* to allocate IPs on the virtual interface and to then redirect
* IP traffic received on those IPs via the GNUnet mesh
* @author Philipp Toelke
+ * @author Christian Grothoff
+ *
+ * TODO:
+ * Basics:
+ * - test!
+ *
+ * Features:
+ * - add back ICMP support (especially needed for IPv6)
+ *
+ * Code cleanup:
+ * - consider moving IP-header building / checksumming code into shared library
+ * with dns/exit/vpn (libgnunettun_tcpip?)
*/
#include "platform.h"
#include "gnunet_util_lib.h"
-#include "gnunet-vpn-packet.h"
#include "gnunet_common.h"
#include "gnunet_protocols.h"
#include "gnunet_applications.h"
#include "gnunet_mesh_service.h"
+#include "gnunet_statistics_service.h"
#include "gnunet_constants.h"
+#include "tcpip_tun.h"
+#include "vpn.h"
+#include "exit.h"
+
+
+/**
+ * Maximum number of messages we allow in the queue for mesh.
+ */
+#define MAX_MESSAGE_QUEUE_SIZE 4
+
+/**
+ * State we keep for each of our tunnels.
+ */
+struct TunnelState;
-struct map_entry
+/**
+ * Information we track for each IP address to determine which tunnel
+ * to send the traffic over to the destination.
+ */
+struct DestinationEntry
{
- /** The description of the service (used for service) */
- GNUNET_HashCode desc;
- /** The real address of the service (used for remote) */
- char addrlen;
- char addr[16];
+ /**
+ * Key under which this entry is in the 'destination_map' (only valid
+ * if 'heap_node != NULL').
+ */
+ GNUNET_HashCode key;
- struct GNUNET_MESH_Tunnel *tunnel;
- uint16_t namelen;
- char additional_ports[8192];
+ /**
+ * Pre-allocated tunnel for this destination, or NULL for none.
+ */
+ struct TunnelState *ts;
+ /**
+ * Entry for this entry in the destination_heap.
+ */
struct GNUNET_CONTAINER_HeapNode *heap_node;
- GNUNET_HashCode hash;
-};
+ /**
+ * GNUNET_NO if this is a tunnel to an Internet-exit,
+ * GNUNET_YES if this tunnel is to a service.
+ */
+ int is_service;
+ /**
+ * Details about the connection (depending on is_service).
+ */
+ union
+ {
-struct remote_addr
-{
- char addrlen;
- unsigned char addr[16];
- char proto;
+ struct
+ {
+ /**
+ * The description of the service (only used for service tunnels).
+ */
+ GNUNET_HashCode service_descriptor;
+
+ /**
+ * Peer offering the service.
+ */
+ struct GNUNET_PeerIdentity target;
+
+ } service_destination;
+
+ struct
+ {
+
+ /**
+ * Address family used (AF_INET or AF_INET6).
+ */
+ int af;
+
+ /**
+ * IP address of the ultimate destination (only used for exit tunnels).
+ */
+ union
+ {
+ /**
+ * Address if af is AF_INET.
+ */
+ struct in_addr v4;
+
+ /**
+ * Address if af is AF_INET6.
+ */
+ struct in6_addr v6;
+ } ip;
+
+ } exit_destination;
+
+ } details;
+
};
-struct tunnel_notify_queue
+/**
+ * A messages we have in queue for a particular tunnel.
+ */
+struct TunnelMessageQueueEntry
{
- struct tunnel_notify_queue *next;
- struct tunnel_notify_queue *prev;
+ /**
+ * This is a doubly-linked list.
+ */
+ struct TunnelMessageQueueEntry *next;
+
+ /**
+ * This is a doubly-linked list.
+ */
+ struct TunnelMessageQueueEntry *prev;
+
+ /**
+ * Number of bytes in 'msg'.
+ */
size_t len;
- void *cls;
+
+ /**
+ * Message to transmit, allocated at the end of this struct.
+ */
+ const void *msg;
};
-struct tunnel_state
+/**
+ * State we keep for each of our tunnels.
+ */
+struct TunnelState
{
+
+ /**
+ * Information about the tunnel to use, NULL if no tunnel
+ * is available right now.
+ */
+ struct GNUNET_MESH_Tunnel *tunnel;
+
+ /**
+ * Active transmission handle, NULL for none.
+ */
struct GNUNET_MESH_TransmitHandle *th;
- struct tunnel_notify_queue *head, *tail;
- int addrlen;
-};
+ /**
+ * Entry for this entry in the tunnel_heap, NULL as long as this
+ * tunnel state is not fully bound.
+ */
+ struct GNUNET_CONTAINER_HeapNode *heap_node;
+
+ /**
+ * Head of list of messages scheduled for transmission.
+ */
+ struct TunnelMessageQueueEntry *tmq_head;
+
+ /**
+ * Tail of list of messages scheduled for transmission.
+ */
+ struct TunnelMessageQueueEntry *tmq_tail;
+
+ /**
+ * Client that needs to be notified about the tunnel being
+ * up as soon as a peer is connected; NULL for none.
+ */
+ struct GNUNET_SERVER_Client *client;
+
+ /**
+ * Destination entry that has a pointer to this tunnel state;
+ * NULL if this tunnel state is in the tunnel map.
+ */
+ struct DestinationEntry *destination_container;
+
+ /**
+ * ID of the client request that caused us to setup this entry.
+ */
+ uint64_t request_id;
+
+ /**
+ * Destination to which this tunnel leads. Note that
+ * this struct is NOT in the destination_map (but a
+ * local copy) and that the 'heap_node' should always
+ * be NULL.
+ */
+ struct DestinationEntry destination;
+
+ /**
+ * Task scheduled to destroy the tunnel (or NO_TASK).
+ */
+ GNUNET_SCHEDULER_TaskIdentifier destroy_task;
+
+ /**
+ * Addess family used for this tunnel on the local TUN interface.
+ */
+ int af;
+
+ /**
+ * Length of the doubly linked 'tmq_head/tmq_tail' list.
+ */
+ unsigned int tmq_length;
+
+ /**
+ * IPPROTO_TCP or IPPROTO_UDP once bound.
+ */
+ uint8_t protocol;
+
+ /**
+ * IP address of the source on our end, initially uninitialized.
+ */
+ union
+ {
+ /**
+ * Address if af is AF_INET.
+ */
+ struct in_addr v4;
+
+ /**
+ * Address if af is AF_INET6.
+ */
+ struct in6_addr v6;
+
+ } source_ip;
+
+ /**
+ * Destination IP address used by the source on our end (this is the IP
+ * that we pick freely within the VPN's tunnel IP range).
+ */
+ union
+ {
+ /**
+ * Address if af is AF_INET.
+ */
+ struct in_addr v4;
+
+ /**
+ * Address if af is AF_INET6.
+ */
+ struct in6_addr v6;
+
+ } destination_ip;
+
+ /**
+ * Source port used by the sender on our end; 0 for uninitialized.
+ */
+ uint16_t source_port;
+ /**
+ * Destination port used by the sender on our end; 0 for uninitialized.
+ */
+ uint16_t destination_port;
+
+};
/**
static struct GNUNET_MESH_Handle *mesh_handle;
/**
- * FIXME
+ * Map from IP address to destination information (possibly with a
+ * MESH tunnel handle for fast setup).
+ */
+static struct GNUNET_CONTAINER_MultiHashMap *destination_map;
+
+/**
+ * Min-Heap sorted by activity time to expire old mappings.
+ */
+static struct GNUNET_CONTAINER_Heap *destination_heap;
+
+/**
+ * Map from source and destination address (IP+port) to connection
+ * information (mostly with the respective MESH tunnel handle).
*/
-static struct GNUNET_CONTAINER_MultiHashMap *hashmap;
+static struct GNUNET_CONTAINER_MultiHashMap *tunnel_map;
/**
- * FIXME
+ * Min-Heap sorted by activity time to expire old mappings; values are
+ * of type 'struct TunnelState'.
*/
-static struct GNUNET_CONTAINER_Heap *heap;
+static struct GNUNET_CONTAINER_Heap *tunnel_heap;
+
+/**
+ * Statistics.
+ */
+static struct GNUNET_STATISTICS_Handle *stats;
/**
* The handle to the VPN helper process "gnunet-helper-vpn".
static struct GNUNET_HELPER_Handle *helper_handle;
/**
- * Arguments to the exit helper.
+ * Arguments to the vpn helper.
*/
static char *vpn_argv[7];
/**
- * If there are at least this many address-mappings, old ones will be removed
+ * Length of the prefix of the VPN's IPv6 network.
*/
-static unsigned long long max_mappings;
+static unsigned long long ipv6prefix;
+/**
+ * Notification context for sending replies to clients.
+ */
+static struct GNUNET_SERVER_NotificationContext *nc;
/**
- * @return the hash of the IP-Address if a mapping exists, NULL otherwise
+ * If there are more than this number of address-mappings, old ones
+ * will be removed
*/
-static GNUNET_HashCode *
-address6_mapping_exists (struct in6_addr *v6addr)
-{
- unsigned char *addr = (unsigned char*) v6addr;
- GNUNET_HashCode *key = GNUNET_malloc (sizeof (GNUNET_HashCode));
- unsigned char *k = (unsigned char *) key;
+static unsigned long long max_destination_mappings;
- memset (key, 0, sizeof (GNUNET_HashCode));
- unsigned int i;
+/**
+ * If there are more than this number of open tunnels, old ones
+ * will be removed
+ */
+static unsigned long long max_tunnel_mappings;
- for (i = 0; i < 16; i++)
- k[15 - i] = addr[i];
- if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (hashmap, key))
- return key;
- else
+/**
+ * Compute the key under which we would store an entry in the
+ * destination_map for the given IP address.
+ *
+ * @param af address family (AF_INET or AF_INET6)
+ * @param address IP address, struct in_addr or struct in6_addr
+ * @param key where to store the key
+ */
+static void
+get_destination_key_from_ip (int af,
+ const void *address,
+ GNUNET_HashCode *key)
+{
+ switch (af)
{
- GNUNET_free (key);
- return NULL;
+ case AF_INET:
+ GNUNET_CRYPTO_hash (address,
+ sizeof (struct in_addr),
+ key);
+ break;
+ case AF_INET6:
+ GNUNET_CRYPTO_hash (address,
+ sizeof (struct in6_addr),
+ key);
+ break;
+ default:
+ GNUNET_assert (0);
+ break;
}
}
+
/**
- * @return the hash of the IP-Address if a mapping exists, NULL otherwise
+ * Compute the key under which we would store an entry in the
+ * tunnel_map for the given socket address pair.
+ *
+ * @param af address family (AF_INET or AF_INET6)
+ * @param protocol IPPROTO_TCP or IPPROTO_UDP
+ * @param source_ip sender's source IP, struct in_addr or struct in6_addr
+ * @param source_port sender's source port
+ * @param destination_ip sender's destination IP, struct in_addr or struct in6_addr
+ * @param destination_port sender's destination port
+ * @param key where to store the key
*/
-static GNUNET_HashCode *
-address4_mapping_exists (uint32_t addr)
+static void
+get_tunnel_key_from_ips (int af,
+ uint8_t protocol,
+ const void *source_ip,
+ uint16_t source_port,
+ const void *destination_ip,
+ uint16_t destination_port,
+ GNUNET_HashCode *key)
{
- GNUNET_HashCode *key = GNUNET_malloc (sizeof (GNUNET_HashCode));
+ char *off;
memset (key, 0, sizeof (GNUNET_HashCode));
- unsigned char *c = (unsigned char *) &addr;
- unsigned char *k = (unsigned char *) key;
- unsigned int i;
-
- for (i = 0; i < 4; i++)
- k[3 - i] = c[i];
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "a4_m_e: getting with key %08x, addr is %08x, %d.%d.%d.%d\n",
- *((uint32_t *) (key)), addr, c[0], c[1], c[2], c[3]);
-
- if (GNUNET_YES == GNUNET_CONTAINER_multihashmap_contains (hashmap, key))
- return key;
- else
+ /* the GNUnet hashmap only uses the first sizeof(unsigned int) of the hash,
+ so we put the ports in there (and hope for few collisions) */
+ off = (char*) key;
+ memcpy (off, &source_port, sizeof (uint16_t));
+ off += sizeof (uint16_t);
+ memcpy (off, &destination_port, sizeof (uint16_t));
+ off += sizeof (uint16_t);
+ switch (af)
{
- GNUNET_free (key);
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Mapping not found!\n");
- return NULL;
+ case AF_INET:
+ memcpy (off, source_ip, sizeof (struct in_addr));
+ off += sizeof (struct in_addr);
+ memcpy (off, destination_ip, sizeof (struct in_addr));
+ off += sizeof (struct in_addr);
+ break;
+ case AF_INET6:
+ memcpy (off, source_ip, sizeof (struct in6_addr));
+ off += sizeof (struct in6_addr);
+ memcpy (off, destination_ip, sizeof (struct in6_addr));
+ off += sizeof (struct in6_addr);
+ break;
+ default:
+ GNUNET_assert (0);
+ break;
}
+ memcpy (off, &protocol, sizeof (uint8_t));
+ off += sizeof (uint8_t);
}
-static void *
-initialize_tunnel_state (int addrlen, struct GNUNET_MESH_TransmitHandle *th)
+/**
+ * Notify the client about the result of its request.
+ *
+ * @param client client to notify
+ * @param request_id original request ID to include in response
+ * @param result_af resulting address family
+ * @param addr resulting IP address
+ */
+static void
+send_client_reply (struct GNUNET_SERVER_Client *client,
+ uint64_t request_id,
+ int result_af,
+ const void *addr)
{
- struct tunnel_state *ts = GNUNET_malloc (sizeof *ts);
+ char buf[sizeof (struct RedirectToIpResponseMessage) + sizeof (struct in6_addr)];
+ struct RedirectToIpResponseMessage *res;
+ size_t rlen;
- ts->addrlen = addrlen;
- ts->th = th;
- return ts;
+ switch (result_af)
+ {
+ case AF_INET:
+ rlen = sizeof (struct in_addr);
+ break;
+ case AF_INET6:
+ rlen = sizeof (struct in6_addr);
+ break;
+ case AF_UNSPEC:
+ rlen = 0;
+ break;
+ default:
+ GNUNET_assert (0);
+ return;
+ }
+ res = (struct RedirectToIpResponseMessage *) buf;
+ res->header.size = htons (sizeof (struct RedirectToIpResponseMessage) + rlen);
+ res->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_CLIENT_USE_IP);
+ res->result_af = htonl (result_af);
+ res->request_id = request_id;
+ memcpy (&res[1], addr, rlen);
+ GNUNET_SERVER_notification_context_add (nc, client);
+ GNUNET_SERVER_notification_context_unicast (nc,
+ client,
+ &res->header,
+ GNUNET_NO);
}
+/**
+ * Destroy the mesh tunnel.
+ *
+ * @param cls the 'struct TunnelState' with the tunnel to destroy
+ * @param ts schedule context
+ */
static void
-send_icmp4_response (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
+destroy_tunnel_task (void *cls,
+ const struct GNUNET_SCHEDULER_TaskContext *tc)
{
- if ((tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN) != 0)
- return;
-
- struct ip_icmp *request = cls;
-
- struct ip_icmp *response = alloca (ntohs (request->shdr.size));
-
- GNUNET_assert (response != NULL);
- memset (response, 0, ntohs (request->shdr.size));
-
- response->shdr.size = request->shdr.size;
- response->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
-
- response->tun.flags = 0;
- response->tun.type = htons (0x0800);
-
- response->ip_hdr.hdr_lngth = 5;
- response->ip_hdr.version = 4;
- response->ip_hdr.proto = 0x01;
- response->ip_hdr.dadr = request->ip_hdr.sadr;
- response->ip_hdr.sadr = request->ip_hdr.dadr;
- response->ip_hdr.tot_lngth = request->ip_hdr.tot_lngth;
-
- response->ip_hdr.chks =
- GNUNET_CRYPTO_crc16_n ((uint16_t *) & response->ip_hdr, 20);
-
- response->icmp_hdr.code = 0;
- response->icmp_hdr.type = 0x0;
-
- /* Magic, more Magic! */
- response->icmp_hdr.chks = request->icmp_hdr.chks + 0x8;
-
- /* Copy the rest of the packet */
- memcpy (response + 1, request + 1,
- ntohs (request->shdr.size) - sizeof (struct ip_icmp));
+ struct TunnelState *ts = cls;
+ struct GNUNET_MESH_Tunnel *tunnel;
- (void) GNUNET_HELPER_send (helper_handle,
- &response->shdr,
- GNUNET_YES,
- NULL, NULL);
- GNUNET_free (request);
+ ts->destroy_task = GNUNET_SCHEDULER_NO_TASK;
+ if (NULL == (tunnel = ts->tunnel))
+ return;
+ ts->tunnel = NULL;
+ GNUNET_MESH_tunnel_destroy (tunnel);
}
+/**
+ * Method called whenever a peer has disconnected from the tunnel.
+ *
+ * @param cls closure
+ * @param peer peer identity the tunnel stopped working with
+ */
static void
-send_icmp6_response (void *cls, const struct GNUNET_SCHEDULER_TaskContext *tc)
+tunnel_peer_disconnect_handler (void *cls,
+ const struct
+ GNUNET_PeerIdentity * peer)
{
- if ((tc->reason & GNUNET_SCHEDULER_REASON_SHUTDOWN) != 0)
- return;
-
- struct ip6_icmp *request = cls;
-
- struct ip6_icmp *response = alloca (ntohs (request->shdr.size));
+ struct TunnelState *ts = cls;
- GNUNET_assert (response != NULL);
- memset (response, 0, ntohs (request->shdr.size));
-
- response->shdr.size = request->shdr.size;
- response->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Peer %s disconnected from tunnel.\n",
+ GNUNET_i2s (peer));
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Peers connected to mesh tunnels"),
+ -1, GNUNET_NO);
+ if (NULL != ts->th)
+ {
+ GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
+ ts->th = NULL;
+ }
+ if (ts->destination.is_service)
+ return; /* hope for reconnect eventually */
+ /* as we are most likely going to change the exit node now,
+ we should just destroy the tunnel entirely... */
+ if (GNUNET_SCHEDULER_NO_TASK == ts->destroy_task)
+ ts->destroy_task = GNUNET_SCHEDULER_add_now (&destroy_tunnel_task, ts);
+}
- response->tun.flags = 0;
- response->tun.type = htons (0x86dd);
- response->ip6_hdr.hoplmt = 255;
- response->ip6_hdr.paylgth = request->ip6_hdr.paylgth;
- response->ip6_hdr.nxthdr = 0x3a;
- response->ip6_hdr.version = 6;
- memcpy (&response->ip6_hdr.sadr, &request->ip6_hdr.dadr, 16);
- memcpy (&response->ip6_hdr.dadr, &request->ip6_hdr.sadr, 16);
+/**
+ * Method called whenever a peer has connected to the tunnel. Notifies
+ * the waiting client that the tunnel is now up.
+ *
+ * @param cls closure
+ * @param peer peer identity the tunnel was created to, NULL on timeout
+ * @param atsi performance data for the connection
+ */
+static void
+tunnel_peer_connect_handler (void *cls,
+ const struct GNUNET_PeerIdentity
+ * peer,
+ const struct
+ GNUNET_ATS_Information * atsi)
+{
+ struct TunnelState *ts = cls;
- response->icmp_hdr.code = 0;
- response->icmp_hdr.type = 0x81;
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Peer %s connected to tunnel.\n",
+ GNUNET_i2s (peer));
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Peers connected to mesh tunnels"),
+ 1, GNUNET_NO);
+ if (NULL == ts->client)
+ return; /* nothing to do */
+ send_client_reply (ts->client,
+ ts->request_id,
+ ts->af,
+ &ts->destination_ip);
+ GNUNET_SERVER_client_drop (ts->client);
+ ts->client = NULL;
+}
- /* Magic, more Magic! */
- response->icmp_hdr.chks = request->icmp_hdr.chks - 0x1;
- /* Copy the rest of the packet */
- memcpy (response + 1, request + 1,
- ntohs (request->shdr.size) - sizeof (struct ip6_icmp));
+/**
+ * Send a message from the message queue via mesh.
+ *
+ * @param cls the 'struct TunnelState' with the message queue
+ * @param size number of bytes available in buf
+ * @param buf where to copy the message
+ * @return number of bytes copied to buf
+ */
+static size_t
+send_to_peer_notify_callback (void *cls, size_t size, void *buf)
+{
+ struct TunnelState *ts = cls;
+ struct TunnelMessageQueueEntry *tnq;
+ size_t ret;
- (void) GNUNET_HELPER_send (helper_handle,
- &response->shdr,
- GNUNET_YES,
- NULL, NULL);
- GNUNET_free (request);
+ ts->th = NULL;
+ if (NULL == buf)
+ return 0;
+ tnq = ts->tmq_head;
+ GNUNET_assert (NULL != tnq);
+ GNUNET_assert (size >= tnq->len);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Sending %u bytes via mesh tunnel\n",
+ tnq->len);
+ GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
+ ts->tmq_tail,
+ tnq);
+ ts->tmq_length--;
+ memcpy (buf, tnq->msg, tnq->len);
+ ret = tnq->len;
+ GNUNET_free (tnq);
+ if (NULL != (tnq = ts->tmq_head))
+ ts->th = GNUNET_MESH_notify_transmit_ready (ts->tunnel,
+ GNUNET_NO /* cork */,
+ 42 /* priority */,
+ GNUNET_TIME_UNIT_FOREVER_REL,
+ NULL,
+ tnq->len,
+ &send_to_peer_notify_callback,
+ ts);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Bytes given to mesh for transmission"),
+ ret, GNUNET_NO);
+ return ret;
}
/**
- * cls is the pointer to a GNUNET_MessageHeader that is
- * followed by the service-descriptor and the packet that should be sent;
+ * Add the given message to the given tunnel and trigger the
+ * transmission process.
+ *
+ * @param tnq message to queue
+ * @param ts tunnel to queue the message for
*/
-static size_t
-send_pkt_to_peer_notify_callback (void *cls, size_t size, void *buf)
+static void
+send_to_tunnel (struct TunnelMessageQueueEntry *tnq,
+ struct TunnelState *ts)
{
- struct GNUNET_MESH_Tunnel **tunnel = cls;
-
- struct tunnel_state *ts = GNUNET_MESH_tunnel_get_data (*tunnel);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Queueing %u bytes for transmission via mesh tunnel\n",
+ tnq->len);
+ GNUNET_CONTAINER_DLL_insert_tail (ts->tmq_head,
+ ts->tmq_tail,
+ tnq);
+ ts->tmq_length++;
+ if (ts->tmq_length > MAX_MESSAGE_QUEUE_SIZE)
+ {
+ struct TunnelMessageQueueEntry *dq;
+
+ dq = ts->tmq_head;
+ GNUNET_assert (dq != tnq);
+ GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
+ ts->tmq_tail,
+ dq);
+ GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
+ ts->th = NULL;
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Bytes dropped in mesh queue (overflow)"),
+ dq->len,
+ GNUNET_NO);
+ GNUNET_free (dq);
+ }
+ if (NULL == ts->th)
+ ts->th = GNUNET_MESH_notify_transmit_ready (ts->tunnel,
+ GNUNET_NO /* cork */,
+ 42 /* priority */,
+ GNUNET_TIME_UNIT_FOREVER_REL,
+ NULL,
+ tnq->len,
+ &send_to_peer_notify_callback,
+ ts);
+}
- ts->th = NULL;
- if (NULL != buf)
+/**
+ * Initialize the given destination entry's mesh tunnel.
+ *
+ * @param de destination entry for which we need to setup a tunnel
+ * @param client client to notify on successful tunnel setup, or NULL for none
+ * @param request_id request ID to send in client notification (unused if client is NULL)
+ * @return tunnel state of the tunnel that was created
+ */
+static struct TunnelState *
+create_tunnel_to_destination (struct DestinationEntry *de,
+ struct GNUNET_SERVER_Client *client,
+ uint64_t request_id)
+{
+ struct TunnelState *ts;
+
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Mesh tunnels created"),
+ 1, GNUNET_NO);
+ GNUNET_assert (NULL == de->ts);
+ ts = GNUNET_malloc (sizeof (struct TunnelState));
+ if (NULL != client)
+ {
+ ts->request_id = request_id;
+ ts->client = client;
+ GNUNET_SERVER_client_keep (client);
+ }
+ ts->destination = *de;
+ ts->destination.heap_node = NULL; /* copy is NOT in destination heap */
+ de->ts = ts;
+ ts->destination_container = de; /* we are referenced from de */
+ ts->af = AF_UNSPEC; /* so far, unknown */
+ ts->tunnel = GNUNET_MESH_tunnel_create (mesh_handle,
+ ts,
+ &tunnel_peer_connect_handler,
+ &tunnel_peer_disconnect_handler,
+ ts);
+ if (de->is_service)
{
- struct GNUNET_MessageHeader *hdr =
- (struct GNUNET_MessageHeader *) (tunnel + 1);
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "send_pkt_to_peer_notify_callback: buf = %x; size = %u;\n", buf,
- size);
- GNUNET_assert (size >= ntohs (hdr->size));
- memcpy (buf, hdr, ntohs (hdr->size));
- size = ntohs (hdr->size);
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sent!\n");
+ "Creating tunnel to peer %s offering service %s\n",
+ GNUNET_i2s (&de->details.service_destination.target),
+ GNUNET_h2s (&de->details.service_destination.service_descriptor));
+ GNUNET_MESH_peer_request_connect_add (ts->tunnel,
+ &de->details.service_destination.target);
}
else
- size = 0;
-
- if (NULL != ts->head)
{
- struct tunnel_notify_queue *element = ts->head;
-
- GNUNET_CONTAINER_DLL_remove (ts->head, ts->tail, element);
-
- ts->th =
- GNUNET_MESH_notify_transmit_ready (*tunnel, GNUNET_NO, 42,
- GNUNET_TIME_relative_divide
- (GNUNET_CONSTANTS_MAX_CORK_DELAY, 2),
- (const struct GNUNET_PeerIdentity *)
- NULL, element->len,
- send_pkt_to_peer_notify_callback,
- element->cls);
-
- /* save the handle */
- GNUNET_free (element);
- }
- GNUNET_free (cls);
-
- return size;
+ switch (de->details.exit_destination.af)
+ {
+ case AF_INET:
+ GNUNET_MESH_peer_request_connect_by_type (ts->tunnel,
+ GNUNET_APPLICATION_TYPE_IPV4_GATEWAY);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Creating tunnel to exit peer for %s\n",
+ "IPv4");
+ break;
+ case AF_INET6:
+ GNUNET_MESH_peer_request_connect_by_type (ts->tunnel,
+ GNUNET_APPLICATION_TYPE_IPV6_GATEWAY);
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Creating tunnel to exit peer for %s\n",
+ "IPv6");
+ break;
+ default:
+ GNUNET_assert (0);
+ break;
+ }
+ }
+ return ts;
}
+/**
+ * Free resources associated with a tunnel state.
+ *
+ * @param ts state to free
+ */
static void
-send_pkt_to_peer (void *cls, const struct GNUNET_PeerIdentity *peer,
- const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
+free_tunnel_state (struct TunnelState *ts)
{
- /* peer == NULL means that all peers in this request are connected */
- if (peer == NULL)
- return;
- struct GNUNET_MESH_Tunnel **tunnel = cls;
- struct GNUNET_MessageHeader *hdr =
- (struct GNUNET_MessageHeader *) (tunnel + 1);
-
- GNUNET_assert (NULL != tunnel);
- GNUNET_assert (NULL != *tunnel);
-
- struct tunnel_state *ts = GNUNET_MESH_tunnel_get_data (*tunnel);
+ GNUNET_HashCode key;
+ struct TunnelMessageQueueEntry *tnq;
+ struct GNUNET_MESH_Tunnel *tunnel;
- if (NULL == ts->th)
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Cleaning up tunnel state\n");
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active tunnels"),
+ -1, GNUNET_NO);
+ if (GNUNET_SCHEDULER_NO_TASK != ts->destroy_task)
{
- ts->th =
- GNUNET_MESH_notify_transmit_ready (*tunnel, GNUNET_NO, 42,
- GNUNET_TIME_relative_divide
- (GNUNET_CONSTANTS_MAX_CORK_DELAY, 2),
- (const struct GNUNET_PeerIdentity *)
- NULL, ntohs (hdr->size),
- send_pkt_to_peer_notify_callback,
- cls);
+ GNUNET_SCHEDULER_cancel (ts->destroy_task);
+ ts->destroy_task = GNUNET_SCHEDULER_NO_TASK;
}
- else
+ while (NULL != (tnq = ts->tmq_head))
{
- struct tunnel_notify_queue *element = GNUNET_malloc (sizeof *element);
-
- element->cls = cls;
- element->len = ntohs (hdr->size);
-
- GNUNET_CONTAINER_DLL_insert_tail (ts->head, ts->tail, element);
+ GNUNET_CONTAINER_DLL_remove (ts->tmq_head,
+ ts->tmq_tail,
+ tnq);
+ ts->tmq_length--;
+ GNUNET_free (tnq);
+ }
+ GNUNET_assert (0 == ts->tmq_length);
+ if (NULL != ts->client)
+ {
+ GNUNET_SERVER_client_drop (ts->client);
+ ts->client = NULL;
+ }
+ if (NULL != ts->th)
+ {
+ GNUNET_MESH_notify_transmit_ready_cancel (ts->th);
+ ts->th = NULL;
+ }
+ GNUNET_assert (NULL == ts->destination.heap_node);
+ if (NULL != (tunnel = ts->tunnel))
+ {
+ ts->tunnel = NULL;
+ GNUNET_MESH_tunnel_destroy (tunnel);
+ }
+ if (NULL != ts->heap_node)
+ {
+ GNUNET_CONTAINER_heap_remove_node (ts->heap_node);
+ ts->heap_node = NULL;
+ get_tunnel_key_from_ips (ts->af,
+ ts->protocol,
+ &ts->source_ip,
+ ts->source_port,
+ &ts->destination_ip,
+ ts->destination_port,
+ &key);
+ GNUNET_assert (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_remove (tunnel_map,
+ &key,
+ ts));
}
+ if (NULL != ts->destination_container)
+ {
+ GNUNET_assert (ts == ts->destination_container->ts);
+ ts->destination_container->ts = NULL;
+ ts->destination_container = NULL;
+ }
+ GNUNET_free (ts);
}
-
-
/**
- * Receive packets from the helper-process
+ * We have too many active tunnels. Clean up the oldest tunnel.
+ *
+ * @param except tunnel that must NOT be cleaned up, even if it is the oldest
*/
static void
-message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
- const struct GNUNET_MessageHeader *message)
+expire_tunnel (struct TunnelState *except)
{
- GNUNET_assert (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_HELPER);
-
- struct tun_pkt *pkt_tun = (struct tun_pkt *) message;
- GNUNET_HashCode *key;
+ struct TunnelState *ts;
- /* ethertype is ipv6 */
- if (ntohs (pkt_tun->tun.type) == 0x86dd)
- {
- struct ip6_pkt *pkt6 = (struct ip6_pkt *) message;
+ ts = GNUNET_CONTAINER_heap_peek (tunnel_heap);
+ if (except == ts)
+ return; /* can't do this */
+ free_tunnel_state (ts);
+}
- GNUNET_assert (pkt6->ip6_hdr.version == 6);
- struct ip6_tcp *pkt6_tcp;
- struct ip6_udp *pkt6_udp;
- struct ip6_icmp *pkt6_icmp;
- pkt6_udp = NULL; /* make compiler happy */
- switch (pkt6->ip6_hdr.nxthdr)
+/**
+ * Route a packet via mesh to the given destination.
+ *
+ * @param destination description of the destination
+ * @param af address family on this end (AF_INET or AF_INET6)
+ * @param protocol IPPROTO_TCP or IPPROTO_UDP
+ * @param source_ip source IP used by the sender (struct in_addr or struct in6_addr)
+ * @param destination_ip destination IP used by the sender (struct in_addr or struct in6_addr)
+ * @param payload payload of the packet after the IP header
+ * @param payload_length number of bytes in payload
+ */
+static void
+route_packet (struct DestinationEntry *destination,
+ int af,
+ uint8_t protocol,
+ const void *source_ip,
+ const void *destination_ip,
+ const void *payload,
+ size_t payload_length)
+{
+ GNUNET_HashCode key;
+ struct TunnelState *ts;
+ struct TunnelMessageQueueEntry *tnq;
+ size_t alen;
+ size_t mlen;
+ int is_new;
+ const struct udp_packet *udp;
+ const struct tcp_packet *tcp;
+ uint16_t spt;
+ uint16_t dpt;
+
+ switch (protocol)
+ {
+ case IPPROTO_UDP:
{
- case IPPROTO_UDP:
- pkt6_udp = (struct ip6_udp *) pkt6;
- /* Send dns-packets to the service-dns */
- /* fall through */
- case IPPROTO_TCP:
- pkt6_tcp = (struct ip6_tcp *) pkt6;
-
- if ((key = address6_mapping_exists (&pkt6->ip6_hdr.dadr)) != NULL)
+ if (payload_length < sizeof (struct udp_packet))
{
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_assert (me != NULL);
- GNUNET_free (key);
-
- size_t size =
- sizeof (struct GNUNET_MESH_Tunnel *) +
- sizeof (struct GNUNET_MessageHeader) + sizeof (GNUNET_HashCode) +
- ntohs (pkt6->ip6_hdr.paylgth);
-
- struct GNUNET_MESH_Tunnel **cls = GNUNET_malloc (size);
- struct GNUNET_MessageHeader *hdr =
- (struct GNUNET_MessageHeader *) (cls + 1);
- GNUNET_HashCode *hc = (GNUNET_HashCode *) (hdr + 1);
-
- hdr->size =
- htons (sizeof (struct GNUNET_MessageHeader) +
- sizeof (GNUNET_HashCode) + ntohs (pkt6->ip6_hdr.paylgth));
-
- GNUNET_MESH_ApplicationType app_type = 0; /* fix compiler uninitialized warning... */
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "me->addrlen is %d\n",
- me->addrlen);
- if (me->addrlen == 0)
- {
- /* This is a mapping to a gnunet-service */
- *hc = me->desc;
-
- if (me->tunnel == NULL && NULL != cls)
- {
- *cls =
- GNUNET_MESH_tunnel_create (mesh_handle,
- initialize_tunnel_state (16, NULL),
- &send_pkt_to_peer, NULL, cls);
-
- GNUNET_MESH_peer_request_connect_add (*cls,
- (struct GNUNET_PeerIdentity *)
- &me->desc);
- me->tunnel = *cls;
- }
- else if (NULL != cls)
- {
- *cls = me->tunnel;
- send_pkt_to_peer (cls, (struct GNUNET_PeerIdentity *) 1, NULL);
- }
- }
- else
- {
- /* This is a mapping to a "real" address */
- struct remote_addr *s = (struct remote_addr *) hc;
-
- s->addrlen = me->addrlen;
- memcpy (s->addr, me->addr, me->addrlen);
- s->proto = pkt6->ip6_hdr.nxthdr;
- if (s->proto == IPPROTO_UDP)
- {
- hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_REMOTE_UDP);
- memcpy (hc + 1, &pkt6_udp->udp_hdr, ntohs (pkt6_udp->udp_hdr.len));
- app_type = GNUNET_APPLICATION_TYPE_INTERNET_UDP_GATEWAY;
- }
- else if (s->proto == IPPROTO_TCP)
- {
- hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_REMOTE_TCP);
- memcpy (hc + 1, &pkt6_tcp->tcp_hdr, ntohs (pkt6->ip6_hdr.paylgth));
- app_type = GNUNET_APPLICATION_TYPE_INTERNET_TCP_GATEWAY;
- }
- else
- {
- GNUNET_assert (0);
- }
- if (me->tunnel == NULL && NULL != cls)
- {
- *cls =
- GNUNET_MESH_tunnel_create (mesh_handle,
- initialize_tunnel_state (16, NULL),
- &send_pkt_to_peer, NULL, cls);
-
- GNUNET_MESH_peer_request_connect_by_type (*cls, app_type);
- me->tunnel = *cls;
- }
- else if (NULL != cls)
- {
- *cls = me->tunnel;
- send_pkt_to_peer (cls, (struct GNUNET_PeerIdentity *) 1, NULL);
- }
- }
+ /* blame kernel? */
+ GNUNET_break (0);
+ return;
}
- else
- {
- char pbuf[INET6_ADDRSTRLEN];
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Packet to %s, which has no mapping\n",
- inet_ntop (AF_INET6,
- &pkt6->ip6_hdr.dadr,
- pbuf,
- sizeof (pbuf)));
- }
- break;
- case 0x3a:
- /* ICMPv6 */
- pkt6_icmp = (struct ip6_icmp *) pkt6;
- /* If this packet is an icmp-echo-request and a mapping exists, answer */
- if (pkt6_icmp->icmp_hdr.type == 0x80 &&
- (key = address6_mapping_exists (&pkt6->ip6_hdr.dadr)) != NULL)
+ udp = payload;
+ spt = ntohs (udp->spt);
+ dpt = ntohs (udp->dpt);
+ get_tunnel_key_from_ips (af,
+ IPPROTO_UDP,
+ source_ip,
+ spt,
+ destination_ip,
+ dpt,
+ &key);
+ }
+ break;
+ case IPPROTO_TCP:
+ {
+ if (payload_length < sizeof (struct tcp_packet))
{
- GNUNET_free (key);
- pkt6_icmp = GNUNET_malloc (ntohs (pkt6->shdr.size));
- memcpy (pkt6_icmp, pkt6, ntohs (pkt6->shdr.size));
- GNUNET_SCHEDULER_add_now (&send_icmp6_response, pkt6_icmp);
+ /* blame kernel? */
+ GNUNET_break (0);
+ return;
}
+ tcp = payload;
+ spt = ntohs (tcp->spt);
+ dpt = ntohs (tcp->dpt);
+ get_tunnel_key_from_ips (af,
+ IPPROTO_TCP,
+ source_ip,
+ spt,
+ destination_ip,
+ dpt,
+ &key);
+ }
+ break;
+ default:
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("Protocol %u not supported, dropping\n"),
+ (unsigned int) protocol);
+ return;
+ }
+ if (! destination->is_service)
+ {
+ switch (destination->details.exit_destination.af)
+ {
+ case AF_INET:
+ alen = sizeof (struct in_addr);
+ break;
+ case AF_INET6:
+ alen = sizeof (struct in6_addr);
break;
+ default:
+ alen = 0;
+ GNUNET_assert (0);
+ }
+
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+ char xbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Routing %s packet from %s:%u -> %s:%u to destination %s:%u\n",
+ (protocol == IPPROTO_TCP) ? "TCP" : "UDP",
+ inet_ntop (af, source_ip, sbuf, sizeof (sbuf)),
+ spt,
+ inet_ntop (af, destination_ip, dbuf, sizeof (dbuf)),
+ dpt,
+ inet_ntop (destination->details.exit_destination.af,
+ &destination->details.exit_destination.ip,
+ xbuf, sizeof (xbuf)));
}
}
- /* ethertype is ipv4 */
- else if (ntohs (pkt_tun->tun.type) == 0x0800)
+ else
{
- struct ip_pkt *pkt = (struct ip_pkt *) message;
- //struct ip_udp *udp = (struct ip_udp *) message;
- struct ip_tcp *pkt_tcp;
- struct ip_udp *pkt_udp;
- struct ip_icmp *pkt_icmp;
+ /* make compiler happy */
+ alen = 0;
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Routing %s packet from %s:%u -> %s:%u to service %s at peer %s\n",
+ (protocol == IPPROTO_TCP) ? "TCP" : "UDP",
+ inet_ntop (af, source_ip, sbuf, sizeof (sbuf)),
+ spt,
+ inet_ntop (af, destination_ip, dbuf, sizeof (dbuf)),
+ dpt,
+ GNUNET_h2s (&destination->details.service_destination.service_descriptor),
+ GNUNET_i2s (&destination->details.service_destination.target));
+ }
- GNUNET_assert (pkt->ip_hdr.version == 4);
+ }
+ /* see if we have an existing tunnel for this destination */
+ ts = GNUNET_CONTAINER_multihashmap_get (tunnel_map,
+ &key);
+ if (NULL == ts)
+ {
+ /* need to either use the existing tunnel from the destination (if still
+ available) or create a fresh one */
+ is_new = GNUNET_YES;
+ if (NULL == destination->ts)
+ ts = create_tunnel_to_destination (destination, NULL, 0);
+ else
+ ts = destination->ts;
+ destination->ts = NULL;
+ ts->destination_container = NULL; /* no longer 'contained' */
+ /* now bind existing "unbound" tunnel to our IP/port tuple */
+ ts->protocol = protocol;
+ ts->af = af;
+ if (af == AF_INET)
+ {
+ ts->source_ip.v4 = * (const struct in_addr *) source_ip;
+ ts->destination_ip.v4 = * (const struct in_addr *) destination_ip;
+ }
+ else
+ {
+ ts->source_ip.v6 = * (const struct in6_addr *) source_ip;
+ ts->destination_ip.v6 = * (const struct in6_addr *) destination_ip;
+ }
+ ts->source_port = spt;
+ ts->destination_port = dpt;
+ ts->heap_node = GNUNET_CONTAINER_heap_insert (tunnel_heap,
+ ts,
+ GNUNET_TIME_absolute_get ().abs_value);
+ GNUNET_assert (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_put (tunnel_map,
+ &key,
+ ts,
+ GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active tunnels"),
+ 1, GNUNET_NO);
+ while (GNUNET_CONTAINER_multihashmap_size (tunnel_map) > max_tunnel_mappings)
+ expire_tunnel (ts);
+ }
+ else
+ {
+ is_new = GNUNET_NO;
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value);
+ }
+
+ /* send via tunnel */
+ switch (protocol)
+ {
+ case IPPROTO_UDP:
+ if (destination->is_service)
{
- uint32_t dadr = pkt->ip_hdr.dadr.s_addr;
- unsigned char *c = (unsigned char *) &dadr;
+ struct GNUNET_EXIT_UdpServiceMessage *usm;
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Packet to %d.%d.%d.%d, proto %x\n",
- c[0], c[1], c[2], c[3], pkt->ip_hdr.proto);
- switch (pkt->ip_hdr.proto)
+ mlen = sizeof (struct GNUNET_EXIT_UdpServiceMessage) +
+ payload_length - sizeof (struct udp_packet);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
+ usm = (struct GNUNET_EXIT_UdpServiceMessage *) &tnq[1];
+ usm->header.size = htons ((uint16_t) mlen);
+ usm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_SERVICE);
+ /* if the source port is below 32000, we assume it has a special
+ meaning; if not, we pick a random port (this is a heuristic) */
+ usm->source_port = (ntohs (udp->spt) < 32000) ? udp->spt : 0;
+ usm->destination_port = udp->dpt;
+ usm->service_descriptor = destination->details.service_destination.service_descriptor;
+ memcpy (&usm[1],
+ &udp[1],
+ payload_length - sizeof (struct udp_packet));
+ }
+ else
+ {
+ struct GNUNET_EXIT_UdpInternetMessage *uim;
+ struct in_addr *ip4dst;
+ struct in6_addr *ip6dst;
+ void *payload;
+
+ mlen = sizeof (struct GNUNET_EXIT_UdpInternetMessage) +
+ alen + payload_length - sizeof (struct udp_packet);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) +
+ mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
+ uim = (struct GNUNET_EXIT_UdpInternetMessage *) &tnq[1];
+ uim->header.size = htons ((uint16_t) mlen);
+ uim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET);
+ uim->af = htonl (destination->details.exit_destination.af);
+ uim->source_port = (ntohs (udp->spt) < 32000) ? udp->spt : 0;
+ uim->destination_port = udp->dpt;
+ switch (destination->details.exit_destination.af)
+ {
+ case AF_INET:
+ ip4dst = (struct in_addr *) &uim[1];
+ *ip4dst = destination->details.exit_destination.ip.v4;
+ payload = &ip4dst[1];
+ break;
+ case AF_INET6:
+ ip6dst = (struct in6_addr *) &uim[1];
+ *ip6dst = destination->details.exit_destination.ip.v6;
+ payload = &ip6dst[1];
+ break;
+ default:
+ GNUNET_assert (0);
+ }
+ memcpy (payload,
+ &udp[1],
+ payload_length - sizeof (struct udp_packet));
+ }
+ break;
+ case IPPROTO_TCP:
+ if (is_new)
+ {
+ if (destination->is_service)
+ {
+ struct GNUNET_EXIT_TcpServiceStartMessage *tsm;
+
+ mlen = sizeof (struct GNUNET_EXIT_TcpServiceStartMessage) +
+ payload_length - sizeof (struct tcp_packet);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
+ tsm = (struct GNUNET_EXIT_TcpServiceStartMessage *) &tnq[1];
+ tsm->header.size = htons ((uint16_t) mlen);
+ tsm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_TO_SERVICE_START);
+ tsm->reserved = htonl (0);
+ tsm->service_descriptor = destination->details.service_destination.service_descriptor;
+ tsm->tcp_header = *tcp;
+ memcpy (&tsm[1],
+ &tcp[1],
+ payload_length - sizeof (struct tcp_packet));
+ }
+ else
{
- case IPPROTO_TCP:
- case IPPROTO_UDP:
- pkt_tcp = (struct ip_tcp *) pkt;
- pkt_udp = (struct ip_udp *) pkt;
-
- if ((key = address4_mapping_exists (dadr)) != NULL)
- {
- struct map_entry *me =
- GNUNET_CONTAINER_multihashmap_get (hashmap, key);
- GNUNET_assert (me != NULL);
- GNUNET_free (key);
-
- size_t size =
- sizeof (struct GNUNET_MESH_Tunnel *) +
- sizeof (struct GNUNET_MessageHeader) + sizeof (GNUNET_HashCode) +
- ntohs (pkt->ip_hdr.tot_lngth) - 4 * pkt->ip_hdr.hdr_lngth;
-
- struct GNUNET_MESH_Tunnel **cls = GNUNET_malloc (size);
- struct GNUNET_MessageHeader *hdr =
- (struct GNUNET_MessageHeader *) (cls + 1);
- GNUNET_HashCode *hc = (GNUNET_HashCode *) (hdr + 1);
-
- hdr->size =
- htons (sizeof (struct GNUNET_MessageHeader) +
- sizeof (GNUNET_HashCode) + ntohs (pkt->ip_hdr.tot_lngth) -
- 4 * pkt->ip_hdr.hdr_lngth);
-
- GNUNET_MESH_ApplicationType app_type = 0; /* make compiler happy */
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "me->addrlen is %d\n",
- me->addrlen);
- if (me->addrlen == 0)
- {
- /* This is a mapping to a gnunet-service */
- *hc = me->desc;
-
- if (me->tunnel == NULL && NULL != cls)
- {
- *cls =
- GNUNET_MESH_tunnel_create (mesh_handle,
- initialize_tunnel_state (4, NULL),
- send_pkt_to_peer, NULL, cls);
- GNUNET_MESH_peer_request_connect_add (*cls,
- (struct GNUNET_PeerIdentity
- *) &me->desc);
- me->tunnel = *cls;
- }
- else if (NULL != cls)
- {
- *cls = me->tunnel;
- send_pkt_to_peer (cls, (struct GNUNET_PeerIdentity *) 1, NULL);
- }
- }
- else
- {
- /* This is a mapping to a "real" address */
- struct remote_addr *s = (struct remote_addr *) hc;
-
- s->addrlen = me->addrlen;
- memcpy (s->addr, me->addr, me->addrlen);
- s->proto = pkt->ip_hdr.proto;
- if (s->proto == IPPROTO_UDP)
- {
- hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_REMOTE_UDP);
- memcpy (hc + 1, &pkt_udp->udp_hdr, ntohs (pkt_udp->udp_hdr.len));
- app_type = GNUNET_APPLICATION_TYPE_INTERNET_UDP_GATEWAY;
- }
- else if (s->proto == IPPROTO_TCP)
- {
- hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_REMOTE_TCP);
- memcpy (hc + 1, &pkt_tcp->tcp_hdr,
- ntohs (pkt->ip_hdr.tot_lngth) -
- 4 * pkt->ip_hdr.hdr_lngth);
- app_type = GNUNET_APPLICATION_TYPE_INTERNET_TCP_GATEWAY;
- }
- else
- GNUNET_assert (0);
- if (me->tunnel == NULL && NULL != cls)
- {
- *cls =
- GNUNET_MESH_tunnel_create (mesh_handle,
- initialize_tunnel_state (4, NULL),
- send_pkt_to_peer, NULL, cls);
-
- GNUNET_MESH_peer_request_connect_by_type (*cls, app_type);
- me->tunnel = *cls;
- }
- else if (NULL != cls)
- {
- *cls = me->tunnel;
- send_pkt_to_peer (cls, (struct GNUNET_PeerIdentity *) 1, NULL);
- }
- }
- }
- else
- {
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Packet to %x which has no mapping\n", dadr);
- }
- break;
- case 0x01:
- /* ICMP */
- pkt_icmp = (struct ip_icmp *) pkt;
- if (pkt_icmp->icmp_hdr.type == 0x8 &&
- (key = address4_mapping_exists (dadr)) != NULL)
- {
- GNUNET_free (key);
- pkt_icmp = GNUNET_malloc (ntohs (pkt->shdr.size));
- memcpy (pkt_icmp, pkt, ntohs (pkt->shdr.size));
- GNUNET_SCHEDULER_add_now (&send_icmp4_response, pkt_icmp);
- }
- break;
+ struct GNUNET_EXIT_TcpInternetStartMessage *tim;
+ struct in_addr *ip4dst;
+ struct in6_addr *ip6dst;
+ void *payload;
+
+ mlen = sizeof (struct GNUNET_EXIT_TcpInternetStartMessage) +
+ alen + payload_length - sizeof (struct tcp_packet);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
+ tim = (struct GNUNET_EXIT_TcpInternetStartMessage *) &tnq[1];
+ tim->header.size = htons ((uint16_t) mlen);
+ tim->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_TO_INTERNET_START);
+ tim->af = htonl (destination->details.exit_destination.af);
+ tim->tcp_header = *tcp;
+ switch (destination->details.exit_destination.af)
+ {
+ case AF_INET:
+ ip4dst = (struct in_addr *) &tim[1];
+ *ip4dst = destination->details.exit_destination.ip.v4;
+ payload = &ip4dst[1];
+ break;
+ case AF_INET6:
+ ip6dst = (struct in6_addr *) &tim[1];
+ *ip6dst = destination->details.exit_destination.ip.v6;
+ payload = &ip6dst[1];
+ break;
+ default:
+ GNUNET_assert (0);
+ }
+ memcpy (payload,
+ &tcp[1],
+ payload_length - sizeof (struct tcp_packet));
}
}
+ else
+ {
+ struct GNUNET_EXIT_TcpDataMessage *tdm;
+
+ mlen = sizeof (struct GNUNET_EXIT_TcpDataMessage) +
+ alen + payload_length - sizeof (struct tcp_packet);
+ if (mlen >= GNUNET_SERVER_MAX_MESSAGE_SIZE)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ tnq = GNUNET_malloc (sizeof (struct TunnelMessageQueueEntry) + mlen);
+ tnq->len = mlen;
+ tnq->msg = &tnq[1];
+ tdm = (struct GNUNET_EXIT_TcpDataMessage *) &tnq[1];
+ tdm->header.size = htons ((uint16_t) mlen);
+ tdm->header.type = htons (GNUNET_MESSAGE_TYPE_VPN_TCP_DATA);
+ tdm->reserved = htonl (0);
+ tdm->tcp_header = *tcp;
+ memcpy (&tdm[1],
+ &tcp[1],
+ payload_length - sizeof (struct tcp_packet));
+ }
+ break;
+ default:
+ /* not supported above, how can we get here !? */
+ GNUNET_assert (0);
+ break;
}
+ send_to_tunnel (tnq, ts);
}
-
-
-
/**
- * Create a new Address from an answer-packet
+ * Receive packets from the helper-process (someone send to the local
+ * virtual tunnel interface). Find the destination mapping, and if it
+ * exists, identify the correct MESH tunnel (or possibly create it)
+ * and forward the packet.
+ *
+ * @param cls closure, NULL
+ * @param client NULL
+ * @param message message we got from the client (VPN tunnel interface)
*/
static void
-new_ip6addr (struct in6_addr *v6addr,
- const GNUNET_HashCode * peer,
- const GNUNET_HashCode * service_desc)
-{ /* {{{ */
- unsigned char *buf = (unsigned char*) v6addr;
- char *ipv6addr;
- unsigned long long ipv6prefix;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV6ADDR",
- &ipv6addr));
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_number (cfg, "vpn",
- "IPV6PREFIX",
- &ipv6prefix));
- GNUNET_assert (ipv6prefix < 127);
- ipv6prefix = (ipv6prefix + 7) / 8;
-
- inet_pton (AF_INET6, ipv6addr, buf);
- GNUNET_free (ipv6addr);
-
- int peer_length = 16 - ipv6prefix - 6;
-
- if (peer_length <= 0)
- peer_length = 0;
-
- int service_length = 16 - ipv6prefix - peer_length;
-
- if (service_length <= 0)
- service_length = 0;
-
- memcpy (buf + ipv6prefix, service_desc, service_length);
- memcpy (buf + ipv6prefix + service_length, peer, peer_length);
-}
-
-/*}}}*/
-
-
-/**
- * Create a new Address from an answer-packet
- */
-static void
-new_ip6addr_remote (struct in6_addr *v6addr,
- unsigned char *addr, char addrlen)
-{ /* {{{ */
- unsigned char *buf = (unsigned char*) v6addr;
- char *ipv6addr;
- unsigned long long ipv6prefix;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV6ADDR",
- &ipv6addr));
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_number (cfg, "vpn",
- "IPV6PREFIX",
- &ipv6prefix));
- GNUNET_assert (ipv6prefix < 127);
- ipv6prefix = (ipv6prefix + 7) / 8;
-
- inet_pton (AF_INET6, ipv6addr, buf);
- GNUNET_free (ipv6addr);
-
- int local_length = 16 - ipv6prefix;
-
- memcpy (buf + ipv6prefix, addr, GNUNET_MIN (addrlen, local_length));
-}
-
-/*}}}*/
-
-/**
- * Create a new Address from an answer-packet
- */
-static void
-new_ip4addr_remote (unsigned char *buf, unsigned char *addr, char addrlen)
-{ /* {{{ */
- char *ipv4addr;
- char *ipv4mask;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4ADDR",
- &ipv4addr));
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn", "IPV4MASK",
- &ipv4mask));
- uint32_t mask;
-
- inet_pton (AF_INET, ipv4addr, buf);
- int r = inet_pton (AF_INET, ipv4mask, &mask);
-
- mask = htonl (mask);
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "inet_pton: %d; %m; mask: %08x\n", r,
- mask);
-
- GNUNET_free (ipv4addr);
-
- int c;
-
- if (mask)
+message_token (void *cls GNUNET_UNUSED, void *client GNUNET_UNUSED,
+ const struct GNUNET_MessageHeader *message)
+{
+ const struct tun_header *tun;
+ size_t mlen;
+ GNUNET_HashCode key;
+ struct DestinationEntry *de;
+
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Packets received from TUN interface"),
+ 1, GNUNET_NO);
+ mlen = ntohs (message->size);
+ if ( (ntohs (message->type) != GNUNET_MESSAGE_TYPE_VPN_HELPER) ||
+ (mlen < sizeof (struct GNUNET_MessageHeader) + sizeof (struct tun_header)) )
{
- mask = (mask ^ (mask - 1)) >> 1;
- for (c = 0; mask; c++)
- {
- mask >>= 1;
- }
+ GNUNET_break (0);
+ return;
}
- else
+ tun = (const struct tun_header *) &message[1];
+ mlen -= (sizeof (struct GNUNET_MessageHeader) + sizeof (struct tun_header));
+ switch (ntohs (tun->proto))
{
- c = CHAR_BIT * sizeof (mask);
- }
-
- c = 32 - c;
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "The mask %s has %d leading 1s.\n",
- ipv4mask, c);
-
- GNUNET_free (ipv4mask);
-
- if (c % 8 == 0)
- c = c / 8;
- else
- GNUNET_assert (0);
+ case ETH_P_IPV6:
+ {
+ const struct ip6_header *pkt6;
+
+ if (mlen < sizeof (struct ip6_header))
+ {
+ /* blame kernel */
+ GNUNET_break (0);
+ return;
+ }
+ pkt6 = (const struct ip6_header *) &tun[1];
+ get_destination_key_from_ip (AF_INET6,
+ &pkt6->destination_address,
+ &key);
+ de = GNUNET_CONTAINER_multihashmap_get (destination_map, &key);
+ /* FIXME: do we need to guard against hash collision?
+ (if so, we need to also store the local destination IP in the
+ destination entry and then compare here; however, the risk
+ of collision seems minimal AND the impact is unlikely to be
+ super-problematic as well... */
+ if (NULL == de)
+ {
+ char buf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("Packet received for unmapped destination `%s' (dropping it)\n"),
+ inet_ntop (AF_INET6,
+ &pkt6->destination_address,
+ buf,
+ sizeof (buf)));
+ return;
+ }
+ route_packet (de,
+ AF_INET6,
+ pkt6->next_header,
+ &pkt6->source_address,
+ &pkt6->destination_address,
+ &pkt6[1],
+ mlen - sizeof (struct ip6_header));
+ }
+ break;
+ case ETH_P_IPV4:
+ {
+ struct ip4_header *pkt4;
- memcpy (buf + c, addr, GNUNET_MIN (addrlen, 4 - c));
+ if (mlen < sizeof (struct ip4_header))
+ {
+ /* blame kernel */
+ GNUNET_break (0);
+ return;
+ }
+ pkt4 = (struct ip4_header *) &tun[1];
+ get_destination_key_from_ip (AF_INET,
+ &pkt4->destination_address,
+ &key);
+ de = GNUNET_CONTAINER_multihashmap_get (destination_map, &key);
+ /* FIXME: do we need to guard against hash collision?
+ (if so, we need to also store the local destination IP in the
+ destination entry and then compare here; however, the risk
+ of collision seems minimal AND the impact is unlikely to be
+ super-problematic as well... */
+ if (NULL == de)
+ {
+ char buf[INET_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("Packet received for unmapped destination `%s' (dropping it)\n"),
+ inet_ntop (AF_INET,
+ &pkt4->destination_address,
+ buf,
+ sizeof (buf)));
+ return;
+ }
+ if (pkt4->header_length * 4 != sizeof (struct ip4_header))
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("Received IPv4 packet with options (dropping it)\n"));
+ return;
+ }
+ route_packet (de,
+ AF_INET,
+ pkt4->protocol,
+ &pkt4->source_address,
+ &pkt4->destination_address,
+ &pkt4[1],
+ mlen - sizeof (struct ip4_header));
+ }
+ break;
+ default:
+ GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+ _("Received packet of unknown protocol %d from TUN (dropping it)\n"),
+ (unsigned int) ntohs (tun->proto));
+ break;
+ }
}
-/*}}}*/
-
-
/**
- * FIXME: document.
+ * We got a UDP packet back from the MESH tunnel. Pass it on to the
+ * local virtual interface via the helper.
+ *
+ * @param cls closure, NULL
+ * @param tunnel connection to the other end
+ * @param tunnel_ctx pointer to our 'struct TunnelState *'
+ * @param sender who sent the message
+ * @param message the actual message
+ * @param atsi performance data for the connection
+ * @return GNUNET_OK to keep the connection open,
+ * GNUNET_SYSERR to close it (signal serious error)
*/
static int
receive_udp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
const struct GNUNET_MessageHeader *message,
const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
{
- GNUNET_HashCode *desc = (GNUNET_HashCode *) (message + 1);
- struct remote_addr *s = (struct remote_addr *) desc;
- struct udp_pkt *pkt = (struct udp_pkt *) (desc + 1);
- const struct GNUNET_PeerIdentity *other = sender;
- struct tunnel_state *ts = *tunnel_ctx;
-
- if (16 == ts->addrlen)
+ struct TunnelState *ts = *tunnel_ctx;
+ const struct GNUNET_EXIT_UdpReplyMessage *reply;
+ size_t mlen;
+
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# UDP packets received from mesh"),
+ 1, GNUNET_NO);
+ mlen = ntohs (message->size);
+ if (mlen < sizeof (struct GNUNET_EXIT_UdpReplyMessage))
{
- size_t size =
- sizeof (struct ip6_udp) + ntohs (pkt->len) - 1 -
- sizeof (struct udp_pkt);
-
- struct ip6_udp *pkt6 = alloca (size);
-
- GNUNET_assert (pkt6 != NULL);
-
- if (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_SERVICE_UDP_BACK)
- new_ip6addr (&pkt6->ip6_hdr.sadr, &other->hashPubKey, desc);
- else
- new_ip6addr_remote (&pkt6->ip6_hdr.sadr, s->addr, s->addrlen);
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Relaying calc:%d gnu:%d udp:%d bytes!\n", size,
- ntohs (message->size), ntohs (pkt->len));
-
- pkt6->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt6->shdr.size = htons (size);
-
- pkt6->tun.flags = 0;
- pkt6->tun.type = htons (0x86dd);
-
- pkt6->ip6_hdr.version = 6;
- pkt6->ip6_hdr.tclass_h = 0;
- pkt6->ip6_hdr.tclass_l = 0;
- pkt6->ip6_hdr.flowlbl = 0;
- pkt6->ip6_hdr.paylgth = pkt->len;
- pkt6->ip6_hdr.nxthdr = IPPROTO_UDP;
- pkt6->ip6_hdr.hoplmt = 0xff;
-
- {
- char *ipv6addr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV6ADDR",
- &ipv6addr));
- inet_pton (AF_INET6, ipv6addr, &pkt6->ip6_hdr.dadr);
- GNUNET_free (ipv6addr);
- }
- memcpy (&pkt6->udp_hdr, pkt, ntohs (pkt->len));
-
- GNUNET_HashCode *key = address6_mapping_exists (&pkt6->ip6_hdr.sadr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
-
- pkt6->udp_hdr.crc = 0;
- uint32_t sum = 0;
-
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.sadr, 16);
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.dadr, 16);
- uint32_t tmp = (pkt6->udp_hdr.len & 0xffff);
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
- tmp = htons (((pkt6->ip6_hdr.nxthdr & 0x00ff)));
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
-
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->udp_hdr,
- ntohs (pkt->len));
- pkt6->udp_hdr.crc = GNUNET_CRYPTO_crc16_finish (sum);
-
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt6->shdr,
- GNUNET_YES,
- NULL, NULL);
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
}
- else
+ if (NULL == ts->heap_node)
{
- size_t size =
- sizeof (struct ip_udp) + ntohs (pkt->len) - 1 - sizeof (struct udp_pkt);
-
- struct ip_udp *pkt4 = alloca (size);
-
- GNUNET_assert (pkt4 != NULL);
-
- GNUNET_assert (ntohs (message->type) ==
- GNUNET_MESSAGE_TYPE_VPN_REMOTE_UDP_BACK);
- uint32_t sadr;
-
- new_ip4addr_remote ((unsigned char *) &sadr, s->addr, s->addrlen);
- pkt4->ip_hdr.sadr.s_addr = sadr;
-
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ if (AF_UNSPEC == ts->af)
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ reply = (const struct GNUNET_EXIT_UdpReplyMessage *) message;
+ mlen -= sizeof (struct GNUNET_EXIT_UdpReplyMessage);
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+
GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Relaying calc:%d gnu:%d udp:%d bytes!\n", size,
- ntohs (message->size), ntohs (pkt->len));
-
- pkt4->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt4->shdr.size = htons (size);
-
- pkt4->tun.flags = 0;
- pkt4->tun.type = htons (0x0800);
-
- pkt4->ip_hdr.version = 4;
- pkt4->ip_hdr.hdr_lngth = 5;
- pkt4->ip_hdr.diff_serv = 0;
- pkt4->ip_hdr.tot_lngth = htons (20 + ntohs (pkt->len));
- pkt4->ip_hdr.ident = 0;
- pkt4->ip_hdr.flags = 0;
- pkt4->ip_hdr.frag_off = 0;
- pkt4->ip_hdr.ttl = 255;
- pkt4->ip_hdr.proto = IPPROTO_UDP;
- pkt4->ip_hdr.chks = 0; /* Will be calculated later */
-
+ "Received UDP reply from mesh, sending %u bytes from %s:%u -> %s:%u via TUN\n",
+ (unsigned int) mlen,
+ inet_ntop (ts->af, &ts->destination_ip, sbuf, sizeof (sbuf)),
+ ts->destination_port,
+ inet_ntop (ts->af, &ts->source_ip, dbuf, sizeof (dbuf)),
+ ts->source_port);
+ }
+ switch (ts->af)
+ {
+ case AF_INET:
{
- char *ipv4addr;
- uint32_t dadr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV4ADDR",
- &ipv4addr));
- inet_pton (AF_INET, ipv4addr, &dadr);
- GNUNET_free (ipv4addr);
- pkt4->ip_hdr.dadr.s_addr = dadr;
+ size_t size = sizeof (struct ip4_header)
+ + sizeof (struct udp_packet)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct tun_header) +
+ mlen;
+ {
+ char buf[size];
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct tun_header *tun = (struct tun_header*) &msg[1];
+ struct ip4_header *ipv4 = (struct ip4_header *) &tun[1];
+ struct udp_packet *udp = (struct udp_packet *) &ipv4[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV4);
+ ipv4->version = 4;
+ ipv4->header_length = sizeof (struct ip4_header) / 4;
+ ipv4->diff_serv = 0;
+ ipv4->total_length = htons (sizeof (struct ip4_header) +
+ sizeof (struct udp_packet) +
+ mlen);
+ ipv4->identification = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+ UINT16_MAX + 1);
+ ipv4->flags = 0;
+ ipv4->fragmentation_offset = 0;
+ ipv4->ttl = 255;
+ ipv4->protocol = IPPROTO_UDP;
+ ipv4->checksum = 0;
+ ipv4->source_address = ts->destination_ip.v4;
+ ipv4->destination_address = ts->source_ip.v4;
+ ipv4->checksum =
+ GNUNET_CRYPTO_crc16_n (ipv4, sizeof (struct ip4_header));
+ if (0 == ntohs (reply->source_port))
+ udp->spt = htons (ts->destination_port);
+ else
+ udp->spt = reply->source_port;
+ if (0 == ntohs (reply->destination_port))
+ udp->dpt = htons (ts->source_port);
+ else
+ udp->dpt = reply->destination_port;
+ udp->len = htons (mlen + sizeof (struct udp_packet));
+ udp->crc = 0; // FIXME: optional, but we might want to calculate this one anyway
+ memcpy (&udp[1],
+ &reply[1],
+ mlen);
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
}
- memcpy (&pkt4->udp_hdr, pkt, ntohs (pkt->len));
-
- GNUNET_HashCode *key = address4_mapping_exists (pkt4->ip_hdr.sadr.s_addr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
-
- pkt4->udp_hdr.crc = 0; /* Optional for IPv4 */
-
- pkt4->ip_hdr.chks =
- GNUNET_CRYPTO_crc16_n ((uint16_t *) & pkt4->ip_hdr, 5 * 4);
-
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt4->shdr,
- GNUNET_YES,
- NULL, NULL);
+ break;
+ case AF_INET6:
+ {
+ size_t size = sizeof (struct ip6_header)
+ + sizeof (struct udp_packet)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct tun_header) +
+ mlen;
+ {
+ char buf[size];
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct tun_header *tun = (struct tun_header*) &msg[1];
+ struct ip6_header *ipv6 = (struct ip6_header *) &tun[1];
+ struct udp_packet *udp = (struct udp_packet *) &ipv6[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV6);
+ ipv6->traffic_class_h = 0;
+ ipv6->version = 6;
+ ipv6->traffic_class_l = 0;
+ ipv6->flow_label = 0;
+ ipv6->payload_length = htons (sizeof (struct udp_packet) + sizeof (struct ip6_header) + mlen);
+ ipv6->next_header = IPPROTO_UDP;
+ ipv6->hop_limit = 255;
+ ipv6->source_address = ts->destination_ip.v6;
+ ipv6->destination_address = ts->source_ip.v6;
+ if (0 == ntohs (reply->source_port))
+ udp->spt = htons (ts->destination_port);
+ else
+ udp->spt = reply->source_port;
+ if (0 == ntohs (reply->destination_port))
+ udp->dpt = htons (ts->source_port);
+ else
+ udp->dpt = reply->destination_port;
+ udp->len = htons (mlen + sizeof (struct udp_packet));
+ udp->crc = 0;
+ memcpy (&udp[1],
+ &reply[1],
+ mlen);
+ {
+ uint32_t sum = 0;
+ sum =
+ GNUNET_CRYPTO_crc16_step (sum, &ipv6->source_address,
+ sizeof (struct in6_addr) * 2);
+ uint32_t tmp = udp->len;
+ sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+ tmp = htons (IPPROTO_UDP);
+ sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+ sum = GNUNET_CRYPTO_crc16_step (sum,
+ udp,
+ ntohs (udp->len));
+ udp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+ }
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
+ }
+ break;
+ default:
+ GNUNET_assert (0);
}
-
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value);
return GNUNET_OK;
}
/**
- * FIXME: document.
+ * We got a TCP packet back from the MESH tunnel. Pass it on to the
+ * local virtual interface via the helper.
+ *
+ * @param cls closure, NULL
+ * @param tunnel connection to the other end
+ * @param tunnel_ctx pointer to our 'struct TunnelState *'
+ * @param sender who sent the message
+ * @param message the actual message
+ * @param atsi performance data for the connection
+ * @return GNUNET_OK to keep the connection open,
+ * GNUNET_SYSERR to close it (signal serious error)
*/
static int
receive_tcp_back (void *cls GNUNET_UNUSED, struct GNUNET_MESH_Tunnel *tunnel,
const struct GNUNET_MessageHeader *message,
const struct GNUNET_ATS_Information *atsi GNUNET_UNUSED)
{
- GNUNET_HashCode *desc = (GNUNET_HashCode *) (message + 1);
- struct remote_addr *s = (struct remote_addr *) desc;
- struct tcp_pkt *pkt = (struct tcp_pkt *) (desc + 1);
- const struct GNUNET_PeerIdentity *other = sender;
- struct tunnel_state *ts = *tunnel_ctx;
-
- size_t pktlen =
- ntohs (message->size) - sizeof (struct GNUNET_MessageHeader) -
- sizeof (GNUNET_HashCode);
-
- GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
- "Received TCP-Packet back, addrlen = %d\n", s->addrlen);
-
- if (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_SERVICE_TCP_BACK ||
- ts->addrlen == 16)
+ struct TunnelState *ts = *tunnel_ctx;
+ const struct GNUNET_EXIT_TcpDataMessage *data;
+ size_t mlen;
+
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# TCP packets received from mesh"),
+ 1, GNUNET_NO);
+ mlen = ntohs (message->size);
+ if (mlen < sizeof (struct GNUNET_EXIT_TcpDataMessage))
{
- size_t size = pktlen + sizeof (struct ip6_tcp) - 1;
-
- struct ip6_tcp *pkt6 = alloca (size);
-
- memset (pkt6, 0, size);
-
- GNUNET_assert (pkt6 != NULL);
-
- if (ntohs (message->type) == GNUNET_MESSAGE_TYPE_VPN_SERVICE_TCP_BACK)
- new_ip6addr (&pkt6->ip6_hdr.sadr, &other->hashPubKey, desc);
- else
- new_ip6addr_remote (&pkt6->ip6_hdr.sadr, s->addr, s->addrlen);
-
- pkt6->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt6->shdr.size = htons (size);
-
- pkt6->tun.flags = 0;
- pkt6->tun.type = htons (0x86dd);
-
- pkt6->ip6_hdr.version = 6;
- pkt6->ip6_hdr.tclass_h = 0;
- pkt6->ip6_hdr.tclass_l = 0;
- pkt6->ip6_hdr.flowlbl = 0;
- pkt6->ip6_hdr.paylgth = htons (pktlen);
- pkt6->ip6_hdr.nxthdr = IPPROTO_TCP;
- pkt6->ip6_hdr.hoplmt = 0xff;
-
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ if (NULL == ts->heap_node)
+ {
+ GNUNET_break_op (0);
+ return GNUNET_SYSERR;
+ }
+ data = (const struct GNUNET_EXIT_TcpDataMessage *) message;
+ mlen -= sizeof (struct GNUNET_EXIT_TcpDataMessage);
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Received TCP reply from mesh, sending %u bytes from %s:%u -> %s:%u via TUN\n",
+ (unsigned int) mlen,
+ inet_ntop (ts->af, &ts->destination_ip, sbuf, sizeof (sbuf)),
+ ts->destination_port,
+ inet_ntop (ts->af, &ts->source_ip, dbuf, sizeof (dbuf)),
+ ts->source_port);
+ }
+ switch (ts->af)
+ {
+ case AF_INET:
{
- char *ipv6addr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV6ADDR",
- &ipv6addr));
- inet_pton (AF_INET6, ipv6addr, &pkt6->ip6_hdr.dadr);
- GNUNET_free (ipv6addr);
+ size_t size = sizeof (struct ip4_header)
+ + sizeof (struct tcp_packet)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct tun_header) +
+ mlen;
+ {
+ char buf[size];
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct tun_header *tun = (struct tun_header*) &msg[1];
+ struct ip4_header *ipv4 = (struct ip4_header *) &tun[1];
+ struct tcp_packet *tcp = (struct tcp_packet *) &ipv4[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV4);
+ ipv4->version = 4;
+ ipv4->header_length = sizeof (struct ip4_header) / 4;
+ ipv4->diff_serv = 0;
+ ipv4->total_length = htons (sizeof (struct ip4_header) +
+ sizeof (struct tcp_packet) +
+ mlen);
+ ipv4->identification = (uint16_t) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+ UINT16_MAX + 1);
+ ipv4->flags = 0;
+ ipv4->fragmentation_offset = 0;
+ ipv4->ttl = 255;
+ ipv4->protocol = IPPROTO_TCP;
+ ipv4->checksum = 0;
+ ipv4->source_address = ts->destination_ip.v4;
+ ipv4->destination_address = ts->source_ip.v4;
+ ipv4->checksum =
+ GNUNET_CRYPTO_crc16_n (ipv4, sizeof (struct ip4_header));
+ *tcp = data->tcp_header;
+ tcp->spt = htons (ts->destination_port);
+ tcp->dpt = htons (ts->source_port);
+ tcp->crc = 0;
+ memcpy (&tcp[1],
+ &data[1],
+ mlen);
+ {
+ uint32_t sum = 0;
+ uint32_t tmp;
+
+ sum = GNUNET_CRYPTO_crc16_step (sum,
+ &ipv4->source_address,
+ 2 * sizeof (struct in_addr));
+ tmp = htonl ((IPPROTO_TCP << 16) | (mlen + sizeof (struct tcp_packet)));
+ sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+ sum = GNUNET_CRYPTO_crc16_step (sum, tcp, mlen + sizeof (struct tcp_packet));
+ tcp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+ }
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
}
- memcpy (&pkt6->tcp_hdr, pkt, pktlen);
-
- GNUNET_HashCode *key = address6_mapping_exists (&pkt6->ip6_hdr.sadr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
+ break;
+ case AF_INET6:
+ {
+ size_t size = sizeof (struct ip6_header)
+ + sizeof (struct tcp_packet)
+ + sizeof (struct GNUNET_MessageHeader) +
+ sizeof (struct tun_header) +
+ mlen;
+ {
+ char buf[size];
+ struct GNUNET_MessageHeader *msg = (struct GNUNET_MessageHeader *) buf;
+ struct tun_header *tun = (struct tun_header*) &msg[1];
+ struct ip6_header *ipv6 = (struct ip6_header *) &tun[1];
+ struct tcp_packet *tcp = (struct tcp_packet *) &ipv6[1];
+ msg->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
+ msg->size = htons (size);
+ tun->flags = htons (0);
+ tun->proto = htons (ETH_P_IPV6);
+ ipv6->traffic_class_h = 0;
+ ipv6->version = 6;
+ ipv6->traffic_class_l = 0;
+ ipv6->flow_label = 0;
+ ipv6->payload_length = htons (sizeof (struct tcp_packet) + sizeof (struct ip6_header) + mlen);
+ ipv6->next_header = IPPROTO_TCP;
+ ipv6->hop_limit = 255;
+ ipv6->source_address = ts->destination_ip.v6;
+ ipv6->destination_address = ts->source_ip.v6;
+ tcp->spt = htons (ts->destination_port);
+ tcp->dpt = htons (ts->source_port);
+ tcp->crc = 0;
+ {
+ uint32_t sum = 0;
+ uint32_t tmp;
+
+ sum = GNUNET_CRYPTO_crc16_step (sum, &ipv6->source_address, 2 * sizeof (struct in6_addr));
+ tmp = htonl (sizeof (struct tcp_packet) + mlen);
+ sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+ tmp = htonl (IPPROTO_TCP);
+ sum = GNUNET_CRYPTO_crc16_step (sum, &tmp, sizeof (uint32_t));
+ sum = GNUNET_CRYPTO_crc16_step (sum, tcp,
+ sizeof (struct tcp_packet) + mlen);
+ tcp->crc = GNUNET_CRYPTO_crc16_finish (sum);
+ }
+ (void) GNUNET_HELPER_send (helper_handle,
+ msg,
+ GNUNET_YES,
+ NULL, NULL);
+ }
+ }
+ break;
+ }
+ GNUNET_CONTAINER_heap_update_cost (tunnel_heap,
+ ts->heap_node,
+ GNUNET_TIME_absolute_get ().abs_value);
+ return GNUNET_OK;
+}
- GNUNET_free (key);
- GNUNET_assert (me != NULL);
+/**
+ * Allocate an IPv4 address from the range of the tunnel
+ * for a new redirection.
+ *
+ * @param v4 where to store the address
+ * @return GNUNET_OK on success,
+ * GNUNET_SYSERR on error
+ */
+static int
+allocate_v4_address (struct in_addr *v4)
+{
+ const char *ipv4addr = vpn_argv[4];
+ const char *ipv4mask = vpn_argv[5];
+ struct in_addr addr;
+ struct in_addr mask;
+ struct in_addr rnd;
+ GNUNET_HashCode key;
+ unsigned int tries;
+
+ GNUNET_assert (1 == inet_pton (AF_INET, ipv4addr, &addr));
+ GNUNET_assert (1 == inet_pton (AF_INET, ipv4mask, &mask));
+ /* Given 192.168.0.1/255.255.0.0, we want a mask
+ of '192.168.255.255', thus: */
+ mask.s_addr = addr.s_addr | ~mask.s_addr;
+ tries = 0;
+ do
+ {
+ tries++;
+ if (tries > 16)
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ _("Failed to find unallocated IPv4 address in VPN's range\n"));
+ return GNUNET_SYSERR;
+ }
+ /* Pick random IPv4 address within the subnet, except 'addr' or 'mask' itself */
+ rnd.s_addr = GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+ UINT32_MAX);
+ v4->s_addr = (addr.s_addr | rnd.s_addr) & mask.s_addr;
+ get_destination_key_from_ip (AF_INET,
+ v4,
+ &key);
+ }
+ while ( (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_contains (destination_map,
+ &key)) ||
+ (v4->s_addr == addr.s_addr) ||
+ (v4->s_addr == mask.s_addr) );
+ return GNUNET_OK;
+}
- pkt6->tcp_hdr.crc = 0;
- uint32_t sum = 0;
- uint32_t tmp;
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.sadr, 16);
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->ip6_hdr.dadr, 16);
- tmp = htonl (pktlen);
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
- tmp = htonl (((pkt6->ip6_hdr.nxthdr & 0x000000ff)));
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
+/**
+ * Allocate an IPv6 address from the range of the tunnel
+ * for a new redirection.
+ *
+ * @param v6 where to store the address
+ * @return GNUNET_OK on success,
+ * GNUNET_SYSERR on error
+ */
+static int
+allocate_v6_address (struct in6_addr *v6)
+{
+ const char *ipv6addr = vpn_argv[2];
+ struct in6_addr addr;
+ struct in6_addr mask;
+ struct in6_addr rnd;
+ int i;
+ GNUNET_HashCode key;
+ unsigned int tries;
+
+ GNUNET_assert (1 == inet_pton (AF_INET6, ipv6addr, &addr));
+ GNUNET_assert (ipv6prefix < 128);
+ /* Given ABCD::/96, we want a mask of 'ABCD::FFFF:FFFF,
+ thus: */
+ mask = addr;
+ for (i=127;i>=128-ipv6prefix;i--)
+ mask.s6_addr[i / 8] |= (1 << (i % 8));
+
+ /* Pick random IPv6 address within the subnet, except 'addr' or 'mask' itself */
+ tries = 0;
+ do
+ {
+ tries++;
+ if (tries > 16)
+ {
+ GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
+ _("Failed to find unallocated IPv6 address in VPN's range\n"));
+ return GNUNET_SYSERR;
+
+ }
+ for (i=0;i<16;i++)
+ {
+ rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (GNUNET_CRYPTO_QUALITY_WEAK,
+ 256);
+ v6->s6_addr[i]
+ = (addr.s6_addr[i] | rnd.s6_addr[i]) & mask.s6_addr[i];
+ }
+ get_destination_key_from_ip (AF_INET6,
+ v6,
+ &key);
+ }
+ while ( (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_contains (destination_map,
+ &key)) ||
+ (0 == memcmp (v6,
+ &addr,
+ sizeof (struct in6_addr))) ||
+ (0 == memcmp (v6,
+ &mask,
+ sizeof (struct in6_addr))) );
+ return GNUNET_OK;
+}
- sum =
- GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt6->tcp_hdr,
- ntohs (pkt6->ip6_hdr.paylgth));
- pkt6->tcp_hdr.crc = GNUNET_CRYPTO_crc16_finish (sum);
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt6->shdr,
- GNUNET_YES,
- NULL, NULL);
+/**
+ * Free resources occupied by a destination entry.
+ *
+ * @param de entry to free
+ */
+static void
+free_destination_entry (struct DestinationEntry *de)
+{
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Cleaning up destination entry\n");
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active destinations"),
+ -1, GNUNET_NO);
+ if (NULL != de->ts)
+ {
+ free_tunnel_state (de->ts);
+ GNUNET_assert (NULL == de->ts);
}
- else
+ if (NULL != de->heap_node)
{
- size_t size = pktlen + sizeof (struct ip_tcp) - 1;
-
- struct ip_tcp *pkt4 = alloca (size);
-
- GNUNET_assert (pkt4 != NULL);
- memset (pkt4, 0, size);
-
- GNUNET_assert (ntohs (message->type) ==
- GNUNET_MESSAGE_TYPE_VPN_REMOTE_TCP_BACK);
- uint32_t sadr;
+ GNUNET_CONTAINER_heap_remove_node (de->heap_node);
+ de->heap_node = NULL;
+ GNUNET_assert (GNUNET_YES ==
+ GNUNET_CONTAINER_multihashmap_remove (destination_map,
+ &de->key,
+ de));
+ }
+ GNUNET_free (de);
+}
- new_ip4addr_remote ((unsigned char *) &sadr, s->addr, s->addrlen);
- pkt4->ip_hdr.sadr.s_addr = sadr;
- pkt4->shdr.type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
- pkt4->shdr.size = htons (size);
+/**
+ * We have too many active destinations. Clean up the oldest destination.
+ *
+ * @param except destination that must NOT be cleaned up, even if it is the oldest
+ */
+static void
+expire_destination (struct DestinationEntry *except)
+{
+ struct DestinationEntry *de;
- pkt4->tun.flags = 0;
- pkt4->tun.type = htons (0x0800);
+ de = GNUNET_CONTAINER_heap_peek (destination_heap);
+ if (except == de)
+ return; /* can't do this */
+ free_destination_entry (de);
+}
- pkt4->ip_hdr.version = 4;
- pkt4->ip_hdr.hdr_lngth = 5;
- pkt4->ip_hdr.diff_serv = 0;
- pkt4->ip_hdr.tot_lngth = htons (20 + pktlen);
- pkt4->ip_hdr.ident = 0;
- pkt4->ip_hdr.flags = 0;
- pkt4->ip_hdr.frag_off = 0;
- pkt4->ip_hdr.ttl = 255;
- pkt4->ip_hdr.proto = IPPROTO_TCP;
- pkt4->ip_hdr.chks = 0; /* Will be calculated later */
+/**
+ * A client asks us to setup a redirection via some exit
+ * node to a particular IP. Setup the redirection and
+ * give the client the allocated IP.
+ *
+ * @param cls unused
+ * @param client requesting client
+ * @param message redirection request (a 'struct RedirectToIpRequestMessage')
+ */
+static void
+service_redirect_to_ip (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
+ const struct GNUNET_MessageHeader *message)
+{
+ size_t mlen;
+ size_t alen;
+ const struct RedirectToIpRequestMessage *msg;
+ int addr_af;
+ int result_af;
+ struct in_addr v4;
+ struct in6_addr v6;
+ void *addr;
+ struct DestinationEntry *de;
+ GNUNET_HashCode key;
+
+ /* validate and parse request */
+ mlen = ntohs (message->size);
+ if (mlen < sizeof (struct RedirectToIpRequestMessage))
+ {
+ GNUNET_break (0);
+ GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+ return;
+ }
+ alen = mlen - sizeof (struct RedirectToIpRequestMessage);
+ msg = (const struct RedirectToIpRequestMessage *) message;
+ addr_af = (int) htonl (msg->addr_af);
+ switch (addr_af)
+ {
+ case AF_INET:
+ if (alen != sizeof (struct in_addr))
{
- char *ipv4addr;
- uint32_t dadr;
-
- GNUNET_assert (GNUNET_OK ==
- GNUNET_CONFIGURATION_get_value_string (cfg, "vpn",
- "IPV4ADDR",
- &ipv4addr));
- inet_pton (AF_INET, ipv4addr, &dadr);
- GNUNET_free (ipv4addr);
- pkt4->ip_hdr.dadr.s_addr = dadr;
+ GNUNET_break (0);
+ GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+ return;
}
+ break;
+ case AF_INET6:
+ if (alen != sizeof (struct in6_addr))
+ {
+ GNUNET_break (0);
+ GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+ return;
+ }
+ break;
+ default:
+ GNUNET_break (0);
+ GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+ return;
+ }
- memcpy (&pkt4->tcp_hdr, pkt, pktlen);
-
- GNUNET_HashCode *key = address4_mapping_exists (pkt4->ip_hdr.sadr.s_addr);
-
- GNUNET_assert (key != NULL);
-
- struct map_entry *me = GNUNET_CONTAINER_multihashmap_get (hashmap, key);
-
- GNUNET_CONTAINER_heap_update_cost (heap, me->heap_node,
- GNUNET_TIME_absolute_get ().abs_value);
-
- GNUNET_free (key);
-
- GNUNET_assert (me != NULL);
- pkt4->tcp_hdr.crc = 0;
- uint32_t sum = 0;
- uint32_t tmp;
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) &pkt4->ip_hdr.sadr, 4);
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) &pkt4->ip_hdr.dadr, 4);
-
- tmp = (0x06 << 16) | (0xffff & pktlen); // 0x06 for TCP?
-
- tmp = htonl (tmp);
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & tmp, 4);
-
- sum = GNUNET_CRYPTO_crc16_step (sum, (uint16_t *) & pkt4->tcp_hdr, pktlen);
- pkt4->tcp_hdr.crc = GNUNET_CRYPTO_crc16_finish (sum);
+ /* allocate response IP */
+ addr = NULL;
+ result_af = (int) htonl (msg->result_af);
+ switch (result_af)
+ {
+ case AF_INET:
+ if (GNUNET_OK !=
+ allocate_v4_address (&v4))
+ result_af = AF_UNSPEC;
+ else
+ addr = &v4;
+ break;
+ case AF_INET6:
+ if (GNUNET_OK !=
+ allocate_v6_address (&v6))
+ result_af = AF_UNSPEC;
+ else
+ addr = &v6;
+ break;
+ case AF_UNSPEC:
+ if (GNUNET_OK ==
+ allocate_v4_address (&v4))
+ {
+ addr = &v4;
+ result_af = AF_INET;
+ }
+ else if (GNUNET_OK ==
+ allocate_v6_address (&v6))
+ {
+ addr = &v6;
+ result_af = AF_INET6;
+ }
+ break;
+ default:
+ GNUNET_break (0);
+ GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+ return;
+ }
+ if ( (result_af == AF_UNSPEC) ||
+ (GNUNET_NO == ntohl (msg->nac)) )
+ {
+ /* send reply "instantly" */
+ send_client_reply (client,
+ msg->request_id,
+ result_af,
+ addr);
+ }
+ if (result_af == AF_UNSPEC)
+ {
+ /* failure, we're done */
+ GNUNET_SERVER_receive_done (client, GNUNET_OK);
+ return;
+ }
- pkt4->ip_hdr.chks =
- GNUNET_CRYPTO_crc16_n ((uint16_t *) & pkt4->ip_hdr, 5 * 4);
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+ char dbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Allocated address %s for redirection via exit to %s\n",
+ inet_ntop (result_af, addr, sbuf, sizeof (sbuf)),
+ inet_ntop (addr_af,
+ &msg[1], dbuf, sizeof (dbuf)));
+ }
+
+ /* setup destination record */
+ de = GNUNET_malloc (sizeof (struct DestinationEntry));
+ de->is_service = GNUNET_NO;
+ de->details.exit_destination.af = addr_af;
+ memcpy (&de->details.exit_destination.ip,
+ &msg[1],
+ alen);
+ get_destination_key_from_ip (result_af,
+ addr,
+ &key);
+ de->key = key;
+ GNUNET_assert (GNUNET_OK ==
+ GNUNET_CONTAINER_multihashmap_put (destination_map,
+ &key,
+ de,
+ GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+ de->heap_node = GNUNET_CONTAINER_heap_insert (destination_heap,
+ de,
+ GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value);
+ GNUNET_STATISTICS_update (stats,
+ gettext_noop ("# Active destinations"),
+ 1, GNUNET_NO);
+ while (GNUNET_CONTAINER_multihashmap_size (destination_map) > max_destination_mappings)
+ expire_destination (de);
+
+ /* setup tunnel to destination */
+ (void) create_tunnel_to_destination (de,
+ (GNUNET_NO == ntohl (msg->nac)) ? NULL : client,
+ msg->request_id);
+ GNUNET_assert (NULL != de->ts);
+ /* we're done */
+ GNUNET_SERVER_receive_done (client, GNUNET_OK);
+}
- (void) GNUNET_HELPER_send (helper_handle,
- &pkt4->shdr,
- GNUNET_YES,
- NULL, NULL);
+/**
+ * A client asks us to setup a redirection to a particular peer
+ * offering a service. Setup the redirection and give the client the
+ * allocated IP.
+ *
+ * @param cls unused
+ * @param client requesting client
+ * @param message redirection request (a 'struct RedirectToPeerRequestMessage')
+ */
+static void
+service_redirect_to_service (void *cls GNUNET_UNUSED, struct GNUNET_SERVER_Client *client,
+ const struct GNUNET_MessageHeader *message)
+{
+ const struct RedirectToServiceRequestMessage *msg;
+ int result_af;
+ struct in_addr v4;
+ struct in6_addr v6;
+ void *addr;
+ struct DestinationEntry *de;
+ GNUNET_HashCode key;
+
+ /* parse request */
+ msg = (const struct RedirectToServiceRequestMessage *) message;
+
+ /* allocate response IP */
+ addr = NULL;
+ result_af = (int) htonl (msg->result_af);
+ switch (result_af)
+ {
+ case AF_INET:
+ if (GNUNET_OK !=
+ allocate_v4_address (&v4))
+ result_af = AF_UNSPEC;
+ else
+ addr = &v4;
+ break;
+ case AF_INET6:
+ if (GNUNET_OK !=
+ allocate_v6_address (&v6))
+ result_af = AF_UNSPEC;
+ else
+ addr = &v6;
+ break;
+ case AF_UNSPEC:
+ if (GNUNET_OK ==
+ allocate_v4_address (&v4))
+ {
+ addr = &v4;
+ result_af = AF_INET;
+ }
+ else if (GNUNET_OK ==
+ allocate_v6_address (&v6))
+ {
+ addr = &v6;
+ result_af = AF_INET6;
+ }
+ break;
+ default:
+ GNUNET_break (0);
+ GNUNET_SERVER_receive_done (client, GNUNET_SYSERR);
+ return;
+ }
+ if ( (result_af == AF_UNSPEC) ||
+ (GNUNET_NO == ntohl (msg->nac)) )
+ {
+ /* send reply "instantly" */
+ send_client_reply (client,
+ msg->request_id,
+ result_af,
+ addr);
+ }
+ if (result_af == AF_UNSPEC)
+ {
+ /* failure, we're done */
+ GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
+ _("Failed to allocate IP address for new destination\n"));
+ GNUNET_SERVER_receive_done (client, GNUNET_OK);
+ return;
}
- return GNUNET_OK;
+ {
+ char sbuf[INET6_ADDRSTRLEN];
+
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "Allocated address %s for redirection to service %s on peer %s\n",
+ inet_ntop (result_af, addr, sbuf, sizeof (sbuf)),
+ GNUNET_h2s (&msg->service_descriptor),
+ GNUNET_i2s (&msg->target));
+ }
+
+ /* setup destination record */
+ de = GNUNET_malloc (sizeof (struct DestinationEntry));
+ de->is_service = GNUNET_YES;
+ de->details.service_destination.service_descriptor = msg->service_descriptor;
+ de->details.service_destination.target = msg->target;
+ get_destination_key_from_ip (result_af,
+ addr,
+ &key);
+ de->key = key;
+ GNUNET_assert (GNUNET_OK ==
+ GNUNET_CONTAINER_multihashmap_put (destination_map,
+ &key,
+ de,
+ GNUNET_CONTAINER_MULTIHASHMAPOPTION_MULTIPLE));
+ de->heap_node = GNUNET_CONTAINER_heap_insert (destination_heap,
+ de,
+ GNUNET_TIME_absolute_ntoh (msg->expiration_time).abs_value);
+ while (GNUNET_CONTAINER_multihashmap_size (destination_map) > max_destination_mappings)
+ expire_destination (de);
+ (void) create_tunnel_to_destination (de,
+ (GNUNET_NO == ntohl (msg->nac)) ? NULL : client,
+ msg->request_id);
+ /* we're done */
+ GNUNET_SERVER_receive_done (client, GNUNET_OK);
}
+
/**
- * FIXME: document.
+ * Function called for inbound tunnels. As we don't offer
+ * any mesh services, this function should never be called.
+ *
+ * @param cls closure
+ * @param tunnel new handle to the tunnel
+ * @param initiator peer that started the tunnel
+ * @param atsi performance information for the tunnel
+ * @return initial tunnel context for the tunnel
+ * (can be NULL -- that's not an error)
*/
static void *
-new_tunnel (void *cls, struct GNUNET_MESH_Tunnel *tunnel,
- const struct GNUNET_PeerIdentity *initiator,
- const struct GNUNET_ATS_Information *atsi)
+inbound_tunnel_cb (void *cls, struct GNUNET_MESH_Tunnel *tunnel,
+ const struct GNUNET_PeerIdentity *initiator,
+ const struct GNUNET_ATS_Information *atsi)
{
- /* Why should anyone open an inbound tunnel to vpn? */
+ /* How can and why should anyone open an inbound tunnel to vpn? */
GNUNET_break (0);
return NULL;
}
/**
- * FIXME: document.
+ * Function called whenever an inbound tunnel is destroyed. Should clean up
+ * any associated state.
+ *
+ * @param cls closure (set from GNUNET_MESH_connect)
+ * @param tunnel connection to the other end (henceforth invalid)
+ * @param tunnel_ctx place where local state associated
+ * with the tunnel is stored (our 'struct TunnelState')
*/
static void
tunnel_cleaner (void *cls, const struct GNUNET_MESH_Tunnel *tunnel, void *tunnel_ctx)
{
- /* Why should anyone open an inbound tunnel to vpn? */
- /* FIXME: is this not also called for outbound tunnels that go down!? */
- GNUNET_break (0);
+ struct TunnelState *ts = tunnel_ctx;
+
+ if (NULL == ts)
+ {
+ GNUNET_break (0);
+ return;
+ }
+ GNUNET_assert (ts->tunnel == tunnel);
+ ts->tunnel = NULL;
+ free_tunnel_state (ts);
+}
+
+
+/**
+ * Free memory occupied by an entry in the destination map.
+ *
+ * @param cls unused
+ * @param key unused
+ * @param value a 'struct DestinationEntry *'
+ * @return GNUNET_OK (continue to iterate)
+ */
+static int
+cleanup_destination (void *cls,
+ const GNUNET_HashCode *key,
+ void *value)
+{
+ struct DestinationEntry *de = value;
+
+ free_destination_entry (de);
+ return GNUNET_OK;
+}
+
+
+/**
+ * Free memory occupied by an entry in the tunnel map.
+ *
+ * @param cls unused
+ * @param key unused
+ * @param value a 'struct TunnelState *'
+ * @return GNUNET_OK (continue to iterate)
+ */
+static int
+cleanup_tunnel (void *cls,
+ const GNUNET_HashCode *key,
+ void *value)
+{
+ struct TunnelState *ts = value;
+
+ free_tunnel_state (ts);
+ return GNUNET_OK;
}
/**
* Function scheduled as very last function, cleans up after us
+ *
+ * @param cls unused
+ * @param tc unused
*/
static void
cleanup (void *cls GNUNET_UNUSED,
- const struct GNUNET_SCHEDULER_TaskContext *tskctx)
+ const struct GNUNET_SCHEDULER_TaskContext *tc)
{
unsigned int i;
- if (mesh_handle != NULL)
+ GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
+ "VPN is shutting down\n");
+ if (NULL != destination_map)
+ {
+ GNUNET_CONTAINER_multihashmap_iterate (destination_map,
+ &cleanup_destination,
+ NULL);
+ GNUNET_CONTAINER_multihashmap_destroy (destination_map);
+ destination_map = NULL;
+ }
+ if (NULL != destination_heap)
+ {
+ GNUNET_CONTAINER_heap_destroy (destination_heap);
+ destination_heap = NULL;
+ }
+ if (NULL != tunnel_map)
+ {
+ GNUNET_CONTAINER_multihashmap_iterate (tunnel_map,
+ &cleanup_tunnel,
+ NULL);
+ GNUNET_CONTAINER_multihashmap_destroy (tunnel_map);
+ tunnel_map = NULL;
+ }
+ if (NULL != tunnel_heap)
+ {
+ GNUNET_CONTAINER_heap_destroy (tunnel_heap);
+ tunnel_heap = NULL;
+ }
+ if (NULL != mesh_handle)
{
GNUNET_MESH_disconnect (mesh_handle);
mesh_handle = NULL;
}
- if (helper_handle != NULL)
- {
+ if (NULL != helper_handle)
+ {
GNUNET_HELPER_stop (helper_handle);
helper_handle = NULL;
}
+ if (NULL != nc)
+ {
+ GNUNET_SERVER_notification_context_destroy (nc);
+ nc = NULL;
+ }
+ if (stats != NULL)
+ {
+ GNUNET_STATISTICS_destroy (stats, GNUNET_YES);
+ stats = NULL;
+ }
for (i=0;i<5;i++)
GNUNET_free_non_null (vpn_argv[i]);
}
+/**
+ * A client disconnected, clean up all references to it.
+ *
+ * @param cls the client that disconnected
+ * @param key unused
+ * @param value a 'struct TunnelState *'
+ * @return GNUNET_OK (continue to iterate)
+ */
+static int
+cleanup_tunnel_client (void *cls,
+ const GNUNET_HashCode *key,
+ void *value)
+{
+ struct GNUNET_SERVER_Client *client = cls;
+ struct TunnelState *ts = value;
+
+ if (client == ts->client)
+ {
+ GNUNET_SERVER_client_drop (ts->client);
+ ts->client = NULL;
+ }
+ return GNUNET_OK;
+}
+
+
+/**
+ * A client disconnected, clean up all references to it.
+ *
+ * @param cls the client that disconnected
+ * @param key unused
+ * @param value a 'struct DestinationEntry *'
+ * @return GNUNET_OK (continue to iterate)
+ */
+static int
+cleanup_destination_client (void *cls,
+ const GNUNET_HashCode *key,
+ void *value)
+{
+ struct GNUNET_SERVER_Client *client = cls;
+ struct DestinationEntry *de = value;
+ struct TunnelState *ts;
+
+ if (NULL == (ts = de->ts))
+ return GNUNET_OK;
+ if (client == ts->client)
+ {
+ GNUNET_SERVER_client_drop (ts->client);
+ ts->client = NULL;
+ }
+ return GNUNET_OK;
+}
+
+
+/**
+ * A client has disconnected from us. If we are currently building
+ * a tunnel for it, cancel the operation.
+ *
+ * @param cls unused
+ * @param client handle to the client that disconnected
+ */
+static void
+client_disconnect (void *cls, struct GNUNET_SERVER_Client *client)
+{
+ if (NULL != tunnel_map)
+ GNUNET_CONTAINER_multihashmap_iterate (tunnel_map,
+ &cleanup_tunnel_client,
+ client);
+ if (NULL != destination_map)
+ GNUNET_CONTAINER_multihashmap_iterate (destination_map,
+ &cleanup_destination_client,
+ client);
+}
+
+
/**
* Main function that will be run by the scheduler.
*
struct GNUNET_SERVER_Handle *server,
const struct GNUNET_CONFIGURATION_Handle *cfg_)
{
- static const struct GNUNET_MESH_MessageHandler handlers[] = {
+ static const struct GNUNET_SERVER_MessageHandler service_handlers[] = {
+ /* callback, cls, type, size */
+ {&service_redirect_to_ip, NULL, GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_IP, 0},
+ {&service_redirect_to_service, NULL,
+ GNUNET_MESSAGE_TYPE_VPN_CLIENT_REDIRECT_TO_SERVICE,
+ sizeof (struct RedirectToServiceRequestMessage) },
+ {NULL, NULL, 0, 0}
+ };
+ static const struct GNUNET_MESH_MessageHandler mesh_handlers[] = {
{receive_udp_back, GNUNET_MESSAGE_TYPE_VPN_SERVICE_UDP_BACK, 0},
{receive_tcp_back, GNUNET_MESSAGE_TYPE_VPN_SERVICE_TCP_BACK, 0},
{receive_udp_back, GNUNET_MESSAGE_TYPE_VPN_REMOTE_UDP_BACK, 0},
char *ipv4mask;
struct in_addr v4;
struct in6_addr v6;
- unsigned long long ipv6prefix;
cfg = cfg_;
- hashmap = GNUNET_CONTAINER_multihashmap_create (65536);
- heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
-
+ stats = GNUNET_STATISTICS_create ("vpn", cfg);
if (GNUNET_OK !=
GNUNET_CONFIGURATION_get_value_number (cfg, "vpn", "MAX_MAPPING",
- &max_mappings))
- max_mappings = 200;
+ &max_destination_mappings))
+ max_destination_mappings = 200;
+ if (GNUNET_OK !=
+ GNUNET_CONFIGURATION_get_value_number (cfg, "vpn", "MAX_TUNNELS",
+ &max_tunnel_mappings))
+ max_tunnel_mappings = 200;
+
+ destination_map = GNUNET_CONTAINER_multihashmap_create (max_destination_mappings * 2);
+ destination_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
+ tunnel_map = GNUNET_CONTAINER_multihashmap_create (max_tunnel_mappings * 2);
+ tunnel_heap = GNUNET_CONTAINER_heap_create (GNUNET_CONTAINER_HEAP_ORDER_MIN);
+
vpn_argv[0] = GNUNET_strdup ("vpn-gnunet");
if (GNUNET_SYSERR ==
mesh_handle =
GNUNET_MESH_connect (cfg_, 42 /* queue length */, NULL,
- &new_tunnel,
+ &inbound_tunnel_cb,
&tunnel_cleaner,
- handlers,
+ mesh_handlers,
types);
helper_handle = GNUNET_HELPER_start ("gnunet-helper-vpn", vpn_argv,
&message_token, NULL);
+ nc = GNUNET_SERVER_notification_context_create (server, 1);
+ GNUNET_SERVER_add_handlers (server, service_handlers);
+ GNUNET_SERVER_disconnect_notify (server, &client_disconnect, NULL);
GNUNET_SCHEDULER_add_delayed (GNUNET_TIME_UNIT_FOREVER_REL, &cleanup, cls);
}
projects / oweals / gnunet.git / blobdiff