1 // This program is a UDP based tunneling of stdin/out Ethernet packets.
3 // A rrqnet program is a bi-directional networking plug that channels
4 // packets between a UDP port and stdin/out. It is configured on the
5 // command line with channel rules that declares which remotes it may
6 // communicate with. Allowed remotes are specified in the format
7 // "ip[/n][:port][=key]", to indicate which subnet and port to accept,
8 // and nominating the associated keyfile to use for channel
11 // The program maintains a table of actualized connections, as an
12 // association between MAC addresses and IP:port addresses. This table
13 // is used for resolving destination for outgoing packets, including
14 // the forwarding of broadcasts.
20 #include <linux/if_tun.h>
25 #include <sys/ioctl.h>
28 #include <sys/types.h>
29 #include <sys/socket.h>
38 // "Private Shared Key" details.
41 unsigned int seed; // Encryption seed
42 unsigned char *key; // Encryption key
43 unsigned int key_length; // Encryption key length
46 // Compacted IP address ipv4/ipv6
48 int width; // 4=ipv4 and 16=ipv6
50 unsigned char bytes[16];
56 // Details of channel rules.
58 char *source; // Orginal rule
60 unsigned int bits; // Bits of IP prefix
61 unsigned short port; // Port (0=any)
62 struct PSK psk; // Associated key
63 htable ignored_mac; // MAC to ignore by this spec
66 // Details of actualized connections.
68 struct SockAddr uaddr; // The remote IP address
69 struct SockAddr laddr; // The local IP for this remote
70 int ifindex; // The local interface index
71 struct Allowed *spec; // Rule being instantiated
72 struct timeval rec_when; // Last received packet time, in seconds
75 // Details of an interface at a remote.
77 unsigned char mac[6]; // MAC address used last (key for by_mac table)
78 struct timeval rec_when; // Last packet time, in seconds
79 struct Remote *remote;
82 // Maximal packet size .. allow for jumbo frames (9000)
85 typedef struct _PacketItem {
88 struct SockAddr src; // the remote IP for this packet
90 struct in_pktinfo in4;
91 struct in6_pktinfo in6;
92 } dstinfo; // The PKTINFO for this packet
94 unsigned char buffer[ BUFSIZE ];
97 typedef struct _ReaderData {
101 // heartbeat interval, in seconds
103 #define HEARTBEAT_MICROS ( HEARTBEAT * 1000000 )
105 // Macros for timing, for struct timeval variables
106 #define TIME_MICROS(TM) (((int64_t) (TM)->tv_sec * 1000000) + (TM)->tv_usec )
107 #define DIFF_MICROS(TM1,TM2) ( TIME_MICROS(TM1) - TIME_MICROS(TM2) )
109 // RECENT_MICROS(T,M) is the time logic for requiring a gap time (in
110 // milliseconds) before shifting a MAC to a new remote. The limit is
111 // 6s for broadcast and 20s for unicast.
112 #define RECENT_MICROS(T,M) ((M) < ((T)? 6000000 : 20000000 ))
114 // VERYOLD_MICROSS is used for discarding downlink remotes whose latest
115 // activity is older than this.
116 #define VERYOLD_MICROS 180000000
120 // Allowed remote specs are held in a table sorted by IP prefix.
122 struct Allowed **table;
126 // Actual remotes are kept in a hash table keyed by their +uaddr+
127 // field, and another hash table keps Interface records for all MAC
128 // addresses sourced from some remote, keyed by their +mac+ field. The
129 // latter is used both for resolving destinations for outgoing
130 // packets, and for limiting broadcast cycles. The former table is
131 // used for limiting incoming packets to allowed sources, and then
132 // decrypt the payload accordingly.
133 static int hashcode_uaddr(struct _htable *table,unsigned char *key);
134 static int hashcode_mac(struct _htable *table,unsigned char *key);
136 htable by_mac; // struct Interface hash table
137 htable by_addr; // struct Remote hash table
139 .by_mac = HTABLEINIT( struct Interface, mac, hashcode_mac ),
140 .by_addr = HTABLEINIT( struct Remote, uaddr, hashcode_uaddr )
143 #define Interface_LOCK if ( pthread_mutex_lock( &remotes.by_mac.lock ) ) { \
144 perror( "FATAL" ); exit( 1 ); }
146 #define Interface_UNLOCK if (pthread_mutex_unlock( &remotes.by_mac.lock ) ) { \
147 perror( "FATAL" ); exit( 1 ); }
149 #define Interface_FIND(m,r) \
150 htfind( &remotes.by_mac, m, (unsigned char **)&r )
152 #define Interface_ADD(r) \
153 htadd( &remotes.by_mac, (unsigned char *)r )
155 #define Interface_DEL(r) \
156 htdelete( &remotes.by_mac, (unsigned char *) r )
158 #define Remote_LOCK if ( pthread_mutex_lock( &remotes.by_addr.lock ) ) { \
159 perror( "FATAL" ); exit( 1 ); }
161 #define Remote_UNLOCK if ( pthread_mutex_unlock( &remotes.by_addr.lock ) ) { \
162 perror( "FATAL" ); exit( 1 ); }
164 #define Remote_FIND(a,r) \
165 htfind( &remotes.by_addr, (unsigned char *)a, (unsigned char **) &r )
167 #define Remote_ADD(r) \
168 htadd( &remotes.by_addr, (unsigned char *) r )
170 #define Remote_DEL(r) \
171 htdelete( &remotes.by_addr, (unsigned char *) r )
173 #define Ignored_FIND(a,m,x) \
174 htfind( &a->ignored_mac, m, (unsigned char **)&x )
176 #define Ignored_ADD(a,x) \
177 htadd( &a->ignored_mac, (unsigned char *)x )
180 static int stdio = 0; // Default is neither stdio nor tap
181 static char *tap = 0; // Name of tap, if any, or "-" for stdio
182 static int tap_fd = 0; // Also used for stdin in stdio mode
185 static int threads_count = 0;
186 static int buffers_count = 0;
188 // Setup for multicast channel
190 struct ip_mreqn group;
191 struct SockAddr sock;
196 // Flag to signal the UDP socket as being ipv6 or not (forced ipv4)
199 // The given UDP source address, if any
202 unsigned char address[16];
205 // Flag to indicate tpg transport patch = avoid UDP payload of 1470
206 // bytes by adding 2 tag-along bytes
207 static int tpg_quirk = 0;
209 // Flag whether to make some stderr outputs or not.
210 // 1 = normal verbosity, 2 = more output, 3 = source debug level stuff
213 // Note: allows a thread to lock/unlock recursively
214 static pthread_mutex_t crypting = PTHREAD_MUTEX_INITIALIZER;
216 // Note: allows a thread to lock/unlock recursively
217 static pthread_mutex_t printing = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
220 if ( pthread_mutex_lock( &printing ) ) { perror( "FATAL" ); exit(1); }
222 #define PRINTUNLOCK \
223 if ( pthread_mutex_unlock( &printing ) ) { perror( "FATAL" ); exit(1); }
225 #define PRINT( X ) { PRINTLOCK; X; PRINTUNLOCK; }
227 #define VERBOSEOUT(fmt, ...) \
228 if ( verbose >= 1 ) PRINT( fprintf( stderr, fmt, ##__VA_ARGS__ ) )
230 #define VERBOSE2OUT(fmt, ...) \
231 if ( verbose >= 2 ) PRINT( fprintf( stderr, fmt, ##__VA_ARGS__ ) )
233 #define VERBOSE3OUT(fmt, ...) \
234 if ( verbose >= 3 ) PRINT( fprintf( stderr, fmt, ##__VA_ARGS__ ) )
236 // The actual name of this program (argv[0])
237 static unsigned char *progname;
239 // Compute a hashcode for the given SockAddr key
240 static int hashcode_uaddr(
241 __attribute__((unused)) struct _htable *table,unsigned char *key)
243 struct SockAddr *s = (struct SockAddr *) key;
244 key = (unsigned char*) &s->in;
245 unsigned char *e = key + ( ( s->in.sa_family == AF_INET )?
246 sizeof( struct sockaddr_in ) :
247 sizeof( struct sockaddr_in6 ) );
255 // Compute a hashcode for the given MAC addr key
256 static int hashcode_mac(struct _htable *table,unsigned char *key) {
259 if ( table->size == 256 ) {
260 for ( ; i < 6; i++ ) {
265 uint16_t *p = (uint16_t *) key;
266 for ( ; i < 3; i++ ) {
272 // Make a text representation of bytes as ipv4 or ipv6
273 static char *inet_nmtoa(unsigned char *b,int w) {
274 static char buffer[20000];
278 sprintf( p,"%d.%d.%d.%d", b[0], b[1], b[2], b[3] );
279 } else if ( w == 16 ){
281 "%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x",
282 b[0], b[1], b[2], b[3],
283 b[4], b[5], b[6], b[7],
284 b[8], b[9], b[10], b[11],
285 b[12], b[13], b[14], b[15] );
287 VERBOSE3OUT( "HEX data of %d bytes\n", w );
288 for ( ; i < w && i < 19000; i++, p += 3 ) {
289 sprintf( p, "%02x:", b[i] );
298 // Form a MAC address string from 6 MAC address bytes, into one of the
299 // 4 static buffer, whose use are cycled.
300 static char *inet_mtoa(unsigned char *mac) {
301 static char buffer[4][30];
306 sprintf( buffer[i], "%02x:%02x:%02x:%02x:%02x:%02x",
307 mac[0], mac[1], mac[2], mac[3], mac[4], mac[5] );
311 // Form a socket address string from Sockaddr, into one of the
312 // 4 static buffer, whose use are cycled.
313 static char *inet_stoa(struct SockAddr *a) {
314 static char buffer[1000];
315 static char out[4][1000];
320 if ( a->in.sa_family == AF_INET ) {
321 sprintf( out[i], "%s:%d",
322 inet_ntop( AF_INET, &a->in4.sin_addr, buffer, 100 ),
323 ntohs( a->in4.sin_port ) );
324 } else if ( a->in.sa_family == AF_INET6 ) {
325 sprintf( out[i], "[%s]:%d",
326 inet_ntop( AF_INET6, &a->in6.sin6_addr, buffer, 100 ),
327 ntohs( a->in6.sin6_port ) );
329 sprintf( out[i], "<tap/stdio>" );
334 // Debugging: string representation of an Allowed record.
335 static char *show_allowed(struct Allowed *a) {
336 static char buffer[20000];
338 sprintf( buffer, "{tap/stdio}" );
340 sprintf( buffer, "%hd (%d) %s %p",
341 a->port, a->bits, inet_nmtoa( a->addr.bytes, a->addr.width ),
347 // Recognize uplink specification
348 static int is_uplink(struct Allowed *a) {
349 return a->bits == (unsigned int) ( a->addr.width * 8 ) && a->port != 0;
352 // Add a new Interface for a Remote. If non-null, the interface is
353 // also added to the interface table.
354 static struct Interface *add_interface(unsigned char *mac,struct Remote *r) {
355 struct Interface *x = calloc( 1, sizeof( struct Interface ) );
356 memcpy( x->mac, mac, sizeof( x->mac ) );
364 // Add a new remote for a given address and spec.
365 static struct Remote *add_remote(struct SockAddr *a,struct Allowed *s) {
366 struct Remote *r = calloc( 1, sizeof( struct Remote ) );
368 memcpy( &r->uaddr, a, sizeof( r->uaddr ) );
371 VERBOSE2OUT( "add_remote %s from spec: %s\n",
372 inet_stoa( &r->uaddr ),
373 ( s == 0 )? ( (a == 0)? "{tap/stdio}" : "{multicast}" )
374 : show_allowed( s ) );
379 // Add a new ignored interface on a channel
380 static int add_ignored(struct Allowed *link,unsigned char *mac) {
381 struct Interface *x = add_interface( mac, 0 );
383 return 1; // error: out of memory
385 Ignored_ADD( link, x );
389 // Parse ignored interfaces
390 // Comma separated list of MAC addresses
391 static int parse_ignored_interfaces(char *arg,struct Allowed *link) {
392 int a, b, c, d, e, f, g;
394 if ( sscanf( arg,"%x:%x:%x:%x:%x:%x%n",&a,&b,&c,&d,&e,&f,&g ) != 6 ) {
398 if ( (a|b|c|d|e|f) & ~0xff ) {
399 return 1; // some %x is not hex
401 unsigned char mac[6] = { a, b, c, d, e, f };
402 if ( add_ignored( link, mac ) ) {
406 VERBOSEOUT( "Ignoring: %s on channel %s\n",
407 inet_mtoa( mac ), link->source );
412 if ( *(arg++) != ',' ) {
413 return 1; // Not comma separated
419 //** IP address parsing utility
420 // Clear bits after <bits>
421 static void clearbitsafter(struct CharAddr *a,unsigned int bits) {
422 unsigned int max = a->width * 8;
424 for ( i = a->width; i < 16; i++ ) {
427 for ( i = a->width - 1; i >= 0; i--, max -= 8 ) {
428 if ( max - 8 < bits ) {
433 if ( i >= 0 && max >= bits ) {
434 a->bytes[ i ] &= ( 0xFF << ( bits - max ) );
438 //** IP address parsing utility
439 // Find the PSK for the given +file+ in the +loaded+ table (of +count+ size)
440 static struct PSK *findLoadedKeyfile(char *file,struct PSK *loaded,int count) {
441 VERBOSE3OUT( "find %s\n", file );
442 for ( count--; count >= 0; count-- ) {
443 if ( strcmp( file, loaded[ count ].keyfile ) ) {
444 VERBOSE3OUT( "found %d\n", count );
445 return &loaded[ count ];
448 VERBOSE3OUT( "found nothing\n" );
452 //** IP address parsing utility
453 // Load a key file into dynamically allocated memory, and update the
454 // given PSK header for it.
455 static void loadkey(struct PSK *psk) {
456 static struct PSK *loaded = 0;
457 static int count = 0;
458 if ( psk->keyfile == 0 ) {
461 struct PSK *old = findLoadedKeyfile( psk->keyfile, loaded, count );
463 memcpy( psk, old, sizeof( struct PSK ) );
469 struct stat filestat;
470 psk->keyfile = strdup( psk->keyfile );
471 int fd = open( (char*) psk->keyfile, O_RDONLY );
474 perror( "open key file" );
477 if ( fstat( fd, &filestat ) ) {
478 perror( "stat of key file" );
481 psk->key_length = filestat.st_size;
482 if ( psk->key_length < 256 ) {
483 fprintf( stderr, "Too small key file: %d %s\n", psk->key_length,
487 psk->key = malloc( psk->key_length );
488 if ( psk->key == 0 ) {
489 fprintf( stderr, "Cannot allocate %d bytes for %s\n",
490 psk->key_length, psk->keyfile );
495 while ( ( n = read( fd, p, e ) ) > 0 ) {
501 fprintf( stderr, "Failed loading key %s\n", psk->keyfile );
504 for ( e = 0; (unsigned) e < psk->key_length; e++ ) {
505 psk->seed += psk->key[ e ];
507 if ( psk->seed == 0 ) {
508 fprintf( stderr, "Bad key %s; adds up to 0\n", psk->keyfile );
513 loaded = realloc( loaded, ( count * sizeof( struct PSK ) ) );
515 loaded = malloc( sizeof( struct PSK ) );
517 memcpy( &loaded[ count-1 ], psk, sizeof( struct PSK ) );
518 VERBOSE3OUT( "%d: %s %d %p %d\n", count-1, psk->keyfile, psk->seed,
519 psk->key, psk->key_length );
522 //** IP address parsing utility
523 // Fill out a CharAddr and *port from a SockAddr
524 static void set_charaddrport(
525 struct CharAddr *ca,unsigned short *port,struct SockAddr *sa)
527 memset( ca, 0, sizeof( struct CharAddr ) );
528 ca->width = ( sa->in.sa_family == AF_INET )? 4 : 16;
529 if ( ca->width == 4 ) {
530 memcpy( &ca->in4, &sa->in4.sin_addr, 4 );
531 *port = ntohs( sa->in4.sin_port );
533 memcpy( &ca->in6, &sa->in6.sin6_addr, 16 );
534 *port = ntohs( sa->in6.sin6_port );
538 //** IP address parsing utility
539 // Fill out a SockAddr from a CharAddr and port
540 static void set_sockaddr(struct SockAddr *sa,struct CharAddr *ca,int port) {
541 memset( sa, 0, sizeof( struct SockAddr ) );
542 if ( ca->width == 4 ) {
543 sa->in4.sin_family = AF_INET;
544 sa->in4.sin_port = htons( port );
545 memcpy( &sa->in4.sin_addr, &ca->in4, 4 );
547 sa->in6.sin6_family = AF_INET6;
548 sa->in6.sin6_port = htons( port );
549 memcpy( &sa->in6.sin6_addr, &ca->in6, 16 );
553 //** IP address parsing utility
554 // Capture an optional port sub phrase [:<port>]
555 static int parse_port(char *port,struct Allowed *into) {
560 if ( sscanf( port, "%d", &p ) != 1 || p < 1 || p > 65535 ) {
569 //** IP address parsing utility
570 // Capture an optional bits sub phrase [/<bits>]
571 static int parse_bits(char *bits,int max,struct Allowed *into) {
576 if ( sscanf( bits, "%d", &b ) != 1 || b < 0 || b > max ) {
584 //** IP address parsing utility
585 // Parse a command line argument as a declaration of an allowed
586 // remote into the given <addr>.
587 // Return 0 if ok and 1 otherwise
588 // Formats: <ipv4-address>[/<bits>][:<port>][=keyfile]
589 // Formats: <ipv6-address>[/<bits>][=keyfile]
590 // Formats: \[<ipv6-address>[/<bits>]\][:<port>][=keyfile]
591 // Formats: hostname:port[=keyfile]
592 static int parse_allowed(char *arg,struct Allowed *into) {
593 static char buffer[10000];
594 int n = strlen( arg );
596 return 1; // excessively large argument
598 strcpy( buffer, arg );
600 char * keyfile = strchr( buffer, '=' );
603 into->psk.keyfile = keyfile;
605 #define B(b) b, b+1, b+2, b+3
606 if ( sscanf( buffer, "%hhu.%hhu.%hhu.%hhu", B(into->addr.bytes) ) == 4 ) {
609 into->addr.width = 4;
610 if ( parse_port( strchr( buffer, ':' ), into ) ) {
611 fprintf( stderr, "bad port\n" );
614 if ( parse_bits( strchr( buffer, '/' ), 32, into ) ) {
615 fprintf( stderr, "bad bits\n" );
621 char * address = buffer;
623 if ( *buffer == '[' ) {
624 // bracketed form, necessary for port
625 char *end = strchr( buffer, ']' );
627 return 1; // bad argument
631 if ( *end == ':' && parse_port( end, into ) ) {
635 into->addr.width = 16;
636 if ( parse_bits( strchr( address, '/' ), 128, into ) ) {
639 if ( inet_pton( AF_INET6, address, into->addr.bytes ) != 1 ) {
640 return 1; // Bad IPv6
645 //** IP address parsing utility
646 // Add a new channel spec into the <allowed> table
647 // spec == 0 for the tap/stdio channel
648 static struct Allowed *add_allowed(char *spec) {
649 struct Allowed *into = calloc( 1, sizeof(struct Allowed) );
650 htable x = HTABLEINIT( struct Interface, mac, hashcode_mac );
651 into->ignored_mac = x;
653 if ( parse_allowed( spec, into ) ) {
654 fprintf( stderr, "Bad remote spec: %s\n", spec );
659 if ( allowed.table == 0 ) {
661 allowed.table = calloc( 1, sizeof(struct Allowed*) );
666 allowed.table = realloc( allowed.table,
667 allowed.count * sizeof(struct Allowed*) );
668 if ( allowed.table == 0 ) {
669 fprintf( stderr, "OUT OF MEMORY\n" );
673 allowed.table[i] = into;
675 loadkey( &into->psk );
676 VERBOSE3OUT( "Allowed %s { %s }\n", into->source, show_allowed( into ) );
677 if ( is_uplink( into ) ) {
678 struct SockAddr addr;
679 set_sockaddr( &addr, &into->addr, into->port );
680 VERBOSEOUT( "Add uplink %s\n", show_allowed( into ) );
681 (void) add_remote( &addr, into );
686 static int parse_threads_count(char *arg) {
687 if ( ( sscanf( arg, "%u", &threads_count ) != 1 ) || threads_count < 1 ) {
690 VERBOSEOUT( "** Threads count = %d\n", threads_count );
694 static int parse_buffers_count(char *arg) {
695 if ( ( sscanf( arg, "%u", &buffers_count ) != 1 ) || buffers_count < 1 ) {
698 VERBOSEOUT( "** Buffers count = %d\n", buffers_count );
702 //** IP address parsing utility for multicast phrase
703 // Return 0 if ok and 1 otherwise
704 // Formats: <ipv4-address>:<port>[=keyfile]
705 // The ipv4 address should be a multicast address in ranges
706 // 224.0.0.0/22, 232.0.0.0/7, 234.0.0.0/8 or 239.0.0.0/8
707 // though it's not checked here.
708 static int parse_mcast(char *arg) {
709 static char buffer[10000];
710 int n = strlen( arg );
712 return 1; // excessively large argument
714 memcpy( buffer, arg, n );
715 char *p = buffer + n - 1;
716 for ( ; p > buffer && *p != ':' && *p != '='; p-- ) { }
718 mcast.psk.keyfile = p+1;
720 loadkey( &mcast.psk );
721 for ( ; p > buffer && *p != ':' ; p-- ) { }
724 fprintf( stderr, "Multicast port is required\n" );
725 return 1; // Port number is required
728 if ( inet_pton( AF_INET, buffer, &mcast.group.imr_multiaddr.s_addr )==0 ) {
729 fprintf( stderr, "Multicast address required\n" );
733 long int port = strtol( p, &e, 10 );
734 if ( *e != 0 || port < 1 || port > 65535 ) {
735 fprintf( stderr, "Bad multicast port\n" );
738 mcast.group.imr_address.s_addr = htonl(INADDR_ANY);
739 mcast.sock.in4.sin_family = AF_INET;
740 mcast.sock.in4.sin_addr.s_addr = htonl(INADDR_ANY);
741 mcast.sock.in4.sin_port = htons( atoi( p ) );
745 //** IP address parsing utility for UDP source address
746 // Return 0 if ok and 1 otherwise
747 // Formats: <ipv4-address> or <ipv6-address>
748 // The ipv4 address should be a multicast address in ranges
749 // 224.0.0.0/22, 232.0.0.0/7, 234.0.0.0/8 or 239.0.0.0/8
750 // though it's not checked here.
751 static int parse_udp_source(char *arg) {
752 if ( inet_pton( AF_INET6, arg, udp_source.address ) ) {
753 // An ipv6 address is given.
755 udp_source.family = AF_INET6;
760 if ( ! inet_pton( AF_INET, arg, udp_source.address ) ) {
764 // An ipv4 address is given.
766 // Translate into ipv6-encoded ipv4
767 memmove( udp_source.address + 12, udp_source.address, 4 );
768 memset( udp_source.address, 0, 10 );
769 memset( udp_source.address + 10, -1, 2 );
770 udp_source.family = AF_INET6;
772 udp_source.family = AF_INET;
777 // Utility that sets upt the multicast socket, which is used for
778 // receiving multicast packets.
779 static void setup_mcast() {
780 // set up ipv4 socket
781 if ( ( mcast.fd = socket( AF_INET, SOCK_DGRAM, 0 ) ) == 0 ) {
782 perror( "creating socket");
785 if ( setsockopt( mcast.fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
786 (char *) &mcast.group, sizeof( mcast.group ) ) < 0) {
787 perror( "Joining multicast group" );
791 if ( setsockopt( mcast.fd, SOL_SOCKET, SO_REUSEADDR,
792 &reuse, sizeof( int ) ) < 0 ) {
793 perror( "SO_REUSEADDR" );
796 if ( bind( mcast.fd, (struct sockaddr*) &mcast.sock.in,
797 sizeof( struct sockaddr ) ) ) {
798 fprintf( stderr, "Error binding socket!\n");
801 // Change mcast address to be the group multiaddress, and add
802 // a persistent "remote" for it.
803 mcast.sock.in4.sin_addr.s_addr = mcast.group.imr_multiaddr.s_addr;
804 add_remote( &mcast.sock, 0 );
807 // Find the applicable channel rule for a given ip:port address
808 static struct Allowed *is_allowed_remote(struct SockAddr *addr) {
810 int width = ( addr->in.sa_family == AF_INET )? 4 : 16;
813 for ( ; (unsigned) i < allowed.count; i++ ) {
814 struct Allowed *a = allowed.table[i];
815 if ( a->addr.width != width ) {
818 set_charaddrport( &ca, &port, addr );
819 if ( a->port != 0 && a->port != port ) {
822 clearbitsafter( &ca, a->bits );
823 if ( memcmp( &ca, &a->addr, sizeof( struct CharAddr ) ) == 0 ) {
827 return 0; // Disallowed
830 // Simple PSK encryption:
832 // First, xor each byte with a key byte that is picked from the key
833 // by means of an index that includes the prior encoding. Also,
834 // compute the sum of encrypted bytes into a "magic" that is added the
835 // "seed" for seeding the random number generator. Secondly reorder
836 // the bytes using successive rand number picks from the seeded
839 static void encrypt(unsigned char *buf,unsigned int n,struct PSK *psk) {
844 VERBOSE3OUT( "encrypt by %s %p\n", psk->keyfile, psk->key );
845 for ( k = 0, r = 0, magic = 0; k < n; k++ ) {
846 r = ( r + magic + k ) % psk->key_length;
847 buf[k] ^= psk->key[ r ];
850 pthread_mutex_lock( &crypting );
851 srand( psk->seed + magic );
852 for ( k = 0; k < n; k++ ) {
858 pthread_mutex_unlock( &crypting );
861 // Corresponding decryption procedure .
862 static void decrypt(unsigned char *buf,unsigned int n,struct PSK *psk) {
863 unsigned int randoms[ BUFSIZE ];
867 unsigned int magic = 0;
868 for ( k = 0; k < n; k++ ) {
871 pthread_mutex_lock( &crypting );
872 srand( psk->seed + magic );
873 for ( k = 0; k < n; k++ ) {
874 randoms[k] = rand() % n;
876 pthread_mutex_unlock( &crypting );
877 for ( k = n; k > 0; ) {
883 for ( k = 0, r = 0, magic = 0; k < n; k++ ) {
884 r = ( r + magic + k ) % psk->key_length;
886 buf[k] ^= psk->key[r];
890 // Write a buffer data to given file descriptor (basically tap_fd in
891 // this program). This is never fragmented.
892 static int dowrite(int fd, unsigned char *buf, int n) {
894 if ( ( w = write( fd, buf, n ) ) < 0){
895 perror( "Writing data" );
901 // Write to the tap/stdio; adding length prefix for stdio
902 static int write_tap(unsigned char *buf, int n) {
903 uint8_t tag0 = *( buf + 12 );
905 uint16_t size = ntohs( *(uint16_t*)(buf + 16) );
906 if ( size <= 1500 ) {
907 if ( ( verbose >= 2 ) && ( n != size + 14 ) ) {
908 VERBOSEOUT( "clip %d to %d\n", n, size + 14 );
910 n = size + 14; // Clip of any tail
914 uint16_t plength = htons( n );
915 if ( dowrite( 1, (unsigned char *) &plength,
916 sizeof( plength ) ) < 0 ) {
919 return dowrite( 1, buf, n );
921 return dowrite( tap_fd, buf, n );
925 // All sorts of fiddling is needed to set the source address for UDP
926 // And 2 different ways for pure ipv4 versus ipv6 sockets
927 static void sendpacket4(unsigned char *buf, int n,struct Remote *r) {
928 // The UDP socket is pure ipv4
929 struct iovec data[1] = {{ .iov_base = buf, .iov_len = n }};
932 struct in_pktinfo data;
934 .hdr.cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)),
935 .hdr.cmsg_level = IPPROTO_IP,
936 .hdr.cmsg_type = IP_PKTINFO,
937 .data.ipi_ifindex = r->ifindex,
938 .data.ipi_spec_dst = r->laddr.in4.sin_addr
940 struct msghdr msg = {
941 .msg_name = &r->uaddr.in4,
942 .msg_namelen = sizeof( struct sockaddr_in ),
945 .msg_control = &control,
946 .msg_controllen = CMSG_SPACE( sizeof( struct in_pktinfo ) ),
947 .msg_flags = 0 // unused
949 VERBOSE2OUT( "sendmsg ipv4 %lu from %s to %s\n",
951 inet_stoa( &r->laddr ),
952 inet_stoa( &r->uaddr ) );
953 if ( sendmsg( udp_fd, &msg, 0 ) < n ) {
954 perror( "Writing socket" );
958 static void sendpacket6(unsigned char *buf, int n,struct Remote *r) {
959 // The UDP socket is ipv6, possibly with mapped ipv4 address(es)
960 struct iovec data[1] = {{ .iov_base = buf, .iov_len = n }};
964 struct in_pktinfo in4;
965 struct in6_pktinfo in6;
968 struct msghdr msg = {
969 .msg_name = &r->uaddr.in6,
970 .msg_namelen = sizeof( struct sockaddr_in6 ),
975 .msg_flags = 0 // unused
978 switch ( r->laddr.in.sa_family ) {
980 control.hdr.cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
981 control.hdr.cmsg_level = IPPROTO_IPV6;
982 control.hdr.cmsg_type = IPV6_PKTINFO;
983 control.data.in6.ipi6_ifindex = r->ifindex;
984 memcpy( &control.data.in6.ipi6_addr, &r->laddr.in6.sin6_addr, 16 );
985 msg.msg_control = &control;
986 msg.msg_controllen = CMSG_SPACE( sizeof( struct in6_pktinfo ) );
989 control.hdr.cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
990 control.hdr.cmsg_level = IPPROTO_IP;
991 control.hdr.cmsg_type = IP_PKTINFO;
992 control.data.in4.ipi_ifindex = r->ifindex;
993 control.data.in4.ipi_spec_dst = r->laddr.in4.sin_addr;
994 msg.msg_control = &control;
995 msg.msg_controllen = CMSG_SPACE( sizeof( struct in_pktinfo ) );
999 VERBOSE2OUT( "sendmsg ipv6 %d from %s to %s\n",
1001 inet_stoa( &r->laddr ),
1002 inet_stoa( &r->uaddr ) );
1003 if ( sendmsg( udp_fd, &msg, 0 ) < n ) {
1004 perror( "Writing socket" );
1008 // Write a packet via the given Interface with encryption as specified.
1009 static void write_remote(unsigned char *buf, int n,struct Remote *r) {
1011 unsigned char output[ BUFSIZE ];
1013 VERBOSE2OUT( "SENDing %d bytes to %s\n", n, inet_stoa( &r->uaddr ) );
1015 VERBOSE2OUT( "SENDing %d bytes %s -> %s to %s\n", n,
1016 inet_mtoa( buf+6 ), inet_mtoa( buf ),
1017 inet_stoa( &r->uaddr ) );
1019 memcpy( output, buf, n ); // Use the private buffer for delivery
1020 // Apply the TPG quirk
1021 if ( tpg_quirk && ( n > 1460 ) && ( n < 1478 ) ) {
1022 VERBOSE2OUT( "tpg quirk applied\n" );
1023 n = 1478; // Add some "random" tag-along bytes
1025 if ( r->spec == 0 ) {
1026 if ( r->uaddr.in.sa_family == 0 ) {
1027 // Output to tap/stdio
1028 if ( write_tap( buf, n ) < 0 ) {
1030 fprintf( stderr, "Cannot write to tap/stdio: exiting!\n" );
1035 // Fall through for multicast
1036 if ( mcast.psk.keyfile ) {
1037 encrypt( output, n, &mcast.psk );
1039 } else if ( r->spec->psk.keyfile ) {
1040 encrypt( output, n, &r->spec->psk );
1043 sendpacket6( output, n, r );
1045 sendpacket4( output, n, r );
1049 // Delete a Remote and all its interfaces
1050 static void delete_remote(struct Remote *r) {
1051 VERBOSE2OUT( "DELETE Remote and all its interfaces %s\n",
1052 inet_stoa( &r->uaddr ) );
1054 struct Interface *x;
1056 for ( ; i < remotes.by_mac.size; i++ ) {
1057 unsigned char *tmp = remotes.by_mac.data[i];
1058 if ( tmp == 0 || tmp == (unsigned char *)1 ) {
1061 x = (struct Interface *) tmp;
1062 if ( x->remote == r ) {
1072 // Unmap an ipv4-mapped ipv6 address
1073 static void unmap_if_mapped(struct SockAddr *s) {
1074 if ( s->in.sa_family != AF_INET6 ||
1075 memcmp( "\000\000\000\000\000\000\000\000\000\000\377\377",
1076 &s->in6.sin6_addr, 12 ) ) {
1079 VERBOSE2OUT( "unmap %s\n",
1080 inet_nmtoa( (unsigned char*) s, sizeof( struct SockAddr ) ) );
1081 s->in.sa_family = AF_INET;
1082 memcpy( &s->in4.sin_addr, s->in6.sin6_addr.s6_addr + 12, 4 );
1083 memset( s->in6.sin6_addr.s6_addr + 4, 0, 12 );
1084 VERBOSE2OUT( "becomes %s\n",
1085 inet_nmtoa( (unsigned char*) s, sizeof( struct SockAddr ) ) );
1088 // Route the packet from the given src
1089 static struct Interface *input_check(
1090 unsigned char *buf,ssize_t len,struct SockAddr *src )
1092 VERBOSE2OUT( "RECV %ld bytes from %s\n", len, inet_stoa( src ) );
1093 struct Remote *r = 0;
1094 struct timeval now = { 0 };
1095 if ( gettimeofday( &now, 0 ) ) {
1096 perror( "RECV time" );
1097 now.tv_sec = time( 0 );
1099 Remote_FIND( src, r );
1101 struct Allowed *a = is_allowed_remote( src );
1103 VERBOSEOUT( "Ignoring %s\n", inet_stoa( src ) );
1104 return 0; // Disallowed
1106 VERBOSEOUT( "New remote %s by %s\n", inet_stoa( src ), a->source );
1107 r = add_remote( src, a );
1108 //r->rec_when = now; // Set activity stamp of new remote
1111 // Ignore short data, but maintain channel
1112 r->rec_when = now; // Update activity stamp touched remote
1114 VERBOSEOUT( "Ignoring %ld bytes from %s\n",
1115 len, inet_stoa( src ) );
1119 // Now decrypt the data as needed
1121 if ( r->spec->psk.seed ) {
1122 decrypt( buf, len, &r->spec->psk );
1124 } else if ( r->uaddr.in.sa_family == 0 && mcast.psk.keyfile ) {
1125 decrypt( buf, len, &mcast.psk );
1127 VERBOSE2OUT( "RECV %s -> %s from %s\n",
1128 inet_mtoa( buf+6 ), inet_mtoa( buf ),
1129 inet_stoa( &r->uaddr ) );
1130 // Note: the payload is now decrypted, and known to be from +r+
1131 struct Interface *x = 0;
1132 // Packets concerning an ignored interface should be ignored.
1133 if ( r->spec && r->spec->ignored_mac.data ) {
1134 Ignored_FIND( r->spec, buf+6, x );
1136 VERBOSE2OUT( "Dropped MAC %s from %s on %s\n",
1137 inet_mtoa( buf+6 ), inet_stoa( &r->uaddr ),
1141 Ignored_FIND( r->spec, buf, x );
1143 VERBOSE2OUT( "Dropped MAC %s to %s on %s\n",
1144 inet_mtoa( buf ), inet_stoa( &r->uaddr ),
1149 Interface_FIND( buf+6, x );
1151 // Totally new MAC. Should bind it to the remote
1152 VERBOSEOUT( "New MAC %s from %s\n",
1153 inet_mtoa( buf+6 ), inet_stoa( src ) );
1154 x = add_interface( buf+6, r );
1155 r->rec_when = now; // Update activity stamp for remote
1159 // Seen that MAC already
1160 if ( x->remote == r ) {
1161 VERBOSE2OUT( "RECV %s from %s again\n",
1162 inet_mtoa( buf+6 ), inet_stoa( &x->remote->uaddr ) );
1163 r->rec_when = now; // Update activity stamp
1164 x->rec_when = now; // Update activity stamp
1167 // MAC clash from two different connections
1169 // x->remote = previous
1170 VERBOSE2OUT( "RECV %s from %s previously from %s\n",
1172 inet_stoa( &r->uaddr ),
1173 inet_stoa( &x->remote->uaddr ) );
1175 // The packet source MAC has arrived on other than its
1176 // previous channel. It thus gets dropped if tap/stdin is the
1177 // primary channel, or the time since the last packet for that
1178 // interface is less than RECENT_MICROS, with different limits
1179 // for broadcast and unicast.
1180 int64_t dmac = DIFF_MICROS( &now, &x->rec_when);
1181 if ( x->remote->spec == 0 || RECENT_MICROS( *buf & 1, dmac ) ) {
1182 if ( verbose >= 2 ) {
1185 "Dropped. MAC %s (%ld) from %s, should be %s\n",
1186 inet_mtoa( buf+6 ), dmac,
1187 inet_stoa( src ), inet_stoa( &x->remote->uaddr ) );
1191 // Check if previous package on the interface was recent
1192 } else if ( r->uaddr.in.sa_family ) {
1193 // Multicast incoming clashing with tap/stdio
1194 VERBOSE3OUT( "Dropped multicast loopback\n" );
1198 // New remote takes over the MAC
1199 VERBOSEOUT( "MAC %s from %s cancels previous %s\n",
1200 inet_mtoa( buf+6 ), inet_stoa( src ),
1201 inet_stoa( &x->remote->uaddr ) );
1202 x->remote = r; // Change remote for MAC
1203 // Note that this may leave the old x->remote without any interface
1204 r->rec_when = now; // Update activity stamp
1205 x->rec_when = now; // Update activity stamp
1209 // Check packet and deliver out
1210 static void route_packet(PacketItem *pi) {
1211 unsigned char *buf = pi->buffer;
1213 struct SockAddr *src = &pi->src;
1214 struct Interface *x = input_check( buf, len, src );
1216 VERBOSE2OUT( "not a nice packet\n" );
1217 return; // not a nice packet
1219 // Set the local addressing for the remote, unless set already
1220 if ( x->remote->ifindex == 0 ) {
1222 x->remote->ifindex = pi->dstinfo.in6.ipi6_ifindex;
1223 x->remote->laddr.in6.sin6_family = AF_INET6;
1224 x->remote->laddr.in6.sin6_port = htons( udp_port );
1225 memcpy( &x->remote->laddr.in6.sin6_addr,
1226 &pi->dstinfo.in6.ipi6_addr,
1228 unmap_if_mapped( &x->remote->laddr );
1230 x->remote->ifindex = pi->dstinfo.in4.ipi_ifindex;
1231 x->remote->laddr.in4.sin_family = AF_INET;
1232 x->remote->laddr.in4.sin_port = htons( udp_port );
1233 memcpy( &x->remote->laddr.in4.sin_addr,
1234 &pi->dstinfo.in4.ipi_spec_dst,
1238 if ( ( *buf & 1 ) == 0 ) {
1240 struct Interface *y = 0; // reuse for destination interface
1241 Interface_FIND( buf, y );
1243 VERBOSE2OUT( "RECV %s -> %s from %s without channel and dropped\n",
1244 inet_mtoa( buf+6 ), inet_mtoa( buf ),
1245 inet_stoa( &x->remote->uaddr ) );
1248 if ( x->remote == y->remote ) {
1249 VERBOSEOUT( "RECV loop for %s -> %s from %s to %s\n",
1250 inet_mtoa( buf+6 ), inet_mtoa( buf ),
1251 inet_stoa( &x->remote->uaddr ),
1252 inet_stoa( &y->remote->uaddr ) );
1253 Interface_DEL( y ); // Need to see this interface again
1256 VERBOSE2OUT( "RECV route %s -> %s\n",
1259 write_remote( buf, len, y->remote );
1262 // broadcast. +x+ is source interface
1263 // x->rec_when is not updated
1264 struct timeval now = { 0 };
1265 if ( gettimeofday( &now, 0 ) ) {
1266 perror( "RECV time" );
1267 now.tv_sec = time( 0 );
1269 VERBOSE2OUT( "BC %s -> %s from %s to %s\n",
1270 inet_mtoa( buf+6 ), inet_mtoa( buf ),
1271 inet_stoa( &x->remote->uaddr ),
1272 inet_stoa( &x->remote->laddr ) );
1276 for ( ; i < remotes.by_addr.size; i++ ) {
1277 unsigned char *tmp = remotes.by_addr.data[i];
1278 if ( tmp == 0 || tmp == (unsigned char *)1 ) {
1281 r = (struct Remote *) tmp;
1282 VERBOSE3OUT( "BC check %s\n", inet_stoa( &r->uaddr ) );
1283 if ( r == x->remote ) {
1284 VERBOSE3OUT( "BC r == x->remote\n" );
1287 if ( r->spec && ! is_uplink( r->spec ) &&
1288 DIFF_MICROS( &now, &r->rec_when ) > VERYOLD_MICROS ) {
1289 // remove old downlink connection
1290 VERBOSEOUT( "Old remote discarded %s (%ld)\n",
1291 inet_stoa( &r->uaddr ),
1292 TIME_MICROS( &r->rec_when ) );
1293 // Removing a downlink might have threading implications
1297 // Send packet to the remote
1298 // Only no-clash or to the tap/stdin
1299 write_remote( buf, len, r );
1304 // The packet handling queues
1311 // The threadcontrol program for handling packets.
1312 static void *packet_handler(void *data) {
1315 PacketItem *todo = (PacketItem *) Queue_getItem( &todolist.full );
1316 if ( todo->fd == mcast.fd ) {
1317 // Patch in the multicast address as source for multicast packet
1318 memcpy( &todo->src, &mcast.sock, sizeof( todo->src ) );
1319 route_packet( todo );
1322 unmap_if_mapped( &todo->src );
1324 route_packet( todo );
1326 memset( &todo->src, 0, sizeof( struct SockAddr ) );
1327 memset( &todo->dstinfo, 0, sizeof( todo->dstinfo ) );
1328 Queue_addItem( &todolist.free, (QueueItem*) todo );
1333 void todolist_initialize(int nbuf,int nthr) {
1334 if ( pthread_mutex_init( &todolist.full.mutex, 0 ) ||
1335 sem_init( &todolist.full.count, 0, 0 ) ) {
1339 if ( pthread_mutex_init( &todolist.free.mutex, 0 ) ||
1340 sem_init( &todolist.free.count, 0, 0 ) ) {
1344 if ( sem_init( &todolist.reading, 0, 1 ) ) {
1348 Queue_initialize( &todolist.free, nbuf, sizeof( PacketItem ) );
1349 for ( ; nthr > 0; nthr-- ) {
1350 pthread_t thread; // Temporary thread id
1351 pthread_create( &thread, 0, packet_handler, 0 );
1355 // Reads a UDP packet on the given file descriptor and captures the
1356 // source and destination addresses of the UDP message.
1357 inline static ssize_t recvpacket(int fd,PacketItem *p) {
1358 char data[100]; // Data area for "pktinfo"
1359 struct iovec buffer[1] = {{ p->buffer, BUFSIZE }};
1360 struct msghdr msg = {
1361 .msg_name = &p->src.in,
1362 .msg_namelen = udp6? sizeof( p->src.in6 ) : sizeof( p->src.in4 ),
1365 .msg_control = data,
1366 .msg_controllen = sizeof( data ),
1367 .msg_flags = 0 // Return value
1369 p->len = recvmsg( fd, &msg, udp6? 0 : IP_PKTINFO );
1370 struct cmsghdr *cmsg = CMSG_FIRSTHDR( &msg );
1373 memcpy( &p->dstinfo.in6, CMSG_DATA( cmsg ),
1374 sizeof( struct in6_pktinfo ) );
1375 VERBOSE2OUT( "DEST= udp6 %d\n", p->dstinfo.in6.ipi6_ifindex );
1377 memcpy( &p->dstinfo.in4, CMSG_DATA( cmsg ),
1378 sizeof( struct in_pktinfo ) );
1379 VERBOSE2OUT( "DEST= %d\n", p->dstinfo.in4.ipi_ifindex );
1387 // Read a full UDP packet into the given buffer, associate with a
1388 // connection, or create a new connection, the decrypt the as
1389 // specified, and capture the sender MAC address. The connection table
1390 // is updated for the new MAC address, However, if there is then a MAC
1391 // address clash in the connection table, then the associated remote
1392 // is removed, and the packet is dropped.
1393 static void *doreadUDP(void *data) {
1394 int fd = ((ReaderData *) data)->fd;
1396 PacketItem *todo = (PacketItem *) Queue_getItem( &todolist.free );
1398 VERBOSE3OUT( "Reading packet on %d\n", fd );
1399 ssize_t len = recvpacket( fd, todo );
1401 perror( "Receiving UDP" );
1406 memcmp( todo->buffer, "STOPSTOPSTOPSTOP", 16 ) == 0 ) {
1410 Queue_addItem( &todolist.full, (QueueItem*) todo );
1415 // Read up to n bytes from the given file descriptor into the buffer
1416 static int doread(int fd, unsigned char *buf, int n) {
1418 if ( ( len = read( fd, buf, n ) ) < 0 ) {
1419 perror( "Reading stdin" );
1425 // Read n bytes from the given file descriptor into the buffer.
1426 // If partial is allowed, then return amount read, otherwise keep
1427 // reading until full.
1428 static int read_into(int fd, unsigned char *buf, int n,int partial) {
1431 if ( (r = doread( fd, buf, x ) ) == 0 ) {
1443 // Go through all uplinks and issue a "heart beat"
1444 static void heartbeat(int fd) {
1445 static unsigned char data[10];
1446 VERBOSE3OUT( "heartbeat fd=%d\n", fd );
1450 if ( gettimeofday( &now, 0 ) ) {
1451 perror( "HEARTBEAT time" );
1452 now.tv_sec = time( 0 );
1456 for ( ; i < remotes.by_addr.size; i++ ) {
1457 unsigned char *tmp = remotes.by_addr.data[i];
1458 if ( tmp == 0 || tmp == (unsigned char *)1 ) {
1461 r = (struct Remote *) tmp;
1462 VERBOSE3OUT( "heartbeat check %s\n", inet_stoa( &r->uaddr ) );
1463 if ( r->spec && is_uplink( r->spec ) ) {
1464 if ( DIFF_MICROS( &now, &r->rec_when ) > HEARTBEAT_MICROS ) {
1465 VERBOSE3OUT( "heartbeat %s\n", inet_stoa( &r->uaddr ) );
1466 write_remote( data, 0, r );
1473 // Tell how to use this program and exit with failure.
1474 static void usage(void) {
1475 fprintf( stderr, "Packet tunneling over UDP, multiple channels, " );
1476 fprintf( stderr, "version 1.5.3\n" );
1477 fprintf( stderr, "Usage: " );
1478 fprintf( stderr, "%s [options] port [remote]+ \n", progname );
1479 fprintf( stderr, "** options must be given or omitted in order!!\n" );
1480 fprintf( stderr, " -v = verbose log, -vv or -vvv for more logs\n" );
1481 fprintf( stderr, " -tpg = UDP transport quirk: avoid bad sizes\n" );
1482 fprintf( stderr, " -4 = use an ipv4 UDP socket\n" );
1483 fprintf( stderr, " -B n = use n buffers (2*threads) by default\n");
1484 fprintf( stderr, " -T n = use n delivery threads (5 bu default)\n" );
1485 fprintf( stderr, " -m mcast = allow remotes on multicast address\n" );
1486 fprintf( stderr, " -t tap = use the nominated tap (or - for stdio)\n" );
1487 fprintf( stderr, " -S source = use given source address for UDP\n" );
1491 // Open the given tap
1492 static int tun_alloc(char *dev, int flags) {
1495 if ( ( fd = open( "/dev/net/tun", O_RDWR ) ) < 0 ) {
1496 perror( "Opening /dev/net/tun" );
1499 memset( &ifr, 0, sizeof( ifr ) );
1500 ifr.ifr_flags = flags;
1502 strcpy( ifr.ifr_name, dev );
1504 if ( ( err = ioctl( fd, TUNSETIFF, (void *) &ifr ) ) < 0 ) {
1505 perror( "ioctl(TUNSETIFF)" );
1509 strcpy( dev, ifr.ifr_name );
1513 // Handle packet received on the tap/stdio channel
1514 static void initialize_tap() {
1515 // Ensure there is a Remote for this
1516 static struct Remote *tap_remote = 0;
1517 if ( tap_remote == 0 ) {
1519 if ( tap_remote == 0 ) {
1520 tap_remote = add_remote( 0, 0 );
1526 // Thread to handle tap/stdio input
1527 static void *doreadTap(void *data) {
1528 int fd = ((ReaderData*) data)->fd;
1529 unsigned int end = 0; // Packet size
1530 unsigned int cur = 0; // Amount read so far
1532 PacketItem *todo = (PacketItem*) Queue_getItem( &todolist.free );
1536 int n = read_into( 0, (unsigned char *) &plength,
1537 sizeof( plength ), 0 );
1539 // Tap/stdio closed => exit silently
1542 end = ntohs( plength );
1544 while ( ( e = ( end - cur ) ) != 0 ) {
1545 unsigned char *p = todo->buffer + cur;
1546 if ( end > BUFSIZE ) {
1547 // Oversize packets should be read and discarded
1548 if ( e > BUFSIZE ) {
1553 cur += read_into( 0, p, e, 1 );
1556 end = doread( fd, todo->buffer, BUFSIZE );
1559 VERBOSE3OUT( "TAP/stdio input %d bytes\n", end );
1560 if ( end <= BUFSIZE ) {
1563 Queue_addItem( &todolist.full, (QueueItem*) todo );
1564 todo = (PacketItem*) Queue_getItem( &todolist.free );
1571 // Application main function
1572 // Parentheses mark optional
1573 // $* = (-v) (-4) (-B n) (-T n) (-m mcast) (-t port) (ip:)port (remote)+
1574 // remote = ipv4(/maskwidth)(:port)(=key)
1575 // remote = ipv6(/maskwidth)(=key)
1576 // remote = [ipv6(/maskwidth)](:port)(=key)
1577 // ip = ipv4 | [ipv6]
1578 int main(int argc, char *argv[]) {
1579 pthread_t thread; // Temporary thread id
1581 progname = (unsigned char *) argv[0];
1582 ///// Parse command line arguments
1584 #define ENSUREARGS(n) if ( argc < i + n ) usage()
1586 // First: optional -v, -vv or -vvv
1587 if ( strncmp( "-v", argv[i], 2 ) == 0 ) {
1588 if ( strncmp( "-v", argv[i], 3 ) == 0 ) {
1590 } else if ( strncmp( "-vv", argv[i], 4 ) == 0 ) {
1592 } else if ( strncmp( "-vvv", argv[i], 5 ) == 0 ) {
1600 if ( strncmp( "-tpg", argv[i], 4 ) == 0 ) {
1605 // then: optional -4
1606 if ( strncmp( "-4", argv[i], 2 ) == 0 ) {
1611 // then: optional -B buffers
1612 if ( strncmp( "-B", argv[i], 2 ) == 0 ) {
1614 if ( parse_buffers_count( argv[i+1] ) ) {
1620 // then: optional -T threads
1621 if ( strncmp( "-T", argv[i], 2 ) == 0 ) {
1623 if ( parse_threads_count( argv[i+1] ) ) {
1629 // then: optional -m mcast
1630 if ( strncmp( "-m", argv[i], 2 ) == 0 ) {
1632 if ( parse_mcast( argv[i+1] ) ) {
1638 // then: optional -t tap
1639 if ( strncmp( "-t", argv[i], 2 ) == 0 ) {
1645 // Then optional source address for UDP
1646 if ( strncmp( "-S", argv[i], 2 ) == 0 ) {
1648 if ( parse_udp_source( argv[i+1] ) ) {
1654 // then: required port
1655 if ( sscanf( argv[i++], "%d", &udp_port ) != 1 ) {
1656 fprintf( stderr, "Bad local port: %s\n", argv[i-1] );
1659 // then: any number of allowed remotes
1660 struct Allowed *last_allowed = 0;
1661 for ( ; i < argc; i++ ) {
1662 if ( last_allowed ) {
1663 // optionally adding ignored interfaces
1664 if ( strncmp( "-i", argv[i], 2 ) == 0 ) {
1666 if ( parse_ignored_interfaces( argv[i+1], last_allowed ) ) {
1673 if ( ( last_allowed = add_allowed( argv[i] ) ) == 0 ) {
1674 fprintf( stderr, "Cannot load remote %s. Exiting.\n", argv[i] );
1678 // end of command line parsing
1680 // Initialize buffers and threads
1681 if ( threads_count == 0 ) {
1684 if ( buffers_count < threads_count ) {
1685 buffers_count = 2 * threads_count;
1687 todolist_initialize( buffers_count, threads_count );
1689 // Set up the tap/stdio channel
1691 // set up the nominated tap
1692 if ( strcmp( "-", tap ) ) { // Unless "-"
1693 tap_fd = tun_alloc( tap, IFF_TAP | IFF_NO_PI );
1695 fprintf( stderr, "Error connecting to interface %s!\n", tap);
1698 VERBOSEOUT( "Using tap %s at %d\n", tap, tap_fd );
1700 // pretend a zero packet on the tap, for initializing.
1703 // set up for stdin/stdout local traffix
1704 setbuf( stdout, NULL ); // No buffering on stdout.
1705 tap_fd = 0; // actually stdin
1711 // Set up the multicast UDP channel (all interfaces)
1712 if ( mcast.group.imr_multiaddr.s_addr ) {
1714 unsigned char *x = (unsigned char *) &mcast.group.imr_multiaddr.s_addr;
1715 VERBOSEOUT( "Using multicast %s:%d at %d\n",
1716 inet_nmtoa( x, 4 ), ntohs( mcast.sock.in4.sin_port ),
1719 // Set up the unicast UPD channel (all interfaces)
1721 // set up ipv4 socket
1722 if ( ( udp_fd = socket( AF_INET, SOCK_DGRAM, 0 ) ) == 0 ) {
1723 perror( "creating socket");
1726 struct sockaddr_in udp_addr = {
1727 .sin_family = AF_INET,
1728 .sin_port = htons( udp_port ),
1730 if ( udp_source.family == 0 ) {
1731 udp_addr.sin_addr.s_addr = htonl( INADDR_ANY );
1733 udp_addr.sin_addr.s_addr = *((uint32_t*) udp_source.address);
1735 if ( bind( udp_fd, (struct sockaddr*) &udp_addr, sizeof(udp_addr))) {
1736 fprintf( stderr, "Error binding socket!\n");
1739 VERBOSEOUT( "Using ipv4 UDP at %d\n", udp_fd );
1741 if ( setsockopt( udp_fd, IPPROTO_IP, IP_PKTINFO, &opt, sizeof(opt)) ) {
1742 fprintf( stderr, "Error configuring socket!\n");
1746 // set up ipv6 socket
1747 if ( ( udp_fd = socket( AF_INET6, SOCK_DGRAM, 0 ) ) == 0 ) {
1748 perror( "creating socket");
1751 struct sockaddr_in6 udp6_addr = {
1752 .sin6_family = AF_INET6,
1753 .sin6_port = htons( udp_port ),
1755 memcpy( udp6_addr.sin6_addr.s6_addr, udp_source.address, 16 );
1756 if ( bind( udp_fd, (struct sockaddr*) &udp6_addr, sizeof(udp6_addr))) {
1757 fprintf( stderr, "Error binding socket!\n");
1760 VERBOSEOUT( "Using ipv6 UDP at %d\n", udp_fd );
1763 udp_fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &opt, sizeof(opt)) ) {
1764 fprintf( stderr, "Error configuring socket!\n");
1768 // If not using stdio for local traffic, then stdin and stdout are
1769 // closed here, so as to avoid that any other traffic channel gets
1770 // 0 or 1 as its file descriptor. Note: stderr (2) is left open.
1775 VERBOSE2OUT( "Socket loop tap=%d mcast=%d udp=%d\n",
1776 tap_fd, mcast.fd, udp_fd );
1779 ReaderData udp_reader = { .fd = udp_fd };
1780 pthread_create( &thread, 0, doreadUDP, &udp_reader );
1782 if ( mcast.group.imr_multiaddr.s_addr ) {
1783 ReaderData mcast_reader = { .fd = mcast.fd };
1784 pthread_create( &thread, 0, doreadUDP, &mcast_reader );
1787 if ( tap_fd || stdio ) {
1788 ReaderData tap_reader = { .fd = tap_fd };
1789 pthread_create( &thread, 0, doreadTap, &tap_reader );
1792 // Start heartbeating to uplinks
1795 heartbeat( udp_fd );