 8d12c04..c5c097f 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -61,7 +61,7 @@ usage() { extern char *__progname; fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] " - "[-P password] [-m maxfragsize] [-z context] [-F pidfile] " + "[-P password] [-m maxfragsize] [-T type] [-O enc] [-z context] [-F pidfile] " "[nameserver] topdomain\n", __progname); exit(2); } @@ -72,7 +72,7 @@ help() { fprintf(stderr, "iodine IP over DNS tunneling client\n"); fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] " - "[-P password] [-m maxfragsize] [-z context] [-F pidfile] " + "[-P password] [-m maxfragsize] [-T type] [-O enc] [-z context] [-F pidfile] " "[nameserver] topdomain\n", __progname); fprintf(stderr, " -v to print version info and exit\n"); fprintf(stderr, " -h to print this help and exit\n"); @@ -83,6 +83,8 @@ help() { fprintf(stderr, " -d device to set tunnel device name\n"); fprintf(stderr, " -P password used for authentication (max 32 chars will be used)\n"); fprintf(stderr, " -m maxfragsize, to limit size of downstream packets\n"); + fprintf(stderr, " -T dns type: NULL (default, fastest), TXT, CNAME, A (CNAME answer), MX\n"); + fprintf(stderr, " -O downstream encoding (!NULL): Base32(default), Base64, or Raw (only TXT)\n"); fprintf(stderr, " -z context, to apply specified SELinux context after initialization\n"); fprintf(stderr, " -F pidfile to write pid to a file\n"); fprintf(stderr, "nameserver is the IP number of the relaying nameserver, if absent /etc/resolv.conf is used\n"); @@ -133,6 +135,7 @@ main(int argc, char **argv) #endif username = NULL; memset(password, 0, 33); + srand(time(NULL)); foreground = 0; newroot = NULL; context = NULL; @@ -159,7 +162,7 @@ main(int argc, char **argv) __progname++; #endif - while ((choice = getopt(argc, argv, "vfhru:t:d:P:m:F:")) != -1) { + while ((choice = getopt(argc, argv, "vfhru:t:d:P:m:F:T:O:")) != -1) { switch(choice) { case 'v': version(); @@ -200,6 +203,12 @@ main(int argc, char **argv) case 'F': pidfile = optarg; break; + case 'T': + set_qtype(optarg); + break; + case 'O': /* not -D, is Debug in server */ + set_downenc(optarg); + break; default: usage(); /* NOTREACHED */ @@ -234,6 +243,7 @@ main(int argc, char **argv) if (nameserv_addr) { client_set_nameserver(nameserv_addr, DNS_PORT); } else { + warnx("No nameserver found - not connected to any network?\n"); usage(); /* NOTREACHED */ } From 43b4cb8bac7ae176f34620800fec686083dc6dde Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:11:16 +0000 Subject: [PATCH 22/49] #75, update server code --- src/iodined.c | 199 +++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 173 insertions(+), 26 deletions(-) diff --git a/src/iodined.c b/src/iodined.c index 0ff8e25..1d420d8 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -68,6 +68,7 @@ static int running = 1; static char *topdomain; static char password[33]; static struct encoder *b32; +static struct encoder *b64; static int created_users; static int check_ip; @@ -85,7 +86,7 @@ static char *__progname; #endif static int read_dns(int, int, struct query *); -static void write_dns(int, struct query *, char *, int); +static void write_dns(int, struct query *, char *, int, char); static void handle_full_packet(int, int); static void @@ -119,7 +120,7 @@ check_user_and_ip(int userid, struct query *q) if (userid < 0 || userid >= created_users ) { return 1; } - if (!users[userid].active) { + if (!users[userid].active || users[userid].disabled) { return 1; } if (users[userid].last_pkt + 60 < time(NULL)) { @@ -225,7 +226,7 @@ send_version_response(int fd, version_ack_t ack, uint32_t payload, int userid, s out[7] = ((payload) & 0xff); out[8] = userid & 0xff; - write_dns(fd, q, out, sizeof(out)); + write_dns(fd, q, out, sizeof(out), users[userid].downenc); } static void @@ -270,7 +271,7 @@ send_chunk(int dns_fd, int userid) { users[userid].outpacket.seqno & 7, users[userid].outpacket.fragment & 15, last, users[userid].outpacket.offset, datalen, users[userid].outpacket.len, userid); } - write_dns(dns_fd, &users[userid].q, pkt, datalen + 2); + write_dns(dns_fd, &users[userid].q, pkt, datalen + 2, users[userid].downenc); users[userid].q.id = 0; if (users[userid].outpacket.len > 0 && @@ -360,10 +361,21 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) memcpy(&(users[userid].q), q, sizeof(struct query)); users[userid].encoder = get_base32_encoder(); + users[userid].downenc = 'T'; send_version_response(dns_fd, VERSION_ACK, users[userid].seed, userid, q); syslog(LOG_INFO, "accepted version for user #%d from %s", userid, inet_ntoa(tempin->sin_addr)); users[userid].q.id = 0; + users[userid].outpacket.len = 0; + users[userid].outpacket.offset = 0; + users[userid].outpacket.sentlen = 0; + users[userid].outpacket.seqno = 0; + users[userid].outpacket.fragment = 0; + users[userid].inpacket.len = 0; + users[userid].inpacket.offset = 0; + users[userid].inpacket.seqno = 0; + users[userid].inpacket.fragment = 0; + users[userid].fragsize = 100; /* very safe */ } else { /* No space for another user */ send_version_response(dns_fd, VERSION_FULL, created_users, 0, q); @@ -382,7 +394,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) userid = unpacked[0]; if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); syslog(LOG_WARNING, "dropped login request from user #%d from unexpected source %s", userid, inet_ntoa(((struct sockaddr_in *) &q->from)->sin_addr)); return; @@ -401,14 +413,14 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) read = snprintf(out, sizeof(out), "%s-%s-%d-%d", tmp[0], tmp[1], my_mtu, netmask); - write_dns(dns_fd, q, out, read); + write_dns(dns_fd, q, out, read, users[userid].downenc); q->id = 0; syslog(LOG_NOTICE, "accepted password from user #%d, given IP %s", userid, tmp[1]); free(tmp[1]); free(tmp[0]); } else { - write_dns(dns_fd, q, "LNAK", 4); + write_dns(dns_fd, q, "LNAK", 4, 'T'); syslog(LOG_WARNING, "rejected login request from user #%d from %s, bad password", userid, inet_ntoa(((struct sockaddr_in *) &q->from)->sin_addr)); } @@ -422,7 +434,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) userid = b32_8to5(in[1]); if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); return; /* illegal id */ } @@ -440,25 +452,26 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) reply[2] = (addr >> 16) & 0xFF; reply[3] = (addr >> 8) & 0xFF; reply[4] = (addr >> 0) & 0xFF; - write_dns(dns_fd, q, reply, sizeof(reply)); + write_dns(dns_fd, q, reply, sizeof(reply), 'T'); } else if(in[0] == 'Z' || in[0] == 'z') { /* Check for case conservation and chars not allowed according to RFC */ /* Reply with received hostname as data */ - write_dns(dns_fd, q, in, domain_len); + /* No userid here, reply with lowest-grade downenc */ + write_dns(dns_fd, q, in, domain_len, 'T'); return; } else if(in[0] == 'S' || in[0] == 's') { int codec; struct encoder *enc; if (domain_len < 3) { /* len at least 3, example: "S15" */ - write_dns(dns_fd, q, "BADLEN", 6); + write_dns(dns_fd, q, "BADLEN", 6, 'T'); return; } userid = b32_8to5(in[1]); if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); return; /* illegal id */ } @@ -468,15 +481,49 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) case 5: /* 5 bits per byte = base32 */ enc = get_base32_encoder(); user_switch_codec(userid, enc); - write_dns(dns_fd, q, enc->name, strlen(enc->name)); + write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc); break; case 6: /* 6 bits per byte = base64 */ enc = get_base64_encoder(); user_switch_codec(userid, enc); - write_dns(dns_fd, q, enc->name, strlen(enc->name)); + write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc); break; default: - write_dns(dns_fd, q, "BADCODEC", 8); + write_dns(dns_fd, q, "BADCODEC", 8, users[userid].downenc); + break; + } + return; + } else if(in[0] == 'O' || in[0] == 'o') { + if (domain_len != 4) { /* len = 4, example: "O1T." */ + write_dns(dns_fd, q, "BADLEN", 6, 'T'); + return; + } + + userid = b32_8to5(in[1]); + + if (check_user_and_ip(userid, q) != 0) { + write_dns(dns_fd, q, "BADIP", 5, 'T'); + return; /* illegal id */ + } + + switch (in[2]) { + case 'T': + case 't': + users[userid].downenc = 'T'; + write_dns(dns_fd, q, "Base32", 6, users[userid].downenc); + break; + case 'S': + case 's': + users[userid].downenc = 'S'; + write_dns(dns_fd, q, "Base64", 6, users[userid].downenc); + break; + case 'R': + case 'r': + users[userid].downenc = 'R'; + write_dns(dns_fd, q, "Raw", 3, users[userid].downenc); + break; + default: + write_dns(dns_fd, q, "BADCODEC", 8, users[userid].downenc); break; } return; @@ -486,20 +533,26 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) /* Downstream fragsize probe packet */ userid = (b32_8to5(in[1]) >> 1) & 15; if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); return; /* illegal id */ } req_frag_size = ((b32_8to5(in[1]) & 1) << 10) | ((b32_8to5(in[2]) & 31) << 5) | (b32_8to5(in[3]) & 31); if (req_frag_size < 2 || req_frag_size > 2047) { - write_dns(dns_fd, q, "BADFRAG", 7); + write_dns(dns_fd, q, "BADFRAG", 7, users[userid].downenc); } else { char buf[2048]; + int i; + unsigned int v = (unsigned int) rand(); memset(buf, 0, sizeof(buf)); buf[0] = (req_frag_size >> 8) & 0xff; buf[1] = req_frag_size & 0xff; - write_dns(dns_fd, q, buf, req_frag_size); + /* make checkable pseudo-random sequence */ + buf[2] = 107; + for (i = 3; i < 2048; i++, v += 107) + buf[i] = (char) (v & 0xff); + write_dns(dns_fd, q, buf, req_frag_size, users[userid].downenc); } return; } else if(in[0] == 'N' || in[0] == 'n') { @@ -509,16 +562,16 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) /* Downstream fragsize packet */ userid = unpacked[0]; if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); return; /* illegal id */ } max_frag_size = ((unpacked[1] & 0xff) << 8) | (unpacked[2] & 0xff); if (max_frag_size < 2) { - write_dns(dns_fd, q, "BADFRAG", 7); + write_dns(dns_fd, q, "BADFRAG", 7, users[userid].downenc); } else { users[userid].fragsize = max_frag_size; - write_dns(dns_fd, q, &unpacked[1], 2); + write_dns(dns_fd, q, &unpacked[1], 2, users[userid].downenc); } return; } else if(in[0] == 'P' || in[0] == 'p') { @@ -529,7 +582,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) /* Ping packet, store userid */ userid = unpacked[0]; if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); return; /* illegal id */ } @@ -564,7 +617,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) userid = code; /* Check user and sending ip number */ if (check_user_and_ip(userid, q) != 0) { - write_dns(dns_fd, q, "BADIP", 5); + write_dns(dns_fd, q, "BADIP", 5, 'T'); } else { /* Decode data header */ int up_seq = (b32_8to5(in[1]) >> 2) & 7; @@ -637,6 +690,10 @@ handle_ns_request(int dns_fd, struct query *q) } len = dns_encode_ns_response(buf, sizeof(buf), q, topdomain); + if (len < 1) { + warnx("dns_encode_ns_response doesn't fit"); + return; + } if (debug >= 2) { struct sockaddr_in *tempin; @@ -659,6 +716,10 @@ forward_query(int bind_fd, struct query *q) in_addr_t newaddr; len = dns_encode(buf, sizeof(buf), q, QR_QUERY, q->name, strlen(q->name)); + if (len < 1) { + warnx("dns_encode doesn't fit"); + return; + } /* Store sockaddr for q->id */ memcpy(&(fwq.addr), &(q->from), q->fromlen); @@ -755,8 +816,14 @@ tunnel_dns(int tun_fd, int dns_fd, int bind_fd) if (inside_topdomain) { /* This is a query we can handle */ + switch (q.type) { case T_NULL: + case T_CNAME: + case T_A: + case T_MX: + case T_TXT: + /* encoding is "transparent" here */ handle_null_request(tun_fd, dns_fd, &q, domain_len); break; case T_NS: @@ -1044,12 +1111,91 @@ read_dns(int fd, int tun_fd, struct query *q) /* FIXME: tun_fd is because of raw } static void -write_dns(int fd, struct query *q, char *data, int datalen) +write_dns(int fd, struct query *q, char *data, int datalen, char downenc) { char buf[64*1024]; - int len; + int len = 0; - len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, data, datalen); + if (q->type == T_CNAME || q->type == T_A || q->type == T_MX) { + static int td1 = 0; + static int td2 = 0; + char cnamebuf[1024]; /* max 255 */ + size_t space; + char *b; + + /* Make a rotating topdomain to prevent filtering */ + td1+=3; + td2+=7; + if (td1>=26) td1-=26; + if (td2>=25) td2-=25; + + /* encode data,datalen to CNAME/MX answer */ + /* (adapted from build_hostname() in iodine.c) */ + + space = MIN(0xFF, sizeof(cnamebuf)) - 4 - 2; + /* -1 encoding type, -3 ".xy", -2 for safety */ + + memset(cnamebuf, 0, sizeof(cnamebuf)); + + if (downenc == 'S') { + cnamebuf[0] = 'I'; + if (!b64->places_dots()) + space -= (space / 57); /* space for dots */ + b64->encode(cnamebuf+1, &space, data, datalen); + if (!b64->places_dots()) + inline_dotify(cnamebuf, sizeof(cnamebuf), 57); + } else { + cnamebuf[0] = 'H'; + if (!b32->places_dots()) + space -= (space / 57); /* space for dots */ + b32->encode(cnamebuf+1, &space, data, datalen); + if (!b32->places_dots()) + inline_dotify(cnamebuf, sizeof(cnamebuf), 57); + } + + /* Add dot (if it wasn't there already) and topdomain */ + b = cnamebuf; + b += strlen(cnamebuf); + if (*b != '.') + *b++ = '.'; + + *b = 'a' + td1; + b++; + *b = 'a' + td2; + b++; + *b = '\0'; + + len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, cnamebuf, sizeof(cnamebuf)); + } + else if (q->type == T_TXT) { + /* TXT with base32 */ + char txtbuf[64*1024]; + size_t space = sizeof(txtbuf) - 1;; + + memset(txtbuf, 0, sizeof(txtbuf)); + + if (downenc == 'S') { + txtbuf[0] = 'S'; /* plain base64(Sixty-four) */ + len = b64->encode(txtbuf+1, &space, data, datalen); + } + else if (downenc == 'R') { + txtbuf[0] = 'R'; /* Raw binary data */ + len = MIN(datalen, sizeof(txtbuf) - 1); + memcpy(txtbuf + 1, data, len); + } else { + txtbuf[0] = 'T'; /* plain base32(Thirty-two) */ + len = b32->encode(txtbuf+1, &space, data, datalen); + } + len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, txtbuf, len+1); + } else { + /* Normal NULL-record encode */ + len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, data, datalen); + } + + if (len < 1) { + warnx("dns_encode doesn't fit"); + return; + } if (debug >= 2) { struct sockaddr_in *tempin; @@ -1166,6 +1312,7 @@ main(int argc, char **argv) pidfile = NULL; b32 = get_base32_encoder(); + b64 = get_base64_encoder(); retval = 0; From 3b4560505aef819dfa55f1112398fdebd500f153 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:15:25 +0000 Subject: [PATCH 23/49] Remove arg to inline_dotify --- src/iodined.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/iodined.c b/src/iodined.c index 1d420d8..6ce7d98 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -1143,14 +1143,14 @@ write_dns(int fd, struct query *q, char *data, int datalen, char downenc) space -= (space / 57); /* space for dots */ b64->encode(cnamebuf+1, &space, data, datalen); if (!b64->places_dots()) - inline_dotify(cnamebuf, sizeof(cnamebuf), 57); + inline_dotify(cnamebuf, sizeof(cnamebuf)); } else { cnamebuf[0] = 'H'; if (!b32->places_dots()) space -= (space / 57); /* space for dots */ b32->encode(cnamebuf+1, &space, data, datalen); if (!b32->places_dots()) - inline_dotify(cnamebuf, sizeof(cnamebuf), 57); + inline_dotify(cnamebuf, sizeof(cnamebuf)); } /* Add dot (if it wasn't there already) and topdomain */ From a5c6f93fa25cce2fbe689ca4d4949d10dd49d350 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:41:24 +0000 Subject: [PATCH 24/49] Fix data length in encoding dns queries --- src/dns.c | 73 +++++++++++++++++++++++++---------------------------- tests/dns.c | 6 +++-- 2 files changed, 38 insertions(+), 41 deletions(-) diff --git a/src/dns.c b/src/dns.c index a11e130..8f6cae8 100644 --- a/src/dns.c +++ b/src/dns.c @@ -90,47 +90,41 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ putshort(&p, C_IN); putlong(&p, 0); /* TTL */ - if (q->type == T_CNAME || q->type == T_A || q->type == T_MX) - { - /* data is expected to be like "Hblabla.host.name.com\0" */ + if (q->type == T_CNAME || q->type == T_A || q->type == T_MX) { + /* data is expected to be like "Hblabla.host.name.com\0" */ - char *startp = p; - int namelen; + char *startp = p; + int namelen; - p += 2; /* skip 2 bytes length */ - CHECKLEN(2); - if (q->type == T_MX) - putshort(&p, 10); /* preference */ - putname(&p, buflen - (p - buf), data); - CHECKLEN(0); - namelen = p - startp; - namelen -= 2; - putshort(&startp, namelen); - } - else if (q->type == T_TXT) - { - /* TXT has binary or base-X data */ - char *startp = p; - int txtlen; - - p += 2; /* skip 2 bytes length */ - puttxtbin(&p, buflen - (p - buf), data, datalen); - CHECKLEN(0); - txtlen = p - startp; - txtlen -= 2; - putshort(&startp, txtlen); - } - else - { - /* NULL has raw binary data */ - datalen = MIN(datalen, buflen - (p - buf)); - CHECKLEN(2); - putshort(&p, datalen); - CHECKLEN(datalen); - putdata(&p, data, datalen); - CHECKLEN(0); - } + p += 2; /* skip 2 bytes length */ + CHECKLEN(2); + if (q->type == T_MX) + putshort(&p, 10); /* preference */ + putname(&p, buflen - (p - buf), data); + CHECKLEN(0); + namelen = p - startp; + namelen -= 2; + putshort(&startp, namelen); + } else if (q->type == T_TXT) { + /* TXT has binary or base-X data */ + char *startp = p; + int txtlen; + p += 2; /* skip 2 bytes length */ + puttxtbin(&p, buflen - (p - buf), data, datalen); + CHECKLEN(0); + txtlen = p - startp; + txtlen -= 2; + putshort(&startp, txtlen); + } else { + /* NULL has raw binary data */ + datalen = MIN(datalen, buflen - (p - buf)); + CHECKLEN(2); + putshort(&p, datalen); + CHECKLEN(datalen); + putdata(&p, data, datalen); + CHECKLEN(0); + } break; case QR_QUERY: /* Note that iodined also uses this for forward queries */ @@ -138,7 +132,8 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ header->qdcount = htons(1); header->arcount = htons(1); - putname(&p, buflen - (p - buf), data); + datalen = MIN(datalen, buflen - (p - buf)); + putname(&p, datalen, data); CHECKLEN(4); putshort(&p, q->type); diff --git a/tests/dns.c b/tests/dns.c index 55e753b..21745c7 100644 --- a/tests/dns.c +++ b/tests/dns.c @@ -69,8 +69,9 @@ START_TEST(test_encode_query) char *d; size_t len; int ret; + int enclen; - len = sizeof(buf); + enclen = sizeof(resolv); memset(&buf, 0, sizeof(buf)); memset(&resolv, 0, sizeof(resolv)); memset(&q, 0, sizeof(struct query)); @@ -80,12 +81,13 @@ START_TEST(test_encode_query) enc = get_base32_encoder(); *d++ = 'A'; - enc->encode(d, &len, innerData, strlen(innerData)); + enc->encode(d, &enclen, innerData, strlen(innerData)); d = resolv + strlen(resolv); if (*d != '.') { *d++ = '.'; } strcpy(d, topdomain); + len = sizeof(buf); ret = dns_encode(buf, len, &q, QR_QUERY, resolv, strlen(resolv)); len = sizeof(query_packet) - 1; /* Skip extra null character */ From 39d7263a119643a73e8875500318f4ca05a7de7d Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 15:57:00 +0000 Subject: [PATCH 25/49] Fix segfault in test for BSDs --- tests/dns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/dns.c b/tests/dns.c index 21745c7..3d21e4c 100644 --- a/tests/dns.c +++ b/tests/dns.c @@ -68,8 +68,8 @@ START_TEST(test_encode_query) struct encoder *enc; char *d; size_t len; + size_t enclen; int ret; - int enclen; enclen = sizeof(resolv); memset(&buf, 0, sizeof(buf)); From 1e72e7cc78bab123f75e645e730a50e5e6202911 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 16:05:37 +0000 Subject: [PATCH 26/49] Update changelog after #75 --- CHANGELOG | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index c3329c3..e6f5820 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -25,6 +25,8 @@ CHANGES: Based on patch by logix. - Client now prints server tunnel IP, fixes #78. Patch by logix. - Fix build error on Mac OS X 10.6, patch by G. Rischard. #79. + - Added support for CNAME/TXT/A/MX query types, fixes #75. + Patch by Anne Bezemer, merge help by logix. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 From ed36bbdf659a1452a5c0e74e68ca4bdd041e179c Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 16:54:29 +0000 Subject: [PATCH 27/49] Fix mtu fragment size probing --- src/client.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/client.c b/src/client.c index 316a38b..42f44d4 100644 --- a/src/client.c +++ b/src/client.c @@ -1191,11 +1191,12 @@ fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) *max_fragsize = acked_fragsize; return 1; } else { - if (downenc != ' ' && downenc != 'T') + if (downenc != ' ' && downenc != 'T') { fprintf(stderr, "%d corrupted at %d.. (Try -O Base32)\n", acked_fragsize, i); - else + } else { fprintf(stderr, "%d corrupted at %d.. ", acked_fragsize, i); fflush(stderr); + } return 1; } } /* always returns */ @@ -1241,7 +1242,7 @@ handshake_autoprobe_fragsize(int dns_fd) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - if(r >= 2) { + if(r > 0) { read = read_dns(dns_fd, 0, in, sizeof(in)); if (read > 0) { From eb0bf453969d2cbfcac5d713f7a4f21313cb083f Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:38 +0000 Subject: [PATCH 28/49] #76 start merging common and docs --- README | 130 ++++++++++++++++++++++++++++++++++++++++- doc/proto_00000501.txt | 39 +++++++++++++ src/common.c | 15 +++++ src/common.h | 3 + 4 files changed, 185 insertions(+), 2 deletions(-) diff --git a/README b/README index 2763731..5377af3 100644 --- a/README +++ b/README @@ -94,6 +94,41 @@ should always work. For more bandwidth, try Base64 or Raw (TXT only) via the -O option. If Base64/Raw doesn't work, you'll see many failures in the fragment size autoprobe. +Normal operation now is for the server to _not_ answer a DNS request until +the next DNS request has come in, a.k.a. being "lazy". This way, the server +will always have a DNS request handy when new downstream data has to be sent. +This greatly improves (interactive) performance and latency, and allows to +slow down the quiescent ping requests to 4 second intervals by default. +In fact, the main purpose of the pings now is to force a reply to the previous +ping, and prevent DNS server timeouts (usually 5-10 seconds per RFC1035). +In the unlikely case that you do experience DNS server timeouts (SERVFAIL), +decrease the -I option to 1. If you are running on a local network without +any DNS server in-between, try -I 50 (iodine and iodined time out after 60 +seconds). The only time you'll notice a slowdown, is when DNS reply packets +go missing; the iodined server then has to wait for a new ping to re-send the +data. You can speed this up by generating some upstream traffic (keypress, +ping). If this happens often, check your network for bottlenecks and/or run +with -I1 . + +Some DNS servers appear to be quite impatient and start retrying DNS requests +(with _different_ DNS ids!) when an answer does not appear within a few +milliseconds. Usually they scale back retries when iodined's lazy mode +repeatedly takes several seconds to answer; and they scale up retries again +when iodined answers fast during heavy data transfer. Some commercial DNS +servers advertise this as "carrier-grade adaptive retransmission techniques". +The effect will only be visible in the network traffic at the iodined server, +and will not affect the client's connection. Iodined has rather elaborate +logic to deal with (i.e., ignore) these unwanted duplicates. + +Other DNS servers, notably the opendns.com network, seem to regard iodined's +lazyness as incompetency, and will start shuffling requests around, possibly +in an attempt to reduce iodined's workload. The resulting out-of-sequence DNS +traffic works quite badly for lazy mode. The iodine client will detect this, +and switch back to legacy mode ("immediate ping-pong") automatically. In these +cases, start the iodine client with -L0 to prevent it from operating in lazy +mode altogether. Note that this will negatively affect interactive performance +and latency, especially in the downstream direction. + If you have problems, try inspecting the traffic with network monitoring tools and make sure that the relaying DNS server has not cached the response. A cached error message could mean that you started the client before the server. @@ -109,12 +144,103 @@ iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to :5353 (Sent in by Tom Schouten) Iodined will reject data from clients that have not been active (data/pings) -for more than 60 seconds. In case of a long network outage or similar, just -stop iodine and restart (re-login), possibly multiple times until you get +for more than 60 seconds. Similarly, iodine will exit when no downstream +data has been received for 60 seconds. In case of a long network outage or +similar, just restart iodine (re-login), possibly multiple times until you get your old IP address back. Once that's done, just wait a while, and you'll eventually see the tunneled TCP traffic continue to flow from where it left off before the outage. +With the introduction of the downstream packet queue in the server, its memory +usage has increased with several megabytes in the default configuration. +For use in low-memory environments (e.g. running on your DSL router), you can +decrease USERS and undefine OUTPACKETQ_LEN in user.h without any ill conse- +quence, assuming at most one client will be connected at any time. A small +DNSCACHE_LEN is still advised, preferably 2 or higher, however you can also +undefine it to save a few more kilobytes. + + +PERFORMANCE: + +This section tabulates some performance measurements. To view properly, use +a fixed-width font like Courier. + +Measurements were done in protocol 00000500 with lazy mode unless indicated +otherwise. Upstream encoding always Base64. +Upstream/downstream throughput was measured by scp'ing a file previously +read from /dev/urandom (i.e. incompressible), and measuring size with +"ls -l ; sleep 30 ; ls -l" on a separate non-tunneled connection. Given the +large scp block size of 16 kB, this gives a resolution of 4.3 kbit/s, which +explains why many values are exactly equal. +Ping round-trip times measured with "ping -c100", presented are average rtt +and mean deviation (indicating spread around the average), in milliseconds. + + +Situation 1: +Laptop -> Wifi AP -> Home server -> DSL provider -> Datacenter + iodine DNS "relay" bind9 DNS cache iodined + + downstr. upstream downstr. ping-up ping-down + fragsize kbit/s kbit/s avg +/-mdev avg +/-mdev +------------------------------------------------------------------------------ + +iodine -> Wifi AP :53 + -Tnull (= -Oraw) 982 39.3 148.5 26.7 3.1 26.6 3.0 + +iodine -> Home server :53 + -Tnull (= -Oraw) 1174 43.6 174.7 25.2 4.0 25.5 3.4 + +iodine -> DSL provider :53 + -Tnull (= -Oraw) 1174 52.4 200.9 20.3 3.2 20.3 2.7 + -Ttxt -Obase32 730 52.4 192.2* + -Ttxt -Obase64 874 52.4 192.2 + -Ttxt -Oraw 1162 52.4 192.2 + -Tcname -Obase32 148 52.4 48.0 + -Tcname -Obase64 181 52.4 61.1 + +iodine -> DSL provider :53 + wired (no Wifi) -Tnull 1174 65.5 244.6 17.7 1.9 17.8 1.6 + + [192.2* : nice, because still 2frag/packet] + + +Situation 2: +Laptop -> (wire) -> (Home server) -> (DSL) -> opendns.com -> Datacenter + iodine DNS cache iodined + + downstr. upstream downstr. ping-up ping-down + fragsize kbit/s kbit/s avg +/-mdev avg +/-mdev +------------------------------------------------------------------------------ + +iodine -> opendns.com :53 + -Tnull -L1 (lazy mode) 230 - - 404.4 196.2 663.8 679.6 + (20% lost) (2% lost) + + -Tnull -L0 (legacy mode) 230 5.6 7.4 197.3 4.7 610.8 323.5 + + [Note: Throughput measured over 300 seconds to get better resolution] + + +Situation 3: +Laptop -> Wifi+vpn / wired -> Home server + iodine iodined + + downstr. upstream downstr. ping-up ping-down + fragsize kbit/s kbit/s avg +/-mdev avg +/-mdev +------------------------------------------------------------------------------ + +wifi + openvpn -Tnull 1186 183.5 611.6 5.7 1.4 7.0 2.7 + +wired -Tnull 1186 685.9 2350.5 1.3 0.1 1.4 0.4 + + +Performance is strongly coupled to low ping times, as iodine requires +confirmation for every data fragment before moving on to the next. Allowing +multiple fragments in-flight like TCP could possibly increase performance, +but it would likely cause serious overload for the intermediary DNS servers. +The current protocol scales performance with DNS responsivity, since the +DNS servers are on average handling at most one DNS request per client. + PORTABILITY: diff --git a/doc/proto_00000501.txt b/doc/proto_00000501.txt index 486083a..9bc37ca 100644 --- a/doc/proto_00000501.txt +++ b/doc/proto_00000501.txt @@ -83,6 +83,12 @@ Server sends: Server may disregard this option; client must always use the downstream encoding type indicated in every downstream DNS packet. + l or L: Lazy mode, server will keep one request unanswered until the + next one comes in. Applies only to data transfer; handshake is always + answered immediately. + i or I: Immediate (non-lazy) mode, server will answer all requests + (nearly) immediately. + Probe downstream fragment size: Client sends: First byte r or R @@ -160,6 +166,39 @@ The server response to Ping and Data packets is a DNS NULL type response: If server has nothing to send, data length is 0 bytes. If server has something to send, it will send a downstream data packet, prefixed with 2 bytes header as shown above. + + +"Lazy-mode" operation +===================== + +Client-server DNS traffic sequence has been reordered to provide increased +(interactive) performance and greatly reduced latency. + +Idea taken from Lucas Nussbaum's slides (24th IFIP International Security +Conference, 2009) at http://www.loria.fr/~lnussbau/tuns.html. Current +implementation is original to iodine, no code or documentation from any other +project was consulted during development. + +Server: +Upstream data is acked immediately*, to keep the slow upstream data flowing +as fast as possible (client waits for ack to send next frag). + +Upstream pings are answered _only_ when 1) downstream data arrives from tun, +OR 2) new upstream ping/data arrives from client. +In most cases, this means we answer the previous DNS query instead of the +current one. The current query is kept in queue and used as soon as +downstream data has to be sent. + +*: upstream data ack is usually done as reply on the previous ping packet, +and the upstream-data packet itself is kept in queue. + +Client: +Downstream data is acked immediately, to keep it flowing fast (includes a +ping after last downstream frag). + +Also, after all available upstream data is sent & acked by the server (which +in some cases uses up the last query), send an additional ping to prime the +server for the next downstream data. ====================================================== diff --git a/src/common.c b/src/common.c index b1f197b..dd2bf2d 100644 --- a/src/common.c +++ b/src/common.c @@ -333,3 +333,18 @@ errx(int eval, const char *fmt, ...) } #endif + +int recent_seqno(int ourseqno, int gotseqno) +/* Return 1 if we've seen gotseqno recently (current or up to 3 back). + Return 0 if gotseqno is new (or very old). +*/ +{ + int i; + for (i = 0; i < 4; i++, ourseqno--) { + if (ourseqno < 0) + ourseqno = 7; + if (gotseqno == ourseqno) + return 1; + } + return 0; +} diff --git a/src/common.h b/src/common.h index 12c91d2..32dd206 100644 --- a/src/common.h +++ b/src/common.h @@ -88,6 +88,7 @@ struct query { char name[QUERY_NAME_SIZE]; unsigned short type; unsigned short id; + unsigned short iddupe; /* only used for dupe checking */ struct in_addr destination; struct sockaddr from; int fromlen; @@ -121,4 +122,6 @@ void errx(int eval, const char *fmt, ...); void warnx(const char *fmt, ...); #endif +int recent_seqno(int , int); + #endif From 92ea4656530fc85dd82376883767c4c593deb121 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:39 +0000 Subject: [PATCH 29/49] #76 merge dns and user --- src/dns.c | 7 +++++++ src/iodined.c | 1 + src/user.c | 25 +++++++++++++++---------- src/user.h | 23 +++++++++++++++++++++++ 4 files changed, 46 insertions(+), 10 deletions(-) diff --git a/src/dns.c b/src/dns.c index 8f6cae8..80c31e8 100644 --- a/src/dns.c +++ b/src/dns.c @@ -356,6 +356,13 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz readshort(packet, &data, &type); readshort(packet, &data, &class); + /* if CHECKLEN okay, then we're sure to have a proper name */ + if (q != NULL) { + /* We only need the first char to check it */ + q->name[0] = name[0]; + q->name[1] = '\0'; + } + /* Assume that first answer is NULL/CNAME that we wanted */ readname(packet, packetlen, &data, name, sizeof(name)); CHECKLEN(10); diff --git a/src/iodined.c b/src/iodined.c index 6ce7d98..8babe62 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -376,6 +376,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) users[userid].inpacket.seqno = 0; users[userid].inpacket.fragment = 0; users[userid].fragsize = 100; /* very safe */ + users[userid].conn = CONN_DNS_NULL; } else { /* No space for another user */ send_version_response(dns_fd, VERSION_FULL, created_users, 0, q); diff --git a/src/user.c b/src/user.c index 32b35c1..b2e8f04 100644 --- a/src/user.c +++ b/src/user.c @@ -78,14 +78,8 @@ init_users(in_addr_t my_ip, int netbits) users[i].disabled = 0; created_users++; } - users[i].inpacket.len = 0; - users[i].inpacket.offset = 0; - users[i].outpacket.len = 0; - users[i].q.id = 0; - users[i].out_acked_seqno = 0; - users[i].out_acked_fragment = 0; - users[i].fragsize = 4096; - users[i].conn = CONN_DNS_NULL; + users[i].active = 0; + /* Rest is reset on login ('V' packet) */ } return created_users; @@ -129,6 +123,11 @@ find_user_by_ip(uint32_t ip) int all_users_waiting_to_send() +/* If this returns true, then reading from tun device is blocked. + So only return true when all clients have at least one packet in + the outpacket-queue, so that sending back-to-back is possible + without going through another select loop. +*/ { time_t now; int ret; @@ -139,8 +138,14 @@ all_users_waiting_to_send() for (i = 0; i < USERS; i++) { if (users[i].active && !users[i].disabled && users[i].last_pkt + 60 > now && - ((users[i].outpacket.len == 0 && users[i].conn == CONN_DNS_NULL) - || users[i].conn == CONN_RAW_UDP)) { + ((users[i].conn == CONN_RAW_UDP) || + ((users[i].conn == CONN_DNS_NULL) +#ifdef OUTPACKETQ_LEN + && users[i].outpacketq_filled < 1 +#else + && users[i].outpacket.len == 0 +#endif + ))) { ret = 0; break; diff --git a/src/user.h b/src/user.h index 6058a8d..d3f81b4 100644 --- a/src/user.h +++ b/src/user.h @@ -19,6 +19,13 @@ #define USERS 16 +#define OUTPACKETQ_LEN 4 /* Note: 16 users * 1 packet = 1MB */ +/* Undefine to have no queue for packets coming in from tun device, which may + lead to massive dropping in multi-user situations with high traffic. */ + +#define DNSCACHE_LEN 4 +/* Undefine to disable. MUST be less than 7; also see comments in iodined.c */ + struct user { char id; int active; @@ -28,14 +35,30 @@ struct user { in_addr_t tun_ip; struct in_addr host; struct query q; + struct query q_prev; + struct query q_sendrealsoon; + int q_sendrealsoon_new; struct packet inpacket; struct packet outpacket; + int outfragresent; struct encoder *encoder; char downenc; int out_acked_seqno; int out_acked_fragment; int fragsize; enum connection conn; + int lazy; +#ifdef OUTPACKETQ_LEN + struct packet outpacketq[OUTPACKETQ_LEN]; + int outpacketq_nexttouse; + int outpacketq_filled; +#endif +#ifdef DNSCACHE_LEN + struct query dnscache_q[DNSCACHE_LEN]; + char dnscache_answer[DNSCACHE_LEN][4096]; + int dnscache_answerlen[DNSCACHE_LEN]; + int dnscache_lastfilled; +#endif }; extern struct user users[USERS]; From 3348a533a38e177255c5a9031abfebd652ee43a4 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:41 +0000 Subject: [PATCH 30/49] #76 merge server code --- src/iodined.c | 905 +++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 742 insertions(+), 163 deletions(-) diff --git a/src/iodined.c b/src/iodined.c index 8babe62..d4314cf 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -87,7 +87,7 @@ static char *__progname; static int read_dns(int, int, struct query *); static void write_dns(int, struct query *, char *, int, char); -static void handle_full_packet(int, int); +static void handle_full_packet(int, int, int); static void sigint(int sig) @@ -156,6 +156,250 @@ send_raw(int fd, char *buf, int buflen, int user, int cmd, struct query *q) } +static void +start_new_outpacket(int userid, char *data, int datalen) +/* Copies data to .outpacket and resets all counters. + data is expected to be compressed already. */ +{ + datalen = MIN(datalen, sizeof(users[userid].outpacket.data)); + memcpy(users[userid].outpacket.data, data, datalen); + users[userid].outpacket.len = datalen; + users[userid].outpacket.offset = 0; + users[userid].outpacket.sentlen = 0; + users[userid].outpacket.seqno = (users[userid].outpacket.seqno + 1) & 7; + users[userid].outpacket.fragment = 0; + users[userid].outfragresent = 0; +} + +#ifdef OUTPACKETQ_LEN + +static int +save_to_outpacketq(int userid, char *data, int datalen) +/* Find space in outpacket-queue and store data (expected compressed already). + Returns: 1 = okay, 0 = no space. */ +{ + int fill; + + if (users[userid].outpacketq_filled >= OUTPACKETQ_LEN) + /* no space */ + return 0; + + fill = users[userid].outpacketq_nexttouse + + users[userid].outpacketq_filled; + if (fill >= OUTPACKETQ_LEN) + fill -= OUTPACKETQ_LEN; + + datalen = MIN(datalen, sizeof(users[userid].outpacketq[fill].data)); + memcpy(users[userid].outpacketq[fill].data, data, datalen); + users[userid].outpacketq[fill].len = datalen; + + users[userid].outpacketq_filled++; + + if (debug >= 3) + fprintf(stderr, " Qstore, now %d\n", + users[userid].outpacketq_filled); + + return 1; +} + +static int +get_from_outpacketq(int userid) +/* Starts new outpacket from queue, if any. + Returns: 1 = okay, 0 = no packets were waiting. */ +{ + int use; + + if (users[userid].outpacketq_filled <= 0) + /* no packets */ + return 0; + + use = users[userid].outpacketq_nexttouse; + + start_new_outpacket(userid, users[userid].outpacketq[use].data, + users[userid].outpacketq[use].len); + + use++; + if (use >= OUTPACKETQ_LEN) + use = 0; + users[userid].outpacketq_nexttouse = use; + users[userid].outpacketq_filled--; + + if (debug >= 3) + fprintf(stderr, " Qget, now %d\n", + users[userid].outpacketq_filled); + + return 1; +} + +#endif /* OUTPACKETQ_LEN */ + +#ifdef DNSCACHE_LEN + +/* On the DNS cache: + + This cache is implemented to better handle the aggressively impatient DNS + servers that very quickly re-send requests when we choose to not + immediately answer them in lazy mode. This cache works much better than + pruning(=dropping) the improper requests, since the DNS server will + actually get an answer instead of silence. + + We normally use either CMC (ping) or seqno/frag (upstream data) to prevent + cache hits on in-between caching DNS servers. Also, the iodine client is + designed to mostly operate properly when cached results are returned. + Two cache-hit situations: + - Repeated DNS query when our ack got lost: has same seqno/frag and doesn't + have CMC; but the client will not have sent any new data or pings + in-between, so this is always cacheable. Even in lazy mode, since we send + the first answer to the actual DNS query only on receipt of the first + client retransmit. + - Identical second+ fragment of mod-8 packets ago, same seqno/frag and no + TCP counter in those fragments to tell them apart. This is _not_ + cachable, so our cache length should never exceed 7 packets. +*/ + +static void +save_to_dnscache(int userid, struct query *q, char *answer, int answerlen) +/* Store answer in our little DNS cache. */ +{ + int fill; + + if (answerlen > sizeof(users[userid].dnscache_answer[fill])) + return; /* can't store this */ + + fill = users[userid].dnscache_lastfilled + 1; + if (fill >= DNSCACHE_LEN) + fill = 0; + + memcpy(&(users[userid].dnscache_q[fill]), q, sizeof(struct query)); + memcpy(users[userid].dnscache_answer[fill], answer, answerlen); + users[userid].dnscache_answerlen[fill] = answerlen; + + users[userid].dnscache_lastfilled = fill; +} + +static int +answer_from_dnscache(int dns_fd, int userid, struct query *q) +/* Checks cache and sends repeated answer if we alreay saw this query recently. + Returns: 1 = answer sent, drop this query, 0 = no answer sent, this is + a new query. */ +{ + int i; + int use; + + for (i = 0; i < DNSCACHE_LEN ; i++) { + /* Try cache most-recent-first */ + use = users[userid].dnscache_lastfilled - i; + if (use < 0) + use += DNSCACHE_LEN; + + if (users[userid].dnscache_q[use].id == 0) + continue; + if (users[userid].dnscache_answerlen[use] <= 0) + continue; + + if (users[userid].dnscache_q[use].type != q->type || + strcmp(users[userid].dnscache_q[use].name, q->name)) + continue; + + /* okay, match */ + write_dns(dns_fd, q, users[userid].dnscache_answer[use], + users[userid].dnscache_answerlen[use], + users[userid].downenc); + + q->id = 0; /* this query was used */ + return 1; + } + + /* here only when no match found */ + return 0; +} + +#endif /* DNSCACHE_LEN */ + +static int +send_chunk_or_dataless(int dns_fd, int userid, struct query *q) +/* Sends current fragment to user, or dataless packet if there is no + current fragment available (-> normal "quiet" ping reply). + Does not update anything, except: + - discards q always (query is used) + - forgets entire users[userid].outpacket if it was sent in one go, + and then tries to get new packet from outpacket-queue + Returns: 1 = can call us again immediately, new packet from queue; + 0 = don't call us again for now. +*/ +{ + char pkt[4096]; + int datalen = 0; + int last = 0; + + /* If re-sent too many times, drop entire packet */ + if (users[userid].outpacket.len > 0 && + users[userid].outfragresent > 5) { + users[userid].outpacket.len = 0; + users[userid].outpacket.offset = 0; + users[userid].outpacket.sentlen = 0; + users[userid].outfragresent = 0; + +#ifdef OUTPACKETQ_LEN + /* Maybe more in queue, use immediately */ + get_from_outpacketq(userid); +#endif + } + + if (users[userid].outpacket.len > 0) { + datalen = MIN(users[userid].fragsize, users[userid].outpacket.len - users[userid].outpacket.offset); + datalen = MIN(datalen, sizeof(pkt)-2); + + memcpy(&pkt[2], users[userid].outpacket.data + users[userid].outpacket.offset, datalen); + users[userid].outpacket.sentlen = datalen; + last = (users[userid].outpacket.len == users[userid].outpacket.offset + datalen); + + users[userid].outfragresent++; + } + + /* Build downstream data header (see doc/proto_xxxxxxxx.txt) */ + + /* First byte is 1 bit compression flag, 3 bits upstream seqno, 4 bits upstream fragment */ + pkt[0] = (1<<7) | ((users[userid].inpacket.seqno & 7) << 4) | + (users[userid].inpacket.fragment & 15); + /* Second byte is 3 bits downstream seqno, 4 bits downstream fragment, 1 bit last flag */ + pkt[1] = ((users[userid].outpacket.seqno & 7) << 5) | + ((users[userid].outpacket.fragment & 15) << 1) | (last & 1); + + if (debug >= 1) { + fprintf(stderr, "OUT pkt seq# %d, frag %d (last=%d), offset %d, fragsize %d, total %d, to user %d\n", + users[userid].outpacket.seqno & 7, users[userid].outpacket.fragment & 15, + last, users[userid].outpacket.offset, datalen, users[userid].outpacket.len, userid); + } + write_dns(dns_fd, q, pkt, datalen + 2, users[userid].downenc); + +#ifdef DNSCACHE_LEN + save_to_dnscache(userid, q, pkt, datalen + 2); +#endif + + q->id = 0; /* this query is used */ + /* .iddupe is _not_ reset on purpose */ + + if (datalen > 0 && datalen == users[userid].outpacket.len) { + /* Whole packet was sent in one chunk, dont wait for ack */ + users[userid].outpacket.len = 0; + users[userid].outpacket.offset = 0; + users[userid].outpacket.sentlen = 0; + users[userid].outfragresent = 0; + +#ifdef OUTPACKETQ_LEN + /* Maybe more in queue, prepare for next time */ + if (get_from_outpacketq(userid) == 1) { + if (debug >= 3) + fprintf(stderr, " Chunk & fromqueue: callagain\n"); + return 1; /* call us again */ + } +#endif + } + + return 0; /* don't call us again */ +} + static int tunnel_tun(int tun_fd, int dns_fd) { @@ -179,18 +423,25 @@ tunnel_tun(int tun_fd, int dns_fd) compress2((uint8_t*)out, &outlen, (uint8_t*)in, read, 9); if (users[userid].conn == CONN_DNS_NULL) { - /* if another packet is queued, throw away this one. TODO build queue */ - if (users[userid].outpacket.len == 0) { - memcpy(users[userid].outpacket.data, out, outlen); - users[userid].outpacket.len = outlen; - users[userid].outpacket.offset = 0; - users[userid].outpacket.sentlen = 0; - users[userid].outpacket.seqno = (++users[userid].outpacket.seqno & 7); - users[userid].outpacket.fragment = 0; - return outlen; - } else { +#ifdef OUTPACKETQ_LEN + /* If a packet is being sent, try storing the new one in the queue. + If the queue is full, drop the packet. TCP will hopefully notice + and reduce the packet rate. */ + if (users[userid].outpacket.len > 0) { + save_to_outpacketq(userid, out, outlen); return 0; } +#endif + + start_new_outpacket(userid, out, outlen); + + /* Start sending immediately if query is waiting */ + if (users[userid].q_sendrealsoon.id != 0) + send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon); + else if (users[userid].q.id != 0) + send_chunk_or_dataless(dns_fd, userid, &users[userid].q); + + return outlen; } else { /* CONN_RAW_UDP */ send_raw(dns_fd, out, outlen, userid, RAW_HDR_CMD_DATA, &users[userid].q); return outlen; @@ -230,93 +481,40 @@ send_version_response(int fd, version_ack_t ack, uint32_t payload, int userid, s } static void -send_chunk(int dns_fd, int userid) { - char pkt[4096]; - int datalen; - int last; +process_downstream_ack(int userid, int down_seq, int down_frag) +/* Process acks from downstream fragments. + After this, .offset and .fragment are updated (if ack correct), + or .len is set to zero when all is done. +*/ +{ + if (users[userid].outpacket.len <= 0) + /* No packet to apply acks to */ + return; - datalen = MIN(users[userid].fragsize, users[userid].outpacket.len - users[userid].outpacket.offset); + if (users[userid].outpacket.seqno != down_seq || + users[userid].outpacket.fragment != down_frag) + /* Not the ack we're waiting for; probably duplicate of old + ack, happens a lot with ping packets */ + return; - if (datalen && users[userid].outpacket.sentlen > 0 && - ( - users[userid].outpacket.seqno != users[userid].out_acked_seqno || - users[userid].outpacket.fragment != users[userid].out_acked_fragment - ) - ) { + /* Received proper ack */ + users[userid].outpacket.offset += users[userid].outpacket.sentlen; + users[userid].outpacket.sentlen = 0; + users[userid].outpacket.fragment++; + users[userid].outfragresent = 0; - /* Still waiting on latest ack, send nothing */ - datalen = 0; - last = 0; - /* TODO : count down and discard packet if no acks arrive within X queries */ - } else { - memcpy(&pkt[2], &users[userid].outpacket.data[users[userid].outpacket.offset], datalen); - users[userid].outpacket.sentlen = datalen; - last = (users[userid].outpacket.len == users[userid].outpacket.offset + users[userid].outpacket.sentlen); - - /* Increase fragment# when sending data with offset */ - if (users[userid].outpacket.offset && datalen) - users[userid].outpacket.fragment++; - } - - /* Build downstream data header (see doc/proto_xxxxxxxx.txt) */ - - /* First byte is 1 bit compression flag, 3 bits upstream seqno, 4 bits upstream fragment */ - pkt[0] = (1<<7) | ((users[userid].inpacket.seqno & 7) << 4) | (users[userid].inpacket.fragment & 15); - /* Second byte is 3 bits downstream seqno, 4 bits downstream fragment, 1 bit last flag */ - pkt[1] = ((users[userid].outpacket.seqno & 7) << 5) | - ((users[userid].outpacket.fragment & 15) << 1) | (last & 1); - - if (debug >= 1) { - fprintf(stderr, "OUT pkt seq# %d, frag %d (last=%d), offset %d, fragsize %d, total %d, to user %d\n", - users[userid].outpacket.seqno & 7, users[userid].outpacket.fragment & 15, - last, users[userid].outpacket.offset, datalen, users[userid].outpacket.len, userid); - } - write_dns(dns_fd, &users[userid].q, pkt, datalen + 2, users[userid].downenc); - users[userid].q.id = 0; - - if (users[userid].outpacket.len > 0 && - users[userid].outpacket.len == users[userid].outpacket.sentlen) { - - /* Whole packet was sent in one chunk, dont wait for ack */ + /* Is packet done? */ + if (users[userid].outpacket.offset == users[userid].outpacket.len) { users[userid].outpacket.len = 0; users[userid].outpacket.offset = 0; - users[userid].outpacket.sentlen = 0; - } -} + users[userid].outpacket.fragment--; /* unneeded ++ above */ + /* last seqno/frag are always returned on pings */ + /* users[userid].outfragresent = 0; already above */ -static void -update_downstream_seqno(int dns_fd, int userid, int down_seq, int down_frag) -{ - /* If we just read a new packet from tun we have not sent a fragment of, just send it */ - if (users[userid].outpacket.len > 0 && users[userid].outpacket.sentlen == 0) { - send_chunk(dns_fd, userid); - return; - } - - /* otherwise, check if we received ack on a fragment and can send next */ - if (users[userid].outpacket.len > 0 && - users[userid].outpacket.seqno == down_seq && users[userid].outpacket.fragment == down_frag) { - - if (down_seq != users[userid].out_acked_seqno || down_frag != users[userid].out_acked_fragment) { - /* Received ACK on downstream fragment */ - users[userid].outpacket.offset += users[userid].outpacket.sentlen; - users[userid].outpacket.sentlen = 0; - - /* Is packet done? */ - if (users[userid].outpacket.offset == users[userid].outpacket.len) { - users[userid].outpacket.len = 0; - users[userid].outpacket.offset = 0; - users[userid].outpacket.sentlen = 0; - } - - users[userid].out_acked_seqno = down_seq; - users[userid].out_acked_fragment = down_frag; - - /* Send reply if waiting */ - if (users[userid].outpacket.len > 0) { - send_chunk(dns_fd, userid); - } - } +#ifdef OUTPACKETQ_LEN + /* Possibly get new packet from queue */ + get_from_outpacketq(userid); +#endif } } @@ -334,6 +532,10 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) userid = -1; + /* Everything here needs at least two chars in the name */ + if (domain_len < 2) + return; + memcpy(in, q->name, MIN(domain_len, sizeof(in))); if(in[0] == 'V' || in[0] == 'v') { @@ -366,17 +568,38 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) syslog(LOG_INFO, "accepted version for user #%d from %s", userid, inet_ntoa(tempin->sin_addr)); users[userid].q.id = 0; + users[userid].q.iddupe = 0; + users[userid].q_prev.id = 0; + users[userid].q_prev.iddupe = 0; + users[userid].q_sendrealsoon.id = 0; + users[userid].q_sendrealsoon_new = 0; users[userid].outpacket.len = 0; users[userid].outpacket.offset = 0; users[userid].outpacket.sentlen = 0; users[userid].outpacket.seqno = 0; users[userid].outpacket.fragment = 0; + users[userid].outfragresent = 0; users[userid].inpacket.len = 0; users[userid].inpacket.offset = 0; users[userid].inpacket.seqno = 0; users[userid].inpacket.fragment = 0; users[userid].fragsize = 100; /* very safe */ users[userid].conn = CONN_DNS_NULL; + users[userid].lazy = 0; +#ifdef OUTPACKETQ_LEN + users[userid].outpacketq_nexttouse = 0; + users[userid].outpacketq_filled = 0; +#endif +#ifdef DNSCACHE_LEN + { + int i; + for (i = 0; i < DNSCACHE_LEN; i++) { + users[userid].dnscache_q[i].id = 0; + users[userid].dnscache_answerlen[i] = 0; + } + } + users[userid].dnscache_lastfilled = 0; +#endif } else { /* No space for another user */ send_version_response(dns_fd, VERSION_FULL, created_users, 0, q); @@ -523,6 +746,16 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) users[userid].downenc = 'R'; write_dns(dns_fd, q, "Raw", 3, users[userid].downenc); break; + case 'L': + case 'l': + users[userid].lazy = 1; + write_dns(dns_fd, q, "Lazy", 4, users[userid].downenc); + break; + case 'I': + case 'i': + users[userid].lazy = 0; + write_dns(dns_fd, q, "Immediate", 9, users[userid].downenc); + break; default: write_dns(dns_fd, q, "BADCODEC", 8, users[userid].downenc); break; @@ -578,36 +811,166 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) } else if(in[0] == 'P' || in[0] == 'p') { int dn_seq; int dn_frag; - + int didsend = 0; + + /* We can't handle id=0, that's "no packet" to us. So drop + request completely. Note that DNS servers rewrite the id. + We'll drop 1 in 64k times. If DNS server retransmits with + different id, then all okay. + Else client won't retransmit, and we'll just keep the + previous ping in cache, no problem either. */ + if (q->id == 0) + return; + read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32); + if (read < 4) + return; + /* Ping packet, store userid */ userid = unpacked[0]; if (check_user_and_ip(userid, q) != 0) { write_dns(dns_fd, q, "BADIP", 5, 'T'); return; /* illegal id */ } + +#ifdef DNSCACHE_LEN + /* Check if cached */ + if (answer_from_dnscache(dns_fd, userid, q)) { + /* Answer sent. But if this is our currently waiting + request in the queue, invalidate now since we can't + be sure that our coming new answer will ever reach + client. Happens on 3+ retransmits in the "lost pings + problem" with agressive DNS server. + */ + if (users[userid].q.id != 0 && + q->type == users[userid].q.type && + !strcmp(q->name, users[userid].q.name)) + users[userid].q.id = 0; + return; + } +#endif + + /* Dupe pruning */ + if (users[userid].q.iddupe != 0 && + q->type == users[userid].q.type && + !strcmp(q->name, users[userid].q.name) && + users[userid].lazy) { + /* We have this ping already. Aggressively impatient + DNS servers resend queries with _different_ id. + But hostname check is sufficient, includes CMC. + Just drop this ping. + If we already answered it (e.g. data available some + milliseconds ago), DNS server should have noticed + by now (race condition, happens rarely). + If we didn't answer yet, we'll do later (to the + first id, thank you very much). */ + if (debug >= 2) { + fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, ignoring\n", + userid); + } + return; + } + + if (users[userid].q_prev.iddupe != 0 && + q->type == users[userid].q_prev.type && + !strcmp(q->name, users[userid].q_prev.name) && + users[userid].lazy) { + /* Okay, even older ping that we already saw + and probably answered just milliseconds ago. + This is a race condition that agressive DNS servers + actually train into; happens quite often. + Just drop this new version. */ + /* If using dnscache, this new query probably got a + cached answer already, and this shouldn't trigger. */ + if (debug >= 2) { + fprintf(stderr, "PING pkt from user %d = dupe (previous) from impatient DNS server, ignoring\n", + userid); + } + return; + } + + if (users[userid].q_sendrealsoon.id != 0 && + q->type == users[userid].q_sendrealsoon.type && + !strcmp(q->name, users[userid].q_sendrealsoon.name)) { + /* Outer select loop will send answer immediately. */ + if (debug >= 2) { + fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, ignoring\n", + userid); + } + return; + } - if (debug >= 1) { - fprintf(stderr, "PING pkt from user %d\n", userid); - } - - if (users[userid].q.id != 0) { - /* Send reply on earlier query before overwriting */ - send_chunk(dns_fd, userid); - } - dn_seq = unpacked[1] >> 4; dn_frag = unpacked[1] & 15; + + if (debug >= 1) { + fprintf(stderr, "PING pkt from user %d, ack for downstream %d/%d\n", + userid, dn_seq, dn_frag); + } + + process_downstream_ack(userid, dn_seq, dn_frag); + + if (debug >= 3) { + fprintf(stderr, "PINGret (if any) will ack upstream %d/%d\n", + users[userid].inpacket.seqno, users[userid].inpacket.fragment); + } + + /* If there is a query that must be returned real soon, do it. + May contain new downstream data if the ping had a new ack. + Otherwise, may also be re-sending old data. */ + if (users[userid].q_sendrealsoon.id != 0) { + send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon); + } + + /* We need to store a new query, so if there still is an + earlier query waiting, always send a reply to finish it. + May contain new downstream data if the ping had a new ack. + Otherwise, may also be re-sending old data. + (This is duplicate data if we had q_sendrealsoon above.) */ + if (users[userid].q.id != 0) { + didsend = 1; + if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q) == 1) + /* new packet from queue, send immediately */ + didsend = 0; + } + + /* Save previous query for dupe checking */ + memcpy(&(users[userid].q_prev), &(users[userid].q), + sizeof(struct query)); + + /* Save new query and time info */ memcpy(&(users[userid].q), q, sizeof(struct query)); users[userid].last_pkt = time(NULL); - /* Update seqno and maybe send immediate response packet */ - update_downstream_seqno(dns_fd, userid, dn_seq, dn_frag); + /* If anything waiting and we didn't already send above, send + it now. And always send immediately if we're not lazy + (then above won't have sent at all). */ + if ((!didsend && users[userid].outpacket.len > 0) || + !users[userid].lazy) + send_chunk_or_dataless(dns_fd, userid, &users[userid].q); + } else if((in[0] >= '0' && in[0] <= '9') || (in[0] >= 'a' && in[0] <= 'f') || (in[0] >= 'A' && in[0] <= 'F')) { + int up_seq, up_frag, dn_seq, dn_frag, lastfrag; + int upstream_ok = 1; + int didsend = 0; + int thisisdupe = 0; int code = -1; + /* Need 4char header + >=1 char data */ + if (domain_len < 5) + return; + + /* We can't handle id=0, that's "no packet" to us. So drop + request completely. Note that DNS servers rewrite the id. + We'll drop 1 in 64k times. If DNS server retransmits with + different id, then all okay. + Else client doesn't get our ack, and will retransmit in + 1 second. */ + if (q->id == 0) + return; + if ((in[0] >= '0' && in[0] <= '9')) code = in[0] - '0'; if ((in[0] >= 'a' && in[0] <= 'f')) @@ -619,47 +982,152 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) /* Check user and sending ip number */ if (check_user_and_ip(userid, q) != 0) { write_dns(dns_fd, q, "BADIP", 5, 'T'); - } else { - /* Decode data header */ - int up_seq = (b32_8to5(in[1]) >> 2) & 7; - int up_frag = ((b32_8to5(in[1]) & 3) << 2) | ((b32_8to5(in[2]) >> 3) & 3); - int dn_seq = (b32_8to5(in[2]) & 7); - int dn_frag = b32_8to5(in[3]) >> 1; - int lastfrag = b32_8to5(in[3]) & 1; + return; /* illegal id */ + } - if (users[userid].q.id != 0) { - /* Send reply on earlier query before overwriting */ - send_chunk(dns_fd, userid); - } +#ifdef DNSCACHE_LEN + /* Check if cached */ + if (answer_from_dnscache(dns_fd, userid, q)) { + /* Answer sent. But if this is our currently waiting + request in the queue, invalidate now since we can't + be sure that our coming new answer will ever reach + client. Happens on 3+ retransmits in the "lost pings + problem" with agressive DNS server. + */ + if (users[userid].q.id != 0 && + q->type == users[userid].q.type && + !strcmp(q->name, users[userid].q.name)) + users[userid].q.id = 0; + return; + } +#endif - /* Update query and time info for user */ - users[userid].last_pkt = time(NULL); - memcpy(&(users[userid].q), q, sizeof(struct query)); + /* Dupe pruning */ + if (users[userid].q.iddupe != 0 && + q->id == users[userid].q.iddupe && + q->type == users[userid].q.type && + !strcmp(q->name, users[userid].q.name) && + users[userid].lazy) { + /* We have this exact query already, with same id. + So this is surely a honest dupe. */ + if (debug >= 2) { + fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, ignoring\n", + userid); + } + return; + } + /* Note: Upstream data packet retransmits have exact same + hostname, so can't reliably ignore the id here. + And that's not even needed because of send_ping_soon in + client. Nice. We still do need a queue-flush on data1-data1, + see thisisdupe. + But then there's the race condition in two variants: + data1 - ping - data1 + data1 - data2 - data1 + These are surely dupes, irrespective of id, because client + will only send ping/data2 when it has received our ack for + data1. (Okay, and ping/data2 should be dupe-pruned + themselves already...) + Draw pictures if you don't understand immediately. + */ + /* If using dnscache, the new data1 probably got a + cached answer already, and this shouldn't trigger. */ + if (users[userid].q.iddupe != 0 && + (q->type != users[userid].q.type || + strcmp(q->name, users[userid].q.name)) && + users[userid].q_prev.iddupe != 0 && + q->type == users[userid].q_prev.type && + !strcmp(q->name, users[userid].q_prev.name) && + users[userid].lazy) { + if (debug >= 2) { + fprintf(stderr, "IN pkt from user %d = dupe (previous) from impatient DNS server, ignoring\n", + userid); + } + return; + } + + if (users[userid].q_sendrealsoon.id != 0 && + q->type == users[userid].q_sendrealsoon.type && + !strcmp(q->name, users[userid].q_sendrealsoon.name)) { + /* Outer select loop will send answer immediately. */ + if (debug >= 2) { + fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, ignoring\n", + userid); + } + return; + } + + /* We need to flush our queue on dupes, since our new answer + to the first query may/will be duplicated by DNS caches to + also answer the client's re-sent (=dupe) query. + (Caches take TTL=0 to mean: "good for current and earlier + queries") */ + if (users[userid].q.iddupe != 0 && + q->type == users[userid].q.type && + !strcmp(q->name, users[userid].q.name)) + thisisdupe = 1; - if (up_seq == users[userid].inpacket.seqno && - up_frag <= users[userid].inpacket.fragment) { - /* Got repeated old packet, skip it */ - if (debug >= 1) { - fprintf(stderr, "IN pkt seq# %d, frag %d, dropped duplicate\n", - up_seq, up_frag); - } - /* Update seqno and maybe send immediate response packet */ - update_downstream_seqno(dns_fd, userid, dn_seq, dn_frag); - return; - } - if (up_seq != users[userid].inpacket.seqno) { - /* New packet has arrived */ - users[userid].inpacket.seqno = up_seq; - users[userid].inpacket.len = 0; - users[userid].inpacket.offset = 0; + + /* Decode data header */ + up_seq = (b32_8to5(in[1]) >> 2) & 7; + up_frag = ((b32_8to5(in[1]) & 3) << 2) | ((b32_8to5(in[2]) >> 3) & 3); + dn_seq = (b32_8to5(in[2]) & 7); + dn_frag = b32_8to5(in[3]) >> 1; + lastfrag = b32_8to5(in[3]) & 1; + + process_downstream_ack(userid, dn_seq, dn_frag); + + if (up_seq == users[userid].inpacket.seqno && + up_frag <= users[userid].inpacket.fragment) { + /* Got repeated old packet _with data_, probably + because client didn't receive our ack. So re-send + our ack(+data) immediately to keep things flowing + fast. + If it's a _really_ old frag, it's a nameserver + that tries again, and sending our current (non- + matching) fragno won't be a problem. */ + if (debug >= 1) { + fprintf(stderr, "IN pkt seq# %d, frag %d, dropped duplicate frag\n", + up_seq, up_frag); } + upstream_ok = 0; + } + else if (up_seq != users[userid].inpacket.seqno && + recent_seqno(users[userid].inpacket.seqno, up_seq)) { + /* Duplicate of recent upstream data packet; probably + need to answer this to keep DNS server happy */ + if (debug >= 1) { + fprintf(stderr, "IN pkt seq# %d, frag %d, dropped duplicate recent seqno\n", + up_seq, up_frag); + } + upstream_ok = 0; + } + else if (up_seq != users[userid].inpacket.seqno) { + /* Really new packet has arrived, no recent duplicate */ + /* Forget any old packet, even if incomplete */ + users[userid].inpacket.seqno = up_seq; users[userid].inpacket.fragment = up_frag; + users[userid].inpacket.len = 0; + users[userid].inpacket.offset = 0; + } else { + /* seq is same, frag is higher; don't care about + missing fragments, TCP checksum will fail */ + users[userid].inpacket.fragment = up_frag; + } + if (debug >= 3) { + fprintf(stderr, "INpack with upstream %d/%d, we are going to ack upstream %d/%d\n", + up_seq, up_frag, + users[userid].inpacket.seqno, users[userid].inpacket.fragment); + } + + if (upstream_ok) { /* decode with this users encoding */ read = unpack_data(unpacked, sizeof(unpacked), &(in[4]), domain_len - 4, users[userid].encoder); /* copy to packet buffer, update length */ + read = MIN(read, sizeof(users[userid].inpacket.data) - users[userid].inpacket.offset); memcpy(users[userid].inpacket.data + users[userid].inpacket.offset, unpacked, read); users[userid].inpacket.len += read; users[userid].inpacket.offset += read; @@ -668,12 +1136,91 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) fprintf(stderr, "IN pkt seq# %d, frag %d (last=%d), fragsize %d, total %d, from user %d\n", up_seq, up_frag, lastfrag, read, users[userid].inpacket.len, userid); } + } - if (lastfrag & 1) { /* packet is complete */ - handle_full_packet(tun_fd, userid); + if (upstream_ok && lastfrag) { /* packet is complete */ + handle_full_packet(tun_fd, dns_fd, userid); + } + + /* If there is a query that must be returned real soon, do it. + Includes an ack of the just received upstream fragment, + may contain new data. */ + if (users[userid].q_sendrealsoon.id != 0) { + didsend = 1; + if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon) == 1) + /* new packet from queue, send immediately */ + didsend = 0; + } + + /* If we already have an earlier query waiting, we need to + get rid of it to store the new query. + - If we have new data waiting and not yet sent above, + send immediately. + - If this wasn't the last upstream fragment, then we expect + more, so ack immediately if we didn't already. + - If we are in non-lazy mode, there should be no query + waiting, but if there is, send immediately. + - If we are flushing queue due to dupe, send immediately. + - In all other cases (mostly the last-fragment cases), + we can afford to wait just a tiny little while for the + TCP ack to arrive from our tun. Note that this works best + when there is only one client. + */ + if (users[userid].q.id != 0) { + if ((users[userid].outpacket.len > 0 && !didsend) || + (upstream_ok && !lastfrag && !didsend) || + (!upstream_ok && !didsend) || + !users[userid].lazy || + thisisdupe) { + didsend = 1; + if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q) == 1) + /* new packet from queue, send immediately */ + didsend = 0; + } else { + memcpy(&(users[userid].q_sendrealsoon), + &(users[userid].q), + sizeof(struct query)); + users[userid].q_sendrealsoon_new = 1; + users[userid].q.id = 0; /* used */ + didsend = 1; + } + } + + /* Save previous query for dupe checking */ + memcpy(&(users[userid].q_prev), &(users[userid].q), + sizeof(struct query)); + + /* Save new query and time info */ + memcpy(&(users[userid].q), q, sizeof(struct query)); + users[userid].last_pkt = time(NULL); + + /* If we still need to ack this upstream frag, do it to keep + upstream flowing. + - If we have new data waiting and not yet sent above, + send immediately. + - If we are flushing queue due to dupe, send immediately. + - If this wasn't the last upstream fragment, then we expect + more, so ack immediately if we didn't already or are + in non-lazy mode. + - If this was the last fragment, and we didn't ack already + or are in non-lazy mode, send the ack after just a tiny + little while so that the TCP ack may have arrived from + our tun device. + - In all other cases, don't send anything now. + */ + if ((users[userid].outpacket.len > 0 && !didsend) + || thisisdupe) + send_chunk_or_dataless(dns_fd, userid, &users[userid].q); + else if (!didsend || !users[userid].lazy) { + if (upstream_ok && lastfrag) { + memcpy(&(users[userid].q_sendrealsoon), + &(users[userid].q), + sizeof(struct query)); + users[userid].q_sendrealsoon_new = 1; + users[userid].q.id = 0; /* used */ + } else { + send_chunk_or_dataless(dns_fd, userid, &users[userid].q); } - /* Update seqno and maybe send immediate response packet */ - update_downstream_seqno(dns_fd, userid, dn_seq, dn_frag); } } } @@ -848,16 +1395,30 @@ tunnel(int tun_fd, int dns_fd, int bind_fd) struct timeval tv; fd_set fds; int i; + int userid; while (running) { int maxfd; - if (users_waiting_on_reply()) { - tv.tv_sec = 0; - tv.tv_usec = 15000; - } else { - tv.tv_sec = 1; - tv.tv_usec = 0; - } + tv.tv_sec = 10; /* doesn't really matter */ + tv.tv_usec = 0; + + /* Adjust timeout if there is anything to send realsoon. + Clients won't be sending new data until we send our ack, + so don't keep them waiting long. This only triggers at + final upstream fragments, which is about once per eight + requests during heavy upstream traffic. + 20msec: ~8 packs every 1/50sec = ~400 DNSreq/sec, + or ~1200bytes every 1/50sec = ~0.5 Mbit/sec upstream */ + for (userid = 0; userid < USERS; userid++) { + if (users[userid].active && !users[userid].disabled && + users[userid].last_pkt + 60 > time(NULL)) { + users[userid].q_sendrealsoon_new = 0; + if (users[userid].q_sendrealsoon.id != 0) { + tv.tv_sec = 0; + tv.tv_usec = 20000; + } + } + } FD_ZERO(&fds); @@ -870,7 +1431,8 @@ tunnel(int tun_fd, int dns_fd, int bind_fd) maxfd = MAX(bind_fd, maxfd); } - /* TODO : use some kind of packet queue */ + /* Don't read from tun if no users can accept data anyway; + tun queue/TCP buffers are larger than our outpacket-queues */ if(!all_users_waiting_to_send()) { FD_SET(tun_fd, &fds); maxfd = MAX(tun_fd, maxfd); @@ -885,33 +1447,34 @@ tunnel(int tun_fd, int dns_fd, int bind_fd) } if (i==0) { - int j; - for (j = 0; j < USERS; j++) { - if (users[j].q.id != 0 && users[j].conn == CONN_DNS_NULL) { - send_chunk(dns_fd, j); - } - } + /* timeout; whatever; doesn't matter anymore */ } else { if (FD_ISSET(tun_fd, &fds)) { tunnel_tun(tun_fd, dns_fd); - continue; } if (FD_ISSET(dns_fd, &fds)) { tunnel_dns(tun_fd, dns_fd, bind_fd); - continue; } if (FD_ISSET(bind_fd, &fds)) { tunnel_bind(bind_fd, dns_fd); - continue; } } + + /* Send realsoon's if tun or dns didn't already */ + for (userid = 0; userid < USERS; userid++) + if (users[userid].active && !users[userid].disabled && + users[userid].last_pkt + 60 > time(NULL) && + users[userid].q_sendrealsoon.id != 0 && + users[userid].conn == CONN_DNS_NULL && + !users[userid].q_sendrealsoon_new) + send_chunk_or_dataless(dns_fd, userid, &users[userid].q_sendrealsoon); } return 0; } static void -handle_full_packet(int tun_fd, int userid) +handle_full_packet(int tun_fd, int dns_fd, int userid) { unsigned long outlen; char out[64*1024]; @@ -932,17 +1495,33 @@ handle_full_packet(int tun_fd, int userid) /* send the uncompressed packet to tun device */ write_tun(tun_fd, out, outlen); } else { - /* send the compressed packet to other client - * if another packet is queued, throw away this one. TODO build queue */ + /* send the compressed(!) packet to other client */ if (users[touser].outpacket.len == 0) { - memcpy(users[touser].outpacket.data, users[userid].inpacket.data, users[userid].inpacket.len); - users[touser].outpacket.len = users[userid].inpacket.len; + start_new_outpacket(touser, + users[userid].inpacket.data, + users[userid].inpacket.len); + + /* Start sending immediately if query is waiting */ + if (users[touser].q_sendrealsoon.id != 0) + send_chunk_or_dataless(dns_fd, touser, &users[touser].q_sendrealsoon); + else if (users[touser].q.id != 0) + send_chunk_or_dataless(dns_fd, touser, &users[userid].q); +#ifdef OUTPACKETQ_LEN + } else { + save_to_outpacketq(touser, + users[userid].inpacket.data, + users[userid].inpacket.len); +#endif } } } else { - fprintf(stderr, "Discarded data, uncompress() result: %d\n", ret); + if (debug >= 1) + fprintf(stderr, "Discarded data, uncompress() result: %d\n", ret); } - users[userid].inpacket.len = users[userid].inpacket.offset = 0; + + /* This packet is done */ + users[userid].inpacket.len = 0; + users[userid].inpacket.offset = 0; } static void @@ -997,7 +1576,7 @@ handle_raw_data(char *packet, int len, struct query *q, int dns_fd, int tun_fd, users[userid].inpacket.len, userid); } - handle_full_packet(tun_fd, userid); + handle_full_packet(tun_fd, dns_fd, userid); } static void From 6e438b4fe4426c9c26d37c0ebda4e15f262b549a Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:42 +0000 Subject: [PATCH 31/49] #76 merge manpage --- man/iodine.8 | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/man/iodine.8 b/man/iodine.8 index 2f08ff5..37f886d 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -27,6 +27,10 @@ iodine, iodined \- tunnel IPv4 over DNS .I dnstype .B ] [-O .I downenc +.B ] [-L +.I 0|1 +.B ] [-I +.I interval .B ] .B [ .I nameserver @@ -70,7 +74,12 @@ iodine, iodined \- tunnel IPv4 over DNS lets you tunnel IPv4 data through a DNS server. This can be useful in situations where Internet access is firewalled, but DNS queries are allowed. It needs a TUN/TAP device to operate. The -bandwidth is asymmetrical with limited upstream and up to 1 Mbit/s downstream. +bandwidth is asymmetrical, +with a measured maximum of 680 kbit/s upstream and 2.3 Mbit/s +downstream in a wired LAN test network. +Realistic sustained throughput on a Wifi network using a carrier-grade +DNS cache has been measured at some 50 kbit/s upstream and over 200 kbit/s +downstream. .B iodine is the client application, .B iodined @@ -143,6 +152,26 @@ For TXT queries, .I Raw will provide maximum performance. This will only work if the nameserver path is fully 8-bit-clean for responses that are assumed to be "legible text". +.TP +.B -L 0|1 +Lazy-mode switch. +\-L1 (default): Use lazy mode if server supports it, for improved +performance and decreased latency. +Some DNS servers, notably the opendns.com network, appear unstable when +handling lazy mode DNS traffic and will re-order requests. If this occurs, +you will notice fluctuating response speed in interactive sessions. +The iodine client will eventually detect this and switch back to legacy +mode automatically. Use \-L0 to force running in legacy mode +(implies \-I1). +.TP +.B -I interval +Maximum interval between requests (pings) so that intermediate DNS +servers will not time out. Default is 4 in lazy mode, which will work +fine in almost all cases. Decrease if you get SERVFAIL errors in periods +without tunneled data traffic. To get absolute minimum DNS traffic, +increase well above 4 until SERVFAIL errors start to occur. +Maximum useful value is 59, since iodined will close a client's +connection after 60 seconds of inactivity. .SS Server Options: .TP .B -c From 282a508f2b8c8d427572d615a07b74442f921dd0 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:44 +0000 Subject: [PATCH 32/49] #76 merge client code --- src/client.c | 670 +++++++++++++++++++++++++++++++++++++++------------ src/client.h | 2 + src/iodine.c | 32 ++- 3 files changed, 551 insertions(+), 153 deletions(-) diff --git a/src/client.c b/src/client.c index 42f44d4..ae4187a 100644 --- a/src/client.c +++ b/src/client.c @@ -51,7 +51,7 @@ #include "version.h" #include "client.h" -#define PING_TIMEOUT(t) ((t) >= (conn == CONN_DNS_NULL ? 1 : 20)) +static void handshake_lazyoff(int dns_fd); static int running; static const char *password; @@ -61,20 +61,21 @@ static struct sockaddr_in raw_serv; static const char *topdomain; static uint16_t rand_seed; -static int downstream_seqno; -static int downstream_fragment; -static int down_ack_seqno; -static int down_ack_fragment; /* Current up/downstream IP packet */ static struct packet outpkt; static struct packet inpkt; +int outchunkresent = 0; /* My userid at the server */ static char userid; +static char userid_char; /* used when sending (uppercase) */ +static char userid_char2; /* also accepted when receiving (lowercase) */ /* DNS id for next packet */ static uint16_t chunkid; +static uint16_t chunkid_prev; +static uint16_t chunkid_prev2; /* Base32 encoder used for non-data packets and replies */ static struct encoder *b32; @@ -94,22 +95,36 @@ static unsigned short do_qtype = T_NULL; /* My connection mode */ static enum connection conn; +int selecttimeout; /* RFC says timeout minimum 5sec */ + +int lazymode; + +long send_ping_soon; + +time_t lastdownstreamtime; + void client_init() { running = 1; - outpkt.seqno = 0; - inpkt.len = 0; - downstream_seqno = 0; - downstream_fragment = 0; - down_ack_seqno = 0; - down_ack_fragment = 0; - chunkid = ((unsigned int) rand()) & 0xFFFF; b32 = get_base32_encoder(); b64 = get_base64_encoder(); dataenc = get_base32_encoder(); rand_seed = ((unsigned int) rand()) & 0xFFFF; + send_ping_soon = 1; /* send ping immediately after startup */ conn = CONN_DNS_NULL; + + chunkid = ((unsigned int) rand()) & 0xFFFF; + chunkid_prev = 0; + chunkid_prev2 = 0; + + outpkt.len = 0; + outpkt.seqno = 0; + outpkt.fragment = 0; + outchunkresent = 0; + inpkt.len = 0; + inpkt.seqno = 0; + inpkt.fragment = 0; } void @@ -176,6 +191,17 @@ set_downenc(char *encoding) downenc = 'R'; } +void +client_set_selecttimeout(int select_timeout) +{ + selecttimeout = select_timeout; +} + +void +client_set_lazymode(int lazy_mode) { + lazymode = lazymode; +} + const char * client_get_raw_addr() { @@ -189,6 +215,8 @@ send_query(int fd, char *hostname) struct query q; size_t len; + chunkid_prev2 = chunkid_prev; + chunkid_prev = chunkid; chunkid += 7727; if (chunkid == 0) /* 0 is used as "no-query" in iodined.c */ @@ -229,6 +257,7 @@ static void send_raw_data(int dns_fd) { send_raw(dns_fd, outpkt.data, outpkt.len, userid, RAW_HDR_CMD_DATA); + outpkt.len = 0; } @@ -243,7 +272,7 @@ send_packet(int fd, char cmd, const char *data, const size_t datalen) send_query(fd, buf); } -static int +static inline int is_sending() { return (outpkt.len != 0); @@ -252,7 +281,6 @@ is_sending() static void send_chunk(int fd) { - char hex[] = "0123456789abcdef"; char buf[4096]; int avail; int code; @@ -266,21 +294,23 @@ send_chunk(int fd) /* Build upstream data header (see doc/proto_xxxxxxxx.txt) */ - buf[0] = hex[userid & 15]; /* First byte is 4 bits userid */ - + buf[0] = userid_char; /* First byte is hex userid */ + code = ((outpkt.seqno & 7) << 2) | ((outpkt.fragment & 15) >> 2); buf[1] = b32_5to8(code); /* Second byte is 3 bits seqno, 2 upper bits fragment count */ - code = ((outpkt.fragment & 3) << 3) | (downstream_seqno & 7); + code = ((outpkt.fragment & 3) << 3) | (inpkt.seqno & 7); buf[2] = b32_5to8(code); /* Third byte is 2 bits lower fragment count, 3 bits downstream packet seqno */ - code = ((downstream_fragment & 15) << 1) | (outpkt.sentlen == avail); + code = ((inpkt.fragment & 15) << 1) | (outpkt.sentlen == avail); buf[3] = b32_5to8(code); /* Fourth byte is 4 bits downstream fragment count, 1 bit last frag flag */ + +#if 0 + fprintf(stderr, " Send: down %d/%d up %d/%d, %d bytes\n", + inpkt.seqno, inpkt.fragment, outpkt.seqno, outpkt.fragment, + outpkt.sentlen); +#endif - down_ack_seqno = downstream_seqno; - down_ack_fragment = downstream_fragment; - - outpkt.fragment++; send_query(fd, buf); } @@ -290,22 +320,18 @@ send_ping(int fd) if (conn == CONN_DNS_NULL) { char data[4]; - if (is_sending()) { - outpkt.sentlen = 0; - outpkt.offset = 0; - outpkt.len = 0; - } - data[0] = userid; - data[1] = ((downstream_seqno & 7) << 4) | (downstream_fragment & 15); + data[1] = ((inpkt.seqno & 7) << 4) | (inpkt.fragment & 15); data[2] = (rand_seed >> 8) & 0xff; data[3] = (rand_seed >> 0) & 0xff; - down_ack_seqno = downstream_seqno; - down_ack_fragment = downstream_fragment; - rand_seed++; +#if 0 + fprintf(stderr, " Send: down %d/%d (ping)\n", + inpkt.seqno, inpkt.fragment); +#endif + send_packet(fd, 'p', data, sizeof(data)); } else { send_raw(fd, NULL, 0, userid, RAW_HDR_CMD_PING); @@ -313,28 +339,31 @@ send_ping(int fd) } static int -read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed for raw handling */ +read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) /* FIXME: tun_fd needed for raw handling */ { struct sockaddr_in from; char data[64*1024]; socklen_t addrlen; - struct query q; int r; addrlen = sizeof(struct sockaddr); if ((r = recvfrom(dns_fd, data, sizeof(data), 0, - (struct sockaddr*)&from, &addrlen)) == -1) { + (struct sockaddr*)&from, &addrlen)) < 0) { warn("recvfrom"); - return 0; + return -1; } if (conn == CONN_DNS_NULL) { int rv; + if (r <= 0) + /* useless packet */ + return 0; - rv = dns_decode(buf, buflen, &q, QR_ANSWER, data, r); + rv = dns_decode(buf, buflen, q, QR_ANSWER, data, r); + if (rv <= 0) + return rv; - if ((q.type == T_CNAME || q.type == T_MX || q.type == T_TXT) - && rv >= 1) + if (q->type == T_CNAME || q->type == T_MX || q->type == T_TXT) /* CNAME an also be returned from an A (or MX) question */ { size_t space; @@ -415,38 +444,6 @@ read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed } } - /* decode the data header, update seqno and frag before next request */ - if (rv >= 2) { - downstream_seqno = (buf[1] >> 5) & 7; - downstream_fragment = (buf[1] >> 1) & 15; - } - - - if (is_sending()) { - if (chunkid == q.id) { - /* Got ACK on sent packet */ - outpkt.offset += outpkt.sentlen; - if (outpkt.offset == outpkt.len) { - /* Packet completed */ - outpkt.offset = 0; - outpkt.len = 0; - outpkt.sentlen = 0; - - /* If the ack contains unacked frag number but no data, - * send a ping to ack the frag number and get more data*/ - if (rv == 2 && ( - downstream_seqno != down_ack_seqno || - downstream_fragment != down_ack_fragment - )) { - - send_ping(dns_fd); - } - } else { - /* More to send */ - send_chunk(dns_fd); - } - } - } return rv; } else { /* CONN_RAW_UDP */ unsigned long datalen; @@ -470,6 +467,22 @@ read_dns(int dns_fd, int tun_fd, char *buf, int buflen) /* FIXME: tun_fd needed } } +static inline int +read_dns_namecheck(int dns_fd, int tun_fd, char *buf, int buflen, char c1, char c2) +/* Only returns >0 when the query hostname in the received packet matches + either c1 or c2; used to tell handshake-dupes apart. +*/ +{ + struct query q; + int rv; + + rv = read_dns_withq(dns_fd, tun_fd, buf, buflen, &q); + + if (rv > 0 && q.name[0] != c1 && q.name[0] != c2) + return 0; + + return rv; /* may also be 0 = useless or -1 = error (printed) */ +} static int tunnel_tun(int tun_fd, int dns_fd) @@ -483,6 +496,11 @@ tunnel_tun(int tun_fd, int dns_fd) if ((read = read_tun(tun_fd, in, sizeof(in))) <= 0) return -1; + /* We may be here only to empty the tun device; then return -1 + to force continue in select loop. */ + if (is_sending()) + return -1; + outlen = sizeof(out); inlen = read; compress2((uint8_t*)out, &outlen, (uint8_t*)in, inlen, 9); @@ -490,12 +508,15 @@ tunnel_tun(int tun_fd, int dns_fd) memcpy(outpkt.data, out, MIN(outlen, sizeof(outpkt.data))); outpkt.sentlen = 0; outpkt.offset = 0; + outpkt.seqno = (outpkt.seqno + 1) & 7; outpkt.len = outlen; - outpkt.seqno++; outpkt.fragment = 0; + outchunkresent = 0; if (conn == CONN_DNS_NULL) { send_chunk(dns_fd); + + send_ping_soon = 0; } else { send_raw_data(dns_fd); } @@ -506,43 +527,251 @@ tunnel_tun(int tun_fd, int dns_fd) static int tunnel_dns(int tun_fd, int dns_fd) { + static long packrecv = 0; + static long packrecv_oos = 0; + int up_ack_seqno; + int up_ack_fragment; + int new_down_seqno; + int new_down_fragment; + struct query q; unsigned long datalen; char buf[64*1024]; - size_t read; + int read; + int send_something_now = 0; - if ((read = read_dns(dns_fd, tun_fd, buf, sizeof(buf))) <= 2) - return -1; - - if (downstream_seqno != inpkt.seqno) { - /* New packet */ - inpkt.seqno = downstream_seqno; - inpkt.fragment = downstream_fragment; - inpkt.len = 0; - } else if (downstream_fragment <= inpkt.fragment) { - /* Duplicate fragment */ - return -1; + if ((read = read_dns_withq(dns_fd, tun_fd, buf, sizeof(buf), &q)) < 2) { + /* Maybe SERVFAIL etc. Send ping to get things back in order, + but wait a bit to prevent fast ping-pong loops. */ + send_ping_soon = 900; + return -1; /* nothing done */ } - inpkt.fragment = downstream_fragment; - datalen = MIN(read - 2, sizeof(inpkt.data) - inpkt.len); + /* Don't process anything that isn't data; already checked read>=2 */ + if (q.name[0] != 'P' && q.name[0] != 'p' && + q.name[0] != userid_char && q.name[0] != userid_char2) + return -1; /* nothing done */ - /* Skip 2 byte data header and append to packet */ - memcpy(&inpkt.data[inpkt.len], &buf[2], datalen); - inpkt.len += datalen; + if (read == 5 && !strncmp("BADIP", buf, 5)) { + warnx("BADIP: Server rejected sender IP address (maybe iodined -c will help), or server kicked us due to timeout. Will exit if no downstream data is received in 60 seconds."); + return -1; /* nothing done */ + } - if (buf[1] & 1) { /* If last fragment flag is set */ - /* Uncompress packet and send to tun */ - datalen = sizeof(buf); - if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) inpkt.data, inpkt.len) == Z_OK) { - write_tun(tun_fd, buf, datalen); + + if (send_ping_soon) { + send_something_now = 1; + send_ping_soon = 0; + } + + + /* Decode the data header, update seqno and frag; + already checked read>=2 + Note that buf[] gets overwritten when down-pkt complete */ + new_down_seqno = (buf[1] >> 5) & 7; + new_down_fragment = (buf[1] >> 1) & 15; + up_ack_seqno = (buf[0] >> 4) & 7; + up_ack_fragment = buf[0] & 15; + +#if 0 + fprintf(stderr, " Recv: down %d/%d up %d/%d, %d bytes\n", + new_down_seqno, new_down_fragment, up_ack_seqno, + up_ack_fragment, read); +#endif + + /* Downstream data traffic */ + + if (read > 2 && new_down_seqno != inpkt.seqno && + recent_seqno(inpkt.seqno, new_down_seqno)) { + /* This is the previous seqno, or a bit earlier. + Probably out-of-sequence dupe due to unreliable + intermediary DNS. Don't get distracted, but send + ping quickly to get things back in order. + Ping will send our current seqno idea. + If it's really a new packet that skipped multiple seqnos + (why??), server will re-send and drop a few times and + eventually everything will work again. */ + read = 2; + send_ping_soon = 500; + /* Still process upstream ack, if any */ + } + + packrecv++; + + /* Don't process any non-recent stuff any further */ + if (q.id != chunkid && q.id != chunkid_prev && q.id != chunkid_prev2) { + packrecv_oos++; +#if 0 + fprintf(stderr, " q=%c Packs received = %8ld Out-of-sequence = %8ld\n", q.name[0], packrecv, packrecv_oos); +#endif + if (lazymode && packrecv < 600 && packrecv_oos == 5) + warnx("Hmm, getting some out-of-sequence DNS replies. You may want to try -I1 or -L0 if you notice hiccups in the data traffic."); + if (lazymode && packrecv < 600 && packrecv_oos == 15) { + warnx("Your DNS server connection causes severe re-ordering of DNS traffic. Lazy mode doesn't work well here, switching off. Next time on this network, start with -L0."); + lazymode = 0; + selecttimeout = 1; + handshake_lazyoff(dns_fd); } - inpkt.len = 0; + + if (send_something_now) { + send_ping(dns_fd); + send_ping_soon = 0; + } + return -1; /* nothing done */ + } +#if 0 + fprintf(stderr, " q=%c Packs received = %8ld Out-of-sequence = %8ld\n", q.name[0], packrecv, packrecv_oos); +#endif + + /* Okay, we have a recent downstream packet */ + lastdownstreamtime = time(NULL); + + /* In lazy mode, we shouldn't get much replies to our most-recent + query, only during heavy data transfer. Except when severe packet + reordering occurs, such as opendns... Since this means the server + doesn't have any packets left, send one relatively fast (but not + too fast, to avoid runaway ping-pong loops..) */ + if (q.id == chunkid && lazymode) { + if (!send_ping_soon || send_ping_soon > 900) + send_ping_soon = 900; } - /* If we have nothing to send, send a ping to get more data */ - if (!is_sending()) + if (read == 2 && new_down_seqno != inpkt.seqno && + !recent_seqno(inpkt.seqno, new_down_seqno)) { + /* This is a seqno that we didn't see yet, but it has + no data any more. Possible since iodined will send + fitting packs just once and not wait for ack. + Real data got lost, or will arrive shortly. + Update our idea of the seqno, and drop any waiting + old pack. Send ping to get things back on track. */ + inpkt.seqno = new_down_seqno; + inpkt.fragment = new_down_fragment; + inpkt.len = 0; + send_ping_soon = 500; + } + + while (read > 2) { + /* "if" with easy exit */ + + if (new_down_seqno != inpkt.seqno) { + /* New packet (and not dupe of recent; checked above) */ + /* Forget any old packet, even if incomplete */ + inpkt.seqno = new_down_seqno; + inpkt.fragment = new_down_fragment; /* hopefully 0 */ + inpkt.len = 0; + } else if (inpkt.fragment == 0 && new_down_fragment == 0 && + inpkt.len == 0) { + /* Weird situation: we probably got a no-data reply + for this seqno (see above), and the actual data + is following now. */ + /* okay, nothing to do here, just so that next else-if + doesn't trigger */ + } else if (new_down_fragment <= inpkt.fragment) { + /* Same packet but duplicate fragment, ignore. + If the server didn't get our ack for it, the next + ping or chunk will do that. */ + send_ping_soon = 500; + break; + } else if (new_down_fragment > inpkt.fragment + 1) { + /* Quite impossible. We missed a fragment, but the + server got our ack for it and is sending the next + fragment already. Don't handle it but let server + re-send and drop. */ + send_ping_soon = 500; + break; + } + inpkt.fragment = new_down_fragment; + + datalen = MIN(read - 2, sizeof(inpkt.data) - inpkt.len); + + /* we are here only when read > 2, so datalen "always" >=1 */ + + /* Skip 2 byte data header and append to packet */ + memcpy(&inpkt.data[inpkt.len], &buf[2], datalen); + inpkt.len += datalen; + + if (buf[1] & 1) { /* If last fragment flag is set */ + /* Uncompress packet and send to tun */ + /* RE-USES buf[] */ + datalen = sizeof(buf); + if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) inpkt.data, inpkt.len) == Z_OK) { + write_tun(tun_fd, buf, datalen); + } + inpkt.len = 0; + /* Keep .seqno and .fragment as is, so that we won't + reassemble from duplicate fragments */ + } + + /* Send anything to ack the received seqno/frag, and get more */ + if (inpkt.len == 0) { + /* was last frag; wait just a trifle because our + tun will probably return TCP-ack immediately. + 5msec = 200 DNSreq/sec */ + send_ping_soon = 5; + } else { + /* server certainly has more data */ + send_something_now = 1; + } + + break; + } + + /* NOTE: buf[] was overwritten when down-packet complete */ + + + /* Upstream data traffic */ + + if (is_sending()) { + /* already checked read>=2 */ +#if 0 + fprintf(stderr, "Got ack for %d,%d - expecting %d,%d - id=%d cur=%d prev=%d prev2=%d\n", + up_ack_seqno, up_ack_fragment, outpkt.seqno, outpkt.fragment, + q.id, chunkid, chunkid_prev, chunkid_prev2); +#endif + + if (up_ack_seqno == outpkt.seqno && + up_ack_fragment == outpkt.fragment) { + /* Okay, previously sent fragment has arrived */ + + outpkt.offset += outpkt.sentlen; + if (outpkt.offset >= outpkt.len) { + /* Packet completed */ + outpkt.offset = 0; + outpkt.len = 0; + outpkt.sentlen = 0; + outchunkresent = 0; + + /* Normally, server still has a query in queue, + but sometimes not. So send a ping. + (Comment this out and you'll see occasional + hiccups.) + But since the server often still has a + query and we can expect a TCP-ack returned + from our tun device quickly in many cases, + don't be too fast. + 20msec still is 50 DNSreq/second... */ + if (!send_ping_soon || send_ping_soon > 20) + send_ping_soon = 20; + } else { + /* More to send */ + outpkt.fragment++; + outchunkresent = 0; + send_chunk(dns_fd); + send_ping_soon = 0; + send_something_now = 0; + } + } + /* else: Some wrong fragment has arrived, or old fragment is + acked again, mostly by ping responses. + Don't resend chunk, usually not needed; select loop will + re-send on timeout (1sec if is_sending()). */ + } + + + /* Send ping if we didn't send anything yet */ + if (send_something_now) { send_ping(dns_fd); - + send_ping_soon = 0; + } + return read; } @@ -553,23 +782,43 @@ client_tunnel(int tun_fd, int dns_fd) fd_set fds; int rv; int i; - int seconds; rv = 0; - seconds = 0; + lastdownstreamtime = time(NULL); while (running) { - tv.tv_sec = 1; + tv.tv_sec = selecttimeout; tv.tv_usec = 0; + if (is_sending()) { + /* fast timeout for retransmits */ + tv.tv_sec = 1; + tv.tv_usec = 0; + } + + if (send_ping_soon) { + tv.tv_sec = 0; + tv.tv_usec = send_ping_soon * 1000; + } FD_ZERO(&fds); - if ((!is_sending()) || conn == CONN_RAW_UDP) { + if (!is_sending() || outchunkresent >= 2) { + /* If re-sending upstream data, chances are that + we're several seconds behind already and TCP + will start filling tun buffer with (useless) + retransmits. + Get up-to-date fast by simply dropping stuff, + that's what TCP is designed to handle. */ FD_SET(tun_fd, &fds); } FD_SET(dns_fd, &fds); i = select(MAX(tun_fd, dns_fd) + 1, &fds, NULL, NULL, &tv); + + if (lastdownstreamtime + 60 < time(NULL)) { + warnx("No downstream data received in 60 seconds, shutting down."); + running = 0; + } if (running == 0) break; @@ -577,24 +826,48 @@ client_tunnel(int tun_fd, int dns_fd) if (i < 0) err(1, "select"); - if (i == 0) { /* timeout */ - seconds++; + if (i == 0) { + /* timeout */ + if (is_sending()) { + /* Re-send current fragment; either frag + or ack probably dropped somewhere. + But problem: no cache-miss-counter, + so hostname will be identical. + Just drop whole packet after 3 retries, + and TCP retransmit will solve it. + NOTE: tun dropping above should be + >=(value_here - 1) */ + if (outchunkresent < 3) { + outchunkresent++; + send_chunk(dns_fd); + } else { + outpkt.offset = 0; + outpkt.len = 0; + outpkt.sentlen = 0; + outchunkresent = 0; + + send_ping(dns_fd); + } + } else { + send_ping(dns_fd); + } + send_ping_soon = 0; + } else { + if (FD_ISSET(tun_fd, &fds)) { - seconds = 0; if (tunnel_tun(tun_fd, dns_fd) <= 0) continue; + /* Returns -1 on error OR when quickly + dropping data in case of DNS congestion; + we need to _not_ do tunnel_dns() then. + If chunk sent, sets send_ping_soon=0. */ } if (FD_ISSET(dns_fd, &fds)) { if (tunnel_dns(tun_fd, dns_fd) <= 0) continue; } } - - if (PING_TIMEOUT(seconds)) { - send_ping(dns_fd); - seconds = 0; - } } return rv; @@ -744,10 +1017,27 @@ send_downenc_switch(int fd, int userid) strncat(buf, topdomain, 512 - strlen(buf)); send_query(fd, buf); } - + +static void +send_lazy_switch(int fd, int userid) +{ + char buf[512] = "o__."; + buf[1] = b32_5to8(userid); + + if (lazymode) + buf[2] = 'l'; + else + buf[2] = 'i'; + + strncat(buf, topdomain, 512 - strlen(buf)); + send_query(fd, buf); +} + static int handshake_version(int dns_fd, int *seed) { + char hex[] = "0123456789abcdef"; + char hex2[] = "0123456789ABCDEF"; struct timeval tv; char in[4096]; fd_set fds; @@ -768,15 +1058,10 @@ handshake_version(int dns_fd, int *seed) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if(read <= 0) { - if (read == 0) { - warn("handshake read"); - } - /* if read < 0 then warning has been printed already */ + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'v', 'V'); + + if(read <= 0) continue; - } if (read >= 9) { payload = (((in[4] & 0xff) << 24) | @@ -787,6 +1072,8 @@ handshake_version(int dns_fd, int *seed) if (strncmp("VACK", in, 4) == 0) { *seed = payload; userid = in[8]; + userid_char = hex[userid & 15]; + userid_char2 = hex2[userid & 15]; fprintf(stderr, "Version ok, both using protocol v 0x%08x. You are user #%d\n", VERSION, userid); return 0; @@ -836,12 +1123,10 @@ handshake_login(int dns_fd, int seed) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); - - if(read <= 0) { - warn("read"); + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'l', 'L'); + + if(read <= 0) continue; - } if (read > 0) { int netmask; @@ -898,7 +1183,7 @@ handshake_raw_udp(int dns_fd, int seed) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - len = read_dns(dns_fd, 0, in, sizeof(in)); + len = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'i', 'I'); if (len == 5 && in[0] == 'I') { /* Received IP address */ remoteaddr = (in[1] & 0xff); @@ -991,28 +1276,24 @@ handshake_case_check(int dns_fd) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'z', 'Z'); if (read > 0) { - if (in[0] == 'z' || in[0] == 'Z') { - if (read < (27 * 2)) { - fprintf(stderr, "Received short case check reply. Will use base32 encoder\n"); - return case_preserved; - } else { - int k; - - /* TODO enhance this, base128 is probably also possible */ - case_preserved = 1; - for (k = 0; k < 27 && case_preserved; k += 2) { - if (in[k] == in[k+1]) { - /* test string: zZ+-aAbBcCdDeE... */ - case_preserved = 0; - } - } - return case_preserved; - } + if (read < (27 * 2)) { + fprintf(stderr, "Received short case check reply. Will use base32 encoder\n"); + return case_preserved; } else { - fprintf(stderr, "Received bad case check reply\n"); + int k; + + /* TODO enhance this, base128 is probably also possible */ + case_preserved = 1; + for (k = 0; k < 27 && case_preserved; k += 2) { + if (in[k] == in[k+1]) { + /* test string: zZ+-aAbBcCdDeE... */ + case_preserved = 0; + } + } + return case_preserved; } } else { fprintf(stderr, "Got error on case check, will use base32\n"); @@ -1055,7 +1336,7 @@ handshake_switch_codec(int dns_fd) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 's', 'S'); if (read > 0) { if (strncmp("BADLEN", in, 6) == 0) { @@ -1112,7 +1393,7 @@ handshake_switch_downenc(int dns_fd) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'o', 'O'); if (read > 0) { if (strncmp("BADLEN", in, 6) == 0) { @@ -1138,6 +1419,94 @@ codec_revert: fprintf(stderr, "Falling back to base32\n"); } +static void +handshake_try_lazy(int dns_fd) +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + + fprintf(stderr, "Switching to lazy mode for low-latency\n"); + for (i=0; running && i<3; i++) { + tv.tv_sec = i + 1; + tv.tv_usec = 0; + + send_lazy_switch(dns_fd, userid); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'o', 'O'); + + if (read > 0) { + if (strncmp("BADLEN", in, 6) == 0) { + fprintf(stderr, "Server got bad message length. "); + goto codec_revert; + } else if (strncmp("BADIP", in, 5) == 0) { + fprintf(stderr, "Server rejected sender IP address. "); + goto codec_revert; + } else if (strncmp("BADCODEC", in, 8) == 0) { + fprintf(stderr, "Server rejected lazy mode. "); + goto codec_revert; + } else if (strncmp("Lazy", in, 4) == 0) { + fprintf(stderr, "Server switched to lazy mode\n"); + lazymode = 1; + return; + } + } + } + fprintf(stderr, "Retrying lazy mode switch...\n"); + } + fprintf(stderr, "No reply from server on lazy switch, probably old server version. "); + +codec_revert: + fprintf(stderr, "Falling back to legacy mode\n"); + lazymode = 0; + selecttimeout = 1; +} + +static void +handshake_lazyoff(int dns_fd) +/* Used in the middle of data transfer, timing is different and no error msgs */ +{ + struct timeval tv; + char in[4096]; + fd_set fds; + int i; + int r; + int read; + + for (i=0; running && i<5; i++) { + tv.tv_sec = 0; + tv.tv_usec = 500000; + + send_lazy_switch(dns_fd, userid); + + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + + if(r > 0) { + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'o', 'O'); + + if (read > 0) { + if (read == 4 && strncmp("Immediate", in, 9) == 0) { + fprintf(stderr, "Server switched back to legacy mode.\n"); + lazymode = 0; + selecttimeout = 1; + return; + } + } + } + } +} static int fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) @@ -1243,7 +1612,7 @@ handshake_autoprobe_fragsize(int dns_fd) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'r', 'R'); if (read > 0) { /* We got a reply */ @@ -1308,7 +1677,7 @@ handshake_set_fragsize(int dns_fd, int fragsize) r = select(dns_fd + 1, &fds, NULL, NULL, &tv); if(r > 0) { - read = read_dns(dns_fd, 0, in, sizeof(in)); + read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'n', 'N'); if (read > 0) { int accepted_fragsize; @@ -1349,6 +1718,7 @@ client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsiz if (raw_mode && handshake_raw_udp(dns_fd, seed)) { conn = CONN_RAW_UDP; + selecttimeout = 20; } else { if (raw_mode == 0) { fprintf(stderr, "Skipping raw mode\n"); @@ -1363,6 +1733,10 @@ client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsiz handshake_switch_downenc(dns_fd); } + if (lazymode) { + handshake_try_lazy(dns_fd); + } + if (autodetect_frag_size) { fragsize = handshake_autoprobe_fragsize(dns_fd); if (!fragsize) { diff --git a/src/client.h b/src/client.h index e20c281..e4141bf 100644 --- a/src/client.h +++ b/src/client.h @@ -28,6 +28,8 @@ void client_set_topdomain(const char *cp); void client_set_password(const char *cp); void set_qtype(char *qtype); void set_downenc(char *encoding); +void client_set_selecttimeout(int select_timeout); +void client_set_lazymode(int lazy_mode); int client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize); int client_tunnel(int tun_fd, int dns_fd); diff --git a/src/iodine.c b/src/iodine.c index c5c097f..97bb5d2 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -61,8 +61,8 @@ usage() { extern char *__progname; fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] " - "[-P password] [-m maxfragsize] [-T type] [-O enc] [-z context] [-F pidfile] " - "[nameserver] topdomain\n", __progname); + "[-P password] [-m maxfragsize] [-T type] [-O enc] [-L 0|1] [-I sec] " + "[-z context] [-F pidfile] [nameserver] topdomain\n", __progname); exit(2); } @@ -72,8 +72,8 @@ help() { fprintf(stderr, "iodine IP over DNS tunneling client\n"); fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] " - "[-P password] [-m maxfragsize] [-T type] [-O enc] [-z context] [-F pidfile] " - "[nameserver] topdomain\n", __progname); + "[-P password] [-m maxfragsize] [-T type] [-O enc] [-L 0|1] [-I sec] " + "[-z context] [-F pidfile] [nameserver] topdomain\n", __progname); fprintf(stderr, " -v to print version info and exit\n"); fprintf(stderr, " -h to print this help and exit\n"); fprintf(stderr, " -f to keep running in foreground\n"); @@ -85,6 +85,8 @@ help() { fprintf(stderr, " -m maxfragsize, to limit size of downstream packets\n"); fprintf(stderr, " -T dns type: NULL (default, fastest), TXT, CNAME, A (CNAME answer), MX\n"); fprintf(stderr, " -O downstream encoding (!NULL): Base32(default), Base64, or Raw (only TXT)\n"); + fprintf(stderr, " -L 1: try lazy mode for low-latency (default). 0: don't (implies -I1)\n"); + fprintf(stderr, " -I max interval between requests (default 4 sec) to prevent server timeouts\n"); fprintf(stderr, " -z context, to apply specified SELinux context after initialization\n"); fprintf(stderr, " -F pidfile to write pid to a file\n"); fprintf(stderr, "nameserver is the IP number of the relaying nameserver, if absent /etc/resolv.conf is used\n"); @@ -127,6 +129,8 @@ main(int argc, char **argv) int autodetect_frag_size; int retval; int raw_mode; + int lazymode; + int selecttimeout; nameserv_addr = NULL; topdomain = NULL; @@ -146,6 +150,8 @@ main(int argc, char **argv) max_downstream_frag_size = 3072; retval = 0; raw_mode = 1; + lazymode = 1; + selecttimeout = 4; #ifdef WINDOWS32 WSAStartup(req_version, &wsa_data); @@ -162,7 +168,7 @@ main(int argc, char **argv) __progname++; #endif - while ((choice = getopt(argc, argv, "vfhru:t:d:P:m:F:T:O:")) != -1) { + while ((choice = getopt(argc, argv, "vfhru:t:d:P:m:F:T:O:L:I:")) != -1) { switch(choice) { case 'v': version(); @@ -209,6 +215,20 @@ main(int argc, char **argv) case 'O': /* not -D, is Debug in server */ set_downenc(optarg); break; + case 'L': + lazymode = atoi(optarg); + if (lazymode > 1) + lazymode = 1; + if (lazymode < 0) + lazymode = 0; + if (!lazymode) + selecttimeout = 1; + break; + case 'I': + selecttimeout = atoi(optarg); + if (selecttimeout < 1) + selecttimeout = 1; + break; default: usage(); /* NOTREACHED */ @@ -260,6 +280,8 @@ main(int argc, char **argv) /* NOTREACHED */ } + client_set_selecttimeout(selecttimeout); + client_set_lazymode(lazymode); client_set_topdomain(topdomain); if (username != NULL) { From 8692c7f7593aceaef91c9d528c38689db829a18a Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:45 +0000 Subject: [PATCH 33/49] Fix test cases --- tests/user.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/user.c b/tests/user.c index 5983717..afd61ca 100644 --- a/tests/user.c +++ b/tests/user.c @@ -63,6 +63,7 @@ START_TEST(test_users_waiting) fail_unless(users_waiting_on_reply() == 0); + users[3].conn = CONN_DNS_NULL; users[3].q.id = 1; fail_unless(users_waiting_on_reply() == 1); @@ -76,6 +77,7 @@ START_TEST(test_find_user_by_ip) ip = inet_addr("127.0.0.1"); init_users(ip, 27); + users[0].conn = CONN_DNS_NULL; testip = (unsigned int) inet_addr("10.0.0.1"); fail_unless(find_user_by_ip(testip) == -1); @@ -104,15 +106,21 @@ START_TEST(test_all_users_waiting_to_send) fail_unless(all_users_waiting_to_send() == 1); + users[0].conn = CONN_DNS_NULL; users[0].active = 1; fail_unless(all_users_waiting_to_send() == 1); users[0].last_pkt = time(NULL); + users[0].outpacket.len = 0; fail_unless(all_users_waiting_to_send() == 0); +#ifdef OUTPACKETQ_LEN + users[0].outpacketq_filled = 1; +#else users[0].outpacket.len = 44; +#endif fail_unless(all_users_waiting_to_send() == 1); } From b6d154938f21165d654c69f39ef8c5e2b080eada Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:46 +0000 Subject: [PATCH 34/49] Fix buggy set lazy mode function --- src/client.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/client.c b/src/client.c index ae4187a..be1cd55 100644 --- a/src/client.c +++ b/src/client.c @@ -198,8 +198,9 @@ client_set_selecttimeout(int select_timeout) } void -client_set_lazymode(int lazy_mode) { - lazymode = lazymode; +client_set_lazymode(int lazy_mode) +{ + lazymode = lazy_mode; } const char * From c9debed45095e63eacb964b9a728dc085c8fb1f0 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sun, 20 Sep 2009 21:10:48 +0000 Subject: [PATCH 35/49] #76 Update changelog --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index e6f5820..5b56247 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -27,6 +27,7 @@ CHANGES: - Fix build error on Mac OS X 10.6, patch by G. Rischard. #79. - Added support for CNAME/TXT/A/MX query types, fixes #75. Patch by Anne Bezemer, merge help by logix. + - Merged low-latency patch from Anne Bezemer, fixes #76. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 From 3614a96417118d05da1a85e5c57751b8d0a13eca Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Mon, 21 Sep 2009 20:06:30 +0000 Subject: [PATCH 36/49] Print DNS errors only when requested packet has an error --- src/client.c | 60 ++++++++++++++++++++++++++++++++++++++++++---------- src/common.h | 1 + src/dns.c | 52 ++++++--------------------------------------- 3 files changed, 57 insertions(+), 56 deletions(-) diff --git a/src/client.c b/src/client.c index be1cd55..f7043f0 100644 --- a/src/client.c +++ b/src/client.c @@ -339,6 +339,36 @@ send_ping(int fd) } } +static void +write_dns_error(struct query *q) +{ + if (!q) return; + + switch (q->rcode) { + case NOERROR: /* 0 */ + warnx("Got reply without error, but also without question and/or answer"); + break; + case FORMERR: /* 1 */ + warnx("Got FORMERR as reply: server does not understand our request"); + break; + case SERVFAIL: /* 2 */ + warnx("Got SERVFAIL as reply: server failed or recursion timeout"); + break; + case NXDOMAIN: /* 3 */ + warnx("Got NXDOMAIN as reply: domain does not exist"); + break; + case NOTIMP: /* 4 */ + warnx("Got NOTIMP as reply: server does not support our request"); + break; + case REFUSED: /* 5 */ + warnx("Got REFUSED as reply"); + break; + default: + warnx("Got RCODE %u as reply", q->rcode); + break; + } +} + static int read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) /* FIXME: tun_fd needed for raw handling */ { @@ -479,9 +509,15 @@ read_dns_namecheck(int dns_fd, int tun_fd, char *buf, int buflen, char c1, char rv = read_dns_withq(dns_fd, tun_fd, buf, buflen, &q); - if (rv > 0 && q.name[0] != c1 && q.name[0] != c2) + /* Filter out any other replies */ + if (q.name[0] != c1 && q.name[0] != c2) return 0; - + + /* Print rcode errors */ + if (rv < 0) { + write_dns_error(&q); + } + return rv; /* may also be 0 = useless or -1 = error (printed) */ } @@ -540,30 +576,32 @@ tunnel_dns(int tun_fd, int dns_fd) int read; int send_something_now = 0; - if ((read = read_dns_withq(dns_fd, tun_fd, buf, sizeof(buf), &q)) < 2) { - /* Maybe SERVFAIL etc. Send ping to get things back in order, - but wait a bit to prevent fast ping-pong loops. */ - send_ping_soon = 900; - return -1; /* nothing done */ - } + memset(q.name, 0, sizeof(q.name)); + read = read_dns_withq(dns_fd, tun_fd, buf, sizeof(buf), &q); - /* Don't process anything that isn't data; already checked read>=2 */ + /* Don't process anything that isn't data for us */ if (q.name[0] != 'P' && q.name[0] != 'p' && q.name[0] != userid_char && q.name[0] != userid_char2) return -1; /* nothing done */ + if (read < 2) { + /* Maybe SERVFAIL etc. Send ping to get things back in order, + but wait a bit to prevent fast ping-pong loops. */ + write_dns_error(&q); + send_ping_soon = 900; + return -1; /* nothing done */ + } + if (read == 5 && !strncmp("BADIP", buf, 5)) { warnx("BADIP: Server rejected sender IP address (maybe iodined -c will help), or server kicked us due to timeout. Will exit if no downstream data is received in 60 seconds."); return -1; /* nothing done */ } - if (send_ping_soon) { send_something_now = 1; send_ping_soon = 0; } - /* Decode the data header, update seqno and frag; already checked read>=2 Note that buf[] gets overwritten when down-pkt complete */ diff --git a/src/common.h b/src/common.h index 32dd206..e55f1ba 100644 --- a/src/common.h +++ b/src/common.h @@ -87,6 +87,7 @@ struct packet struct query { char name[QUERY_NAME_SIZE]; unsigned short type; + unsigned short rcode; unsigned short id; unsigned short iddupe; /* only used for dupe checking */ struct in_addr destination; diff --git a/src/dns.c b/src/dns.c index 80c31e8..4a66a2b 100644 --- a/src/dns.c +++ b/src/dns.c @@ -297,54 +297,13 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz rlen = 0; + if (q != NULL) + q->rcode = header->rcode; + switch (qr) { case QR_ANSWER: if(qdcount < 1 || ancount < 1) { /* We may get both CNAME and A, then ancount=2 */ - switch (header->rcode) { - case NOERROR: /* 0 */ - if (header->tc) - warnx("Got TRUNCATION as reply: response too long for DNS path"); - else - warnx("Got reply without error, but also without question and/or answer"); - break; - - case FORMERR: /* 1 */ - warnx("Got FORMERR as reply: server does not understand our request"); - break; - - case SERVFAIL: /* 2 */ - if (qdcount >= 1 - && packetlen >= sizeof(HEADER) + 2 - && (data[1] == 'r' || data[1] == 'R')) - warnx("Got SERVFAIL as reply on earlier fragsize autoprobe"); - else if (qdcount >= 1 - && packetlen >= sizeof(HEADER) + 2 - && (data[1] < '0' || data[1] > '9') - && (data[1] < 'a' || data[1] > 'f') - && (data[1] < 'A' || data[1] > 'F') - && data[1] != 'p' && data[1] != 'P') - warnx("Got SERVFAIL as reply on earlier config setting"); - else - warnx("Got SERVFAIL as reply: server failed or recursion timeout"); - break; - - case NXDOMAIN: /* 3 */ - warnx("Got NXDOMAIN as reply: domain does not exist"); - break; - - case NOTIMP: /* 4 */ - warnx("Got NOTIMP as reply: server does not support our request"); - break; - - case REFUSED: /* 5 */ - warnx("Got REFUSED as reply"); - break; - - default: - warnx("Got RCODE %u as reply", (unsigned int) header->rcode); - break; - } return -1; } @@ -377,8 +336,9 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz if (rv >= 2 && buf) { rv = MIN(rv, buflen); memcpy(buf, rdata, rv); + } else { + rv = 0; } - /* "else rv=0;" here? */ } if ((type == T_CNAME || type == T_MX) && buf) { if (type == T_MX) @@ -395,6 +355,8 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz if (rv >= 1) { rv = MIN(rv, buflen); memcpy(buf, rdata, rv); + } else { + rv = 0; } } if (q != NULL) From a130abbfd924302904e50ad885ffdbb855fc6635 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Mon, 21 Sep 2009 20:35:18 +0000 Subject: [PATCH 37/49] Make sure replies with errors get the name parsed --- src/dns.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/dns.c b/src/dns.c index 4a66a2b..e1704c9 100644 --- a/src/dns.c +++ b/src/dns.c @@ -302,14 +302,15 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz switch (qr) { case QR_ANSWER: - if(qdcount < 1 || ancount < 1) { - /* We may get both CNAME and A, then ancount=2 */ + if(qdcount < 1) { + /* We need a question */ return -1; } if (q != NULL) q->id = id; + /* Read name even if no answer, to give better error message */ readname(packet, packetlen, &data, name, sizeof(name)); CHECKLEN(4); readshort(packet, &data, &type); @@ -320,6 +321,11 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz /* We only need the first char to check it */ q->name[0] = name[0]; q->name[1] = '\0'; + } + + if (ancount < 1) { + /* We may get both CNAME and A, then ancount=2 */ + return -1; } /* Assume that first answer is NULL/CNAME that we wanted */ From 36a25ed6426c93cc84cb52f21fa2e89061f8ced8 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Fri, 25 Sep 2009 21:47:14 +0000 Subject: [PATCH 38/49] #82, fix resolving given nameserver on everything but win32 --- src/client.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/src/client.c b/src/client.c index f7043f0..ad69aba 100644 --- a/src/client.c +++ b/src/client.c @@ -144,8 +144,26 @@ client_set_nameserver(const char *cp, int port) { struct in_addr addr; - if (inet_aton(cp, &addr) != 1) - errx(1, "error parsing nameserver address: '%s'", cp); + if (inet_aton(cp, &addr) != 1) { +#ifndef WINDOWS32 + /* MinGW only supports getaddrinfo on WinXP and higher.. + * so turn it off in windows for now + * + * try resolving if domain a domain is given */ + struct addrinfo *addrinfo; + struct addrinfo *res; + if (getaddrinfo(cp, NULL, NULL, &addrinfo) == 0) { + struct sockaddr_in *inaddr; + for (res = addrinfo; res != NULL; res = res->ai_next) { + inaddr = (struct sockaddr_in *) res->ai_addr; + addr = inaddr->sin_addr; + break; + } + freeaddrinfo(addrinfo); + } else +#endif + errx(1, "error parsing nameserver address: '%s'", cp); + } memset(&nameserv, 0, sizeof(nameserv)); nameserv.sin_family = AF_INET; From b23f08773a07bf58757a9159643c73bec6999af5 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Fri, 25 Sep 2009 22:11:18 +0000 Subject: [PATCH 39/49] #82 update docs --- CHANGELOG | 1 + man/iodine.8 | 3 ++- src/client.c | 2 +- src/iodine.c | 3 ++- 4 files changed, 6 insertions(+), 3 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 5b56247..4c3ab30 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -28,6 +28,7 @@ CHANGES: - Added support for CNAME/TXT/A/MX query types, fixes #75. Patch by Anne Bezemer, merge help by logix. - Merged low-latency patch from Anne Bezemer, fixes #76. + - Resolve client nameserver argument (except on win32), #82. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 diff --git a/man/iodine.8 b/man/iodine.8 index 37f886d..246d626 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -220,7 +220,8 @@ in production environments. .TP .B nameserver The nameserver to use to relay the dns traffic. This can be any relaying -nameserver or the ip number of the server running iodined if reachable. +nameserver or the server running iodined if reachable. This field can be +given as an IP address, or as a hostname (except on Win32 currently). This argument is optional, and if not specified a nameserver will be read from the .I /etc/resolv.conf diff --git a/src/client.c b/src/client.c index ad69aba..09a81d9 100644 --- a/src/client.c +++ b/src/client.c @@ -149,7 +149,7 @@ client_set_nameserver(const char *cp, int port) /* MinGW only supports getaddrinfo on WinXP and higher.. * so turn it off in windows for now * - * try resolving if domain a domain is given */ + * try resolving if a domain is given */ struct addrinfo *addrinfo; struct addrinfo *res; if (getaddrinfo(cp, NULL, NULL, &addrinfo) == 0) { diff --git a/src/iodine.c b/src/iodine.c index 97bb5d2..14992cc 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -89,7 +89,8 @@ help() { fprintf(stderr, " -I max interval between requests (default 4 sec) to prevent server timeouts\n"); fprintf(stderr, " -z context, to apply specified SELinux context after initialization\n"); fprintf(stderr, " -F pidfile to write pid to a file\n"); - fprintf(stderr, "nameserver is the IP number of the relaying nameserver, if absent /etc/resolv.conf is used\n"); + fprintf(stderr, "nameserver is the IP number/hostname of the relaying nameserver\n " + "(hostname not supported on win32). if absent, /etc/resolv.conf is used\n"); fprintf(stderr, "topdomain is the FQDN that is delegated to the tunnel endpoint.\n"); exit(0); From 4d42dbd8792668275b0eb1425ab4f573412b34b9 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Sat, 26 Sep 2009 09:42:32 +0000 Subject: [PATCH 40/49] #82, switch to gethostbyname() for win32 support --- CHANGELOG | 2 +- man/iodine.8 | 5 ++--- src/client.c | 44 +++++++++++++++++++++++++++++--------------- src/iodine.c | 3 +-- 4 files changed, 33 insertions(+), 21 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 4c3ab30..404774f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -28,7 +28,7 @@ CHANGES: - Added support for CNAME/TXT/A/MX query types, fixes #75. Patch by Anne Bezemer, merge help by logix. - Merged low-latency patch from Anne Bezemer, fixes #76. - - Resolve client nameserver argument (except on win32), #82. + - Resolve client nameserver argument if given as hostname, fixes #82. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 diff --git a/man/iodine.8 b/man/iodine.8 index 246d626..fd72067 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -221,9 +221,8 @@ in production environments. .B nameserver The nameserver to use to relay the dns traffic. This can be any relaying nameserver or the server running iodined if reachable. This field can be -given as an IP address, or as a hostname (except on Win32 currently). -This argument is optional, and if not specified a nameserver will be read -from the +given as an IP address, or as a hostname. This argument is optional, and +if not specified a nameserver will be read from the .I /etc/resolv.conf file. .TP diff --git a/src/client.c b/src/client.c index 09a81d9..98978d6 100644 --- a/src/client.c +++ b/src/client.c @@ -145,26 +145,40 @@ client_set_nameserver(const char *cp, int port) struct in_addr addr; if (inet_aton(cp, &addr) != 1) { + /* try resolving if a domain is given */ + struct hostent *host; + const char *err; + host = gethostbyname(cp); + if (host != NULL && h_errno > 0) { + int i = 0; + while (host->h_addr_list[i] != 0) { + addr = *(struct in_addr *) host->h_addr_list[i++]; + fprintf(stderr, "Resolved %s to %s\n", cp, inet_ntoa(addr)); + goto setaddr; + } + } #ifndef WINDOWS32 - /* MinGW only supports getaddrinfo on WinXP and higher.. - * so turn it off in windows for now - * - * try resolving if a domain is given */ - struct addrinfo *addrinfo; - struct addrinfo *res; - if (getaddrinfo(cp, NULL, NULL, &addrinfo) == 0) { - struct sockaddr_in *inaddr; - for (res = addrinfo; res != NULL; res = res->ai_next) { - inaddr = (struct sockaddr_in *) res->ai_addr; - addr = inaddr->sin_addr; + err = hstrerror(h_errno); +#else + { + DWORD wserr = WSAGetLastError(); + switch (wserr) { + case WSAHOST_NOT_FOUND: + err = "Host not found"; + break; + case WSANO_DATA: + err = "No data record found"; + break; + default: + err = "Unknown error"; break; } - freeaddrinfo(addrinfo); - } else -#endif - errx(1, "error parsing nameserver address: '%s'", cp); + } +#endif /* !WINDOWS32 */ + errx(1, "error resolving nameserver '%s': %s", cp, err); } +setaddr: memset(&nameserv, 0, sizeof(nameserv)); nameserv.sin_family = AF_INET; nameserv.sin_port = htons(port); diff --git a/src/iodine.c b/src/iodine.c index 14992cc..af3b9dc 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -89,8 +89,7 @@ help() { fprintf(stderr, " -I max interval between requests (default 4 sec) to prevent server timeouts\n"); fprintf(stderr, " -z context, to apply specified SELinux context after initialization\n"); fprintf(stderr, " -F pidfile to write pid to a file\n"); - fprintf(stderr, "nameserver is the IP number/hostname of the relaying nameserver\n " - "(hostname not supported on win32). if absent, /etc/resolv.conf is used\n"); + fprintf(stderr, "nameserver is the IP number/hostname of the relaying nameserver. if absent, /etc/resolv.conf is used\n"); fprintf(stderr, "topdomain is the FQDN that is delegated to the tunnel endpoint.\n"); exit(0); From 35bd6f744f61c8532d42e65d5144e4687c8776db Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Tue, 29 Dec 2009 20:00:57 +0000 Subject: [PATCH 41/49] Applied patch from #88, thanks a lot! --- README | 299 ++-- ...{proto_00000501.txt => proto_00000502.txt} | 100 +- man/iodine.8 | 185 +-- src/Makefile | 14 +- src/base128.c | 291 ++++ src/base128.h | 22 + src/base32.c | 254 ++-- src/base64.c | 231 +-- src/client.c | 1345 +++++++++++++---- src/client.h | 2 + src/common.h | 7 +- src/dns.c | 292 +++- src/dns.h | 3 + src/encoding.c | 6 +- src/encoding.h | 9 +- src/iodine.c | 43 +- src/iodined.c | 746 ++++++--- src/user.h | 16 +- src/version.h | 2 +- 19 files changed, 2813 insertions(+), 1054 deletions(-) rename doc/{proto_00000501.txt => proto_00000502.txt} (68%) create mode 100644 src/base128.c create mode 100644 src/base128.h diff --git a/README b/README index 5377af3..612ee69 100644 --- a/README +++ b/README @@ -11,12 +11,12 @@ firewalled, but DNS queries are allowed. QUICKSTART: Try it out within your own LAN! Follow these simple steps: -- On your server, run: ./iodined -f 10.0.0.1 test.asdf +- On your server, run: ./iodined -f 10.0.0.1 test.com (If you already use the 10.0.0.0 network, use another internal net like 172.16.0.0) - Enter a password -- On the client, run: ./iodine -f 192.168.0.1 test.asdf - (Replace 192.168.0.1 with the server's ip address) +- On the client, run: ./iodine -f -r 192.168.0.1 test.com + (Replace 192.168.0.1 with your server's ip address) - Enter the same password - Now the client has the tunnel ip 10.0.0.2 and the server has 10.0.0.1 - Try pinging each other through the tunnel @@ -26,113 +26,196 @@ To actually use it through a relaying nameserver, see below. HOW TO USE: +Note: server and client are required to speak the exact same protocol. In most +cases, this means running the same iodine version. Unfortunately, implementing +backward and forward protocol compatibility is usually not feasible. + Server side: -To use this tunnel, you need control over a real domain (like mytunnel.com), -and a server with a public IP number. If the server already runs a DNS -server, change the listening port and then use the -b option to let -iodined forward the DNS requests. Then, delegate a subdomain -(say, tunnel1.mytunnel.com) to the server. If you use BIND for the domain, -add these lines to the zone file: +To use this tunnel, you need control over a real domain (like mydomain.com), +and a server with a public IP address to run iodined on. If this server +already runs a DNS program, change its listening port and then use iodined's +-b option to let iodined forward the DNS requests. (Note that this procedure +is not advised in production environments, because iodined's DNS forwarding +is not completely transparent.) -tunnel1host IN A 10.15.213.99 -tunnel1 IN NS tunnel1host.mytunnel.com. +Then, delegate a subdomain (say, t1.mydomain.com) to the iodined server. +If you use BIND for your domain, add two lines like these to the zone file: -Do not use CNAME instead of A above. -If your server has a dynamic IP, use a dynamic dns provider: +t1 IN NS t1ns.mydomain.com. ; note the dot! +t1ns IN A 10.15.213.99 -tunnel1 IN NS tunnel1host.mydyndnsprovider.com +The "NS" line is all that's needed to route queries for the "t1" subdomain +to the "t1ns" server. We use a short name for the subdomain, to keep as much +space as possible available for the data traffic. At the end of the "NS" line +is the name of your iodined server. This can be any name, pointing anywhere, +but in this case it's easily kept in the same zone file. It must be a name +(not an IP address), and that name itself must have an A record (not a CNAME). -Now any DNS querys for domains ending with tunnel1.mytunnnel.com will be sent -to your server. Start iodined on the server. The first argument is the tunnel -IP address (like 192.168.99.1) and the second is the assigned domain (in this -case tunnel1.mytunnel.com). The -f argument will keep iodined running in the -foreground, which helps when testing. iodined will start a virtual interface, -and also start listening for DNS queries on UDP port 53. Either enter a -password on the commandline (-P pass) or after the server has started. Now -everything is ready for the client. +If your iodined server has a dynamic IP, use a dynamic dns provider. Simply +point the "NS" line to it, and leave the "A" line out: + +t1 IN NS myname.mydyndnsprovider.com. ; note the dot! + +Then reload or restart your nameserver program. Now any DNS queries for +domains ending in t1.mydomain.com will be sent to your iodined server. + +Finally start iodined on your server. The first argument is the IP address +inside the tunnel, which can be from any range that you don't use yet (for +example 192.168.99.1), and the second argument is the assigned domain (in this +case t1.mydomain.com). Using the -f option will keep iodined running in the +foreground, which helps when testing. iodined will open a virtual interface +("tun device"), and will also start listening for DNS queries on UDP port 53. +Either enter a password on the commandline (-P pass) or after the server has +started. Now everything is ready for the client. + +If there is a chance you'll be using an iodine tunnel from unexpected +environments, start iodined with a -c option. + +Resulting commandline in this example situation: +./iodined -f -c -P secretpassword 192.168.99.1 t1.mydomain.com Client side: -All the setup is done, just start iodine. It takes up to two arguments, the +All the setup is done, just start iodine. It takes one or two arguments, the first is the local relaying DNS server (optional) and the second is the domain -used (tunnel1.mytunnnel.com). If DNS queries are allowed to any computer, you -can use the tunnel endpoint (example: 10.15.213.99 or tunnel1host.mytunnel.com) -as the first argument. The tunnel interface will get an IP close to the servers -(in this case 192.168.99.2) and a suitable MTU. Enter the same password as on -the server either by argument or after the client has started. Now you should -be able to ping the other end of the tunnel from either side. +you used (t1.mydomain.com). If you don't specify the first argument, the +system's current DNS setting will be consulted. + +If DNS queries are allowed to any computer, you can directly give the iodined +server's address as first argument (in the example: t1ns.mydomain.com or +10.15.213.99). In that case, it may also happen that _any_ traffic is allowed +to the DNS port (53 UDP) of any computer. Iodine will detect this, and switch +to raw UDP tunneling if possible. To force DNS tunneling in any case, use the +-r option (especially useful when testing within your own network). + +The client's tunnel interface will get an IP close to the server's (in this +case 192.168.99.2 or .3 etc.) and a suitable MTU. Enter the same password as +on the server either as commandline option or after the client has started. +Using the -f option will keep the iodine client running in the foreground. + +Resulting commandline in this example situation: +./iodine -f -P secretpassword t1.mydomain.com +(add -r to force DNS tunneling even if raw UDP tunneling would be possible) + +From either side, you should now be able to ping the IP address on the other +end of the tunnel. In this case, ping 192.168.99.1 from the iodine client, and +192.168.99.2 or .3 etc. from the iodine server. MISC. INFO: Routing: -The normal case is to route all traffic through the DNS tunnel. To do this, first -add a route to the nameserver you use with the default gateway as gateway. Then -replace the default gateway with the servers IP address within the DNS tunnel, -and configure the server to do NAT. +It is possible to route all traffic through the DNS tunnel. To do this, first +add a host route to the nameserver used by iodine over the wired/wireless +interface with the default gateway as gateway. Then replace the default +gateway with the iodined server's IP address inside the DNS tunnel, and +configure the server to do NAT. +However, note that the tunneled data traffic is not encrypted at all, and can +be read and changed by external parties relatively easily. For maximum +security, run a VPN through the DNS tunnel (=double tunneling), or use secure +shell (SSH) access, possibly with port forwarding. The latter can also be used +for web browsing, when you run a web proxy (for example Privoxy) on your +server. + +Testing: +The iodined server replies to NS requests sent for subdomains of the tunnel +domain. If your iodined subdomain is t1.mydomain.com, send a NS request for +foo123.t1.mydomain.com to see if the delegation works. dig is a good tool +for this: +dig -t NS foo123.t1.mydomain.com + +Also, the iodined server will answer requests starting with 'z' for any of the +supported request types, for example: +dig -t TXT z456.t1.mydomain.com +dig -t SRV z456.t1.mydomain.com +dig -t CNAME z456.t1.mydomain.com +The reply should look like garbled text in all these cases. + +Operational info: The DNS-response fragment size is normally autoprobed to get maximum bandwidth. To force a specific value (and speed things up), use the -m option. -The iodined server replies to NS requests sent for subdomains of the tunnel -domain. If your domain is tunnel.com, send a NS request for foo.tunnel.com -to see if the delegation works. dig is a good tool for this: -dig -t NS foo123.tunnel.com +The DNS hostnames are normally used up to their maximum length, 255 characters. +Some DNS relays have been found that answer full-length queries rather +unreliably, giving widely varying (and mostly very bad) results of the +fragment size autoprobe on repeated tries. In these cases, use the -M switch +to reduce the DNS hostname length to for example 200 characters, which makes +these DNS relays much more stable. This is also useful on some "de-optimizing" +DNS relays that stuff the response with two full copies of the query, leaving +very little space for downstream data (also not capable of EDNS0). The -M +switch can trade some upstream bandwidth for downstream bandwidth. Note that +the minimum -M value is about 100, since the protocol can split packets (1200 +bytes max) in only 16 fragments, requiring at least 75 real data bytes per +fragment. -The upstream data is sent gzipped encoded with Base32, or Base64 if the relay -server support '+' in domain names. DNS protocol allows one query per packet, -and one query can be max 256 chars. Each domain name part can be max 63 chars. -So your domain name and subdomain should be as short as possible to allow -maximum upstream throughput. +The upstream data is sent gzipped encoded with Base32; or Base64 if the relay +server supports mixed case and '+' in domain names; or Base64u if '_' is +supported instead; or Base128 if high-byte-value characters are supported. +This upstream encoding is autodetected. The DNS protocol allows one query per +packet, and one query can be max 256 chars. Each domain name part can be max +63 chars. So your domain name and subdomain should be as short as possible to +allow maximum upstream throughput. -The default is to use DNS NULL-type queries, as this provides the largest -downstream bandwidth. If your DNS server blocks NULL requests, try TXT or -CNAME queries via the -T option. Also supported are A (returning CNAME) and -MX requests, but these may/will cause additional lookups by "smart" caching -nameservers to get an actual IP address, which may either slow down or fail -completely. DNS responses for non-NULL are Base32 encoded by default, which -should always work. For more bandwidth, try Base64 or Raw (TXT only) via the --O option. If Base64/Raw doesn't work, you'll see many failures in the -fragment size autoprobe. +Several DNS request types are supported, with the NULL type expected to provide +the largest downstream bandwidth. Other available types are TXT, SRV, MX, +CNAME and A (returning CNAME), in decreasing bandwidth order. Normally the +"best" request type is autodetected and used. However, DNS relays may impose +limits on for example NULL and TXT, making SRV or MX actually the best choice. +This is not autodetected, but can be forced using the -T option. It is +advisable to try various alternatives especially when the autodetected request +type provides a downstream fragment size of less than 200 bytes. + +Note that SRV, MX and A (returning CNAME) queries may/will cause additional +lookups by "smart" caching nameservers to get an actual IP address, which may +either slow down or fail completely. + +DNS responses for non-NULL queries can be encoded with the same set of codecs +as upstream data. This is normally also autodetected, but no fully exhaustive +tests are done, so some problems may not be noticed when selecting more +advanced codecs. In that case, you'll see failures/corruption in the fragment +size autoprobe. In particular, several DNS relays have been found that change +replies returning hostnames (SRV, MX, CNAME, A) to lowercase only when that +hostname exceeds ca. 180 characters. In these and similar cases, use the -O +option to try other downstream codecs; Base32 should always work. Normal operation now is for the server to _not_ answer a DNS request until the next DNS request has come in, a.k.a. being "lazy". This way, the server will always have a DNS request handy when new downstream data has to be sent. This greatly improves (interactive) performance and latency, and allows to -slow down the quiescent ping requests to 4 second intervals by default. -In fact, the main purpose of the pings now is to force a reply to the previous -ping, and prevent DNS server timeouts (usually 5-10 seconds per RFC1035). -In the unlikely case that you do experience DNS server timeouts (SERVFAIL), -decrease the -I option to 1. If you are running on a local network without -any DNS server in-between, try -I 50 (iodine and iodined time out after 60 -seconds). The only time you'll notice a slowdown, is when DNS reply packets -go missing; the iodined server then has to wait for a new ping to re-send the -data. You can speed this up by generating some upstream traffic (keypress, -ping). If this happens often, check your network for bottlenecks and/or run -with -I1 . +slow down the quiescent ping requests to 4 second intervals by default, and +possibly much slower. In fact, the main purpose of the pings now is to force +a reply to the previous ping, and prevent DNS server timeouts (usually at +least 5-10 seconds per RFC1035). Some DNS servers are more impatient and will +give SERVFAIL errors (timeouts) in periods without tunneled data traffic. All +data should still get through in these cases, but iodine will reduce the ping +interval to 1 second anyway (-I1) to reduce the number of error messages. This +may not help for very impatient DNS relays like dnsadvantage.com (ultradns), +which time out in 1 second or even less. Yet data will still get trough, and +you can ignore the SERVFAIL errors. -Some DNS servers appear to be quite impatient and start retrying DNS requests -(with _different_ DNS ids!) when an answer does not appear within a few -milliseconds. Usually they scale back retries when iodined's lazy mode -repeatedly takes several seconds to answer; and they scale up retries again -when iodined answers fast during heavy data transfer. Some commercial DNS -servers advertise this as "carrier-grade adaptive retransmission techniques". -The effect will only be visible in the network traffic at the iodined server, -and will not affect the client's connection. Iodined has rather elaborate -logic to deal with (i.e., ignore) these unwanted duplicates. +If you are running on a local network without any DNS server in-between, try +-I 50 (iodine and iodined close the connection after 60 seconds of silence). +The only time you'll notice a slowdown, is when DNS reply packets go missing; +the iodined server then has to wait for a new ping to re-send the data. You can +speed this up by generating some upstream traffic (keypress, ping). If this +happens often, check your network for bottlenecks and/or run with -I1. -Other DNS servers, notably the opendns.com network, seem to regard iodined's -lazyness as incompetency, and will start shuffling requests around, possibly -in an attempt to reduce iodined's workload. The resulting out-of-sequence DNS -traffic works quite badly for lazy mode. The iodine client will detect this, -and switch back to legacy mode ("immediate ping-pong") automatically. In these -cases, start the iodine client with -L0 to prevent it from operating in lazy -mode altogether. Note that this will negatively affect interactive performance -and latency, especially in the downstream direction. +The delayed answering in lazy mode will cause some "carrier grade" commercial +DNS relays to repeatedly re-send the same DNS query to the iodined server. +If the DNS relay is actually implemented as a pool of parallel servers, +duplicate requests may even arrive from multiple sources. This effect will +only be visible in the network traffic at the iodined server, and will not +affect the client's connection. Iodined will notice these duplicates, and send +the same answer (when its time has come) to both the original query and the +latest duplicate. After that, the full answer is cached for a short while. +Delayed duplicates that arrive at the server even later, get a reply that the +iodine client will ignore (if it ever arrives there). If you have problems, try inspecting the traffic with network monitoring tools -and make sure that the relaying DNS server has not cached the response. A -cached error message could mean that you started the client before the server. -The -D (and -DD) option on the server can also show received and sent queries. +like tcpdump or ethereal/wireshark, and make sure that the relaying DNS server +has not cached the response. A cached error message could mean that you +started the client before the server. The -D (and -DD) option on the server +can also show received and sent queries. TIPS & TRICKS: @@ -165,13 +248,16 @@ PERFORMANCE: This section tabulates some performance measurements. To view properly, use a fixed-width font like Courier. -Measurements were done in protocol 00000500 with lazy mode unless indicated -otherwise. Upstream encoding always Base64. +Measurements were done in protocol 00000502 in lazy mode; upstream encoding +always Base128; iodine -M255; iodined -m1130. Network conditions were not +extremely favorable; results are not benchmarks but a realistic indication of +real-world performance that can be expected in similar situations. + Upstream/downstream throughput was measured by scp'ing a file previously read from /dev/urandom (i.e. incompressible), and measuring size with "ls -l ; sleep 30 ; ls -l" on a separate non-tunneled connection. Given the large scp block size of 16 kB, this gives a resolution of 4.3 kbit/s, which -explains why many values are exactly equal. +explains why some values are exactly equal. Ping round-trip times measured with "ping -c100", presented are average rtt and mean deviation (indicating spread around the average), in milliseconds. @@ -185,43 +271,28 @@ Laptop -> Wifi AP -> Home server -> DSL provider -> Datacenter ------------------------------------------------------------------------------ iodine -> Wifi AP :53 - -Tnull (= -Oraw) 982 39.3 148.5 26.7 3.1 26.6 3.0 + -Tnull (= -Oraw) 982 43.6 131.0 28.0 4.6 26.8 3.4 iodine -> Home server :53 - -Tnull (= -Oraw) 1174 43.6 174.7 25.2 4.0 25.5 3.4 + -Tnull (= -Oraw) 1174 48.0 305.8 26.6 5.0 26.9 8.4 iodine -> DSL provider :53 - -Tnull (= -Oraw) 1174 52.4 200.9 20.3 3.2 20.3 2.7 - -Ttxt -Obase32 730 52.4 192.2* - -Ttxt -Obase64 874 52.4 192.2 - -Ttxt -Oraw 1162 52.4 192.2 - -Tcname -Obase32 148 52.4 48.0 - -Tcname -Obase64 181 52.4 61.1 + -Tnull (= -Oraw) 1174 56.7 367.0 20.6 3.1 21.2 4.4 + -Ttxt -Obase32 730 56.7 174.7* + -Ttxt -Obase64 874 56.7 174.7 + -Ttxt -Obase128 1018 56.7 174.7 + -Ttxt -Oraw 1162 56.7 358.2 + -Tsrv -Obase128 910 56.7 174.7 + -Tcname -Obase32 151 56.7 43.6 + -Tcname -Obase128 212 56.7 52.4 iodine -> DSL provider :53 - wired (no Wifi) -Tnull 1174 65.5 244.6 17.7 1.9 17.8 1.6 + wired (no Wifi) -Tnull 1174 74.2 585.4 20.2 5.6 19.6 3.4 - [192.2* : nice, because still 2frag/packet] + [174.7* : these all have 2frag/packet] Situation 2: -Laptop -> (wire) -> (Home server) -> (DSL) -> opendns.com -> Datacenter - iodine DNS cache iodined - - downstr. upstream downstr. ping-up ping-down - fragsize kbit/s kbit/s avg +/-mdev avg +/-mdev ------------------------------------------------------------------------------- - -iodine -> opendns.com :53 - -Tnull -L1 (lazy mode) 230 - - 404.4 196.2 663.8 679.6 - (20% lost) (2% lost) - - -Tnull -L0 (legacy mode) 230 5.6 7.4 197.3 4.7 610.8 323.5 - - [Note: Throughput measured over 300 seconds to get better resolution] - - -Situation 3: Laptop -> Wifi+vpn / wired -> Home server iodine iodined @@ -229,9 +300,9 @@ Laptop -> Wifi+vpn / wired -> Home server fragsize kbit/s kbit/s avg +/-mdev avg +/-mdev ------------------------------------------------------------------------------ -wifi + openvpn -Tnull 1186 183.5 611.6 5.7 1.4 7.0 2.7 +wifi + openvpn -Tnull 1186 166.0 1022.3 6.3 1.3 6.6 1.6 -wired -Tnull 1186 685.9 2350.5 1.3 0.1 1.4 0.4 +wired -Tnull 1186 677.2 2464.1 1.3 0.2 1.3 0.1 Performance is strongly coupled to low ping times, as iodine requires diff --git a/doc/proto_00000501.txt b/doc/proto_00000502.txt similarity index 68% rename from doc/proto_00000501.txt rename to doc/proto_00000502.txt index 9bc37ca..46cf2de 100644 --- a/doc/proto_00000501.txt +++ b/doc/proto_00000502.txt @@ -1,4 +1,4 @@ -Detailed specification of protocol in version 00000501 +Detailed specification of protocol in version 00000502 ====================================================== Note: work in progress!! @@ -7,6 +7,22 @@ Note: work in progress!! 1. DNS protocol ====================================================== +Quick alphabetical index / register: + 0-9 Data packet + A-F Data packet + I IP address + L Login + N Downstream fragsize (NS.topdomain A-type reply) + O Options + P Ping + R Downstream fragsize probe + S Switch upstream codec + V Version + W (WWW.topdomain A-type reply) + Y Downstream codec check + Z Upstream codec check + + CMC = 2 byte Cache Miss Counter, increased every time it is used Version: @@ -38,29 +54,55 @@ IP Request: Client sends: First byte i or I 5 bits coded as Base32 char, meaning userid - CMC + CMC as 3 Base32 chars Server replies BADIP if bad userid, or I and then 4 bytes network order external IP address of iodined server -Case check: +Upstream codec check / bounce: Client sends: First byte z or Z Lots of data that should not be decoded Server replies: - The requested domain copied raw + The requested domain copied raw, in the lowest-grade downstream codec + available for the request type. + +Downstream codec check: +Client sends: + First byte y or Y + 1 char, meaning downstream codec to use + 5 bits coded as Base32 char, meaning check variant + CMC as 3 Base32 chars + Possibly extra data, depending on check variant +Server sends: + Data encoded with requested downstream codec; data content depending + on check variant number. + BADCODEC if requested downstream codec not available. + BADLEN if check variant is not available, or problem with extra data. + + Downstream codec chars are same as in 'O' Option request, below. + + Check variants: + 1: Send encoded DOWNCODECCHECK1 string as defined in encoding.h + + (Other variants reserved; possibly variant that sends a decoded-encoded + copy of Base32-encoded extra data in the request) Switch codec: Client sends: First byte s or S 5 bits coded as Base32 char, meaning userid - 5 bits coded as Base32 char, with value 5 or 6, representing number of raw - bits per encoded byte - CMC + 5 bits coded as Base32 char, representing number of raw bits per + encoded byte: + 5: Base32 (a-z0-5) + 6: Base64 (a-zA-Z0-9+-) + 26: Base64u (a-zA-Z0-9_-) + 7: Base128 (a-zA-Z0-9\274-\375) + CMC as 3 Base32 chars Server sends: Name of codec if accepted. After this all upstream data packets must be encoded with the new codec. - BADCODEC if not accepted. Client must then revert to Base32 + BADCODEC if not accepted. Client must then revert to previous codec BADLEN if length of query is too short Options: @@ -68,6 +110,7 @@ Client sends: First byte o or O 5 bits coded as Base32 char, meaning userid 1 char, meaning option + CMC as 3 Base32 chars Server sends: Full name of option if accepted. After this, option immediately takes effect in server. @@ -77,6 +120,8 @@ Server sends: Option chars: t or T: Downstream encoding Base32, for TXT/CNAME/A/MX (default) s or S: Downstream encoding Base64, for TXT/CNAME/A/MX + u or U: Downstream encoding Base64u, for TXT/CNAME/A/MX + v or V: Downstream encoding Base128, for TXT/CNAME/A/MX r or R: Downstream encoding Raw, for TXT/NULL (default for NULL) If codec unsupported for request type, server will use Base32; note that server will answer any mix of request types that a client sends. @@ -96,8 +141,10 @@ Client sends: meaning 4 bits userid, 11 bits fragment size Then follows a long random query which contents does not matter Server sends: - Requested number of bytes as a response. The first two bytes contains - the requested length. Rest of message can be any data. + Requested number of bytes as a response. The first two bytes contain + the requested length. The third byte is 107 (0x6B). The fourth byte + is a random value, and each following byte is incremented with 107. + This is checked by the client to determine corruption. BADFRAG if requested length not accepted. Set downstream fragment size: @@ -114,10 +161,10 @@ Server sends: Data: Upstream data header: - 3210 432 10 43 210 4321 0 - +----+---+--+--+---+----+-+ - |UUUU|SSS|FF|FF|DDD|GGGG|L| - +----+---+--+--+---+----+-+ + 3210 432 10 43 210 4321 0 43210 + +----+---+--+--+---+----+-+-----+ + |UUUU|SSS|FF|FF|DDD|GGGG|L|UDCMC| + +----+---+--+--+---+----+-+-----+ Downstream data header: 7 654 3210 765 4321 0 @@ -132,9 +179,11 @@ FFFF = Upstream fragment number DDD = Downstream packet sequence number GGGG = Downstream fragment number C = Compression enabled for downstream packet +UDCMC = Upstream Data CMC, 36 steps a-z0-9, case-insensitive -Upstream data packet starts with 1 byte ASCII hex coded user byte, then 3 bytes -Base32 encoded header, then comes the payload data, encoded with chosen codec. +Upstream data packet starts with 1 byte ASCII hex coded user byte; then 3 bytes +Base32 encoded header; then 1 char data-CMC; then comes the payload data, +encoded with the chosen upstream codec. Downstream data starts with 2 byte header. Then payload data, which may be compressed. @@ -147,10 +196,18 @@ TXT: <=255 bytes) t or T: Base32 encoded before chop, decoded after un-chop s or S: Base64 encoded before chop, decoded after un-chop + u or U: Base64u encoded before chop, decoded after un-chop + v or V: Base128 encoded before chop, decoded after un-chop r or R: Raw no encoding, only DNS-chop -CNAME/A/MX: +SRV/MX/CNAME/A: h or H: Hostname encoded with Base32 i or I: Hostname encoded with Base64 + j or J: Hostname encoded with Base64u + k or K: Hostname encoded with Base128 +SRV and MX may reply with multiple hostnames, each encoded separately. Each +has a 10-multiple priority, and encoding/decoding is done in strictly +increasing priority sequence 10, 20, 30, etc. without gaps. Note that some DNS +relays will shuffle the answer records in the response. Ping: Client sends: @@ -162,10 +219,11 @@ Client sends: 4 bits downstream fragment CMC -The server response to Ping and Data packets is a DNS NULL type response: -If server has nothing to send, data length is 0 bytes. -If server has something to send, it will send a downstream data packet, -prefixed with 2 bytes header as shown above. +The server response to Ping and Data packets is a DNS NULL/TXT/.. type response, +always starting with the 2 bytes downstream data header as shown above. +If server has nothing to send, no data is added after the header. +If server has something to send, it will add the downstream data packet +(or some fragment of it) after the header. "Lazy-mode" operation diff --git a/man/iodine.8 b/man/iodine.8 index fd72067..00224e4 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -1,5 +1,5 @@ .\" groff -man -Tascii iodine.8 -.TH IODINE 8 "SEP 2009" "User Manuals" +.TH IODINE 8 "DEC 2009" "User Manuals" .SH NAME iodine, iodined \- tunnel IPv4 over DNS .SH SYNOPSIS @@ -19,6 +19,8 @@ iodine, iodined \- tunnel IPv4 over DNS .I device .B ] [-m .I fragsize +.B ] [-M +.I namelen .B ] [-z .I context .B ] [-F @@ -84,6 +86,10 @@ downstream. is the client application, .B iodined is the server. + +Note: server and client are required to speak the exact same protocol. In most +cases, this means running the same iodine version. Unfortunately, implementing +backward and forward protocol compatibility is usually not feasible. .SH OPTIONS .SS Common Options: .TP @@ -127,49 +133,85 @@ will be sent to the server instead of the DNS relay. Force maximum downstream fragment size. Not setting this will cause the client to automatically probe the maximum accepted downstream fragment size. .TP +.B -M namelen +Maximum length of upstream hostnames, default 255. +Usable range ca. 100 to 255. +Use this option to scale back upstream bandwidth in favor of downstream +bandwidth. +Also useful for DNS servers that perform unreliably when using full-length +hostnames, noticable when fragment size autoprobe returns very +different results each time. +.TP .B -T dnstype -DNS request type. -.I NULL -is default. If this doesn't work, try -.I TXT -(some less bandwidth) or +DNS request type override. +By default, autodetection will probe for working DNS request types, and +will select the request type that is expected to provide the most bandwidth. +However, it may turn out that a DNS relay imposes limits that skew the +picture, which may lead to an "unexpected" DNS request type providing +more bandwidth. +In that case, use this option to override the autodetection. +In (expected) decreasing bandwidth order, the supported DNS request types are: +.IR NULL , +.IR TXT , +.IR SRV , +.IR MX , .I CNAME -(much less bandwidth). Also supported are +and .I A -(returning CNAME) and +(returning CNAME). +Note that +.IR SRV , .I MX -requests, but these may/will cause additional lookups by "smart" caching +and +.I A +may/will cause additional lookups by "smart" caching nameservers to get an actual IP address, which may either slow down or fail completely. .TP .B -O downenc -Downstream encoding for all query type responses except NULL. +Force downstream encoding type for all query type responses except NULL. +Default is autodetected, but may not spot all problems for the more advanced +codecs. +Use this option to override the autodetection. .I Base32 -is default and should always work. +is the lowest-grade codec and should always work; this is used when +autodetection fails. .I Base64 provides more bandwidth, but may not work on all nameservers. +.I Base64u +is equal to Base64 except in using underscore ('_') +instead of plus sign ('+'), possibly working where +.I Base64 +does not. +.I Base128 +uses high byte values (mostly accented letters in iso8859-1), +which might work with some nameservers. For TXT queries, .I Raw -will provide maximum performance. This will only work if the nameserver +will provide maximum performance, but this will only work if the nameserver path is fully 8-bit-clean for responses that are assumed to be "legible text". .TP .B -L 0|1 Lazy-mode switch. -\-L1 (default): Use lazy mode if server supports it, for improved -performance and decreased latency. -Some DNS servers, notably the opendns.com network, appear unstable when -handling lazy mode DNS traffic and will re-order requests. If this occurs, -you will notice fluctuating response speed in interactive sessions. -The iodine client will eventually detect this and switch back to legacy -mode automatically. Use \-L0 to force running in legacy mode +\-L1 (default): Use lazy mode for improved performance and decreased latency. +A very small minority of DNS relays appears to be unable to handle the +lazy mode traffic pattern, resulting in no or very little data coming through. +The iodine client will detect this and try to switch back to legacy mode, +but this may not always work. +In these situations use \-L0 to force running in legacy mode (implies \-I1). .TP .B -I interval Maximum interval between requests (pings) so that intermediate DNS servers will not time out. Default is 4 in lazy mode, which will work -fine in almost all cases. Decrease if you get SERVFAIL errors in periods -without tunneled data traffic. To get absolute minimum DNS traffic, -increase well above 4 until SERVFAIL errors start to occur. +fine in most cases. When too many SERVFAIL errors occur, iodine +will automatically reduce this to 1. +To get absolute minimum DNS traffic, +increase well above 4, but not so high that SERVFAIL errors start to occur. +There are some DNS relays with very small timeouts, +notably dnsadvantage.com (ultradns), that will give +SERVFAIL errors even with \-I1; data will still get trough, +and these errors can be ignored. Maximum useful value is 59, since iodined will close a client's connection after 60 seconds of inactivity. .SS Server Options: @@ -190,11 +232,16 @@ Increase debug level. Level 1 prints info about each RX/TX packet. Implies the .B -f option. +On level 2 (-DD) or higher, DNS queries will be printed literally. +When using Base128 upstream encoding, this is best viewed as +ISO Latin-1 text instead of (illegal) UTF-8. +This is easily done with : "LC_ALL=C luit iodined -DD ..." +(see luit(1)). .TP .B -m mtu Set 'mtu' as mtu size for the tun device. This will be sent to the client on login, and the client will use the same mtu -for its tun device. Default 1200. Note that the DNS traffic will be +for its tun device. Default 1130. Note that the DNS traffic will be automatically fragmented when needed. .TP .B -l listen_ip @@ -236,97 +283,22 @@ must be the same on both the client and the server. .SS Server Arguments: .TP .B tunnel_ip[/netmask] -+This is the server's ip address on the tun interface. The client will be +This is the server's ip address on the tun interface. The client will be given the next ip number in the range. It is recommended to use the 10.0.0.0 or 172.16.0.0 ranges. The default netmask is /27, can be overriden by specifying it here. Using a smaller network will limit the number of concurrent users. .TP .B topdomain -+The dns traffic is expected to arrive as queries for +The dns traffic is expected to arrive as queries for subdomains under 'topdomain'. This is normally a subdomain to a domain you own. Use a short domain name to get better throughput. This argument must be the same on both the client and the server. Queries for domains other than 'topdomain' will be forwarded when the \-b option is given, otherwise they will be dropped. .SH EXAMPLES -.SS Quickstart: -.TP -Try it out within your own LAN! Follow these simple steps: -.TP -- On your server, run: ./iodined \-f 10.0.0.1 test.asdf -(If you already use the 10.0.0.0 network, use another internal net like -172.16.0.0) -.TP -- Enter a password -.TP -- On the client, run: ./iodine \-f 192.168.0.1 test.asdf -(Replace 192.168.0.1 with the server's ip address) -.TP -- Enter the same password -.TP -- Now the client has the tunnel ip 10.0.0.2 and the server has 10.0.0.1 -.TP -- Try pinging each other through the tunnel -.TP -- Done! :) -.TP -To actually use it through a relaying nameserver, see below. -.SS Full setup: - -.TP -.B Server side: -To use this tunnel, you need control over a real domain (like mytunnel.com), -and a server with a public IP number. If the server already runs a DNS -server, change the listening port and then use the \-b option to let -iodined forward the DNS requests. Then, delegate a subdomain -(say, tunnel1.mytunnel.com) to the server. If you use BIND for the domain, -add these lines to the zone file (replace 10.15.213.99 with your server ip): - -.nf -tunnel1host IN A 10.15.213.99 -tunnel1 IN NS tunnel1host.mytunnel.com. -.fi - -Now any DNS querys for domains ending with tunnel1.mytunnnel.com will be sent -to your server. Start iodined on the server. The first argument is the tunnel -IP address (like 192.168.99.1) and the second is the assigned domain (in this -case tunnel1.mytunnel.com). The \-f argument will keep iodined running in the -foreground, which helps when testing. iodined will start a virtual interface, -and also start listening for DNS queries on UDP port 53. Either enter a -password on the commandline (\-P pass) or after the server has started. Now -everything is ready for the client. -.TP -.B Client side: -All the setup is done, just start iodine. It also takes two -arguments, the first is the local relaying DNS server and the second is the -domain used (tunnel1.mytunnnel.com). If DNS queries are allowed to any -computer, you can use the tunnel endpoint (example: 10.15.213.99 or -tunnel1host.mytunnel.com) as the first argument. The tunnel interface will get -an IP close to the servers (in this case 192.168.99.2) and a suitable MTU. -Enter the same password as on the server either by argument or after the client -has started. Now you should be able to ping the other end of the tunnel from -either side. -.TP -.B Routing: -The normal case is to route all traffic through the DNS tunnel. To do this, first -add a route to the nameserver you use with the default gateway as gateway. Then -replace the default gateway with the servers IP address within the DNS tunnel, -and configure the server to do NAT. -.TP -.B Troubleshooting: -Use the \-D option on the server to show received and sent queries, or use a -tool like Wireshark/tcpdump. The iodined server replies to NS requests sent for -subdomains of the tunnel domain. If your domain is tunnel.com, send a NS -request for foo.tunnel.com to see if the delegation works. dig is a good tool -for this: -.nf -dig \-t NS foo123.tunnel.com -.fi -.TP -.B MTU issues: -These issues should be solved now, with automatic fragmentation of downstream -packets. There should be no need to set the MTU explicitly on the server. +See the README file for both a quick test scenario, and a detailed description +of real-world deployment. .SH SECURITY Login is a relatively secure challenge-response MD5 hash, with the password never passing the wire. @@ -336,10 +308,9 @@ encrypted in any way. The DNS traffic is also vulnerable to replay, injection and man-in-the-middle attacks, especially when iodined is used with the \-c option. Use of ssh or vpn tunneling is strongly recommended. On both server and client, use -.I iptables -, +.IR iptables , .I pf -or other firewlls to block all traffic coming in from the tun interfaces, +or other firewalls to block all traffic coming in from the tun interfaces, except to the used ssh or vpn ports. .SH ENVIRONMENT .SS IODINE_PASS @@ -348,14 +319,14 @@ If the environment variable is set, iodine will use the value it is set to as password instead of asking for one. The .B -P -option still has preference. +option still has precedence. .SS IODINED_PASS If the environment variable .B IODINED_PASS is set, iodined will use the value it is set to as password instead of asking for one. The .B -P -option still has preference. +option still has precedence. .El .SH SEE ALSO The README file in the source distribution contains some more elaborate diff --git a/src/Makefile b/src/Makefile index 3cfdea7..b8cf780 100644 --- a/src/Makefile +++ b/src/Makefile @@ -1,4 +1,4 @@ -COMMONOBJS = tun.o dns.o read.o encoding.o login.o base32.o base64.o md5.o common.o +COMMONOBJS = tun.o dns.o read.o encoding.o login.o base32.o base64.o base64u.o base128.o md5.o common.o CLIENTOBJS = iodine.o client.o util.o CLIENT = ../bin/iodine SERVEROBJS = iodined.o user.o fw_query.o @@ -30,7 +30,17 @@ $(SERVER): $(COMMONOBJS) $(SERVEROBJS) @echo CC $< @$(CC) $(CFLAGS) $< -o $@ +base64u.o client.o iodined.o: base64u.h +base64u.c: base64.c + @echo Making $@ + @echo '/* No use in editing, produced by Makefile! */' > $@ + @sed -e 's/\(base64\)/\1u/ig ; s/0123456789+/0123456789_/' < $< >> $@ +base64u.h: base64.h + @echo Making $@ + @echo '/* No use in editing, produced by Makefile! */' > $@ + @sed -e 's/\(base64\)/\1u/ig ; s/0123456789+/0123456789_/' < $< >> $@ + clean: @echo "Cleaning src/" - @rm -f $(CLIENT){,.exe} $(SERVER){,.exe} *~ *.o *.core + @rm -f $(CLIENT){,.exe} $(SERVER){,.exe} *~ *.o *.core base64u.* diff --git a/src/base128.c b/src/base128.c new file mode 100644 index 0000000..32a29f8 --- /dev/null +++ b/src/base128.c @@ -0,0 +1,291 @@ +/* + * Copyright (C) 2009 J.A.Bezemer@opensourcepartners.nl + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +/* + * raw 76543210 76543210 76543210 76543210 76543210 76543210 76543210 + * enc 65432106 54321065 43210654 32106543 21065432 10654321 06543210 + * ^ ^ ^ ^ ^ ^ ^ ^ + * + * 0001 1 0001 1 + * 0011 3 0011 3 + * 0111 7 0111 7 + * 1111 f 0110 6 + * 1110 e 0100 4 + * 1100 c + * 1000 8 + */ + +#include +#include +#include + +#include "encoding.h" +#include "base128.h" + +#define BLKSIZE_RAW 7 +#define BLKSIZE_ENC 8 + +/* Don't use '-' (restricted to middle of labels), prefer iso_8859-1 + * accent chars since they might readily be entered in normal use, + * don't use 254-255 because of possible function overloading in DNS systems. + */ +static const unsigned char cb128[] = + "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" + "\274\275\276\277" + "\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317" + "\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337" + "\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357" + "\360\361\362\363\364\365\366\367\370\371\372\373\374\375"; +static unsigned char rev128[256]; +static int reverse_init = 0; + +static int base128_encode(char *, size_t *, const void *, size_t); +static int base128_decode(void *, size_t *, const char *, size_t); +static int base128_handles_dots(); +static int base128_blksize_raw(); +static int base128_blksize_enc(); + +static struct encoder base128_encoder = +{ + "Base128", + base128_encode, + base128_decode, + base128_handles_dots, + base128_handles_dots, + base128_blksize_raw, + base128_blksize_enc +}; + +struct encoder +*get_base128_encoder() +{ + return &base128_encoder; +} + +static int +base128_handles_dots() +{ + return 0; +} + +static int +base128_blksize_raw() +{ + return BLKSIZE_RAW; +} + +static int +base128_blksize_enc() +{ + return BLKSIZE_ENC; +} + +inline static void +base128_reverse_init() +{ + int i; + unsigned char c; + + if (!reverse_init) { + memset (rev128, 0, 256); + for (i = 0; i < 128; i++) { + c = cb128[i]; + rev128[(int) c] = i; + } + reverse_init = 1; + } +} + +static int +base128_encode(char *buf, size_t *buflen, const void *data, size_t size) +/* + * Fills *buf with max. *buflen characters, encoding size bytes of *data. + * + * NOTE: *buf space should be at least 1 byte _more_ than *buflen + * to hold the trailing '\0'. + * + * return value : #bytes filled in buf (excluding \0) + * sets *buflen to : #bytes encoded from data + */ +{ + unsigned char *ubuf = (unsigned char *) buf; + unsigned char *udata = (unsigned char *) data; + int iout = 0; /* to-be-filled output char */ + int iin = 0; /* one more than last input byte that can be + successfully decoded */ + + /* Note: Don't bother to optimize manually. GCC optimizes + better(!) when using simplistic array indexing. */ + + while (1) { + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[((udata[iin] & 0xfe) >> 1)]; + iout++; + + if (iout >= *buflen || iin >= size) { + iout--; /* previous char is useless */ + break; + } + ubuf[iout] = cb128[((udata[iin] & 0x01) << 6) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xfc) >> 2) : 0)]; + iin++; /* 0 complete, iin=1 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[((udata[iin] & 0x03) << 5) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xf8) >> 3) : 0)]; + iin++; /* 1 complete, iin=2 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[((udata[iin] & 0x07) << 4) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xf0) >> 4) : 0)]; + iin++; /* 2 complete, iin=3 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[((udata[iin] & 0x0f) << 3) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xe0) >> 5) : 0)]; + iin++; /* 3 complete, iin=4 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[((udata[iin] & 0x1f) << 2) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xc0) >> 6) : 0)]; + iin++; /* 4 complete, iin=5 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[((udata[iin] & 0x3f) << 1) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0x80) >> 7) : 0)]; + iin++; /* 5 complete, iin=6 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + ubuf[iout] = cb128[(udata[iin] & 0x7f)]; + iin++; /* 6 complete, iin=7 */ + iout++; + } + + ubuf[iout] = '\0'; + + /* store number of bytes from data that was used */ + *buflen = iin; + + return iout; +} + +#define REV128(x) rev128[(int) (x)] + +static int +base128_decode(void *buf, size_t *buflen, const char *str, size_t slen) +/* + * Fills *buf with max. *buflen bytes, decoded from slen chars in *str. + * Decoding stops early when *str contains \0. + * Illegal encoded chars are assumed to decode to zero. + * + * NOTE: *buf space should be at least 1 byte _more_ than *buflen + * to hold a trailing '\0' that is added (though *buf will usually + * contain full-binary data). + * + * return value : #bytes filled in buf (excluding \0) + */ +{ + unsigned char *ustr = (unsigned char *) str; + unsigned char *ubuf = (unsigned char *) buf; + int iout = 0; /* to-be-filled output byte */ + int iin = 0; /* next input char to use in decoding */ + + base128_reverse_init (); + + /* Note: Don't bother to optimize manually. GCC optimizes + better(!) when using simplistic array indexing. */ + + while (1) { + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x7f) << 1) | + ((REV128(ustr[iin + 1]) & 0x40) >> 6); + iin++; /* 0 used up, iin=1 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x3f) << 2) | + ((REV128(ustr[iin + 1]) & 0x60) >> 5); + iin++; /* 1 used up, iin=2 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x1f) << 3) | + ((REV128(ustr[iin + 1]) & 0x70) >> 4); + iin++; /* 2 used up, iin=3 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x0f) << 4) | + ((REV128(ustr[iin + 1]) & 0x78) >> 3); + iin++; /* 3 used up, iin=4 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x07) << 5) | + ((REV128(ustr[iin + 1]) & 0x7c) >> 2); + iin++; /* 4 used up, iin=5 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x03) << 6) | + ((REV128(ustr[iin + 1]) & 0x7e) >> 1); + iin++; /* 5 used up, iin=6 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV128(ustr[iin]) & 0x01) << 7) | + ((REV128(ustr[iin + 1]) & 0x7f)); + iin += 2; /* 6,7 used up, iin=8 */ + iout++; + } + + ubuf[iout] = '\0'; + + return iout; +} diff --git a/src/base128.h b/src/base128.h new file mode 100644 index 0000000..235b2f9 --- /dev/null +++ b/src/base128.h @@ -0,0 +1,22 @@ +/* + * Copyright (C) 2009 J.A.Bezemer@opensourcepartners.nl + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef __BASE128_H__ +#define __BASE128_H__ + +struct encoder *get_base128_encoder(void); + +#endif diff --git a/src/base32.c b/src/base32.c index eff2e2b..8731a92 100644 --- a/src/base32.c +++ b/src/base32.c @@ -1,5 +1,6 @@ /* * Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman + * Mostly rewritten 2009 J.A.Bezemer@opensourcepartners.nl * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -28,10 +29,11 @@ static const char cb32[] = "abcdefghijklmnopqrstuvwxyz012345"; static const char cb32_ucase[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ012345"; -static unsigned char rev32[128]; +static unsigned char rev32[256]; +static int reverse_init = 0; -static int base32_decode(void *, size_t *, const char *, size_t); static int base32_encode(char *, size_t *, const void *, size_t); +static int base32_decode(void *, size_t *, const char *, size_t); static int base32_handles_dots(); static int base32_blksize_raw(); static int base32_blksize_enc(); @@ -71,14 +73,14 @@ base32_blksize_enc() return BLKSIZE_ENC; } -static void +inline static void base32_reverse_init() { int i; unsigned char c; - static int reverse_init = 0; if (!reverse_init) { + memset (rev32, 0, 256); for (i = 0; i < 32; i++) { c = cb32[i]; rev32[(int) c] = i; @@ -104,123 +106,165 @@ b32_8to5(int in) static int base32_encode(char *buf, size_t *buflen, const void *data, size_t size) +/* + * Fills *buf with max. *buflen characters, encoding size bytes of *data. + * + * NOTE: *buf space should be at least 1 byte _more_ than *buflen + * to hold the trailing '\0'. + * + * return value : #bytes filled in buf (excluding \0) + * sets *buflen to : #bytes encoded from data + */ { - size_t newsize; - size_t maxsize; - unsigned char *p; - unsigned char *q; - int i; + unsigned char *udata = (unsigned char *) data; + int iout = 0; /* to-be-filled output char */ + int iin = 0; /* one more than last input byte that can be + successfully decoded */ - memset(buf, 0, *buflen); + /* Note: Don't bother to optimize manually. GCC optimizes + better(!) when using simplistic array indexing. */ - /* how many chars can we encode within the buf */ - maxsize = BLKSIZE_RAW * (*buflen / BLKSIZE_ENC); - /* how big will the encoded data be */ - newsize = BLKSIZE_ENC * (size / BLKSIZE_RAW); - if (size % BLKSIZE_RAW) { - newsize += BLKSIZE_ENC; - } - /* if the buffer is too small, eat some of the data */ - if (*buflen < newsize) { - size = maxsize; + while (1) { + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb32[((udata[iin] & 0xf8) >> 3)]; + iout++; + + if (iout >= *buflen || iin >= size) { + iout--; /* previous char is useless */ + break; + } + buf[iout] = cb32[((udata[iin] & 0x07) << 2) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xc0) >> 6) : 0)]; + iin++; /* 0 complete, iin=1 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb32[((udata[iin] & 0x3e) >> 1)]; + iout++; + + if (iout >= *buflen || iin >= size) { + iout--; /* previous char is useless */ + break; + } + buf[iout] = cb32[((udata[iin] & 0x01) << 4) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xf0) >> 4) : 0)]; + iin++; /* 1 complete, iin=2 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb32[((udata[iin] & 0x0f) << 1) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0x80) >> 7) : 0)]; + iin++; /* 2 complete, iin=3 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb32[((udata[iin] & 0x7c) >> 2)]; + iout++; + + if (iout >= *buflen || iin >= size) { + iout--; /* previous char is useless */ + break; + } + buf[iout] = cb32[((udata[iin] & 0x03) << 3) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xe0) >> 5) : 0)]; + iin++; /* 3 complete, iin=4 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb32[((udata[iin] & 0x1f))]; + iin++; /* 4 complete, iin=5 */ + iout++; } - p = (unsigned char *) buf; - q = (unsigned char *)data; - - for(i=0;i> 3)]; - p[1] = cb32[(((q[0] & 0x07) << 2) | ((q[1] & 0xc0) >> 6))]; - p[2] = (i+1 < size) ? cb32[((q[1] & 0x3e) >> 1)] : '\0'; - p[3] = (i+1 < size) ? cb32[((q[1] & 0x01) << 4) | ((q[2] & 0xf0) >> 4)] : '\0'; - p[4] = (i+2 < size) ? cb32[((q[2] & 0x0f) << 1) | ((q[3] & 0x80) >> 7)] : '\0'; - p[5] = (i+3 < size) ? cb32[((q[3] & 0x7c) >> 2)] : '\0'; - p[6] = (i+3 < size) ? cb32[((q[3] & 0x03) << 3) | ((q[4] & 0xe0) >> 5)] : '\0'; - p[7] = (i+4 < size) ? cb32[((q[4] & 0x1f))] : '\0'; - - q += BLKSIZE_RAW; - p += BLKSIZE_ENC; - } - *p = 0; + buf[iout] = '\0'; /* store number of bytes from data that was used */ - *buflen = size; + *buflen = iin; - return strlen(buf); + return iout; } -#define DECODE_ERROR 0xffffffff #define REV32(x) rev32[(int) (x)] -static int -decode_token(const unsigned char *t, unsigned char *data, size_t len) -{ - if (len < 2) - return 0; - - data[0] = ((REV32(t[0]) & 0x1f) << 3) | - ((REV32(t[1]) & 0x1c) >> 2); - - if (len < 4) - return 1; - - data[1] = ((REV32(t[1]) & 0x03) << 6) | - ((REV32(t[2]) & 0x1f) << 1) | - ((REV32(t[3]) & 0x10) >> 4); - - if (len < 5) - return 2; - - data[2] = ((REV32(t[3]) & 0x0f) << 4) | - ((REV32(t[4]) & 0x1e) >> 1); - - if (len < 7) - return 3; - - data[3] = ((REV32(t[4]) & 0x01) << 7) | - ((REV32(t[5]) & 0x1f) << 2) | - ((REV32(t[6]) & 0x18) >> 3); - - if (len < 8) - return 4; - - data[4] = ((REV32(t[6]) & 0x07) << 5) | - ((REV32(t[7]) & 0x1f)); - - return 5; -} - static int base32_decode(void *buf, size_t *buflen, const char *str, size_t slen) +/* + * Fills *buf with max. *buflen bytes, decoded from slen chars in *str. + * Decoding stops early when *str contains \0. + * Illegal encoded chars are assumed to decode to zero. + * + * NOTE: *buf space should be at least 1 byte _more_ than *buflen + * to hold a trailing '\0' that is added (though *buf will usually + * contain full-binary data). + * + * return value : #bytes filled in buf (excluding \0) + */ { - unsigned char *q; - size_t newsize; - size_t maxsize; - const char *p; - int len; + unsigned char *ubuf = (unsigned char *) buf; + int iout = 0; /* to-be-filled output byte */ + int iin = 0; /* next input char to use in decoding */ - base32_reverse_init(); - - /* chars needed to decode slen */ - newsize = BLKSIZE_RAW * (slen / BLKSIZE_ENC + 1) + 1; - /* encoded chars that fit in buf */ - maxsize = BLKSIZE_ENC * (*buflen / BLKSIZE_RAW + 1) + 1; - /* if the buffer is too small, eat some of the data */ - if (*buflen < newsize) { - slen = maxsize; - } + base32_reverse_init (); - q = buf; - for (p = str; *p && strchr(cb32, *p); p += BLKSIZE_ENC) { - len = decode_token((unsigned char *) p, (unsigned char *) q, slen); - q += len; - slen -= BLKSIZE_ENC; - - if (len < BLKSIZE_RAW) + /* Note: Don't bother to optimize manually. GCC optimizes + better(!) when using simplistic array indexing. */ + + while (1) { + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') break; - } - *q = '\0'; - - return q - (unsigned char *) buf; -} + ubuf[iout] = ((REV32(str[iin]) & 0x1f) << 3) | + ((REV32(str[iin + 1]) & 0x1c) >> 2); + iin++; /* 0 used up, iin=1 */ + iout++; + if (iout >= *buflen || iin + 2 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0' || + str[iin + 2] == '\0') + break; + ubuf[iout] = ((REV32(str[iin]) & 0x03) << 6) | + ((REV32(str[iin + 1]) & 0x1f) << 1) | + ((REV32(str[iin + 2]) & 0x10) >> 4); + iin += 2; /* 1,2 used up, iin=3 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV32(str[iin]) & 0x0f) << 4) | + ((REV32(str[iin + 1]) & 0x1e) >> 1); + iin++; /* 3 used up, iin=4 */ + iout++; + + if (iout >= *buflen || iin + 2 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0' || + str[iin + 2] == '\0') + break; + ubuf[iout] = ((REV32(str[iin]) & 0x01) << 7) | + ((REV32(str[iin + 1]) & 0x1f) << 2) | + ((REV32(str[iin + 2]) & 0x18) >> 3); + iin += 2; /* 4,5 used up, iin=6 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV32(str[iin]) & 0x07) << 5) | + ((REV32(str[iin + 1]) & 0x1f)); + iin += 2; /* 6,7 used up, iin=8 */ + iout++; + } + + ubuf[iout] = '\0'; + + return iout; +} diff --git a/src/base64.c b/src/base64.c index 7da2d2a..5218c09 100644 --- a/src/base64.c +++ b/src/base64.c @@ -1,5 +1,6 @@ /* * Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman + * Mostly rewritten 2009 J.A.Bezemer@opensourcepartners.nl * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -19,15 +20,16 @@ #include #include "encoding.h" -#include "common.h" #include "base64.h" #define BLKSIZE_RAW 3 #define BLKSIZE_ENC 4 +/* Note: the "unofficial" char is last here, which means that the \377 pattern + in DOWNCODECCHECK1 ('Y' request) will properly test it. */ static const char cb64[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-0123456789+"; -static unsigned char rev64[128]; +static unsigned char rev64[256]; static int reverse_init = 0; static int base64_encode(char *, size_t *, const void *, size_t); @@ -36,8 +38,6 @@ static int base64_handles_dots(); static int base64_blksize_raw(); static int base64_blksize_enc(); -#define REV64(x) rev64[(int) (x)] - static struct encoder base64_encoder = { "Base64", @@ -73,122 +73,133 @@ base64_blksize_enc() return BLKSIZE_ENC; } -static int -base64_encode(char *buf, size_t *buflen, const void *data, size_t size) +inline static void +base64_reverse_init() { - size_t newsize; - size_t maxsize; - unsigned char *s; - unsigned char *p; - unsigned char *q; int i; - - memset(buf, 0, *buflen); - - /* how many chars can we encode within the buf */ - maxsize = BLKSIZE_RAW * (*buflen / BLKSIZE_ENC); - /* how big will the encoded data be */ - newsize = BLKSIZE_ENC * (size / BLKSIZE_RAW); - if (size % BLKSIZE_RAW) { - newsize += BLKSIZE_ENC; - } - - /* if the buffer is too small, eat some of the data */ - if (*buflen < newsize) { - size = maxsize; - } - - p = s = (unsigned char *) buf; - q = (unsigned char *)data; - - for(i=0;i> 2)]; - p[1] = cb64[(((q[0] & 0x03) << 4) | ((q[1] & 0xf0) >> 4))]; - p[2] = (i+1 < size) ? cb64[((q[1] & 0x0f) << 2 ) | ((q[2] & 0xc0) >> 6)] : '\0'; - p[3] = (i+2 < size) ? cb64[(q[2] & 0x3f)] : '\0'; - - q += BLKSIZE_RAW; - p += BLKSIZE_ENC; - } - *p = 0; - - /* store number of bytes from data that was used */ - *buflen = size; - - return strlen(buf); -} - -#define DECODE_ERROR 0xffffffff - -static int -decode_token(const unsigned char *t, unsigned char *data, size_t len) -{ - if (len < 2) - return 0; - - data[0] = ((REV64(t[0]) & 0x3f) << 2) | - ((REV64(t[1]) & 0x30) >> 4); - - if (len < 3) - return 1; - - data[1] = ((REV64(t[1]) & 0x0f) << 4) | - ((REV64(t[2]) & 0x3c) >> 2); - - if (len < 4) - return 2; - - data[2] = ((REV64(t[2]) & 0x03) << 6) | - (REV64(t[3]) & 0x3f); - - return 3; -} - -static int -base64_decode(void *buf, size_t *buflen, const char *str, size_t slen) -{ - unsigned char *q; - size_t newsize; - size_t maxsize; - const char *p; unsigned char c; - unsigned char block[BLKSIZE_ENC]; - int len; - int i; if (!reverse_init) { + memset (rev64, 0, 256); for (i = 0; i < 64; i++) { c = cb64[i]; rev64[(int) c] = i; } reverse_init = 1; } - - /* chars needed to decode slen */ - newsize = BLKSIZE_RAW * (slen / BLKSIZE_ENC + 1) + 1; - /* encoded chars that fit in buf */ - maxsize = BLKSIZE_ENC * (*buflen / BLKSIZE_RAW + 1) + 1; - /* if the buffer is too small, eat some of the data */ - if (*buflen < newsize) { - slen = maxsize; - } - - - q = buf; - for (p = str; *p; p += BLKSIZE_ENC) { - /* since the str is const, we unescape in another buf */ - for (i = 0; i < BLKSIZE_ENC; i++) { - block[i] = p[i]; - } - len = decode_token(block, (unsigned char *) q, slen); - q += len; - slen -= BLKSIZE_ENC; - - if (len < BLKSIZE_RAW) - break; - } - *q = '\0'; - - return q - (unsigned char *) buf; } +static int +base64_encode(char *buf, size_t *buflen, const void *data, size_t size) +/* + * Fills *buf with max. *buflen characters, encoding size bytes of *data. + * + * NOTE: *buf space should be at least 1 byte _more_ than *buflen + * to hold the trailing '\0'. + * + * return value : #bytes filled in buf (excluding \0) + * sets *buflen to : #bytes encoded from data + */ +{ + unsigned char *udata = (unsigned char *) data; + int iout = 0; /* to-be-filled output char */ + int iin = 0; /* one more than last input byte that can be + successfully decoded */ + + /* Note: Don't bother to optimize manually. GCC optimizes + better(!) when using simplistic array indexing. */ + + while (1) { + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb64[((udata[iin] & 0xfc) >> 2)]; + iout++; + + if (iout >= *buflen || iin >= size) { + iout--; /* previous char is useless */ + break; + } + buf[iout] = cb64[((udata[iin] & 0x03) << 4) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xf0) >> 4) : 0)]; + iin++; /* 0 complete, iin=1 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb64[((udata[iin] & 0x0f) << 2 ) | + ((iin + 1 < size) ? + ((udata[iin + 1] & 0xc0) >> 6) : 0)]; + iin++; /* 1 complete, iin=2 */ + iout++; + + if (iout >= *buflen || iin >= size) + break; + buf[iout] = cb64[(udata[iin] & 0x3f)]; + iin++; /* 2 complete, iin=3 */ + iout++; + } + + buf[iout] = '\0'; + + /* store number of bytes from data that was used */ + *buflen = iin; + + return iout; +} + +#define REV64(x) rev64[(int) (x)] + +static int +base64_decode(void *buf, size_t *buflen, const char *str, size_t slen) +/* + * Fills *buf with max. *buflen bytes, decoded from slen chars in *str. + * Decoding stops early when *str contains \0. + * Illegal encoded chars are assumed to decode to zero. + * + * NOTE: *buf space should be at least 1 byte _more_ than *buflen + * to hold a trailing '\0' that is added (though *buf will usually + * contain full-binary data). + * + * return value : #bytes filled in buf (excluding \0) + */ +{ + unsigned char *ubuf = (unsigned char *) buf; + int iout = 0; /* to-be-filled output byte */ + int iin = 0; /* next input char to use in decoding */ + + base64_reverse_init (); + + /* Note: Don't bother to optimize manually. GCC optimizes + better(!) when using simplistic array indexing. */ + + while (1) { + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV64(str[iin]) & 0x3f) << 2) | + ((REV64(str[iin + 1]) & 0x30) >> 4); + iin++; /* 0 used up, iin=1 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV64(str[iin]) & 0x0f) << 4) | + ((REV64(str[iin + 1]) & 0x3c) >> 2); + iin++; /* 1 used up, iin=2 */ + iout++; + + if (iout >= *buflen || iin + 1 >= slen || + str[iin] == '\0' || str[iin + 1] == '\0') + break; + ubuf[iout] = ((REV64(str[iin]) & 0x03) << 6) | + (REV64(str[iin + 1]) & 0x3f); + iin += 2; /* 2,3 used up, iin=4 */ + iout++; + } + + ubuf[iout] = '\0'; + + return iout; +} diff --git a/src/client.c b/src/client.c index 98978d6..6845e0f 100644 --- a/src/client.c +++ b/src/client.c @@ -45,6 +45,8 @@ #include "encoding.h" #include "base32.h" #include "base64.h" +#include "base64u.h" +#include "base128.h" #include "dns.h" #include "login.h" #include "tun.h" @@ -69,8 +71,8 @@ int outchunkresent = 0; /* My userid at the server */ static char userid; -static char userid_char; /* used when sending (uppercase) */ -static char userid_char2; /* also accepted when receiving (lowercase) */ +static char userid_char; /* used when sending (lowercase) */ +static char userid_char2; /* also accepted when receiving (uppercase) */ /* DNS id for next packet */ static uint16_t chunkid; @@ -79,8 +81,10 @@ static uint16_t chunkid_prev2; /* Base32 encoder used for non-data packets and replies */ static struct encoder *b32; -/* Base64 encoder for replies */ +/* Base64 etc encoders for replies */ static struct encoder *b64; +static struct encoder *b64u; +static struct encoder *b128; /* The encoder used for data packets * Defaults to Base32, can be changed after handshake */ @@ -90,18 +94,18 @@ static struct encoder *dataenc; static char downenc = ' '; /* set query type to send */ -static unsigned short do_qtype = T_NULL; +static unsigned short do_qtype = T_UNSET; /* My connection mode */ static enum connection conn; -int selecttimeout; /* RFC says timeout minimum 5sec */ - -int lazymode; - -long send_ping_soon; - -time_t lastdownstreamtime; +static int selecttimeout; /* RFC says timeout minimum 5sec */ +static int lazymode; +static long send_ping_soon; +static time_t lastdownstreamtime; +static long send_query_sendcnt = -1; +static long send_query_recvcnt = 0; +static int hostname_maxlen = 0xFF; void client_init() @@ -109,6 +113,8 @@ client_init() running = 1; b32 = get_base32_encoder(); b64 = get_base64_encoder(); + b64u = get_base64u_encoder(); + b128 = get_base128_encoder(); dataenc = get_base32_encoder(); rand_seed = ((unsigned int) rand()) & 0xFFFF; send_ping_soon = 1; /* send ping immediately after startup */ @@ -208,10 +214,27 @@ set_qtype(char *qtype) do_qtype = T_A; else if (!strcasecmp(qtype, "MX")) do_qtype = T_MX; + else if (!strcasecmp(qtype, "SRV")) + do_qtype = T_SRV; else if (!strcasecmp(qtype, "TXT")) do_qtype = T_TXT; } +char * +get_qtype() +{ + char *c = "UNDEFINED"; + + if (do_qtype == T_NULL) c = "NULL"; + else if (do_qtype == T_CNAME) c = "CNAME"; + else if (do_qtype == T_A) c = "A"; + else if (do_qtype == T_MX) c = "MX"; + else if (do_qtype == T_SRV) c = "SRV"; + else if (do_qtype == T_TXT) c = "TXT"; + + return c; +} + void set_downenc(char *encoding) { @@ -219,6 +242,10 @@ set_downenc(char *encoding) downenc = 'T'; else if (!strcasecmp(encoding, "base64")) downenc = 'S'; + else if (!strcasecmp(encoding, "base64u")) + downenc = 'U'; + else if (!strcasecmp(encoding, "base128")) + downenc = 'V'; else if (!strcasecmp(encoding, "raw")) downenc = 'R'; } @@ -235,6 +262,13 @@ client_set_lazymode(int lazy_mode) lazymode = lazy_mode; } +void +client_set_hostname_maxlen(int i) +{ + if (i <= 0xFF) + hostname_maxlen = i; +} + const char * client_get_raw_addr() { @@ -264,7 +298,42 @@ send_query(int fd, char *hostname) return; } +#if 0 + fprintf(stderr, " Sendquery: id %5d name[0] '%c'\n", q.id, hostname[0]); +#endif + sendto(fd, packet, len, 0, (struct sockaddr*)&nameserv, sizeof(nameserv)); + + /* There are DNS relays that time out quickly but don't send anything + back on timeout. + And there are relays where, in lazy mode, our new query apparently + _replaces_ our previous query, and we get no answers at all in + lazy mode while legacy immediate-ping-pong works just fine. + Here we detect and fix these situations. + (Can't very well do this anywhere else; this is the only place + we'll reliably get to in such situations.) + */ + + if (send_query_sendcnt >= 0 && send_query_sendcnt < 100 && lazymode) { + send_query_sendcnt++; + + if ((send_query_sendcnt > 6 && send_query_recvcnt <= 0) || + (send_query_sendcnt > 10 && + 4 * send_query_recvcnt < send_query_sendcnt)) { + if (selecttimeout > 1) { + warnx("Receiving too few answers. Setting interval to 1 (-I1)"); + selecttimeout = 1; + /* restart counting */ + send_query_sendcnt = 0; + send_query_recvcnt = 0; + } else if (lazymode) { + warnx("Receiving too few answers. Will try to switch lazy mode off, but that may not always work any more. Start with -L0 next time on this network."); + lazymode = 0; + selecttimeout = 1; + handshake_lazyoff(fd); + } + } + } } static void @@ -301,7 +370,8 @@ send_packet(int fd, char cmd, const char *data, const size_t datalen) buf[0] = cmd; - build_hostname(buf + 1, sizeof(buf) - 1, data, datalen, topdomain, b32); + build_hostname(buf + 1, sizeof(buf) - 1, data, datalen, topdomain, + b32, hostname_maxlen); send_query(fd, buf); } @@ -318,12 +388,16 @@ send_chunk(int fd) int avail; int code; char *p; + static int datacmc = 0; + char *datacmcchars = "abcdefghijklmnopqrstuvwxyz0123456789"; p = outpkt.data; p += outpkt.offset; avail = outpkt.len - outpkt.offset; - outpkt.sentlen = build_hostname(buf + 4, sizeof(buf) - 4, p, avail, topdomain, dataenc); + /* Note: must be same, or smaller than send_fragsize_probe() */ + outpkt.sentlen = build_hostname(buf + 5, sizeof(buf) - 5, p, avail, + topdomain, dataenc, hostname_maxlen); /* Build upstream data header (see doc/proto_xxxxxxxx.txt) */ @@ -337,6 +411,11 @@ send_chunk(int fd) code = ((inpkt.fragment & 15) << 1) | (outpkt.sentlen == avail); buf[3] = b32_5to8(code); /* Fourth byte is 4 bits downstream fragment count, 1 bit last frag flag */ + + buf[4] = datacmcchars[datacmc]; /* Fifth byte is data-CMC */ + datacmc++; + if (datacmc >= 36) + datacmc = 0; #if 0 fprintf(stderr, " Send: down %d/%d up %d/%d, %d bytes\n", @@ -372,19 +451,29 @@ send_ping(int fd) } static void -write_dns_error(struct query *q) +write_dns_error(struct query *q, int ignore_some_errors) +/* This is called from: + 1. handshake_waitdns() when already checked that reply fits to our + latest query. + 2. tunnel_dns() when already checked that reply is for our ping or data + packet, but not necessarily the most recent (SERVFAIL mostly comes + after long delay). + So ignorable errors are never printed. +*/ { if (!q) return; switch (q->rcode) { case NOERROR: /* 0 */ - warnx("Got reply without error, but also without question and/or answer"); + if (!ignore_some_errors) + warnx("Got reply without error, but also without question and/or answer"); break; case FORMERR: /* 1 */ warnx("Got FORMERR as reply: server does not understand our request"); break; case SERVFAIL: /* 2 */ - warnx("Got SERVFAIL as reply: server failed or recursion timeout"); + if (!ignore_some_errors) + warnx("Got SERVFAIL as reply: server failed or recursion timeout"); break; case NXDOMAIN: /* 3 */ warnx("Got NXDOMAIN as reply: domain does not exist"); @@ -402,7 +491,110 @@ write_dns_error(struct query *q) } static int -read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) /* FIXME: tun_fd needed for raw handling */ +dns_namedec(char *outdata, int outdatalen, char *buf, int buflen) +/* Decodes *buf to *outdata. + * *buf WILL be changed by undotify. + * Note: buflen must be _exactly_ strlen(buf) before undotifying. + * (undotify of reduced-len won't copy \0, base-X decode will decode too much.) + * Returns #bytes usefully filled in outdata. + */ +{ + size_t outdatalenu = outdatalen; + + switch (buf[0]) { + case 'h': /* Hostname with base32 */ + case 'H': + /* Need 1 byte H, 3 bytes ".xy", >=1 byte data */ + if (buflen < 5) + return 0; + + /* this also does undotify */ + return unpack_data(outdata, outdatalen, buf + 1, buflen - 4, + b32); + + case 'i': /* Hostname++ with base64 */ + case 'I': + /* Need 1 byte I, 3 bytes ".xy", >=1 byte data */ + if (buflen < 5) + return 0; + + /* this also does undotify */ + return unpack_data(outdata, outdatalen, buf + 1, buflen - 4, + b64); + + case 'j': /* Hostname++ with base64u */ + case 'J': + /* Need 1 byte J, 3 bytes ".xy", >=1 byte data */ + if (buflen < 5) + return 0; + + /* this also does undotify */ + return unpack_data(outdata, outdatalen, buf + 1, buflen - 4, + b64u); + + case 'k': /* Hostname++ with base128 */ + case 'K': + /* Need 1 byte J, 3 bytes ".xy", >=1 byte data */ + if (buflen < 5) + return 0; + + /* this also does undotify */ + return unpack_data(outdata, outdatalen, buf + 1, buflen - 4, + b128); + + case 't': /* plain base32(Thirty-two) from TXT */ + case 'T': + if (buflen < 2) + return 0; + + return b32->decode(outdata, &outdatalenu, buf + 1, buflen - 1); + + case 's': /* plain base64(Sixty-four) from TXT */ + case 'S': + if (buflen < 2) + return 0; + + return b64->decode(outdata, &outdatalenu, buf + 1, buflen - 1); + + case 'u': /* plain base64u (Underscore) from TXT */ + case 'U': + if (buflen < 2) + return 0; + + return b64u->decode(outdata, &outdatalenu, buf + 1, buflen - 1); + + case 'v': /* plain base128 from TXT */ + case 'V': + if (buflen < 2) + return 0; + + return b128->decode(outdata, &outdatalenu, buf + 1, buflen - 1); + + case 'r': /* Raw binary from TXT */ + case 'R': + /* buflen>=1 already checked */ + buflen--; + buflen = MIN(buflen, outdatalen); + memcpy(outdata, buf + 1, buflen); + return buflen; + + default: + warnx("Received unsupported encoding"); + return 0; + } + + /* notreached */ + return 0; +} + +static int +read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) +/* FIXME: tun_fd needed for raw handling */ +/* Returns -1 on receive error or decode error, including DNS error replies. + Returns 0 on replies that could be correct but are useless, and are not + DNS error replies. + Returns >0 on correct replies; value is #valid bytes in *buf. +*/ { struct sockaddr_in from; char data[64*1024]; @@ -426,11 +618,9 @@ read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) / if (rv <= 0) return rv; - if (q->type == T_CNAME || q->type == T_MX || q->type == T_TXT) - /* CNAME an also be returned from an A (or MX) question */ + if (q->type == T_CNAME || q->type == T_TXT) + /* CNAME can also be returned from an A question */ { - size_t space; - /* * buf is a hostname or txt stream that we still need to * decode to binary @@ -440,71 +630,38 @@ read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) / * data is unused here, and will certainly hold the smaller binary */ - switch (buf[0]) { - case 'h': /* Hostname with base32 */ - case 'H': - if (rv < 5) { - /* 1 byte H, 3 bytes ".xy", >=1 byte data */ - rv = 0; - break; - } + rv = dns_namedec(data, sizeof(data), buf, rv); - rv -= 3; /* rv=strlen, strip ".xy" */ - rv = unpack_data (data, sizeof(data), buf + 1, rv - 1, b32); - /* this also does undotify */ - - rv = MIN(rv, buflen); + rv = MIN(rv, buflen); + if (rv > 0) memcpy(buf, data, rv); - break; - case 'i': /* Hostname++ with base64 */ - case 'I': - if (rv < 5) { - /* 1 byte H, 3 bytes ".xy", >=1 byte data */ - rv = 0; + + } else if (q->type == T_MX || q->type == T_SRV) { + /* buf is like "Hname.com\0Hanother.com\0\0" */ + int buftotal = rv; /* idx of last \0 */ + int bufoffset = 0; + int dataoffset = 0; + int thispartlen, dataspace, datanew; + + while (1) { + thispartlen = strlen(buf); + thispartlen = MIN(thispartlen, buftotal-bufoffset); + dataspace = sizeof(data) - dataoffset; + if (thispartlen <= 0 || dataspace <= 0) break; - } - rv -= 3; /* rv=strlen, strip ".xy" */ - rv = unpack_data (data, sizeof(data), buf + 1, rv - 1, b64); - /* this also does undotify */ - - rv = MIN(rv, buflen); - memcpy(buf, data, rv); - break; - case 't': /* plain base32(Thirty-two) from TXT */ - case 'T': - if (rv < 2) { - rv = 0; + datanew = dns_namedec(data + dataoffset, dataspace, + buf + bufoffset, thispartlen); + if (datanew <= 0) break; - } - space = sizeof(data); - rv = b32->decode (data, &space, buf + 1, rv - 1); - rv = MIN(rv, buflen); - memcpy(buf, data, rv); - break; - case 's': /* plain base64(Sixty-four) from TXT */ - case 'S': - if (rv < 2) { - rv = 0; - break; - } - - space = sizeof(data); - rv = b64->decode (data, &space, buf + 1, rv - 1); - rv = MIN(rv, buflen); - memcpy(buf, data, rv); - break; - case 'r': /* Raw binary from TXT */ - case 'R': - rv--; /* rv>=1 already checked */ - memmove(buf, buf+1, rv); - break; - default: - warnx("Received unsupported encoding"); - rv = 0; - break; + bufoffset += thispartlen + 1; + dataoffset += datanew; } + rv = dataoffset; + rv = MIN(rv, buflen); + if (rv > 0) + memcpy(buf, data, rv); } return rv; @@ -516,41 +673,108 @@ read_dns_withq(int dns_fd, int tun_fd, char *buf, int buflen, struct query *q) / if (r < RAW_HDR_LEN) return 0; /* should start with header */ if (memcmp(data, raw_header, RAW_HDR_IDENT_LEN)) return 0; - /* should be data packet */ - if (RAW_HDR_GET_CMD(data) != RAW_HDR_CMD_DATA) return 0; /* should be my user id */ if (RAW_HDR_GET_USR(data) != userid) return 0; + if (RAW_HDR_GET_CMD(data) == RAW_HDR_CMD_DATA || + RAW_HDR_GET_CMD(data) == RAW_HDR_CMD_PING) + lastdownstreamtime = time(NULL); + + /* should be data packet */ + if (RAW_HDR_GET_CMD(data) != RAW_HDR_CMD_DATA) return 0; + r -= RAW_HDR_LEN; datalen = sizeof(buf); if (uncompress((uint8_t*)buf, &datalen, (uint8_t*) &data[RAW_HDR_LEN], r) == Z_OK) { write_tun(tun_fd, buf, datalen); } + + /* don't process any further */ return 0; } } -static inline int -read_dns_namecheck(int dns_fd, int tun_fd, char *buf, int buflen, char c1, char c2) -/* Only returns >0 when the query hostname in the received packet matches - either c1 or c2; used to tell handshake-dupes apart. +static int +handshake_waitdns(int dns_fd, char *buf, int buflen, char c1, char c2, int timeout) +/* Wait for DNS reply fitting to our latest query and returns it. + Returns length of reply = #bytes used in buf. + Returns 0 if fitting reply happens to be useless. + Returns -2 on (at least) DNS error that fits to our latest query, + error message already printed. + Returns -3 on timeout (given in seconds). + Returns -1 on other errors. + + Timeout is restarted when "wrong" (previous/delayed) replies are received, + so effective timeout may be longer than specified. */ { struct query q; - int rv; + int r, rv; + fd_set fds; + struct timeval tv; - rv = read_dns_withq(dns_fd, tun_fd, buf, buflen, &q); + while (1) { + tv.tv_sec = timeout; + tv.tv_usec = 0; + FD_ZERO(&fds); + FD_SET(dns_fd, &fds); + r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - /* Filter out any other replies */ - if (q.name[0] != c1 && q.name[0] != c2) - return 0; - - /* Print rcode errors */ - if (rv < 0) { - write_dns_error(&q); + if (r < 0) + return -1; /* select error */ + if (r == 0) + return -3; /* select timeout */ + + q.id = 0; + q.name[0] = '\0'; + rv = read_dns_withq(dns_fd, 0, buf, buflen, &q); + + if (q.id != chunkid || (q.name[0] != c1 && q.name[0] != c2)) { +#if 0 + fprintf(stderr, "Ignoring unfitting reply id %d starting with '%c'\n", q.id, q.name[0]); +#endif + continue; + } + + /* if still here: reply matches our latest query */ + + /* Non-recursive DNS servers (such as [a-m].root-servers.net) + return no answer, but only additional and authority records. + Can't explicitly test for that here, just assume that + NOERROR is such situation. Only trigger on the very first + requests (Y or V, depending if -T given). + */ + if (rv < 0 && q.rcode == NOERROR && + (q.name[0] == 'Y' || q.name[0] == 'y' || + q.name[0] == 'V' || q.name[0] == 'v')) { + fprintf(stderr, "Got empty reply. This nameserver may not be resolving recursively, use another.\n"); + fprintf(stderr, "Try \"iodine [options] ns.%s %s\" first, it might just work.\n", + topdomain, topdomain); + return -2; + } + + /* If we get an immediate SERVFAIL on the handshake query + we're waiting for, wait a while before sending the next. + SERVFAIL reliably happens during fragsize autoprobe, but + mostly long after we've moved along to some other queries. + However, some DNS relays, once they throw a SERVFAIL, will + for several seconds apply it immediately to _any_ new query + for the same topdomain. When this happens, waiting a while + is the only option that works. + */ + if (rv < 0 && q.rcode == SERVFAIL) + sleep(1); + + if (rv < 0) { + write_dns_error(&q, 1); + return -2; + } + /* rv either 0 or >0, return it as is. */ + return rv; } - - return rv; /* may also be 0 = useless or -1 = error (printed) */ + + /* not reached */ + return -1; } static int @@ -598,6 +822,7 @@ tunnel_dns(int tun_fd, int dns_fd) { static long packrecv = 0; static long packrecv_oos = 0; + static long packrecv_servfail = 0; int up_ack_seqno; int up_ack_fragment; int new_down_seqno; @@ -611,15 +836,58 @@ tunnel_dns(int tun_fd, int dns_fd) memset(q.name, 0, sizeof(q.name)); read = read_dns_withq(dns_fd, tun_fd, buf, sizeof(buf), &q); - /* Don't process anything that isn't data for us */ + if (conn != CONN_DNS_NULL) + return 1; /* everything already done */ + +#if 0 + fprintf(stderr, " Recv: id %5d name[0]='%c'\n", + q.id, q.name[0]); +#endif + + /* Don't process anything that isn't data for us; usually error + replies from fragsize probes etc. However a sequence of those, + mostly 1 sec apart, will continuously break the >=2-second select + timeout, which means we won't send a proper ping for a while. + So make select a bit faster, <1sec. */ if (q.name[0] != 'P' && q.name[0] != 'p' && - q.name[0] != userid_char && q.name[0] != userid_char2) + q.name[0] != userid_char && q.name[0] != userid_char2) { + send_ping_soon = 700; return -1; /* nothing done */ + } if (read < 2) { /* Maybe SERVFAIL etc. Send ping to get things back in order, but wait a bit to prevent fast ping-pong loops. */ - write_dns_error(&q); + + if (read < 0) + write_dns_error(&q, 0); + + if (read < 0 && q.rcode == SERVFAIL && lazymode && + selecttimeout > 1) { + if (packrecv < 500 && packrecv_servfail < 4) { + packrecv_servfail++; + warnx("Hmm, that's %ld. Your data should still go through...", packrecv_servfail); + } else if (packrecv < 500 && packrecv_servfail == 4) { + packrecv_servfail++; + warnx("I think %ld is too many. Setting interval to 1 to hopefully reduce SERVFAILs. But just ignore them if data still comes through. (Use -I1 next time on this network.)", packrecv_servfail); + selecttimeout = 1; + send_query_sendcnt = 0; + send_query_recvcnt = 0; + } else if (packrecv >= 500 && packrecv_servfail > 0) { + warnx("(Sorry, stopped counting; try -I1 if you experience hiccups.)"); + packrecv_servfail = 0; + } + } + + /* read==1 happens with "QMEM" illegal replies, caused by + heavy reordering, or after short disconnections when + data-CMC has looped around into the "duplicate" values. + All these cases are helped by faster pinging. */ +#if 0 + if (read == 1) + fprintf(stderr, " q=%c id %5d 1-byte illegal \"QMEM\" reply\n", q.name[0], q.id); +#endif + send_ping_soon = 900; return -1; /* nothing done */ } @@ -643,8 +911,8 @@ tunnel_dns(int tun_fd, int dns_fd) up_ack_fragment = buf[0] & 15; #if 0 - fprintf(stderr, " Recv: down %d/%d up %d/%d, %d bytes\n", - new_down_seqno, new_down_fragment, up_ack_seqno, + fprintf(stderr, " Recv: id %5d down %d/%d up %d/%d, %d bytes\n", + q.id, new_down_seqno, new_down_fragment, up_ack_seqno, up_ack_fragment, read); #endif @@ -665,21 +933,30 @@ tunnel_dns(int tun_fd, int dns_fd) /* Still process upstream ack, if any */ } - packrecv++; + if (!(packrecv & 0x1000000)) + packrecv++; + send_query_recvcnt++; /* overflow doesn't matter */ - /* Don't process any non-recent stuff any further */ + /* Don't process any non-recent stuff any further. + No need to remember more than 3 ids: in practice any older replies + arrive after new/current replies, and whatever data the old replies + have, it has become useless in the mean time. + Actually, ever since iodined is replying to both the original query + and the last dupe, this hardly triggers any more. + */ if (q.id != chunkid && q.id != chunkid_prev && q.id != chunkid_prev2) { packrecv_oos++; #if 0 fprintf(stderr, " q=%c Packs received = %8ld Out-of-sequence = %8ld\n", q.name[0], packrecv, packrecv_oos); #endif - if (lazymode && packrecv < 600 && packrecv_oos == 5) - warnx("Hmm, getting some out-of-sequence DNS replies. You may want to try -I1 or -L0 if you notice hiccups in the data traffic."); - if (lazymode && packrecv < 600 && packrecv_oos == 15) { - warnx("Your DNS server connection causes severe re-ordering of DNS traffic. Lazy mode doesn't work well here, switching off. Next time on this network, start with -L0."); - lazymode = 0; + if (lazymode && packrecv < 1000 && packrecv_oos == 5) { + if (selecttimeout > 1) + warnx("Hmm, getting some out-of-sequence DNS replies. Setting interval to 1 (use -I1 next time on this network). If data traffic still has large hiccups, try if -L0 works better."); + else + warnx("Hmm, getting some out-of-sequence DNS replies. If data traffic often has large hiccups, try running with -L0 ."); selecttimeout = 1; - handshake_lazyoff(dns_fd); + send_query_sendcnt = 0; + send_query_recvcnt = 0; } if (send_something_now) { @@ -696,8 +973,7 @@ tunnel_dns(int tun_fd, int dns_fd) lastdownstreamtime = time(NULL); /* In lazy mode, we shouldn't get much replies to our most-recent - query, only during heavy data transfer. Except when severe packet - reordering occurs, such as opendns... Since this means the server + query, only during heavy data transfer. Since this means the server doesn't have any packets left, send one relatively fast (but not too fast, to avoid runaway ping-pong loops..) */ if (q.id == chunkid && lazymode) { @@ -856,6 +1132,7 @@ client_tunnel(int tun_fd, int dns_fd) rv = 0; lastdownstreamtime = time(NULL); + send_query_sendcnt = 0; /* start counting now */ while (running) { tv.tv_sec = selecttimeout; @@ -974,7 +1251,10 @@ send_fragsize_probe(int fd, int fragsize) memset(probedata, MAX(1, rand_seed & 0xff), sizeof(probedata)); probedata[1] = MAX(1, (rand_seed >> 8) & 0xff); rand_seed++; - build_hostname(buf + 4, sizeof(buf) - 4, probedata, sizeof(probedata), topdomain, dataenc); + + /* Note: must either be same, or larger, than send_chunk() */ + build_hostname(buf + 5, sizeof(buf) - 5, probedata, sizeof(probedata), + topdomain, dataenc, hostname_maxlen); fragsize &= 2047; @@ -982,6 +1262,7 @@ send_fragsize_probe(int fd, int fragsize) buf[1] = b32_5to8((userid << 1) | ((fragsize >> 10) & 1)); buf[2] = b32_5to8((fragsize >> 5) & 31); buf[3] = b32_5to8(fragsize & 31); + buf[4] = 'd'; /* dummy to match send_chunk() */ send_query(fd, buf); } @@ -1017,13 +1298,13 @@ send_version(int fd, uint32_t version) rand_seed++; - send_packet(fd, 'V', data, sizeof(data)); + send_packet(fd, 'v', data, sizeof(data)); } static void send_ip_request(int fd, int userid) { - char buf[512] = "I____."; + char buf[512] = "i____."; buf[1] = b32_5to8(userid); buf[2] = b32_5to8((rand_seed >> 10) & 0x1f); @@ -1045,12 +1326,35 @@ send_raw_udp_login(int dns_fd, int userid, int seed) } static void -send_case_check(int fd) +send_upenctest(int fd, char *s) +/* NOTE: String may be at most 63-4=59 chars to fit in 1 dns chunk. */ { - /* The '+' plus character is not allowed according to RFC. - * Expect to get SERVFAIL or similar if it is rejected. - */ - char buf[512] = "zZ+-aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyY1234."; + char buf[512] = "z___"; + + buf[1] = b32_5to8((rand_seed >> 10) & 0x1f); + buf[2] = b32_5to8((rand_seed >> 5) & 0x1f); + buf[3] = b32_5to8((rand_seed ) & 0x1f); + rand_seed++; + + strncat(buf, s, 512); + strncat(buf, ".", 512); + strncat(buf, topdomain, 512 - strlen(buf)); + send_query(fd, buf); +} + +static void +send_downenctest(int fd, char downenc, int variant, char *s, int slen) +/* Note: content/handling of s is not defined yet. */ +{ + char buf[512] = "y_____."; + + buf[1] = tolower(downenc); + buf[2] = b32_5to8(variant); + + buf[3] = b32_5to8((rand_seed >> 10) & 0x1f); + buf[4] = b32_5to8((rand_seed >> 5) & 0x1f); + buf[5] = b32_5to8((rand_seed ) & 0x1f); + rand_seed++; strncat(buf, topdomain, 512 - strlen(buf)); send_query(fd, buf); @@ -1092,7 +1396,7 @@ send_downenc_switch(int fd, int userid) static void send_lazy_switch(int fd, int userid) { - char buf[512] = "o__."; + char buf[512] = "o_____."; buf[1] = b32_5to8(userid); if (lazymode) @@ -1100,6 +1404,11 @@ send_lazy_switch(int fd, int userid) else buf[2] = 'i'; + buf[3] = b32_5to8((rand_seed >> 10) & 0x1f); + buf[4] = b32_5to8((rand_seed >> 5) & 0x1f); + buf[5] = b32_5to8((rand_seed ) & 0x1f); + rand_seed++; + strncat(buf, topdomain, 512 - strlen(buf)); send_query(fd, buf); } @@ -1109,31 +1418,18 @@ handshake_version(int dns_fd, int *seed) { char hex[] = "0123456789abcdef"; char hex2[] = "0123456789ABCDEF"; - struct timeval tv; char in[4096]; - fd_set fds; uint32_t payload; int i; - int r; int read; for (i = 0; running && i < 5; i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; send_version(dns_fd, VERSION); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'v', 'V'); - - if(read <= 0) - continue; + read = handshake_waitdns(dns_fd, in, sizeof(in), 'v', 'V', i+1); + /*XXX START adjust indent 1 tab back*/ if (read >= 9) { payload = (((in[4] & 0xff) << 24) | ((in[5] & 0xff) << 16) | @@ -1156,9 +1452,9 @@ handshake_version(int dns_fd, int *seed) warnx("Server full, all %d slots are taken. Try again later", payload); return 1; } - } else + } else if (read > 0) warnx("did not receive proper login challenge"); - } + /*XXX END adjust indent 1 tab back*/ fprintf(stderr, "Retrying version check...\n"); } @@ -1169,36 +1465,23 @@ handshake_version(int dns_fd, int *seed) static int handshake_login(int dns_fd, int seed) { - struct timeval tv; char in[4096]; char login[16]; char server[65]; char client[65]; int mtu; - fd_set fds; int i; - int r; int read; login_calculate(login, 16, password, seed); for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; send_login(dns_fd, login, 16); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'l', 'L'); - - if(read <= 0) - continue; + read = handshake_waitdns(dns_fd, in, sizeof(in), 'l', 'L', i+1); + /*XXX START adjust indent 1 tab back*/ if (read > 0) { int netmask; if (strncmp("LNAK", in, 4) == 0) { @@ -1221,7 +1504,7 @@ handshake_login(int dns_fd, int seed) fprintf(stderr, "Received bad handshake\n"); } } - } + /*XXX END adjust indent 1 tab back*/ fprintf(stderr, "Retrying login...\n"); } @@ -1241,20 +1524,14 @@ handshake_raw_udp(int dns_fd, int seed) unsigned remoteaddr = 0; struct in_addr server; - fprintf(stderr, "Testing raw UDP data to the server (skip with -r)\n"); + fprintf(stderr, "Testing raw UDP data to the server (skip with -r)"); for (i=0; running && i<3 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; send_ip_request(dns_fd, userid); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + len = handshake_waitdns(dns_fd, in, sizeof(in), 'i', 'I', i+1); - if(r > 0) { - len = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'i', 'I'); + /*XXX START adjust indent 1 tab back*/ if (len == 5 && in[0] == 'I') { /* Received IP address */ remoteaddr = (in[1] & 0xff); @@ -1267,11 +1544,14 @@ handshake_raw_udp(int dns_fd, int seed) server.s_addr = ntohl(remoteaddr); break; } - } else { - fprintf(stderr, "."); - fflush(stderr); - } + /*XXX END adjust indent 1 tab back*/ + + fprintf(stderr, "."); + fflush(stderr); } + fprintf(stderr, "\n"); + if (!running) + return 0; if (!remoteaddr) { fprintf(stderr, "Failed to get raw server IP, will use DNS mode.\n"); @@ -1324,91 +1604,472 @@ handshake_raw_udp(int dns_fd, int seed) } static int -handshake_case_check(int dns_fd) +handshake_upenctest(int dns_fd, char *s) +/* NOTE: *s may be max 59 chars; must start with "aA" for case-swap check + Returns: + -1: case swap, no need for any further test: error printed; or Ctrl-C + 0: not identical or error or timeout + 1: identical string returned +*/ { - struct timeval tv; char in[4096]; - fd_set fds; + unsigned char *uin = (unsigned char *) in; + unsigned char *us = (unsigned char *) s; int i; - int r; int read; - int case_preserved; + int slen; - case_preserved = 0; - for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; + slen = strlen(s); + for (i=0; running && i<3 ;i++) { - send_case_check(dns_fd); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); + send_upenctest(dns_fd, s); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + read = handshake_waitdns(dns_fd, in, sizeof(in), 'z', 'Z', i+1); - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'z', 'Z'); - - if (read > 0) { - if (read < (27 * 2)) { - fprintf(stderr, "Received short case check reply. Will use base32 encoder\n"); - return case_preserved; - } else { - int k; + if (read == -2) + return 0; /* hard error */ - /* TODO enhance this, base128 is probably also possible */ - case_preserved = 1; - for (k = 0; k < 27 && case_preserved; k += 2) { - if (in[k] == in[k+1]) { - /* test string: zZ+-aAbBcCdDeE... */ - case_preserved = 0; - } - } - return case_preserved; - } - } else { - fprintf(stderr, "Got error on case check, will use base32\n"); - return case_preserved; + if (read > 0 && read < slen + 4) + return 0; /* reply too short (chars dropped) */ + + if (read > 0) { + int k; +#if 0 + /* in[56] = '@'; */ + /* in[56] = '_'; */ + /* if (in[29] == '\344') in[29] = 'a'; */ + in[read] = '\0'; + fprintf(stderr, "BounceReply: >%s<\n", in); +#endif + /* quick check if case swapped, to give informative error msg */ + if (in[4] == 'A') { + fprintf(stderr, "DNS queries get changed to uppercase, keeping upstream codec Base32\n"); + return -1; } + if (in[5] == 'a') { + fprintf(stderr, "DNS queries get changed to lowercase, keeping upstream codec Base32\n"); + return -1; + } + + for (k = 0; k < slen; k++) { + if (in[k+4] != s[k]) { + /* Definitely not reliable */ + if (in[k+4] >= ' ' && in[k+4] <= '~' && + s[k] >= ' ' && s[k] <= '~') { + fprintf(stderr, "DNS query char '%c' gets changed into '%c'\n", + s[k], in[k+4]); + } else { + fprintf(stderr, "DNS query char 0x%02X gets changed into 0x%02X\n", + (unsigned int) us[k], + (unsigned int) uin[k+4]); + } + return 0; + } + } + /* if still here, then all okay */ + return 1; } - fprintf(stderr, "Retrying case check...\n"); + fprintf(stderr, "Retrying upstream codec test...\n"); } - fprintf(stderr, "No reply on case check, continuing\n"); - return case_preserved; + if (!running) + return -1; + + /* timeout */ + return 0; +} + +static int +handshake_upenc_autodetect(int dns_fd) +/* Returns: + 0: keep Base32 + 1: Base64 is okay + 2: Base64u is okay + 3: Base128 is okay +*/ +{ + /* Note: max 59 chars, must start with "aA". + pat64: If 0129 work, assume 3-8 are okay too. + + RFC1035 par 2.3.1 states that [A-Z0-9-] allowed, but only + [A-Z] as first, and [A-Z0-9] as last char _per label_. + Test by having '-' as last char. + */ + char *pat64="aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ+0129-"; + char *pat64u="aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ_0129-"; + char *pat128a="aA-Aaahhh-Drink-mal-ein-J\344germeister-"; + char *pat128b="aA-La-fl\373te-na\357ve-fran\347aise-est-retir\351-\340-Cr\350te"; + char *pat128c="aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ"; + char *pat128d="aA0123456789\274\275\276\277" + "\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317"; + char *pat128e="aA" + "\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337" + "\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357" + "\360\361\362\363\364\365\366\367\370\371\372\373\374\375"; + int res; + + /* Try Base128, starting very gently to not draw attention */ + while (1) { + res = handshake_upenctest(dns_fd, pat128a); + if (res < 0) { + /* DNS swaps case, msg already printed; or Ctrl-C */ + return 0; + } else if (res == 0) { + /* Probably not okay, skip Base128 entirely */ + break; + } + + res = handshake_upenctest(dns_fd, pat128b); + if (res < 0) + return 0; + else if (res == 0) + break; + + /* if this works, we can test the real stuff */ + + res = handshake_upenctest(dns_fd, pat128c); + if (res < 0) + return 0; + else if (res == 0) + break; + + res = handshake_upenctest(dns_fd, pat128d); + if (res < 0) + return 0; + else if (res == 0) + break; + + res = handshake_upenctest(dns_fd, pat128e); + if (res < 0) + return 0; + else if (res == 0) + break; + + /* if still here, then base128 works completely */ + return 3; + } + + /* Try Base64 (with plus sign) */ + res = handshake_upenctest(dns_fd, pat64); + if (res < 0) { + /* DNS swaps case, msg already printed; or Ctrl-C */ + return 0; + } else if (res > 0) { + /* All okay, Base64 msg will be printed later */ + return 1; + } + + /* Try Base64u (with _u_nderscore) */ + res = handshake_upenctest(dns_fd, pat64u); + if (res < 0) { + /* DNS swaps case, msg already printed; or Ctrl-C */ + return 0; + } else if (res > 0) { + /* All okay, Base64u msg will be printed later */ + return 2; + } + + /* if here, then nonthing worked */ + fprintf(stderr, "Keeping upstream codec Base32\n"); + return 0; +} + +static int +handshake_downenctest(int dns_fd, char trycodec) +/* Returns: + 0: not identical or error or timeout + 1: identical string returned +*/ +{ + char in[4096]; + int i; + int read; + char *s = DOWNCODECCHECK1; + int slen = DOWNCODECCHECK1_LEN; + + for (i=0; running && i<3 ;i++) { + + send_downenctest(dns_fd, trycodec, 1, NULL, 0); + + read = handshake_waitdns(dns_fd, in, sizeof(in), 'y', 'Y', i+1); + + if (read == -2) + return 0; /* hard error */ + + if (read > 0 && read != slen) + return 0; /* reply incorrect = unreliable */ + + if (read > 0) { + int k; + for (k = 0; k < slen; k++) { + if (in[k] != s[k]) { + /* Definitely not reliable */ + return 0; + } + } + /* if still here, then all okay */ + return 1; + } + + fprintf(stderr, "Retrying downstream codec test...\n"); + } + + /* timeout */ + return 0; +} + +static char +handshake_downenc_autodetect(int dns_fd) +/* Returns codec char (or ' ' if no advanced codec works) */ +{ + int base64ok = 0; + int base64uok = 0; + int base128ok = 0; + + if (do_qtype == T_NULL) { + /* no other choice than raw */ + fprintf(stderr, "No alternative downstream codec available, using default (Raw)\n"); + return ' '; + } + + fprintf(stderr, "Autodetecting downstream codec (use -O to override)\n"); + + /* Try Base64 */ + if (handshake_downenctest(dns_fd, 'S')) + base64ok = 1; + else if (running && handshake_downenctest(dns_fd, 'U')) + base64uok = 1; + + /* Try Base128 only if 64 gives us some perspective */ + if (running && (base64ok || base64uok)) { + if (handshake_downenctest(dns_fd, 'V')) + base128ok = 1; + } + + /* If 128 works, then TXT may give us Raw as well */ + if (running && (base128ok && do_qtype == T_TXT)) { + if (handshake_downenctest(dns_fd, 'R')) + return 'R'; + } + + if (!running) + return ' '; + + if (base128ok) + return 'V'; + if (base64ok) + return 'S'; + if (base64uok) + return 'U'; + + fprintf(stderr, "No advanced downstream codecs seem to work, using default (Base32)\n"); + return ' '; +} + +static int +handshake_qtypetest(int dns_fd, int timeout) +/* Returns: + 0: doesn't work with this timeout + 1: works properly +*/ +{ + char in[4096]; + int read; + char *s = DOWNCODECCHECK1; + int slen = DOWNCODECCHECK1_LEN; + int trycodec; + int k; + + if (do_qtype == T_NULL) + trycodec = 'R'; + else + trycodec = 'T'; + + /* We could use 'Z' bouncing here, but 'Y' also tests that 0-255 + byte values can be returned, which is needed for NULL to work. */ + + send_downenctest(dns_fd, trycodec, 1, NULL, 0); + + read = handshake_waitdns(dns_fd, in, sizeof(in), 'y', 'Y', timeout); + + if (read != slen) + return 0; /* incorrect */ + + for (k = 0; k < slen; k++) { + if (in[k] != s[k]) { + /* corrupted */ + return 0; + } + } + + /* if still here, then all okay */ + return 1; +} + +static int +handshake_qtype_numcvt(int num) +{ + switch (num) { + case 0: return T_NULL; + case 1: return T_TXT; + case 2: return T_SRV; + case 3: return T_MX; + case 4: return T_CNAME; + case 5: return T_A; + } + return T_UNSET; +} + +static int +handshake_qtype_autodetect(int dns_fd) +/* Returns: + 0: okay, do_qtype set + 1: problem, program exit +*/ +{ + int highestworking = 100; + int timeout; + int qtypenum; + + fprintf(stderr, "Autodetecting DNS query type (use -T to override)"); + fflush(stderr); + + /* Method: try all "interesting" qtypes with a 1-sec timeout, then try + all "still-interesting" qtypes with a 2-sec timeout, etc. + "Interesting" means: qtypes that (are expected to) have higher + bandwidth than what we know is working already (highestworking). + + Note that DNS relays may not immediately resolve the first (NULL) + query in 1 sec, due to long recursive lookups, so we keep trying + to see if things will start working after a while. + */ + + for (timeout = 1; running && timeout <= 3; timeout++) { + for (qtypenum = 0; running && qtypenum < highestworking; qtypenum++) { + do_qtype = handshake_qtype_numcvt(qtypenum); + if (do_qtype == T_UNSET) + break; /* this round finished */ + + fprintf(stderr, "."); + fflush(stderr); + + if (handshake_qtypetest(dns_fd, timeout)) { + /* okay */ + highestworking = qtypenum; +#if 0 + fprintf(stderr, " Type %s timeout %d works\n", + get_qtype(), timeout); +#endif + break; + /* try others with longer timeout */ + } + /* else: try next qtype with same timeout */ + } + if (highestworking == 0) + /* good, we have NULL; abort immediately */ + break; + } + + fprintf(stderr, "\n"); + + if (!running) { + warnx("Stopped while autodetecting DNS query type (try setting manually with -T)"); + return 1; /* problem */ + } + + /* finished */ + do_qtype = handshake_qtype_numcvt(highestworking); + + if (do_qtype == T_UNSET) { + /* also catches highestworking still 100 */ + warnx("No suitable DNS query type found. Are you connected to a network?"); + warnx("If you expect very long roundtrip delays, use -T explicitly."); + warnx("(Also, connecting to an \"ancient\" version of iodined won't work.)"); + return 1; /* problem */ + } + + /* "using qtype" message printed in handshake function */ + return 0; /* okay */ +} + +static int +handshake_edns0_check(int dns_fd) +/* Returns: + 0: EDNS0 not supported; or Ctrl-C + 1: EDNS0 works +*/ +{ + char in[4096]; + int i; + int read; + char *s = DOWNCODECCHECK1; + int slen = DOWNCODECCHECK1_LEN; + char trycodec; + + if (do_qtype == T_NULL) + trycodec = 'R'; + else + trycodec = 'T'; + + for (i=0; running && i<3 ;i++) { + + send_downenctest(dns_fd, trycodec, 1, NULL, 0); + + read = handshake_waitdns(dns_fd, in, sizeof(in), 'y', 'Y', i+1); + + if (read == -2) + return 0; /* hard error */ + + if (read > 0 && read != slen) + return 0; /* reply incorrect = unreliable */ + + if (read > 0) { + int k; + for (k = 0; k < slen; k++) { + if (in[k] != s[k]) { + /* Definitely not reliable */ + return 0; + } + } + /* if still here, then all okay */ + return 1; + } + + fprintf(stderr, "Retrying EDNS0 support test...\n"); + } + + /* timeout or Ctrl-C */ + return 0; } static void -handshake_switch_codec(int dns_fd) +handshake_switch_codec(int dns_fd, int bits) { - struct timeval tv; char in[4096]; - fd_set fds; int i; - int r; int read; + struct encoder *tempenc; + + if (bits == 5) + tempenc = get_base32_encoder(); + else if (bits == 6) + tempenc = get_base64_encoder(); + else if (bits == 26) /* "2nd" 6 bits per byte, with underscore */ + tempenc = get_base64u_encoder(); + else if (bits == 7) + tempenc = get_base128_encoder(); + else return; + + fprintf(stderr, "Switching upstream to codec %s\n", tempenc->name); - dataenc = get_base64_encoder(); - fprintf(stderr, "Switching upstream to %s codec\n", dataenc->name); - /* Send to server that this user will use base64 from now on */ for (i=0; running && i<5 ;i++) { - int bits; - tv.tv_sec = i + 1; - tv.tv_usec = 0; - - bits = 6; /* base64 = 6 bits per byte */ send_codec_switch(dns_fd, userid, bits); - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); + read = handshake_waitdns(dns_fd, in, sizeof(in), 's', 'S', i+1); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 's', 'S'); - + /*XXX START adjust indent 1 tab back*/ if (read > 0) { if (strncmp("BADLEN", in, 6) == 0) { fprintf(stderr, "Server got bad message length. "); @@ -1422,50 +2083,48 @@ handshake_switch_codec(int dns_fd) } in[read] = 0; /* zero terminate */ fprintf(stderr, "Server switched upstream to codec %s\n", in); + dataenc = tempenc; return; } - } + /*XXX END adjust indent 1 tab back*/ + fprintf(stderr, "Retrying codec switch...\n"); } + if (!running) + return; + fprintf(stderr, "No reply from server on codec switch. "); codec_revert: - fprintf(stderr, "Falling back to base32\n"); - dataenc = get_base32_encoder(); + fprintf(stderr, "Falling back to upstream codec %s\n", dataenc->name); } static void handshake_switch_downenc(int dns_fd) { - struct timeval tv; char in[4096]; - fd_set fds; int i; - int r; int read; char *dname; dname = "Base32"; if (downenc == 'S') dname = "Base64"; + else if (downenc == 'U') + dname = "Base64u"; + else if (downenc == 'V') + dname = "Base128"; else if (downenc == 'R') dname = "Raw"; fprintf(stderr, "Switching downstream to codec %s\n", dname); for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; send_downenc_switch(dns_fd, userid); - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'o', 'O'); + read = handshake_waitdns(dns_fd, in, sizeof(in), 'o', 'O', i+1); + /*XXX START adjust indent 1 tab back*/ if (read > 0) { if (strncmp("BADLEN", in, 6) == 0) { fprintf(stderr, "Server got bad message length. "); @@ -1481,40 +2140,34 @@ handshake_switch_downenc(int dns_fd) fprintf(stderr, "Server switched downstream to codec %s\n", in); return; } - } + /*XXX END adjust indent 1 tab back*/ + fprintf(stderr, "Retrying codec switch...\n"); } + if (!running) + return; + fprintf(stderr, "No reply from server on codec switch. "); codec_revert: - fprintf(stderr, "Falling back to base32\n"); + fprintf(stderr, "Falling back to downstream codec Base32\n"); } static void handshake_try_lazy(int dns_fd) { - struct timeval tv; char in[4096]; - fd_set fds; int i; - int r; int read; fprintf(stderr, "Switching to lazy mode for low-latency\n"); - for (i=0; running && i<3; i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; + for (i=0; running && i<5; i++) { send_lazy_switch(dns_fd, userid); - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'o', 'O'); + read = handshake_waitdns(dns_fd, in, sizeof(in), 'o', 'O', i+1); + /*XXX START adjust indent 1 tab back*/ if (read > 0) { if (strncmp("BADLEN", in, 6) == 0) { fprintf(stderr, "Server got bad message length. "); @@ -1531,10 +2184,14 @@ handshake_try_lazy(int dns_fd) return; } } - } + /*XXX END adjust indent 1 tab back*/ + fprintf(stderr, "Retrying lazy mode switch...\n"); } - fprintf(stderr, "No reply from server on lazy switch, probably old server version. "); + if (!running) + return; + + fprintf(stderr, "No reply from server on lazy switch. "); codec_revert: fprintf(stderr, "Falling back to legacy mode\n"); @@ -1546,37 +2203,29 @@ static void handshake_lazyoff(int dns_fd) /* Used in the middle of data transfer, timing is different and no error msgs */ { - struct timeval tv; char in[4096]; - fd_set fds; int i; - int r; int read; for (i=0; running && i<5; i++) { - tv.tv_sec = 0; - tv.tv_usec = 500000; send_lazy_switch(dns_fd, userid); - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); + read = handshake_waitdns(dns_fd, in, sizeof(in), 'o', 'O', 1); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'o', 'O'); - - if (read > 0) { - if (read == 4 && strncmp("Immediate", in, 9) == 0) { - fprintf(stderr, "Server switched back to legacy mode.\n"); + /*XXX START adjust indent 2 tabs back*/ + if (read == 9 && strncmp("Immediate", in, 9) == 0) { + warnx("Server switched back to legacy mode.\n"); lazymode = 0; selecttimeout = 1; return; } - } - } + /*XXX END adjust indent 2 tabs back*/ } + if (!running) + return; + + warnx("No reply from server on legacy mode switch.\n"); } static int @@ -1584,7 +2233,9 @@ fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) /* Returns: 0: keep checking, 1: break loop (either okay or definitely wrong) */ { int acked_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); - static int nocheck_warned = 0; + int okay; + int i; + unsigned int v; if (read >= 5 && strncmp("BADIP", in, 5) == 0) { fprintf(stderr, "got BADIP (Try iodined -c)..\n"); @@ -1613,14 +2264,20 @@ fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) /* test: */ /* in[123] = 123; */ - /* Check for corruption */ - if ((in[2] & 0xff) == 107) { - int okay = 1; - int i; - unsigned int v = in[3] & 0xff; + if ((in[2] & 0xff) != 107) { + fprintf(stderr, "\n"); + warnx("corruption at byte 2, this won't work. Try -O Base32, or other -T options."); + *max_fragsize = -1; + return 1; + } - for (i = 3; i < read; i++, v += 107) - if ((in[i] & 0xff) != (v & 0xff)) { + /* Check for corruption */ + okay = 1; + v = in[3] & 0xff; + + /*XXX START adjust indent 1 tab back*/ + for (i = 3; i < read; i++, v = (v + 107) & 0xff) + if ((in[i] & 0xff) != v) { okay = 0; break; } @@ -1635,22 +2292,13 @@ fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) fprintf(stderr, "%d corrupted at %d.. (Try -O Base32)\n", acked_fragsize, i); } else { fprintf(stderr, "%d corrupted at %d.. ", acked_fragsize, i); - fflush(stderr); } + fflush(stderr); return 1; } - } /* always returns */ + /*XXX END adjust indent 1 tab back*/ - /* here when uncheckable, so assume correct */ - - if (read >= 3 && nocheck_warned == 0) { - fprintf(stderr, "(Old server version, cannot check for corruption)\n"); - fflush(stderr); - nocheck_warned = 1; - } - fprintf(stderr, "%d ok.. ", acked_fragsize); - fflush(stderr); - *max_fragsize = acked_fragsize; + /* notreached */ return 1; } @@ -1658,11 +2306,8 @@ fragsize_check(char *in, int read, int proposed_fragsize, int *max_fragsize) static int handshake_autoprobe_fragsize(int dns_fd) { - struct timeval tv; char in[4096]; - fd_set fds; int i; - int r; int read; int proposed_fragsize = 768; int range = 768; @@ -1673,27 +2318,25 @@ handshake_autoprobe_fragsize(int dns_fd) while (running && range > 0 && (range >= 8 || max_fragsize < 300)) { /* stop the slow probing early when we have enough bytes anyway */ for (i=0; running && i<3 ;i++) { - tv.tv_sec = 1; - tv.tv_usec = 0; + send_fragsize_probe(dns_fd, proposed_fragsize); - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); - - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'r', 'R'); + read = handshake_waitdns(dns_fd, in, sizeof(in), 'r', 'R', 1); + /*XXX START adjust indent 1 tab back*/ if (read > 0) { /* We got a reply */ if (fragsize_check(in, read, proposed_fragsize, &max_fragsize) == 1) break; } - } + /*XXX END adjust indent 1 tab back*/ + fprintf(stderr, "."); fflush(stderr); } + if (max_fragsize < 0) + break; + range >>= 1; if (max_fragsize == proposed_fragsize) { /* Try bigger */ @@ -1711,16 +2354,27 @@ handshake_autoprobe_fragsize(int dns_fd) return 0; } if (max_fragsize <= 2) { - /* Tried all the way down to 2 and found no good size */ + /* Tried all the way down to 2 and found no good size. + But we _did_ do all handshake before this, so there must + be some workable connection. */ fprintf(stderr, "\n"); - warnx("found no accepted fragment size. (Try forcing with -m, or try other -T or -O options)"); + warnx("found no accepted fragment size."); + warnx("try setting -M to 200 or lower, or try other -T or -O options."); return 0; } /* data header adds 2 bytes */ fprintf(stderr, "will use %d-2=%d\n", max_fragsize, max_fragsize - 2); - if (do_qtype != T_NULL && downenc == ' ') - fprintf(stderr, "(Maybe other -O options will increase throughput)\n"); + /* need 1200 / 16frags = 75 bytes fragsize */ + if (max_fragsize < 82) { + fprintf(stderr, "Note: this probably won't work well.\n"); + fprintf(stderr, "Try setting -M to 200 or lower, or try other DNS types (-T option).\n"); + } else if (max_fragsize < 202 && + (do_qtype == T_NULL || do_qtype == T_TXT || + do_qtype == T_SRV || do_qtype == T_MX)) { + fprintf(stderr, "Note: this isn't very much.\n"); + fprintf(stderr, "Try setting -M to 200 or lower, or try other DNS types (-T option).\n"); + } return max_fragsize - 2; } @@ -1728,28 +2382,18 @@ handshake_autoprobe_fragsize(int dns_fd) static void handshake_set_fragsize(int dns_fd, int fragsize) { - struct timeval tv; char in[4096]; - fd_set fds; int i; - int r; int read; fprintf(stderr, "Setting downstream fragment size to max %d...\n", fragsize); for (i=0; running && i<5 ;i++) { - tv.tv_sec = i + 1; - tv.tv_usec = 0; send_set_downstream_fragsize(dns_fd, fragsize); - - FD_ZERO(&fds); - FD_SET(dns_fd, &fds); - r = select(dns_fd + 1, &fds, NULL, NULL, &tv); + read = handshake_waitdns(dns_fd, in, sizeof(in), 'n', 'N', i+1); - if(r > 0) { - read = read_dns_namecheck(dns_fd, 0, in, sizeof(in), 'n', 'N'); - + /*XXX START adjust indent 1 tab back*/ if (read > 0) { int accepted_fragsize; @@ -1764,9 +2408,13 @@ handshake_set_fragsize(int dns_fd, int fragsize) accepted_fragsize = ((in[0] & 0xff) << 8) | (in[1] & 0xff); return; } - } + /*XXX END adjust indent 1 tab back*/ + fprintf(stderr, "Retrying set fragsize...\n"); } + if (!running) + return; + fprintf(stderr, "No reply from server when setting fragsize. Keeping default.\n"); } @@ -1774,9 +2422,21 @@ int client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize) { int seed; - int case_preserved; + int upcodec; int r; + dnsc_use_edns0 = 0; + + /* qtype message printed in handshake function */ + if (do_qtype == T_UNSET) { + r = handshake_qtype_autodetect(dns_fd); + if (r) { + return r; + } + } + + fprintf(stderr, "Using DNS type %s queries\n", get_qtype()); + r = handshake_version(dns_fd, &seed); if (r) { return r; @@ -1794,19 +2454,48 @@ client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsiz if (raw_mode == 0) { fprintf(stderr, "Skipping raw mode\n"); } - case_preserved = handshake_case_check(dns_fd); - if (case_preserved) { - handshake_switch_codec(dns_fd); + dnsc_use_edns0 = 1; + if (handshake_edns0_check(dns_fd) && running) { + fprintf(stderr, "Using EDNS0 extension\n"); + } else if (!running) { + return -1; + } else { + fprintf(stderr, "DNS relay does not support EDNS0 extension\n"); + dnsc_use_edns0 = 0; } + upcodec = handshake_upenc_autodetect(dns_fd); + if (!running) + return -1; + + if (upcodec == 1) { + handshake_switch_codec(dns_fd, 6); + } else if (upcodec == 2) { + handshake_switch_codec(dns_fd, 26); + } else if (upcodec == 3) { + handshake_switch_codec(dns_fd, 7); + } + if (!running) + return -1; + + if (downenc == ' ') { + downenc = handshake_downenc_autodetect(dns_fd); + } + if (!running) + return -1; + if (downenc != ' ') { handshake_switch_downenc(dns_fd); } + if (!running) + return -1; if (lazymode) { handshake_try_lazy(dns_fd); } + if (!running) + return -1; if (autodetect_frag_size) { fragsize = handshake_autoprobe_fragsize(dns_fd); @@ -1816,6 +2505,8 @@ client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsiz } handshake_set_fragsize(dns_fd, fragsize); + if (!running) + return -1; } return 0; diff --git a/src/client.h b/src/client.h index e4141bf..16ab0e4 100644 --- a/src/client.h +++ b/src/client.h @@ -27,9 +27,11 @@ void client_set_nameserver(const char *cp, int port); void client_set_topdomain(const char *cp); void client_set_password(const char *cp); void set_qtype(char *qtype); +char *get_qtype(); void set_downenc(char *encoding); void client_set_selecttimeout(int select_timeout); void client_set_lazymode(int lazy_mode); +void client_set_hostname_maxlen(int i); int client_handshake(int dns_fd, int raw_mode, int autodetect_frag_size, int fragsize); int client_tunnel(int tun_fd, int dns_fd); diff --git a/src/common.h b/src/common.h index e55f1ba..8dbbfbd 100644 --- a/src/common.h +++ b/src/common.h @@ -74,6 +74,9 @@ extern const unsigned char raw_header[RAW_HDR_LEN]; # define DONT_FRAG_VALUE 1 #endif +#define T_UNSET 65432 +/* Unused RR type; "private use" range, see http://www.bind9.net/dns-parameters */ + struct packet { int len; /* Total packet length */ @@ -89,10 +92,12 @@ struct query { unsigned short type; unsigned short rcode; unsigned short id; - unsigned short iddupe; /* only used for dupe checking */ struct in_addr destination; struct sockaddr from; int fromlen; + unsigned short id2; + struct sockaddr from2; + int fromlen2; }; enum connection { diff --git a/src/dns.c b/src/dns.c index e1704c9..fb2bcaf 100644 --- a/src/dns.c +++ b/src/dns.c @@ -39,6 +39,8 @@ #include "encoding.h" #include "read.h" +int dnsc_use_edns0 = 1; + #define CHECKLEN(x) if (buflen - (p-buf) < (x)) return 0 int @@ -48,6 +50,7 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ short name; char *p; int len; + int ancnt; if (buflen < sizeof(HEADER)) return 0; @@ -68,7 +71,6 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ switch (qr) { case QR_ANSWER: - header->ancount = htons(1); header->qdcount = htons(1); name = 0xc000 | ((p - buf) & 0x3fff); @@ -81,56 +83,115 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ putshort(&p, C_IN); /* Answer section */ - CHECKLEN(10); - putshort(&p, name); - if (q->type == T_A) - putshort(&p, T_CNAME); /* answer CNAME to A question */ - else - putshort(&p, q->type); - putshort(&p, C_IN); - putlong(&p, 0); /* TTL */ - if (q->type == T_CNAME || q->type == T_A || q->type == T_MX) { + if (q->type == T_CNAME || q->type == T_A) { /* data is expected to be like "Hblabla.host.name.com\0" */ - char *startp = p; + char *startp; int namelen; + CHECKLEN(10); + putshort(&p, name); + if (q->type == T_A) + /* answer CNAME to A question */ + putshort(&p, T_CNAME); + else + putshort(&p, q->type); + putshort(&p, C_IN); + putlong(&p, 0); /* TTL */ + + startp = p; p += 2; /* skip 2 bytes length */ - CHECKLEN(2); - if (q->type == T_MX) - putshort(&p, 10); /* preference */ putname(&p, buflen - (p - buf), data); CHECKLEN(0); namelen = p - startp; namelen -= 2; putshort(&startp, namelen); + ancnt = 1; + } else if (q->type == T_MX || q->type == T_SRV) { + /* Data is expected to be like + "Hblabla.host.name.com\0Hanother.com\0\0" + For SRV, see RFC2782. + */ + + char *mxdata = data; + char *startp; + int namelen; + + ancnt = 1; + while (1) { + CHECKLEN(10); + putshort(&p, name); + putshort(&p, q->type); + putshort(&p, C_IN); + putlong(&p, 0); /* TTL */ + + startp = p; + p += 2; /* skip 2 bytes length */ + CHECKLEN(2); + putshort(&p, 10 * ancnt); /* preference */ + + if (q->type == T_SRV) { + /* weight, port (5060 = SIP) */ + CHECKLEN(4); + putshort(&p, 10); + putshort(&p, 5060); + } + + putname(&p, buflen - (p - buf), mxdata); + CHECKLEN(0); + namelen = p - startp; + namelen -= 2; + putshort(&startp, namelen); + + mxdata = mxdata + strlen(mxdata) + 1; + if (*mxdata == '\0') + break; + + ancnt++; + } } else if (q->type == T_TXT) { /* TXT has binary or base-X data */ - char *startp = p; + char *startp; int txtlen; + CHECKLEN(10); + putshort(&p, name); + putshort(&p, q->type); + putshort(&p, C_IN); + putlong(&p, 0); /* TTL */ + + startp = p; p += 2; /* skip 2 bytes length */ puttxtbin(&p, buflen - (p - buf), data, datalen); CHECKLEN(0); txtlen = p - startp; txtlen -= 2; putshort(&startp, txtlen); + ancnt = 1; } else { /* NULL has raw binary data */ + + CHECKLEN(10); + putshort(&p, name); + putshort(&p, q->type); + putshort(&p, C_IN); + putlong(&p, 0); /* TTL */ + datalen = MIN(datalen, buflen - (p - buf)); CHECKLEN(2); putshort(&p, datalen); CHECKLEN(datalen); putdata(&p, data, datalen); CHECKLEN(0); + ancnt = 1; } + header->ancount = htons(ancnt); break; case QR_QUERY: /* Note that iodined also uses this for forward queries */ header->qdcount = htons(1); - header->arcount = htons(1); datalen = MIN(datalen, buflen - (p - buf)); putname(&p, datalen, data); @@ -141,6 +202,9 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ /* EDNS0 to advertise maximum response length (even CNAME/A/MX, 255+255+header would be >512) */ + if (dnsc_use_edns0) { + header->arcount = htons(1); + /*XXX START adjust indent 1 tab forward*/ CHECKLEN(11); putbyte(&p, 0x00); /* Root */ putshort(&p, 0x0029); /* OPT */ @@ -148,6 +212,9 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ putshort(&p, 0x0000); /* Higher bits/edns version */ putshort(&p, 0x8000); /* Z */ putshort(&p, 0x0000); /* Data length */ + /*XXX END adjust indent 1 tab forward*/ + } + break; } @@ -159,13 +226,14 @@ dns_encode(char *buf, size_t buflen, struct query *q, qr_t qr, char *data, size_ int dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomain) /* Only used when iodined gets an NS type query */ +/* Mostly same as dns_encode_a_response() below */ { HEADER *header; int len; short name; short topname; short nsname; - char *domain; + char *ipp; int domain_len; char *p; @@ -193,13 +261,16 @@ dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomai /* pointer to start of name */ name = 0xc000 | ((p - buf) & 0x3fff); - domain = strstr(q->name, topdomain); - if (domain) { - domain_len = (int) (domain - q->name); - } else { + domain_len = strlen(q->name) - strlen(topdomain); + if (domain_len < 0 || domain_len == 1) return -1; - } - /* pointer to start of topdomain */ + if (strcasecmp(q->name + domain_len, topdomain)) + return -1; + if (domain_len >= 1 && q->name[domain_len - 1] != '.') + return -1; + + /* pointer to start of topdomain; instead of dots at the end + we have length-bytes in front, so total length is the same */ topname = 0xc000 | ((p - buf + domain_len) & 0x3fff); /* Query section */ @@ -233,12 +304,72 @@ dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomai putshort(&p, 4); /* Data length */ /* ugly hack to output IP address */ - domain = (char *) &q->destination; + ipp = (char *) &q->destination; CHECKLEN(4); - putbyte(&p, *domain++); - putbyte(&p, *domain++); - putbyte(&p, *domain++); - putbyte(&p, *domain); + putbyte(&p, *(ipp++)); + putbyte(&p, *(ipp++)); + putbyte(&p, *(ipp++)); + putbyte(&p, *ipp); + + len = p - buf; + return len; +} + +int +dns_encode_a_response(char *buf, size_t buflen, struct query *q) +/* Only used when iodined gets an A type query for ns.topdomain or www.topdomain */ +/* Mostly same as dns_encode_ns_response() above */ +{ + HEADER *header; + int len; + short name; + char *ipp; + char *p; + + if (buflen < sizeof(HEADER)) + return 0; + + memset(buf, 0, buflen); + + header = (HEADER*)buf; + + header->id = htons(q->id); + header->qr = 1; + header->opcode = 0; + header->aa = 1; + header->tc = 0; + header->rd = 0; + header->ra = 0; + + p = buf + sizeof(HEADER); + + header->qdcount = htons(1); + header->ancount = htons(1); + + /* pointer to start of name */ + name = 0xc000 | ((p - buf) & 0x3fff); + + /* Query section */ + putname(&p, buflen - (p - buf), q->name); /* Name */ + CHECKLEN(4); + putshort(&p, q->type); /* Type */ + putshort(&p, C_IN); /* Class */ + + /* Answer section */ + CHECKLEN(12); + putshort(&p, name); /* Name */ + putshort(&p, q->type); /* Type */ + putshort(&p, C_IN); /* Class */ + putlong(&p, 3600); /* TTL */ + putshort(&p, 4); /* Data length */ + + /* ugly hack to output IP address */ + ipp = (char *) &q->destination; + CHECKLEN(4); + putbyte(&p, *(ipp++)); + putbyte(&p, *(ipp++)); + putbyte(&p, *(ipp++)); + putbyte(&p, *ipp); len = p - buf; return len; @@ -276,6 +407,7 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz int id; int rv; + q->id2 = 0; rv = 0; header = (HEADER*)packet; @@ -324,19 +456,22 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz } if (ancount < 1) { - /* We may get both CNAME and A, then ancount=2 */ + /* DNS errors like NXDOMAIN have ancount=0 and + stop here. CNAME may also have A; MX/SRV may have + multiple results. */ return -1; } - /* Assume that first answer is NULL/CNAME that we wanted */ - readname(packet, packetlen, &data, name, sizeof(name)); - CHECKLEN(10); - readshort(packet, &data, &type); - readshort(packet, &data, &class); - readlong(packet, &data, &ttl); - readshort(packet, &data, &rlen); - + /* Here type is still the question type */ if (type == T_NULL) { + /* Assume that first answer is what we wanted */ + readname(packet, packetlen, &data, name, sizeof(name)); + CHECKLEN(10); + readshort(packet, &data, &type); + readshort(packet, &data, &class); + readlong(packet, &data, &ttl); + readshort(packet, &data, &rlen); + rv = MIN(rlen, sizeof(rdata)); rv = readdata(packet, &data, rdata, rv); if (rv >= 2 && buf) { @@ -346,9 +481,15 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz rv = 0; } } - if ((type == T_CNAME || type == T_MX) && buf) { - if (type == T_MX) - data += 2; /* skip preference */ + else if ((type == T_A || type == T_CNAME) && buf) { + /* Assume that first answer is what we wanted */ + readname(packet, packetlen, &data, name, sizeof(name)); + CHECKLEN(10); + readshort(packet, &data, &type); + readshort(packet, &data, &class); + readlong(packet, &data, &ttl); + readshort(packet, &data, &rlen); + memset(name, 0, sizeof(name)); readname(packet, packetlen, &data, name, sizeof(name) - 1); name[sizeof(name)-1] = '\0'; @@ -356,7 +497,74 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz buf[buflen - 1] = '\0'; rv = strlen(buf); } - if (type == T_TXT && buf) { + else if ((type == T_MX || type == T_SRV) && buf) { + /* We support 250 records, 250*(255+header) ~= 64kB. + Only exact 10-multiples are accepted, and gaps in + numbering are not jumped over (->truncated). + Hopefully DNS servers won't mess around too much. + */ + char names[250][QUERY_NAME_SIZE]; + char *rdatastart; + short pref; + int i; + int offset; + + memset(names, 0, sizeof(names)); + + for (i=0; i < ancount; i++) { + readname(packet, packetlen, &data, name, sizeof(name)); + CHECKLEN(12); + readshort(packet, &data, &type); + readshort(packet, &data, &class); + readlong(packet, &data, &ttl); + readshort(packet, &data, &rlen); + rdatastart = data; + readshort(packet, &data, &pref); + + if (type == T_SRV) { + /* skip weight, port */ + data += 4; + CHECKLEN(0); + } + + if (pref % 10 == 0 && pref >= 10 && + pref < 2500) { + readname(packet, packetlen, &data, + names[pref / 10 - 1], + QUERY_NAME_SIZE - 1); + names[pref / 10 - 1][QUERY_NAME_SIZE-1] = '\0'; + } + + /* always trust rlen, not name encoding */ + data = rdatastart + rlen; + CHECKLEN(0); + } + + /* output is like Hname10.com\0Hname20.com\0\0 */ + offset = 0; + i = 0; + while (names[i][0] != '\0') { + int l = MIN(strlen(names[i]), buflen-offset-2); + if (l <= 0) + break; + memcpy(buf + offset, names[i], l); + offset += l; + *(buf + offset) = '\0'; + offset++; + i++; + } + *(buf + offset) = '\0'; + rv = offset; + } + else if (type == T_TXT && buf) { + /* Assume that first answer is what we wanted */ + readname(packet, packetlen, &data, name, sizeof(name)); + CHECKLEN(10); + readshort(packet, &data, &type); + readshort(packet, &data, &class); + readlong(packet, &data, &ttl); + readshort(packet, &data, &rlen); + rv = readtxtbin(packet, &data, rlen, rdata, sizeof(rdata)); if (rv >= 1) { rv = MIN(rv, buflen); @@ -365,6 +573,8 @@ dns_decode(char *buf, size_t buflen, struct query *q, qr_t qr, char *packet, siz rv = 0; } } + + /* Here type is the answer type (note A->CNAME) */ if (q != NULL) q->type = type; break; diff --git a/src/dns.h b/src/dns.h index b5c4cc5..72d4fe9 100644 --- a/src/dns.h +++ b/src/dns.h @@ -24,8 +24,11 @@ typedef enum { QR_ANSWER = 1 } qr_t; +extern int dnsc_use_edns0; + int dns_encode(char *, size_t, struct query *, qr_t, char *, size_t); int dns_encode_ns_response(char *buf, size_t buflen, struct query *q, char *topdomain); +int dns_encode_a_response(char *buf, size_t buflen, struct query *q); unsigned short dns_get_id(char *packet, size_t packetlen); int dns_decode(char *, size_t, struct query *, qr_t, char *, size_t); diff --git a/src/encoding.c b/src/encoding.c index 11b2334..896d67d 100644 --- a/src/encoding.c +++ b/src/encoding.c @@ -21,13 +21,15 @@ int build_hostname(char *buf, size_t buflen, const char *data, const size_t datalen, - const char *topdomain, struct encoder *encoder) + const char *topdomain, struct encoder *encoder, int maxlen) { int encsize; size_t space; char *b; - space = MIN(0xFF, buflen) - strlen(topdomain) - 7; + space = MIN(maxlen, buflen) - strlen(topdomain) - 8; + /* 8 = 5 max header length + 1 dot before topdomain + 2 safety */ + if (!encoder->places_dots()) space -= (space / 57); /* space for dots */ diff --git a/src/encoding.h b/src/encoding.h index d2ac4f2..7ddf6e0 100644 --- a/src/encoding.h +++ b/src/encoding.h @@ -17,6 +17,13 @@ #ifndef _ENCODING_H_ #define _ENCODING_H_ +/* All-0, all-1, 01010101, 10101010: each 4 times to make sure the pattern + spreads across multiple encoded chars -> 16 bytes total. + Followed by 32 bytes from my /dev/random; should be enough. + */ +#define DOWNCODECCHECK1 "\000\000\000\000\377\377\377\377\125\125\125\125\252\252\252\252\201\143\310\322\307\174\262\027\137\117\316\311\111\055\122\041\141\251\161\040\045\263\006\163\346\330\104\060\171\120\127\277" +#define DOWNCODECCHECK1_LEN 48 + struct encoder { char name[8]; int (*encode) (char *, size_t *, const void *, size_t); @@ -27,7 +34,7 @@ struct encoder { int (*blocksize_encoded)(void); }; -int build_hostname(char *, size_t, const char *, const size_t, const char *, struct encoder *); +int build_hostname(char *, size_t, const char *, const size_t, const char *, struct encoder *, int); int unpack_data(char *, size_t, char *, size_t, struct encoder *); int inline_dotify(char *, size_t); int inline_undotify(char *, size_t); diff --git a/src/iodine.c b/src/iodine.c index af3b9dc..0d34c43 100644 --- a/src/iodine.c +++ b/src/iodine.c @@ -61,7 +61,7 @@ usage() { extern char *__progname; fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] " - "[-P password] [-m maxfragsize] [-T type] [-O enc] [-L 0|1] [-I sec] " + "[-P password] [-m maxfragsize] [-M maxlen] [-T type] [-O enc] [-L 0|1] [-I sec] " "[-z context] [-F pidfile] [nameserver] topdomain\n", __progname); exit(2); } @@ -72,21 +72,25 @@ help() { fprintf(stderr, "iodine IP over DNS tunneling client\n"); fprintf(stderr, "Usage: %s [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] " - "[-P password] [-m maxfragsize] [-T type] [-O enc] [-L 0|1] [-I sec] " + "[-P password] [-m maxfragsize] [-M maxlen] [-T type] [-O enc] [-L 0|1] [-I sec] " "[-z context] [-F pidfile] [nameserver] topdomain\n", __progname); + fprintf(stderr, "Options to try if connection doesn't work:\n"); + fprintf(stderr, " -T force dns type: NULL, TXT, SRV, MX, CNAME, A (default: autodetect)\n"); + fprintf(stderr, " -O force downstream encoding for -T other than NULL: Base32, Base64, Base64u,\n"); + fprintf(stderr, " Base128, or (only for TXT:) Raw (default: autodetect)\n"); + fprintf(stderr, " -I max interval between requests (default 4 sec) to prevent DNS timeouts\n"); + fprintf(stderr, " -L 1: use lazy mode for low-latency (default). 0: don't (implies -I1)\n"); + fprintf(stderr, " -m max size of downstream fragments (default: autodetect)\n"); + fprintf(stderr, " -M max size of upstream hostnames (~100-255, default: 255)\n"); + fprintf(stderr, " -r to skip raw UDP mode attempt\n"); + fprintf(stderr, " -P password used for authentication (max 32 chars will be used)\n"); + fprintf(stderr, "Other options:\n"); fprintf(stderr, " -v to print version info and exit\n"); fprintf(stderr, " -h to print this help and exit\n"); fprintf(stderr, " -f to keep running in foreground\n"); - fprintf(stderr, " -r to skip raw UDP mode attempt\n"); fprintf(stderr, " -u name to drop privileges and run as user 'name'\n"); fprintf(stderr, " -t dir to chroot to directory dir\n"); fprintf(stderr, " -d device to set tunnel device name\n"); - fprintf(stderr, " -P password used for authentication (max 32 chars will be used)\n"); - fprintf(stderr, " -m maxfragsize, to limit size of downstream packets\n"); - fprintf(stderr, " -T dns type: NULL (default, fastest), TXT, CNAME, A (CNAME answer), MX\n"); - fprintf(stderr, " -O downstream encoding (!NULL): Base32(default), Base64, or Raw (only TXT)\n"); - fprintf(stderr, " -L 1: try lazy mode for low-latency (default). 0: don't (implies -I1)\n"); - fprintf(stderr, " -I max interval between requests (default 4 sec) to prevent server timeouts\n"); fprintf(stderr, " -z context, to apply specified SELinux context after initialization\n"); fprintf(stderr, " -F pidfile to write pid to a file\n"); fprintf(stderr, "nameserver is the IP number/hostname of the relaying nameserver. if absent, /etc/resolv.conf is used\n"); @@ -131,6 +135,7 @@ main(int argc, char **argv) int raw_mode; int lazymode; int selecttimeout; + int hostname_maxlen; nameserv_addr = NULL; topdomain = NULL; @@ -152,6 +157,7 @@ main(int argc, char **argv) raw_mode = 1; lazymode = 1; selecttimeout = 4; + hostname_maxlen = 0xFF; #ifdef WINDOWS32 WSAStartup(req_version, &wsa_data); @@ -168,7 +174,7 @@ main(int argc, char **argv) __progname++; #endif - while ((choice = getopt(argc, argv, "vfhru:t:d:P:m:F:T:O:L:I:")) != -1) { + while ((choice = getopt(argc, argv, "vfhru:t:d:P:m:M:F:T:O:L:I:")) != -1) { switch(choice) { case 'v': version(); @@ -203,6 +209,13 @@ main(int argc, char **argv) autodetect_frag_size = 0; max_downstream_frag_size = atoi(optarg); break; + case 'M': + hostname_maxlen = atoi(optarg); + if (hostname_maxlen > 255) + hostname_maxlen = 255; + if (hostname_maxlen < 10) + hostname_maxlen = 10; + break; case 'z': context = optarg; break; @@ -283,6 +296,7 @@ main(int argc, char **argv) client_set_selecttimeout(selecttimeout); client_set_lazymode(lazymode); client_set_topdomain(topdomain); + client_set_hostname_maxlen(hostname_maxlen); if (username != NULL) { #ifndef WINDOWS32 @@ -315,17 +329,20 @@ main(int argc, char **argv) signal(SIGINT, sighandler); signal(SIGTERM, sighandler); + fprintf(stderr, "Sending DNS queries for %s to %s\n", + topdomain, nameserv_addr); + if (client_handshake(dns_fd, raw_mode, autodetect_frag_size, max_downstream_frag_size)) { retval = 1; goto cleanup2; } - if (client_get_conn() == CONN_DNS_NULL) { - fprintf(stderr, "Sending queries for %s to %s\n", topdomain, nameserv_addr); - } else { + if (client_get_conn() == CONN_RAW_UDP) { fprintf(stderr, "Sending raw traffic directly to %s\n", client_get_raw_addr()); } + fprintf(stderr, "Connection setup complete, transmitting data.\n"); + if (foreground == 0) do_detach(); diff --git a/src/iodined.c b/src/iodined.c index d4314cf..938975e 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -51,6 +51,8 @@ #include "encoding.h" #include "base32.h" #include "base64.h" +#include "base64u.h" +#include "base128.h" #include "user.h" #include "login.h" #include "tun.h" @@ -69,6 +71,8 @@ static char *topdomain; static char password[33]; static struct encoder *b32; static struct encoder *b64; +static struct encoder *b64u; +static struct encoder *b128; static int created_users; static int check_ip; @@ -117,6 +121,8 @@ check_user_and_ip(int userid, struct query *q) { struct sockaddr_in *tempin; + /* Note: duplicate in handle_raw_login() except IP-address check */ + if (userid < 0 || userid >= created_users ) { return 1; } @@ -152,6 +158,13 @@ send_raw(int fd, char *buf, int buflen, int user, int cmd, struct query *q) len += RAW_HDR_LEN; packet[RAW_HDR_CMD] = cmd | (user & 0x0F); + if (debug >= 2) { + struct sockaddr_in *tempin; + tempin = (struct sockaddr_in *) &(q->from); + fprintf(stderr, "TX-raw: client %s, cmd %d, %d bytes\n", + inet_ntoa(tempin->sin_addr), cmd, len); + } + sendto(fd, packet, len, 0, &q->from, q->fromlen); } @@ -243,18 +256,11 @@ get_from_outpacketq(int userid) pruning(=dropping) the improper requests, since the DNS server will actually get an answer instead of silence. - We normally use either CMC (ping) or seqno/frag (upstream data) to prevent - cache hits on in-between caching DNS servers. Also, the iodine client is - designed to mostly operate properly when cached results are returned. - Two cache-hit situations: - - Repeated DNS query when our ack got lost: has same seqno/frag and doesn't - have CMC; but the client will not have sent any new data or pings - in-between, so this is always cacheable. Even in lazy mode, since we send - the first answer to the actual DNS query only on receipt of the first - client retransmit. - - Identical second+ fragment of mod-8 packets ago, same seqno/frag and no - TCP counter in those fragments to tell them apart. This is _not_ - cachable, so our cache length should never exceed 7 packets. + Because of the CMC in both ping and upstream data, unwanted cache hits + are prevented. Data-CMC is only 36 counts, so our cache length should + not exceed 36/2=18 packets. (This quick rule assumes all packets are + otherwise equal, which they arent: up/downstream seq/frag, tcp sequence + number, and of course data.) */ static void @@ -302,6 +308,9 @@ answer_from_dnscache(int dns_fd, int userid, struct query *q) continue; /* okay, match */ + if (debug >= 1) + fprintf(stderr, "OUT user %d %s from dnscache\n", userid, q->name); + write_dns(dns_fd, q, users[userid].dnscache_answer[use], users[userid].dnscache_answerlen[use], users[userid].downenc); @@ -316,6 +325,130 @@ answer_from_dnscache(int dns_fd, int userid, struct query *q) #endif /* DNSCACHE_LEN */ +static inline void +save_to_qmem(unsigned char *qmem_cmc, unsigned short *qmem_type, int qmem_len, + int *qmem_lastfilled, unsigned char *cmc_to_add, + unsigned short type_to_add) +/* Remember query to check for duplicates */ +{ + int fill; + + fill = *qmem_lastfilled + 1; + if (fill >= qmem_len) + fill = 0; + + memcpy(qmem_cmc + fill * 4, cmc_to_add, 4); + qmem_type[fill] = type_to_add; + *qmem_lastfilled = fill; +} + +static inline void +save_to_qmem_pingordata(int userid, struct query *q) +{ + /* Our CMC is a bit more than the "official" CMC; we store 4 bytes + just because we can, and because it may prevent some false matches. + For ping, we save the 4 decoded bytes: userid + seq/frag + CMC. + For data, we save the 4 _un_decoded chars in lowercase: seq/frag's + + 1 char CMC; that last char is non-Base32. + */ + + char cmc[8]; + int i; + + if (q->name[0] == 'P' || q->name[0] == 'p') { + /* Ping packet */ + + size_t cmcsize = sizeof(cmc); + char *cp = strchr(q->name, '.'); + + if (cp == NULL) + return; /* illegal hostname; shouldn't happen */ + + /* We already unpacked in handle_null_request(), but that's + lost now... Note: b32 directly, we want no undotify here! */ + i = b32->decode(cmc, &cmcsize, q->name + 1, (cp - q->name) - 1); + + if (i < 4) + return; /* illegal ping; shouldn't happen */ + + save_to_qmem(users[userid].qmemping_cmc, + users[userid].qmemping_type, QMEMPING_LEN, + &users[userid].qmemping_lastfilled, + (void *) cmc, q->type); + } else { + /* Data packet, hopefully not illegal */ + if (strlen(q->name) < 5) + return; + + /* We store CMC in lowercase; if routing via multiple parallel + DNS servers, one may do case-switch and another may not, + and we still want to detect duplicates. + Data-header is always base32, so case-swap won't hurt. + */ + for (i = 0; i < 4; i++) + if (q->name[i+1] >= 'A' && q->name[i+1] <= 'Z') + cmc[i] = q->name[i+1] + ('a' - 'A'); + else + cmc[i] = q->name[i+1]; + + save_to_qmem(users[userid].qmemdata_cmc, + users[userid].qmemdata_type, QMEMDATA_LEN, + &users[userid].qmemdata_lastfilled, + (void *) cmc, q->type); + } +} + +static int +answer_from_qmem(int dns_fd, struct query *q, unsigned char *qmem_cmc, + unsigned short *qmem_type, int qmem_len, + unsigned char *cmc_to_check) +/* Checks query memory and sends an (illegal) answer if this is a duplicate. + Returns: 1 = answer sent, drop this query, 0 = no answer sent, this is + not a duplicate. */ +{ + int i; + + for (i = 0; i < qmem_len ; i++) { + + if (qmem_type[i] == T_UNSET) + continue; + if (qmem_type[i] != q->type) + continue; + if (memcmp(qmem_cmc + i * 4, cmc_to_check, 4)) + continue; + + /* okay, match */ + if (debug >= 1) + fprintf(stderr, "OUT from qmem for %s == duplicate, sending illegal reply\n", q->name); + + write_dns(dns_fd, q, "x", 1, 'T'); + + q->id = 0; /* this query was used */ + return 1; + } + + /* here only when no match found */ + return 0; +} + +static inline int +answer_from_qmem_data(int dns_fd, int userid, struct query *q) +/* Quick helper function to keep handle_null_request() clean */ +{ + char cmc[4]; + int i; + + for (i = 0; i < 4; i++) + if (q->name[i+1] >= 'A' && q->name[i+1] <= 'Z') + cmc[i] = q->name[i+1] + ('a' - 'A'); + else + cmc[i] = q->name[i+1]; + + return answer_from_qmem(dns_fd, q, users[userid].qmemdata_cmc, + users[userid].qmemdata_type, QMEMDATA_LEN, + (void *) cmc); +} + static int send_chunk_or_dataless(int dns_fd, int userid, struct query *q) /* Sends current fragment to user, or dataless packet if there is no @@ -373,12 +506,22 @@ send_chunk_or_dataless(int dns_fd, int userid, struct query *q) } write_dns(dns_fd, q, pkt, datalen + 2, users[userid].downenc); + if (q->id2 != 0) { + q->id = q->id2; + q->fromlen = q->fromlen2; + memcpy(&(q->from), &(q->from2), q->fromlen2); + if (debug >= 1) + fprintf(stderr, "OUT again to last duplicate\n"); + write_dns(dns_fd, q, pkt, datalen + 2, users[userid].downenc); + } + + save_to_qmem_pingordata(userid, q); + #ifdef DNSCACHE_LEN save_to_dnscache(userid, q, pkt, datalen + 2); #endif q->id = 0; /* this query is used */ - /* .iddupe is _not_ reset on purpose */ if (datalen > 0 && datalen == users[userid].outpacket.len) { /* Whole packet was sent in one chunk, dont wait for ack */ @@ -504,11 +647,11 @@ process_downstream_ack(int userid, int down_seq, int down_frag) users[userid].outfragresent = 0; /* Is packet done? */ - if (users[userid].outpacket.offset == users[userid].outpacket.len) { + if (users[userid].outpacket.offset >= users[userid].outpacket.len) { users[userid].outpacket.len = 0; users[userid].outpacket.offset = 0; users[userid].outpacket.fragment--; /* unneeded ++ above */ - /* last seqno/frag are always returned on pings */ + /* ^keep last seqno/frag, are always returned on pings */ /* users[userid].outfragresent = 0; already above */ #ifdef OUTPACKETQ_LEN @@ -554,6 +697,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) if (version == VERSION) { userid = find_available_user(); if (userid >= 0) { + int i; struct sockaddr_in *tempin; users[userid].seed = rand(); @@ -568,10 +712,9 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) syslog(LOG_INFO, "accepted version for user #%d from %s", userid, inet_ntoa(tempin->sin_addr)); users[userid].q.id = 0; - users[userid].q.iddupe = 0; - users[userid].q_prev.id = 0; - users[userid].q_prev.iddupe = 0; + users[userid].q.id2 = 0; users[userid].q_sendrealsoon.id = 0; + users[userid].q_sendrealsoon.id2 = 0; users[userid].q_sendrealsoon_new = 0; users[userid].outpacket.len = 0; users[userid].outpacket.offset = 0; @@ -592,7 +735,6 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) #endif #ifdef DNSCACHE_LEN { - int i; for (i = 0; i < DNSCACHE_LEN; i++) { users[userid].dnscache_q[i].id = 0; users[userid].dnscache_answerlen[i] = 0; @@ -600,6 +742,12 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) } users[userid].dnscache_lastfilled = 0; #endif + for (i = 0; i < QMEMPING_LEN; i++) + users[userid].qmemping_type[i] = T_UNSET; + users[userid].qmemping_lastfilled = 0; + for (i = 0; i < QMEMDATA_LEN; i++) + users[userid].qmemdata_type[i] = T_UNSET; + users[userid].qmemdata_lastfilled = 0; } else { /* No space for another user */ send_version_response(dns_fd, VERSION_FULL, created_users, 0, q); @@ -614,6 +762,11 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) return; } else if(in[0] == 'L' || in[0] == 'l') { read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32); + if (read < 17) { + write_dns(dns_fd, q, "BADLEN", 6, 'T'); + return; + } + /* Login phase, handle auth */ userid = unpacked[0]; @@ -712,13 +865,23 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) user_switch_codec(userid, enc); write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc); break; + case 26: /* "2nd" 6 bits per byte = base64u, with underscore */ + enc = get_base64u_encoder(); + user_switch_codec(userid, enc); + write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc); + break; + case 7: /* 7 bits per byte = base128 */ + enc = get_base128_encoder(); + user_switch_codec(userid, enc); + write_dns(dns_fd, q, enc->name, strlen(enc->name), users[userid].downenc); + break; default: write_dns(dns_fd, q, "BADCODEC", 8, users[userid].downenc); break; } return; } else if(in[0] == 'O' || in[0] == 'o') { - if (domain_len != 4) { /* len = 4, example: "O1T." */ + if (domain_len < 3) { /* len at least 3, example: "O1T" */ write_dns(dns_fd, q, "BADLEN", 6, 'T'); return; } @@ -741,6 +904,16 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) users[userid].downenc = 'S'; write_dns(dns_fd, q, "Base64", 6, users[userid].downenc); break; + case 'U': + case 'u': + users[userid].downenc = 'U'; + write_dns(dns_fd, q, "Base64u", 7, users[userid].downenc); + break; + case 'V': + case 'v': + users[userid].downenc = 'V'; + write_dns(dns_fd, q, "Base128", 7, users[userid].downenc); + break; case 'R': case 'r': users[userid].downenc = 'R'; @@ -761,9 +934,86 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) break; } return; + } else if(in[0] == 'Y' || in[0] == 'y') { + int i; + char *datap; + int datalen; + + if (domain_len < 6) { /* len at least 6, example: "YTxCMC" */ + write_dns(dns_fd, q, "BADLEN", 6, 'T'); + return; + } + + i = b32_8to5(in[2]); /* check variant */ + + switch (i) { + case 1: + datap = DOWNCODECCHECK1; + datalen = DOWNCODECCHECK1_LEN; + break; + default: + write_dns(dns_fd, q, "BADLEN", 6, 'T'); + return; + } + + switch (in[1]) { + case 'T': + case 't': + if (q->type == T_TXT || + q->type == T_SRV || q->type == T_MX || + q->type == T_CNAME || q->type == T_A) { + write_dns(dns_fd, q, datap, datalen, 'T'); + return; + } + break; + case 'S': + case 's': + if (q->type == T_TXT || + q->type == T_SRV || q->type == T_MX || + q->type == T_CNAME || q->type == T_A) { + write_dns(dns_fd, q, datap, datalen, 'S'); + return; + } + break; + case 'U': + case 'u': + if (q->type == T_TXT || + q->type == T_SRV || q->type == T_MX || + q->type == T_CNAME || q->type == T_A) { + write_dns(dns_fd, q, datap, datalen, 'U'); + return; + } + break; + case 'V': + case 'v': + if (q->type == T_TXT || + q->type == T_SRV || q->type == T_MX || + q->type == T_CNAME || q->type == T_A) { + write_dns(dns_fd, q, datap, datalen, 'V'); + return; + } + break; + case 'R': + case 'r': + if (q->type == T_NULL || q->type == T_TXT) { + write_dns(dns_fd, q, datap, datalen, 'R'); + return; + } + break; + } + + /* if still here, then codec not available */ + write_dns(dns_fd, q, "BADCODEC", 8, 'T'); + return; + } else if(in[0] == 'R' || in[0] == 'r') { int req_frag_size; + if (domain_len < 16) { /* we'd better have some chars for data... */ + write_dns(dns_fd, q, "BADLEN", 6, 'T'); + return; + } + /* Downstream fragsize probe packet */ userid = (b32_8to5(in[1]) >> 1) & 15; if (check_user_and_ip(userid, q) != 0) { @@ -777,15 +1027,15 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) } else { char buf[2048]; int i; - unsigned int v = (unsigned int) rand(); + unsigned int v = ((unsigned int) rand()) & 0xff ; memset(buf, 0, sizeof(buf)); buf[0] = (req_frag_size >> 8) & 0xff; buf[1] = req_frag_size & 0xff; /* make checkable pseudo-random sequence */ buf[2] = 107; - for (i = 3; i < 2048; i++, v += 107) - buf[i] = (char) (v & 0xff); + for (i = 3; i < 2048; i++, v = (v + 107) & 0xff) + buf[i] = v; write_dns(dns_fd, q, buf, req_frag_size, users[userid].downenc); } return; @@ -793,6 +1043,12 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) int max_frag_size; read = unpack_data(unpacked, sizeof(unpacked), &(in[1]), domain_len - 1, b32); + + if (read < 3) { + write_dns(dns_fd, q, "BADLEN", 6, 'T'); + return; + } + /* Downstream fragsize packet */ userid = unpacked[0]; if (check_user_and_ip(userid, q) != 0) { @@ -835,68 +1091,51 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) #ifdef DNSCACHE_LEN /* Check if cached */ - if (answer_from_dnscache(dns_fd, userid, q)) { - /* Answer sent. But if this is our currently waiting - request in the queue, invalidate now since we can't - be sure that our coming new answer will ever reach - client. Happens on 3+ retransmits in the "lost pings - problem" with agressive DNS server. - */ - if (users[userid].q.id != 0 && - q->type == users[userid].q.type && - !strcmp(q->name, users[userid].q.name)) - users[userid].q.id = 0; + if (answer_from_dnscache(dns_fd, userid, q)) return; - } #endif - /* Dupe pruning */ - if (users[userid].q.iddupe != 0 && + /* Check if duplicate (and not in full dnscache any more) */ + if (answer_from_qmem(dns_fd, q, users[userid].qmemping_cmc, + users[userid].qmemping_type, QMEMPING_LEN, + (void *) unpacked)) + return; + + /* Check if duplicate of waiting queries; impatient DNS relays + like to re-try early and often (with _different_ .id!) */ + if (users[userid].q.id != 0 && q->type == users[userid].q.type && !strcmp(q->name, users[userid].q.name) && users[userid].lazy) { - /* We have this ping already. Aggressively impatient - DNS servers resend queries with _different_ id. - But hostname check is sufficient, includes CMC. - Just drop this ping. - If we already answered it (e.g. data available some - milliseconds ago), DNS server should have noticed - by now (race condition, happens rarely). - If we didn't answer yet, we'll do later (to the - first id, thank you very much). */ + /* We have this ping already, and it's waiting to be + answered. Always keep the last duplicate, since the + relay may have forgotten its first version already. + Our answer will go to both. + (If we already sent an answer, qmem/cache will + have triggered.) */ if (debug >= 2) { - fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, ignoring\n", + fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, remembering\n", userid); } + users[userid].q.id2 = q->id; + users[userid].q.fromlen2 = q->fromlen; + memcpy(&(users[userid].q.from2), &(q->from), q->fromlen); return; } - if (users[userid].q_prev.iddupe != 0 && - q->type == users[userid].q_prev.type && - !strcmp(q->name, users[userid].q_prev.name) && - users[userid].lazy) { - /* Okay, even older ping that we already saw - and probably answered just milliseconds ago. - This is a race condition that agressive DNS servers - actually train into; happens quite often. - Just drop this new version. */ - /* If using dnscache, this new query probably got a - cached answer already, and this shouldn't trigger. */ - if (debug >= 2) { - fprintf(stderr, "PING pkt from user %d = dupe (previous) from impatient DNS server, ignoring\n", - userid); - } - return; - } - if (users[userid].q_sendrealsoon.id != 0 && q->type == users[userid].q_sendrealsoon.type && !strcmp(q->name, users[userid].q_sendrealsoon.name)) { - /* Outer select loop will send answer immediately. */ + /* Outer select loop will send answer immediately, + to both queries. */ if (debug >= 2) { - fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, ignoring\n", + fprintf(stderr, "PING pkt from user %d = dupe from impatient DNS server, remembering\n", userid); } + users[userid].q_sendrealsoon.id2 = q->id; + users[userid].q_sendrealsoon.fromlen2 = q->fromlen; + memcpy(&(users[userid].q_sendrealsoon.from2), + &(q->from), q->fromlen); return; } @@ -934,10 +1173,6 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) didsend = 0; } - /* Save previous query for dupe checking */ - memcpy(&(users[userid].q_prev), &(users[userid].q), - sizeof(struct query)); - /* Save new query and time info */ memcpy(&(users[userid].q), q, sizeof(struct query)); users[userid].last_pkt = time(NULL); @@ -955,11 +1190,10 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) int up_seq, up_frag, dn_seq, dn_frag, lastfrag; int upstream_ok = 1; int didsend = 0; - int thisisdupe = 0; int code = -1; - /* Need 4char header + >=1 char data */ - if (domain_len < 5) + /* Need 5char header + >=1 char data */ + if (domain_len < 6) return; /* We can't handle id=0, that's "no packet" to us. So drop @@ -987,86 +1221,52 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) #ifdef DNSCACHE_LEN /* Check if cached */ - if (answer_from_dnscache(dns_fd, userid, q)) { - /* Answer sent. But if this is our currently waiting - request in the queue, invalidate now since we can't - be sure that our coming new answer will ever reach - client. Happens on 3+ retransmits in the "lost pings - problem" with agressive DNS server. - */ - if (users[userid].q.id != 0 && - q->type == users[userid].q.type && - !strcmp(q->name, users[userid].q.name)) - users[userid].q.id = 0; + if (answer_from_dnscache(dns_fd, userid, q)) return; - } #endif - /* Dupe pruning */ - if (users[userid].q.iddupe != 0 && - q->id == users[userid].q.iddupe && - q->type == users[userid].q.type && - !strcmp(q->name, users[userid].q.name) && - users[userid].lazy) { - /* We have this exact query already, with same id. - So this is surely a honest dupe. */ - if (debug >= 2) { - fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, ignoring\n", - userid); - } + /* Check if duplicate (and not in full dnscache any more) */ + if (answer_from_qmem_data(dns_fd, userid, q)) return; - } - /* Note: Upstream data packet retransmits have exact same - hostname, so can't reliably ignore the id here. - And that's not even needed because of send_ping_soon in - client. Nice. We still do need a queue-flush on data1-data1, - see thisisdupe. - But then there's the race condition in two variants: - data1 - ping - data1 - data1 - data2 - data1 - These are surely dupes, irrespective of id, because client - will only send ping/data2 when it has received our ack for - data1. (Okay, and ping/data2 should be dupe-pruned - themselves already...) - Draw pictures if you don't understand immediately. - */ - /* If using dnscache, the new data1 probably got a - cached answer already, and this shouldn't trigger. */ - if (users[userid].q.iddupe != 0 && - (q->type != users[userid].q.type || - strcmp(q->name, users[userid].q.name)) && - users[userid].q_prev.iddupe != 0 && - q->type == users[userid].q_prev.type && - !strcmp(q->name, users[userid].q_prev.name) && + + /* Check if duplicate of waiting queries; impatient DNS relays + like to re-try early and often (with _different_ .id!) */ + if (users[userid].q.id != 0 && + q->type == users[userid].q.type && + !strcmp(q->name, users[userid].q.name) && users[userid].lazy) { + /* We have this packet already, and it's waiting to be + answered. Always keep the last duplicate, since the + relay may have forgotten its first version already. + Our answer will go to both. + (If we already sent an answer, qmem/cache will + have triggered.) */ if (debug >= 2) { - fprintf(stderr, "IN pkt from user %d = dupe (previous) from impatient DNS server, ignoring\n", + fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, remembering\n", userid); } + users[userid].q.id2 = q->id; + users[userid].q.fromlen2 = q->fromlen; + memcpy(&(users[userid].q.from2), &(q->from), q->fromlen); return; } if (users[userid].q_sendrealsoon.id != 0 && q->type == users[userid].q_sendrealsoon.type && !strcmp(q->name, users[userid].q_sendrealsoon.name)) { - /* Outer select loop will send answer immediately. */ + /* Outer select loop will send answer immediately, + to both queries. */ if (debug >= 2) { - fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, ignoring\n", + fprintf(stderr, "IN pkt from user %d = dupe from impatient DNS server, remembering\n", userid); } + users[userid].q_sendrealsoon.id2 = q->id; + users[userid].q_sendrealsoon.fromlen2 = q->fromlen; + memcpy(&(users[userid].q_sendrealsoon.from2), + &(q->from), q->fromlen); return; } - /* We need to flush our queue on dupes, since our new answer - to the first query may/will be duplicated by DNS caches to - also answer the client's re-sent (=dupe) query. - (Caches take TTL=0 to mean: "good for current and earlier - queries") */ - if (users[userid].q.iddupe != 0 && - q->type == users[userid].q.type && - !strcmp(q->name, users[userid].q.name)) - thisisdupe = 1; - /* Decode data header */ up_seq = (b32_8to5(in[1]) >> 2) & 7; @@ -1122,8 +1322,8 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) } if (upstream_ok) { - /* decode with this users encoding */ - read = unpack_data(unpacked, sizeof(unpacked), &(in[4]), domain_len - 4, + /* decode with this user's encoding */ + read = unpack_data(unpacked, sizeof(unpacked), &(in[5]), domain_len - 5, users[userid].encoder); /* copy to packet buffer, update length */ @@ -1160,7 +1360,6 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) more, so ack immediately if we didn't already. - If we are in non-lazy mode, there should be no query waiting, but if there is, send immediately. - - If we are flushing queue due to dupe, send immediately. - In all other cases (mostly the last-fragment cases), we can afford to wait just a tiny little while for the TCP ack to arrive from our tun. Note that this works best @@ -1170,8 +1369,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) if ((users[userid].outpacket.len > 0 && !didsend) || (upstream_ok && !lastfrag && !didsend) || (!upstream_ok && !didsend) || - !users[userid].lazy || - thisisdupe) { + !users[userid].lazy) { didsend = 1; if (send_chunk_or_dataless(dns_fd, userid, &users[userid].q) == 1) /* new packet from queue, send immediately */ @@ -1186,10 +1384,6 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) } } - /* Save previous query for dupe checking */ - memcpy(&(users[userid].q_prev), &(users[userid].q), - sizeof(struct query)); - /* Save new query and time info */ memcpy(&(users[userid].q), q, sizeof(struct query)); users[userid].last_pkt = time(NULL); @@ -1198,7 +1392,6 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) upstream flowing. - If we have new data waiting and not yet sent above, send immediately. - - If we are flushing queue due to dupe, send immediately. - If this wasn't the last upstream fragment, then we expect more, so ack immediately if we didn't already or are in non-lazy mode. @@ -1208,8 +1401,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) our tun device. - In all other cases, don't send anything now. */ - if ((users[userid].outpacket.len > 0 && !didsend) - || thisisdupe) + if (users[userid].outpacket.len > 0 && !didsend) send_chunk_or_dataless(dns_fd, userid, &users[userid].q); else if (!didsend || !users[userid].lazy) { if (upstream_ok && lastfrag) { @@ -1227,6 +1419,7 @@ handle_null_request(int tun_fd, int dns_fd, struct query *q, int domain_len) static void handle_ns_request(int dns_fd, struct query *q) +/* Mostly identical to handle_a_request() below */ { char buf[64*1024]; int len; @@ -1254,6 +1447,40 @@ handle_ns_request(int dns_fd, struct query *q) } } +static void +handle_a_request(int dns_fd, struct query *q, int fakeip) +/* Mostly identical to handle_ns_request() above */ +{ + char buf[64*1024]; + int len; + + if (fakeip) { + in_addr_t ip = inet_addr("127.0.0.1"); + memcpy(&q->destination.s_addr, &ip, sizeof(in_addr_t)); + + } else if (ns_ip != INADDR_ANY) { + /* If ns_ip set, overwrite destination addr with it. + * Destination addr will be sent as additional record (A, IN) */ + memcpy(&q->destination.s_addr, &ns_ip, sizeof(in_addr_t)); + } + + len = dns_encode_a_response(buf, sizeof(buf), q); + if (len < 1) { + warnx("dns_encode_a_response doesn't fit"); + return; + } + + if (debug >= 2) { + struct sockaddr_in *tempin; + tempin = (struct sockaddr_in *) &(q->from); + fprintf(stderr, "TX: client %s, type %d, name %s, %d bytes A reply\n", + inet_ntoa(tempin->sin_addr), q->type, q->name, len); + } + if (sendto(dns_fd, buf, len, 0, (struct sockaddr*)&q->from, q->fromlen) <= 0) { + warn("a reply send error"); + } +} + static void forward_query(int bind_fd, struct query *q) { @@ -1339,7 +1566,6 @@ tunnel_dns(int tun_fd, int dns_fd, int bind_fd) { struct query q; int read; - char *domain; int domain_len; int inside_topdomain; @@ -1352,24 +1578,44 @@ tunnel_dns(int tun_fd, int dns_fd, int bind_fd) fprintf(stderr, "RX: client %s, type %d, name %s\n", inet_ntoa(tempin->sin_addr), q.type, q.name); } - - domain = strstr(q.name, topdomain); - inside_topdomain = 0; - if (domain) { - domain_len = (int) (domain - q.name); - if (domain_len + strlen(topdomain) == strlen(q.name)) { - inside_topdomain = 1; - } - } - + + domain_len = strlen(q.name) - strlen(topdomain); + if (domain_len >= 0 && !strcasecmp(q.name + domain_len, topdomain)) + inside_topdomain = 1; + /* require dot before topdomain */ + if (domain_len >= 1 && q.name[domain_len - 1] != '.') + inside_topdomain = 0; + if (inside_topdomain) { /* This is a query we can handle */ + /* Handle A-type query for ns.topdomain, possibly caused + by our proper response to any NS request */ + if (domain_len == 3 && q.type == T_A && + (q.name[0] == 'n' || q.name[0] == 'N') && + (q.name[1] == 's' || q.name[1] == 'S') && + q.name[2] == '.') { + handle_a_request(dns_fd, &q, 0); + return 0; + } + + /* Handle A-type query for www.topdomain, for anyone that's + poking around */ + if (domain_len == 4 && q.type == T_A && + (q.name[0] == 'w' || q.name[0] == 'W') && + (q.name[1] == 'w' || q.name[1] == 'W') && + (q.name[2] == 'w' || q.name[2] == 'W') && + q.name[3] == '.') { + handle_a_request(dns_fd, &q, 1); + return 0; + } + switch (q.type) { case T_NULL: case T_CNAME: case T_A: case T_MX: + case T_SRV: case T_TXT: /* encoding is "transparent" here */ handle_null_request(tun_fd, dns_fd, &q, domain_len); @@ -1496,6 +1742,8 @@ handle_full_packet(int tun_fd, int dns_fd, int userid) write_tun(tun_fd, out, outlen); } else { /* send the compressed(!) packet to other client */ + /*XXX START adjust indent 1 tab forward*/ + if (users[touser].conn == CONN_DNS_NULL) { if (users[touser].outpacket.len == 0) { start_new_outpacket(touser, users[userid].inpacket.data, @@ -1505,7 +1753,7 @@ handle_full_packet(int tun_fd, int dns_fd, int userid) if (users[touser].q_sendrealsoon.id != 0) send_chunk_or_dataless(dns_fd, touser, &users[touser].q_sendrealsoon); else if (users[touser].q.id != 0) - send_chunk_or_dataless(dns_fd, touser, &users[userid].q); + send_chunk_or_dataless(dns_fd, touser, &users[touser].q); #ifdef OUTPACKETQ_LEN } else { save_to_outpacketq(touser, @@ -1513,6 +1761,12 @@ handle_full_packet(int tun_fd, int dns_fd, int userid) users[userid].inpacket.len); #endif } + } else{ /* CONN_RAW_UDP */ + send_raw(dns_fd, users[userid].inpacket.data, + users[userid].inpacket.len, touser, + RAW_HDR_CMD_DATA, &users[touser].q); + } + /*XXX END adjust indent 1 tab forward*/ } } else { if (debug >= 1) @@ -1531,8 +1785,16 @@ handle_raw_login(char *packet, int len, struct query *q, int fd, int userid) if (len < 16) return; - if (userid < 0 || userid > created_users) return; - if (!users[userid].active) return; + /* can't use check_user_and_ip() since IP address will be different, + so duplicate here except IP address */ + if (userid < 0 || userid >= created_users) return; + if (!users[userid].active || users[userid].disabled) return; + if (users[userid].last_pkt + 60 < time(NULL)) return; + + if (debug >= 1) { + fprintf(stderr, "IN login raw, len %d, from user %d\n", + len, userid); + } /* User sends hash of seed + 1 */ login_calculate(myhash, 16, password, users[userid].seed + 1); @@ -1549,7 +1811,6 @@ handle_raw_login(char *packet, int len, struct query *q, int fd, int userid) /* Correct hash, reply with hash of seed - 1 */ user_set_conn_type(userid, CONN_RAW_UDP); - users[userid].last_pkt = time(NULL); login_calculate(myhash, 16, password, users[userid].seed - 1); send_raw(fd, myhash, 16, userid, RAW_HDR_CMD_LOGIN, q); } @@ -1590,6 +1851,10 @@ handle_raw_ping(struct query *q, int dns_fd, int userid) users[userid].last_pkt = time(NULL); memcpy(&(users[userid].q), q, sizeof(struct query)); + if (debug >= 1) { + fprintf(stderr, "IN ping raw, from user %d\n", userid); + } + /* Send ping reply */ send_raw(dns_fd, NULL, 0, userid, RAW_HDR_CMD_PING, q); } @@ -1690,64 +1955,119 @@ read_dns(int fd, int tun_fd, struct query *q) /* FIXME: tun_fd is because of raw return 0; } +static size_t +write_dns_nameenc(char *buf, size_t buflen, char *data, int datalen, char downenc) +/* Returns #bytes of data that were encoded */ +{ + static int td1 = 0; + static int td2 = 0; + size_t space; + char *b; + + /* Make a rotating topdomain to prevent filtering */ + td1+=3; + td2+=7; + if (td1>=26) td1-=26; + if (td2>=25) td2-=25; + + /* encode data,datalen to CNAME/MX answer + (adapted from build_hostname() in encoding.c) + */ + + space = MIN(0xFF, buflen) - 4 - 2; + /* -1 encoding type, -3 ".xy", -2 for safety */ + + memset(buf, 0, sizeof(buf)); + + if (downenc == 'S') { + buf[0] = 'i'; + if (!b64->places_dots()) + space -= (space / 57); /* space for dots */ + b64->encode(buf+1, &space, data, datalen); + if (!b64->places_dots()) + inline_dotify(buf, buflen); + } else if (downenc == 'U') { + buf[0] = 'j'; + if (!b64u->places_dots()) + space -= (space / 57); /* space for dots */ + b64u->encode(buf+1, &space, data, datalen); + if (!b64u->places_dots()) + inline_dotify(buf, buflen); + } else if (downenc == 'V') { + buf[0] = 'k'; + if (!b128->places_dots()) + space -= (space / 57); /* space for dots */ + b128->encode(buf+1, &space, data, datalen); + if (!b128->places_dots()) + inline_dotify(buf, buflen); + } else { + buf[0] = 'h'; + if (!b32->places_dots()) + space -= (space / 57); /* space for dots */ + b32->encode(buf+1, &space, data, datalen); + if (!b32->places_dots()) + inline_dotify(buf, buflen); + } + + /* Add dot (if it wasn't there already) and topdomain */ + b = buf; + b += strlen(buf) - 1; + if (*b != '.') + *++b = '.'; + b++; + + *b = 'a' + td1; + b++; + *b = 'a' + td2; + b++; + *b = '\0'; + + return space; +} + static void write_dns(int fd, struct query *q, char *data, int datalen, char downenc) { char buf[64*1024]; int len = 0; - if (q->type == T_CNAME || q->type == T_A || q->type == T_MX) { - static int td1 = 0; - static int td2 = 0; + if (q->type == T_CNAME || q->type == T_A) { char cnamebuf[1024]; /* max 255 */ - size_t space; - char *b; - /* Make a rotating topdomain to prevent filtering */ - td1+=3; - td2+=7; - if (td1>=26) td1-=26; - if (td2>=25) td2-=25; + write_dns_nameenc(cnamebuf, sizeof(cnamebuf), + data, datalen, downenc); - /* encode data,datalen to CNAME/MX answer */ - /* (adapted from build_hostname() in iodine.c) */ + len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, cnamebuf, + sizeof(cnamebuf)); + } else if (q->type == T_MX || q->type == T_SRV) { + char mxbuf[64*1024]; + char *b = mxbuf; + int offset = 0; + int res; - space = MIN(0xFF, sizeof(cnamebuf)) - 4 - 2; - /* -1 encoding type, -3 ".xy", -2 for safety */ + while (1) { + res = write_dns_nameenc(b, sizeof(mxbuf) - (b - mxbuf), + data + offset, + datalen - offset, downenc); + if (res < 1) { + /* nothing encoded */ + b++; /* for final \0 */ + break; + } - memset(cnamebuf, 0, sizeof(cnamebuf)); + b = b + strlen(b) + 1; - if (downenc == 'S') { - cnamebuf[0] = 'I'; - if (!b64->places_dots()) - space -= (space / 57); /* space for dots */ - b64->encode(cnamebuf+1, &space, data, datalen); - if (!b64->places_dots()) - inline_dotify(cnamebuf, sizeof(cnamebuf)); - } else { - cnamebuf[0] = 'H'; - if (!b32->places_dots()) - space -= (space / 57); /* space for dots */ - b32->encode(cnamebuf+1, &space, data, datalen); - if (!b32->places_dots()) - inline_dotify(cnamebuf, sizeof(cnamebuf)); + offset += res; + if (offset >= datalen) + break; } - /* Add dot (if it wasn't there already) and topdomain */ - b = cnamebuf; - b += strlen(cnamebuf); - if (*b != '.') - *b++ = '.'; - - *b = 'a' + td1; - b++; - *b = 'a' + td2; - b++; + /* Add final \0 */ *b = '\0'; - len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, cnamebuf, sizeof(cnamebuf)); - } - else if (q->type == T_TXT) { + len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, mxbuf, + sizeof(mxbuf)); + } else if (q->type == T_TXT) { /* TXT with base32 */ char txtbuf[64*1024]; size_t space = sizeof(txtbuf) - 1;; @@ -1755,15 +2075,23 @@ write_dns(int fd, struct query *q, char *data, int datalen, char downenc) memset(txtbuf, 0, sizeof(txtbuf)); if (downenc == 'S') { - txtbuf[0] = 'S'; /* plain base64(Sixty-four) */ + txtbuf[0] = 's'; /* plain base64(Sixty-four) */ len = b64->encode(txtbuf+1, &space, data, datalen); } + else if (downenc == 'U') { + txtbuf[0] = 'u'; /* Base64 with Underscore */ + len = b64u->encode(txtbuf+1, &space, data, datalen); + } + else if (downenc == 'V') { + txtbuf[0] = 'v'; /* Base128 */ + len = b128->encode(txtbuf+1, &space, data, datalen); + } else if (downenc == 'R') { - txtbuf[0] = 'R'; /* Raw binary data */ + txtbuf[0] = 'r'; /* Raw binary data */ len = MIN(datalen, sizeof(txtbuf) - 1); memcpy(txtbuf + 1, data, len); } else { - txtbuf[0] = 'T'; /* plain base32(Thirty-two) */ + txtbuf[0] = 't'; /* plain base32(Thirty-two) */ len = b32->encode(txtbuf+1, &space, data, datalen); } len = dns_encode(buf, sizeof(buf), q, QR_ANSWER, txtbuf, len+1); @@ -1815,6 +2143,7 @@ help() { "which then has to be created manually\n"); fprintf(stderr, " -f to keep running in foreground\n"); fprintf(stderr, " -D to increase debug level\n"); + fprintf(stderr, " (using -DD in UTF-8 terminal: \"LC_ALL=C luit iodined -DD ...\")\n"); fprintf(stderr, " -u name to drop privileges and run as user 'name'\n"); fprintf(stderr, " -t dir to chroot to directory dir\n"); fprintf(stderr, " -d device to set tunnel device name\n"); @@ -1881,7 +2210,8 @@ main(int argc, char **argv) foreground = 0; bind_enable = 0; bind_fd = 0; - mtu = 1200; + mtu = 1130; /* Very many relays give fragsize 1150 or slightly + higher for NULL; tun/zlib adds ~17 bytes. */ listen_ip = INADDR_ANY; port = 53; ns_ip = INADDR_ANY; @@ -1893,6 +2223,8 @@ main(int argc, char **argv) b32 = get_base32_encoder(); b64 = get_base64_encoder(); + b64u = get_base64u_encoder(); + b128 = get_base128_encoder(); retval = 0; diff --git a/src/user.h b/src/user.h index d3f81b4..e32e090 100644 --- a/src/user.h +++ b/src/user.h @@ -24,7 +24,14 @@ lead to massive dropping in multi-user situations with high traffic. */ #define DNSCACHE_LEN 4 -/* Undefine to disable. MUST be less than 7; also see comments in iodined.c */ +/* Undefine to disable. Should be less than 18; also see comments in iodined.c */ + + +#define QMEMPING_LEN 30 +/* Max advisable: 64k/2 = 32000. Total mem usage: QMEMPING_LEN * USERS * 6 bytes */ + +#define QMEMDATA_LEN 15 +/* Max advisable: 36/2 = 18. Total mem usage: QMEMDATA_LEN * USERS * 6 bytes */ struct user { char id; @@ -35,7 +42,6 @@ struct user { in_addr_t tun_ip; struct in_addr host; struct query q; - struct query q_prev; struct query q_sendrealsoon; int q_sendrealsoon_new; struct packet inpacket; @@ -48,6 +54,12 @@ struct user { int fragsize; enum connection conn; int lazy; + unsigned char qmemping_cmc[QMEMPING_LEN * 4]; + unsigned short qmemping_type[QMEMPING_LEN]; + int qmemping_lastfilled; + unsigned char qmemdata_cmc[QMEMDATA_LEN * 4]; + unsigned short qmemdata_type[QMEMDATA_LEN]; + int qmemdata_lastfilled; #ifdef OUTPACKETQ_LEN struct packet outpacketq[OUTPACKETQ_LEN]; int outpacketq_nexttouse; diff --git a/src/version.h b/src/version.h index 05a979a..1561b9e 100644 --- a/src/version.h +++ b/src/version.h @@ -19,7 +19,7 @@ /* This is the version of the network protocol It is usually equal to the latest iodine version number */ -#define VERSION 0x00000501 +#define VERSION 0x00000502 #endif /* _VERSION_H_ */ From 0c294915ae4266b4f3621f2138d0f5bd0975c491 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Tue, 29 Dec 2009 20:08:01 +0000 Subject: [PATCH 42/49] fix tests after patch in #88 --- tests/encoding.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/encoding.c b/tests/encoding.c index 38e8fab..a323411 100644 --- a/tests/encoding.c +++ b/tests/encoding.c @@ -86,7 +86,7 @@ START_TEST(test_build_hostname) buflen = sizeof(buf); for (i = 1; i < sizeof(data); i++) { - int len = build_hostname(buf, buflen, data, i, topdomain, get_base32_encoder()); + int len = build_hostname(buf, buflen, data, i, topdomain, get_base32_encoder(), sizeof(buflen)); fail_if(len > i); fail_if(strstr(buf, ".."), "Found double dots when encoding data len %d! buf: %s", i, buf); From 27e16d6ac02cce61aab28e6aab9f743c430acdd6 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Tue, 29 Dec 2009 20:10:02 +0000 Subject: [PATCH 43/49] Add credits --- README | 1 + man/iodine.8 | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/README b/README index 612ee69..d9e3c29 100644 --- a/README +++ b/README @@ -338,6 +338,7 @@ THANKS: AUTHORS & LICENSE: Copyright (c) 2006-2009 Bjorn Andersson , Erik Ekman +Also major contributions by Anne Bezemer. Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice diff --git a/man/iodine.8 b/man/iodine.8 index 00224e4..6eee603 100644 --- a/man/iodine.8 +++ b/man/iodine.8 @@ -334,4 +334,5 @@ information. .SH BUGS File bugs at http://dev.kryo.se/iodine/ .SH AUTHORS -Erik Ekman and Bjorn Andersson +Erik Ekman and Bjorn Andersson . Major +contributions by Anne Bezemer. From 6ce502ffa4c01926dedbf0d936645a17cc96a5a3 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Tue, 29 Dec 2009 20:14:50 +0000 Subject: [PATCH 44/49] Fix compile for win32 --- src/windows.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/windows.h b/src/windows.h index d7e03e1..7e0e16c 100644 --- a/src/windows.h +++ b/src/windows.h @@ -39,6 +39,7 @@ typedef unsigned int in_addr_t; #define T_CNAME DNS_TYPE_CNAME #define T_MX DNS_TYPE_MX #define T_TXT DNS_TYPE_TXT +#define T_SRV DNS_TYPE_SRV #define C_IN 1 @@ -48,6 +49,8 @@ typedef unsigned int in_addr_t; #define NOTIMP 4 #define REFUSED 5 +#define sleep(seconds) Sleep((seconds)*1000) + typedef struct { unsigned id :16; /* query identification number */ /* fields in third byte */ From 158a3658809f89da85bb98663ead083624cdfdb5 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Tue, 29 Dec 2009 20:25:33 +0000 Subject: [PATCH 45/49] Fix osx compile, maybe also OpenBSD --- src/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Makefile b/src/Makefile index b8cf780..a5b9838 100644 --- a/src/Makefile +++ b/src/Makefile @@ -34,11 +34,11 @@ base64u.o client.o iodined.o: base64u.h base64u.c: base64.c @echo Making $@ @echo '/* No use in editing, produced by Makefile! */' > $@ - @sed -e 's/\(base64\)/\1u/ig ; s/0123456789+/0123456789_/' < $< >> $@ + @sed -e 's/\([Bb][Aa][Ss][Ee]64\)/\1u/g ; s/0123456789+/0123456789_/' < base64.c >> $@ base64u.h: base64.h @echo Making $@ @echo '/* No use in editing, produced by Makefile! */' > $@ - @sed -e 's/\(base64\)/\1u/ig ; s/0123456789+/0123456789_/' < $< >> $@ + @sed -e 's/\([Bb][Aa][Ss][Ee]64\)/\1u/g ; s/0123456789+/0123456789_/' < base64.h >> $@ clean: @echo "Cleaning src/" From 13590899c852363fc61a03da39cd651833dead0f Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Wed, 30 Dec 2009 07:39:52 +0000 Subject: [PATCH 46/49] Fix strange sizeof() --- tests/encoding.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/encoding.c b/tests/encoding.c index a323411..ac22452 100644 --- a/tests/encoding.c +++ b/tests/encoding.c @@ -86,7 +86,7 @@ START_TEST(test_build_hostname) buflen = sizeof(buf); for (i = 1; i < sizeof(data); i++) { - int len = build_hostname(buf, buflen, data, i, topdomain, get_base32_encoder(), sizeof(buflen)); + int len = build_hostname(buf, buflen, data, i, topdomain, get_base32_encoder(), sizeof(buf)); fail_if(len > i); fail_if(strstr(buf, ".."), "Found double dots when encoding data len %d! buf: %s", i, buf); From dc140c8b240996dd52211d57197a36ec3ab39565 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Mon, 8 Feb 2010 16:09:45 +0000 Subject: [PATCH 47/49] Fix #86, patch from jsbid1 gmail.com --- CHANGELOG | 1 + src/iodined.c | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index 404774f..271e2ad 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -29,6 +29,7 @@ CHANGES: Patch by Anne Bezemer, merge help by logix. - Merged low-latency patch from Anne Bezemer, fixes #76. - Resolve client nameserver argument if given as hostname, fixes #82. + - Open log before chroot, fixes #86: logging on FreeBSD. 2009-06-01: 0.5.2 "WifiFree" - Fixed client segfault on OS X, #57 diff --git a/src/iodined.c b/src/iodined.c index 938975e..a3e599b 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -2446,6 +2446,11 @@ main(int argc, char **argv) if (pidfile != NULL) do_pidfile(pidfile); +#ifdef FREEBSD + tzsetwall(); +#endif + openlog( __progname, LOG_NDELAY, LOG_DAEMON ); + if (newroot != NULL) do_chroot(newroot); From 8e5d75e426839bf9c2ae0c518b25d5649590403f Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Mon, 8 Feb 2010 16:13:17 +0000 Subject: [PATCH 48/49] Fix build error on windows --- src/iodined.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/iodined.c b/src/iodined.c index a3e599b..34cd240 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -2449,7 +2449,9 @@ main(int argc, char **argv) #ifdef FREEBSD tzsetwall(); #endif +#ifndef WINDOWS32 openlog( __progname, LOG_NDELAY, LOG_DAEMON ); +#endif if (newroot != NULL) do_chroot(newroot); From a4f41b7db39216b3746b24c9c88bc765fc3437a4 Mon Sep 17 00:00:00 2001 From: Erik Ekman Date: Mon, 8 Feb 2010 16:50:45 +0000 Subject: [PATCH 49/49] #89, use remote ip as second ip in ifconfig on FreeBSD --- src/client.c | 2 +- src/iodined.c | 6 +++--- src/tun.c | 6 +++++- src/tun.h | 2 +- src/user.c | 8 ++++++++ src/user.h | 1 + 6 files changed, 19 insertions(+), 6 deletions(-) diff --git a/src/client.c b/src/client.c index 6845e0f..0036b0e 100644 --- a/src/client.c +++ b/src/client.c @@ -1492,7 +1492,7 @@ handshake_login(int dns_fd, int seed) server[64] = 0; client[64] = 0; - if (tun_setip(client, netmask) == 0 && + if (tun_setip(client, server, netmask) == 0 && tun_setmtu(mtu) == 0) { fprintf(stderr, "Server tunnel IP is %s\n", server); diff --git a/src/iodined.c b/src/iodined.c index 34cd240..84b2281 100644 --- a/src/iodined.c +++ b/src/iodined.c @@ -2409,12 +2409,14 @@ main(int argc, char **argv) read_password(password, sizeof(password)); } + created_users = init_users(my_ip, netmask); + if ((tun_fd = open_tun(device)) == -1) { retval = 1; goto cleanup0; } if (!skipipconfig) { - if (tun_setip(argv[0], netmask) != 0 || tun_setmtu(mtu) != 0) { + if (tun_setip(argv[0], users_get_first_ip(), netmask) != 0 || tun_setmtu(mtu) != 0) { retval = 1; goto cleanup1; } @@ -2431,8 +2433,6 @@ main(int argc, char **argv) } my_mtu = mtu; - - created_users = init_users(my_ip, netmask); if (created_users < USERS) { fprintf(stderr, "Limiting to %d simultaneous users because of netmask /%d\n", diff --git a/src/tun.c b/src/tun.c index df2297e..6802850 100644 --- a/src/tun.c +++ b/src/tun.c @@ -426,7 +426,7 @@ read_tun(int tun_fd, char *buf, size_t len) } int -tun_setip(const char *ip, int netbits) +tun_setip(const char *ip, const char *remoteip, int netbits) { char cmdline[512]; int netmask; @@ -458,7 +458,11 @@ tun_setip(const char *ip, int netbits) "/sbin/ifconfig %s %s %s netmask %s", if_name, ip, +#ifdef FREEBSD + remoteip, /* FreeBSD wants other IP as second IP */ +#else ip, +#endif inet_ntoa(net)); fprintf(stderr, "Setting IP of %s to %s\n", if_name, ip); diff --git a/src/tun.h b/src/tun.h index 3f99dc0..89ffcfa 100644 --- a/src/tun.h +++ b/src/tun.h @@ -21,7 +21,7 @@ int open_tun(const char *); void close_tun(int); int write_tun(int, char *, size_t); ssize_t read_tun(int, char *, size_t); -int tun_setip(const char *, int); +int tun_setip(const char *, const char *, int); int tun_setmtu(const unsigned); #endif /* _TUN_H_ */ diff --git a/src/user.c b/src/user.c index b2e8f04..dfe9c36 100644 --- a/src/user.c +++ b/src/user.c @@ -85,6 +85,14 @@ init_users(in_addr_t my_ip, int netbits) return created_users; } +const char* +users_get_first_ip() +{ + struct in_addr ip; + ip.s_addr = users[0].tun_ip; + return inet_ntoa(ip); +} + int users_waiting_on_reply() { diff --git a/src/user.h b/src/user.h index e32e090..51a6092 100644 --- a/src/user.h +++ b/src/user.h @@ -76,6 +76,7 @@ struct user { extern struct user users[USERS]; int init_users(in_addr_t, int); +const char* users_get_first_ip(); int users_waiting_on_reply(); int find_user_by_ip(uint32_t); int all_users_waiting_to_send();