* @file vpn/gnunet-service-vpn.c
* @brief service that opens a virtual interface and allows its clients
* to allocate IPs on the virtual interface and to then redirect
- * IP traffic received on those IPs via the GNUnet mesh
+ * IP traffic received on those IPs via the GNUnet mesh
* @author Philipp Toelke
* @author Christian Grothoff
*
* TODO:
- * - build mesh messages
- * - parse mesh replies
- * - build IP messages from mesh replies
- * - create secondary mesh tunnels if needed
- * - fully implement shutdown code
- * - better message queue management (bounded state, drop oldest/RED?)
- * - imrpove support for deciding which tunnels to keep and which ones to destroy
- * - add back ICMP support (especially needed for IPv6)
+ * - keep multiple peers/mesh tunnels ready as alternative exits /
+ * detect & recover from tunnel-to-exit failure gracefully
*/
#include "platform.h"
#include "gnunet_util_lib.h"
#include "gnunet_protocols.h"
#include "gnunet_applications.h"
#include "gnunet_mesh_service.h"
+#include "gnunet_statistics_service.h"
#include "gnunet_constants.h"
-#include "tcpip_tun.h"
+#include "gnunet_tun_lib.h"
+#include "gnunet_regex_service.h"
#include "vpn.h"
#include "exit.h"
+
+/**
+ * Maximum number of messages we allow in the queue for mesh.
+ */
+#define MAX_MESSAGE_QUEUE_SIZE 4
+
+
+/**
+ * State we keep for each of our tunnels.
+ */
+struct TunnelState;
+
+/**
+ * Information we track for each IP address to determine which tunnel
+ * to send the traffic over to the destination.
+ */
+struct DestinationEntry;
+
+/**
+ * List of tunnels we keep for each destination port for a given
+ * destination entry.
+ */
+struct DestinationTunnel
+{
+
+ /**
+ * Kept in a DLL.
+ */
+ struct DestinationTunnel *next;
+
+ /**
+ * Kept in a DLL.
+ */
+ struct DestinationTunnel *prev;
+
+ /**
+ * Destination entry list this `struct DestinationTunnel` belongs with.
+ */
+ struct DestinationEntry *destination;
+
+ /**
+ * Pre-allocated tunnel for this destination, or NULL for none.
+ */
+ struct TunnelState *ts;
+
+ /**
+ * Destination port this tunnel state is used for.
+ */
+ uint16_t destination_port;
+
+};
+
+
/**
* Information we track for each IP address to determine which tunnel
* to send the traffic over to the destination.
*/
struct DestinationEntry
{
+
/**
- * Information about the tunnel to use, NULL if no tunnel
- * is available right now.
+ * Key under which this entry is in the 'destination_map' (only valid
+ * if 'heap_node != NULL').
*/
- struct GNUNET_MESH_Tunnel *tunnel;
+ struct GNUNET_HashCode key;
+
+ /**
+ * Head of DLL of tunnels associated with this destination.
+ */
+ struct DestinationTunnel *dt_head;
+
+ /**
+ * Tail of DLL of tunnels associated with this destination.
+ */
+ struct DestinationTunnel *dt_tail;
/**
* Entry for this entry in the destination_heap.
struct GNUNET_CONTAINER_HeapNode *heap_node;
/**
- * GNUNET_NO if this is a tunnel to an Internet-exit,
- * GNUNET_YES if this tunnel is to a service.
+ * #GNUNET_NO if this is a tunnel to an Internet-exit,
+ * #GNUNET_YES if this tunnel is to a service.
*/
int is_service;
/**
* The description of the service (only used for service tunnels).
*/
- GNUNET_HashCode service_descriptor;
+ struct GNUNET_HashCode service_descriptor;
/**
* Peer offering the service.
} service_destination;
- struct
+ struct
{
-
+
/**
* Address family used (AF_INET or AF_INET6).
*/
int af;
-
+
/**
* IP address of the ultimate destination (only used for exit tunnels).
*/
} exit_destination;
} details;
-
+
};
* This is a doubly-linked list.
*/
struct TunnelMessageQueueEntry *prev;
-
+
/**
* Number of bytes in 'msg'.
*/
*/
struct TunnelState
{
+
+ /**
+ * Information about the tunnel to use, NULL if no tunnel
+ * is available right now.
+ */
+ struct GNUNET_MESH_Tunnel *tunnel;
+
+ /**
+ * Active query with REGEX to locate exit.
+ */
+ struct GNUNET_REGEX_Search *search;
+
/**
* Active transmission handle, NULL for none.
*/
/**
* Head of list of messages scheduled for transmission.
*/
- struct TunnelMessageQueueEntry *head;
+ struct TunnelMessageQueueEntry *tmq_head;
/**
* Tail of list of messages scheduled for transmission.
*/
- struct TunnelMessageQueueEntry *tail;
+ struct TunnelMessageQueueEntry *tmq_tail;
/**
- * Client that needs to be notified about the tunnel being
- * up as soon as a peer is connected; NULL for none.
+ * Destination entry that has a pointer to this tunnel state;
+ * NULL if this tunnel state is in the tunnel map.
*/
- struct GNUNET_SERVER_Client *client;
-
- /**
- * ID of the client request that caused us to setup this entry.
- */
- uint64_t request_id;
+ struct DestinationTunnel *destination_container;
/**
* Destination to which this tunnel leads. Note that
struct DestinationEntry destination;
/**
- * GNUNET_NO if this is a tunnel to an Internet-exit,
- * GNUNET_YES if this tunnel is to a service.
+ * Addess family used for this tunnel on the local TUN interface.
*/
- int is_service;
+ int af;
/**
- * Addess family used for this tunnel on the local TUN interface.
+ * Length of the doubly linked 'tmq_head/tmq_tail' list.
*/
- int af;
+ unsigned int tmq_length;
+
+ /**
+ * IPPROTO_TCP or IPPROTO_UDP once bound.
+ */
+ uint8_t protocol;
/**
* IP address of the source on our end, initially uninitialized.
* Address if af is AF_INET.
*/
struct in_addr v4;
-
+
/**
* Address if af is AF_INET6.
*/
* Address if af is AF_INET.
*/
struct in_addr v4;
-
+
/**
* Address if af is AF_INET6.
*/
};
+/**
+ * Return value from 'main'.
+ */
+static int global_ret;
+
/**
* Configuration we use.
*/
static struct GNUNET_CONTAINER_MultiHashMap *tunnel_map;
/**
- * Min-Heap sorted by activity time to expire old mappings.
+ * Min-Heap sorted by activity time to expire old mappings; values are
+ * of type 'struct TunnelState'.
*/
static struct GNUNET_CONTAINER_Heap *tunnel_heap;
+/**
+ * Statistics.
+ */
+static struct GNUNET_STATISTICS_Handle *stats;
+
/**
* The handle to the VPN helper process "gnunet-helper-vpn".
*/
static void
get_destination_key_from_ip (int af,
const void *address,
- GNUNET_HashCode *key)
+ struct GNUNET_HashCode *key)
{
switch (af)
{
uint16_t source_port,
const void *destination_ip,
uint16_t destination_port,
- GNUNET_HashCode *key)
+ struct GNUNET_HashCode *key)
{
char *off;
- memset (key, 0, sizeof (GNUNET_HashCode));
+ memset (key, 0, sizeof (struct GNUNET_HashCode));
/* the GNUnet hashmap only uses the first sizeof(unsigned int) of the hash,
so we put the ports in there (and hope for few collisions) */
off = (char*) key;
break;
}
memcpy (off, &protocol, sizeof (uint8_t));
- off += sizeof (uint8_t);
+ /* off += sizeof (uint8_t); */
}
int result_af,
const void *addr)
{
- char buf[sizeof (struct RedirectToIpResponseMessage) + sizeof (struct in6_addr)];
+ char buf[sizeof (struct RedirectToIpResponseMessage) + sizeof (struct in6_addr)] GNUNET_ALIGN;
struct RedirectToIpResponseMessage *res;
size_t rlen;
switch (result_af)
{
case AF_INET:
- rlen = sizeof (struct in_addr);
+ rlen = sizeof (struct in_addr);
break;
case AF_INET6:
rlen = sizeof (struct in6_addr);
/**
- * Method called whenever a peer has disconnected from the tunnel.
- *
- * @param cls closure
- * @param peer peer identity the tunnel stopped working with
- */
-static void
-tunnel_peer_disconnect_handler (void *cls,
- const struct
- GNUNET_PeerIdentity * peer)
-{
- /* FIXME: should we do anything here?
- - stop transmitting to the tunnel (start queueing?)
- - possibly destroy the tunnel entirely (unless service tunnel?)
- */
-}
-
-
-/**
- * Method called whenever a peer has connected to the tunnel. Notifies
- * the waiting client that the tunnel is now up.
+ * Free resources associated with a tunnel state.
*
- * @param cls closure
- * @param peer peer identity the tunnel was created to, NULL on timeout
- * @param atsi performance data for the connection
+ * @param ts state to free
*/
static void
-tunnel_peer_connect_handler (void *cls,
- const struct GNUNET_PeerIdentity
- * peer,
- const struct
- GNUNET_ATS_Information * atsi)
+free_tunnel_state (struct TunnelState *ts)
{
- struct TunnelState *ts = cls;
+ struct GNUNET_HashCode key;
+ struct TunnelMessageQueueEntry *tnq;
+ struct GNUNET_MESH_Tunnel *tunnel;
- if (NULL == ts->client)
- return; /* nothing to do */
- send_client_reply (ts->client,
- ts->request_id,
- ts->af,
- &ts->destination_ip);
- GNUNET_SERVER_client_drop (ts->client);
- ts->client = NULL;
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Cleaning up tunnel state\n");
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active tunnels"),
+ -1, GNUNET_NO);
+ while (NULL != (tnq = ts->tmq_head))
+ {
+ GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
+ ts->tmq_tail,
+ tnq);
+ ts->tmq_length--;
+ GNUNET_free (tnq);
+ }
+ GNUNET_assert (0 == ts->tmq_length);
+ if (NULL != ts->th)
+ {
+ GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
+ ts->th = NULL;
+ }
+ GNUNET_assert (NULL == ts->destination.heap_node);
+ if (NULL != (tunnel = ts->tunnel))
+ {
+ ts->tunnel = NULL;
+ GNUNET_MESH_tunnel_destroy (tunnel);
+ }
+ if (NULL != ts->search)
+ {
+ GNUNET_REGEX_search_cancel (ts->search);
+ ts->search = NULL;
+ }
+ if (NULL != ts->heap_node)
+ {
+ GNUNET_CONTAINER_heap_remove_node (ts->heap_node);
+ ts->heap_node = NULL;
+ get_tunnel_key_from_ips (ts->af,
+ ts->protocol,
+ &ts->source_ip,
+ ts->source_port,
+ &ts->destination_ip,
+ ts->destination_port,
+ &key);
+ GNUNET_assert (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_remove (tunnel_map,
+ &key,
+ ts));
+ }
+ if (NULL != ts->destination_container)
+ {
+ GNUNET_assert (ts == ts->destination_container->ts);
+ ts->destination_container->ts = NULL;
+ ts->destination_container = NULL;
+ }
+ GNUNET_free (ts);
}
/**
* Send a message from the message queue via mesh.
*
- * @param cls the 'struct TunnelState' with the message queue
- * @param size number of bytes available in buf
+ * @param cls the `struct TunnelState` with the message queue
+ * @param size number of bytes available in @a buf
* @param buf where to copy the message
- * @return number of bytes copied to buf
+ * @return number of bytes copied to @a buf
*/
static size_t
send_to_peer_notify_callback (void *cls, size_t size, void *buf)
ts->th = NULL;
if (NULL == buf)
return 0;
- tnq = ts->head;
+ tnq = ts->tmq_head;
GNUNET_assert (NULL != tnq);
GNUNET_assert (size >= tnq->len);
- GNUNET_CONTAINER_DLL_remove (ts->head,
- ts->tail,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Sending %u bytes via mesh tunnel\n",
+ tnq->len);
+ GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
+ ts->tmq_tail,
tnq);
+ ts->tmq_length--;
memcpy (buf, tnq->msg, tnq->len);
ret = tnq->len;
GNUNET_free (tnq);
- if (NULL != (tnq = ts->head))
- ts->th = GNUNET_MESH_notify_transmit_ready (ts->destination.tunnel,
- GNUNET_NO /* cork */,
- 42 /* priority */,
+ if (NULL != (tnq = ts->tmq_head))
+ ts->th = GNUNET_MESH_notify_transmit_ready (ts->tunnel,
+ GNUNET_NO /* cork */,
GNUNET_TIME_UNIT_FOREVER_REL,
- NULL,
tnq->len,
&send_to_peer_notify_callback,
ts);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Bytes given to mesh for transmission"),
+ ret, GNUNET_NO);
return ret;
}
/**
- * Add the given message to the given tunnel and
- * trigger the transmission process.
+ * Add the given message to the given tunnel and trigger the
+ * transmission process.
*
* @param tnq message to queue
* @param ts tunnel to queue the message for
send_to_tunnel (struct TunnelMessageQueueEntry *tnq,
struct TunnelState *ts)
{
- GNUNET_CONTAINER_DLL_insert_tail (ts->head,
- ts->tail,
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Queueing %u bytes for transmission via mesh tunnel\n",
+ tnq->len);
+ GNUNET_assert (NULL != ts->tunnel);
+ GNUNET_CONTAINER_DLL_insert_tail (ts->tmq_head,
+ ts->tmq_tail,
tnq);
+ ts->tmq_length++;
+ if (ts->tmq_length > MAX_MESSAGE_QUEUE_SIZE)
+ {
+ struct TunnelMessageQueueEntry *dq;
+
+ dq = ts->tmq_head;
+ GNUNET_assert (dq != tnq);
+ GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
+ ts->tmq_tail,
+ dq);
+ ts->tmq_length--;
+ GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
+ ts->th = NULL;
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Bytes dropped in mesh queue (overflow)"),
+ dq->len,
+ GNUNET_NO);
+ GNUNET_free (dq);
+ }
if (NULL == ts->th)
- ts->th = GNUNET_MESH_notify_transmit_ready (ts->destination.tunnel,
+ ts->th = GNUNET_MESH_notify_transmit_ready (ts->tunnel,
GNUNET_NO /* cork */,
- 42 /* priority */,
GNUNET_TIME_UNIT_FOREVER_REL,
- NULL,
tnq->len,
&send_to_peer_notify_callback,
ts);
/**
- * Route a packet via mesh to the given destination.
+ * Regex has found a potential exit peer for us; consider using it.
+ *
+ * @param cls the 'struct TunnelState'
+ * @param id Peer providing a regex that matches the string.
+ * @param get_path Path of the get request.
+ * @param get_path_length Lenght of @a get_path.
+ * @param put_path Path of the put request.
+ * @param put_path_length Length of the @a put_path.
+ */
+static void
+handle_regex_result (void *cls,
+ const struct GNUNET_PeerIdentity *id,
+ const struct GNUNET_PeerIdentity *get_path,
+ unsigned int get_path_length,
+ const struct GNUNET_PeerIdentity *put_path,
+ unsigned int put_path_length)
+{
+ struct TunnelState *ts = cls;
+ unsigned int apptype;
+
+ GNUNET_REGEX_search_cancel (ts->search);
+ ts->search = NULL;
+ switch (ts->af)
+ {
+ case AF_INET:
+ apptype = GNUNET_APPLICATION_TYPE_IPV4_GATEWAY;
+ break;
+ case AF_INET6:
+ apptype = GNUNET_APPLICATION_TYPE_IPV6_GATEWAY;
+ break;
+ default:
+ GNUNET_break (0);
+ return;
+ }
+ ts->tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
+ ts,
+ id,
+ apptype,
+ GNUNET_YES,
+ GNUNET_NO);
+}
+
+
+/**
+ * Initialize the given destination entry's mesh tunnel.
+ *
+ * @param dt destination tunnel for which we need to setup a tunnel
+ * @param client_af address family of the address returned to the client
+ * @return tunnel state of the tunnel that was created
+ */
+static struct TunnelState *
+create_tunnel_to_destination (struct DestinationTunnel *dt,
+ int client_af)
+{
+ struct TunnelState *ts;
+ unsigned int apptype;
+
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Mesh tunnels created"),
+ 1, GNUNET_NO);
+ GNUNET_assert (NULL == dt->ts);
+ switch (client_af)
+ {
+ case AF_INET:
+ apptype = GNUNET_APPLICATION_TYPE_IPV4_GATEWAY;
+ break;
+ case AF_INET6:
+ apptype = GNUNET_APPLICATION_TYPE_IPV6_GATEWAY;
+ break;
+ default:
+ GNUNET_break (0);
+ return NULL;
+ }
+ ts = GNUNET_new (struct TunnelState);
+ ts->af = client_af;
+ ts->destination = *dt->destination;
+ ts->destination.heap_node = NULL; /* copy is NOT in destination heap */
+ dt->ts = ts;
+ ts->destination_container = dt; /* we are referenced from dt */
+ if (dt->destination->is_service)
+ {
+ ts->tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
+ ts,
+ &dt->destination->details.service_destination.target,
+ apptype,
+ GNUNET_YES,
+ GNUNET_NO);
+ if (NULL == ts->tunnel)
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+ _("Failed to setup mesh tunnel!\n"));
+ GNUNET_free (ts);
+ return NULL;
+ }
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Creating tunnel to peer %s offering service %s\n",
+ GNUNET_i2s (&dt->destination->details.service_destination.target),
+ GNUNET_h2s (&dt->destination->details.service_destination.service_descriptor));
+ }
+ else
+ {
+ char *policy;
+
+ switch (dt->destination->details.exit_destination.af)
+ {
+ case AF_INET:
+ {
+ char address[GNUNET_TUN_IPV4_REGEXLEN];
+
+ GNUNET_TUN_ipv4toregexsearch (&dt->destination->details.exit_destination.ip.v4,
+ "255.255.255.255",
+ address);
+ GNUNET_asprintf (&policy, "%s%s%s:%u",
+ GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
+ "4",
+ address,
+ (unsigned int) dt->destination_port);
+ break;
+ }
+ case AF_INET6:
+ {
+ char address[GNUNET_TUN_IPV6_REGEXLEN];
+
+ GNUNET_TUN_ipv6toregexsearch (&dt->destination->details.exit_destination.ip.v6,
+ 128, address);
+ GNUNET_asprintf (&policy, "%s%s%s:%u",
+ GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
+ "6",
+ address,
+ (unsigned int) dt->destination_port);
+ break;
+ }
+ default:
+ GNUNET_assert (0);
+ break;
+ }
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Requesting connect by string: %s\n",
+ policy);
+ ts->search = GNUNET_REGEX_search (cfg,
+ policy,
+ &handle_regex_result,
+ ts);
+ GNUNET_free (policy);
+ }
+ return ts;
+}
+
+
+/**
+ * We have too many active tunnels. Clean up the oldest tunnel.
+ *
+ * @param except tunnel that must NOT be cleaned up, even if it is the oldest
+ */
+static void
+expire_tunnel (struct TunnelState *except)
+{
+ struct TunnelState *ts;
+
+ ts = GNUNET_CONTAINER_heap_peek (tunnel_heap);
+ GNUNET_assert (NULL != ts);
+ if (except == ts)
+ return; /* can't do this */
+ free_tunnel_state (ts);
+}
+
+
+/**
+ * Route a packet via mesh to the given destination.
*
* @param destination description of the destination
* @param af address family on this end (AF_INET or AF_INET6)
- * @param protocol IPPROTO_TCP or IPPROTO_UDP
+ * @param protocol IPPROTO_TCP or IPPROTO_UDP or IPPROTO_ICMP or IPPROTO_ICMPV6
* @param source_ip source IP used by the sender (struct in_addr or struct in6_addr)
* @param destination_ip destination IP used by the sender (struct in_addr or struct in6_addr)
* @param payload payload of the packet after the IP header
- * @param payload_length number of bytes in payload
+ * @param payload_length number of bytes in @a payload
*/
static void
route_packet (struct DestinationEntry *destination,
const void *payload,
size_t payload_length)
{
- GNUNET_HashCode key;
+ struct GNUNET_HashCode key;
struct TunnelState *ts;
struct TunnelMessageQueueEntry *tnq;
size_t alen;
size_t mlen;
- GNUNET_MESH_ApplicationType app_type;
int is_new;
- const struct udp_packet *udp;
- const struct tcp_packet *tcp;
-
+ const struct GNUNET_TUN_UdpHeader *udp;
+ const struct GNUNET_TUN_TcpHeader *tcp;
+ const struct GNUNET_TUN_IcmpHeader *icmp;
+ struct DestinationTunnel *dt;
+ uint16_t source_port;
+ uint16_t destination_port;
+
switch (protocol)
{
case IPPROTO_UDP:
{
- if (payload_length < sizeof (struct udp_packet))
+ if (payload_length < sizeof (struct GNUNET_TUN_UdpHeader))
{
/* blame kernel? */
GNUNET_break (0);
return;
}
+ tcp = NULL; /* make compiler happy */
+ icmp = NULL; /* make compiler happy */
udp = payload;
+ if (udp->len < sizeof (struct GNUNET_TUN_UdpHeader))
+ {
+ GNUNET_break_op (0);
+ return;
+ }
+ source_port = ntohs (udp->source_port);
+ destination_port = ntohs (udp->destination_port);
get_tunnel_key_from_ips (af,
IPPROTO_UDP,
source_ip,
- ntohs (udp->spt),
+ source_port,
destination_ip,
- ntohs (udp->dpt),
+ destination_port,
&key);
}
break;
case IPPROTO_TCP:
{
- if (payload_length < sizeof (struct tcp_packet))
+ if (payload_length < sizeof (struct GNUNET_TUN_TcpHeader))
{
/* blame kernel? */
GNUNET_break (0);
return;
}
+ udp = NULL; /* make compiler happy */
+ icmp = NULL; /* make compiler happy */
tcp = payload;
+ if (tcp->off * 4 < sizeof (struct GNUNET_TUN_TcpHeader))
+ {
+ GNUNET_break_op (0);
+ return;
+ }
+ source_port = ntohs (tcp->source_port);
+ destination_port = ntohs (tcp->destination_port);
get_tunnel_key_from_ips (af,
IPPROTO_TCP,
source_ip,
- ntohs (tcp->spt),
+ source_port,
+ destination_ip,
+ destination_port,
+ &key);
+ }
+ break;
+ case IPPROTO_ICMP:
+ case IPPROTO_ICMPV6:
+ {
+ if ( (AF_INET == af) ^ (protocol == IPPROTO_ICMP) )
+ {
+ GNUNET_break (0);
+ return;
+ }
+ if (payload_length < sizeof (struct GNUNET_TUN_IcmpHeader))
+ {
+ /* blame kernel? */
+ GNUNET_break (0);
+ return;
+ }
+ tcp = NULL; /* make compiler happy */
+ udp = NULL; /* make compiler happy */
+ icmp = payload;
+ source_port = 0;
+ destination_port = 0;
+ get_tunnel_key_from_ips (af,
+ protocol,
+ source_ip,
+ 0,
destination_ip,
- ntohs (tcp->dpt),
+ 0,
&key);
}
break;
(unsigned int) protocol);
return;
}
-
+ alen = 0;
if (! destination->is_service)
- {
+ {
switch (destination->details.exit_destination.af)
{
case AF_INET:
alen = sizeof (struct in_addr);
- app_type = GNUNET_APPLICATION_TYPE_IPV4_GATEWAY;
break;
case AF_INET6:
alen = sizeof (struct in6_addr);
- app_type = GNUNET_APPLICATION_TYPE_IPV6_GATEWAY;
break;
default:
- alen = 0;
GNUNET_assert (0);
}
+
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+ char xbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Routing %s packet from %s:%u -> %s:%u to destination %s:%u\n",
+ (protocol == IPPROTO_TCP) ? "TCP" : "UDP",
+ inet_ntop (af, source_ip, sbuf, sizeof (sbuf)),
+ source_port,
+ inet_ntop (af, destination_ip, dbuf, sizeof (dbuf)),
+ destination_port,
+ inet_ntop (destination->details.exit_destination.af,
+ &destination->details.exit_destination.ip,
+ xbuf, sizeof (xbuf)),
+ destination_port);
+ }
+ for (dt = destination->dt_head; NULL != dt; dt = dt->next)
+ if (dt->destination_port == destination_port)
+ break;
}
else
{
- /* make compiler happy */
- alen = 0;
- app_type = 0;
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Routing %s packet from %s:%u -> %s:%u to service %s at peer %s\n",
+ (protocol == IPPROTO_TCP) ? "TCP" : "UDP",
+ inet_ntop (af, source_ip, sbuf, sizeof (sbuf)),
+ source_port,
+ inet_ntop (af, destination_ip, dbuf, sizeof (dbuf)),
+ destination_port,
+ GNUNET_h2s (&destination->details.service_destination.service_descriptor),
+ GNUNET_i2s (&destination->details.service_destination.target));
+ }
+ dt = destination->dt_head;
+ }
+ if (NULL == dt)
+ {
+ dt = GNUNET_new (struct DestinationTunnel);
+ dt->destination = destination;
+ GNUNET_CONTAINER_DLL_insert (destination->dt_head,
+ destination->dt_tail,
+ dt);
+ dt->destination_port = destination_port;
}
- // FIXME: something is horrifically wrong here about
- // how we lookup 'ts', match it and how we decide about
- // creating new tunnels!
- /* find tunnel */
- is_new = GNUNET_NO;
+ /* see if we have an existing tunnel for this destination */
ts = GNUNET_CONTAINER_multihashmap_get (tunnel_map,
&key);
if (NULL == ts)
{
- /* create new tunnel */
+ /* need to either use the existing tunnel from the destination (if still
+ available) or create a fresh one */
is_new = GNUNET_YES;
- ts = GNUNET_malloc (sizeof (struct TunnelState));
- ts->destination.tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
- ts,
- &tunnel_peer_connect_handler,
- &tunnel_peer_disconnect_handler,
- ts);
- if (destination->is_service)
- GNUNET_MESH_peer_request_connect_add (ts->destination.tunnel,
- &destination->details.service_destination.target);
+ if (NULL == dt->ts)
+ ts = create_tunnel_to_destination (dt, af);
else
- GNUNET_MESH_peer_request_connect_by_type (ts->destination.tunnel,
- app_type);
+ ts = dt->ts;
+ if (NULL == ts)
+ return;
+ dt->ts = NULL;
+ ts->destination_container = NULL; /* no longer 'contained' */
+ /* now bind existing "unbound" tunnel to our IP/port tuple */
+ ts->protocol = protocol;
+ ts->af = af;
+ if (AF_INET == af)
+ {
+ ts->source_ip.v4 = * (const struct in_addr *) source_ip;
+ ts->destination_ip.v4 = * (const struct in_addr *) destination_ip;
+ }
+ else
+ {
+ ts->source_ip.v6 = * (const struct in6_addr *) source_ip;
+ ts->destination_ip.v6 = * (const struct in6_addr *) destination_ip;
+ }
+ ts->source_port = source_port;
+ ts->destination_port = destination_port;
+ ts->heap_node = GNUNET_CONTAINER_heap_insert (tunnel_heap,
+ ts,
+ GNUNET_TIME_absolute_get ().abs_value_us);
+ GNUNET_assert (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_put (tunnel_map,
+ &key,
+ ts,
+ GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active tunnels"),
+ 1, GNUNET_NO);
+ while (GNUNET_CONTAINER_multihashmap_size (tunnel_map) > max_tunnel_mappings)
+ expire_tunnel (ts);
+ }
+ else
+ {
+ is_new = GNUNET_NO;
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value_us);
}
-
+ GNUNET_assert (NULL != ts->tunnel);
+
/* send via tunnel */
switch (protocol)
{
{
struct GNUNET_EXIT_UdpServiceMessage *usm;
- mlen = sizeof (struct GNUNET_EXIT_UdpServiceMessage) +
- payload_length - sizeof (struct udp_packet);
+ mlen = sizeof (struct GNUNET_EXIT_UdpServiceMessage) +
+ payload_length - sizeof (struct GNUNET_TUN_UdpHeader);
if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
{
GNUNET_break (0);
return;
}
tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
usm = (struct GNUNET_EXIT_UdpServiceMessage *) &tnq[1];
usm->header.size = htons ((uint16_t) mlen);
usm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_SERVICE);
/* if the source port is below 32000, we assume it has a special
meaning; if not, we pick a random port (this is a heuristic) */
- usm->source_port = (ntohs (udp->spt) < 32000) ? udp->spt : 0;
- usm->destination_port = udp->dpt;
+ usm->source_port = (ntohs (udp->source_port) < 32000) ? udp->source_port : 0;
+ usm->destination_port = udp->destination_port;
usm->service_descriptor = destination->details.service_destination.service_descriptor;
memcpy (&usm[1],
&udp[1],
- payload_length - sizeof (struct udp_packet));
+ payload_length - sizeof (struct GNUNET_TUN_UdpHeader));
}
else
{
struct in6_addr *ip6dst;
void *payload;
- mlen = sizeof (struct GNUNET_EXIT_UdpInternetMessage) +
- alen + payload_length - sizeof (struct udp_packet);
+ mlen = sizeof (struct GNUNET_EXIT_UdpInternetMessage) +
+ alen + payload_length - sizeof (struct GNUNET_TUN_UdpHeader);
if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
{
GNUNET_break (0);
return;
}
- tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) +
- mlen);
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
uim = (struct GNUNET_EXIT_UdpInternetMessage *) &tnq[1];
uim->header.size = htons ((uint16_t) mlen);
- uim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET);
+ uim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET);
uim->af = htonl (destination->details.exit_destination.af);
- uim->source_port = (ntohs (udp->spt) < 32000) ? udp->spt : 0;
- uim->destination_port = udp->dpt;
+ uim->source_port = (ntohs (udp->source_port) < 32000) ? udp->source_port : 0;
+ uim->destination_port = udp->destination_port;
switch (destination->details.exit_destination.af)
{
case AF_INET:
}
memcpy (payload,
&udp[1],
- payload_length - sizeof (struct udp_packet));
+ payload_length - sizeof (struct GNUNET_TUN_UdpHeader));
}
break;
case IPPROTO_TCP:
{
struct GNUNET_EXIT_TcpServiceStartMessage *tsm;
- mlen = sizeof (struct GNUNET_EXIT_TcpServiceStartMessage) +
- payload_length - sizeof (struct tcp_packet);
+ mlen = sizeof (struct GNUNET_EXIT_TcpServiceStartMessage) +
+ payload_length - sizeof (struct GNUNET_TUN_TcpHeader);
if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
{
GNUNET_break (0);
return;
}
tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
tsm = (struct GNUNET_EXIT_TcpServiceStartMessage *) &tnq[1];
tsm->header.size = htons ((uint16_t) mlen);
tsm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_TO_SERVICE_START);
tsm->tcp_header = *tcp;
memcpy (&tsm[1],
&tcp[1],
- payload_length - sizeof (struct tcp_packet));
+ payload_length - sizeof (struct GNUNET_TUN_TcpHeader));
}
else
{
struct in6_addr *ip6dst;
void *payload;
- mlen = sizeof (struct GNUNET_EXIT_TcpInternetStartMessage) +
- alen + payload_length - sizeof (struct tcp_packet);
+ mlen = sizeof (struct GNUNET_EXIT_TcpInternetStartMessage) +
+ alen + payload_length - sizeof (struct GNUNET_TUN_TcpHeader);
if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
{
GNUNET_break (0);
return;
}
tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
tim = (struct GNUNET_EXIT_TcpInternetStartMessage *) &tnq[1];
tim->header.size = htons ((uint16_t) mlen);
tim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_TO_INTERNET_START);
}
memcpy (payload,
&tcp[1],
- payload_length - sizeof (struct tcp_packet));
+ payload_length - sizeof (struct GNUNET_TUN_TcpHeader));
}
}
else
{
struct GNUNET_EXIT_TcpDataMessage *tdm;
- mlen = sizeof (struct GNUNET_EXIT_TcpDataMessage) +
- alen + payload_length - sizeof (struct tcp_packet);
+ mlen = sizeof (struct GNUNET_EXIT_TcpDataMessage) +
+ payload_length - sizeof (struct GNUNET_TUN_TcpHeader);
if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
{
GNUNET_break (0);
return;
}
tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
tdm = (struct GNUNET_EXIT_TcpDataMessage *) &tnq[1];
tdm->header.size = htons ((uint16_t) mlen);
- tdm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_DATA);
+ tdm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT);
tdm->reserved = htonl (0);
tdm->tcp_header = *tcp;
memcpy (&tdm[1],
&tcp[1],
- payload_length - sizeof (struct tcp_packet));
+ payload_length - sizeof (struct GNUNET_TUN_TcpHeader));
}
break;
- default:
- /* not supported above, how can we get here !? */
- GNUNET_assert (0);
- break;
- }
- send_to_tunnel (tnq, ts);
-}
-
-
-/**
- * Receive packets from the helper-process (someone send to the local
- * virtual tunnel interface). Find the destination mapping, and if it
- * exists, identify the correct MESH tunnel (or possibly create it)
- * and forward the packet.
- *
- * @param cls closure, NULL
- * @param client NULL
- * @param message message we got from the client (VPN tunnel interface)
- */
-static void
-message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
- const struct GNUNET_MessageHeader *message)
-{
- const struct tun_header *tun;
- size_t mlen;
- GNUNET_HashCode key;
- struct DestinationEntry *de;
+ case IPPROTO_ICMP:
+ case IPPROTO_ICMPV6:
+ if (destination->is_service)
+ {
+ struct GNUNET_EXIT_IcmpServiceMessage *ism;
+ mlen = sizeof (struct GNUNET_EXIT_IcmpServiceMessage) +
+ payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->msg = &tnq[1];
+ ism = (struct GNUNET_EXIT_IcmpServiceMessage *) &tnq[1];
+ ism->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_SERVICE);
+ ism->af = htonl (af); /* need to tell destination ICMP protocol family! */
+ ism->service_descriptor = destination->details.service_destination.service_descriptor;
+ ism->icmp_header = *icmp;
+ /* ICMP protocol translation will be done by the receiver (as we don't know
+ the target AF); however, we still need to possibly discard the payload
+ depending on the ICMP type */
+ switch (af)
+ {
+ case AF_INET:
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
+ case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
+ break;
+ case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
+ case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
+ case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
+ /* throw away ICMP payload, won't be useful for the other side anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ default:
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv4 packets dropped (not allowed)"),
+ 1, GNUNET_NO);
+ return;
+ }
+ /* end of AF_INET */
+ break;
+ case AF_INET6:
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
+ case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
+ case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
+ case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
+ /* throw away ICMP payload, won't be useful for the other side anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
+ break;
+ default:
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (not allowed)"),
+ 1, GNUNET_NO);
+ return;
+ }
+ /* end of AF_INET6 */
+ break;
+ default:
+ GNUNET_assert (0);
+ break;
+ }
+
+ /* update length calculations, as payload_length may have changed */
+ mlen = sizeof (struct GNUNET_EXIT_IcmpServiceMessage) +
+ alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
+ tnq->len = mlen;
+ ism->header.size = htons ((uint16_t) mlen);
+ /* finally, copy payload (if there is any left...) */
+ memcpy (&ism[1],
+ &icmp[1],
+ payload_length - sizeof (struct GNUNET_TUN_IcmpHeader));
+ }
+ else
+ {
+ struct GNUNET_EXIT_IcmpInternetMessage *iim;
+ struct in_addr *ip4dst;
+ struct in6_addr *ip6dst;
+ void *payload;
+
+ mlen = sizeof (struct GNUNET_EXIT_IcmpInternetMessage) +
+ alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->msg = &tnq[1];
+ iim = (struct GNUNET_EXIT_IcmpInternetMessage *) &tnq[1];
+ iim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_INTERNET);
+ iim->icmp_header = *icmp;
+ /* Perform ICMP protocol-translation (depending on destination AF and source AF)
+ and throw away ICMP payload depending on ICMP message type */
+ switch (af)
+ {
+ case AF_INET:
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
+ if (destination->details.exit_destination.af == AF_INET6)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_ECHO_REPLY;
+ break;
+ case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
+ if (destination->details.exit_destination.af == AF_INET6)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST;
+ break;
+ case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
+ if (destination->details.exit_destination.af == AF_INET6)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE;
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
+ if (destination->details.exit_destination.af == AF_INET6)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED;
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
+ if (destination->details.exit_destination.af == AF_INET6)
+ {
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv4 packets dropped (impossible PT to v6)"),
+ 1, GNUNET_NO);
+ GNUNET_free (tnq);
+ return;
+ }
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ default:
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv4 packets dropped (type not allowed)"),
+ 1, GNUNET_NO);
+ GNUNET_free (tnq);
+ return;
+ }
+ /* end of AF_INET */
+ break;
+ case AF_INET6:
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
+ if (destination->details.exit_destination.af == AF_INET6)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE;
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
+ if (destination->details.exit_destination.af == AF_INET)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED;
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
+ if (destination->details.exit_destination.af == AF_INET)
+ {
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (impossible PT to v4)"),
+ 1, GNUNET_NO);
+ GNUNET_free (tnq);
+ return;
+ }
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
+ if (destination->details.exit_destination.af == AF_INET)
+ {
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (impossible PT to v4)"),
+ 1, GNUNET_NO);
+ GNUNET_free (tnq);
+ return;
+ }
+ /* throw away IP-payload, exit will have to make it up anyway */
+ payload_length = sizeof (struct GNUNET_TUN_IcmpHeader);
+ break;
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
+ if (destination->details.exit_destination.af == AF_INET)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE_ECHO_REQUEST;
+ break;
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
+ if (destination->details.exit_destination.af == AF_INET)
+ iim->icmp_header.type = GNUNET_TUN_ICMPTYPE_ECHO_REPLY;
+ break;
+ default:
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (type not allowed)"),
+ 1, GNUNET_NO);
+ GNUNET_free (tnq);
+ return;
+ }
+ /* end of AF_INET6 */
+ break;
+ default:
+ GNUNET_assert (0);
+ }
+ /* update length calculations, as payload_length may have changed */
+ mlen = sizeof (struct GNUNET_EXIT_IcmpInternetMessage) +
+ alen + payload_length - sizeof (struct GNUNET_TUN_IcmpHeader);
+ tnq->len = mlen;
+ iim->header.size = htons ((uint16_t) mlen);
+
+ /* need to tell destination ICMP protocol family! */
+ iim->af = htonl (destination->details.exit_destination.af);
+ switch (destination->details.exit_destination.af)
+ {
+ case AF_INET:
+ ip4dst = (struct in_addr *) &iim[1];
+ *ip4dst = destination->details.exit_destination.ip.v4;
+ payload = &ip4dst[1];
+ break;
+ case AF_INET6:
+ ip6dst = (struct in6_addr *) &iim[1];
+ *ip6dst = destination->details.exit_destination.ip.v6;
+ payload = &ip6dst[1];
+ break;
+ default:
+ GNUNET_assert (0);
+ }
+ memcpy (payload,
+ &icmp[1],
+ payload_length - sizeof (struct GNUNET_TUN_IcmpHeader));
+ }
+ break;
+ default:
+ /* not supported above, how can we get here !? */
+ GNUNET_assert (0);
+ break;
+ }
+ send_to_tunnel (tnq, ts);
+}
+
+
+/**
+ * Receive packets from the helper-process (someone send to the local
+ * virtual tunnel interface). Find the destination mapping, and if it
+ * exists, identify the correct MESH tunnel (or possibly create it)
+ * and forward the packet.
+ *
+ * @param cls closure, NULL
+ * @param client NULL
+ * @param message message we got from the client (VPN tunnel interface)
+ */
+static int
+message_token (void *cls,
+ void *client,
+ const struct GNUNET_MessageHeader *message)
+{
+ const struct GNUNET_TUN_Layer2PacketHeader *tun;
+ size_t mlen;
+ struct GNUNET_HashCode key;
+ struct DestinationEntry *de;
+
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Packets received from TUN interface"),
+ 1, GNUNET_NO);
mlen = ntohs (message->size);
if ( (ntohs (message->type) != GNUNET_MESSAGE_TYPE_VPN_HELPER) ||
- (mlen < sizeof (struct GNUNET_MessageHeader) + sizeof (struct tun_header)) )
+ (mlen < sizeof (struct GNUNET_MessageHeader) + sizeof (struct GNUNET_TUN_Layer2PacketHeader)) )
{
GNUNET_break (0);
- return;
+ return GNUNET_OK;
}
- tun = (const struct tun_header *) &message[1];
- mlen -= (sizeof (struct GNUNET_MessageHeader) + sizeof (struct tun_header));
+ tun = (const struct GNUNET_TUN_Layer2PacketHeader *) &message[1];
+ mlen -= (sizeof (struct GNUNET_MessageHeader) + sizeof (struct GNUNET_TUN_Layer2PacketHeader));
switch (ntohs (tun->proto))
{
case ETH_P_IPV6:
{
- const struct ip6_header *pkt6;
-
- if (mlen < sizeof (struct ip6_header))
+ const struct GNUNET_TUN_IPv6Header *pkt6;
+
+ if (mlen < sizeof (struct GNUNET_TUN_IPv6Header))
{
/* blame kernel */
GNUNET_break (0);
- return;
+ return GNUNET_OK;
}
- pkt6 = (const struct ip6_header *) &tun[1];
+ pkt6 = (const struct GNUNET_TUN_IPv6Header *) &tun[1];
get_destination_key_from_ip (AF_INET6,
&pkt6->destination_address,
&key);
de = GNUNET_CONTAINER_multihashmap_get (destination_map, &key);
- /* FIXME: do we need to guard against hash collision? */
if (NULL == de)
{
char buf[INET6_ADDRSTRLEN];
&pkt6->destination_address,
buf,
sizeof (buf)));
- return;
+ return GNUNET_OK;
}
route_packet (de,
AF_INET6,
pkt6->next_header,
- &pkt6->source_address,
- &pkt6->destination_address,
+ &pkt6->source_address,
+ &pkt6->destination_address,
&pkt6[1],
- mlen - sizeof (struct ip6_header));
+ mlen - sizeof (struct GNUNET_TUN_IPv6Header));
}
break;
case ETH_P_IPV4:
{
- struct ip4_header *pkt4;
+ struct GNUNET_TUN_IPv4Header *pkt4;
- if (mlen < sizeof (struct ip4_header))
+ if (mlen < sizeof (struct GNUNET_TUN_IPv4Header))
{
/* blame kernel */
GNUNET_break (0);
- return;
+ return GNUNET_OK;
}
- pkt4 = (struct ip4_header *) &tun[1];
+ pkt4 = (struct GNUNET_TUN_IPv4Header *) &tun[1];
get_destination_key_from_ip (AF_INET,
&pkt4->destination_address,
&key);
de = GNUNET_CONTAINER_multihashmap_get (destination_map, &key);
- /* FIXME: do we need to guard against hash collision? */
if (NULL == de)
{
char buf[INET_ADDRSTRLEN];
&pkt4->destination_address,
buf,
sizeof (buf)));
- return;
+ return GNUNET_OK;
}
- if (pkt4->header_length * 4 != sizeof (struct ip4_header))
+ if (pkt4->header_length * 4 != sizeof (struct GNUNET_TUN_IPv4Header))
{
GNUNET_log (GNUNET_ERROR_TYPE_INFO,
- _("Received IPv4 packet with options (dropping it)\n"));
- return;
+ _("Received IPv4 packet with options (dropping it)\n"));
+ return GNUNET_OK;
}
route_packet (de,
AF_INET,
pkt4->protocol,
- &pkt4->source_address,
- &pkt4->destination_address,
+ &pkt4->source_address,
+ &pkt4->destination_address,
&pkt4[1],
- mlen - sizeof (struct ip4_header));
+ mlen - sizeof (struct GNUNET_TUN_IPv4Header));
}
break;
default:
(unsigned int) ntohs (tun->proto));
break;
}
+ return GNUNET_OK;
}
/**
- * We got a UDP packet back from the MESH tunnel. Pass it on to the
+ * Synthesize a plausible ICMP payload for an ICMP error
+ * response on the given tunnel.
+ *
+ * @param ts tunnel information
+ * @param ipp IPv4 header to fill in (ICMP payload)
+ * @param udp "UDP" header to fill in (ICMP payload); might actually
+ * also be the first 8 bytes of the TCP header
+ */
+static void
+make_up_icmpv4_payload (struct TunnelState *ts,
+ struct GNUNET_TUN_IPv4Header *ipp,
+ struct GNUNET_TUN_UdpHeader *udp)
+{
+ GNUNET_TUN_initialize_ipv4_header (ipp,
+ ts->protocol,
+ sizeof (struct GNUNET_TUN_TcpHeader),
+ &ts->source_ip.v4,
+ &ts->destination_ip.v4);
+ udp->source_port = htons (ts->source_port);
+ udp->destination_port = htons (ts->destination_port);
+ udp->len = htons (0);
+ udp->crc = htons (0);
+}
+
+
+/**
+ * Synthesize a plausible ICMP payload for an ICMP error
+ * response on the given tunnel.
+ *
+ * @param ts tunnel information
+ * @param ipp IPv6 header to fill in (ICMP payload)
+ * @param udp "UDP" header to fill in (ICMP payload); might actually
+ * also be the first 8 bytes of the TCP header
+ */
+static void
+make_up_icmpv6_payload (struct TunnelState *ts,
+ struct GNUNET_TUN_IPv6Header *ipp,
+ struct GNUNET_TUN_UdpHeader *udp)
+{
+ GNUNET_TUN_initialize_ipv6_header (ipp,
+ ts->protocol,
+ sizeof (struct GNUNET_TUN_TcpHeader),
+ &ts->source_ip.v6,
+ &ts->destination_ip.v6);
+ udp->source_port = htons (ts->source_port);
+ udp->destination_port = htons (ts->destination_port);
+ udp->len = htons (0);
+ udp->crc = htons (0);
+}
+
+
+/**
+ * We got an ICMP packet back from the MESH tunnel. Pass it on to the
* local virtual interface via the helper.
*
* @param cls closure, NULL
* @param tunnel connection to the other end
* @param tunnel_ctx pointer to our 'struct TunnelState *'
- * @param sender who sent the message
* @param message the actual message
- * @param atsi performance data for the connection
- * @return GNUNET_OK to keep the connection open,
- * GNUNET_SYSERR to close it (signal serious error)
- */
+ * @return #GNUNET_OK to keep the connection open,
+ * #GNUNET_SYSERR to close it (signal serious error)
+ */
static int
-receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
- void **tunnel_ctx, const struct GNUNET_PeerIdentity *sender,
- const struct GNUNET_MessageHeader *message,
- const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+receive_icmp_back (void *cls,
+ struct GNUNET_MESH_Tunnel *tunnel,
+ void **tunnel_ctx,
+ const struct GNUNET_MessageHeader *message)
{
- // FIXME: parse message, build IP packet, give to TUN!
-#if 0
- GNUNET_HashCode *desc = (GNUNET_HashCode *) (message + 1);
- struct remote_addr *s = (struct remote_addr *) desc;
- struct udp_pkt *pkt = (struct udp_pkt *) (desc + 1);
- const struct GNUNET_PeerIdentity *other = sender;
struct TunnelState *ts = *tunnel_ctx;
+ const struct GNUNET_EXIT_IcmpToVPNMessage *i2v;
+ size_t mlen;
- if (16 == ts->addrlen)
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMP packets received from mesh"),
+ 1, GNUNET_NO);
+ mlen = ntohs (message->size);
+ if (mlen < sizeof (struct GNUNET_EXIT_IcmpToVPNMessage))
{
- size_t size =
- sizeof (struct ip6_udp) + ntohs (pkt->len) - 1 -
- sizeof (struct udp_pkt);
-
- struct ip6_udp *pkt6 = alloca (size);
-
- GNUNET_assert (pkt6 != NULL);
-
- if (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_SERVICE_UDP_BACK)
- new_ip6addr (&pkt6->ip6_hdr.sadr, &other->hashPubKey, desc);
- else
- new_ip6addr_remote (&pkt6->ip6_hdr.sadr, s->addr, s->addrlen);
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Relaying calc:%d gnu:%d udp:%d bytes!\n", size,
- ntohs (message->size), ntohs (pkt->len));
-
- pkt6->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt6->shdr.size = htons (size);
-
- pkt6->tun.flags = 0;
- pkt6->tun.type = htons (0x86dd);
-
- pkt6->ip6_hdr.version = 6;
- pkt6->ip6_hdr.tclass_h = 0;
- pkt6->ip6_hdr.tclass_l = 0;
- pkt6->ip6_hdr.flowlbl = 0;
- pkt6->ip6_hdr.paylgth = pkt->len;
- pkt6->ip6_hdr.nxthdr = IPPROTO_UDP;
- pkt6->ip6_hdr.hoplmt = 0xff;
-
- {
- char *ipv6addr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV6ADDR",
- &ipv6addr));
- inet_pton (AF_INET6, ipv6addr, &pkt6->ip6_hdr.dadr);
- GNUNET_free (ipv6addr);
- }
- memcpy (&pkt6->udp_hdr, pkt, ntohs (pkt->len));
-
- GNUNET_HashCode *key = address6_mapping_exists (&pkt6->ip6_hdr.sadr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
-
- pkt6->udp_hdr.crc = 0;
- uint32_t sum = 0;
-
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.sadr, 16);
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.dadr, 16);
- uint32_t tmp = (pkt6->udp_hdr.len & 0xffff);
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
- tmp = htons (((pkt6->ip6_hdr.nxthdr & 0x00ff)));
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
-
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->udp_hdr,
- ntohs (pkt->len));
- pkt6->udp_hdr.crc = GNUNET_CRYPTO_crc16_finish (sum);
-
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt6->shdr,
- GNUNET_YES,
- NULL, NULL);
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
}
- else
+ if (NULL == ts->heap_node)
{
- size_t size =
- sizeof (struct ip_udp) + ntohs (pkt->len) - 1 - sizeof (struct udp_pkt);
-
- struct ip_udp *pkt4 = alloca (size);
-
- GNUNET_assert (pkt4 != NULL);
-
- GNUNET_assert (ntohs (message->type) ==
- GNUNET_MESSAGE_TYPE_VPN_REMOTE_UDP_BACK);
- uint32_t sadr;
-
- new_ip4addr_remote ((unsigned char *) &sadr, s->addr, s->addrlen);
- pkt4->ip_hdr.sadr.s_addr = sadr;
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ if (AF_UNSPEC == ts->af)
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ i2v = (const struct GNUNET_EXIT_IcmpToVPNMessage *) message;
+ mlen -= sizeof (struct GNUNET_EXIT_IcmpToVPNMessage);
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Relaying calc:%d gnu:%d udp:%d bytes!\n", size,
- ntohs (message->size), ntohs (pkt->len));
-
- pkt4->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt4->shdr.size = htons (size);
-
- pkt4->tun.flags = 0;
- pkt4->tun.type = htons (0x0800);
-
- pkt4->ip_hdr.version = 4;
- pkt4->ip_hdr.hdr_lngth = 5;
- pkt4->ip_hdr.diff_serv = 0;
- pkt4->ip_hdr.tot_lngth = htons (20 + ntohs (pkt->len));
- pkt4->ip_hdr.ident = 0;
- pkt4->ip_hdr.flags = 0;
- pkt4->ip_hdr.frag_off = 0;
- pkt4->ip_hdr.ttl = 255;
- pkt4->ip_hdr.proto = IPPROTO_UDP;
- pkt4->ip_hdr.chks = 0; /* Will be calculated later */
-
+ "Received ICMP packet from mesh, sending %u bytes from %s -> %s via TUN\n",
+ (unsigned int) mlen,
+ inet_ntop (ts->af, &ts->destination_ip, sbuf, sizeof (sbuf)),
+ inet_ntop (ts->af, &ts->source_ip, dbuf, sizeof (dbuf)));
+ }
+ switch (ts->af)
+ {
+ case AF_INET:
+ {
+ size_t size = sizeof (struct GNUNET_TUN_IPv4Header)
+ + sizeof (struct GNUNET_TUN_IcmpHeader)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
+ mlen;
+ {
+ /* reserve some extra space in case we have an ICMP type here where
+ we will need to make up the payload ourselves */
+ char buf[size + sizeof (struct GNUNET_TUN_IPv4Header) + 8] GNUNET_ALIGN;
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct GNUNET_TUN_Layer2PacketHeader *tun = (struct GNUNET_TUN_Layer2PacketHeader*) &msg[1];
+ struct GNUNET_TUN_IPv4Header *ipv4 = (struct GNUNET_TUN_IPv4Header *) &tun[1];
+ struct GNUNET_TUN_IcmpHeader *icmp = (struct GNUNET_TUN_IcmpHeader *) &ipv4[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV4);
+ GNUNET_TUN_initialize_ipv4_header (ipv4,
+ IPPROTO_ICMP,
+ sizeof (struct GNUNET_TUN_IcmpHeader) + mlen,
+ &ts->destination_ip.v4,
+ &ts->source_ip.v4);
+ *icmp = i2v->icmp_header;
+ memcpy (&icmp[1],
+ &i2v[1],
+ mlen);
+ /* For some ICMP types, we need to adjust (make up) the payload here.
+ Also, depending on the AF used on the other side, we have to
+ do ICMP PT (translate ICMP types) */
+ switch (ntohl (i2v->af))
+ {
+ case AF_INET:
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
+ case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
+ break;
+ case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
+ case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
+ case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
+ {
+ struct GNUNET_TUN_IPv4Header *ipp = (struct GNUNET_TUN_IPv4Header *) &icmp[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
+
+ if (mlen != 0)
+ {
+ /* sender did not strip ICMP payload? */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ size += sizeof (struct GNUNET_TUN_IPv4Header) + 8;
+ GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+ make_up_icmpv4_payload (ts, ipp, udp);
+ }
+ break;
+ default:
+ GNUNET_break_op (0);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv4 packets dropped (type not allowed)"),
+ 1, GNUNET_NO);
+ return GNUNET_SYSERR;
+ }
+ /* end AF_INET */
+ break;
+ case AF_INET6:
+ /* ICMP PT 6-to-4 and possibly making up payloads */
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
+ icmp->type = GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE;
+ {
+ struct GNUNET_TUN_IPv4Header *ipp = (struct GNUNET_TUN_IPv4Header *) &icmp[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
+
+ if (mlen != 0)
+ {
+ /* sender did not strip ICMP payload? */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ size += sizeof (struct GNUNET_TUN_IPv4Header) + 8;
+ GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+ make_up_icmpv4_payload (ts, ipp, udp);
+ }
+ break;
+ case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
+ icmp->type = GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED;
+ {
+ struct GNUNET_TUN_IPv4Header *ipp = (struct GNUNET_TUN_IPv4Header *) &icmp[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
+
+ if (mlen != 0)
+ {
+ /* sender did not strip ICMP payload? */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ size += sizeof (struct GNUNET_TUN_IPv4Header) + 8;
+ GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+ make_up_icmpv4_payload (ts, ipp, udp);
+ }
+ break;
+ case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
+ case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (impossible PT to v4)"),
+ 1, GNUNET_NO);
+ return GNUNET_OK;
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
+ icmp->type = GNUNET_TUN_ICMPTYPE_ECHO_REQUEST;
+ break;
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
+ icmp->type = GNUNET_TUN_ICMPTYPE_ECHO_REPLY;
+ break;
+ default:
+ GNUNET_break_op (0);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (type not allowed)"),
+ 1, GNUNET_NO);
+ return GNUNET_SYSERR;
+ }
+ /* end AF_INET6 */
+ break;
+ default:
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ msg->size = htons (size);
+ GNUNET_TUN_calculate_icmp_checksum (icmp,
+ &i2v[1],
+ mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
+ }
+ break;
+ case AF_INET6:
{
- char *ipv4addr;
- uint32_t dadr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV4ADDR",
- &ipv4addr));
- inet_pton (AF_INET, ipv4addr, &dadr);
- GNUNET_free (ipv4addr);
- pkt4->ip_hdr.dadr.s_addr = dadr;
+ size_t size = sizeof (struct GNUNET_TUN_IPv6Header)
+ + sizeof (struct GNUNET_TUN_IcmpHeader)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
+ mlen;
+ {
+ char buf[size + sizeof (struct GNUNET_TUN_IPv6Header) + 8] GNUNET_ALIGN;
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct GNUNET_TUN_Layer2PacketHeader *tun = (struct GNUNET_TUN_Layer2PacketHeader*) &msg[1];
+ struct GNUNET_TUN_IPv6Header *ipv6 = (struct GNUNET_TUN_IPv6Header *) &tun[1];
+ struct GNUNET_TUN_IcmpHeader *icmp = (struct GNUNET_TUN_IcmpHeader *) &ipv6[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV6);
+ GNUNET_TUN_initialize_ipv6_header (ipv6,
+ IPPROTO_ICMPV6,
+ sizeof (struct GNUNET_TUN_IcmpHeader) + mlen,
+ &ts->destination_ip.v6,
+ &ts->source_ip.v6);
+ *icmp = i2v->icmp_header;
+ memcpy (&icmp[1],
+ &i2v[1],
+ mlen);
+
+ /* For some ICMP types, we need to adjust (make up) the payload here.
+ Also, depending on the AF used on the other side, we have to
+ do ICMP PT (translate ICMP types) */
+ switch (ntohl (i2v->af))
+ {
+ case AF_INET:
+ /* ICMP PT 4-to-6 and possibly making up payloads */
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
+ icmp->type = GNUNET_TUN_ICMPTYPE6_ECHO_REPLY;
+ break;
+ case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
+ icmp->type = GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST;
+ break;
+ case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
+ icmp->type = GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE;
+ {
+ struct GNUNET_TUN_IPv6Header *ipp = (struct GNUNET_TUN_IPv6Header *) &icmp[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
+
+ if (mlen != 0)
+ {
+ /* sender did not strip ICMP payload? */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ size += sizeof (struct GNUNET_TUN_IPv6Header) + 8;
+ GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+ make_up_icmpv6_payload (ts, ipp, udp);
+ }
+ break;
+ case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
+ icmp->type = GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED;
+ {
+ struct GNUNET_TUN_IPv6Header *ipp = (struct GNUNET_TUN_IPv6Header *) &icmp[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
+
+ if (mlen != 0)
+ {
+ /* sender did not strip ICMP payload? */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ size += sizeof (struct GNUNET_TUN_IPv6Header) + 8;
+ GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+ make_up_icmpv6_payload (ts, ipp, udp);
+ }
+ break;
+ case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv4 packets dropped (impossible PT to v6)"),
+ 1, GNUNET_NO);
+ return GNUNET_OK;
+ default:
+ GNUNET_break_op (0);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv4 packets dropped (type not allowed)"),
+ 1, GNUNET_NO);
+ return GNUNET_SYSERR;
+ }
+ /* end AF_INET */
+ break;
+ case AF_INET6:
+ switch (icmp->type)
+ {
+ case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
+ case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
+ case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
+ case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
+ {
+ struct GNUNET_TUN_IPv6Header *ipp = (struct GNUNET_TUN_IPv6Header *) &icmp[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipp[1];
+
+ if (mlen != 0)
+ {
+ /* sender did not strip ICMP payload? */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ size += sizeof (struct GNUNET_TUN_IPv6Header) + 8;
+ GNUNET_assert (8 == sizeof (struct GNUNET_TUN_UdpHeader));
+ make_up_icmpv6_payload (ts, ipp, udp);
+ }
+ break;
+ case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
+ break;
+ default:
+ GNUNET_break_op (0);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# ICMPv6 packets dropped (type not allowed)"),
+ 1, GNUNET_NO);
+ return GNUNET_SYSERR;
+ }
+ /* end AF_INET6 */
+ break;
+ default:
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ msg->size = htons (size);
+ GNUNET_TUN_calculate_icmp_checksum (icmp,
+ &i2v[1], mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
}
- memcpy (&pkt4->udp_hdr, pkt, ntohs (pkt->len));
-
- GNUNET_HashCode *key = address4_mapping_exists (pkt4->ip_hdr.sadr.s_addr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
-
- pkt4->udp_hdr.crc = 0; /* Optional for IPv4 */
-
- pkt4->ip_hdr.chks =
- GNUNET_CRYPTO_crc16_n ((uint16_t *) & pkt4->ip_hdr, 5 * 4);
-
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt4->shdr,
- GNUNET_YES,
- NULL, NULL);
+ break;
+ default:
+ GNUNET_assert (0);
}
-#endif
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value_us);
return GNUNET_OK;
}
/**
- * We got a TCP packet back from the MESH tunnel. Pass it on to the
+ * We got a UDP packet back from the MESH tunnel. Pass it on to the
* local virtual interface via the helper.
*
* @param cls closure, NULL
* @param tunnel connection to the other end
* @param tunnel_ctx pointer to our 'struct TunnelState *'
- * @param sender who sent the message
* @param message the actual message
- * @param atsi performance data for the connection
- * @return GNUNET_OK to keep the connection open,
- * GNUNET_SYSERR to close it (signal serious error)
- */
+ * @return #GNUNET_OK to keep the connection open,
+ * #GNUNET_SYSERR to close it (signal serious error)
+ */
static int
-receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
+receive_udp_back (void *cls,
+ struct GNUNET_MESH_Tunnel *tunnel,
void **tunnel_ctx,
- const struct GNUNET_PeerIdentity *sender GNUNET_UNUSED,
- const struct GNUNET_MessageHeader *message,
- const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+ const struct GNUNET_MessageHeader *message)
{
- // FIXME: parse message, build IP packet, give to TUN!
-#if 0
- GNUNET_HashCode *desc = (GNUNET_HashCode *) (message + 1);
- struct remote_addr *s = (struct remote_addr *) desc;
- struct tcp_pkt *pkt = (struct tcp_pkt *) (desc + 1);
- const struct GNUNET_PeerIdentity *other = sender;
struct TunnelState *ts = *tunnel_ctx;
+ const struct GNUNET_EXIT_UdpReplyMessage *reply;
+ size_t mlen;
- size_t pktlen =
- ntohs (message->size) - sizeof (struct GNUNET_MessageHeader) -
- sizeof (GNUNET_HashCode);
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Received TCP-Packet back, addrlen = %d\n", s->addrlen);
-
- if (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_SERVICE_TCP_BACK ||
- ts->addrlen == 16)
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# UDP packets received from mesh"),
+ 1, GNUNET_NO);
+ mlen = ntohs (message->size);
+ if (mlen < sizeof (struct GNUNET_EXIT_UdpReplyMessage))
{
- size_t size = pktlen + sizeof (struct ip6_tcp) - 1;
-
- struct ip6_tcp *pkt6 = alloca (size);
-
- memset (pkt6, 0, size);
-
- GNUNET_assert (pkt6 != NULL);
-
- if (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_SERVICE_TCP_BACK)
- new_ip6addr (&pkt6->ip6_hdr.sadr, &other->hashPubKey, desc);
- else
- new_ip6addr_remote (&pkt6->ip6_hdr.sadr, s->addr, s->addrlen);
-
- pkt6->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt6->shdr.size = htons (size);
-
- pkt6->tun.flags = 0;
- pkt6->tun.type = htons (0x86dd);
-
- pkt6->ip6_hdr.version = 6;
- pkt6->ip6_hdr.tclass_h = 0;
- pkt6->ip6_hdr.tclass_l = 0;
- pkt6->ip6_hdr.flowlbl = 0;
- pkt6->ip6_hdr.paylgth = htons (pktlen);
- pkt6->ip6_hdr.nxthdr = IPPROTO_TCP;
- pkt6->ip6_hdr.hoplmt = 0xff;
-
- {
- char *ipv6addr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV6ADDR",
- &ipv6addr));
- inet_pton (AF_INET6, ipv6addr, &pkt6->ip6_hdr.dadr);
- GNUNET_free (ipv6addr);
- }
- memcpy (&pkt6->tcp_hdr, pkt, pktlen);
-
- GNUNET_HashCode *key = address6_mapping_exists (&pkt6->ip6_hdr.sadr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
-
- pkt6->tcp_hdr.crc = 0;
- uint32_t sum = 0;
- uint32_t tmp;
-
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.sadr, 16);
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.dadr, 16);
- tmp = htonl (pktlen);
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
- tmp = htonl (((pkt6->ip6_hdr.nxthdr & 0x000000ff)));
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
-
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->tcp_hdr,
- ntohs (pkt6->ip6_hdr.paylgth));
- pkt6->tcp_hdr.crc = GNUNET_CRYPTO_crc16_finish (sum);
-
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt6->shdr,
- GNUNET_YES,
- NULL, NULL);
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
}
- else
+ if (NULL == ts->heap_node)
{
- size_t size = pktlen + sizeof (struct ip_tcp) - 1;
-
- struct ip_tcp *pkt4 = alloca (size);
-
- GNUNET_assert (pkt4 != NULL);
- memset (pkt4, 0, size);
-
- GNUNET_assert (ntohs (message->type) ==
- GNUNET_MESSAGE_TYPE_VPN_REMOTE_TCP_BACK);
- uint32_t sadr;
-
- new_ip4addr_remote ((unsigned char *) &sadr, s->addr, s->addrlen);
- pkt4->ip_hdr.sadr.s_addr = sadr;
-
- pkt4->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt4->shdr.size = htons (size);
-
- pkt4->tun.flags = 0;
- pkt4->tun.type = htons (0x0800);
-
- pkt4->ip_hdr.version = 4;
- pkt4->ip_hdr.hdr_lngth = 5;
- pkt4->ip_hdr.diff_serv = 0;
- pkt4->ip_hdr.tot_lngth = htons (20 + pktlen);
- pkt4->ip_hdr.ident = 0;
- pkt4->ip_hdr.flags = 0;
- pkt4->ip_hdr.frag_off = 0;
- pkt4->ip_hdr.ttl = 255;
- pkt4->ip_hdr.proto = IPPROTO_TCP;
- pkt4->ip_hdr.chks = 0; /* Will be calculated later */
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ if (AF_UNSPEC == ts->af)
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ reply = (const struct GNUNET_EXIT_UdpReplyMessage *) message;
+ mlen -= sizeof (struct GNUNET_EXIT_UdpReplyMessage);
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Received UDP reply from mesh, sending %u bytes from %s:%u -> %s:%u via TUN\n",
+ (unsigned int) mlen,
+ inet_ntop (ts->af, &ts->destination_ip, sbuf, sizeof (sbuf)),
+ ts->destination_port,
+ inet_ntop (ts->af, &ts->source_ip, dbuf, sizeof (dbuf)),
+ ts->source_port);
+ }
+ switch (ts->af)
+ {
+ case AF_INET:
{
- char *ipv4addr;
- uint32_t dadr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV4ADDR",
- &ipv4addr));
- inet_pton (AF_INET, ipv4addr, &dadr);
- GNUNET_free (ipv4addr);
- pkt4->ip_hdr.dadr.s_addr = dadr;
+ size_t size = sizeof (struct GNUNET_TUN_IPv4Header)
+ + sizeof (struct GNUNET_TUN_UdpHeader)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
+ mlen;
+ {
+ char buf[size] GNUNET_ALIGN;
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct GNUNET_TUN_Layer2PacketHeader *tun = (struct GNUNET_TUN_Layer2PacketHeader*) &msg[1];
+ struct GNUNET_TUN_IPv4Header *ipv4 = (struct GNUNET_TUN_IPv4Header *) &tun[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipv4[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV4);
+ GNUNET_TUN_initialize_ipv4_header (ipv4,
+ IPPROTO_UDP,
+ sizeof (struct GNUNET_TUN_UdpHeader) + mlen,
+ &ts->destination_ip.v4,
+ &ts->source_ip.v4);
+ if (0 == ntohs (reply->source_port))
+ udp->source_port = htons (ts->destination_port);
+ else
+ udp->source_port = reply->source_port;
+ if (0 == ntohs (reply->destination_port))
+ udp->destination_port = htons (ts->source_port);
+ else
+ udp->destination_port = reply->destination_port;
+ udp->len = htons (mlen + sizeof (struct GNUNET_TUN_UdpHeader));
+ GNUNET_TUN_calculate_udp4_checksum (ipv4,
+ udp,
+ &reply[1],
+ mlen);
+ memcpy (&udp[1],
+ &reply[1],
+ mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
}
+ break;
+ case AF_INET6:
+ {
+ size_t size = sizeof (struct GNUNET_TUN_IPv6Header)
+ + sizeof (struct GNUNET_TUN_UdpHeader)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
+ mlen;
+ {
+ char buf[size] GNUNET_ALIGN;
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct GNUNET_TUN_Layer2PacketHeader *tun = (struct GNUNET_TUN_Layer2PacketHeader*) &msg[1];
+ struct GNUNET_TUN_IPv6Header *ipv6 = (struct GNUNET_TUN_IPv6Header *) &tun[1];
+ struct GNUNET_TUN_UdpHeader *udp = (struct GNUNET_TUN_UdpHeader *) &ipv6[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV6);
+ GNUNET_TUN_initialize_ipv6_header (ipv6,
+ IPPROTO_UDP,
+ sizeof (struct GNUNET_TUN_UdpHeader) + mlen,
+ &ts->destination_ip.v6,
+ &ts->source_ip.v6);
+ if (0 == ntohs (reply->source_port))
+ udp->source_port = htons (ts->destination_port);
+ else
+ udp->source_port = reply->source_port;
+ if (0 == ntohs (reply->destination_port))
+ udp->destination_port = htons (ts->source_port);
+ else
+ udp->destination_port = reply->destination_port;
+ udp->len = htons (mlen + sizeof (struct GNUNET_TUN_UdpHeader));
+ GNUNET_TUN_calculate_udp6_checksum (ipv6,
+ udp,
+ &reply[1], mlen);
+ memcpy (&udp[1],
+ &reply[1],
+ mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
+ }
+ break;
+ default:
+ GNUNET_assert (0);
+ }
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value_us);
+ return GNUNET_OK;
+}
- memcpy (&pkt4->tcp_hdr, pkt, pktlen);
-
- GNUNET_HashCode *key = address4_mapping_exists (pkt4->ip_hdr.sadr.s_addr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
- pkt4->tcp_hdr.crc = 0;
- uint32_t sum = 0;
- uint32_t tmp;
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) &pkt4->ip_hdr.sadr, 4);
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) &pkt4->ip_hdr.dadr, 4);
-
- tmp = (0x06 << 16) | (0xffff & pktlen); // 0x06 for TCP?
-
- tmp = htonl (tmp);
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt4->tcp_hdr, pktlen);
- pkt4->tcp_hdr.crc = GNUNET_CRYPTO_crc16_finish (sum);
- pkt4->ip_hdr.chks =
- GNUNET_CRYPTO_crc16_n ((uint16_t *) & pkt4->ip_hdr, 5 * 4);
+/**
+ * We got a TCP packet back from the MESH tunnel. Pass it on to the
+ * local virtual interface via the helper.
+ *
+ * @param cls closure, NULL
+ * @param tunnel connection to the other end
+ * @param tunnel_ctx pointer to our `struct TunnelState *`
+ * @param message the actual message
+ * @return #GNUNET_OK to keep the connection open,
+ * #GNUNET_SYSERR to close it (signal serious error)
+ */
+static int
+receive_tcp_back (void *cls,
+ struct GNUNET_MESH_Tunnel *tunnel,
+ void **tunnel_ctx,
+ const struct GNUNET_MessageHeader *message)
+{
+ struct TunnelState *ts = *tunnel_ctx;
+ const struct GNUNET_EXIT_TcpDataMessage *data;
+ size_t mlen;
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt4->shdr,
- GNUNET_YES,
- NULL, NULL);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# TCP packets received from mesh"),
+ 1, GNUNET_NO);
+ mlen = ntohs (message->size);
+ if (mlen < sizeof (struct GNUNET_EXIT_TcpDataMessage))
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ if (NULL == ts->heap_node)
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ data = (const struct GNUNET_EXIT_TcpDataMessage *) message;
+ mlen -= sizeof (struct GNUNET_EXIT_TcpDataMessage);
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Received TCP reply from mesh, sending %u bytes from %s:%u -> %s:%u via TUN\n",
+ (unsigned int) mlen,
+ inet_ntop (ts->af, &ts->destination_ip, sbuf, sizeof (sbuf)),
+ ts->destination_port,
+ inet_ntop (ts->af, &ts->source_ip, dbuf, sizeof (dbuf)),
+ ts->source_port);
+ }
+ if (data->tcp_header.off * 4 < sizeof (struct GNUNET_TUN_TcpHeader))
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ switch (ts->af)
+ {
+ case AF_INET:
+ {
+ size_t size = sizeof (struct GNUNET_TUN_IPv4Header)
+ + sizeof (struct GNUNET_TUN_TcpHeader)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
+ mlen;
+ {
+ char buf[size] GNUNET_ALIGN;
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct GNUNET_TUN_Layer2PacketHeader *tun = (struct GNUNET_TUN_Layer2PacketHeader*) &msg[1];
+ struct GNUNET_TUN_IPv4Header *ipv4 = (struct GNUNET_TUN_IPv4Header *) &tun[1];
+ struct GNUNET_TUN_TcpHeader *tcp = (struct GNUNET_TUN_TcpHeader *) &ipv4[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV4);
+ GNUNET_TUN_initialize_ipv4_header (ipv4,
+ IPPROTO_TCP,
+ sizeof (struct GNUNET_TUN_TcpHeader) + mlen,
+ &ts->destination_ip.v4,
+ &ts->source_ip.v4);
+ *tcp = data->tcp_header;
+ tcp->source_port = htons (ts->destination_port);
+ tcp->destination_port = htons (ts->source_port);
+ GNUNET_TUN_calculate_tcp4_checksum (ipv4,
+ tcp,
+ &data[1],
+ mlen);
+ memcpy (&tcp[1],
+ &data[1],
+ mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
+ }
+ break;
+ case AF_INET6:
+ {
+ size_t size = sizeof (struct GNUNET_TUN_IPv6Header)
+ + sizeof (struct GNUNET_TUN_TcpHeader)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct GNUNET_TUN_Layer2PacketHeader) +
+ mlen;
+ {
+ char buf[size] GNUNET_ALIGN;
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct GNUNET_TUN_Layer2PacketHeader *tun = (struct GNUNET_TUN_Layer2PacketHeader*) &msg[1];
+ struct GNUNET_TUN_IPv6Header *ipv6 = (struct GNUNET_TUN_IPv6Header *) &tun[1];
+ struct GNUNET_TUN_TcpHeader *tcp = (struct GNUNET_TUN_TcpHeader *) &ipv6[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV6);
+ GNUNET_TUN_initialize_ipv6_header (ipv6,
+ IPPROTO_TCP,
+ sizeof (struct GNUNET_TUN_TcpHeader) + mlen,
+ &ts->destination_ip.v6,
+ &ts->source_ip.v6);
+ *tcp = data->tcp_header;
+ tcp->source_port = htons (ts->destination_port);
+ tcp->destination_port = htons (ts->source_port);
+ GNUNET_TUN_calculate_tcp6_checksum (ipv6,
+ tcp,
+ &data[1],
+ mlen);
+ memcpy (&tcp[1],
+ &data[1],
+ mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
+ }
+ break;
}
-#endif
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value_us);
return GNUNET_OK;
}
* for a new redirection.
*
* @param v4 where to store the address
- * @return GNUNET_OK on success,
- * GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success,
+ * #GNUNET_SYSERR on error
*/
static int
allocate_v4_address (struct in_addr *v4)
struct in_addr addr;
struct in_addr mask;
struct in_addr rnd;
- GNUNET_HashCode key;
+ struct GNUNET_HashCode key;
unsigned int tries;
GNUNET_assert (1 == inet_pton (AF_INET, ipv4addr, &addr));
- GNUNET_assert (1 == inet_pton (AF_INET, ipv4mask, &mask));
- /* Given 192.168.0.1/255.255.0.0, we want a mask
+ GNUNET_assert (1 == inet_pton (AF_INET, ipv4mask, &mask));
+ /* Given 192.168.0.1/255.255.0.0, we want a mask
of '192.168.255.255', thus: */
- mask.s_addr = addr.s_addr | ~mask.s_addr;
+ mask.s_addr = addr.s_addr | ~mask.s_addr;
tries = 0;
do
{
return GNUNET_SYSERR;
}
/* Pick random IPv4 address within the subnet, except 'addr' or 'mask' itself */
- rnd.s_addr = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+ rnd.s_addr = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
UINT32_MAX);
- v4->s_addr = (addr.s_addr | rnd.s_addr) & mask.s_addr;
+ v4->s_addr = (addr.s_addr | rnd.s_addr) & mask.s_addr;
get_destination_key_from_ip (AF_INET,
v4,
&key);
* for a new redirection.
*
* @param v6 where to store the address
- * @return GNUNET_OK on success,
- * GNUNET_SYSERR on error
+ * @return #GNUNET_OK on success,
+ * #GNUNET_SYSERR on error
*/
static int
allocate_v6_address (struct in6_addr *v6)
struct in6_addr mask;
struct in6_addr rnd;
int i;
- GNUNET_HashCode key;
+ struct GNUNET_HashCode key;
unsigned int tries;
GNUNET_assert (1 == inet_pton (AF_INET6, ipv6addr, &addr));
/* Given ABCD::/96, we want a mask of 'ABCD::FFFF:FFFF,
thus: */
mask = addr;
- for (i=127;i>=128-ipv6prefix;i--)
+ for (i=127;i>=ipv6prefix;i--)
mask.s6_addr[i / 8] |= (1 << (i % 8));
-
+
/* Pick random IPv6 address within the subnet, except 'addr' or 'mask' itself */
tries = 0;
do
}
for (i=0;i<16;i++)
{
- rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+ rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
256);
v6->s6_addr[i]
= (addr.s6_addr[i] | rnd.s6_addr[i]) & mask.s6_addr[i];
/**
- * A client asks us to setup a redirection via some exit
- * node to a particular IP. Setup the redirection and
- * give the client the allocated IP.
+ * Free resources occupied by a destination entry.
+ *
+ * @param de entry to free
+ */
+static void
+free_destination_entry (struct DestinationEntry *de)
+{
+ struct DestinationTunnel *dt;
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Cleaning up destination entry\n");
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active destinations"),
+ -1, GNUNET_NO);
+ while (NULL != (dt = de->dt_head))
+ {
+ if (NULL != dt->ts)
+ {
+ free_tunnel_state (dt->ts);
+ GNUNET_assert (NULL == dt->ts);
+ }
+ GNUNET_CONTAINER_DLL_remove (de->dt_head,
+ de->dt_tail,
+ dt);
+ GNUNET_free (dt);
+ }
+ if (NULL != de->heap_node)
+ {
+ GNUNET_CONTAINER_heap_remove_node (de->heap_node);
+ de->heap_node = NULL;
+ GNUNET_assert (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_remove (destination_map,
+ &de->key,
+ de));
+ }
+ GNUNET_free (de);
+}
+
+
+/**
+ * We have too many active destinations. Clean up the oldest destination.
+ *
+ * @param except destination that must NOT be cleaned up, even if it is the oldest
+ */
+static void
+expire_destination (struct DestinationEntry *except)
+{
+ struct DestinationEntry *de;
+
+ de = GNUNET_CONTAINER_heap_peek (destination_heap);
+ GNUNET_assert (NULL != de);
+ if (except == de)
+ return; /* can't do this */
+ free_destination_entry (de);
+}
+
+
+/**
+ * Allocate an IP address for the response.
+ *
+ * @param result_af desired address family; set to the actual
+ * address family; can initially be AF_UNSPEC if there
+ * is no preference; will be set to AF_UNSPEC if the
+ * allocation failed
+ * @param addr set to either v4 or v6 depending on which
+ * storage location was used; set to NULL if allocation failed
+ * @param v4 storage space for an IPv4 address
+ * @param v6 storage space for an IPv6 address
+ * @return #GNUNET_OK normally, #GNUNET_SYSERR if `* result_af` was
+ * an unsupported address family (not AF_INET, AF_INET6 or AF_UNSPEC)
+ */
+static int
+allocate_response_ip (int *result_af,
+ void **addr,
+ struct in_addr *v4,
+ struct in6_addr *v6)
+{
+ *addr = NULL;
+ switch (*result_af)
+ {
+ case AF_INET:
+ if (GNUNET_OK !=
+ allocate_v4_address (v4))
+ *result_af = AF_UNSPEC;
+ else
+ *addr = v4;
+ break;
+ case AF_INET6:
+ if (GNUNET_OK !=
+ allocate_v6_address (v6))
+ *result_af = AF_UNSPEC;
+ else
+ *addr = v6;
+ break;
+ case AF_UNSPEC:
+ if (GNUNET_OK ==
+ allocate_v4_address (v4))
+ {
+ *addr = v4;
+ *result_af = AF_INET;
+ }
+ else if (GNUNET_OK ==
+ allocate_v6_address (v6))
+ {
+ *addr = v6;
+ *result_af = AF_INET6;
+ }
+ break;
+ default:
+ GNUNET_break (0);
+ return GNUNET_SYSERR;
+ }
+ return GNUNET_OK;
+}
+
+
+/**
+ * A client asks us to setup a redirection via some exit node to a
+ * particular IP. Setup the redirection and give the client the
+ * allocated IP.
*
* @param cls unused
* @param client requesting client
- * @param message redirection request (a 'struct RedirectToIpRequestMessage')
+ * @param message redirection request (a `struct RedirectToIpRequestMessage`)
*/
static void
-service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
+service_redirect_to_ip (void *cls,
+ struct GNUNET_SERVER_Client *client,
const struct GNUNET_MessageHeader *message)
{
size_t mlen;
struct in6_addr v6;
void *addr;
struct DestinationEntry *de;
- GNUNET_HashCode key;
- struct TunnelState *ts;
- GNUNET_MESH_ApplicationType app_type;
-
+ struct GNUNET_HashCode key;
+
/* validate and parse request */
mlen = ntohs (message->size);
if (mlen < sizeof (struct RedirectToIpRequestMessage))
{
GNUNET_break (0);
GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
- return;
+ return;
}
- app_type = GNUNET_APPLICATION_TYPE_IPV4_GATEWAY;
break;
case AF_INET6:
if (alen != sizeof (struct in6_addr))
{
GNUNET_break (0);
GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
- return;
+ return;
}
- app_type = GNUNET_APPLICATION_TYPE_IPV6_GATEWAY;
break;
default:
GNUNET_break (0);
GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
- return;
+ return;
}
/* allocate response IP */
- addr = NULL;
result_af = (int) htonl (msg->result_af);
- switch (result_af)
+ if (GNUNET_OK != allocate_response_ip (&result_af,
+ &addr,
+ &v4, &v6))
{
- case AF_INET:
- if (GNUNET_OK !=
- allocate_v4_address (&v4))
- result_af = AF_UNSPEC;
- else
- addr = &v4;
- break;
- case AF_INET6:
- if (GNUNET_OK !=
- allocate_v6_address (&v6))
- result_af = AF_UNSPEC;
- else
- addr = &v6;
- break;
- case AF_UNSPEC:
- if (GNUNET_OK ==
- allocate_v4_address (&v4))
- {
- addr = &v4;
- result_af = AF_INET;
- }
- else if (GNUNET_OK ==
- allocate_v6_address (&v6))
- {
- addr = &v6;
- result_af = AF_INET6;
- }
- break;
- default:
- GNUNET_break (0);
GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
- return;
- }
- if ( (result_af == AF_UNSPEC) ||
- (GNUNET_NO == ntohl (msg->nac)) )
- {
- /* send reply "instantly" */
- send_client_reply (client,
- msg->request_id,
- result_af,
- addr);
+ return;
}
+ /* send reply with our IP address */
+ send_client_reply (client,
+ msg->request_id,
+ result_af,
+ addr);
if (result_af == AF_UNSPEC)
{
/* failure, we're done */
GNUNET_SERVER_receive_done (client, GNUNET_OK);
return;
}
-
+
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Allocated address %s for redirection via exit to %s\n",
+ inet_ntop (result_af, addr, sbuf, sizeof (sbuf)),
+ inet_ntop (addr_af,
+ &msg[1], dbuf, sizeof (dbuf)));
+ }
+
/* setup destination record */
- de = GNUNET_malloc (sizeof (struct DestinationEntry));
+ de = GNUNET_new (struct DestinationEntry);
de->is_service = GNUNET_NO;
de->details.exit_destination.af = addr_af;
memcpy (&de->details.exit_destination.ip,
get_destination_key_from_ip (result_af,
addr,
&key);
+ de->key = key;
GNUNET_assert (GNUNET_OK ==
GNUNET_CONTAINER_multihashmap_put (destination_map,
&key,
GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
de->heap_node = GNUNET_CONTAINER_heap_insert (destination_heap,
de,
- GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value);
- /* setup tunnel to destination */
- ts = GNUNET_malloc (sizeof (struct TunnelState));
- if (GNUNET_NO != ntohl (msg->nac))
- {
- ts->request_id = msg->request_id;
- ts->client = client;
- GNUNET_SERVER_client_keep (client);
- }
- ts->destination = *de;
- ts->destination.heap_node = NULL;
- ts->is_service = GNUNET_NO;
- ts->af = result_af;
- if (result_af == AF_INET)
- ts->destination_ip.v4 = v4;
- else
- ts->destination_ip.v6 = v6;
- de->tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
- ts,
- &tunnel_peer_connect_handler,
- &tunnel_peer_disconnect_handler,
- ts);
- GNUNET_MESH_peer_request_connect_by_type (de->tunnel,
- app_type);
- /* we're done */
+ GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value_us);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active destinations"),
+ 1, GNUNET_NO);
+ while (GNUNET_CONTAINER_multihashmap_size (destination_map) > max_destination_mappings)
+ expire_destination (de);
GNUNET_SERVER_receive_done (client, GNUNET_OK);
}
*
* @param cls unused
* @param client requesting client
- * @param message redirection request (a 'struct RedirectToPeerRequestMessage')
+ * @param message redirection request (a `struct RedirectToPeerRequestMessage`)
*/
static void
-service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
+service_redirect_to_service (void *cls,
+ struct GNUNET_SERVER_Client *client,
const struct GNUNET_MessageHeader *message)
{
const struct RedirectToServiceRequestMessage *msg;
struct in6_addr v6;
void *addr;
struct DestinationEntry *de;
- GNUNET_HashCode key;
+ struct GNUNET_HashCode key;
struct TunnelState *ts;
-
+ struct DestinationTunnel *dt;
+
/* parse request */
msg = (const struct RedirectToServiceRequestMessage *) message;
/* allocate response IP */
- addr = NULL;
result_af = (int) htonl (msg->result_af);
- switch (result_af)
+ if (GNUNET_OK != allocate_response_ip (&result_af,
+ &addr,
+ &v4, &v6))
{
- case AF_INET:
- if (GNUNET_OK !=
- allocate_v4_address (&v4))
- result_af = AF_UNSPEC;
- else
- addr = &v4;
- break;
- case AF_INET6:
- if (GNUNET_OK !=
- allocate_v6_address (&v6))
- result_af = AF_UNSPEC;
- else
- addr = &v6;
- break;
- case AF_UNSPEC:
- if (GNUNET_OK ==
- allocate_v4_address (&v4))
- {
- addr = &v4;
- result_af = AF_INET;
- }
- else if (GNUNET_OK ==
- allocate_v6_address (&v6))
- {
- addr = &v6;
- result_af = AF_INET6;
- }
- break;
- default:
- GNUNET_break (0);
GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
- return;
- }
- if ( (result_af == AF_UNSPEC) ||
- (GNUNET_NO == ntohl (msg->nac)) )
- {
- /* send reply "instantly" */
- send_client_reply (client,
- msg->request_id,
- result_af,
- addr);
+ return;
}
+ send_client_reply (client,
+ msg->request_id,
+ result_af,
+ addr);
if (result_af == AF_UNSPEC)
{
/* failure, we're done */
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+ _("Failed to allocate IP address for new destination\n"));
GNUNET_SERVER_receive_done (client, GNUNET_OK);
return;
}
-
+
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Allocated address %s for redirection to service %s on peer %s\n",
+ inet_ntop (result_af, addr, sbuf, sizeof (sbuf)),
+ GNUNET_h2s (&msg->service_descriptor),
+ GNUNET_i2s (&msg->target));
+ }
+
/* setup destination record */
- de = GNUNET_malloc (sizeof (struct DestinationEntry));
+ de = GNUNET_new (struct DestinationEntry);
de->is_service = GNUNET_YES;
de->details.service_destination.service_descriptor = msg->service_descriptor;
de->details.service_destination.target = msg->target;
get_destination_key_from_ip (result_af,
addr,
&key);
+ de->key = key;
GNUNET_assert (GNUNET_OK ==
GNUNET_CONTAINER_multihashmap_put (destination_map,
&key,
GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
de->heap_node = GNUNET_CONTAINER_heap_insert (destination_heap,
de,
- GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value);
-
- /* setup tunnel to destination */
- ts = GNUNET_malloc (sizeof (struct TunnelState));
- if (GNUNET_NO != ntohl (msg->nac))
+ GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value_us);
+ while (GNUNET_CONTAINER_multihashmap_size (destination_map) > max_destination_mappings)
+ expire_destination (de);
+
+ dt = GNUNET_new (struct DestinationTunnel);
+ dt->destination = de;
+ GNUNET_CONTAINER_DLL_insert (de->dt_head,
+ de->dt_tail,
+ dt);
+ ts = create_tunnel_to_destination (dt,
+ result_af);
+ switch (result_af)
{
- ts->request_id = msg->request_id;
- ts->client = client;
- GNUNET_SERVER_client_keep (client);
- }
- ts->destination = *de;
- ts->destination.heap_node = NULL;
- ts->is_service = GNUNET_YES;
- ts->af = result_af;
- if (result_af == AF_INET)
+ case AF_INET:
ts->destination_ip.v4 = v4;
- else
+ break;
+ case AF_INET6:
ts->destination_ip.v6 = v6;
- de->tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
- ts,
- &tunnel_peer_connect_handler,
- &tunnel_peer_disconnect_handler,
- ts);
- GNUNET_MESH_peer_request_connect_add (de->tunnel,
- &msg->target);
+ break;
+ default:
+ GNUNET_assert (0);
+ }
/* we're done */
GNUNET_SERVER_receive_done (client, GNUNET_OK);
}
+/**
+ * Function called whenever a tunnel is destroyed. Should clean up
+ * any associated state.
+ *
+ * @param cls closure (set from #GNUNET_MESH_connect)
+ * @param tunnel connection to the other end (henceforth invalid)
+ * @param tunnel_ctx place where local state associated
+ * with the tunnel is stored (our `struct TunnelState`)
+ */
+static void
+tunnel_cleaner (void *cls,
+ const struct GNUNET_MESH_Tunnel *tunnel,
+ void *tunnel_ctx)
+{
+ struct TunnelState *ts = tunnel_ctx;
+
+ ts->tunnel = NULL; /* we must not call GNUNET_MESH_tunnel_destroy() anymore */
+ free_tunnel_state (ts);
+}
+
/**
- * Function called for inbound tunnels. As we don't offer
- * any mesh services, this function should never be called.
+ * Free memory occupied by an entry in the destination map.
*
- * @param cls closure
- * @param tunnel new handle to the tunnel
- * @param initiator peer that started the tunnel
- * @param atsi performance information for the tunnel
- * @return initial tunnel context for the tunnel
- * (can be NULL -- that's not an error)
- */
-static void *
-inbound_tunnel_cb (void *cls, struct GNUNET_MESH_Tunnel *tunnel,
- const struct GNUNET_PeerIdentity *initiator,
- const struct GNUNET_ATS_Information *atsi)
+ * @param cls unused
+ * @param key unused
+ * @param value a `struct DestinationEntry *`
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+cleanup_destination (void *cls,
+ const struct GNUNET_HashCode *key,
+ void *value)
{
- /* Why should anyone open an inbound tunnel to vpn? */
- GNUNET_break (0);
- return NULL;
+ struct DestinationEntry *de = value;
+
+ free_destination_entry (de);
+ return GNUNET_OK;
}
/**
- * Function called whenever an inbound tunnel is destroyed. Should clean up
- * any associated state.
+ * Free memory occupied by an entry in the tunnel map.
*
- * @param cls closure (set from GNUNET_MESH_connect)
- * @param tunnel connection to the other end (henceforth invalid)
- * @param tunnel_ctx place where local state associated
- * with the tunnel is stored
- */
-static void
-tunnel_cleaner (void *cls, const struct GNUNET_MESH_Tunnel *tunnel, void *tunnel_ctx)
+ * @param cls unused
+ * @param key unused
+ * @param value a `struct TunnelState *`
+ * @return #GNUNET_OK (continue to iterate)
+ */
+static int
+cleanup_tunnel (void *cls,
+ const struct GNUNET_HashCode *key,
+ void *value)
{
- /* FIXME: is this function called for outbound tunnels that go down?
- Should we clean up something here? */
- GNUNET_break (0);
+ struct TunnelState *ts = value;
+
+ free_tunnel_state (ts);
+ return GNUNET_OK;
}
/**
* Function scheduled as very last function, cleans up after us
+ *
+ * @param cls unused
+ * @param tc unused
*/
static void
-cleanup (void *cls GNUNET_UNUSED,
- const struct GNUNET_SCHEDULER_TaskContext *tskctx)
+cleanup (void *cls,
+ const struct GNUNET_SCHEDULER_TaskContext *tc)
{
unsigned int i;
- // FIXME: clean up heaps and maps!
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "VPN is shutting down\n");
+ if (NULL != destination_map)
+ {
+ GNUNET_CONTAINER_multihashmap_iterate (destination_map,
+ &cleanup_destination,
+ NULL);
+ GNUNET_CONTAINER_multihashmap_destroy (destination_map);
+ destination_map = NULL;
+ }
+ if (NULL != destination_heap)
+ {
+ GNUNET_CONTAINER_heap_destroy (destination_heap);
+ destination_heap = NULL;
+ }
+ if (NULL != tunnel_map)
+ {
+ GNUNET_CONTAINER_multihashmap_iterate (tunnel_map,
+ &cleanup_tunnel,
+ NULL);
+ GNUNET_CONTAINER_multihashmap_destroy (tunnel_map);
+ tunnel_map = NULL;
+ }
+ if (NULL != tunnel_heap)
+ {
+ GNUNET_CONTAINER_heap_destroy (tunnel_heap);
+ tunnel_heap = NULL;
+ }
if (NULL != mesh_handle)
{
GNUNET_MESH_disconnect (mesh_handle);
mesh_handle = NULL;
}
if (NULL != helper_handle)
- {
- GNUNET_HELPER_stop (helper_handle);
+ {
+ GNUNET_HELPER_stop (helper_handle, GNUNET_NO);
helper_handle = NULL;
}
if (NULL != nc)
GNUNET_SERVER_notification_context_destroy (nc);
nc = NULL;
}
+ if (NULL != stats)
+ {
+ GNUNET_STATISTICS_destroy (stats, GNUNET_NO);
+ stats = NULL;
+ }
for (i=0;i<5;i++)
GNUNET_free_non_null (vpn_argv[i]);
}
-/**
- * A client has disconnected from us. If we are currently building
- * a tunnel for it, cancel the operation.
- *
- * @param cls unused
- * @param client handle to the client that disconnected
- */
-static void
-client_disconnect (void *cls, struct GNUNET_SERVER_Client *client)
-{
- // FIXME: find all TunnelState's and check if they point
- // to the client and if so, clean the reference up!
-}
-
-
/**
* Main function that will be run by the scheduler.
*
{
static const struct GNUNET_SERVER_MessageHandler service_handlers[] = {
/* callback, cls, type, size */
- {&service_redirect_to_ip, NULL, GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_IP, 0},
- {&service_redirect_to_service, NULL,
- GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_SERVICE,
+ { &service_redirect_to_ip, NULL, GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_IP, 0},
+ { &service_redirect_to_service, NULL,
+ GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_SERVICE,
sizeof (struct RedirectToServiceRequestMessage) },
{NULL, NULL, 0, 0}
};
static const struct GNUNET_MESH_MessageHandler mesh_handlers[] = {
- {receive_udp_back, GNUNET_MESSAGE_TYPE_VPN_SERVICE_UDP_BACK, 0},
- {receive_tcp_back, GNUNET_MESSAGE_TYPE_VPN_SERVICE_TCP_BACK, 0},
- {receive_udp_back, GNUNET_MESSAGE_TYPE_VPN_REMOTE_UDP_BACK, 0},
- {receive_tcp_back, GNUNET_MESSAGE_TYPE_VPN_REMOTE_TCP_BACK, 0},
+ { &receive_udp_back, GNUNET_MESSAGE_TYPE_VPN_UDP_REPLY, 0},
+ { &receive_tcp_back, GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_VPN, 0},
+ { &receive_icmp_back, GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_VPN, 0},
{NULL, 0, 0}
};
- static const GNUNET_MESH_ApplicationType types[] = {
- GNUNET_APPLICATION_TYPE_END
- };
char *ifname;
char *ipv6addr;
char *ipv6prefix_s;
char *ipv4mask;
struct in_addr v4;
struct in6_addr v6;
+ char *binary;
+
+ binary = GNUNET_OS_get_libexec_binary_path ("gnunet-helper-vpn");
+ if (GNUNET_YES !=
+ GNUNET_OS_check_helper_binary (binary, GNUNET_YES, "-d gnunet-vpn - - 169.1.3.3.7 255.255.255.0")) //ipv4 only please!
+ {
+ fprintf (stderr,
+ "`%s' is not SUID, refusing to run.\n",
+ "gnunet-helper-vpn");
+ GNUNET_free (binary);
+ global_ret = 1;
+ return;
+ }
+ GNUNET_free (binary);
cfg = cfg_;
+ stats = GNUNET_STATISTICS_create ("vpn", cfg);
if (GNUNET_OK !=
- GNUNET_CONFIGURATION_get_value_number (cfg, "vpn", "MAX_MAPPING",
+ GNUNET_CONFIGURATION_get_value_number (cfg, "VPN", "MAX_MAPPING",
&max_destination_mappings))
max_destination_mappings = 200;
if (GNUNET_OK !=
- GNUNET_CONFIGURATION_get_value_number (cfg, "vpn", "MAX_TUNNELS",
+ GNUNET_CONFIGURATION_get_value_number (cfg, "VPN", "MAX_TUNNELS",
&max_tunnel_mappings))
max_tunnel_mappings = 200;
- destination_map = GNUNET_CONTAINER_multihashmap_create (max_destination_mappings * 2);
+ destination_map = GNUNET_CONTAINER_multihashmap_create (max_destination_mappings * 2, GNUNET_NO);
destination_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
- tunnel_map = GNUNET_CONTAINER_multihashmap_create (max_tunnel_mappings * 2);
+ tunnel_map = GNUNET_CONTAINER_multihashmap_create (max_tunnel_mappings * 2, GNUNET_NO);
tunnel_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
vpn_argv[0] = GNUNET_strdup ("vpn-gnunet");
if (GNUNET_SYSERR ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IFNAME", &ifname))
+ GNUNET_CONFIGURATION_get_value_string (cfg, "VPN", "IFNAME", &ifname))
{
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
- "No entry 'IFNAME' in configuration!\n");
+ GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "VPN", "IFNAME");
GNUNET_SCHEDULER_shutdown ();
return;
}
vpn_argv[1] = ifname;
- if ( (GNUNET_SYSERR ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV6ADDR",
- &ipv6addr) ||
- (1 != inet_pton (AF_INET6, ipv6addr, &v6))) )
+ if (GNUNET_OK == GNUNET_NETWORK_test_pf (PF_INET6))
{
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
- "No valid entry 'IPV6ADDR' in configuration!\n");
- GNUNET_SCHEDULER_shutdown ();
- return;
- }
- vpn_argv[2] = ipv6addr;
- if (GNUNET_SYSERR ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV6PREFIX",
- &ipv6prefix_s))
- {
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
- "No entry 'IPV6PREFIX' in configuration!\n");
- GNUNET_SCHEDULER_shutdown ();
- return;
+ if ( (GNUNET_SYSERR ==
+ GNUNET_CONFIGURATION_get_value_string (cfg, "VPN", "IPV6ADDR",
+ &ipv6addr) ||
+ (1 != inet_pton (AF_INET6, ipv6addr, &v6))) )
+ {
+ GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV6ADDR",
+ _("Must specify valid IPv6 address"));
+ GNUNET_SCHEDULER_shutdown ();
+ return;
+ }
+ vpn_argv[2] = ipv6addr;
+ if (GNUNET_SYSERR ==
+ GNUNET_CONFIGURATION_get_value_string (cfg, "VPN", "IPV6PREFIX",
+ &ipv6prefix_s))
+ {
+ GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV6PREFIX");
+ GNUNET_SCHEDULER_shutdown ();
+ return;
+ }
+ vpn_argv[3] = ipv6prefix_s;
+ if ( (GNUNET_OK !=
+ GNUNET_CONFIGURATION_get_value_number (cfg, "VPN",
+ "IPV6PREFIX",
+ &ipv6prefix)) ||
+ (ipv6prefix >= 127) )
+ {
+ GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV4MASK",
+ _("Must specify valid IPv6 mask"));
+ GNUNET_SCHEDULER_shutdown ();
+ return;
+ }
}
- vpn_argv[3] = ipv6prefix_s;
- if ( (GNUNET_OK !=
- GNUNET_CONFIGURATION_get_value_number (cfg, "vpn",
- "IPV6PREFIX",
- &ipv6prefix)) ||
- (ipv6prefix >= 127) )
+ else
{
- GNUNET_SCHEDULER_shutdown ();
- return;
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("IPv6 support disabled as this system does not support IPv6\n"));
+ vpn_argv[2] = GNUNET_strdup ("-");
+ vpn_argv[3] = GNUNET_strdup ("-");
}
-
- if ( (GNUNET_SYSERR ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4ADDR",
- &ipv4addr) ||
- (1 != inet_pton (AF_INET, ipv4addr, &v4))) )
+ if (GNUNET_OK == GNUNET_NETWORK_test_pf (PF_INET))
{
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
- "No valid entry for 'IPV4ADDR' in configuration!\n");
- GNUNET_SCHEDULER_shutdown ();
- return;
+ if ( (GNUNET_SYSERR ==
+ GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4ADDR",
+ &ipv4addr) ||
+ (1 != inet_pton (AF_INET, ipv4addr, &v4))) )
+ {
+ GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV4ADDR",
+ _("Must specify valid IPv4 address"));
+ GNUNET_SCHEDULER_shutdown ();
+ return;
+ }
+ vpn_argv[4] = ipv4addr;
+ if ( (GNUNET_SYSERR ==
+ GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4MASK",
+ &ipv4mask) ||
+ (1 != inet_pton (AF_INET, ipv4mask, &v4))) )
+ {
+ GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR, "VPN", "IPV4MASK",
+ _("Must specify valid IPv4 mask"));
+ GNUNET_SCHEDULER_shutdown ();
+ return;
+ }
+ vpn_argv[5] = ipv4mask;
}
- vpn_argv[4] = ipv4addr;
- if ( (GNUNET_SYSERR ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4MASK",
- &ipv4mask) ||
- (1 != inet_pton (AF_INET, ipv4mask, &v4))) )
+ else
{
- GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
- "No valid entry 'IPV4MASK' in configuration!\n");
- GNUNET_SCHEDULER_shutdown ();
- return;
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("IPv4 support disabled as this system does not support IPv4\n"));
+ vpn_argv[4] = GNUNET_strdup ("-");
+ vpn_argv[5] = GNUNET_strdup ("-");
}
- vpn_argv[5] = ipv4mask;
vpn_argv[6] = NULL;
mesh_handle =
- GNUNET_MESH_connect (cfg_, 42 /* queue length */, NULL,
- &inbound_tunnel_cb,
- &tunnel_cleaner,
+ GNUNET_MESH_connect (cfg_, NULL,
+ NULL,
+ &tunnel_cleaner,
mesh_handlers,
- types);
- helper_handle = GNUNET_HELPER_start ("gnunet-helper-vpn", vpn_argv,
- &message_token, NULL);
+ NULL);
+ helper_handle = GNUNET_HELPER_start (GNUNET_NO,
+ "gnunet-helper-vpn", vpn_argv,
+ &message_token, NULL, NULL);
nc = GNUNET_SERVER_notification_context_create (server, 1);
GNUNET_SERVER_add_handlers (server, service_handlers);
- GNUNET_SERVER_disconnect_notify (server, &client_disconnect, NULL);
GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL, &cleanup, cls);
}
main (int argc, char *const *argv)
{
return (GNUNET_OK ==
- GNUNET_SERVICE_run (argc, argv, "vpn",
+ GNUNET_SERVICE_run (argc, argv, "vpn",
GNUNET_SERVICE_OPTION_NONE,
- &run, NULL)) ? 0 : 1;
+ &run, NULL)) ? global_ret : 1;
}
/* end of gnunet-service-vpn.c */