drygdryg/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-04-21 14:32:57 +03:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: drygdryg:72520463624b949abf1492ba6b8be7406cea45f5
Branches Tags
drygdryg:master
drygdryg:v70.6
drygdryg:v70.5
drygdryg:v70.4
drygdryg:v70.3
drygdryg:v70
drygdryg:v69.9
drygdryg:v69.8
drygdryg:v69.7
drygdryg:v69.6
drygdryg:v69.5
drygdryg:v69.4
drygdryg:v69.3
drygdryg:v69.2
drygdryg:v69.1
drygdryg:v69
drygdryg:v68
drygdryg:v67
drygdryg:v66
drygdryg:v65
drygdryg:v64
...
compare: drygdryg:dee9c04d2ad70c1fa583075efab1409e96fbad70
Branches Tags
drygdryg:master
drygdryg:v70.6
drygdryg:v70.5
drygdryg:v70.4
drygdryg:v70.3
drygdryg:v70
drygdryg:v69.9
drygdryg:v69.8
drygdryg:v69.7
drygdryg:v69.6
drygdryg:v69.5
drygdryg:v69.4
drygdryg:v69.3
drygdryg:v69.2
drygdryg:v69.1
drygdryg:v69
drygdryg:v68
drygdryg:v67
drygdryg:v66
drygdryg:v65
drygdryg:v64

9 Commits
7252046362 ... dee9c04d2a

Author SHA1 Message Date
bol-van
dee9c04d2a tpws: fix --debug-level text tab 2024-08-23 21:49:33 +03:00
bol-van
5e3cc263ab tpws: remove cygwin ifdef 2024-08-23 21:27:20 +03:00
bol-van
fe7a7f30a9 tpws: --debug to syslog and file 2024-08-23 21:15:27 +03:00
bol-van
700de59241 tpws: connect-bind-addr link local ifname delayed resolution 2024-08-23 16:57:44 +03:00
bol-van
e86fc2e7b5 tpws: connect-bind-addr support %iface for link locals 2024-08-23 16:42:56 +03:00
bol-van
7894796bdb
Merge pull request #315 from cleverfox/master 
option to bind to specified address for outbound connection
 2024-08-23 15:38:15 +03:00
bol-van
d6d48d26bf nfqws: open syslog only if --debug=syslog 2024-08-23 15:31:07 +03:00
bol-van
ea9435a737 nfqws: --debug to file and syslog 2024-08-23 14:42:21 +03:00
Vladimir Goncharov
c793ec8e1c bind address for connect 2024-08-22 16:09:38 +07:00
19 changed files with 1072 additions and 624 deletions
Show Stats Expand all files Collapse all files

44
nfq/darkmagic.c
View File

@ -699,7 +699,7 @@ static void str_srcdst_ip(char *s, size_t s_len, const void *saddr,const void *d
inet_ntop(AF_INET, daddr, d_ip, sizeof(d_ip)); inet_ntop(AF_INET, daddr, d_ip, sizeof(d_ip));
snprintf(s,s_len,"%s => %s",s_ip,d_ip); snprintf(s,s_len,"%s => %s",s_ip,d_ip);
} }
static void str_ip(char *s, size_t s_len, const struct ip *ip) void str_ip(char *s, size_t s_len, const struct ip *ip)
{ {
char ss[35],s_proto[16]; char ss[35],s_proto[16];
str_srcdst_ip(ss,sizeof(ss),&ip->ip_src,&ip->ip_dst); str_srcdst_ip(ss,sizeof(ss),&ip->ip_src,&ip->ip_dst);
@ -712,7 +712,7 @@ void print_ip(const struct ip *ip)
str_ip(s,sizeof(s),ip); str_ip(s,sizeof(s),ip);
printf("%s",s); printf("%s",s);
} }
static void str_srcdst_ip6(char *s, size_t s_len, const void *saddr,const void *daddr) void str_srcdst_ip6(char *s, size_t s_len, const void *saddr,const void *daddr)
{ {
char s_ip[40],d_ip[40]; char s_ip[40],d_ip[40];
*s_ip=*d_ip=0; *s_ip=*d_ip=0;
@ -720,7 +720,7 @@ static void str_srcdst_ip6(char *s, size_t s_len, const void *saddr,const void *
inet_ntop(AF_INET6, daddr, d_ip, sizeof(d_ip)); inet_ntop(AF_INET6, daddr, d_ip, sizeof(d_ip));
snprintf(s,s_len,"%s => %s",s_ip,d_ip); snprintf(s,s_len,"%s => %s",s_ip,d_ip);
} }
static void str_ip6hdr(char *s, size_t s_len, const struct ip6_hdr *ip6hdr, uint8_t proto) void str_ip6hdr(char *s, size_t s_len, const struct ip6_hdr *ip6hdr, uint8_t proto)
{ {
char ss[83],s_proto[16]; char ss[83],s_proto[16];
str_srcdst_ip6(ss,sizeof(ss),&ip6hdr->ip6_src,&ip6hdr->ip6_dst); str_srcdst_ip6(ss,sizeof(ss),&ip6hdr->ip6_src,&ip6hdr->ip6_dst);
@ -733,7 +733,7 @@ void print_ip6hdr(const struct ip6_hdr *ip6hdr, uint8_t proto)
str_ip6hdr(s,sizeof(s),ip6hdr,proto); str_ip6hdr(s,sizeof(s),ip6hdr,proto);
printf("%s",s); printf("%s",s);
} }
static void str_tcphdr(char *s, size_t s_len, const struct tcphdr *tcphdr) void str_tcphdr(char *s, size_t s_len, const struct tcphdr *tcphdr)
{ {
char flags[7],*f=flags; char flags[7],*f=flags;
if (tcphdr->th_flags & TH_SYN) *f++='S'; if (tcphdr->th_flags & TH_SYN) *f++='S';
@ -751,7 +751,7 @@ void print_tcphdr(const struct tcphdr *tcphdr)
str_tcphdr(s,sizeof(s),tcphdr); str_tcphdr(s,sizeof(s),tcphdr);
printf("%s",s); printf("%s",s);
} }
static void str_udphdr(char *s, size_t s_len, const struct udphdr *udphdr) void str_udphdr(char *s, size_t s_len, const struct udphdr *udphdr)
{ {
snprintf(s,s_len,"sport=%u dport=%u",htons(udphdr->uh_sport),htons(udphdr->uh_dport)); snprintf(s,s_len,"sport=%u dport=%u",htons(udphdr->uh_sport),htons(udphdr->uh_dport));
} }
@ -937,11 +937,11 @@ void tcp_rewrite_wscale(struct tcphdr *tcp, uint8_t scale_factor)
scale_factor_old=scale[2]; scale_factor_old=scale[2];
// do not allow increasing scale factor // do not allow increasing scale factor
if (scale_factor>=scale_factor_old) if (scale_factor>=scale_factor_old)
DLOG("Scale factor %u unchanged\n", scale_factor_old) DLOG("Scale factor %u unchanged\n", scale_factor_old);
else else
{ {
scale[2]=scale_factor; scale[2]=scale_factor;
DLOG("Scale factor change %u => %u\n", scale_factor_old, scale_factor) DLOG("Scale factor change %u => %u\n", scale_factor_old, scale_factor);
} }
} }
} }
@ -953,7 +953,7 @@ void tcp_rewrite_winsize(struct tcphdr *tcp, uint16_t winsize, uint8_t scale_fac
winsize_old = htons(tcp->th_win); // << scale_factor; winsize_old = htons(tcp->th_win); // << scale_factor;
tcp->th_win = htons(winsize); tcp->th_win = htons(winsize);
DLOG("Window size change %u => %u\n", winsize_old, winsize) DLOG("Window size change %u => %u\n", winsize_old, winsize);
tcp_rewrite_wscale(tcp, scale_factor); tcp_rewrite_wscale(tcp, scale_factor);
} }
@ -1342,10 +1342,10 @@ static HANDLE windivert_init_filter(const char *filter, UINT64 flags)
FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, FormatMessageA(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL, w_win32_error, MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPSTR)&errormessage, 0, NULL); NULL, w_win32_error, MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPSTR)&errormessage, 0, NULL);
fprintf(stderr, "windivert: error opening filter: %s", errormessage); DLOG_ERR("windivert: error opening filter: %s", errormessage);
LocalFree(errormessage); LocalFree(errormessage);
if (w_win32_error == ERROR_INVALID_IMAGE_HASH) if (w_win32_error == ERROR_INVALID_IMAGE_HASH)
fprintf(stderr,"windivert: try to disable secure boot and install OS patches\n"); DLOG_ERR("windivert: try to disable secure boot and install OS patches\n");
return NULL; return NULL;
} }
@ -1592,14 +1592,14 @@ static bool set_socket_fwmark(int sock, uint32_t fwmark)
#ifdef SO_USER_COOKIE #ifdef SO_USER_COOKIE
if (setsockopt(sock, SOL_SOCKET, SO_USER_COOKIE, &fwmark, sizeof(fwmark)) == -1) if (setsockopt(sock, SOL_SOCKET, SO_USER_COOKIE, &fwmark, sizeof(fwmark)) == -1)
{ {
perror("rawsend: setsockopt(SO_USER_COOKIE)"); DLOG_PERROR("rawsend: setsockopt(SO_USER_COOKIE)");
return false; return false;
} }
#endif #endif
#elif defined(__linux__) #elif defined(__linux__)
if (setsockopt(sock, SOL_SOCKET, SO_MARK, &fwmark, sizeof(fwmark)) == -1) if (setsockopt(sock, SOL_SOCKET, SO_MARK, &fwmark, sizeof(fwmark)) == -1)
{ {
perror("rawsend: setsockopt(SO_MARK)"); DLOG_PERROR("rawsend: setsockopt(SO_MARK)");
return false; return false;
} }
@ -1631,28 +1631,28 @@ static int rawsend_socket(sa_family_t family)
#endif #endif
if (*sock==-1) if (*sock==-1)
{ {
perror("rawsend: socket()"); DLOG_PERROR("rawsend: socket()");
return -1; return -1;
} }
#ifdef __linux__ #ifdef __linux__
if (setsockopt(*sock, SOL_SOCKET, SO_PRIORITY, &pri, sizeof(pri)) == -1) if (setsockopt(*sock, SOL_SOCKET, SO_PRIORITY, &pri, sizeof(pri)) == -1)
{ {
perror("rawsend: setsockopt(SO_PRIORITY)"); DLOG_PERROR("rawsend: setsockopt(SO_PRIORITY)");
goto exiterr; goto exiterr;
} }
if (family==AF_INET && setsockopt(*sock, IPPROTO_IP, IP_NODEFRAG, &yes, sizeof(yes)) == -1) if (family==AF_INET && setsockopt(*sock, IPPROTO_IP, IP_NODEFRAG, &yes, sizeof(yes)) == -1)
{ {
perror("rawsend: setsockopt(IP_NODEFRAG)"); DLOG_PERROR("rawsend: setsockopt(IP_NODEFRAG)");
goto exiterr; goto exiterr;
} }
if (family==AF_INET && setsockopt(*sock, IPPROTO_IP, IP_FREEBIND, &yes, sizeof(yes)) == -1) if (family==AF_INET && setsockopt(*sock, IPPROTO_IP, IP_FREEBIND, &yes, sizeof(yes)) == -1)
{ {
perror("rawsend: setsockopt(IP_FREEBIND)"); DLOG_PERROR("rawsend: setsockopt(IP_FREEBIND)");
goto exiterr; goto exiterr;
} }
if (family==AF_INET6 && setsockopt(*sock, SOL_IPV6, IPV6_FREEBIND, &yes, sizeof(yes)) == -1) if (family==AF_INET6 && setsockopt(*sock, SOL_IPV6, IPV6_FREEBIND, &yes, sizeof(yes)) == -1)
{ {
//perror("rawsend: setsockopt(IPV6_FREEBIND)"); //DLOG_PERROR("rawsend: setsockopt(IPV6_FREEBIND)");
// dont error because it's supported only from kernel 4.15 // dont error because it's supported only from kernel 4.15
} }
#endif #endif
@ -1686,7 +1686,7 @@ bool rawsend(const struct sockaddr* dst,uint32_t fwmark,const char *ifout,const
bytes = rawsend_sendto_divert(dst->sa_family,sock,data,len); bytes = rawsend_sendto_divert(dst->sa_family,sock,data,len);
if (bytes==-1) if (bytes==-1)
{ {
perror("rawsend: sendto_divert"); DLOG_PERROR("rawsend: sendto_divert");
return false; return false;
} }
return true; return true;
@ -1711,19 +1711,19 @@ bool rawsend(const struct sockaddr* dst,uint32_t fwmark,const char *ifout,const
//printf("family %u dev %s bind : ", dst->sa_family, ifout); print_sockaddr((struct sockaddr *)&sa_src); printf("\n"); //printf("family %u dev %s bind : ", dst->sa_family, ifout); print_sockaddr((struct sockaddr *)&sa_src); printf("\n");
if (setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, ifout, ifout ? strlen(ifout)+1 : 0) == -1) if (setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, ifout, ifout ? strlen(ifout)+1 : 0) == -1)
{ {
perror("rawsend: setsockopt(SO_BINDTODEVICE)"); DLOG_PERROR("rawsend: setsockopt(SO_BINDTODEVICE)");
return false; return false;
} }
if (bind(sock, (const struct sockaddr*)&sa_src, dst->sa_family==AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6))) if (bind(sock, (const struct sockaddr*)&sa_src, dst->sa_family==AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)))
{ {
perror("rawsend: bind (ignoring)"); DLOG_PERROR("rawsend: bind (ignoring)");
// do not fail. this can happen regardless of IP_FREEBIND // do not fail. this can happen regardless of IP_FREEBIND
// rebind to any address // rebind to any address
memset(&sa_src,0,sizeof(sa_src)); memset(&sa_src,0,sizeof(sa_src));
sa_src.ss_family = dst->sa_family; sa_src.ss_family = dst->sa_family;
if (bind(sock, (const struct sockaddr*)&sa_src, dst->sa_family==AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6))) if (bind(sock, (const struct sockaddr*)&sa_src, dst->sa_family==AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)))
{ {
perror("rawsend: bind to any"); DLOG_PERROR("rawsend: bind to any");
return false; return false;
} }
} }
@ -1734,7 +1734,7 @@ nofix:
bytes = sendto(sock, data, len, 0, (struct sockaddr*)&dst2, salen); bytes = sendto(sock, data, len, 0, (struct sockaddr*)&dst2, salen);
if (bytes==-1) if (bytes==-1)
{ {
perror("rawsend: sendto"); DLOG_PERROR("rawsend: sendto");
return false; return false;
} }
return true; return true;

5
nfq/darkmagic.h
View File

@ -187,6 +187,11 @@ void print_ip(const struct ip *ip);
void print_ip6hdr(const struct ip6_hdr *ip6hdr, uint8_t proto); void print_ip6hdr(const struct ip6_hdr *ip6hdr, uint8_t proto);
void print_tcphdr(const struct tcphdr *tcphdr); void print_tcphdr(const struct tcphdr *tcphdr);
void print_udphdr(const struct udphdr *udphdr); void print_udphdr(const struct udphdr *udphdr);
void str_ip(char *s, size_t s_len, const struct ip *ip);
void str_ip6hdr(char *s, size_t s_len, const struct ip6_hdr *ip6hdr, uint8_t proto);
void str_srcdst_ip6(char *s, size_t s_len, const void *saddr,const void *daddr);
void str_tcphdr(char *s, size_t s_len, const struct tcphdr *tcphdr);
void str_udphdr(char *s, size_t s_len, const struct udphdr *udphdr);
bool proto_check_ipv4(const uint8_t *data, size_t len); bool proto_check_ipv4(const uint8_t *data, size_t len);
void proto_skip_ipv4(uint8_t **data, size_t *len); void proto_skip_ipv4(uint8_t **data, size_t *len);

182
nfq/desync.c
View File

@ -253,7 +253,7 @@ static void auto_hostlist_failed(const char *hostname)
} }
if (!append_to_list_file(params.hostlist_auto_filename, hostname)) if (!append_to_list_file(params.hostlist_auto_filename, hostname))
{ {
perror("write to auto hostlist:"); DLOG_PERROR("write to auto hostlist:");
return; return;
} }
params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename); params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename);
@ -279,7 +279,7 @@ static bool send_delayed(t_ctrack *ctrack)
{ {
if (!rawpacket_queue_empty(&ctrack->delayed)) if (!rawpacket_queue_empty(&ctrack->delayed))
{ {
DLOG("SENDING %u delayed packets\n", rawpacket_queue_count(&ctrack->delayed)) DLOG("SENDING %u delayed packets\n", rawpacket_queue_count(&ctrack->delayed));
return rawsend_queue(&ctrack->delayed); return rawsend_queue(&ctrack->delayed);
} }
return true; return true;
@ -316,13 +316,13 @@ static bool reasm_feed(t_ctrack *ctrack, t_reassemble *reasm, uint8_t proto, con
uint32_t seq = (proto==IPPROTO_TCP) ? ctrack->seq_last : (uint32_t)reasm->size_present; uint32_t seq = (proto==IPPROTO_TCP) ? ctrack->seq_last : (uint32_t)reasm->size_present;
if (ReasmFeed(reasm, seq, data_payload, len_payload)) if (ReasmFeed(reasm, seq, data_payload, len_payload))
{ {
DLOG("reassemble : feeding data payload size=%zu. now we have %zu/%zu\n", len_payload,reasm->size_present,reasm->size) DLOG("reassemble : feeding data payload size=%zu. now we have %zu/%zu\n", len_payload,reasm->size_present,reasm->size);
return true; return true;
} }
else else
{ {
ReasmClear(reasm); ReasmClear(reasm);
DLOG("reassemble session failed\n") DLOG("reassemble session failed\n");
send_delayed(ctrack); send_delayed(ctrack);
} }
} }
@ -363,7 +363,7 @@ static uint8_t ct_new_postnat_fix(const t_ctrack *ctrack, struct ip *ip, struct
// we also can't use fooling because DPI would accept fooled packets // we also can't use fooling because DPI would accept fooled packets
if (ctrack && ctrack->pcounter_orig==1) if (ctrack && ctrack->pcounter_orig==1)
{ {
DLOG("applying linux postnat conntrack workaround\n") DLOG("applying linux postnat conntrack workaround\n");
if (proto==IPPROTO_UDP && udp && len_pkt) if (proto==IPPROTO_UDP && udp && len_pkt)
{ {
// make malformed udp packet with zero length and invalid checksum // make malformed udp packet with zero length and invalid checksum
@ -462,13 +462,13 @@ static size_t pos_normalize(size_t split_pos, size_t reasm_offset, size_t len_pa
if (rsplit_pos) if (rsplit_pos)
{ {
if (split_pos==rsplit_pos) if (split_pos==rsplit_pos)
DLOG("split pos %zu\n",split_pos) DLOG("split pos %zu\n",split_pos);
else else
{ {
if (split_pos) if (split_pos)
DLOG("split pos was normalized to packet data offset : %zu -> %zu\n",rsplit_pos,split_pos) DLOG("split pos was normalized to packet data offset : %zu -> %zu\n",rsplit_pos,split_pos);
else else
DLOG("split pos %zu is outside of this packet %zu-%zu\n",rsplit_pos,reasm_offset,reasm_offset+len_payload) DLOG("split pos %zu is outside of this packet %zu-%zu\n",rsplit_pos,reasm_offset,reasm_offset+len_payload);
} }
} }
return split_pos; return split_pos;
@ -530,9 +530,9 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
{ {
ctrack->autottl = autottl_guess(ttl_orig, attl); ctrack->autottl = autottl_guess(ttl_orig, attl);
if (ctrack->autottl) if (ctrack->autottl)
DLOG("autottl: guessed %u\n",ctrack->autottl) DLOG("autottl: guessed %u\n",ctrack->autottl);
else else
DLOG("autottl: could not guess\n") DLOG("autottl: could not guess\n");
} }
} }
@ -556,11 +556,11 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
bFail = HttpReplyLooksLikeDPIRedirect(data_payload, len_payload, ctrack->hostname); bFail = HttpReplyLooksLikeDPIRedirect(data_payload, len_payload, ctrack->hostname);
if (bFail) if (bFail)
{ {
DLOG("redirect to another domain detected. possibly DPI redirect.\n") DLOG("redirect to another domain detected. possibly DPI redirect.\n");
HOSTLIST_DEBUGLOG_APPEND("%s : redirect to another domain", ctrack->hostname); HOSTLIST_DEBUGLOG_APPEND("%s : redirect to another domain", ctrack->hostname);
} }
else else
DLOG("local or in-domain redirect detected. it's not a DPI redirect.\n") DLOG("local or in-domain redirect detected. it's not a DPI redirect.\n");
} }
else else
{ {
@ -647,7 +647,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
return verdict; return verdict;
} }
DLOG("sending SYN with fake data : "); DLOG("sending SYN with fake data : ");
hexdump_limited_dlog(params.fake_syndata,params.fake_syndata_size,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(params.fake_syndata,params.fake_syndata_size,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
verdict = ct_new_postnat_fix_tcp(ctrack, ip, ip6hdr, tcphdr); verdict = ct_new_postnat_fix_tcp(ctrack, ip, ip6hdr, tcphdr);
@ -693,7 +693,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if ((bIsHttp = IsHttp(rdata_payload,rlen_payload))) if ((bIsHttp = IsHttp(rdata_payload,rlen_payload)))
{ {
DLOG("packet contains HTTP request\n") DLOG("packet contains HTTP request\n");
if (ctrack && !ctrack->l7proto) ctrack->l7proto = HTTP; if (ctrack && !ctrack->l7proto) ctrack->l7proto = HTTP;
// we do not reassemble http // we do not reassemble http
@ -707,7 +707,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
bHaveHost=HttpExtractHost(rdata_payload,rlen_payload,host,sizeof(host)); bHaveHost=HttpExtractHost(rdata_payload,rlen_payload,host,sizeof(host));
if (!bHaveHost) if (!bHaveHost)
{ {
DLOG("not applying tampering to HTTP without Host:\n") DLOG("not applying tampering to HTTP without Host:\n");
return verdict; return verdict;
} }
} }
@ -728,7 +728,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
else if (IsTLSClientHello(rdata_payload,rlen_payload,TLS_PARTIALS_ENABLE)) else if (IsTLSClientHello(rdata_payload,rlen_payload,TLS_PARTIALS_ENABLE))
{ {
bool bReqFull = IsTLSRecordFull(rdata_payload,rlen_payload); bool bReqFull = IsTLSRecordFull(rdata_payload,rlen_payload);
DLOG(bReqFull ? "packet contains full TLS ClientHello\n" : "packet contains partial TLS ClientHello\n") DLOG(bReqFull ? "packet contains full TLS ClientHello\n" : "packet contains partial TLS ClientHello\n");
bHaveHost=TLSHelloExtractHost(rdata_payload,rlen_payload,host,sizeof(host),TLS_PARTIALS_ENABLE); bHaveHost=TLSHelloExtractHost(rdata_payload,rlen_payload,host,sizeof(host),TLS_PARTIALS_ENABLE);
@ -787,7 +787,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if (params.desync_skip_nosni && !bHaveHost) if (params.desync_skip_nosni && !bHaveHost)
{ {
DLOG("not applying tampering to TLS ClientHello without hostname in the SNI\n") DLOG("not applying tampering to TLS ClientHello without hostname in the SNI\n");
reasm_orig_cancel(ctrack); reasm_orig_cancel(ctrack);
return verdict; return verdict;
} }
@ -812,7 +812,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if (bHaveHost) if (bHaveHost)
{ {
DLOG("hostname: %s\n",host) DLOG("hostname: %s\n",host);
if (params.hostlist || params.hostlist_exclude) if (params.hostlist || params.hostlist_exclude)
{ {
bool bBypass; bool bBypass;
@ -830,7 +830,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
else else
ctrack_stop_retrans_counter(ctrack_replay); ctrack_stop_retrans_counter(ctrack_replay);
} }
DLOG("not applying tampering to this request\n") DLOG("not applying tampering to this request\n");
return verdict; return verdict;
} }
} }
@ -839,7 +839,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if (!bKnownProtocol) if (!bKnownProtocol)
{ {
if (!params.desync_any_proto) return verdict; if (!params.desync_any_proto) return verdict;
DLOG("applying tampering to unknown protocol\n") DLOG("applying tampering to unknown protocol\n");
fake = params.fake_unknown; fake = params.fake_unknown;
fake_size = params.fake_unknown_size; fake_size = params.fake_unknown_size;
} }
@ -848,7 +848,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
{ {
if (params.hostcase) if (params.hostcase)
{ {
DLOG("modifying Host: => %c%c%c%c:\n", params.hostspell[0], params.hostspell[1], params.hostspell[2], params.hostspell[3]) DLOG("modifying Host: => %c%c%c%c:\n", params.hostspell[0], params.hostspell[1], params.hostspell[2], params.hostspell[3]);
memcpy(phost + 2, params.hostspell, 4); memcpy(phost + 2, params.hostspell, 4);
verdict=VERDICT_MODIFY; verdict=VERDICT_MODIFY;
} }
@ -864,7 +864,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
(pua = (uint8_t*)memmem(data_payload, len_payload, "\r\nUser-Agent: ", 14)) && (pua = (uint8_t*)memmem(data_payload, len_payload, "\r\nUser-Agent: ", 14)) &&
(pua = (uint8_t*)memmem(pua + 1, len_payload - (pua - data_payload) - 1, "\r\n", 2))) (pua = (uint8_t*)memmem(pua + 1, len_payload - (pua - data_payload) - 1, "\r\n", 2)))
{ {
DLOG("removing space after Host: and adding it to User-Agent:\n") DLOG("removing space after Host: and adding it to User-Agent:\n");
if (pua > phost) if (pua > phost)
{ {
memmove(phost + 7, phost + 8, pua - phost - 8); memmove(phost + 7, phost + 8, pua - phost - 8);
@ -883,11 +883,10 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if (params.debug) if (params.debug)
{ {
printf("dpi desync src="); char s1[48],s2[48];
print_sockaddr((struct sockaddr *)&src); ntop46_port((struct sockaddr *)&src, s1, sizeof(s1));
printf(" dst="); ntop46_port((struct sockaddr *)&dst, s2, sizeof(s2));
print_sockaddr((struct sockaddr *)&dst); DLOG("dpi desync src=%s dst=%s\n",s1,s2);
printf("\n");
} }
if (!split_pos || split_pos>rlen_payload) split_pos=1; if (!split_pos || split_pos>rlen_payload) split_pos=1;
@ -922,7 +921,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
return verdict; return verdict;
} }
DLOG("sending fake request : "); DLOG("sending fake request : ");
hexdump_limited_dlog(fake,fake_size,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(fake,fake_size,PKTDATA_MAXDUMP); DLOG("\n");
b = true; b = true;
break; break;
case DESYNC_RST: case DESYNC_RST:
@ -968,7 +967,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
return verdict; return verdict;
if (params.desync_mode2==DESYNC_NONE || !desync_valid_second_stage_tcp(params.desync_mode2)) if (params.desync_mode2==DESYNC_NONE || !desync_valid_second_stage_tcp(params.desync_mode2))
{ {
DLOG("reinjecting original packet. len=%zu len_payload=%zu\n", *len_pkt, len_payload) DLOG("reinjecting original packet. len=%zu len_payload=%zu\n", *len_pkt, len_payload);
verdict_tcp_csum_fix(verdict, tcphdr, transport_len, ip, ip6hdr); verdict_tcp_csum_fix(verdict, tcphdr, transport_len, ip, ip6hdr);
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , data_pkt, *len_pkt)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , data_pkt, *len_pkt))
return verdict; return verdict;
@ -989,7 +988,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if (params.desync_seqovl>=split_pos) if (params.desync_seqovl>=split_pos)
{ {
DLOG("seqovl>=split_pos. desync is not possible.\n") DLOG("seqovl>=split_pos. desync is not possible.\n");
return verdict; return verdict;
} }
@ -1000,7 +999,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
seg_len = len_payload-split_pos+params.desync_seqovl; seg_len = len_payload-split_pos+params.desync_seqovl;
if (seg_len>sizeof(fakeseg)) if (seg_len>sizeof(fakeseg))
{ {
DLOG("seqovl is too large\n") DLOG("seqovl is too large\n");
return verdict; return verdict;
} }
fill_pattern(fakeseg,params.desync_seqovl,params.seqovl_pattern,sizeof(params.seqovl_pattern)); fill_pattern(fakeseg,params.desync_seqovl,params.seqovl_pattern,sizeof(params.seqovl_pattern));
@ -1017,8 +1016,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment, ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment,
seg, seg_len, pkt1, &pkt1_len)) seg, seg_len, pkt1, &pkt1_len))
return verdict; return verdict;
DLOG("sending 2nd out-of-order tcp segment %zu-%zu len=%zu seqovl=%u : ",split_pos,len_payload-1, len_payload-split_pos, params.desync_seqovl) DLOG("sending 2nd out-of-order tcp segment %zu-%zu len=%zu seqovl=%u : ",split_pos,len_payload-1, len_payload-split_pos, params.desync_seqovl);
hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
} }
@ -1031,8 +1030,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
ttl_fake,params.desync_fooling_mode,params.desync_badseq_increment,params.desync_badseq_ack_increment, ttl_fake,params.desync_fooling_mode,params.desync_badseq_increment,params.desync_badseq_ack_increment,
zeropkt, split_pos, fakeseg, &seg_len)) zeropkt, split_pos, fakeseg, &seg_len))
return verdict; return verdict;
DLOG("sending fake(1) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos) DLOG("sending fake(1) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len)) if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len))
return verdict; return verdict;
} }
@ -1042,15 +1041,15 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment, ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment,
data_payload, split_pos, pkt1, &pkt1_len)) data_payload, split_pos, pkt1, &pkt1_len))
return verdict; return verdict;
DLOG("sending 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos) DLOG("sending 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
hexdump_limited_dlog(data_payload,split_pos,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(data_payload,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
if (desync_mode==DESYNC_DISORDER) if (desync_mode==DESYNC_DISORDER)
{ {
DLOG("sending fake(2) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos) DLOG("sending fake(2) 1st out-of-order tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len)) if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, seg_len))
return verdict; return verdict;
} }
@ -1072,8 +1071,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
ttl_fake,params.desync_fooling_mode,params.desync_badseq_increment,params.desync_badseq_ack_increment, ttl_fake,params.desync_fooling_mode,params.desync_badseq_increment,params.desync_badseq_ack_increment,
zeropkt, split_pos, fakeseg, &fakeseg_len)) zeropkt, split_pos, fakeseg, &fakeseg_len))
return verdict; return verdict;
DLOG("sending fake(1) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos) DLOG("sending fake(1) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len)) if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
return verdict; return verdict;
} }
@ -1083,7 +1082,7 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
seg_len = split_pos+params.desync_seqovl; seg_len = split_pos+params.desync_seqovl;
if (seg_len>sizeof(ovlseg)) if (seg_len>sizeof(ovlseg))
{ {
DLOG("seqovl is too large") DLOG("seqovl is too large");
return verdict; return verdict;
} }
fill_pattern(ovlseg,params.desync_seqovl,params.seqovl_pattern,sizeof(params.seqovl_pattern)); fill_pattern(ovlseg,params.desync_seqovl,params.seqovl_pattern,sizeof(params.seqovl_pattern));
@ -1100,15 +1099,15 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment, ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment,
seg, seg_len, pkt1, &pkt1_len)) seg, seg_len, pkt1, &pkt1_len))
return verdict; return verdict;
DLOG("sending 1st tcp segment 0-%zu len=%zu seqovl=%u : ",split_pos-1, split_pos, params.desync_seqovl) DLOG("sending 1st tcp segment 0-%zu len=%zu seqovl=%u : ",split_pos-1, split_pos, params.desync_seqovl);
hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(seg,seg_len,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
if (desync_mode==DESYNC_SPLIT) if (desync_mode==DESYNC_SPLIT)
{ {
DLOG("sending fake(2) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos) DLOG("sending fake(2) 1st tcp segment 0-%zu len=%zu : ",split_pos-1, split_pos);
hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(zeropkt,split_pos,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len)) if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , fakeseg, fakeseg_len))
return verdict; return verdict;
} }
@ -1119,8 +1118,8 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment, ttl_orig,fooling_orig,params.desync_badseq_increment,params.desync_badseq_ack_increment,
data_payload+split_pos, len_payload-split_pos, pkt1, &pkt1_len)) data_payload+split_pos, len_payload-split_pos, pkt1, &pkt1_len))
return verdict; return verdict;
DLOG("sending 2nd tcp segment %zu-%zu len=%zu : ",split_pos,len_payload-1, len_payload-split_pos) DLOG("sending 2nd tcp segment %zu-%zu len=%zu : ",split_pos,len_payload-1, len_payload-split_pos);
hexdump_limited_dlog(data_payload+split_pos,len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(data_payload+split_pos,len_payload-split_pos,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
} }
@ -1158,13 +1157,13 @@ static uint8_t dpi_desync_tcp_packet_play(bool replay, size_t reasm_offset, uint
if (!ip_frag(pkt_orig, pkt_orig_len, ipfrag_pos, ident, pkt1, &pkt1_len, pkt2, &pkt2_len)) if (!ip_frag(pkt_orig, pkt_orig_len, ipfrag_pos, ident, pkt1, &pkt1_len, pkt2, &pkt2_len))
return verdict; return verdict;
DLOG("sending 1st ip fragment 0-%zu ip_payload_len=%zu : ", ipfrag_pos-1, ipfrag_pos) DLOG("sending 1st ip fragment 0-%zu ip_payload_len=%zu : ", ipfrag_pos-1, ipfrag_pos);
hexdump_limited_dlog(pkt1,pkt1_len,IP_MAXDUMP); DLOG("\n") hexdump_limited_dlog(pkt1,pkt1_len,IP_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
DLOG("sending 2nd ip fragment %zu-%zu ip_payload_len=%zu : ", ipfrag_pos, transport_len-1, transport_len-ipfrag_pos) DLOG("sending 2nd ip fragment %zu-%zu ip_payload_len=%zu : ", ipfrag_pos, transport_len-1, transport_len-ipfrag_pos);
hexdump_limited_dlog(pkt2,pkt2_len,IP_MAXDUMP); DLOG("\n") hexdump_limited_dlog(pkt2,pkt2_len,IP_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt2, pkt2_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt2, pkt2_len))
return verdict; return verdict;
@ -1185,12 +1184,12 @@ static bool quic_reasm_cancel(t_ctrack *ctrack, const char *reason)
reasm_orig_cancel(ctrack); reasm_orig_cancel(ctrack);
if (params.desync_any_proto) if (params.desync_any_proto)
{ {
DLOG("%s. applying tampering because desync_any_proto is set\n",reason) DLOG("%s. applying tampering because desync_any_proto is set\n",reason);
return true; return true;
} }
else else
{ {
DLOG("%s. not applying tampering because desync_any_proto is not set\n",reason) DLOG("%s. not applying tampering because desync_any_proto is not set\n",reason);
return false; return false;
} }
} }
@ -1259,7 +1258,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (IsQUICInitial(data_payload,len_payload)) if (IsQUICInitial(data_payload,len_payload))
{ {
DLOG("packet contains QUIC initial\n") DLOG("packet contains QUIC initial\n");
if (ctrack && !ctrack->l7proto) ctrack->l7proto = QUIC; if (ctrack && !ctrack->l7proto) ctrack->l7proto = QUIC;
uint8_t clean[16384], *pclean; uint8_t clean[16384], *pclean;
@ -1300,7 +1299,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
bool bIsHello = IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len); bool bIsHello = IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len);
bool bReqFull = bIsHello ? IsTLSHandshakeFull(defrag+hello_offset,hello_len) : false; bool bReqFull = bIsHello ? IsTLSHandshakeFull(defrag+hello_offset,hello_len) : false;
DLOG(bIsHello ? bReqFull ? "packet contains full TLS ClientHello\n" : "packet contains partial TLS ClientHello\n" : "packet does not contain TLS ClientHello\n") DLOG(bIsHello ? bReqFull ? "packet contains full TLS ClientHello\n" : "packet contains partial TLS ClientHello\n" : "packet does not contain TLS ClientHello\n");
if (ctrack) if (ctrack)
{ {
@ -1341,7 +1340,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (!bHaveHost && params.desync_skip_nosni) if (!bHaveHost && params.desync_skip_nosni)
{ {
reasm_orig_cancel(ctrack); reasm_orig_cancel(ctrack);
DLOG("not applying tampering to QUIC ClientHello without hostname in the SNI\n") DLOG("not applying tampering to QUIC ClientHello without hostname in the SNI\n");
return verdict; return verdict;
} }
} }
@ -1375,7 +1374,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (IsWireguardHandshakeInitiation(data_payload,len_payload)) if (IsWireguardHandshakeInitiation(data_payload,len_payload))
{ {
DLOG("packet contains wireguard handshake initiation\n") DLOG("packet contains wireguard handshake initiation\n");
if (ctrack && !ctrack->l7proto) ctrack->l7proto = WIREGUARD; if (ctrack && !ctrack->l7proto) ctrack->l7proto = WIREGUARD;
fake = params.fake_wg; fake = params.fake_wg;
fake_size = params.fake_wg_size; fake_size = params.fake_wg_size;
@ -1383,7 +1382,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
} }
else if (IsDhtD1(data_payload,len_payload)) else if (IsDhtD1(data_payload,len_payload))
{ {
DLOG("packet contains DHT d1...e\n") DLOG("packet contains DHT d1...e\n");
if (ctrack && !ctrack->l7proto) ctrack->l7proto = DHT; if (ctrack && !ctrack->l7proto) ctrack->l7proto = DHT;
fake = params.fake_dht; fake = params.fake_dht;
fake_size = params.fake_dht_size; fake_size = params.fake_dht_size;
@ -1392,7 +1391,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
else else
{ {
if (!params.desync_any_proto) return verdict; if (!params.desync_any_proto) return verdict;
DLOG("applying tampering to unknown protocol\n") DLOG("applying tampering to unknown protocol\n");
fake = params.fake_unknown_udp; fake = params.fake_unknown_udp;
fake_size = params.fake_unknown_udp_size; fake_size = params.fake_unknown_udp_size;
} }
@ -1400,7 +1399,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (bHaveHost) if (bHaveHost)
{ {
DLOG("hostname: %s\n",host) DLOG("hostname: %s\n",host);
if (params.hostlist || params.hostlist_exclude) if (params.hostlist || params.hostlist_exclude)
{ {
bool bBypass; bool bBypass;
@ -1418,7 +1417,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
ctrack_replay->hostname=strdup(host); ctrack_replay->hostname=strdup(host);
} }
} }
DLOG("not applying tampering to this request\n") DLOG("not applying tampering to this request\n");
return verdict; return verdict;
} }
} }
@ -1429,11 +1428,10 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (params.debug) if (params.debug)
{ {
printf("dpi desync src="); char s1[48],s2[48];
print_sockaddr((struct sockaddr *)&src); ntop46_port((struct sockaddr *)&src, s1, sizeof(s1));
printf(" dst="); ntop46_port((struct sockaddr *)&dst, s2, sizeof(s2));
print_sockaddr((struct sockaddr *)&dst); DLOG("dpi desync src=%s dst=%s\n",s1,s2);
printf("\n");
} }
pkt1_len = sizeof(pkt1); pkt1_len = sizeof(pkt1);
@ -1451,7 +1449,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (!prepare_udp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, ttl_fake, params.desync_fooling_mode, NULL, 0, 0, fake, fake_size, pkt1, &pkt1_len)) if (!prepare_udp_segment((struct sockaddr *)&src, (struct sockaddr *)&dst, ttl_fake, params.desync_fooling_mode, NULL, 0, 0, fake, fake_size, pkt1, &pkt1_len))
return verdict; return verdict;
DLOG("sending fake request : "); DLOG("sending fake request : ");
hexdump_limited_dlog(fake,fake_size,PKTDATA_MAXDUMP); DLOG("\n") hexdump_limited_dlog(fake,fake_size,PKTDATA_MAXDUMP); DLOG("\n");
if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend_rep((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
b = true; b = true;
@ -1485,7 +1483,7 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
{ {
if (params.desync_mode2==DESYNC_NONE || !desync_valid_second_stage_udp(params.desync_mode2)) if (params.desync_mode2==DESYNC_NONE || !desync_valid_second_stage_udp(params.desync_mode2))
{ {
DLOG("reinjecting original packet. len=%zu len_payload=%zu\n", *len_pkt, len_payload) DLOG("reinjecting original packet. len=%zu len_payload=%zu\n", *len_pkt, len_payload);
verdict_udp_csum_fix(verdict, udphdr, transport_len, ip, ip6hdr); verdict_udp_csum_fix(verdict, udphdr, transport_len, ip, ip6hdr);
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , data_pkt, *len_pkt)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , data_pkt, *len_pkt))
return verdict; return verdict;
@ -1568,13 +1566,13 @@ static uint8_t dpi_desync_udp_packet_play(bool replay, size_t reasm_offset, uint
if (!ip_frag(pkt_orig, pkt_orig_len, ipfrag_pos, ident, pkt1, &pkt1_len, pkt2, &pkt2_len)) if (!ip_frag(pkt_orig, pkt_orig_len, ipfrag_pos, ident, pkt1, &pkt1_len, pkt2, &pkt2_len))
return verdict; return verdict;
DLOG("sending 1st ip fragment 0-%zu ip_payload_len=%zu : ", ipfrag_pos-1, ipfrag_pos) DLOG("sending 1st ip fragment 0-%zu ip_payload_len=%zu : ", ipfrag_pos-1, ipfrag_pos);
hexdump_limited_dlog(pkt1,pkt1_len,IP_MAXDUMP); DLOG("\n") hexdump_limited_dlog(pkt1,pkt1_len,IP_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt1, pkt1_len))
return verdict; return verdict;
DLOG("sending 2nd ip fragment %zu-%zu ip_payload_len=%zu : ", ipfrag_pos, transport_len-1, transport_len-ipfrag_pos) DLOG("sending 2nd ip fragment %zu-%zu ip_payload_len=%zu : ", ipfrag_pos, transport_len-1, transport_len-ipfrag_pos);
hexdump_limited_dlog(pkt2,pkt2_len,IP_MAXDUMP); DLOG("\n") hexdump_limited_dlog(pkt2,pkt2_len,IP_MAXDUMP); DLOG("\n");
if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt2, pkt2_len)) if (!rawsend((struct sockaddr *)&dst, desync_fwmark, ifout , pkt2, pkt2_len))
return verdict; return verdict;
@ -1594,34 +1592,36 @@ static void packet_debug(bool replay, uint8_t proto, const struct ip *ip, const
{ {
if (params.debug) if (params.debug)
{ {
if (replay) printf("REPLAY "); if (replay) DLOG("REPLAY ");
if (ip) if (ip)
{ {
printf("IP4: "); char s[66];
print_ip(ip); str_ip(s,sizeof(s),ip);
DLOG("IP4: %s",s);
} }
else if (ip6hdr) else if (ip6hdr)
{ {
printf("IP6: "); char s[128];
print_ip6hdr(ip6hdr, proto); str_ip6hdr(s,sizeof(s),ip6hdr, proto);
DLOG("IP6: %s",s);
} }
if (tcphdr) if (tcphdr)
{ {
printf(" "); char s[80];
print_tcphdr(tcphdr); str_tcphdr(s,sizeof(s),tcphdr);
printf("\n"); DLOG(" %s\n",s);
if (len_payload) { printf("TCP: "); hexdump_limited_dlog(data_payload, len_payload, 32); printf("\n"); } if (len_payload) { DLOG("TCP: "); hexdump_limited_dlog(data_payload, len_payload, 32); DLOG("\n"); }
} }
else if (udphdr) else if (udphdr)
{ {
printf(" "); char s[30];
print_udphdr(udphdr); str_udphdr(s,sizeof(s),udphdr);
printf("\n"); DLOG(" %s\n",s);
if (len_payload) { printf("UDP: "); hexdump_limited_dlog(data_payload, len_payload, 32); printf("\n"); } if (len_payload) { DLOG("UDP: "); hexdump_limited_dlog(data_payload, len_payload, 32); DLOG("\n"); }
} }
else else
printf("\n"); DLOG("\n");
} }
} }
@ -1676,20 +1676,20 @@ static bool replay_queue(struct rawpacket_tailhead *q)
bool b = true; bool b = true;
for (i=1,offset=0 ; (rp=rawpacket_dequeue(q)) ; offset+=rp->len_payload, rawpacket_free(rp), i++) for (i=1,offset=0 ; (rp=rawpacket_dequeue(q)) ; offset+=rp->len_payload, rawpacket_free(rp), i++)
{ {
DLOG("REPLAYING delayed packet #%u offset %zu\n",i,offset) DLOG("REPLAYING delayed packet #%u offset %zu\n",i,offset);
uint8_t verdict = dpi_desync_packet_play(true, offset, rp->fwmark, rp->ifout, rp->packet, &rp->len); uint8_t verdict = dpi_desync_packet_play(true, offset, rp->fwmark, rp->ifout, rp->packet, &rp->len);
switch(verdict & VERDICT_MASK) switch(verdict & VERDICT_MASK)
{ {
case VERDICT_MODIFY: case VERDICT_MODIFY:
DLOG("SENDING delayed packet #%u modified\n", i) DLOG("SENDING delayed packet #%u modified\n", i);
b &= rawsend_rp(rp); b &= rawsend_rp(rp);
break; break;
case VERDICT_PASS: case VERDICT_PASS:
DLOG("SENDING delayed packet #%u unmodified\n", i) DLOG("SENDING delayed packet #%u unmodified\n", i);
b &= rawsend_rp(rp); b &= rawsend_rp(rp);
break; break;
case VERDICT_DROP: case VERDICT_DROP:
DLOG("DROPPING delayed packet #%u\n", i) DLOG("DROPPING delayed packet #%u\n", i);
break; break;
} }
} }

10
nfq/helpers.c
View File

@ -189,24 +189,24 @@ void dbgprint_socket_buffers(int fd)
socklen_t sz; socklen_t sz;
sz = sizeof(int); sz = sizeof(int);
if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz)) if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz))
DLOG("fd=%d SO_RCVBUF=%d\n", fd, v) DLOG("fd=%d SO_RCVBUF=%d\n", fd, v);
sz = sizeof(int); sz = sizeof(int);
if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz)) if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz))
DLOG("fd=%d SO_SNDBUF=%d\n", fd, v) DLOG("fd=%d SO_SNDBUF=%d\n", fd, v);
} }
} }
bool set_socket_buffers(int fd, int rcvbuf, int sndbuf) bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
{ {
DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf) DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf);
if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0) if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0)
{ {
perror("setsockopt (SO_RCVBUF)"); DLOG_PERROR("setsockopt (SO_RCVBUF)");
close(fd); close(fd);
return false; return false;
} }
if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0) if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0)
{ {
perror("setsockopt (SO_SNDBUF)"); DLOG_PERROR("setsockopt (SO_SNDBUF)");
close(fd); close(fd);
return false; return false;
} }

24
nfq/hostlist.c
View File

@ -31,11 +31,11 @@ bool AppendHostList(strpool **hostlist, char *filename)
FILE *F; FILE *F;
int r; int r;
printf("Loading hostlist %s\n",filename); DLOG_CONDUP("Loading hostlist %s\n",filename);
if (!(F = fopen(filename, "rb"))) if (!(F = fopen(filename, "rb")))
{ {
fprintf(stderr, "Could not open %s\n", filename); DLOG_ERR("Could not open %s\n", filename);
return false; return false;
} }
@ -45,7 +45,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
fclose(F); fclose(F);
if (r==Z_OK) if (r==Z_OK)
{ {
printf("zlib compression detected. uncompressed size : %zu\n", zsize); DLOG_CONDUP("zlib compression detected. uncompressed size : %zu\n", zsize);
p = zbuf; p = zbuf;
e = zbuf + zsize; e = zbuf + zsize;
@ -54,7 +54,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue; if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue;
if (!addpool(hostlist,&p,e)) if (!addpool(hostlist,&p,e))
{ {
fprintf(stderr, "Not enough memory to store host list : %s\n", filename); DLOG_ERR("Not enough memory to store host list : %s\n", filename);
free(zbuf); free(zbuf);
return false; return false;
} }
@ -64,13 +64,13 @@ bool AppendHostList(strpool **hostlist, char *filename)
} }
else else
{ {
fprintf(stderr, "zlib decompression failed : result %d\n",r); DLOG_ERR("zlib decompression failed : result %d\n",r);
return false; return false;
} }
} }
else else
{ {
printf("loading plain text list\n"); DLOG_CONDUP("loading plain text list\n");
while (fgets(s, 256, F)) while (fgets(s, 256, F))
{ {
@ -78,7 +78,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue; if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue;
if (!addpool(hostlist,&p,p+strlen(p))) if (!addpool(hostlist,&p,p+strlen(p)))
{ {
fprintf(stderr, "Not enough memory to store host list : %s\n", filename); DLOG_ERR("Not enough memory to store host list : %s\n", filename);
fclose(F); fclose(F);
return false; return false;
} }
@ -87,7 +87,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
fclose(F); fclose(F);
} }
printf("Loaded %d hosts from %s\n", ct, filename); DLOG_CONDUP("Loaded %d hosts from %s\n", ct, filename);
return true; return true;
} }
@ -124,7 +124,7 @@ bool SearchHostList(strpool *hostlist, const char *host)
while (p) while (p)
{ {
bInHostList = StrPoolCheckStr(hostlist, p); bInHostList = StrPoolCheckStr(hostlist, p);
if (params.debug) printf("Hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative"); DLOG("Hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative");
if (bInHostList) return true; if (bInHostList) return true;
p = strchr(p, '.'); p = strchr(p, '.');
if (p) p++; if (p) p++;
@ -139,7 +139,7 @@ static bool HostlistCheck_(strpool *hostlist, strpool *hostlist_exclude, const c
if (excluded) *excluded = false; if (excluded) *excluded = false;
if (hostlist_exclude) if (hostlist_exclude)
{ {
if (params.debug) printf("Checking exclude hostlist\n"); DLOG("Checking exclude hostlist\n");
if (SearchHostList(hostlist_exclude, host)) if (SearchHostList(hostlist_exclude, host))
{ {
if (excluded) *excluded = true; if (excluded) *excluded = true;
@ -148,7 +148,7 @@ static bool HostlistCheck_(strpool *hostlist, strpool *hostlist_exclude, const c
} }
if (hostlist) if (hostlist)
{ {
if (params.debug) printf("Checking include hostlist\n"); DLOG("Checking include hostlist\n");
return SearchHostList(hostlist, host); return SearchHostList(hostlist, host);
} }
return true; return true;
@ -162,7 +162,7 @@ bool HostlistCheck(const char *host, bool *excluded)
time_t t = file_mod_time(params.hostlist_auto_filename); time_t t = file_mod_time(params.hostlist_auto_filename);
if (t!=params.hostlist_auto_mod_time) if (t!=params.hostlist_auto_mod_time)
{ {
printf("Autohostlist was modified by another process. Reloading include hostslist.\n"); DLOG_CONDUP("Autohostlist was modified by another process. Reloading include hostslist.\n");
if (!LoadIncludeHostLists()) if (!LoadIncludeHostLists())
{ {
// what will we do without hostlist ?? sure, gonna die // what will we do without hostlist ?? sure, gonna die

290
nfq/nfqws.c
View File

@ -28,6 +28,7 @@
#include <sys/socket.h> #include <sys/socket.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <netinet/in.h> #include <netinet/in.h>
#include <syslog.h>
#ifdef __CYGWIN__ #ifdef __CYGWIN__
#include "win.h" #include "win.h"
@ -99,7 +100,7 @@ static uint8_t processPacketData(uint32_t *mark, const char *ifout, uint8_t *dat
#ifdef __linux__ #ifdef __linux__
if (*mark & params.desync_fwmark) if (*mark & params.desync_fwmark)
{ {
DLOG("ignoring generated packet\n") DLOG("ignoring generated packet\n");
return VERDICT_PASS; return VERDICT_PASS;
} }
#endif #endif
@ -129,11 +130,11 @@ static int nfq_cb(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, struct nfq_da
ifidx = nfq_get_outdev(nfa); ifidx = nfq_get_outdev(nfa);
if (ifidx) if_indextoname(ifidx,ifout); if (ifidx) if_indextoname(ifidx,ifout);
DLOG("packet: id=%d len=%d mark=%08X ifout=%s(%u)\n", id, ilen, mark, ifout, ifidx) DLOG("packet: id=%d len=%d mark=%08X ifout=%s(%u)\n", id, ilen, mark, ifout, ifidx);
} }
else else
// save some syscalls // save some syscalls
DLOG("packet: id=%d len=%d mark=%08X\n", id, ilen, mark) DLOG("packet: id=%d len=%d mark=%08X\n", id, ilen, mark);
if (ilen >= 0) if (ilen >= 0)
{ {
len = ilen; len = ilen;
@ -158,49 +159,49 @@ static int nfq_main(void)
int fd,rv; int fd,rv;
uint8_t buf[16384] __attribute__((aligned)); uint8_t buf[16384] __attribute__((aligned));
printf("opening library handle\n"); DLOG_CONDUP("opening library handle\n");
h = nfq_open(); h = nfq_open();
if (!h) { if (!h) {
perror("nfq_open()"); DLOG_PERROR("nfq_open()");
goto exiterr; goto exiterr;
} }
printf("unbinding existing nf_queue handler for AF_INET (if any)\n"); DLOG_CONDUP("unbinding existing nf_queue handler for AF_INET (if any)\n");
if (nfq_unbind_pf(h, AF_INET) < 0) { if (nfq_unbind_pf(h, AF_INET) < 0) {
perror("nfq_unbind_pf()"); DLOG_PERROR("nfq_unbind_pf()");
goto exiterr; goto exiterr;
} }
printf("binding nfnetlink_queue as nf_queue handler for AF_INET\n"); DLOG_CONDUP("binding nfnetlink_queue as nf_queue handler for AF_INET\n");
if (nfq_bind_pf(h, AF_INET) < 0) { if (nfq_bind_pf(h, AF_INET) < 0) {
perror("nfq_bind_pf()"); DLOG_PERROR("nfq_bind_pf()");
goto exiterr; goto exiterr;
} }
printf("binding this socket to queue '%u'\n", params.qnum); DLOG_CONDUP("binding this socket to queue '%u'\n", params.qnum);
qh = nfq_create_queue(h, params.qnum, &nfq_cb, &params); qh = nfq_create_queue(h, params.qnum, &nfq_cb, &params);
if (!qh) { if (!qh) {
perror("nfq_create_queue()"); DLOG_PERROR("nfq_create_queue()");
goto exiterr; goto exiterr;
} }
printf("setting copy_packet mode\n"); DLOG_CONDUP("setting copy_packet mode\n");
if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) { if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
perror("can't set packet_copy mode"); DLOG_PERROR("can't set packet_copy mode");
goto exiterr; goto exiterr;
} }
if (nfq_set_queue_maxlen(qh, Q_MAXLEN) < 0) { if (nfq_set_queue_maxlen(qh, Q_MAXLEN) < 0) {
perror("can't set queue maxlen"); DLOG_PERROR("can't set queue maxlen");
goto exiterr; goto exiterr;
} }
// accept packets if they cant be handled // accept packets if they cant be handled
if (nfq_set_queue_flags(qh, NFQA_CFG_F_FAIL_OPEN , NFQA_CFG_F_FAIL_OPEN)) if (nfq_set_queue_flags(qh, NFQA_CFG_F_FAIL_OPEN , NFQA_CFG_F_FAIL_OPEN))
{ {
fprintf(stderr, "can't set queue flags. its OK on linux <3.6\n"); DLOG_ERR("can't set queue flags. its OK on linux <3.6\n");
// dot not fail. not supported on old linuxes <3.6 // dot not fail. not supported on old linuxes <3.6
} }
printf("initializing raw sockets bind-fix4=%u bind-fix6=%u\n",params.bind_fix4,params.bind_fix6); DLOG_CONDUP("initializing raw sockets bind-fix4=%u bind-fix6=%u\n",params.bind_fix4,params.bind_fix6);
if (!rawsend_preinit(params.bind_fix4,params.bind_fix6)) if (!rawsend_preinit(params.bind_fix4,params.bind_fix6))
goto exiterr; goto exiterr;
@ -227,24 +228,24 @@ static int nfq_main(void)
{ {
dohup(); dohup();
int r = nfq_handle_packet(h, (char *)buf, rv); int r = nfq_handle_packet(h, (char *)buf, rv);
if (r) fprintf(stderr, "nfq_handle_packet error %d\n", r); if (r) DLOG_ERR("nfq_handle_packet error %d\n", r);
} }
fprintf(stderr, "recv: errno %d\n",errno); DLOG_ERR("recv: errno %d\n",errno);
perror("recv"); DLOG_PERROR("recv");
// do not fail on ENOBUFS // do not fail on ENOBUFS
} while(errno==ENOBUFS); } while(errno==ENOBUFS);
printf("unbinding from queue %u\n", params.qnum); DLOG_CONDUP("unbinding from queue %u\n", params.qnum);
nfq_destroy_queue(qh); nfq_destroy_queue(qh);
#ifdef INSANE #ifdef INSANE
/* normally, applications SHOULD NOT issue this command, since /* normally, applications SHOULD NOT issue this command, since
* it detaches other programs/sockets from AF_INET, too ! */ * it detaches other programs/sockets from AF_INET, too ! */
printf("unbinding from AF_INET\n"); DLOG_CONDUP("unbinding from AF_INET\n");
nfq_unbind_pf(h, AF_INET); nfq_unbind_pf(h, AF_INET);
#endif #endif
printf("closing library handle\n"); DLOG_CONDUP("closing library handle\n");
nfq_close(h); nfq_close(h);
return 0; return 0;
@ -273,16 +274,16 @@ static int dvt_main(void)
bp4.sin_port = htons(params.port); bp4.sin_port = htons(params.port);
bp4.sin_addr.s_addr = INADDR_ANY; bp4.sin_addr.s_addr = INADDR_ANY;
printf("creating divert4 socket\n"); DLOG_CONDUP("creating divert4 socket\n");
fd[0] = socket_divert(AF_INET); fd[0] = socket_divert(AF_INET);
if (fd[0] == -1) { if (fd[0] == -1) {
perror("socket (DIVERT4)"); DLOG_PERROR("socket (DIVERT4)");
goto exiterr; goto exiterr;
} }
printf("binding divert4 socket\n"); DLOG_CONDUP("binding divert4 socket\n");
if (bind(fd[0], (struct sockaddr*)&bp4, sizeof(bp4)) < 0) if (bind(fd[0], (struct sockaddr*)&bp4, sizeof(bp4)) < 0)
{ {
perror("bind (DIVERT4)"); DLOG_PERROR("bind (DIVERT4)");
goto exiterr; goto exiterr;
} }
if (!set_socket_buffers(fd[0],Q_RCVBUF,Q_SNDBUF)) if (!set_socket_buffers(fd[0],Q_RCVBUF,Q_SNDBUF))
@ -298,16 +299,16 @@ static int dvt_main(void)
bp6.sin6_family = AF_INET6; bp6.sin6_family = AF_INET6;
bp6.sin6_port = htons(params.port); bp6.sin6_port = htons(params.port);
printf("creating divert6 socket\n"); DLOG_CONDUP("creating divert6 socket\n");
fd[1] = socket_divert(AF_INET6); fd[1] = socket_divert(AF_INET6);
if (fd[1] == -1) { if (fd[1] == -1) {
perror("socket (DIVERT6)"); DLOG_PERROR("socket (DIVERT6)");
goto exiterr; goto exiterr;
} }
printf("binding divert6 socket\n"); DLOG_CONDUP("binding divert6 socket\n");
if (bind(fd[1], (struct sockaddr*)&bp6, sizeof(bp6)) < 0) if (bind(fd[1], (struct sockaddr*)&bp6, sizeof(bp6)) < 0)
{ {
perror("bind (DIVERT6)"); DLOG_PERROR("bind (DIVERT6)");
goto exiterr; goto exiterr;
} }
fdct++; fdct++;
@ -317,7 +318,7 @@ static int dvt_main(void)
#endif #endif
fdmax = (fd[0]>fd[1] ? fd[0] : fd[1]) + 1; fdmax = (fd[0]>fd[1] ? fd[0] : fd[1]) + 1;
printf("initializing raw sockets\n"); DLOG_CONDUP("initializing raw sockets\n");
if (!rawsend_preinit(false,false)) if (!rawsend_preinit(false,false))
goto exiterr; goto exiterr;
@ -340,7 +341,7 @@ static int dvt_main(void)
dohup(); dohup();
continue; continue;
} }
perror("select"); DLOG_PERROR("select");
goto exiterr; goto exiterr;
} }
for(i=0;i<fdct;i++) for(i=0;i<fdct;i++)
@ -351,7 +352,7 @@ static int dvt_main(void)
rd = recvfrom(fd[i], buf, sizeof(buf), 0, (struct sockaddr*)&sa_from, &socklen); rd = recvfrom(fd[i], buf, sizeof(buf), 0, (struct sockaddr*)&sa_from, &socklen);
if (rd<0) if (rd<0)
{ {
perror("recvfrom"); DLOG_PERROR("recvfrom");
goto exiterr; goto exiterr;
} }
else if (rd>0) else if (rd>0)
@ -360,21 +361,21 @@ static int dvt_main(void)
uint8_t verdict; uint8_t verdict;
size_t len = rd; size_t len = rd;
DLOG("packet: id=%u len=%zu\n", id, len) DLOG("packet: id=%u len=%zu\n", id, len);
verdict = processPacketData(&mark, NULL, buf, &len); verdict = processPacketData(&mark, NULL, buf, &len);
switch (verdict & VERDICT_MASK) switch (verdict & VERDICT_MASK)
{ {
case VERDICT_PASS: case VERDICT_PASS:
case VERDICT_MODIFY: case VERDICT_MODIFY:
if ((verdict & VERDICT_MASK)==VERDICT_PASS) if ((verdict & VERDICT_MASK)==VERDICT_PASS)
DLOG("packet: id=%u reinject unmodified\n", id) DLOG("packet: id=%u reinject unmodified\n", id);
else else
DLOG("packet: id=%u reinject modified len=%zu\n", id, len) DLOG("packet: id=%u reinject modified len=%zu\n", id, len);
wr = sendto(fd[i], buf, len, 0, (struct sockaddr*)&sa_from, socklen); wr = sendto(fd[i], buf, len, 0, (struct sockaddr*)&sa_from, socklen);
if (wr<0) if (wr<0)
perror("reinject sendto"); DLOG_PERROR("reinject sendto");
else if (wr!=len) else if (wr!=len)
fprintf(stderr,"reinject sendto: not all data was reinjected. received %zu, sent %zd\n", len, wr); DLOG_ERR("reinject sendto: not all data was reinjected. received %zu, sent %zd\n", len, wr);
break; break;
default: default:
DLOG("packet: id=%u drop\n", id); DLOG("packet: id=%u drop\n", id);
@ -383,7 +384,7 @@ static int dvt_main(void)
} }
else else
{ {
DLOG("unexpected zero size recvfrom\n") DLOG("unexpected zero size recvfrom\n");
} }
} }
} }
@ -414,7 +415,7 @@ static int win_main(const char *windivert_filter)
if (!win_dark_init(&params.ssid_filter, &params.nlm_filter)) if (!win_dark_init(&params.ssid_filter, &params.nlm_filter))
{ {
fprintf(stderr, "win_dark_init failed. win32 error %u (0x%08X)\n", w_win32_error, w_win32_error); DLOG_ERR("win_dark_init failed. win32 error %u (0x%08X)\n", w_win32_error, w_win32_error);
return w_win32_error; return w_win32_error;
} }
@ -422,20 +423,20 @@ static int win_main(const char *windivert_filter)
{ {
if (!logical_net_filter_match()) if (!logical_net_filter_match())
{ {
printf("logical network is not present. waiting it to appear.\n"); DLOG_CONDUP("logical network is not present. waiting it to appear.\n");
fflush(stdout); fflush(stdout);
do do
{ {
if (bQuit) if (bQuit)
{ {
DLOG("QUIT requested\n") DLOG("QUIT requested\n");
win_dark_deinit(); win_dark_deinit();
return 0; return 0;
} }
usleep(500000); usleep(500000);
} }
while (!logical_net_filter_match()); while (!logical_net_filter_match());
printf("logical network now present\n"); DLOG_CONDUP("logical network now present\n");
fflush(stdout); fflush(stdout);
} }
@ -445,7 +446,7 @@ static int win_main(const char *windivert_filter)
return w_win32_error; return w_win32_error;
} }
printf("windivert initialized. capture is started.\n"); DLOG_CONDUP("windivert initialized. capture is started.\n");
// cygwin auto flush fails when piping // cygwin auto flush fails when piping
fflush(stdout); fflush(stdout);
@ -458,36 +459,36 @@ static int win_main(const char *windivert_filter)
{ {
if (errno==ENOBUFS) if (errno==ENOBUFS)
{ {
DLOG("windivert: ignoring too large packet\n") DLOG("windivert: ignoring too large packet\n");
continue; // too large packet continue; // too large packet
} }
else if (errno==ENODEV) else if (errno==ENODEV)
{ {
printf("logical network disappeared. deinitializing windivert.\n"); DLOG_CONDUP("logical network disappeared. deinitializing windivert.\n");
rawsend_cleanup(); rawsend_cleanup();
break; break;
} }
else if (errno==EINTR) else if (errno==EINTR)
{ {
DLOG("QUIT requested\n") DLOG("QUIT requested\n");
win_dark_deinit(); win_dark_deinit();
return 0; return 0;
} }
fprintf(stderr, "windivert: recv failed. errno %d\n", errno); DLOG_ERR("windivert: recv failed. errno %d\n", errno);
win_dark_deinit(); win_dark_deinit();
return w_win32_error; return w_win32_error;
} }
*ifout=0; *ifout=0;
if (wa.Outbound) snprintf(ifout,sizeof(ifout),"%u.%u", wa.Network.IfIdx, wa.Network.SubIfIdx); if (wa.Outbound) snprintf(ifout,sizeof(ifout),"%u.%u", wa.Network.IfIdx, wa.Network.SubIfIdx);
DLOG("packet: id=%u len=%zu %s IPv6=%u IPChecksum=%u TCPChecksum=%u UDPChecksum=%u IfIdx=%u.%u\n", id, len, wa.Outbound ? "outbound" : "inbound", wa.IPv6, wa.IPChecksum, wa.TCPChecksum, wa.UDPChecksum, wa.Network.IfIdx, wa.Network.SubIfIdx) DLOG("packet: id=%u len=%zu %s IPv6=%u IPChecksum=%u TCPChecksum=%u UDPChecksum=%u IfIdx=%u.%u\n", id, len, wa.Outbound ? "outbound" : "inbound", wa.IPv6, wa.IPChecksum, wa.TCPChecksum, wa.UDPChecksum, wa.Network.IfIdx, wa.Network.SubIfIdx);
if (wa.Impostor) if (wa.Impostor)
{ {
DLOG("windivert: passing impostor packet\n") DLOG("windivert: passing impostor packet\n");
verdict = VERDICT_PASS; verdict = VERDICT_PASS;
} }
else if (wa.Loopback) else if (wa.Loopback)
{ {
DLOG("windivert: passing loopback packet\n") DLOG("windivert: passing loopback packet\n");
verdict = VERDICT_PASS; verdict = VERDICT_PASS;
} }
else else
@ -501,11 +502,11 @@ static int win_main(const char *windivert_filter)
case VERDICT_PASS: case VERDICT_PASS:
case VERDICT_MODIFY: case VERDICT_MODIFY:
if ((verdict & VERDICT_MASK)==VERDICT_PASS) if ((verdict & VERDICT_MASK)==VERDICT_PASS)
DLOG("packet: id=%u reinject unmodified\n", id) DLOG("packet: id=%u reinject unmodified\n", id);
else else
DLOG("packet: id=%u reinject modified len=%zu\n", id, len) DLOG("packet: id=%u reinject modified len=%zu\n", id, len);
if (!windivert_send(packet, len, &wa)) if (!windivert_send(packet, len, &wa))
fprintf(stderr,"windivert: reinject of packet id=%u failed\n", id); DLOG_ERR("windivert: reinject of packet id=%u failed\n", id);
break; break;
default: default:
DLOG("packet: id=%u drop\n", id); DLOG("packet: id=%u drop\n", id);
@ -533,7 +534,7 @@ static bool parse_ws_scale_factor(char *s, uint16_t *wsize, uint8_t *wscale)
v = atoi(s); v = atoi(s);
if (v < 0 || v>65535) if (v < 0 || v>65535)
{ {
fprintf(stderr, "bad wsize\n"); DLOG_ERR("bad wsize\n");
return false; return false;
} }
*wsize=(uint16_t)v; *wsize=(uint16_t)v;
@ -542,7 +543,7 @@ static bool parse_ws_scale_factor(char *s, uint16_t *wsize, uint8_t *wscale)
v = atoi(p); v = atoi(p);
if (v < 0 || v>255) if (v < 0 || v>255)
{ {
fprintf(stderr, "bad wscale\n"); DLOG_ERR("bad wscale\n");
return false; return false;
} }
*wscale = (uint8_t)v; *wscale = (uint8_t)v;
@ -595,19 +596,19 @@ static void load_file_or_exit(const char *filename, void *buf, size_t *size)
{ {
if (!parse_hex_str(filename+2,buf,size) || !*size) if (!parse_hex_str(filename+2,buf,size) || !*size)
{ {
fprintf(stderr, "invalid hex string: %s\n",filename+2); DLOG_ERR("invalid hex string: %s\n",filename+2);
exit_clean(1); exit_clean(1);
} }
DLOG("read %zu bytes from hex string\n",*size) DLOG("read %zu bytes from hex string\n",*size);
} }
else else
{ {
if (!load_file_nonempty(filename,buf,size)) if (!load_file_nonempty(filename,buf,size))
{ {
fprintf(stderr, "could not read %s\n",filename); DLOG_ERR("could not read %s\n",filename);
exit_clean(1); exit_clean(1);
} }
DLOG("read %zu bytes from %s\n",*size,filename) DLOG("read %zu bytes from %s\n",*size,filename);
} }
} }
@ -786,7 +787,7 @@ static unsigned int hash_jen(const void *data,unsigned int len)
static void exithelp(void) static void exithelp(void)
{ {
printf( printf(
" --debug=0|1\n" " --debug=0|1|syslog|@<filename>\n"
#ifdef __linux__ #ifdef __linux__
" --qnum=<nfqueue_number>\n" " --qnum=<nfqueue_number>\n"
#elif defined(BSD) #elif defined(BSD)
@ -1078,7 +1079,42 @@ int main(int argc, char **argv)
switch (option_index) switch (option_index)
{ {
case 0: /* debug */ case 0: /* debug */
params.debug = !optarg || atoi(optarg); if (optarg)
{
if (*optarg=='@')
{
strncpy(params.debug_logfile,optarg+1,sizeof(params.debug_logfile));
params.debug_logfile[sizeof(params.debug_logfile)-1] = 0;
FILE *F = fopen(params.debug_logfile,"wt");
if (!F)
{
fprintf(stderr, "cannot create %s\n", params.debug_logfile);
exit_clean(1);
}
#ifndef __CYGWIN__
if (params.droproot && chown(params.debug_logfile, params.uid, -1))
fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
#endif
params.debug = true;
params.debug_target = LOG_TARGET_FILE;
}
else if (!strcmp(optarg,"syslog"))
{
params.debug = true;
params.debug_target = LOG_TARGET_SYSLOG;
openlog(progname,LOG_PID,LOG_USER);
}
else
{
params.debug = !!atoi(optarg);
params.debug_target = LOG_TARGET_CONSOLE;
}
}
else
{
params.debug = true;
params.debug_target = LOG_TARGET_CONSOLE;
}
break; break;
#ifndef __CYGWIN__ #ifndef __CYGWIN__
case 1: /* qnum or port */ case 1: /* qnum or port */
@ -1086,7 +1122,7 @@ int main(int argc, char **argv)
params.qnum = atoi(optarg); params.qnum = atoi(optarg);
if (params.qnum < 0 || params.qnum>65535) if (params.qnum < 0 || params.qnum>65535)
{ {
fprintf(stderr, "bad qnum\n"); DLOG_ERR("bad qnum\n");
exit_clean(1); exit_clean(1);
} }
#elif defined(BSD) #elif defined(BSD)
@ -1094,7 +1130,7 @@ int main(int argc, char **argv)
int i = atoi(optarg); int i = atoi(optarg);
if (i <= 0 || i > 65535) if (i <= 0 || i > 65535)
{ {
fprintf(stderr, "bad port number\n"); DLOG_ERR("bad port number\n");
exit_clean(1); exit_clean(1);
} }
params.port = (uint16_t)i; params.port = (uint16_t)i;
@ -1115,7 +1151,7 @@ int main(int argc, char **argv)
struct passwd *pwd = getpwnam(optarg); struct passwd *pwd = getpwnam(optarg);
if (!pwd) if (!pwd)
{ {
fprintf(stderr, "non-existent username supplied\n"); DLOG_ERR("non-existent username supplied\n");
exit_clean(1); exit_clean(1);
} }
params.uid = pwd->pw_uid; params.uid = pwd->pw_uid;
@ -1128,7 +1164,7 @@ int main(int argc, char **argv)
params.droproot = true; params.droproot = true;
if (sscanf(optarg, "%u:%u", &params.uid, &params.gid)<1) if (sscanf(optarg, "%u:%u", &params.uid, &params.gid)<1)
{ {
fprintf(stderr, "--uid should be : uid[:gid]\n"); DLOG_ERR("--uid should be : uid[:gid]\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1144,14 +1180,14 @@ int main(int argc, char **argv)
case 8: /* wssize-cutoff */ case 8: /* wssize-cutoff */
if (!parse_cutoff(optarg, &params.wssize_cutoff, &params.wssize_cutoff_mode)) if (!parse_cutoff(optarg, &params.wssize_cutoff, &params.wssize_cutoff_mode))
{ {
fprintf(stderr, "invalid wssize-cutoff value\n"); DLOG_ERR("invalid wssize-cutoff value\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 9: /* ctrack-timeouts */ case 9: /* ctrack-timeouts */
if (sscanf(optarg, "%u:%u:%u:%u", &params.ctrack_t_syn, &params.ctrack_t_est, &params.ctrack_t_fin, &params.ctrack_t_udp)<3) if (sscanf(optarg, "%u:%u:%u:%u", &params.ctrack_t_syn, &params.ctrack_t_est, &params.ctrack_t_fin, &params.ctrack_t_udp)<3)
{ {
fprintf(stderr, "invalid ctrack-timeouts value\n"); DLOG_ERR("invalid ctrack-timeouts value\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1161,7 +1197,7 @@ int main(int argc, char **argv)
case 11: /* hostspell */ case 11: /* hostspell */
if (strlen(optarg) != 4) if (strlen(optarg) != 4)
{ {
fprintf(stderr, "hostspell must be exactly 4 chars long\n"); DLOG_ERR("hostspell must be exactly 4 chars long\n");
exit_clean(1); exit_clean(1);
} }
params.hostcase = true; params.hostcase = true;
@ -1196,23 +1232,23 @@ int main(int argc, char **argv)
params.desync_mode2 = desync_mode_from_string(mode2); params.desync_mode2 = desync_mode_from_string(mode2);
if (params.desync_mode0==DESYNC_INVALID || params.desync_mode==DESYNC_INVALID || params.desync_mode2==DESYNC_INVALID) if (params.desync_mode0==DESYNC_INVALID || params.desync_mode==DESYNC_INVALID || params.desync_mode2==DESYNC_INVALID)
{ {
fprintf(stderr, "invalid dpi-desync mode\n"); DLOG_ERR("invalid dpi-desync mode\n");
exit_clean(1); exit_clean(1);
} }
if (mode3) if (mode3)
{ {
fprintf(stderr, "invalid desync combo : %s+%s+%s\n",mode,mode2,mode3); DLOG_ERR("invalid desync combo : %s+%s+%s\n",mode,mode2,mode3);
exit_clean(1); exit_clean(1);
} }
if (params.desync_mode2 && (desync_only_first_stage(params.desync_mode) || !(desync_valid_first_stage(params.desync_mode) && desync_valid_second_stage(params.desync_mode2)))) if (params.desync_mode2 && (desync_only_first_stage(params.desync_mode) || !(desync_valid_first_stage(params.desync_mode) && desync_valid_second_stage(params.desync_mode2))))
{ {
fprintf(stderr, "invalid desync combo : %s+%s\n", mode,mode2); DLOG_ERR("invalid desync combo : %s+%s\n", mode,mode2);
exit_clean(1); exit_clean(1);
} }
#if defined(__OpenBSD__) #if defined(__OpenBSD__)
if (params.desync_mode==DESYNC_IPFRAG2 || params.desync_mode2==DESYNC_IPFRAG2) if (params.desync_mode==DESYNC_IPFRAG2 || params.desync_mode2==DESYNC_IPFRAG2)
{ {
fprintf(stderr, "OpenBSD has checksum issues with fragmented packets. ipfrag disabled.\n"); DLOG_ERR("OpenBSD has checksum issues with fragmented packets. ipfrag disabled.\n");
exit_clean(1); exit_clean(1);
} }
#endif #endif
@ -1225,11 +1261,11 @@ int main(int argc, char **argv)
if (sscanf(optarg, "0x%X", &params.desync_fwmark)<=0) sscanf(optarg, "%u", &params.desync_fwmark); if (sscanf(optarg, "0x%X", &params.desync_fwmark)<=0) sscanf(optarg, "%u", &params.desync_fwmark);
if (!params.desync_fwmark) if (!params.desync_fwmark)
{ {
fprintf(stderr, "fwmark/sockarg should be decimal or 0xHEX and should not be zero\n"); DLOG_ERR("fwmark/sockarg should be decimal or 0xHEX and should not be zero\n");
exit_clean(1); exit_clean(1);
} }
#else #else
fprintf(stderr, "fmwark/sockarg not supported in this OS\n"); DLOG_ERR("fmwark/sockarg not supported in this OS\n");
exit_clean(1); exit_clean(1);
#endif #endif
break; break;
@ -1243,14 +1279,14 @@ int main(int argc, char **argv)
case 18: /* dpi-desync-autottl */ case 18: /* dpi-desync-autottl */
if (!parse_autottl(optarg, &params.desync_autottl)) if (!parse_autottl(optarg, &params.desync_autottl))
{ {
fprintf(stderr, "dpi-desync-autottl value error\n"); DLOG_ERR("dpi-desync-autottl value error\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 19: /* dpi-desync-autottl6 */ case 19: /* dpi-desync-autottl6 */
if (!parse_autottl(optarg, &params.desync_autottl6)) if (!parse_autottl(optarg, &params.desync_autottl6))
{ {
fprintf(stderr, "dpi-desync-autottl6 value error\n"); DLOG_ERR("dpi-desync-autottl6 value error\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1268,7 +1304,7 @@ int main(int argc, char **argv)
else if (!strcmp(p,"badsum")) else if (!strcmp(p,"badsum"))
{ {
#ifdef __OpenBSD__ #ifdef __OpenBSD__
printf("\nWARNING !!! OpenBSD may forcibly recompute tcp/udp checksums !!! In this case badsum fooling will not work.\nYou should check tcp checksum correctness in tcpdump manually before using badsum.\n\n"); DLOG_CONDUP("\nWARNING !!! OpenBSD may forcibly recompute tcp/udp checksums !!! In this case badsum fooling will not work.\nYou should check tcp checksum correctness in tcpdump manually before using badsum.\n\n");
#endif #endif
params.desync_fooling_mode |= FOOL_BADSUM; params.desync_fooling_mode |= FOOL_BADSUM;
} }
@ -1282,7 +1318,7 @@ int main(int argc, char **argv)
params.desync_fooling_mode |= FOOL_HOPBYHOP2; params.desync_fooling_mode |= FOOL_HOPBYHOP2;
else if (strcmp(p,"none")) else if (strcmp(p,"none"))
{ {
fprintf(stderr, "dpi-desync-fooling allowed values : none,md5sig,ts,badseq,badsum,datanoack,hopbyhop,hopbyhop2\n"); DLOG_ERR("dpi-desync-fooling allowed values : none,md5sig,ts,badseq,badsum,datanoack,hopbyhop,hopbyhop2\n");
exit_clean(1); exit_clean(1);
} }
p = e; p = e;
@ -1292,7 +1328,7 @@ int main(int argc, char **argv)
case 21: /* dpi-desync-repeats */ case 21: /* dpi-desync-repeats */
if (sscanf(optarg,"%u",&params.desync_repeats)<1 || !params.desync_repeats || params.desync_repeats>20) if (sscanf(optarg,"%u",&params.desync_repeats)<1 || !params.desync_repeats || params.desync_repeats>20)
{ {
fprintf(stderr, "dpi-desync-repeats must be within 1..20\n"); DLOG_ERR("dpi-desync-repeats must be within 1..20\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1302,28 +1338,28 @@ int main(int argc, char **argv)
case 23: /* dpi-desync-split-pos */ case 23: /* dpi-desync-split-pos */
if (sscanf(optarg,"%u",&params.desync_split_pos)<1 || params.desync_split_pos<1) if (sscanf(optarg,"%u",&params.desync_split_pos)<1 || params.desync_split_pos<1)
{ {
fprintf(stderr, "dpi-desync-split-pos is not valid\n"); DLOG_ERR("dpi-desync-split-pos is not valid\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 24: /* dpi-desync-split-http-req */ case 24: /* dpi-desync-split-http-req */
if (!parse_httpreqpos(optarg, &params.desync_split_http_req)) if (!parse_httpreqpos(optarg, &params.desync_split_http_req))
{ {
fprintf(stderr, "Invalid argument for dpi-desync-split-http-req\n"); DLOG_ERR("Invalid argument for dpi-desync-split-http-req\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 25: /* dpi-desync-split-tls */ case 25: /* dpi-desync-split-tls */
if (!parse_tlspos(optarg, &params.desync_split_tls)) if (!parse_tlspos(optarg, &params.desync_split_tls))
{ {
fprintf(stderr, "Invalid argument for dpi-desync-split-tls\n"); DLOG_ERR("Invalid argument for dpi-desync-split-tls\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 26: /* dpi-desync-split-seqovl */ case 26: /* dpi-desync-split-seqovl */
if (sscanf(optarg,"%u",&params.desync_seqovl)<1) if (sscanf(optarg,"%u",&params.desync_seqovl)<1)
{ {
fprintf(stderr, "dpi-desync-split-seqovl is not valid\n"); DLOG_ERR("dpi-desync-split-seqovl is not valid\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1338,38 +1374,38 @@ int main(int argc, char **argv)
case 28: /* dpi-desync-ipfrag-pos-tcp */ case 28: /* dpi-desync-ipfrag-pos-tcp */
if (sscanf(optarg,"%u",&params.desync_ipfrag_pos_tcp)<1 || params.desync_ipfrag_pos_tcp<1 || params.desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN) if (sscanf(optarg,"%u",&params.desync_ipfrag_pos_tcp)<1 || params.desync_ipfrag_pos_tcp<1 || params.desync_ipfrag_pos_tcp>DPI_DESYNC_MAX_FAKE_LEN)
{ {
fprintf(stderr, "dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN); DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
exit_clean(1); exit_clean(1);
} }
if (params.desync_ipfrag_pos_tcp & 7) if (params.desync_ipfrag_pos_tcp & 7)
{ {
fprintf(stderr, "dpi-desync-ipfrag-pos-tcp must be multiple of 8\n"); DLOG_ERR("dpi-desync-ipfrag-pos-tcp must be multiple of 8\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 29: /* dpi-desync-ipfrag-pos-udp */ case 29: /* dpi-desync-ipfrag-pos-udp */
if (sscanf(optarg,"%u",&params.desync_ipfrag_pos_udp)<1 || params.desync_ipfrag_pos_udp<1 || params.desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN) if (sscanf(optarg,"%u",&params.desync_ipfrag_pos_udp)<1 || params.desync_ipfrag_pos_udp<1 || params.desync_ipfrag_pos_udp>DPI_DESYNC_MAX_FAKE_LEN)
{ {
fprintf(stderr, "dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN); DLOG_ERR("dpi-desync-ipfrag-pos-udp must be within 1..%u range\n",DPI_DESYNC_MAX_FAKE_LEN);
exit_clean(1); exit_clean(1);
} }
if (params.desync_ipfrag_pos_udp & 7) if (params.desync_ipfrag_pos_udp & 7)
{ {
fprintf(stderr, "dpi-desync-ipfrag-pos-udp must be multiple of 8\n"); DLOG_ERR("dpi-desync-ipfrag-pos-udp must be multiple of 8\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 30: /* dpi-desync-badseq-increments */ case 30: /* dpi-desync-badseq-increments */
if (!parse_badseq_increment(optarg,&params.desync_badseq_increment)) if (!parse_badseq_increment(optarg,&params.desync_badseq_increment))
{ {
fprintf(stderr, "dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n"); DLOG_ERR("dpi-desync-badseq-increment should be signed decimal or signed 0xHEX\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 31: /* dpi-desync-badack-increment */ case 31: /* dpi-desync-badack-increment */
if (!parse_badseq_increment(optarg,&params.desync_badseq_ack_increment)) if (!parse_badseq_increment(optarg,&params.desync_badseq_ack_increment))
{ {
fprintf(stderr, "dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n"); DLOG_ERR("dpi-desync-badack-increment should be signed decimal or signed 0xHEX\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1411,7 +1447,7 @@ int main(int argc, char **argv)
case 41: /* dpi-desync-udplen-increment */ case 41: /* dpi-desync-udplen-increment */
if (sscanf(optarg,"%d",&params.udplen_increment)<1 || params.udplen_increment>0x7FFF || params.udplen_increment<-0x8000) if (sscanf(optarg,"%d",&params.udplen_increment)<1 || params.udplen_increment>0x7FFF || params.udplen_increment<-0x8000)
{ {
fprintf(stderr, "dpi-desync-udplen-increment must be integer within -32768..32767 range\n"); DLOG_ERR("dpi-desync-udplen-increment must be integer within -32768..32767 range\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1426,59 +1462,59 @@ int main(int argc, char **argv)
case 43: /* desync-cutoff */ case 43: /* desync-cutoff */
if (!parse_cutoff(optarg, &params.desync_cutoff, &params.desync_cutoff_mode)) if (!parse_cutoff(optarg, &params.desync_cutoff, &params.desync_cutoff_mode))
{ {
fprintf(stderr, "invalid desync-cutoff value\n"); DLOG_ERR("invalid desync-cutoff value\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 44: /* desync-start */ case 44: /* desync-start */
if (!parse_cutoff(optarg, &params.desync_start, &params.desync_start_mode)) if (!parse_cutoff(optarg, &params.desync_start, &params.desync_start_mode))
{ {
fprintf(stderr, "invalid desync-start value\n"); DLOG_ERR("invalid desync-start value\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 45: /* hostlist */ case 45: /* hostlist */
if (!strlist_add(&params.hostlist_files, optarg)) if (!strlist_add(&params.hostlist_files, optarg))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 46: /* hostlist-exclude */ case 46: /* hostlist-exclude */
if (!strlist_add(&params.hostlist_exclude_files, optarg)) if (!strlist_add(&params.hostlist_exclude_files, optarg))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 47: /* hostlist-auto */ case 47: /* hostlist-auto */
if (*params.hostlist_auto_filename) if (*params.hostlist_auto_filename)
{ {
fprintf(stderr, "only one auto hostlist is supported\n"); DLOG_ERR("only one auto hostlist is supported\n");
exit_clean(1); exit_clean(1);
} }
{ {
FILE *F = fopen(optarg,"a+t"); FILE *F = fopen(optarg,"at");
if (!F) if (!F)
{ {
fprintf(stderr, "cannot create %s\n", optarg); DLOG_ERR("cannot create %s\n", optarg);
exit_clean(1); exit_clean(1);
} }
bool bGzip = is_gzip(F); bool bGzip = is_gzip(F);
fclose(F); fclose(F);
if (bGzip) if (bGzip)
{ {
fprintf(stderr, "gzipped auto hostlists are not supported\n"); DLOG_ERR("gzipped auto hostlists are not supported\n");
exit_clean(1); exit_clean(1);
} }
#ifndef __CYGWIN__ #ifndef __CYGWIN__
if (params.droproot && chown(optarg, params.uid, -1)) if (params.droproot && chown(optarg, params.uid, -1))
fprintf(stderr, "could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg); DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg);
#endif #endif
} }
if (!strlist_add(&params.hostlist_files, optarg)) if (!strlist_add(&params.hostlist_files, optarg))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
strncpy(params.hostlist_auto_filename, optarg, sizeof(params.hostlist_auto_filename)); strncpy(params.hostlist_auto_filename, optarg, sizeof(params.hostlist_auto_filename));
@ -1488,7 +1524,7 @@ int main(int argc, char **argv)
params.hostlist_auto_fail_threshold = (uint8_t)atoi(optarg); params.hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (params.hostlist_auto_fail_threshold<1 || params.hostlist_auto_fail_threshold>20) if (params.hostlist_auto_fail_threshold<1 || params.hostlist_auto_fail_threshold>20)
{ {
fprintf(stderr, "auto hostlist fail threshold must be within 1..20\n"); DLOG_ERR("auto hostlist fail threshold must be within 1..20\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1496,7 +1532,7 @@ int main(int argc, char **argv)
params.hostlist_auto_fail_time = (uint8_t)atoi(optarg); params.hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (params.hostlist_auto_fail_time<1) if (params.hostlist_auto_fail_time<1)
{ {
fprintf(stderr, "auto hostlist fail time is not valid\n"); DLOG_ERR("auto hostlist fail time is not valid\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1504,7 +1540,7 @@ int main(int argc, char **argv)
params.hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg); params.hostlist_auto_retrans_threshold = (uint8_t)atoi(optarg);
if (params.hostlist_auto_retrans_threshold<2 || params.hostlist_auto_retrans_threshold>10) if (params.hostlist_auto_retrans_threshold<2 || params.hostlist_auto_retrans_threshold>10)
{ {
fprintf(stderr, "auto hostlist fail threshold must be within 2..10\n"); DLOG_ERR("auto hostlist fail threshold must be within 2..10\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1513,13 +1549,13 @@ int main(int argc, char **argv)
FILE *F = fopen(optarg,"a+t"); FILE *F = fopen(optarg,"a+t");
if (!F) if (!F)
{ {
fprintf(stderr, "cannot create %s\n", optarg); DLOG_ERR("cannot create %s\n", optarg);
exit_clean(1); exit_clean(1);
} }
fclose(F); fclose(F);
#ifndef __CYGWIN__ #ifndef __CYGWIN__
if (params.droproot && chown(optarg, params.uid, -1)) if (params.droproot && chown(optarg, params.uid, -1))
fprintf(stderr, "could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg); DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg);
#endif #endif
strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog)); strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog));
params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0'; params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
@ -1536,14 +1572,14 @@ int main(int argc, char **argv)
case 52: /* wf-iface */ case 52: /* wf-iface */
if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx)) if (!sscanf(optarg,"%u.%u",&IfIdx,&SubIfIdx))
{ {
fprintf(stderr, "bad value for --wf-iface\n"); DLOG_ERR("bad value for --wf-iface\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 53: /* wf-l3 */ case 53: /* wf-l3 */
if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6)) if (!wf_make_l3(optarg,&wf_ipv4,&wf_ipv6))
{ {
fprintf(stderr, "bad value for --wf-l3\n"); DLOG_ERR("bad value for --wf-l3\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1552,7 +1588,7 @@ int main(int argc, char **argv)
if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) || if (!wf_make_pf(optarg,"tcp","SrcPort",wf_pf_tcp_src,sizeof(wf_pf_tcp_src)) ||
!wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst))) !wf_make_pf(optarg,"tcp","DstPort",wf_pf_tcp_dst,sizeof(wf_pf_tcp_dst)))
{ {
fprintf(stderr, "bad value for --wf-tcp\n"); DLOG_ERR("bad value for --wf-tcp\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1561,7 +1597,7 @@ int main(int argc, char **argv)
if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) || if (!wf_make_pf(optarg,"udp","SrcPort",wf_pf_udp_src,sizeof(wf_pf_udp_src)) ||
!wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst))) !wf_make_pf(optarg,"udp","DstPort",wf_pf_udp_dst,sizeof(wf_pf_udp_dst)))
{ {
fprintf(stderr, "bad value for --wf-udp\n"); DLOG_ERR("bad value for --wf-udp\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -1593,7 +1629,7 @@ int main(int argc, char **argv)
if (e) *e++=0; if (e) *e++=0;
if (*p && !strlist_add(&params.ssid_filter, p)) if (*p && !strlist_add(&params.ssid_filter, p))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
p = e; p = e;
@ -1611,7 +1647,7 @@ int main(int argc, char **argv)
if (e) *e++=0; if (e) *e++=0;
if (*p && !strlist_add(&params.nlm_filter, p)) if (*p && !strlist_add(&params.nlm_filter, p))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
p = e; p = e;
@ -1622,7 +1658,7 @@ int main(int argc, char **argv)
case 60: /* nlm-list */ case 60: /* nlm-list */
if (!nlm_list(optarg && !strcmp(optarg,"all"))) if (!nlm_list(optarg && !strcmp(optarg,"all")))
{ {
fprintf(stderr, "could not get list of NLM networks\n"); DLOG_ERR("could not get list of NLM networks\n");
exit_clean(1); exit_clean(1);
} }
exit_clean(0); exit_clean(0);
@ -1634,13 +1670,13 @@ int main(int argc, char **argv)
#ifdef __linux__ #ifdef __linux__
if (params.qnum<0) if (params.qnum<0)
{ {
fprintf(stderr, "Need queue number (--qnum)\n"); DLOG_ERR("Need queue number (--qnum)\n");
exit_clean(1); exit_clean(1);
} }
#elif defined(BSD) #elif defined(BSD)
if (!params.port) if (!params.port)
{ {
fprintf(stderr, "Need divert port (--port)\n"); DLOG_ERR("Need divert port (--port)\n");
exit_clean(1); exit_clean(1);
} }
#elif defined(__CYGWIN__) #elif defined(__CYGWIN__)
@ -1648,26 +1684,26 @@ int main(int argc, char **argv)
{ {
if (!*wf_pf_tcp_src && !*wf_pf_udp_src) if (!*wf_pf_tcp_src && !*wf_pf_udp_src)
{ {
fprintf(stderr, "windivert filter : must specify port filter\n"); DLOG_ERR("windivert filter : must specify port filter\n");
exit_clean(1); exit_clean(1);
} }
if (!wf_make_filter(windivert_filter, sizeof(windivert_filter), IfIdx, SubIfIdx, wf_ipv4, wf_ipv6, wf_pf_tcp_src, wf_pf_tcp_dst, wf_pf_udp_src, wf_pf_udp_dst)) if (!wf_make_filter(windivert_filter, sizeof(windivert_filter), IfIdx, SubIfIdx, wf_ipv4, wf_ipv6, wf_pf_tcp_src, wf_pf_tcp_dst, wf_pf_udp_src, wf_pf_udp_dst))
{ {
fprintf(stderr, "windivert filter : could not make filter\n"); DLOG_ERR("windivert filter : could not make filter\n");
exit_clean(1); exit_clean(1);
} }
} }
DLOG("windivert filter size: %zu\nwindivert filter:\n%s\n",strlen(windivert_filter),windivert_filter) DLOG("windivert filter size: %zu\nwindivert filter:\n%s\n",strlen(windivert_filter),windivert_filter);
if (*wf_save_file) if (*wf_save_file)
{ {
if (save_file(wf_save_file,windivert_filter,strlen(windivert_filter))) if (save_file(wf_save_file,windivert_filter,strlen(windivert_filter)))
{ {
printf("windivert filter: raw filter saved to %s\n", wf_save_file); DLOG_ERR("windivert filter: raw filter saved to %s\n", wf_save_file);
exit_clean(0); exit_clean(0);
} }
else else
{ {
fprintf(stderr, "windivert filter: could not save raw filter to %s\n", wf_save_file); DLOG_ERR("windivert filter: could not save raw filter to %s\n", wf_save_file);
exit_clean(1); exit_clean(1);
} }
} }
@ -1680,7 +1716,7 @@ int main(int argc, char **argv)
if (hMutexArg && GetLastError()==ERROR_ALREADY_EXISTS) if (hMutexArg && GetLastError()==ERROR_ALREADY_EXISTS)
{ {
CloseHandle(hMutexArg); hMutexArg = NULL; CloseHandle(hMutexArg); hMutexArg = NULL;
fprintf(stderr, "A copy of winws is already running with the same filter\n"); DLOG_ERR("A copy of winws is already running with the same filter\n");
goto exiterr; goto exiterr;
} }
@ -1691,22 +1727,22 @@ int main(int argc, char **argv)
if (params.desync_ttl6 == 0xFF) params.desync_ttl6=params.desync_ttl; if (params.desync_ttl6 == 0xFF) params.desync_ttl6=params.desync_ttl;
if (!AUTOTTL_ENABLED(params.desync_autottl6)) params.desync_autottl6 = params.desync_autottl; if (!AUTOTTL_ENABLED(params.desync_autottl6)) params.desync_autottl6 = params.desync_autottl;
if (AUTOTTL_ENABLED(params.desync_autottl)) if (AUTOTTL_ENABLED(params.desync_autottl))
DLOG("autottl ipv4 %u:%u-%u\n",params.desync_autottl.delta,params.desync_autottl.min,params.desync_autottl.max) DLOG("autottl ipv4 %u:%u-%u\n",params.desync_autottl.delta,params.desync_autottl.min,params.desync_autottl.max);
if (AUTOTTL_ENABLED(params.desync_autottl6)) if (AUTOTTL_ENABLED(params.desync_autottl6))
DLOG("autottl ipv6 %u:%u-%u\n",params.desync_autottl6.delta,params.desync_autottl6.min,params.desync_autottl6.max) DLOG("autottl ipv6 %u:%u-%u\n",params.desync_autottl6.delta,params.desync_autottl6.min,params.desync_autottl6.max);
if (params.desync_split_tls==tlspos_none && params.desync_split_pos) params.desync_split_tls=tlspos_pos; if (params.desync_split_tls==tlspos_none && params.desync_split_pos) params.desync_split_tls=tlspos_pos;
if (params.desync_split_http_req==httpreqpos_none && params.desync_split_pos) params.desync_split_http_req=httpreqpos_pos; if (params.desync_split_http_req==httpreqpos_none && params.desync_split_pos) params.desync_split_http_req=httpreqpos_pos;
if (!LoadIncludeHostLists()) if (!LoadIncludeHostLists())
{ {
fprintf(stderr, "Include hostlist load failed\n"); DLOG_ERR("Include hostlist load failed\n");
exit_clean(1); exit_clean(1);
} }
if (*params.hostlist_auto_filename) if (*params.hostlist_auto_filename)
NonEmptyHostlist(&params.hostlist); NonEmptyHostlist(&params.hostlist);
if (!LoadExcludeHostLists()) if (!LoadExcludeHostLists())
{ {
fprintf(stderr, "Exclude hostlist load failed\n"); DLOG_ERR("Exclude hostlist load failed\n");
exit_clean(1); exit_clean(1);
} }
@ -1714,11 +1750,11 @@ int main(int argc, char **argv)
if (*pidfile && !writepid(pidfile)) if (*pidfile && !writepid(pidfile))
{ {
fprintf(stderr, "could not write pidfile\n"); DLOG_ERR("could not write pidfile\n");
goto exiterr; goto exiterr;
} }
DLOG("initializing conntrack with timeouts tcp=%u:%u:%u udp=%u\n", params.ctrack_t_syn, params.ctrack_t_est, params.ctrack_t_fin, params.ctrack_t_udp) DLOG("initializing conntrack with timeouts tcp=%u:%u:%u udp=%u\n", params.ctrack_t_syn, params.ctrack_t_est, params.ctrack_t_fin, params.ctrack_t_udp);
ConntrackPoolInit(&params.conntrack, 10, params.ctrack_t_syn, params.ctrack_t_est, params.ctrack_t_fin, params.ctrack_t_udp); ConntrackPoolInit(&params.conntrack, 10, params.ctrack_t_syn, params.ctrack_t_est, params.ctrack_t_fin, params.ctrack_t_udp);
#ifdef __linux__ #ifdef __linux__

151
nfq/params.c Normal file
View File

@ -0,0 +1,151 @@
#include "params.h"
#include <stdarg.h>
#include <syslog.h>
#include <errno.h>
#ifdef BSD
const char *progname = "dvtws";
#elif defined(__CYGWIN__)
const char *progname = "winws";
#elif defined(__linux__)
const char *progname = "nfqws";
#else
#error UNKNOWN_SYSTEM_TIME
#endif
int DLOG_FILE(FILE *F, const char *format, va_list args)
{
return vfprintf(F, format, args);
}
int DLOG_CON(const char *format, int syslog_priority, va_list args)
{
return DLOG_FILE(syslog_priority==LOG_ERR ? stderr : stdout, format, args);
}
int DLOG_FILENAME(const char *filename, const char *format, va_list args)
{
int r;
FILE *F = fopen(filename,"at");
if (F)
{
r = DLOG_FILE(F, format, args);
fclose(F);
}
else
r=-1;
return r;
}
static char syslog_buf[1024];
static size_t syslog_buf_sz=0;
static void syslog_buffered(int priority, const char *format, va_list args)
{
if (vsnprintf(syslog_buf+syslog_buf_sz,sizeof(syslog_buf)-syslog_buf_sz,format,args)>0)
{
syslog_buf_sz=strlen(syslog_buf);
// log when buffer is full or buffer ends with \n
if (syslog_buf_sz>=(sizeof(syslog_buf)-1) || (syslog_buf_sz && syslog_buf[syslog_buf_sz-1]=='\n'))
{
syslog(priority,"%s",syslog_buf);
syslog_buf_sz = 0;
}
}
}
static int DLOG_VA(const char *format, int syslog_priority, bool condup, va_list args)
{
int r=0;
va_list args2;
if (condup && !(params.debug && params.debug_target==LOG_TARGET_CONSOLE))
{
va_copy(args2,args);
DLOG_CON(format,syslog_priority,args2);
}
if (params.debug)
{
switch(params.debug_target)
{
case LOG_TARGET_CONSOLE:
r = DLOG_CON(format,syslog_priority,args);
break;
case LOG_TARGET_FILE:
r = DLOG_FILENAME(params.debug_logfile,format,args);
break;
case LOG_TARGET_SYSLOG:
// skip newlines
syslog_buffered(syslog_priority,format,args);
r = 1;
break;
default:
break;
}
}
return r;
}
int DLOG(const char *format, ...)
{
int r;
va_list args;
va_start(args, format);
r = DLOG_VA(format, LOG_DEBUG, false, args);
va_end(args);
return r;
}
int DLOG_CONDUP(const char *format, ...)
{
int r;
va_list args;
va_start(args, format);
r = DLOG_VA(format, LOG_DEBUG, true, args);
va_end(args);
return r;
}
int DLOG_ERR(const char *format, ...)
{
int r;
va_list args;
va_start(args, format);
r = DLOG_VA(format, LOG_ERR, true, args);
va_end(args);
return r;
}
int DLOG_PERROR(const char *s)
{
return DLOG_ERR("%s: %s\n", s, strerror(errno));
}
int LOG_APPEND(const char *filename, const char *format, va_list args)
{
int r;
FILE *F = fopen(filename,"at");
if (F)
{
fprint_localtime(F);
fprintf(F, " : ");
r = vfprintf(F, format, args);
fprintf(F, "\n");
fclose(F);
}
else
r=-1;
return r;
}
int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
{
if (*params.hostlist_auto_debuglog)
{
int r;
va_list args;
va_start(args, format);
r = LOG_APPEND(params.hostlist_auto_debuglog, format, args);
va_end(args);
return r;
}
else
return 0;
}

24
nfq/params.h
View File

@ -33,9 +33,14 @@
#define HOSTLIST_AUTO_FAIL_TIME_DEFAULT 60 #define HOSTLIST_AUTO_FAIL_TIME_DEFAULT 60
#define HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT 3 #define HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT 3
enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
struct params_s struct params_s
{ {
enum log_target debug_target;
char debug_logfile[PATH_MAX];
bool debug; bool debug;
uint16_t wsize,wssize; uint16_t wsize,wssize;
uint8_t wscale,wsscale; uint8_t wscale,wsscale;
char wssize_cutoff_mode; // n - packets, d - data packets, s - relative sequence char wssize_cutoff_mode; // n - packets, d - data packets, s - relative sequence
@ -85,17 +90,10 @@ struct params_s
}; };
extern struct params_s params; extern struct params_s params;
extern const char *progname;
#define DLOG(format, ...) {if (params.debug) printf(format, ##__VA_ARGS__);} int DLOG(const char *format, ...);
int DLOG_ERR(const char *format, ...);
#define LOG_APPEND(filename, format, ...) \ int DLOG_PERROR(const char *s);
{ \ int DLOG_CONDUP(const char *format, ...);
FILE *F = fopen(filename,"at"); \ int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);
if (F) \
{ \
fprint_localtime(F); \
fprintf(F, " : " format "\n", ##__VA_ARGS__); \
fclose(F); \
} \
}
#define HOSTLIST_DEBUGLOG_APPEND(format, ...) if (*params.hostlist_auto_debuglog) LOG_APPEND(params.hostlist_auto_debuglog, format, ##__VA_ARGS__)

32
nfq/sec.c
View File

@ -7,6 +7,8 @@
#include <fcntl.h> #include <fcntl.h>
#include <grp.h> #include <grp.h>
#include "params.h"
#ifdef __linux__ #ifdef __linux__
#include <sys/prctl.h> #include <sys/prctl.h>
@ -194,14 +196,14 @@ bool sec_harden(void)
{ {
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
{ {
perror("PR_SET_NO_NEW_PRIVS(prctl)"); DLOG_PERROR("PR_SET_NO_NEW_PRIVS(prctl)");
return false; return false;
} }
#if ARCH_NR!=0 #if ARCH_NR!=0
if (!set_seccomp()) if (!set_seccomp())
{ {
perror("seccomp"); DLOG_PERROR("seccomp");
if (errno==EINVAL) fprintf(stderr,"seccomp: this can be safely ignored if kernel does not support seccomp\n"); if (errno==EINVAL) DLOG_ERR("seccomp: this can be safely ignored if kernel does not support seccomp\n");
return false; return false;
} }
#endif #endif
@ -257,15 +259,15 @@ bool dropcaps(void)
{ {
if (prctl(PR_CAPBSET_DROP, cap)<0) if (prctl(PR_CAPBSET_DROP, cap)<0)
{ {
fprintf(stderr, "could not drop bound cap %d\n", cap); DLOG_ERR("could not drop bound cap %d\n", cap);
perror("cap_drop_bound"); DLOG_PERROR("cap_drop_bound");
} }
} }
} }
// now without CAP_SETPCAP // now without CAP_SETPCAP
if (!setpcap(caps)) if (!setpcap(caps))
{ {
perror("setpcap"); DLOG_PERROR("setpcap");
return checkpcap(caps); return checkpcap(caps);
} }
return true; return true;
@ -299,24 +301,24 @@ bool droproot(uid_t uid, gid_t gid)
#ifdef __linux__ #ifdef __linux__
if (prctl(PR_SET_KEEPCAPS, 1L)) if (prctl(PR_SET_KEEPCAPS, 1L))
{ {
perror("prctl(PR_SET_KEEPCAPS)"); DLOG_PERROR("prctl(PR_SET_KEEPCAPS)");
return false; return false;
} }
#endif #endif
// drop all SGIDs // drop all SGIDs
if (setgroups(0,NULL)) if (setgroups(0,NULL))
{ {
perror("setgroups"); DLOG_PERROR("setgroups");
return false; return false;
} }
if (setgid(gid)) if (setgid(gid))
{ {
perror("setgid"); DLOG_PERROR("setgid");
return false; return false;
} }
if (setuid(uid)) if (setuid(uid))
{ {
perror("setuid"); DLOG_PERROR("setuid");
return false; return false;
} }
#ifdef __linux__ #ifdef __linux__
@ -331,16 +333,16 @@ void print_id(void)
int i,N; int i,N;
gid_t g[128]; gid_t g[128];
printf("Running as UID=%u GID=",getuid()); DLOG_CONDUP("Running as UID=%u GID=",getuid());
N=getgroups(sizeof(g)/sizeof(*g),g); N=getgroups(sizeof(g)/sizeof(*g),g);
if (N>0) if (N>0)
{ {
for(i=0;i<N;i++) for(i=0;i<N;i++)
printf(i==(N-1) ? "%u" : "%u,", g[i]); DLOG_CONDUP(i==(N-1) ? "%u" : "%u,", g[i]);
printf("\n"); DLOG_CONDUP("\n");
} }
else else
printf("%u\n",getgid()); DLOG_CONDUP("%u\n",getgid());
} }
#endif #endif
@ -353,7 +355,7 @@ void daemonize(void)
pid = fork(); pid = fork();
if (pid == -1) if (pid == -1)
{ {
perror("fork"); DLOG_PERROR("fork");
exit(2); exit(2);
} }
else if (pid != 0) else if (pid != 0)

24
tpws/hostlist.c
View File

@ -31,11 +31,11 @@ bool AppendHostList(strpool **hostlist, char *filename)
FILE *F; FILE *F;
int r; int r;
printf("Loading hostlist %s\n",filename); DLOG_CONDUP("Loading hostlist %s\n",filename);
if (!(F = fopen(filename, "rb"))) if (!(F = fopen(filename, "rb")))
{ {
fprintf(stderr, "Could not open %s\n", filename); DLOG_ERR("Could not open %s\n", filename);
return false; return false;
} }
@ -45,7 +45,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
fclose(F); fclose(F);
if (r==Z_OK) if (r==Z_OK)
{ {
printf("zlib compression detected. uncompressed size : %zu\n", zsize); DLOG_CONDUP("zlib compression detected. uncompressed size : %zu\n", zsize);
p = zbuf; p = zbuf;
e = zbuf + zsize; e = zbuf + zsize;
@ -54,7 +54,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue; if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue;
if (!addpool(hostlist,&p,e)) if (!addpool(hostlist,&p,e))
{ {
fprintf(stderr, "Not enough memory to store host list : %s\n", filename); DLOG_ERR("Not enough memory to store host list : %s\n", filename);
free(zbuf); free(zbuf);
return false; return false;
} }
@ -64,13 +64,13 @@ bool AppendHostList(strpool **hostlist, char *filename)
} }
else else
{ {
fprintf(stderr, "zlib decompression failed : result %d\n",r); DLOG_ERR("zlib decompression failed : result %d\n",r);
return false; return false;
} }
} }
else else
{ {
printf("loading plain text list\n"); DLOG_CONDUP("loading plain text list\n");
while (fgets(s, 256, F)) while (fgets(s, 256, F))
{ {
@ -78,7 +78,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue; if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue;
if (!addpool(hostlist,&p,p+strlen(p))) if (!addpool(hostlist,&p,p+strlen(p)))
{ {
fprintf(stderr, "Not enough memory to store host list : %s\n", filename); DLOG_ERR("Not enough memory to store host list : %s\n", filename);
fclose(F); fclose(F);
return false; return false;
} }
@ -87,7 +87,7 @@ bool AppendHostList(strpool **hostlist, char *filename)
fclose(F); fclose(F);
} }
printf("Loaded %d hosts from %s\n", ct, filename); DLOG_CONDUP("Loaded %d hosts from %s\n", ct, filename);
return true; return true;
} }
@ -124,7 +124,7 @@ bool SearchHostList(strpool *hostlist, const char *host)
while (p) while (p)
{ {
bInHostList = StrPoolCheckStr(hostlist, p); bInHostList = StrPoolCheckStr(hostlist, p);
if (params.debug) printf("Hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative"); VPRINT("Hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative");
if (bInHostList) return true; if (bInHostList) return true;
p = strchr(p, '.'); p = strchr(p, '.');
if (p) p++; if (p) p++;
@ -139,7 +139,7 @@ static bool HostlistCheck_(strpool *hostlist, strpool *hostlist_exclude, const c
if (excluded) *excluded = false; if (excluded) *excluded = false;
if (hostlist_exclude) if (hostlist_exclude)
{ {
if (params.debug) printf("Checking exclude hostlist\n"); VPRINT("Checking exclude hostlist\n");
if (SearchHostList(hostlist_exclude, host)) if (SearchHostList(hostlist_exclude, host))
{ {
if (excluded) *excluded = true; if (excluded) *excluded = true;
@ -148,7 +148,7 @@ static bool HostlistCheck_(strpool *hostlist, strpool *hostlist_exclude, const c
} }
if (hostlist) if (hostlist)
{ {
if (params.debug) printf("Checking include hostlist\n"); VPRINT("Checking include hostlist\n");
return SearchHostList(hostlist, host); return SearchHostList(hostlist, host);
} }
return true; return true;
@ -162,7 +162,7 @@ bool HostlistCheck(const char *host, bool *excluded)
time_t t = file_mod_time(params.hostlist_auto_filename); time_t t = file_mod_time(params.hostlist_auto_filename);
if (t!=params.hostlist_auto_mod_time) if (t!=params.hostlist_auto_mod_time)
{ {
printf("Autohostlist was modified by another process. Reloading include hostslist.\n"); DLOG_CONDUP("Autohostlist was modified by another process. Reloading include hostslist.\n");
if (!LoadIncludeHostLists()) if (!LoadIncludeHostLists())
{ {
// what will we do without hostlist ?? sure, gonna die // what will we do without hostlist ?? sure, gonna die

140
tpws/params.c Normal file
View File

@ -0,0 +1,140 @@
#include "params.h"
#include <stdarg.h>
#include <syslog.h>
#include <errno.h>
int DLOG_FILE(FILE *F, const char *format, va_list args)
{
return vfprintf(F, format, args);
}
int DLOG_CON(const char *format, int syslog_priority, va_list args)
{
return DLOG_FILE(syslog_priority==LOG_ERR ? stderr : stdout, format, args);
}
int DLOG_FILENAME(const char *filename, const char *format, va_list args)
{
int r;
FILE *F = fopen(filename,"at");
if (F)
{
r = DLOG_FILE(F, format, args);
fclose(F);
}
else
r=-1;
return r;
}
static char syslog_buf[1024];
static size_t syslog_buf_sz=0;
static void syslog_buffered(int priority, const char *format, va_list args)
{
if (vsnprintf(syslog_buf+syslog_buf_sz,sizeof(syslog_buf)-syslog_buf_sz,format,args)>0)
{
syslog_buf_sz=strlen(syslog_buf);
// log when buffer is full or buffer ends with \n
if (syslog_buf_sz>=(sizeof(syslog_buf)-1) || (syslog_buf_sz && syslog_buf[syslog_buf_sz-1]=='\n'))
{
syslog(priority,"%s",syslog_buf);
syslog_buf_sz = 0;
}
}
}
static int DLOG_VA(const char *format, int syslog_priority, bool condup, int level, va_list args)
{
int r=0;
va_list args2;
if (condup && !(params.debug>=level && params.debug_target==LOG_TARGET_CONSOLE))
{
va_copy(args2,args);
DLOG_CON(format,syslog_priority,args2);
}
if (params.debug>=level)
{
switch(params.debug_target)
{
case LOG_TARGET_CONSOLE:
r = DLOG_CON(format,syslog_priority,args);
break;
case LOG_TARGET_FILE:
r = DLOG_FILENAME(params.debug_logfile,format,args);
break;
case LOG_TARGET_SYSLOG:
// skip newlines
syslog_buffered(syslog_priority,format,args);
r = 1;
break;
default:
break;
}
}
return r;
}
int DLOG(const char *format, int level, ...)
{
int r;
va_list args;
va_start(args, level);
r = DLOG_VA(format, LOG_DEBUG, false, level, args);
va_end(args);
return r;
}
int DLOG_CONDUP(const char *format, ...)
{
int r;
va_list args;
va_start(args, format);
r = DLOG_VA(format, LOG_DEBUG, true, 1, args);
va_end(args);
return r;
}
int DLOG_ERR(const char *format, ...)
{
int r;
va_list args;
va_start(args, format);
r = DLOG_VA(format, LOG_ERR, true, 1, args);
va_end(args);
return r;
}
int DLOG_PERROR(const char *s)
{
return DLOG_ERR("%s: %s\n", s, strerror(errno));
}
int LOG_APPEND(const char *filename, const char *format, va_list args)
{
int r;
FILE *F = fopen(filename,"at");
if (F)
{
fprint_localtime(F);
fprintf(F, " : ");
r = vfprintf(F, format, args);
fprintf(F, "\n");
fclose(F);
}
else
r=-1;
return r;
}
int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
{
if (*params.hostlist_auto_debuglog)
{
int r;
va_list args;
va_start(args, format);
r = LOG_APPEND(params.hostlist_auto_debuglog, format, args);
va_end(args);
return r;
}
else
return 0;
}

29
tpws/params.h
View File

@ -25,6 +25,8 @@ struct bind_s
int bind_wait_ifup,bind_wait_ip,bind_wait_ip_ll; int bind_wait_ifup,bind_wait_ip,bind_wait_ip_ll;
}; };
enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
struct params_s struct params_s
{ {
struct bind_s binds[MAX_BINDS]; struct bind_s binds[MAX_BINDS];
@ -72,7 +74,13 @@ struct params_s
bool tamper_start_n,tamper_cutoff_n; bool tamper_start_n,tamper_cutoff_n;
unsigned int tamper_start,tamper_cutoff; unsigned int tamper_start,tamper_cutoff;
struct sockaddr_in connect_bind4;
struct sockaddr_in6 connect_bind6;
char connect_bind6_ifname[IF_NAMESIZE];
int debug; int debug;
enum log_target debug_target;
char debug_logfile[PATH_MAX];
#if defined(BSD) #if defined(BSD)
bool pf_enable; bool pf_enable;
@ -84,18 +92,11 @@ struct params_s
extern struct params_s params; extern struct params_s params;
#define _DBGPRINT(format, level, ...) { if (params.debug>=level) printf(format "\n", ##__VA_ARGS__); } int DLOG(const char *format, int level, ...);
#define VPRINT(format, ...) _DBGPRINT(format,1,##__VA_ARGS__) int DLOG_CONDUP(const char *format, ...);
#define DBGPRINT(format, ...) _DBGPRINT(format,2,##__VA_ARGS__) int DLOG_ERR(const char *format, ...);
int DLOG_PERROR(const char *s);
int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);
#define LOG_APPEND(filename, format, ...) \ #define VPRINT(format, ...) DLOG(format, 1, ##__VA_ARGS__)
{ \ #define DBGPRINT(format, ...) DLOG(format, 2, ##__VA_ARGS__)
FILE *F = fopen(filename,"at"); \
if (F) \
{ \
fprint_localtime(F); \
fprintf(F, " : " format "\n", ##__VA_ARGS__); \
fclose(F); \
} \
}
#define HOSTLIST_DEBUGLOG_APPEND(format, ...) if (*params.hostlist_auto_debuglog) LOG_APPEND(params.hostlist_auto_debuglog, format, ##__VA_ARGS__)

32
tpws/redirect.c
View File

@ -31,7 +31,7 @@ void redir_close(void)
{ {
close(redirector_fd); close(redirector_fd);
redirector_fd = -1; redirector_fd = -1;
DBGPRINT("closed redirector"); DBGPRINT("closed redirector\n");
} }
} }
static bool redir_open_private(const char *fname, int flags) static bool redir_open_private(const char *fname, int flags)
@ -40,10 +40,10 @@ static bool redir_open_private(const char *fname, int flags)
redirector_fd = open(fname, flags); redirector_fd = open(fname, flags);
if (redirector_fd < 0) if (redirector_fd < 0)
{ {
perror("redir_openv_private"); DLOG_PERROR("redir_openv_private");
return false; return false;
} }
DBGPRINT("opened redirector %s",fname); DBGPRINT("opened redirector %s\n",fname);
return true; return true;
} }
bool redir_init(void) bool redir_init(void)
@ -63,7 +63,7 @@ static bool destination_from_pf(const struct sockaddr *accept_sa, struct sockadd
char s[48],s2[48]; char s[48],s2[48];
*s=0; ntop46_port(accept_sa, s, sizeof(s)); *s=0; ntop46_port(accept_sa, s, sizeof(s));
*s2=0; ntop46_port((struct sockaddr *)orig_dst, s2, sizeof(s2)); *s2=0; ntop46_port((struct sockaddr *)orig_dst, s2, sizeof(s2));
DBGPRINT("destination_from_pf %s %s",s,s2); DBGPRINT("destination_from_pf %s %s\n",s,s2);
} }
saconvmapped(orig_dst); saconvmapped(orig_dst);
@ -79,12 +79,12 @@ static bool destination_from_pf(const struct sockaddr *accept_sa, struct sockadd
char s[48],s2[48]; char s[48],s2[48];
*s=0; ntop46_port(accept_sa, s, sizeof(s)); *s=0; ntop46_port(accept_sa, s, sizeof(s));
*s2=0; ntop46_port((struct sockaddr *)orig_dst, s2, sizeof(s2)); *s2=0; ntop46_port((struct sockaddr *)orig_dst, s2, sizeof(s2));
DBGPRINT("destination_from_pf (saconvmapped) %s %s",s,s2); DBGPRINT("destination_from_pf (saconvmapped) %s %s\n",s,s2);
} }
if (accept_sa->sa_family!=orig_dst->ss_family) if (accept_sa->sa_family!=orig_dst->ss_family)
{ {
DBGPRINT("accept_sa and orig_dst sa_family mismatch : %d %d", accept_sa->sa_family, orig_dst->ss_family); DBGPRINT("accept_sa and orig_dst sa_family mismatch : %d %d\n", accept_sa->sa_family, orig_dst->ss_family);
return false; return false;
} }
@ -123,16 +123,16 @@ static bool destination_from_pf(const struct sockaddr *accept_sa, struct sockadd
} }
break; break;
default: default:
DBGPRINT("destination_from_pf : unexpected address family %d",orig_dst->ss_family); DBGPRINT("destination_from_pf : unexpected address family %d\n",orig_dst->ss_family);
return false; return false;
} }
if (ioctl(redirector_fd, DIOCNATLOOK, &nl) < 0) if (ioctl(redirector_fd, DIOCNATLOOK, &nl) < 0)
{ {
DBGPRINT("ioctl(DIOCNATLOOK) failed: %s",strerror(errno)); DLOG_PERROR("ioctl(DIOCNATLOOK) failed");
return false; return false;
} }
DBGPRINT("destination_from_pf : got orig dest addr from pf"); DBGPRINT("destination_from_pf : got orig dest addr from pf\n");
switch(nl.af) switch(nl.af)
{ {
@ -155,7 +155,7 @@ static bool destination_from_pf(const struct sockaddr *accept_sa, struct sockadd
((struct sockaddr_in6*)orig_dst)->sin6_addr = nl.rdaddr.v6; ((struct sockaddr_in6*)orig_dst)->sin6_addr = nl.rdaddr.v6;
break; break;
default: default:
DBGPRINT("destination_from_pf : DIOCNATLOOK returned unexpected address family %d",nl.af); DBGPRINT("destination_from_pf : DIOCNATLOOK returned unexpected address family %d\n",nl.af);
return false; return false;
} }
@ -192,38 +192,38 @@ bool get_dest_addr(int sockfd, const struct sockaddr *accept_sa, struct sockaddr
r = getsockopt(sockfd, SOL_IPV6, IP6T_SO_ORIGINAL_DST, (struct sockaddr*) orig_dst, &addrlen); r = getsockopt(sockfd, SOL_IPV6, IP6T_SO_ORIGINAL_DST, (struct sockaddr*) orig_dst, &addrlen);
if (r<0) if (r<0)
{ {
DBGPRINT("both SO_ORIGINAL_DST and IP6T_SO_ORIGINAL_DST failed !"); DBGPRINT("both SO_ORIGINAL_DST and IP6T_SO_ORIGINAL_DST failed !\n");
#endif #endif
// TPROXY : socket is bound to original destination // TPROXY : socket is bound to original destination
r=getsockname(sockfd, (struct sockaddr*) orig_dst, &addrlen); r=getsockname(sockfd, (struct sockaddr*) orig_dst, &addrlen);
if (r<0) if (r<0)
{ {
perror("getsockname"); DLOG_PERROR("getsockname");
return false; return false;
} }
if (orig_dst->ss_family==AF_INET6) if (orig_dst->ss_family==AF_INET6)
((struct sockaddr_in6*)orig_dst)->sin6_scope_id=0; // or MacOS will not connect() ((struct sockaddr_in6*)orig_dst)->sin6_scope_id=0; // or MacOS will not connect()
#ifdef BSD #ifdef BSD
if (params.pf_enable && !destination_from_pf(accept_sa, orig_dst)) if (params.pf_enable && !destination_from_pf(accept_sa, orig_dst))
DBGPRINT("pf filter destination_from_pf failed"); DBGPRINT("pf filter destination_from_pf failed\n");
#endif #endif
#ifdef __linux__ #ifdef __linux__
} }
#endif #endif
if (saconvmapped(orig_dst)) if (saconvmapped(orig_dst))
DBGPRINT("Original destination : converted ipv6 mapped address to ipv4"); DBGPRINT("Original destination : converted ipv6 mapped address to ipv4\n");
if (params.debug) if (params.debug)
{ {
if (orig_dst->ss_family == AF_INET) if (orig_dst->ss_family == AF_INET)
{ {
inet_ntop(AF_INET, &(((struct sockaddr_in*) orig_dst)->sin_addr), orig_dst_str, INET_ADDRSTRLEN); inet_ntop(AF_INET, &(((struct sockaddr_in*) orig_dst)->sin_addr), orig_dst_str, INET_ADDRSTRLEN);
VPRINT("Original destination for socket fd=%d : %s:%d", sockfd,orig_dst_str, htons(((struct sockaddr_in*) orig_dst)->sin_port)) VPRINT("Original destination for socket fd=%d : %s:%d\n", sockfd,orig_dst_str, htons(((struct sockaddr_in*) orig_dst)->sin_port));
} }
else if (orig_dst->ss_family == AF_INET6) else if (orig_dst->ss_family == AF_INET6)
{ {
inet_ntop(AF_INET6,&(((struct sockaddr_in6*) orig_dst)->sin6_addr), orig_dst_str, INET6_ADDRSTRLEN); inet_ntop(AF_INET6,&(((struct sockaddr_in6*) orig_dst)->sin6_addr), orig_dst_str, INET6_ADDRSTRLEN);
VPRINT("Original destination for socket fd=%d : [%s]:%d", sockfd,orig_dst_str, htons(((struct sockaddr_in6*) orig_dst)->sin6_port)) VPRINT("Original destination for socket fd=%d : [%s]:%d\n", sockfd,orig_dst_str, htons(((struct sockaddr_in6*) orig_dst)->sin6_port));
} }
} }
return true; return true;

14
tpws/resolver.c
View File

@ -1,6 +1,8 @@
#define _GNU_SOURCE #define _GNU_SOURCE
#include "resolver.h" #include "resolver.h"
#include "params.h"
#include <stdlib.h> #include <stdlib.h>
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
@ -74,7 +76,7 @@ static void *resolver_thread(void *arg)
{ {
if (errno!=EINTR) if (errno!=EINTR)
{ {
perror("sem_wait (resolver_thread)"); DLOG_PERROR("sem_wait (resolver_thread)");
break; // fatal err break; // fatal err
} }
} }
@ -112,13 +114,13 @@ static void *resolver_thread(void *arg)
if (wr<0) if (wr<0)
{ {
free(ri); free(ri);
perror("write resolve_pipe"); DLOG_PERROR("write resolve_pipe");
} }
else if (wr!=sizeof(void*)) else if (wr!=sizeof(void*))
{ {
// partial pointer write is FATAL. in any case it will cause pointer corruption and coredump // partial pointer write is FATAL. in any case it will cause pointer corruption and coredump
free(ri); free(ri);
fprintf(stderr,"write resolve_pipe : not full write\n"); DLOG_ERR("write resolve_pipe : not full write\n");
exit(1000); exit(1000);
} }
pthread_sigmask(SIG_UNBLOCK, &signal_mask, NULL); pthread_sigmask(SIG_UNBLOCK, &signal_mask, NULL);
@ -181,7 +183,7 @@ bool resolver_init(int threads, int fd_signal_pipe)
resolver.sem = sem_open(sn,O_CREAT,0600,0); resolver.sem = sem_open(sn,O_CREAT,0600,0);
if (resolver.sem==SEM_FAILED) if (resolver.sem==SEM_FAILED)
{ {
perror("sem_open"); DLOG_PERROR("sem_open");
goto ex; goto ex;
} }
// unlink immediately to remove tails // unlink immediately to remove tails
@ -189,7 +191,7 @@ bool resolver_init(int threads, int fd_signal_pipe)
#else #else
if (sem_init(&resolver._sem,0,0)==-1) if (sem_init(&resolver._sem,0,0)==-1)
{ {
perror("sem_init"); DLOG_PERROR("sem_init");
goto ex; goto ex;
} }
resolver.sem = &resolver._sem; resolver.sem = &resolver._sem;
@ -252,7 +254,7 @@ struct resolve_item *resolver_queue(const char *dom, uint16_t port, void *ptr)
rlist_unlock; rlist_unlock;
if (sem_post(resolver.sem)<0) if (sem_post(resolver.sem)<0)
{ {
perror("resolver_queue sem_post"); DLOG_PERROR("resolver_queue sem_post");
free(ri); free(ri);
return NULL; return NULL;
} }

31
tpws/sec.c
View File

@ -169,14 +169,14 @@ bool sec_harden(void)
{ {
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
{ {
perror("PR_SET_NO_NEW_PRIVS(prctl)"); DLOG_PERROR("PR_SET_NO_NEW_PRIVS(prctl)");
return false; return false;
} }
#if ARCH_NR!=0 #if ARCH_NR!=0
if (!set_seccomp()) if (!set_seccomp())
{ {
perror("seccomp"); DLOG_PERROR("seccomp");
if (errno==EINVAL) fprintf(stderr,"seccomp: this can be safely ignored if kernel does not support seccomp\n"); if (errno==EINVAL) DLOG_ERR("seccomp: this can be safely ignored if kernel does not support seccomp\n");
return false; return false;
} }
#endif #endif
@ -232,15 +232,15 @@ bool dropcaps(void)
{ {
if (prctl(PR_CAPBSET_DROP, cap)<0) if (prctl(PR_CAPBSET_DROP, cap)<0)
{ {
fprintf(stderr, "could not drop bound cap %d\n", cap); DLOG_ERR("could not drop bound cap %d\n", cap);
perror("cap_drop_bound"); DLOG_PERROR("cap_drop_bound");
} }
} }
} }
// now without CAP_SETPCAP // now without CAP_SETPCAP
if (!setpcap(caps)) if (!setpcap(caps))
{ {
perror("setpcap"); DLOG_PERROR("setpcap");
return checkpcap(caps); return checkpcap(caps);
} }
return true; return true;
@ -273,24 +273,24 @@ bool droproot(uid_t uid, gid_t gid)
#ifdef __linux__ #ifdef __linux__
if (prctl(PR_SET_KEEPCAPS, 1L)) if (prctl(PR_SET_KEEPCAPS, 1L))
{ {
perror("prctl(PR_SET_KEEPCAPS)"); DLOG_PERROR("prctl(PR_SET_KEEPCAPS)");
return false; return false;
} }
#endif #endif
// drop all SGIDs // drop all SGIDs
if (setgroups(0,NULL)) if (setgroups(0,NULL))
{ {
perror("setgroups"); DLOG_PERROR("setgroups");
return false; return false;
} }
if (setgid(gid)) if (setgid(gid))
{ {
perror("setgid"); DLOG_PERROR("setgid");
return false; return false;
} }
if (setuid(uid)) if (setuid(uid))
{ {
perror("setuid"); DLOG_PERROR("setuid");
return false; return false;
} }
#ifdef __linux__ #ifdef __linux__
@ -304,16 +304,17 @@ void print_id(void)
{ {
int i,N; int i,N;
gid_t g[128]; gid_t g[128];
printf("Running as UID=%u GID=",getuid());
DLOG_CONDUP("Running as UID=%u GID=",getuid());
N=getgroups(sizeof(g)/sizeof(*g),g); N=getgroups(sizeof(g)/sizeof(*g),g);
if (N>0) if (N>0)
{ {
for(i=0;i<N;i++) for(i=0;i<N;i++)
printf(i==(N-1) ? "%u" : "%u,", g[i]); DLOG_CONDUP(i==(N-1) ? "%u" : "%u,", g[i]);
printf("\n"); DLOG_CONDUP("\n");
} }
else else
printf("%u\n",getgid()); DLOG_CONDUP("%u\n",getgid());
} }
void daemonize(void) void daemonize(void)
@ -323,7 +324,7 @@ void daemonize(void)
pid = fork(); pid = fork();
if (pid == -1) if (pid == -1)
{ {
perror("fork"); DLOG_PERROR("fork");
exit(2); exit(2);
} }
else if (pid != 0) else if (pid != 0)

2
tpws/sec.h
View File

@ -1,5 +1,7 @@
#pragma once #pragma once
#include "params.h"
#include <sys/types.h> #include <sys/types.h>
#include <stdbool.h> #include <stdbool.h>

76
tpws/tamper.c
View File

@ -17,7 +17,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
bool bBypass = false, bHaveHost = false, bHostExcluded = false; bool bBypass = false, bHaveHost = false, bHostExcluded = false;
char *pc, Host[256]; char *pc, Host[256];
DBGPRINT("tamper_out") DBGPRINT("tamper_out\n");
*split_pos=0; *split_pos=0;
*split_flags=0; *split_flags=0;
@ -25,7 +25,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if ((method = HttpMethod(segment,*size))) if ((method = HttpMethod(segment,*size)))
{ {
method_len = strlen(method)-2; method_len = strlen(method)-2;
VPRINT("Data block looks like http request start : %s", method) VPRINT("Data block looks like http request start : %s\n", method);
if (!ctrack->l7proto) ctrack->l7proto=HTTP; if (!ctrack->l7proto) ctrack->l7proto=HTTP;
// cpu saving : we search host only if and when required. we do not research host every time we need its position // cpu saving : we search host only if and when required. we do not research host every time we need its position
if ((params.hostlist || params.hostlist_exclude) && HttpFindHost(&pHost,segment,*size)) if ((params.hostlist || params.hostlist_exclude) && HttpFindHost(&pHost,segment,*size))
@ -37,7 +37,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
memcpy(Host, p, pp - p); memcpy(Host, p, pp - p);
Host[pp - p] = '\0'; Host[pp - p] = '\0';
bHaveHost = true; bHaveHost = true;
VPRINT("Requested Host is : %s", Host) VPRINT("Requested Host is : %s\n", Host);
for(pc = Host; *pc; pc++) *pc=tolower(*pc); for(pc = Host; *pc; pc++) *pc=tolower(*pc);
bBypass = !HostlistCheck(Host, &bHostExcluded); bBypass = !HostlistCheck(Host, &bHostExcluded);
} }
@ -54,7 +54,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if (pp == (p - 1)) if (pp == (p - 1))
{ {
// probably end of http headers // probably end of http headers
VPRINT("Found double EOL at pos %td. Stop replacing.", pp - segment) VPRINT("Found double EOL at pos %td. Stop replacing.\n", pp - segment);
break; break;
} }
pp = p; pp = p;
@ -63,7 +63,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
} }
if (params.methodeol && (*size+1+!params.unixeol)<=segment_buffer_size) if (params.methodeol && (*size+1+!params.unixeol)<=segment_buffer_size)
{ {
VPRINT("Adding EOL before method") VPRINT("Adding EOL before method\n");
if (params.unixeol) if (params.unixeol)
{ {
memmove(segment + 1, segment, *size); memmove(segment + 1, segment, *size);
@ -82,7 +82,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if (params.methodspace && *size<segment_buffer_size) if (params.methodspace && *size<segment_buffer_size)
{ {
// we only work with data blocks looking as HTTP query, so method is at the beginning // we only work with data blocks looking as HTTP query, so method is at the beginning
VPRINT("Adding extra space after method") VPRINT("Adding extra space after method\n");
p = segment + method_len + 1; p = segment + method_len + 1;
pos = method_len + 1; pos = method_len + 1;
memmove(p + 1, p, *size - pos); memmove(p + 1, p, *size - pos);
@ -97,7 +97,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if (p < (segment + *size)) if (p < (segment + *size))
{ {
pos = p - segment; pos = p - segment;
VPRINT("Adding %s to host name at pos %zu", params.hostdot ? "dot" : "tab", pos) VPRINT("Adding %s to host name at pos %zu\n", params.hostdot ? "dot" : "tab", pos);
memmove(p + 1, p, *size - pos); memmove(p + 1, p, *size - pos);
*p = params.hostdot ? '.' : '\t'; // insert dot or tab *p = params.hostdot ? '.' : '\t'; // insert dot or tab
(*size)++; // block will grow by 1 byte (*size)++; // block will grow by 1 byte
@ -107,7 +107,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
{ {
p = pHost + 5; p = pHost + 5;
pos = p - segment; pos = p - segment;
VPRINT("Mixing domain case at pos %zu",pos) VPRINT("Mixing domain case at pos %zu\n",pos);
for (; p < (segment + *size) && *p != '\r' && *p != '\n'; p++) for (; p < (segment + *size) && *p != '\r' && *p != '\n'; p++)
*p = (((size_t)p) & 1) ? tolower(*p) : toupper(*p); *p = (((size_t)p) & 1) ? tolower(*p) : toupper(*p);
} }
@ -115,13 +115,13 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
{ {
p = pHost + 6; p = pHost + 6;
pos = p - segment; pos = p - segment;
VPRINT("Removing space before host name at pos %zu", pos) VPRINT("Removing space before host name at pos %zu\n", pos);
memmove(p - 1, p, *size - pos); memmove(p - 1, p, *size - pos);
(*size)--; // block will shrink by 1 byte (*size)--; // block will shrink by 1 byte
} }
if (params.hostcase && HttpFindHost(&pHost,segment,*size)) if (params.hostcase && HttpFindHost(&pHost,segment,*size))
{ {
VPRINT("Changing 'Host:' => '%c%c%c%c:' at pos %td", params.hostspell[0], params.hostspell[1], params.hostspell[2], params.hostspell[3], pHost - segment) VPRINT("Changing 'Host:' => '%c%c%c%c:' at pos %td\n", params.hostspell[0], params.hostspell[1], params.hostspell[2], params.hostspell[3], pHost - segment);
memcpy(pHost, params.hostspell, 4); memcpy(pHost, params.hostspell, 4);
} }
if (params.hostpad && HttpFindHost(&pHost,segment,*size)) if (params.hostpad && HttpFindHost(&pHost,segment,*size))
@ -132,16 +132,16 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
size_t hostpad = params.hostpad<hsize ? hsize : params.hostpad; size_t hostpad = params.hostpad<hsize ? hsize : params.hostpad;
if ((hsize+*size)>segment_buffer_size) if ((hsize+*size)>segment_buffer_size)
VPRINT("could not add host padding : buffer too small") VPRINT("could not add host padding : buffer too small\n");
else else
{ {
if ((hostpad+*size)>segment_buffer_size) if ((hostpad+*size)>segment_buffer_size)
{ {
hostpad=segment_buffer_size-*size; hostpad=segment_buffer_size-*size;
VPRINT("host padding reduced to %zu bytes : buffer too small", hostpad) VPRINT("host padding reduced to %zu bytes : buffer too small\n", hostpad);
} }
else else
VPRINT("host padding with %zu bytes", hostpad) VPRINT("host padding with %zu bytes\n", hostpad);
p = pHost; p = pHost;
pos = p - segment; pos = p - segment;
@ -177,7 +177,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
} }
else else
{ {
VPRINT("Not acting on this request") VPRINT("Not acting on this request\n");
} }
} }
else if (IsTLSClientHello(segment,*size,false)) else if (IsTLSClientHello(segment,*size,false))
@ -186,17 +186,17 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if (!ctrack->l7proto) ctrack->l7proto=TLS; if (!ctrack->l7proto) ctrack->l7proto=TLS;
VPRINT("packet contains TLS ClientHello") VPRINT("packet contains TLS ClientHello\n");
// we need host only if hostlist is present // we need host only if hostlist is present
if ((params.hostlist || params.hostlist_exclude) && TLSHelloExtractHost((uint8_t*)segment,*size,Host,sizeof(Host),false)) if ((params.hostlist || params.hostlist_exclude) && TLSHelloExtractHost((uint8_t*)segment,*size,Host,sizeof(Host),false))
{ {
VPRINT("hostname: %s",Host) VPRINT("hostname: %s\n",Host);
bHaveHost = true; bHaveHost = true;
bBypass = !HostlistCheck(Host, &bHostExcluded); bBypass = !HostlistCheck(Host, &bHostExcluded);
} }
if (bBypass) if (bBypass)
{ {
VPRINT("Not acting on this request") VPRINT("Not acting on this request\n");
} }
else else
{ {
@ -213,7 +213,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
{ {
// length is checked in IsTLSClientHello and cannot exceed buffer size // length is checked in IsTLSClientHello and cannot exceed buffer size
if ((tpos-5)>=l) tpos=5+1; if ((tpos-5)>=l) tpos=5+1;
VPRINT("making 2 TLS records at pos %zu",tpos) VPRINT("making 2 TLS records at pos %zu\n",tpos);
memmove(segment+tpos+5,segment+tpos,*size-tpos); memmove(segment+tpos+5,segment+tpos,*size-tpos);
segment[tpos] = segment[0]; segment[tpos] = segment[0];
segment[tpos+1] = segment[1]; segment[tpos+1] = segment[1];
@ -229,7 +229,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if (spos && spos < *size) if (spos && spos < *size)
{ {
VPRINT("split pos %zu",spos); VPRINT("split pos %zu\n",spos);
*split_pos = spos; *split_pos = spos;
} }
@ -242,7 +242,7 @@ void tamper_out(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,si
if (bHaveHost && bBypass && !bHostExcluded && *params.hostlist_auto_filename) if (bHaveHost && bBypass && !bHostExcluded && *params.hostlist_auto_filename)
{ {
DBGPRINT("tamper_out put hostname : %s", Host) DBGPRINT("tamper_out put hostname : %s\n", Host);
if (ctrack->hostname) free(ctrack->hostname); if (ctrack->hostname) free(ctrack->hostname);
ctrack->hostname=strdup(Host); ctrack->hostname=strdup(Host);
} }
@ -260,7 +260,7 @@ static void auto_hostlist_reset_fail_counter(const char *hostname)
if (fail_counter) if (fail_counter)
{ {
HostFailPoolDel(&params.hostlist_auto_fail_counters, fail_counter); HostFailPoolDel(&params.hostlist_auto_fail_counters, fail_counter);
VPRINT("auto hostlist : %s : fail counter reset. website is working.", hostname); VPRINT("auto hostlist : %s : fail counter reset. website is working.\n", hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : fail counter reset. website is working.", hostname); HOSTLIST_DEBUGLOG_APPEND("%s : fail counter reset. website is working.", hostname);
} }
} }
@ -276,39 +276,39 @@ static void auto_hostlist_failed(const char *hostname)
fail_counter = HostFailPoolAdd(&params.hostlist_auto_fail_counters, hostname, params.hostlist_auto_fail_time); fail_counter = HostFailPoolAdd(&params.hostlist_auto_fail_counters, hostname, params.hostlist_auto_fail_time);
if (!fail_counter) if (!fail_counter)
{ {
fprintf(stderr, "HostFailPoolAdd: out of memory\n"); DLOG_ERR("HostFailPoolAdd: out of memory\n");
return; return;
} }
} }
fail_counter->counter++; fail_counter->counter++;
VPRINT("auto hostlist : %s : fail counter %d/%d", hostname, fail_counter->counter, params.hostlist_auto_fail_threshold); VPRINT("auto hostlist : %s : fail counter %d/%d\n", hostname, fail_counter->counter, params.hostlist_auto_fail_threshold);
HOSTLIST_DEBUGLOG_APPEND("%s : fail counter %d/%d", hostname, fail_counter->counter, params.hostlist_auto_fail_threshold); HOSTLIST_DEBUGLOG_APPEND("%s : fail counter %d/%d", hostname, fail_counter->counter, params.hostlist_auto_fail_threshold);
if (fail_counter->counter >= params.hostlist_auto_fail_threshold) if (fail_counter->counter >= params.hostlist_auto_fail_threshold)
{ {
VPRINT("auto hostlist : fail threshold reached. adding %s to auto hostlist", hostname); VPRINT("auto hostlist : fail threshold reached. adding %s to auto hostlist\n", hostname);
HostFailPoolDel(&params.hostlist_auto_fail_counters, fail_counter); HostFailPoolDel(&params.hostlist_auto_fail_counters, fail_counter);
VPRINT("auto hostlist : rechecking %s to avoid duplicates", hostname); VPRINT("auto hostlist : rechecking %s to avoid duplicates\n", hostname);
bool bExcluded=false; bool bExcluded=false;
if (!HostlistCheck(hostname, &bExcluded) && !bExcluded) if (!HostlistCheck(hostname, &bExcluded) && !bExcluded)
{ {
VPRINT("auto hostlist : adding %s", hostname); VPRINT("auto hostlist : adding %s\n", hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : adding", hostname); HOSTLIST_DEBUGLOG_APPEND("%s : adding", hostname);
if (!StrPoolAddStr(&params.hostlist, hostname)) if (!StrPoolAddStr(&params.hostlist, hostname))
{ {
fprintf(stderr, "StrPoolAddStr out of memory\n"); DLOG_ERR("StrPoolAddStr out of memory\n");
return; return;
} }
if (!append_to_list_file(params.hostlist_auto_filename, hostname)) if (!append_to_list_file(params.hostlist_auto_filename, hostname))
{ {
perror("write to auto hostlist:"); DLOG_PERROR("write to auto hostlist:");
return; return;
} }
params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename); params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename);
} }
else else
{ {
VPRINT("auto hostlist : NOT adding %s", hostname); VPRINT("auto hostlist : NOT adding %s\n", hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : NOT adding, duplicate detected", hostname); HOSTLIST_DEBUGLOG_APPEND("%s : NOT adding, duplicate detected", hostname);
} }
} }
@ -318,7 +318,7 @@ void tamper_in(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,siz
{ {
bool bFail=false; bool bFail=false;
DBGPRINT("tamper_in hostname=%s", ctrack->hostname) DBGPRINT("tamper_in hostname=%s\n", ctrack->hostname);
if (*params.hostlist_auto_filename) if (*params.hostlist_auto_filename)
{ {
@ -328,20 +328,20 @@ void tamper_in(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,siz
{ {
if (IsHttpReply(segment,*size)) if (IsHttpReply(segment,*size))
{ {
VPRINT("incoming HTTP reply detected for hostname %s", ctrack->hostname); VPRINT("incoming HTTP reply detected for hostname %s\n", ctrack->hostname);
bFail = HttpReplyLooksLikeDPIRedirect(segment, *size, ctrack->hostname); bFail = HttpReplyLooksLikeDPIRedirect(segment, *size, ctrack->hostname);
if (bFail) if (bFail)
{ {
VPRINT("redirect to another domain detected. possibly DPI redirect.") VPRINT("redirect to another domain detected. possibly DPI redirect.\n");
HOSTLIST_DEBUGLOG_APPEND("%s : redirect to another domain", ctrack->hostname); HOSTLIST_DEBUGLOG_APPEND("%s : redirect to another domain", ctrack->hostname);
} }
else else
VPRINT("local or in-domain redirect detected. it's not a DPI redirect.") VPRINT("local or in-domain redirect detected. it's not a DPI redirect.\n");
} }
else else
{ {
// received not http reply. do not monitor this connection anymore // received not http reply. do not monitor this connection anymore
VPRINT("incoming unknown HTTP data detected for hostname %s", ctrack->hostname); VPRINT("incoming unknown HTTP data detected for hostname %s\n", ctrack->hostname);
} }
if (bFail) auto_hostlist_failed(ctrack->hostname); if (bFail) auto_hostlist_failed(ctrack->hostname);
@ -354,7 +354,7 @@ void tamper_in(t_ctrack *ctrack, uint8_t *segment,size_t segment_buffer_size,siz
void rst_in(t_ctrack *ctrack) void rst_in(t_ctrack *ctrack)
{ {
DBGPRINT("rst_in hostname=%s", ctrack->hostname) DBGPRINT("rst_in hostname=%s\n", ctrack->hostname);
if (!*params.hostlist_auto_filename) return; if (!*params.hostlist_auto_filename) return;
@ -362,14 +362,14 @@ void rst_in(t_ctrack *ctrack)
if (!ctrack->bTamperInCutoff && ctrack->hostname) if (!ctrack->bTamperInCutoff && ctrack->hostname)
{ {
VPRINT("incoming RST detected for hostname %s", ctrack->hostname); VPRINT("incoming RST detected for hostname %s\n", ctrack->hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : incoming RST", ctrack->hostname); HOSTLIST_DEBUGLOG_APPEND("%s : incoming RST", ctrack->hostname);
auto_hostlist_failed(ctrack->hostname); auto_hostlist_failed(ctrack->hostname);
} }
} }
void hup_out(t_ctrack *ctrack) void hup_out(t_ctrack *ctrack)
{ {
DBGPRINT("hup_out hostname=%s", ctrack->hostname) DBGPRINT("hup_out hostname=%s\n", ctrack->hostname);
if (!*params.hostlist_auto_filename) return; if (!*params.hostlist_auto_filename) return;
@ -378,7 +378,7 @@ void hup_out(t_ctrack *ctrack)
if (!ctrack->bTamperInCutoff && ctrack->hostname) if (!ctrack->bTamperInCutoff && ctrack->hostname)
{ {
// local leg dropped connection after first request. probably due to timeout. // local leg dropped connection after first request. probably due to timeout.
VPRINT("local leg closed connection after first request (timeout ?). hostname: %s", ctrack->hostname); VPRINT("local leg closed connection after first request (timeout ?). hostname: %s\n", ctrack->hostname);
HOSTLIST_DEBUGLOG_APPEND("%s : client closed connection without server reply", ctrack->hostname); HOSTLIST_DEBUGLOG_APPEND("%s : client closed connection without server reply", ctrack->hostname);
auto_hostlist_failed(ctrack->hostname); auto_hostlist_failed(ctrack->hostname);
} }

273
tpws/tpws.c
View File

@ -23,6 +23,7 @@
#include <pwd.h> #include <pwd.h>
#include <sys/resource.h> #include <sys/resource.h>
#include <time.h> #include <time.h>
#include <syslog.h>
#include "tpws.h" #include "tpws.h"
@ -78,17 +79,17 @@ static int8_t block_sigpipe(void)
//Get the old sigset, add SIGPIPE and update sigset //Get the old sigset, add SIGPIPE and update sigset
if (sigprocmask(SIG_BLOCK, NULL, &sigset) == -1) { if (sigprocmask(SIG_BLOCK, NULL, &sigset) == -1) {
perror("sigprocmask (get)"); DLOG_PERROR("sigprocmask (get)");
return -1; return -1;
} }
if (sigaddset(&sigset, SIGPIPE) == -1) { if (sigaddset(&sigset, SIGPIPE) == -1) {
perror("sigaddset"); DLOG_PERROR("sigaddset");
return -1; return -1;
} }
if (sigprocmask(SIG_BLOCK, &sigset, NULL) == -1) { if (sigprocmask(SIG_BLOCK, &sigset, NULL) == -1) {
perror("sigprocmask (set)"); DLOG_PERROR("sigprocmask (set)");
return -1; return -1;
} }
@ -136,6 +137,7 @@ static void exithelp(void)
" --bind-wait-ip-linklocal=<sec>\t\t; (prefer) accept only LL first N seconds then any (unwanted) accept only globals first N seconds then LL\n" " --bind-wait-ip-linklocal=<sec>\t\t; (prefer) accept only LL first N seconds then any (unwanted) accept only globals first N seconds then LL\n"
" --bind-wait-only\t\t\t; wait for bind conditions satisfaction then exit. return code 0 if success.\n" " --bind-wait-only\t\t\t; wait for bind conditions satisfaction then exit. return code 0 if success.\n"
" * multiple binds are supported. each bind-addr, bind-iface* start new bind\n" " * multiple binds are supported. each bind-addr, bind-iface* start new bind\n"
" --connect-bind-addr=<v4_addr>|<v6_addr> ; address for outbound connections. for v6 link locals append %%interface_name\n"
" --port=<port>\t\t\t\t; only one port number for all binds is supported\n" " --port=<port>\t\t\t\t; only one port number for all binds is supported\n"
" --socks\t\t\t\t; implement socks4/5 proxy instead of transparent proxy\n" " --socks\t\t\t\t; implement socks4/5 proxy instead of transparent proxy\n"
" --no-resolve\t\t\t\t; disable socks5 remote dns ability\n" " --no-resolve\t\t\t\t; disable socks5 remote dns ability\n"
@ -162,7 +164,8 @@ static void exithelp(void)
#if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__) #if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
" --enable-pf\t\t\t\t; enable PF redirector support. required in FreeBSD when used with PF firewall.\n" " --enable-pf\t\t\t\t; enable PF redirector support. required in FreeBSD when used with PF firewall.\n"
#endif #endif
" --debug=0|1|2\t\t\t\t; 0(default)=silent 1=verbose 2=debug\n" " --debug=0|1|2|syslog|@<filename>\t; 1 and 2 means log to console and set debug level. for other targets use --debug-level.\n"
" --debug-level=0|1|2\t\t\t; specify debug level\n"
"\nFILTER:\n" "\nFILTER:\n"
" --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" " --hostlist=<filename>\t\t\t; only act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
" --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n" " --hostlist-exclude=<filename>\t\t; do not act on hosts in the list (one host per line, subdomains auto apply, gzip supported, multiple hostlists allowed)\n"
@ -227,7 +230,7 @@ static void nextbind_clean(void)
params.binds_last++; params.binds_last++;
if (params.binds_last>=MAX_BINDS) if (params.binds_last>=MAX_BINDS)
{ {
fprintf(stderr,"maximum of %d binds are supported\n",MAX_BINDS); DLOG_ERR("maximum of %d binds are supported\n",MAX_BINDS);
exit_clean(1); exit_clean(1);
} }
} }
@ -235,7 +238,7 @@ static void checkbind_clean(void)
{ {
if (params.binds_last<0) if (params.binds_last<0)
{ {
fprintf(stderr,"start new bind with --bind-addr,--bind-iface*\n"); DLOG_ERR("start new bind with --bind-addr,--bind-iface*\n");
exit_clean(1); exit_clean(1);
} }
} }
@ -248,7 +251,7 @@ void save_default_ttl(void)
params.ttl_default = get_default_ttl(); params.ttl_default = get_default_ttl();
if (!params.ttl_default) if (!params.ttl_default)
{ {
fprintf(stderr, "could not get default ttl\n"); DLOG_ERR("could not get default ttl\n");
exit_clean(1); exit_clean(1);
} }
} }
@ -345,23 +348,25 @@ void parse_params(int argc, char *argv[])
{ "hostlist-auto-debug",required_argument,0,0}, // optidx=41 { "hostlist-auto-debug",required_argument,0,0}, // optidx=41
{ "pidfile",required_argument,0,0 },// optidx=42 { "pidfile",required_argument,0,0 },// optidx=42
{ "debug",optional_argument,0,0 },// optidx=43 { "debug",optional_argument,0,0 },// optidx=43
{ "local-rcvbuf",required_argument,0,0 },// optidx=44 { "debug-level",required_argument,0,0 },// optidx=44
{ "local-sndbuf",required_argument,0,0 },// optidx=45 { "local-rcvbuf",required_argument,0,0 },// optidx=45
{ "remote-rcvbuf",required_argument,0,0 },// optidx=46 { "local-sndbuf",required_argument,0,0 },// optidx=46
{ "remote-sndbuf",required_argument,0,0 },// optidx=47 { "remote-rcvbuf",required_argument,0,0 },// optidx=47
{ "socks",no_argument,0,0 },// optidx=48 { "remote-sndbuf",required_argument,0,0 },// optidx=48
{ "no-resolve",no_argument,0,0 },// optidx=49 { "socks",no_argument,0,0 },// optidx=40
{ "resolver-threads",required_argument,0,0 },// optidx=50 { "no-resolve",no_argument,0,0 },// optidx=50
{ "skip-nodelay",no_argument,0,0 },// optidx=51 { "resolver-threads",required_argument,0,0 },// optidx=51
{ "tamper-start",required_argument,0,0 },// optidx=52 { "skip-nodelay",no_argument,0,0 },// optidx=52
{ "tamper-cutoff",required_argument,0,0 },// optidx=53 { "tamper-start",required_argument,0,0 },// optidx=53
{ "tamper-cutoff",required_argument,0,0 },// optidx=54
{ "connect-bind-addr",required_argument,0,0 },// optidx=55
#if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__) #if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
{ "enable-pf",no_argument,0,0 },// optidx=54 { "enable-pf",no_argument,0,0 },// optidx=56
#elif defined(__linux__) #elif defined(__linux__)
{ "mss",required_argument,0,0 },// optidx=54 { "mss",required_argument,0,0 },// optidx=56
{ "mss-pf",required_argument,0,0 },// optidx=55 { "mss-pf",required_argument,0,0 },// optidx=57
#ifdef SPLICE_PRESENT #ifdef SPLICE_PRESENT
{ "nosplice",no_argument,0,0 },// optidx=55 { "nosplice",no_argument,0,0 },// optidx=58
#endif #endif
#endif #endif
{ "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility { "hostlist-auto-retrans-threshold",optional_argument,0,0}, // ignored. for nfqws command line compatibility
@ -414,7 +419,7 @@ void parse_params(int argc, char *argv[])
params.binds[params.binds_last].bindll=unwanted; params.binds[params.binds_last].bindll=unwanted;
else else
{ {
fprintf(stderr, "invalid parameter in bind-linklocal : %s\n",optarg); DLOG_ERR("invalid parameter in bind-linklocal : %s\n",optarg);
exit_clean(1); exit_clean(1);
} }
break; break;
@ -437,7 +442,7 @@ void parse_params(int argc, char *argv[])
i = atoi(optarg); i = atoi(optarg);
if (i <= 0 || i > 65535) if (i <= 0 || i > 65535)
{ {
fprintf(stderr, "bad port number\n"); DLOG_ERR("bad port number\n");
exit_clean(1); exit_clean(1);
} }
params.port = (uint16_t)i; params.port = (uint16_t)i;
@ -450,7 +455,7 @@ void parse_params(int argc, char *argv[])
struct passwd *pwd = getpwnam(optarg); struct passwd *pwd = getpwnam(optarg);
if (!pwd) if (!pwd)
{ {
fprintf(stderr, "non-existent username supplied\n"); DLOG_ERR("non-existent username supplied\n");
exit_clean(1); exit_clean(1);
} }
params.uid = pwd->pw_uid; params.uid = pwd->pw_uid;
@ -463,7 +468,7 @@ void parse_params(int argc, char *argv[])
params.droproot = true; params.droproot = true;
if (sscanf(optarg,"%u:%u",&params.uid,&params.gid)<1) if (sscanf(optarg,"%u:%u",&params.uid,&params.gid)<1)
{ {
fprintf(stderr, "--uid should be : uid[:gid]\n"); DLOG_ERR("--uid should be : uid[:gid]\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -471,7 +476,7 @@ void parse_params(int argc, char *argv[])
params.maxconn = atoi(optarg); params.maxconn = atoi(optarg);
if (params.maxconn <= 0 || params.maxconn > 10000) if (params.maxconn <= 0 || params.maxconn > 10000)
{ {
fprintf(stderr, "bad maxconn\n"); DLOG_ERR("bad maxconn\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -479,7 +484,7 @@ void parse_params(int argc, char *argv[])
params.maxfiles = atoi(optarg); params.maxfiles = atoi(optarg);
if (params.maxfiles < 0) if (params.maxfiles < 0)
{ {
fprintf(stderr, "bad maxfiles\n"); DLOG_ERR("bad maxfiles\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -487,7 +492,7 @@ void parse_params(int argc, char *argv[])
params.max_orphan_time = atoi(optarg); params.max_orphan_time = atoi(optarg);
if (params.max_orphan_time < 0) if (params.max_orphan_time < 0)
{ {
fprintf(stderr, "bad max_orphan_time\n"); DLOG_ERR("bad max_orphan_time\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -498,7 +503,7 @@ void parse_params(int argc, char *argv[])
case 18: /* hostspell */ case 18: /* hostspell */
if (strlen(optarg) != 4) if (strlen(optarg) != 4)
{ {
fprintf(stderr, "hostspell must be exactly 4 chars long\n"); DLOG_ERR("hostspell must be exactly 4 chars long\n");
exit_clean(1); exit_clean(1);
} }
params.hostcase = true; params.hostcase = true;
@ -524,7 +529,7 @@ void parse_params(int argc, char *argv[])
case 23: /* split-http-req */ case 23: /* split-http-req */
if (!parse_httpreqpos(optarg, &params.split_http_req)) if (!parse_httpreqpos(optarg, &params.split_http_req))
{ {
fprintf(stderr, "Invalid argument for split-http-req\n"); DLOG_ERR("Invalid argument for split-http-req\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -532,7 +537,7 @@ void parse_params(int argc, char *argv[])
case 24: /* split-tls */ case 24: /* split-tls */
if (!parse_tlspos(optarg, &params.split_tls)) if (!parse_tlspos(optarg, &params.split_tls))
{ {
fprintf(stderr, "Invalid argument for split-tls\n"); DLOG_ERR("Invalid argument for split-tls\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -543,7 +548,7 @@ void parse_params(int argc, char *argv[])
params.split_pos = i; params.split_pos = i;
else else
{ {
fprintf(stderr, "Invalid argument for split-pos\n"); DLOG_ERR("Invalid argument for split-pos\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -558,7 +563,7 @@ void parse_params(int argc, char *argv[])
else if (!strcmp(optarg,"tls")) params.disorder_tls=true; else if (!strcmp(optarg,"tls")) params.disorder_tls=true;
else else
{ {
fprintf(stderr, "Invalid argument for disorder\n"); DLOG_ERR("Invalid argument for disorder\n");
exit_clean(1); exit_clean(1);
} }
} }
@ -573,7 +578,7 @@ void parse_params(int argc, char *argv[])
else if (!strcmp(optarg,"tls")) params.oob_tls=true; else if (!strcmp(optarg,"tls")) params.oob_tls=true;
else else
{ {
fprintf(stderr, "Invalid argument for oob\n"); DLOG_ERR("Invalid argument for oob\n");
exit_clean(1); exit_clean(1);
} }
} }
@ -587,7 +592,7 @@ void parse_params(int argc, char *argv[])
if (l==1) params.oob_byte = (uint8_t)*optarg; if (l==1) params.oob_byte = (uint8_t)*optarg;
else if (l!=4 || sscanf(optarg,"0x%02X",&bt)!=1) else if (l!=4 || sscanf(optarg,"0x%02X",&bt)!=1)
{ {
fprintf(stderr, "Invalid argument for oob-data\n"); DLOG_ERR("Invalid argument for oob-data\n");
exit_clean(1); exit_clean(1);
} }
else params.oob_byte = (uint8_t)bt; else params.oob_byte = (uint8_t)bt;
@ -612,7 +617,7 @@ void parse_params(int argc, char *argv[])
case 34: /* tlsrec */ case 34: /* tlsrec */
if (!parse_tlspos(optarg, &params.tlsrec)) if (!parse_tlspos(optarg, &params.tlsrec))
{ {
fprintf(stderr, "Invalid argument for tlsrec\n"); DLOG_ERR("Invalid argument for tlsrec\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -622,7 +627,7 @@ void parse_params(int argc, char *argv[])
params.tlsrec = tlspos_pos; params.tlsrec = tlspos_pos;
else else
{ {
fprintf(stderr, "Invalid argument for tlsrec-pos\n"); DLOG_ERR("Invalid argument for tlsrec-pos\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -630,7 +635,7 @@ void parse_params(int argc, char *argv[])
case 36: /* hostlist */ case 36: /* hostlist */
if (!strlist_add(&params.hostlist_files, optarg)) if (!strlist_add(&params.hostlist_files, optarg))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -638,7 +643,7 @@ void parse_params(int argc, char *argv[])
case 37: /* hostlist-exclude */ case 37: /* hostlist-exclude */
if (!strlist_add(&params.hostlist_exclude_files, optarg)) if (!strlist_add(&params.hostlist_exclude_files, optarg))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
params.tamper = true; params.tamper = true;
@ -646,29 +651,29 @@ void parse_params(int argc, char *argv[])
case 38: /* hostlist-auto */ case 38: /* hostlist-auto */
if (*params.hostlist_auto_filename) if (*params.hostlist_auto_filename)
{ {
fprintf(stderr, "only one auto hostlist is supported\n"); DLOG_ERR("only one auto hostlist is supported\n");
exit_clean(1); exit_clean(1);
} }
{ {
FILE *F = fopen(optarg,"a+t"); FILE *F = fopen(optarg,"a+t");
if (!F) if (!F)
{ {
fprintf(stderr, "cannot create %s\n", optarg); DLOG_ERR("cannot create %s\n", optarg);
exit_clean(1); exit_clean(1);
} }
bool bGzip = is_gzip(F); bool bGzip = is_gzip(F);
fclose(F); fclose(F);
if (bGzip) if (bGzip)
{ {
fprintf(stderr, "gzipped auto hostlists are not supported\n"); DLOG_ERR("gzipped auto hostlists are not supported\n");
exit_clean(1); exit_clean(1);
} }
if (params.droproot && chown(optarg, params.uid, -1)) if (params.droproot && chown(optarg, params.uid, -1))
fprintf(stderr, "could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg); DLOG_ERR("could not chown %s. auto hostlist file may not be writable after privilege drop\n", optarg);
} }
if (!strlist_add(&params.hostlist_files, optarg)) if (!strlist_add(&params.hostlist_files, optarg))
{ {
fprintf(stderr, "strlist_add failed\n"); DLOG_ERR("strlist_add failed\n");
exit_clean(1); exit_clean(1);
} }
strncpy(params.hostlist_auto_filename, optarg, sizeof(params.hostlist_auto_filename)); strncpy(params.hostlist_auto_filename, optarg, sizeof(params.hostlist_auto_filename));
@ -679,7 +684,7 @@ void parse_params(int argc, char *argv[])
params.hostlist_auto_fail_threshold = (uint8_t)atoi(optarg); params.hostlist_auto_fail_threshold = (uint8_t)atoi(optarg);
if (params.hostlist_auto_fail_threshold<1 || params.hostlist_auto_fail_threshold>20) if (params.hostlist_auto_fail_threshold<1 || params.hostlist_auto_fail_threshold>20)
{ {
fprintf(stderr, "auto hostlist fail threshold must be within 1..20\n"); DLOG_ERR("auto hostlist fail threshold must be within 1..20\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -687,7 +692,7 @@ void parse_params(int argc, char *argv[])
params.hostlist_auto_fail_time = (uint8_t)atoi(optarg); params.hostlist_auto_fail_time = (uint8_t)atoi(optarg);
if (params.hostlist_auto_fail_time<1) if (params.hostlist_auto_fail_time<1)
{ {
fprintf(stderr, "auto hostlist fail time is not valid\n"); DLOG_ERR("auto hostlist fail time is not valid\n");
exit_clean(1); exit_clean(1);
} }
break; break;
@ -696,12 +701,12 @@ void parse_params(int argc, char *argv[])
FILE *F = fopen(optarg,"a+t"); FILE *F = fopen(optarg,"a+t");
if (!F) if (!F)
{ {
fprintf(stderr, "cannot create %s\n", optarg); DLOG_ERR("cannot create %s\n", optarg);
exit_clean(1); exit_clean(1);
} }
fclose(F); fclose(F);
if (params.droproot && chown(optarg, params.uid, -1)) if (params.droproot && chown(optarg, params.uid, -1))
fprintf(stderr, "could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg); DLOG_ERR("could not chown %s. auto hostlist debug log may not be writable after privilege drop\n", optarg);
strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog)); strncpy(params.hostlist_auto_debuglog, optarg, sizeof(params.hostlist_auto_debuglog));
params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0'; params.hostlist_auto_debuglog[sizeof(params.hostlist_auto_debuglog) - 1] = '\0';
} }
@ -710,55 +715,91 @@ void parse_params(int argc, char *argv[])
strncpy(params.pidfile,optarg,sizeof(params.pidfile)); strncpy(params.pidfile,optarg,sizeof(params.pidfile));
params.pidfile[sizeof(params.pidfile)-1]='\0'; params.pidfile[sizeof(params.pidfile)-1]='\0';
break; break;
case 43: case 43: /* debug */
params.debug = optarg ? atoi(optarg) : 1; if (optarg)
{
if (*optarg=='@')
{
strncpy(params.debug_logfile,optarg+1,sizeof(params.debug_logfile));
params.debug_logfile[sizeof(params.debug_logfile)-1] = 0;
FILE *F = fopen(params.debug_logfile,"wt");
if (!F)
{
fprintf(stderr, "cannot create %s\n", params.debug_logfile);
exit_clean(1);
}
if (params.droproot && chown(params.debug_logfile, params.uid, -1))
fprintf(stderr, "could not chown %s. log file may not be writable after privilege drop\n", params.debug_logfile);
params.debug = 1;
params.debug_target = LOG_TARGET_FILE;
}
else if (!strcmp(optarg,"syslog"))
{
params.debug = 1;
params.debug_target = LOG_TARGET_SYSLOG;
openlog("tpws",LOG_PID,LOG_USER);
}
else
{
params.debug = atoi(optarg);
params.debug_target = LOG_TARGET_CONSOLE;
}
}
else
{
params.debug = 1;
params.debug_target = LOG_TARGET_CONSOLE;
}
break; break;
case 44: /* local-rcvbuf */ case 44: /* debug-level */
params.debug = atoi(optarg);
break;
case 45: /* local-rcvbuf */
#ifdef __linux__ #ifdef __linux__
params.local_rcvbuf = atoi(optarg)/2; params.local_rcvbuf = atoi(optarg)/2;
#else #else
params.local_rcvbuf = atoi(optarg); params.local_rcvbuf = atoi(optarg);
#endif #endif
break; break;
case 45: /* local-sndbuf */ case 46: /* local-sndbuf */
#ifdef __linux__ #ifdef __linux__
params.local_sndbuf = atoi(optarg)/2; params.local_sndbuf = atoi(optarg)/2;
#else #else
params.local_sndbuf = atoi(optarg); params.local_sndbuf = atoi(optarg);
#endif #endif
break; break;
case 46: /* remote-rcvbuf */ case 47: /* remote-rcvbuf */
#ifdef __linux__ #ifdef __linux__
params.remote_rcvbuf = atoi(optarg)/2; params.remote_rcvbuf = atoi(optarg)/2;
#else #else
params.remote_rcvbuf = atoi(optarg); params.remote_rcvbuf = atoi(optarg);
#endif #endif
break; break;
case 47: /* remote-sndbuf */ case 48: /* remote-sndbuf */
#ifdef __linux__ #ifdef __linux__
params.remote_sndbuf = atoi(optarg)/2; params.remote_sndbuf = atoi(optarg)/2;
#else #else
params.remote_sndbuf = atoi(optarg); params.remote_sndbuf = atoi(optarg);
#endif #endif
break; break;
case 48: /* socks */ case 49: /* socks */
params.proxy_type = CONN_TYPE_SOCKS; params.proxy_type = CONN_TYPE_SOCKS;
break; break;
case 49: /* no-resolve */ case 50: /* no-resolve */
params.no_resolve = true; params.no_resolve = true;
break; break;
case 50: /* resolver-threads */ case 51: /* resolver-threads */
params.resolver_threads = atoi(optarg); params.resolver_threads = atoi(optarg);
if (params.resolver_threads<1 || params.resolver_threads>300) if (params.resolver_threads<1 || params.resolver_threads>300)
{ {
fprintf(stderr, "resolver-threads must be within 1..300\n"); DLOG_ERR("resolver-threads must be within 1..300\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 51: /* skip-nodelay */ case 52: /* skip-nodelay */
params.skip_nodelay = true; params.skip_nodelay = true;
break; break;
case 52: /* tamper-start */ case 53: /* tamper-start */
{ {
const char *p=optarg; const char *p=optarg;
if (*p=='n') if (*p=='n')
@ -771,7 +812,7 @@ void parse_params(int argc, char *argv[])
params.tamper_start = atoi(p); params.tamper_start = atoi(p);
} }
break; break;
case 53: /* tamper-cutoff */ case 54: /* tamper-cutoff */
{ {
const char *p=optarg; const char *p=optarg;
if (*p=='n') if (*p=='n')
@ -784,29 +825,55 @@ void parse_params(int argc, char *argv[])
params.tamper_cutoff = atoi(p); params.tamper_cutoff = atoi(p);
} }
break; break;
case 55: /* connect-bind-addr */
{
char *p = strchr(optarg,'%');
if (p) *p++=0;
if (inet_pton(AF_INET, optarg, &params.connect_bind4.sin_addr))
{
params.connect_bind4.sin_family = AF_INET;
}
else if (inet_pton(AF_INET6, optarg, &params.connect_bind6.sin6_addr))
{
params.connect_bind6.sin6_family = AF_INET6;
if (p && *p)
{
// copy interface name for delayed resolution
strncpy(params.connect_bind6_ifname,p,sizeof(params.connect_bind6_ifname));
params.connect_bind6_ifname[sizeof(params.connect_bind6_ifname)-1]=0;
}
}
else
{
DLOG_ERR("bad bind addr : %s\n", optarg);
exit_clean(1);
}
}
break;
#if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__) #if defined(BSD) && !defined(__OpenBSD__) && !defined(__APPLE__)
case 54: /* enable-pf */ case 56: /* enable-pf */
params.pf_enable = true; params.pf_enable = true;
break; break;
#elif defined(__linux__) #elif defined(__linux__)
case 54: /* mss */ case 56: /* mss */
// this option does not work in any BSD and MacOS. OS may accept but it changes nothing // this option does not work in any BSD and MacOS. OS may accept but it changes nothing
params.mss = atoi(optarg); params.mss = atoi(optarg);
if (params.mss<88 || params.mss>32767) if (params.mss<88 || params.mss>32767)
{ {
fprintf(stderr, "Invalid value for MSS. Linux accepts MSS 88-32767.\n"); DLOG_ERR("Invalid value for MSS. Linux accepts MSS 88-32767.\n");
exit_clean(1); exit_clean(1);
} }
break; break;
case 55: /* mss-pf */ case 57: /* mss-pf */
if (!pf_parse(optarg,&params.mss_pf)) if (!pf_parse(optarg,&params.mss_pf))
{ {
fprintf(stderr, "Invalid MSS port filter.\n"); DLOG_ERR("Invalid MSS port filter.\n");
exit_clean(1); exit_clean(1);
} }
break; break;
#ifdef SPLICE_PRESENT #ifdef SPLICE_PRESENT
case 56: /* nosplice */ case 58: /* nosplice */
params.nosplice = true; params.nosplice = true;
break; break;
#endif #endif
@ -815,7 +882,7 @@ void parse_params(int argc, char *argv[])
} }
if (!params.bind_wait_only && !params.port) if (!params.bind_wait_only && !params.port)
{ {
fprintf(stderr, "Need port number\n"); DLOG_ERR("Need port number\n");
exit_clean(1); exit_clean(1);
} }
if (params.binds_last<=0) if (params.binds_last<=0)
@ -824,7 +891,7 @@ void parse_params(int argc, char *argv[])
} }
if (params.skip_nodelay && (params.split_http_req || params.split_pos)) if (params.skip_nodelay && (params.split_http_req || params.split_pos))
{ {
fprintf(stderr, "Cannot split with --skip-nodelay\n"); DLOG_ERR("Cannot split with --skip-nodelay\n");
exit_clean(1); exit_clean(1);
} }
if (!params.resolver_threads) params.resolver_threads = 5 + params.maxconn/50; if (!params.resolver_threads) params.resolver_threads = 5 + params.maxconn/50;
@ -834,13 +901,13 @@ void parse_params(int argc, char *argv[])
if (*params.hostlist_auto_filename) params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename); if (*params.hostlist_auto_filename) params.hostlist_auto_mod_time = file_mod_time(params.hostlist_auto_filename);
if (!LoadIncludeHostLists()) if (!LoadIncludeHostLists())
{ {
fprintf(stderr, "Include hostlist load failed\n"); DLOG_ERR("Include hostlist load failed\n");
exit_clean(1); exit_clean(1);
} }
if (*params.hostlist_auto_filename) NonEmptyHostlist(&params.hostlist); if (*params.hostlist_auto_filename) NonEmptyHostlist(&params.hostlist);
if (!LoadExcludeHostLists()) if (!LoadExcludeHostLists())
{ {
fprintf(stderr, "Exclude hostlist load failed\n"); DLOG_ERR("Exclude hostlist load failed\n");
exit_clean(1); exit_clean(1);
} }
} }
@ -963,24 +1030,24 @@ static bool set_ulimit(void)
else else
fdmax = params.maxfiles; fdmax = params.maxfiles;
fdmin_system = fdmax + 4096; fdmin_system = fdmax + 4096;
DBGPRINT("set_ulimit : fdmax=%ju fdmin_system=%ju",(uintmax_t)fdmax,(uintmax_t)fdmin_system) DBGPRINT("set_ulimit : fdmax=%ju fdmin_system=%ju\n",(uintmax_t)fdmax,(uintmax_t)fdmin_system);
if (!read_system_maxfiles(&cur_lim)) if (!read_system_maxfiles(&cur_lim))
return false; return false;
DBGPRINT("set_ulimit : current system file-max=%ju",(uintmax_t)cur_lim) DBGPRINT("set_ulimit : current system file-max=%ju\n",(uintmax_t)cur_lim);
if (cur_lim<fdmin_system) if (cur_lim<fdmin_system)
{ {
DBGPRINT("set_ulimit : system fd limit is too low. trying to increase to %ju",(uintmax_t)fdmin_system) DBGPRINT("set_ulimit : system fd limit is too low. trying to increase to %ju\n",(uintmax_t)fdmin_system);
if (!write_system_maxfiles(fdmin_system)) if (!write_system_maxfiles(fdmin_system))
{ {
fprintf(stderr,"could not set system-wide max file descriptors\n"); DLOG_ERR("could not set system-wide max file descriptors\n");
return false; return false;
} }
} }
struct rlimit rlim = {fdmax,fdmax}; struct rlimit rlim = {fdmax,fdmax};
n=setrlimit(RLIMIT_NOFILE, &rlim); n=setrlimit(RLIMIT_NOFILE, &rlim);
if (n==-1) perror("setrlimit"); if (n==-1) DLOG_PERROR("setrlimit");
return n!=-1; return n!=-1;
} }
@ -1005,7 +1072,7 @@ int main(int argc, char *argv[])
if (*params.pidfile && !writepid(params.pidfile)) if (*params.pidfile && !writepid(params.pidfile))
{ {
fprintf(stderr,"could not write pidfile\n"); DLOG_ERR("could not write pidfile\n");
goto exiterr; goto exiterr;
} }
@ -1014,7 +1081,7 @@ int main(int argc, char *argv[])
for(i=0;i<=params.binds_last;i++) for(i=0;i<=params.binds_last;i++)
{ {
VPRINT("Prepare bind %d : addr=%s iface=%s v6=%u link_local=%s wait_ifup=%d wait_ip=%d wait_ip_ll=%d",i, VPRINT("Prepare bind %d : addr=%s iface=%s v6=%u link_local=%s wait_ifup=%d wait_ip=%d wait_ip_ll=%d\n",i,
params.binds[i].bindaddr,params.binds[i].bindiface,params.binds[i].bind_if6,bindll_s[params.binds[i].bindll], params.binds[i].bindaddr,params.binds[i].bindiface,params.binds[i].bind_if6,bindll_s[params.binds[i].bindll],
params.binds[i].bind_wait_ifup,params.binds[i].bind_wait_ip,params.binds[i].bind_wait_ip_ll); params.binds[i].bind_wait_ifup,params.binds[i].bind_wait_ip,params.binds[i].bind_wait_ip_ll);
if_index=0; if_index=0;
@ -1025,7 +1092,7 @@ int main(int argc, char *argv[])
int sec=0; int sec=0;
if (!is_interface_online(params.binds[i].bindiface)) if (!is_interface_online(params.binds[i].bindiface))
{ {
printf("waiting for ifup of %s for up to %d second(s)...\n",params.binds[i].bindiface,params.binds[i].bind_wait_ifup); DLOG_CONDUP("waiting for ifup of %s for up to %d second(s)...\n",params.binds[i].bindiface,params.binds[i].bind_wait_ifup);
do do
{ {
sleep(1); sleep(1);
@ -1034,14 +1101,14 @@ int main(int argc, char *argv[])
while (!is_interface_online(params.binds[i].bindiface) && sec<params.binds[i].bind_wait_ifup); while (!is_interface_online(params.binds[i].bindiface) && sec<params.binds[i].bind_wait_ifup);
if (sec>=params.binds[i].bind_wait_ifup) if (sec>=params.binds[i].bind_wait_ifup)
{ {
printf("wait timed out\n"); DLOG_CONDUP("wait timed out\n");
goto exiterr; goto exiterr;
} }
} }
} }
if (!(if_index = if_nametoindex(params.binds[i].bindiface)) && params.binds[i].bind_wait_ip<=0) if (!(if_index = if_nametoindex(params.binds[i].bindiface)) && params.binds[i].bind_wait_ip<=0)
{ {
printf("bad iface %s\n",params.binds[i].bindiface); DLOG_CONDUP("bad iface %s\n",params.binds[i].bindiface);
goto exiterr; goto exiterr;
} }
} }
@ -1059,7 +1126,7 @@ int main(int argc, char *argv[])
} }
else else
{ {
printf("bad bind addr : %s\n", params.binds[i].bindaddr); DLOG_CONDUP("bad bind addr : %s\n", params.binds[i].bindaddr);
goto exiterr; goto exiterr;
} }
} }
@ -1073,13 +1140,13 @@ int main(int argc, char *argv[])
if (params.binds[i].bind_wait_ip > 0) if (params.binds[i].bind_wait_ip > 0)
{ {
printf("waiting for ip on %s for up to %d second(s)...\n", *params.binds[i].bindiface ? params.binds[i].bindiface : "<any>", params.binds[i].bind_wait_ip); DLOG_CONDUP("waiting for ip on %s for up to %d second(s)...\n", *params.binds[i].bindiface ? params.binds[i].bindiface : "<any>", params.binds[i].bind_wait_ip);
if (params.binds[i].bind_wait_ip_ll>0) if (params.binds[i].bind_wait_ip_ll>0)
{ {
if (params.binds[i].bindll==prefer) if (params.binds[i].bindll==prefer)
printf("during the first %d second(s) accepting only link locals...\n", params.binds[i].bind_wait_ip_ll); DLOG_CONDUP("during the first %d second(s) accepting only link locals...\n", params.binds[i].bind_wait_ip_ll);
else if (params.binds[i].bindll==unwanted) else if (params.binds[i].bindll==unwanted)
printf("during the first %d second(s) accepting only ipv6 globals...\n", params.binds[i].bind_wait_ip_ll); DLOG_CONDUP("during the first %d second(s) accepting only ipv6 globals...\n", params.binds[i].bind_wait_ip_ll);
} }
} }
@ -1092,9 +1159,9 @@ int main(int argc, char *argv[])
if (sec && sec==params.binds[i].bind_wait_ip_ll) if (sec && sec==params.binds[i].bind_wait_ip_ll)
{ {
if (params.binds[i].bindll==prefer) if (params.binds[i].bindll==prefer)
printf("link local address wait timeout. now accepting globals\n"); DLOG_CONDUP("link local address wait timeout. now accepting globals\n");
else if (params.binds[i].bindll==unwanted) else if (params.binds[i].bindll==unwanted)
printf("global ipv6 address wait timeout. now accepting link locals\n"); DLOG_CONDUP("global ipv6 address wait timeout. now accepting link locals\n");
} }
found = find_listen_addr(&list[i].salisten,params.binds[i].bindiface,params.binds[i].bind_if6,bindll_1,&if_index); found = find_listen_addr(&list[i].salisten,params.binds[i].bindiface,params.binds[i].bind_if6,bindll_1,&if_index);
if (found) break; if (found) break;
@ -1108,7 +1175,7 @@ int main(int argc, char *argv[])
if (!found) if (!found)
{ {
printf("suitable ip address not found\n"); DLOG_CONDUP("suitable ip address not found\n");
goto exiterr; goto exiterr;
} }
list[i].bind_wait_ip_left = params.binds[i].bind_wait_ip - sec; list[i].bind_wait_ip_left = params.binds[i].bind_wait_ip - sec;
@ -1136,14 +1203,14 @@ int main(int argc, char *argv[])
if (params.bind_wait_only) if (params.bind_wait_only)
{ {
printf("bind wait condition satisfied\n"); DLOG_CONDUP("bind wait condition satisfied\n");
exit_v = 0; exit_v = 0;
goto exiterr; goto exiterr;
} }
if (params.proxy_type==CONN_TYPE_TRANSPARENT && !redir_init()) if (params.proxy_type==CONN_TYPE_TRANSPARENT && !redir_init())
{ {
fprintf(stderr,"could not initialize redirector !!!\n"); DLOG_ERR("could not initialize redirector !!!\n");
goto exiterr; goto exiterr;
} }
@ -1152,11 +1219,11 @@ int main(int argc, char *argv[])
if (params.debug) if (params.debug)
{ {
ntop46_port((struct sockaddr *)&list[i].salisten, ip_port, sizeof(ip_port)); ntop46_port((struct sockaddr *)&list[i].salisten, ip_port, sizeof(ip_port));
VPRINT("Binding %d to %s",i,ip_port); VPRINT("Binding %d to %s\n",i,ip_port);
} }
if ((listen_fd[i] = socket(list[i].salisten.ss_family, SOCK_STREAM, 0)) == -1) { if ((listen_fd[i] = socket(list[i].salisten.ss_family, SOCK_STREAM, 0)) == -1) {
perror("socket"); DLOG_PERROR("socket");
goto exiterr; goto exiterr;
} }
@ -1164,14 +1231,14 @@ int main(int argc, char *argv[])
// in OpenBSD always IPV6_ONLY for wildcard sockets // in OpenBSD always IPV6_ONLY for wildcard sockets
if ((list[i].salisten.ss_family == AF_INET6) && setsockopt(listen_fd[i], IPPROTO_IPV6, IPV6_V6ONLY, &list[i].ipv6_only, sizeof(int)) == -1) if ((list[i].salisten.ss_family == AF_INET6) && setsockopt(listen_fd[i], IPPROTO_IPV6, IPV6_V6ONLY, &list[i].ipv6_only, sizeof(int)) == -1)
{ {
perror("setsockopt (IPV6_ONLY)"); DLOG_PERROR("setsockopt (IPV6_ONLY)");
goto exiterr; goto exiterr;
} }
#endif #endif
if (setsockopt(listen_fd[i], SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) == -1) if (setsockopt(listen_fd[i], SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) == -1)
{ {
perror("setsockopt (SO_REUSEADDR)"); DLOG_PERROR("setsockopt (SO_REUSEADDR)");
goto exiterr; goto exiterr;
} }
@ -1182,13 +1249,13 @@ int main(int argc, char *argv[])
#ifdef __linux__ #ifdef __linux__
if (setsockopt(listen_fd[i], SOL_IP, IP_TRANSPARENT, &yes, sizeof(yes)) == -1) if (setsockopt(listen_fd[i], SOL_IP, IP_TRANSPARENT, &yes, sizeof(yes)) == -1)
{ {
perror("setsockopt (IP_TRANSPARENT)"); DLOG_PERROR("setsockopt (IP_TRANSPARENT)");
goto exiterr; goto exiterr;
} }
#elif defined(BSD) && defined(SO_BINDANY) #elif defined(BSD) && defined(SO_BINDANY)
if (setsockopt(listen_fd[i], SOL_SOCKET, SO_BINDANY, &yes, sizeof(yes)) == -1) if (setsockopt(listen_fd[i], SOL_SOCKET, SO_BINDANY, &yes, sizeof(yes)) == -1)
{ {
perror("setsockopt (SO_BINDANY)"); DLOG_PERROR("setsockopt (SO_BINDANY)");
goto exiterr; goto exiterr;
} }
#endif #endif
@ -1221,21 +1288,21 @@ int main(int argc, char *argv[])
if (!bBindBug) if (!bBindBug)
{ {
ntop46_port((struct sockaddr *)&list[i].salisten, ip_port, sizeof(ip_port)); ntop46_port((struct sockaddr *)&list[i].salisten, ip_port, sizeof(ip_port));
printf("address %s is not available. will retry for %d sec\n",ip_port,list[i].bind_wait_ip_left); DLOG_CONDUP("address %s is not available. will retry for %d sec\n",ip_port,list[i].bind_wait_ip_left);
bBindBug=true; bBindBug=true;
} }
sleep(1); sleep(1);
list[i].bind_wait_ip_left--; list[i].bind_wait_ip_left--;
continue; continue;
} }
perror("bind"); DLOG_PERROR("bind");
goto exiterr; goto exiterr;
} }
break; break;
} }
if (listen(listen_fd[i], BACKLOG) == -1) if (listen(listen_fd[i], BACKLOG) == -1)
{ {
perror("listen"); DLOG_PERROR("listen");
goto exiterr; goto exiterr;
} }
} }
@ -1250,19 +1317,19 @@ int main(int argc, char *argv[])
//example a socket) is closed during splice(). I would rather have splice() //example a socket) is closed during splice(). I would rather have splice()
//fail and return -1, so blocking SIGPIPE. //fail and return -1, so blocking SIGPIPE.
if (block_sigpipe() == -1) { if (block_sigpipe() == -1) {
fprintf(stderr, "Could not block SIGPIPE signal\n"); DLOG_ERR("Could not block SIGPIPE signal\n");
goto exiterr; goto exiterr;
} }
printf(params.proxy_type==CONN_TYPE_SOCKS ? "socks mode\n" : "transparent proxy mode\n"); DLOG_CONDUP(params.proxy_type==CONN_TYPE_SOCKS ? "socks mode\n" : "transparent proxy mode\n");
if (!params.tamper) printf("TCP proxy mode (no tampering)\n"); if (!params.tamper) DLOG_CONDUP("TCP proxy mode (no tampering)\n");
signal(SIGHUP, onhup); signal(SIGHUP, onhup);
signal(SIGUSR2, onusr2); signal(SIGUSR2, onusr2);
retval = event_loop(listen_fd,params.binds_last+1); retval = event_loop(listen_fd,params.binds_last+1);
exit_v = retval < 0 ? EXIT_FAILURE : EXIT_SUCCESS; exit_v = retval < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
printf("Exiting\n"); DLOG_CONDUP("Exiting\n");
exiterr: exiterr:
redir_close(); redir_close();

313
tpws/tpws_conn.c
View File

@ -40,7 +40,7 @@ static void count_legs(struct tailhead *conn_list)
*/ */
static void print_legs(void) static void print_legs(void)
{ {
VPRINT("Legs : local:%d remote:%d", legs_local, legs_remote) VPRINT("Legs : local:%d remote:%d\n", legs_local, legs_remote);
} }
@ -99,17 +99,17 @@ ssize_t send_with_ttl(int fd, const void *buf, size_t len, int flags, int ttl)
if (ttl) if (ttl)
{ {
DBGPRINT("send_with_ttl %d fd=%d",ttl,fd); DBGPRINT("send_with_ttl %d fd=%d\n",ttl,fd);
if (!set_ttl_hl(fd, ttl)) if (!set_ttl_hl(fd, ttl))
//fprintf(stderr,"could not set ttl %d to fd=%d\n",ttl,fd); //DLOG_ERR("could not set ttl %d to fd=%d\n",ttl,fd);
fprintf(stderr,"could not set ttl %d to fd=%d\n",ttl,fd); DLOG_ERR("could not set ttl %d to fd=%d\n",ttl,fd);
} }
wr = send(fd, buf, len, flags); wr = send(fd, buf, len, flags);
if (ttl) if (ttl)
{ {
int e=errno; int e=errno;
if (!set_ttl_hl(fd, params.ttl_default)) if (!set_ttl_hl(fd, params.ttl_default))
fprintf(stderr,"could not set ttl %d to fd=%d\n",params.ttl_default,fd); DLOG_ERR("could not set ttl %d to fd=%d\n",params.ttl_default,fd);
errno=e; errno=e;
} }
return wr; return wr;
@ -120,13 +120,13 @@ static bool send_buffer_create(send_buffer_t *sb, const void *data, size_t len,
{ {
if (sb->data) if (sb->data)
{ {
fprintf(stderr,"FATAL : send_buffer_create but buffer is not empty\n"); DLOG_ERR("FATAL : send_buffer_create but buffer is not empty\n");
exit(1); exit(1);
} }
sb->data = malloc(len + extra_bytes); sb->data = malloc(len + extra_bytes);
if (!sb->data) if (!sb->data)
{ {
DBGPRINT("send_buffer_create failed. errno=%d",errno) DBGPRINT("send_buffer_create failed\n");
return false; return false;
} }
if (data) memcpy(sb->data,data,len); if (data) memcpy(sb->data,data,len);
@ -144,12 +144,12 @@ static bool send_buffer_realloc(send_buffer_t *sb, size_t extra_bytes)
if (p) if (p)
{ {
sb->data = p; sb->data = p;
DBGPRINT("reallocated send_buffer from %zd to %zd", sb->len, sb->len + extra_bytes) DBGPRINT("reallocated send_buffer from %zd to %zd\n", sb->len, sb->len + extra_bytes);
return true; return true;
} }
else else
{ {
DBGPRINT("failed to realloc send_buffer from %zd to %zd", sb->len, sb->len + extra_bytes) DBGPRINT("failed to realloc send_buffer from %zd to %zd\n", sb->len, sb->len + extra_bytes);
} }
} }
return false; return false;
@ -188,7 +188,7 @@ static ssize_t send_buffer_send(send_buffer_t *sb, int fd)
ssize_t wr; ssize_t wr;
wr = send_with_ttl(fd, sb->data + sb->pos, sb->len - sb->pos, sb->flags, sb->ttl); wr = send_with_ttl(fd, sb->data + sb->pos, sb->len - sb->pos, sb->flags, sb->ttl);
DBGPRINT("send_buffer_send len=%zu pos=%zu wr=%zd err=%d",sb->len,sb->pos,wr,errno) DBGPRINT("send_buffer_send len=%zu pos=%zu wr=%zd err=%d\n",sb->len,sb->pos,wr,errno);
if (wr>0) if (wr>0)
{ {
sb->pos += wr; sb->pos += wr;
@ -210,7 +210,7 @@ static ssize_t send_buffers_send(send_buffer_t *sb_array, int count, int fd, siz
if (send_buffer_present(sb_array+i)) if (send_buffer_present(sb_array+i))
{ {
wr = send_buffer_send(sb_array+i, fd); wr = send_buffer_send(sb_array+i, fd);
DBGPRINT("send_buffers_send(%d) wr=%zd err=%d",i,wr,errno) DBGPRINT("send_buffers_send(%d) wr=%zd err=%d\n",i,wr,errno);
if (wr<0) if (wr<0)
{ {
if (real_wr) *real_wr = twr; if (real_wr) *real_wr = twr;
@ -285,25 +285,25 @@ static void dbgprint_socket_buffers(int fd)
socklen_t sz; socklen_t sz;
sz=sizeof(int); sz=sizeof(int);
if (!getsockopt(fd,SOL_SOCKET,SO_RCVBUF,&v,&sz)) if (!getsockopt(fd,SOL_SOCKET,SO_RCVBUF,&v,&sz))
DBGPRINT("fd=%d SO_RCVBUF=%d",fd,v) DBGPRINT("fd=%d SO_RCVBUF=%d\n",fd,v);
sz=sizeof(int); sz=sizeof(int);
if (!getsockopt(fd,SOL_SOCKET,SO_SNDBUF,&v,&sz)) if (!getsockopt(fd,SOL_SOCKET,SO_SNDBUF,&v,&sz))
DBGPRINT("fd=%d SO_SNDBUF=%d",fd,v) DBGPRINT("fd=%d SO_SNDBUF=%d\n",fd,v);
} }
} }
bool set_socket_buffers(int fd, int rcvbuf, int sndbuf) bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
{ {
DBGPRINT("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d",fd,rcvbuf,sndbuf) DBGPRINT("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n",fd,rcvbuf,sndbuf);
if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) <0) if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) <0)
{ {
perror("setsockopt (SO_RCVBUF)"); DLOG_PERROR("setsockopt (SO_RCVBUF)");
close(fd); close(fd);
return false; return false;
} }
if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) <0) if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) <0)
{ {
perror("setsockopt (SO_SNDBUF)"); DLOG_PERROR("setsockopt (SO_SNDBUF)");
close(fd); close(fd);
return false; return false;
} }
@ -324,7 +324,7 @@ static bool proxy_remote_conn_ack(tproxy_conn_t *conn, int sock_err)
{ {
conn->partner->socks_state=S_TCP; conn->partner->socks_state=S_TCP;
bres = socks_send_rep_errno(conn->partner->socks_ver,conn->partner->fd,sock_err); bres = socks_send_rep_errno(conn->partner->socks_ver,conn->partner->fd,sock_err);
DBGPRINT("socks connection acknowledgement. bres=%d remote_errn=%d remote_fd=%d local_fd=%d",bres,sock_err,conn->fd,conn->partner->fd) DBGPRINT("socks connection acknowledgement. bres=%d remote_errn=%d remote_fd=%d local_fd=%d\n",bres,sock_err,conn->fd,conn->partner->fd);
} }
break; break;
} }
@ -341,20 +341,20 @@ static int connect_remote(const struct sockaddr *remote_addr, bool bApplyConnect
if((remote_fd = socket(remote_addr->sa_family, SOCK_STREAM, 0)) < 0) if((remote_fd = socket(remote_addr->sa_family, SOCK_STREAM, 0)) < 0)
{ {
perror("socket (connect_remote)"); DLOG_PERROR("socket (connect_remote)");
return -1; return -1;
} }
// Use NONBLOCK to avoid slow connects affecting the performance of other connections // Use NONBLOCK to avoid slow connects affecting the performance of other connections
// separate fcntl call to comply with macos // separate fcntl call to comply with macos
if (fcntl(remote_fd, F_SETFL, O_NONBLOCK)<0) if (fcntl(remote_fd, F_SETFL, O_NONBLOCK)<0)
{ {
perror("socket set O_NONBLOCK (connect_remote)"); DLOG_PERROR("socket set O_NONBLOCK (connect_remote)");
close(remote_fd); close(remote_fd);
return -1; return -1;
} }
if (setsockopt(remote_fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0) if (setsockopt(remote_fd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes)) < 0)
{ {
perror("setsockopt (SO_REUSEADDR, connect_remote)"); DLOG_PERROR("setsockopt (SO_REUSEADDR, connect_remote)");
close(remote_fd); close(remote_fd);
return -1; return -1;
} }
@ -362,13 +362,13 @@ static int connect_remote(const struct sockaddr *remote_addr, bool bApplyConnect
return -1; return -1;
if (!set_keepalive(remote_fd)) if (!set_keepalive(remote_fd))
{ {
perror("set_keepalive"); DLOG_PERROR("set_keepalive");
close(remote_fd); close(remote_fd);
return -1; return -1;
} }
if (setsockopt(remote_fd, IPPROTO_TCP, TCP_NODELAY, params.skip_nodelay ? &no : &yes, sizeof(int)) <0) if (setsockopt(remote_fd, IPPROTO_TCP, TCP_NODELAY, params.skip_nodelay ? &no : &yes, sizeof(int)) <0)
{ {
perror("setsockopt (TCP_NODELAY, connect_remote)"); DLOG_PERROR("setsockopt (TCP_NODELAY, connect_remote)");
close(remote_fd); close(remote_fd);
return -1; return -1;
} }
@ -377,29 +377,61 @@ static int connect_remote(const struct sockaddr *remote_addr, bool bApplyConnect
uint16_t port = saport(remote_addr); uint16_t port = saport(remote_addr);
if (pf_in_range(port,&params.mss_pf)) if (pf_in_range(port,&params.mss_pf))
{ {
VPRINT("Setting MSS %d",params.mss) VPRINT("Setting MSS %d\n",params.mss);
if (setsockopt(remote_fd, IPPROTO_TCP, TCP_MAXSEG, &params.mss, sizeof(int)) <0) if (setsockopt(remote_fd, IPPROTO_TCP, TCP_MAXSEG, &params.mss, sizeof(int)) <0)
{ {
perror("setsockopt (TCP_MAXSEG, connect_remote)"); DLOG_PERROR("setsockopt (TCP_MAXSEG, connect_remote)");
close(remote_fd); close(remote_fd);
return -1; return -1;
} }
} }
else else
{ {
VPRINT("Not setting MSS. Port %u is out of MSS port range.",port) VPRINT("Not setting MSS. Port %u is out of MSS port range.\n",port);
} }
} }
if (connect(remote_fd, remote_addr, remote_addr->sa_family == AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)) < 0)
// if no bind address specified - address family will be 0 in params_connect_bindX
if(remote_addr->sa_family == params.connect_bind4.sin_family)
{ {
if(errno != EINPROGRESS) if (bind(remote_fd, (struct sockaddr *)&params.connect_bind4, sizeof(struct sockaddr_in)) == -1)
{ {
perror("connect (connect_remote)"); DLOG_PERROR("bind on connect");
close(remote_fd); close(remote_fd);
return -1; return -1;
} }
} }
DBGPRINT("Connecting remote fd=%d",remote_fd) else if(remote_addr->sa_family == params.connect_bind6.sin6_family)
{
if (*params.connect_bind6_ifname && !params.connect_bind6.sin6_scope_id)
{
params.connect_bind6.sin6_scope_id=if_nametoindex(params.connect_bind6_ifname);
if (!params.connect_bind6.sin6_scope_id)
{
DLOG_ERR("interface name not found : %s\n", params.connect_bind6_ifname);
close(remote_fd);
return -1;
}
}
if (bind(remote_fd, (struct sockaddr *)&params.connect_bind6, sizeof(struct sockaddr_in6)) == -1)
{
DLOG_PERROR("bind on connect");
close(remote_fd);
return -1;
}
}
if (connect(remote_fd, remote_addr, remote_addr->sa_family == AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)) < 0)
{
if(errno != EINPROGRESS)
{
DLOG_PERROR("connect (connect_remote)");
close(remote_fd);
return -1;
}
}
DBGPRINT("Connecting remote fd=%d\n",remote_fd);
return remote_fd; return remote_fd;
} }
@ -428,7 +460,7 @@ static tproxy_conn_t *new_conn(int fd, bool remote)
//Create connection object and fill in information //Create connection object and fill in information
if((conn = (tproxy_conn_t*) malloc(sizeof(tproxy_conn_t))) == NULL) if((conn = (tproxy_conn_t*) malloc(sizeof(tproxy_conn_t))) == NULL)
{ {
fprintf(stderr, "Could not allocate memory for connection\n"); DLOG_ERR("Could not allocate memory for connection\n");
return NULL; return NULL;
} }
@ -442,7 +474,7 @@ static tproxy_conn_t *new_conn(int fd, bool remote)
// otherwise create pipe only in local leg // otherwise create pipe only in local leg
if (!params.nosplice && ( !remote || !params.tamper || params.tamper_start || params.tamper_cutoff ) && pipe2(conn->splice_pipe, O_NONBLOCK) != 0) if (!params.nosplice && ( !remote || !params.tamper || params.tamper_start || params.tamper_cutoff ) && pipe2(conn->splice_pipe, O_NONBLOCK) != 0)
{ {
fprintf(stderr, "Could not create the splice pipe\n"); DLOG_ERR("Could not create the splice pipe\n");
free_conn(conn); free_conn(conn);
return NULL; return NULL;
} }
@ -458,11 +490,11 @@ static bool epoll_set(tproxy_conn_t *conn, uint32_t events)
memset(&ev, 0, sizeof(ev)); memset(&ev, 0, sizeof(ev));
ev.events = events; ev.events = events;
ev.data.ptr = (void*) conn; ev.data.ptr = (void*) conn;
DBGPRINT("epoll_set fd=%d events=%08X",conn->fd,events); DBGPRINT("epoll_set fd=%d events=%08X\n",conn->fd,events);
if(epoll_ctl(conn->efd, EPOLL_CTL_MOD, conn->fd, &ev)==-1 && if(epoll_ctl(conn->efd, EPOLL_CTL_MOD, conn->fd, &ev)==-1 &&
epoll_ctl(conn->efd, EPOLL_CTL_ADD, conn->fd, &ev)==-1) epoll_ctl(conn->efd, EPOLL_CTL_ADD, conn->fd, &ev)==-1)
{ {
perror("epoll_ctl (add/mod)"); DLOG_PERROR("epoll_ctl (add/mod)");
return false; return false;
} }
return true; return true;
@ -473,10 +505,10 @@ static bool epoll_del(tproxy_conn_t *conn)
memset(&ev, 0, sizeof(ev)); memset(&ev, 0, sizeof(ev));
DBGPRINT("epoll_del fd=%d",conn->fd); DBGPRINT("epoll_del fd=%d\n",conn->fd);
if(epoll_ctl(conn->efd, EPOLL_CTL_DEL, conn->fd, &ev)==-1) if(epoll_ctl(conn->efd, EPOLL_CTL_DEL, conn->fd, &ev)==-1)
{ {
perror("epoll_ctl (del)"); DLOG_PERROR("epoll_ctl (del)");
return false; return false;
} }
return true; return true;
@ -489,7 +521,7 @@ static bool epoll_update_flow(tproxy_conn_t *conn)
uint32_t evtmask = (conn->state==CONN_RDHUP ? 0 : EPOLLRDHUP)|(conn->bFlowIn?EPOLLIN:0)|(conn->bFlowOut?EPOLLOUT:0); uint32_t evtmask = (conn->state==CONN_RDHUP ? 0 : EPOLLRDHUP)|(conn->bFlowIn?EPOLLIN:0)|(conn->bFlowOut?EPOLLOUT:0);
if (!epoll_set(conn, evtmask)) if (!epoll_set(conn, evtmask))
return false; return false;
DBGPRINT("SET FLOW fd=%d to in=%d out=%d state_rdhup=%d",conn->fd,conn->bFlowIn,conn->bFlowOut,conn->state==CONN_RDHUP) DBGPRINT("SET FLOW fd=%d to in=%d out=%d state_rdhup=%d\n",conn->fd,conn->bFlowIn,conn->bFlowOut,conn->state==CONN_RDHUP);
conn->bFlowInPrev = conn->bFlowIn; conn->bFlowInPrev = conn->bFlowIn;
conn->bFlowOutPrev = conn->bFlowOut; conn->bFlowOutPrev = conn->bFlowOut;
conn->bPrevRdhup = (conn->state==CONN_RDHUP); conn->bPrevRdhup = (conn->state==CONN_RDHUP);
@ -514,13 +546,13 @@ static tproxy_conn_t* add_tcp_connection(int efd, struct tailhead *conn_list,int
{ {
if(!get_dest_addr(local_fd, accept_sa, &orig_dst)) if(!get_dest_addr(local_fd, accept_sa, &orig_dst))
{ {
fprintf(stderr, "Could not get destination address\n"); DLOG_ERR("Could not get destination address\n");
close(local_fd); close(local_fd);
return NULL; return NULL;
} }
if (check_local_ip((struct sockaddr*)&orig_dst) && saport((struct sockaddr*)&orig_dst)==listen_port) if (check_local_ip((struct sockaddr*)&orig_dst) && saport((struct sockaddr*)&orig_dst)==listen_port)
{ {
VPRINT("Dropping connection to local address to the same port to avoid loop") VPRINT("Dropping connection to local address to the same port to avoid loop\n");
close(local_fd); close(local_fd);
return NULL; return NULL;
} }
@ -531,7 +563,7 @@ static tproxy_conn_t* add_tcp_connection(int efd, struct tailhead *conn_list,int
if(!set_keepalive(local_fd)) if(!set_keepalive(local_fd))
{ {
perror("set_keepalive"); DLOG_PERROR("set_keepalive");
close(local_fd); close(local_fd);
return 0; return 0;
} }
@ -540,7 +572,7 @@ static tproxy_conn_t* add_tcp_connection(int efd, struct tailhead *conn_list,int
{ {
if ((remote_fd = connect_remote((struct sockaddr *)&orig_dst, true)) < 0) if ((remote_fd = connect_remote((struct sockaddr *)&orig_dst, true)) < 0)
{ {
fprintf(stderr, "Failed to connect\n"); DLOG_ERR("Failed to connect\n");
close(local_fd); close(local_fd);
return NULL; return NULL;
} }
@ -619,12 +651,23 @@ static bool check_connection_attempt(tproxy_conn_t *conn, int efd)
// check the connection was sucessfull. it means its not in in SO_ERROR state // check the connection was sucessfull. it means its not in in SO_ERROR state
if(getsockopt(conn->fd, SOL_SOCKET, SO_ERROR, &errn, &optlen) == -1) if(getsockopt(conn->fd, SOL_SOCKET, SO_ERROR, &errn, &optlen) == -1)
{ {
perror("getsockopt (SO_ERROR)"); DLOG_PERROR("getsockopt (SO_ERROR)");
return false; return false;
} }
if (!errn) if (!errn)
{ {
VPRINT("Socket fd=%d (remote) connected", conn->fd) if (params.debug>=1)
{
struct sockaddr_storage sa;
socklen_t salen=sizeof(sa);
char ip_port[48];
if (getsockname(conn->fd,(struct sockaddr *)&sa,&salen))
*ip_port=0;
else
ntop46_port((struct sockaddr*)&sa,ip_port,sizeof(ip_port));
VPRINT("Socket fd=%d (remote) connected from : %s\n", conn->fd, ip_port);
}
if (!epoll_set_flow(conn, true, false) || (conn_partner_alive(conn) && !epoll_set_flow(conn->partner, true, false))) if (!epoll_set_flow(conn, true, false) || (conn_partner_alive(conn) && !epoll_set_flow(conn->partner, true, false)))
{ {
return false; return false;
@ -643,8 +686,8 @@ static bool epoll_set_flow_pair(tproxy_conn_t *conn)
bool bHasUnsent = conn_has_unsent(conn); bool bHasUnsent = conn_has_unsent(conn);
bool bHasUnsentPartner = conn_partner_alive(conn) ? conn_has_unsent(conn->partner) : false; bool bHasUnsentPartner = conn_partner_alive(conn) ? conn_has_unsent(conn->partner) : false;
DBGPRINT("epoll_set_flow_pair fd=%d remote=%d partner_fd=%d bHasUnsent=%d bHasUnsentPartner=%d state_rdhup=%d", DBGPRINT("epoll_set_flow_pair fd=%d remote=%d partner_fd=%d bHasUnsent=%d bHasUnsentPartner=%d state_rdhup=%d\n",
conn->fd , conn->remote, conn_partner_alive(conn) ? conn->partner->fd : 0, bHasUnsent, bHasUnsentPartner, conn->state==CONN_RDHUP) conn->fd , conn->remote, conn_partner_alive(conn) ? conn->partner->fd : 0, bHasUnsent, bHasUnsentPartner, conn->state==CONN_RDHUP);
if (!epoll_set_flow(conn, !bHasUnsentPartner && (conn->state!=CONN_RDHUP), bHasUnsent || conn->state==CONN_RDHUP)) if (!epoll_set_flow(conn, !bHasUnsentPartner && (conn->state!=CONN_RDHUP), bHasUnsent || conn->state==CONN_RDHUP))
return false; return false;
if (conn_partner_alive(conn)) if (conn_partner_alive(conn))
@ -659,13 +702,13 @@ static bool handle_unsent(tproxy_conn_t *conn)
{ {
ssize_t wr; ssize_t wr;
DBGPRINT("+handle_unsent, fd=%d has_unsent=%d has_unsent_partner=%d",conn->fd,conn_has_unsent(conn),conn_partner_alive(conn) ? conn_has_unsent(conn->partner) : false) DBGPRINT("+handle_unsent, fd=%d has_unsent=%d has_unsent_partner=%d\n",conn->fd,conn_has_unsent(conn),conn_partner_alive(conn) ? conn_has_unsent(conn->partner) : false);
#ifdef SPLICE_PRESENT #ifdef SPLICE_PRESENT
if (!params.nosplice && conn->wr_unsent) if (!params.nosplice && conn->wr_unsent)
{ {
wr = splice(conn->splice_pipe[0], NULL, conn->fd, NULL, conn->wr_unsent, SPLICE_F_MOVE | SPLICE_F_NONBLOCK); wr = splice(conn->splice_pipe[0], NULL, conn->fd, NULL, conn->wr_unsent, SPLICE_F_MOVE | SPLICE_F_NONBLOCK);
DBGPRINT("splice unsent=%zd wr=%zd err=%d",conn->wr_unsent,wr,errno) DBGPRINT("splice unsent=%zd wr=%zd err=%d\n",conn->wr_unsent,wr,errno);
if (wr<0) if (wr<0)
{ {
if (errno==EAGAIN) wr=0; if (errno==EAGAIN) wr=0;
@ -678,7 +721,7 @@ static bool handle_unsent(tproxy_conn_t *conn)
if (!conn->wr_unsent && conn_buffers_present(conn)) if (!conn->wr_unsent && conn_buffers_present(conn))
{ {
wr=conn_buffers_send(conn); wr=conn_buffers_send(conn);
DBGPRINT("conn_buffers_send wr=%zd",wr) DBGPRINT("conn_buffers_send wr=%zd\n",wr);
if (wr<0) return false; if (wr<0) return false;
} }
return epoll_set_flow_pair(conn); return epoll_set_flow_pair(conn);
@ -691,13 +734,13 @@ bool proxy_mode_connect_remote(const struct sockaddr *sa, tproxy_conn_t *conn, s
if (params.debug>=1) if (params.debug>=1)
{ {
printf("socks target for fd=%d is : ", conn->fd); char ip_port[48];
print_sockaddr(sa); ntop46_port(sa,ip_port,sizeof(ip_port));
printf("\n"); VPRINT("socks target for fd=%d is : %s\n", conn->fd, ip_port);
} }
if (check_local_ip((struct sockaddr *)sa)) if (check_local_ip((struct sockaddr *)sa))
{ {
VPRINT("Dropping connection to local address for security reasons") VPRINT("Dropping connection to local address for security reasons\n");
socks_send_rep(conn->socks_ver, conn->fd, S5_REP_NOT_ALLOWED_BY_RULESET); socks_send_rep(conn->socks_ver, conn->fd, S5_REP_NOT_ALLOWED_BY_RULESET);
return false; return false;
} }
@ -707,19 +750,19 @@ bool proxy_mode_connect_remote(const struct sockaddr *sa, tproxy_conn_t *conn, s
{ {
bConnFooling=HostlistCheck(conn->track.hostname, NULL); bConnFooling=HostlistCheck(conn->track.hostname, NULL);
if (!bConnFooling) if (!bConnFooling)
VPRINT("0-phase desync hostlist check negative. not acting on this connection.") VPRINT("0-phase desync hostlist check negative. not acting on this connection.\n");
} }
if ((remote_fd = connect_remote(sa, bConnFooling)) < 0) if ((remote_fd = connect_remote(sa, bConnFooling)) < 0)
{ {
fprintf(stderr, "socks failed to connect (1) errno=%d\n", errno); DLOG_ERR("socks failed to connect (1) errno=%d\n", errno);
socks_send_rep_errno(conn->socks_ver, conn->fd, errno); socks_send_rep_errno(conn->socks_ver, conn->fd, errno);
return false; return false;
} }
if (!(conn->partner = new_conn(remote_fd, true))) if (!(conn->partner = new_conn(remote_fd, true)))
{ {
close(remote_fd); close(remote_fd);
fprintf(stderr, "socks out-of-memory (1)\n"); DLOG_ERR("socks out-of-memory (1)\n");
socks_send_rep(conn->socks_ver, conn->fd, S5_REP_GENERAL_FAILURE); socks_send_rep(conn->socks_ver, conn->fd, S5_REP_GENERAL_FAILURE);
return false; return false;
} }
@ -727,7 +770,7 @@ bool proxy_mode_connect_remote(const struct sockaddr *sa, tproxy_conn_t *conn, s
conn->partner->efd = conn->efd; conn->partner->efd = conn->efd;
if (!epoll_set(conn->partner, EPOLLOUT)) if (!epoll_set(conn->partner, EPOLLOUT))
{ {
fprintf(stderr, "socks epoll_set error %d\n", errno); DLOG_ERR("socks epoll_set error %d\n", errno);
free_conn(conn->partner); free_conn(conn->partner);
conn->partner = NULL; conn->partner = NULL;
socks_send_rep(conn->socks_ver, conn->fd, S5_REP_GENERAL_FAILURE); socks_send_rep(conn->socks_ver, conn->fd, S5_REP_GENERAL_FAILURE);
@ -736,7 +779,7 @@ bool proxy_mode_connect_remote(const struct sockaddr *sa, tproxy_conn_t *conn, s
TAILQ_INSERT_HEAD(conn_list, conn->partner, conn_ptrs); TAILQ_INSERT_HEAD(conn_list, conn->partner, conn_ptrs);
legs_remote++; legs_remote++;
print_legs(); print_legs();
DBGPRINT("S_WAIT_CONNECTION") DBGPRINT("S_WAIT_CONNECTION\n");
conn->socks_state = S_WAIT_CONNECTION; conn->socks_state = S_WAIT_CONNECTION;
return true; return true;
} }
@ -752,7 +795,7 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
// receive proxy control message // receive proxy control message
rd=recv(conn->fd, buf, sizeof(buf), MSG_DONTWAIT); rd=recv(conn->fd, buf, sizeof(buf), MSG_DONTWAIT);
DBGPRINT("handle_proxy_mode rd=%zd",rd) DBGPRINT("handle_proxy_mode rd=%zd\n",rd);
if (rd<1) return false; // hangup if (rd<1) return false; // hangup
switch(conn->conn_type) switch(conn->conn_type)
{ {
@ -760,10 +803,10 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
switch(conn->socks_state) switch(conn->socks_state)
{ {
case S_WAIT_HANDSHAKE: case S_WAIT_HANDSHAKE:
DBGPRINT("S_WAIT_HANDSHAKE") DBGPRINT("S_WAIT_HANDSHAKE\n");
if (buf[0] != 5 && buf[0] != 4) return false; // unknown socks version if (buf[0] != 5 && buf[0] != 4) return false; // unknown socks version
conn->socks_ver = buf[0]; conn->socks_ver = buf[0];
DBGPRINT("socks version %u", conn->socks_ver) DBGPRINT("socks version %u\n", conn->socks_ver);
if (conn->socks_ver==5) if (conn->socks_ver==5)
{ {
s5_handshake *m = (s5_handshake*)buf; s5_handshake *m = (s5_handshake*)buf;
@ -773,26 +816,26 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
ack.ver=5; ack.ver=5;
if (!S5_REQ_HANDHSHAKE_VALID(m,rd)) if (!S5_REQ_HANDHSHAKE_VALID(m,rd))
{ {
DBGPRINT("socks5 proxy handshake invalid") DBGPRINT("socks5 proxy handshake invalid\n");
return false; return false;
} }
for (k=0;k<m->nmethods;k++) if (m->methods[k]==S5_AUTH_NONE) break; for (k=0;k<m->nmethods;k++) if (m->methods[k]==S5_AUTH_NONE) break;
if (k>=m->nmethods) if (k>=m->nmethods)
{ {
DBGPRINT("socks5 client wants authentication but we dont support") DBGPRINT("socks5 client wants authentication but we dont support\n");
ack.method=S5_AUTH_UNACCEPTABLE; ack.method=S5_AUTH_UNACCEPTABLE;
wr=send(conn->fd,&ack,sizeof(ack),MSG_DONTWAIT); wr=send(conn->fd,&ack,sizeof(ack),MSG_DONTWAIT);
return false; return false;
} }
DBGPRINT("socks5 recv valid handshake") DBGPRINT("socks5 recv valid handshake\n");
ack.method=S5_AUTH_NONE; ack.method=S5_AUTH_NONE;
wr=send(conn->fd,&ack,sizeof(ack),MSG_DONTWAIT); wr=send(conn->fd,&ack,sizeof(ack),MSG_DONTWAIT);
if (wr!=sizeof(ack)) if (wr!=sizeof(ack))
{ {
DBGPRINT("socks5 handshake ack send error. wr=%zd errno=%d",wr,errno) DBGPRINT("socks5 handshake ack send error. wr=%zd errno=%d\n",wr,errno);
return false; return false;
} }
DBGPRINT("socks5 send handshake ack OK") DBGPRINT("socks5 send handshake ack OK\n");
conn->socks_state=S_WAIT_REQUEST; conn->socks_state=S_WAIT_REQUEST;
return true; return true;
} }
@ -803,31 +846,31 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
s4_req *m = (s4_req*)buf; s4_req *m = (s4_req*)buf;
if (!S4_REQ_HEADER_VALID(m, rd)) if (!S4_REQ_HEADER_VALID(m, rd))
{ {
DBGPRINT("socks4 request invalid") DBGPRINT("socks4 request invalid\n");
return false; return false;
} }
if (m->cmd!=S4_CMD_CONNECT) if (m->cmd!=S4_CMD_CONNECT)
{ {
// BIND is not supported // BIND is not supported
DBGPRINT("socks4 unsupported command %02X", m->cmd) DBGPRINT("socks4 unsupported command %02X\n", m->cmd);
socks4_send_rep(conn->fd, S4_REP_FAILED); socks4_send_rep(conn->fd, S4_REP_FAILED);
return false; return false;
} }
if (!S4_REQ_CONNECT_VALID(m, rd)) if (!S4_REQ_CONNECT_VALID(m, rd))
{ {
DBGPRINT("socks4 connect request invalid") DBGPRINT("socks4 connect request invalid\n");
socks4_send_rep(conn->fd, S4_REP_FAILED); socks4_send_rep(conn->fd, S4_REP_FAILED);
return false; return false;
} }
if (!m->port) if (!m->port)
{ {
DBGPRINT("socks4 zero port") DBGPRINT("socks4 zero port\n");
socks4_send_rep(conn->fd, S4_REP_FAILED); socks4_send_rep(conn->fd, S4_REP_FAILED);
return false; return false;
} }
if (m->ip==htonl(1)) // special ip 0.0.0.1 if (m->ip==htonl(1)) // special ip 0.0.0.1
{ {
VPRINT("socks4a protocol not supported") VPRINT("socks4a protocol not supported\n");
socks4_send_rep(conn->fd, S4_REP_FAILED); socks4_send_rep(conn->fd, S4_REP_FAILED);
return false; return false;
} }
@ -838,28 +881,28 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
} }
break; break;
case S_WAIT_REQUEST: case S_WAIT_REQUEST:
DBGPRINT("S_WAIT_REQUEST") DBGPRINT("S_WAIT_REQUEST\n");
{ {
s5_req *m = (s5_req*)buf; s5_req *m = (s5_req*)buf;
if (!S5_REQ_HEADER_VALID(m,rd)) if (!S5_REQ_HEADER_VALID(m,rd))
{ {
DBGPRINT("socks5 request invalid") DBGPRINT("socks5 request invalid\n");
return false; return false;
} }
if (m->cmd!=S5_CMD_CONNECT) if (m->cmd!=S5_CMD_CONNECT)
{ {
// BIND and UDP are not supported // BIND and UDP are not supported
DBGPRINT("socks5 unsupported command %02X", m->cmd) DBGPRINT("socks5 unsupported command %02X\n", m->cmd);
socks5_send_rep(conn->fd,S5_REP_COMMAND_NOT_SUPPORTED); socks5_send_rep(conn->fd,S5_REP_COMMAND_NOT_SUPPORTED);
return false; return false;
} }
if (!S5_REQ_CONNECT_VALID(m,rd)) if (!S5_REQ_CONNECT_VALID(m,rd))
{ {
DBGPRINT("socks5 connect request invalid") DBGPRINT("socks5 connect request invalid\n");
return false; return false;
} }
DBGPRINT("socks5 recv valid connect request") DBGPRINT("socks5 recv valid connect request\n");
switch(m->atyp) switch(m->atyp)
{ {
case S5_ATYP_IP4: case S5_ATYP_IP4:
@ -880,28 +923,28 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
if (params.no_resolve) if (params.no_resolve)
{ {
VPRINT("socks5 hostname resolving disabled") VPRINT("socks5 hostname resolving disabled\n");
socks5_send_rep(conn->fd,S5_REP_NOT_ALLOWED_BY_RULESET); socks5_send_rep(conn->fd,S5_REP_NOT_ALLOWED_BY_RULESET);
return false; return false;
} }
port=S5_PORT_FROM_DD(m,rd); port=S5_PORT_FROM_DD(m,rd);
if (!port) if (!port)
{ {
VPRINT("socks5 no port is given") VPRINT("socks5 no port is given\n");
socks5_send_rep(conn->fd,S5_REP_HOST_UNREACHABLE); socks5_send_rep(conn->fd,S5_REP_HOST_UNREACHABLE);
return false; return false;
} }
m->dd.domport[m->dd.len] = 0; m->dd.domport[m->dd.len] = 0;
DBGPRINT("socks5 queue resolve hostname '%s' port '%u'",m->dd.domport,port) DBGPRINT("socks5 queue resolve hostname '%s' port '%u'\n",m->dd.domport,port);
conn->socks_ri = resolver_queue(m->dd.domport,port,conn); conn->socks_ri = resolver_queue(m->dd.domport,port,conn);
if (!conn->socks_ri) if (!conn->socks_ri)
{ {
VPRINT("socks5 could not queue resolve item") VPRINT("socks5 could not queue resolve item\n");
socks5_send_rep(conn->fd,S5_REP_GENERAL_FAILURE); socks5_send_rep(conn->fd,S5_REP_GENERAL_FAILURE);
return false; return false;
} }
conn->socks_state=S_WAIT_RESOLVE; conn->socks_state=S_WAIT_RESOLVE;
DBGPRINT("S_WAIT_RESOLVE") DBGPRINT("S_WAIT_RESOLVE\n");
return true; return true;
} }
break; break;
@ -913,13 +956,13 @@ static bool handle_proxy_mode(tproxy_conn_t *conn, struct tailhead *conn_list)
} }
break; break;
case S_WAIT_RESOLVE: case S_WAIT_RESOLVE:
DBGPRINT("socks received message while in S_WAIT_RESOLVE. hanging up") DBGPRINT("socks received message while in S_WAIT_RESOLVE. hanging up\n");
break; break;
case S_WAIT_CONNECTION: case S_WAIT_CONNECTION:
DBGPRINT("socks received message while in S_WAIT_CONNECTION. hanging up") DBGPRINT("socks received message while in S_WAIT_CONNECTION. hanging up\n");
break; break;
default: default:
DBGPRINT("socks received message while in an unexpected connection state") DBGPRINT("socks received message while in an unexpected connection state\n");
break; break;
} }
break; break;
@ -935,7 +978,7 @@ static bool resolve_complete(struct resolve_item *ri, struct tailhead *conn_list
{ {
if (conn->socks_state==S_WAIT_RESOLVE) if (conn->socks_state==S_WAIT_RESOLVE)
{ {
DBGPRINT("resolve_complete %s. getaddrinfo result %d", ri->dom, ri->ga_res); DBGPRINT("resolve_complete %s. getaddrinfo result %d\n", ri->dom, ri->ga_res);
if (ri->ga_res) if (ri->ga_res)
{ {
socks5_send_rep(conn->fd,S5_REP_HOST_UNREACHABLE); socks5_send_rep(conn->fd,S5_REP_HOST_UNREACHABLE);
@ -945,17 +988,17 @@ static bool resolve_complete(struct resolve_item *ri, struct tailhead *conn_list
{ {
if (!conn->track.hostname) if (!conn->track.hostname)
{ {
DBGPRINT("resolve_complete put hostname : %s", ri->dom) DBGPRINT("resolve_complete put hostname : %s\n", ri->dom);
conn->track.hostname = strdup(ri->dom); conn->track.hostname = strdup(ri->dom);
} }
return proxy_mode_connect_remote((struct sockaddr *)&ri->ss,conn,conn_list); return proxy_mode_connect_remote((struct sockaddr *)&ri->ss,conn,conn_list);
} }
} }
else else
fprintf(stderr, "resolve_complete: conn in wrong socks_state !!! (%s)\n", ri->dom); DLOG_ERR("resolve_complete: conn in wrong socks_state !!! (%s)\n", ri->dom);
} }
else else
DBGPRINT("resolve_complete: orphaned resolve for %s", ri->dom); DBGPRINT("resolve_complete: orphaned resolve for %s\n", ri->dom);
return true; return true;
} }
@ -982,11 +1025,11 @@ static void tamper(tproxy_conn_t *conn, uint8_t *segment, size_t segment_buffer_
else else
{ {
bool in_range = in_tamper_out_range(conn); bool in_range = in_tamper_out_range(conn);
DBGPRINT("tamper_out stream pos %" PRIu64 "(n%" PRIu64 "). tamper range %s%u-%s%u (%s)", DBGPRINT("tamper_out stream pos %" PRIu64 "(n%" PRIu64 "). tamper range %s%u-%s%u (%s)\n",
conn->trd, conn->tnrd+1, conn->trd, conn->tnrd+1,
params.tamper_start_n ? "n" : "" , params.tamper_start, params.tamper_start_n ? "n" : "" , params.tamper_start,
params.tamper_cutoff_n ? "n" : "" , params.tamper_cutoff, params.tamper_cutoff_n ? "n" : "" , params.tamper_cutoff,
in_range ? "IN RANGE" : "OUT OF RANGE") in_range ? "IN RANGE" : "OUT OF RANGE");
if (in_range) tamper_out(&conn->track,segment,segment_buffer_size,segment_size,split_pos,split_flags); if (in_range) tamper_out(&conn->track,segment,segment_buffer_size,segment_size,split_pos,split_flags);
} }
} }
@ -998,7 +1041,7 @@ static ssize_t send_or_buffer_oob(send_buffer_t *sb, int fd, uint8_t *buf, size_
ssize_t wr; ssize_t wr;
if (oob) if (oob)
{ {
VPRINT("Sending OOB byte %02X", params.oob_byte) VPRINT("Sending OOB byte %02X\n", params.oob_byte);
uint8_t oob_save; uint8_t oob_save;
oob_save = buf[len]; oob_save = buf[len];
buf[len] = params.oob_byte; buf[len] = params.oob_byte;
@ -1020,7 +1063,7 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
size_t bs; size_t bs;
DBGPRINT("+handle_epoll") DBGPRINT("+handle_epoll\n");
if (!conn_in_tcp_mode(conn)) if (!conn_in_tcp_mode(conn))
{ {
@ -1048,7 +1091,7 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
trd+=rd; trd+=rd;
conn->trd+=rd; conn->trd+=rd;
} }
DBGPRINT("wasted recv=%zd all_rd=%" PRIu64 " err=%d",rd,trd,errno) DBGPRINT("wasted recv=%zd all_rd=%" PRIu64 " err=%d\n",rd,trd,errno);
return true; return true;
} }
@ -1059,10 +1102,10 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
bool oom=false; bool oom=false;
numbytes=conn_bytes_unread(conn); numbytes=conn_bytes_unread(conn);
DBGPRINT("numbytes=%d",numbytes) DBGPRINT("numbytes=%d\n",numbytes);
if (numbytes>0) if (numbytes>0)
{ {
DBGPRINT("%s leg fd=%d stream pos : %" PRIu64 "(n%" PRIu64 ")/%" PRIu64, conn->remote ? "remote" : "local", conn->fd, conn->trd,conn->tnrd+1,conn->twr) DBGPRINT("%s leg fd=%d stream pos : %" PRIu64 "(n%" PRIu64 ")/%" PRIu64 "\n", conn->remote ? "remote" : "local", conn->fd, conn->trd,conn->tnrd+1,conn->twr);
#ifdef SPLICE_PRESENT #ifdef SPLICE_PRESENT
if (!params.nosplice && (!params.tamper || (conn->remote && conn->partner->track.bTamperInCutoff) || (!conn->remote && !in_tamper_out_range(conn)))) if (!params.nosplice && (!params.tamper || (conn->remote && conn->partner->track.bTamperInCutoff) || (!conn->remote && !in_tamper_out_range(conn))))
{ {
@ -1071,7 +1114,7 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
// if we dont tamper - splice both legs // if we dont tamper - splice both legs
rd = splice(conn->fd, NULL, conn->partner->splice_pipe[1], NULL, SPLICE_LEN, SPLICE_F_MOVE | SPLICE_F_NONBLOCK); rd = splice(conn->fd, NULL, conn->partner->splice_pipe[1], NULL, SPLICE_LEN, SPLICE_F_MOVE | SPLICE_F_NONBLOCK);
DBGPRINT("splice fd=%d remote=%d len=%d rd=%zd err=%d",conn->fd,conn->remote,SPLICE_LEN,rd,errno) DBGPRINT("splice fd=%d remote=%d len=%d rd=%zd err=%d\n",conn->fd,conn->remote,SPLICE_LEN,rd,errno);
if (rd<0 && errno==EAGAIN) rd=0; if (rd<0 && errno==EAGAIN) rd=0;
if (rd>0) if (rd>0)
{ {
@ -1079,7 +1122,7 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
conn->trd += rd; conn->trd += rd;
conn->partner->wr_unsent += rd; conn->partner->wr_unsent += rd;
wr = splice(conn->partner->splice_pipe[0], NULL, conn->partner->fd, NULL, conn->partner->wr_unsent, SPLICE_F_MOVE | SPLICE_F_NONBLOCK); wr = splice(conn->partner->splice_pipe[0], NULL, conn->partner->fd, NULL, conn->partner->wr_unsent, SPLICE_F_MOVE | SPLICE_F_NONBLOCK);
DBGPRINT("splice fd=%d remote=%d wr=%zd err=%d",conn->partner->fd,conn->partner->remote,wr,errno) DBGPRINT("splice fd=%d remote=%d wr=%zd err=%d\n",conn->partner->fd,conn->partner->remote,wr,errno);
if (wr<0 && errno==EAGAIN) wr=0; if (wr<0 && errno==EAGAIN) wr=0;
if (wr>0) if (wr>0)
{ {
@ -1095,7 +1138,7 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
uint8_t buf[RD_BLOCK_SIZE + 5]; uint8_t buf[RD_BLOCK_SIZE + 5];
rd = recv(conn->fd, buf, RD_BLOCK_SIZE, MSG_DONTWAIT); rd = recv(conn->fd, buf, RD_BLOCK_SIZE, MSG_DONTWAIT);
DBGPRINT("recv fd=%d rd=%zd err=%d",conn->fd, rd,errno) DBGPRINT("recv fd=%d rd=%zd err=%d\n",conn->fd, rd,errno);
if (rd<0 && errno==EAGAIN) rd=0; if (rd<0 && errno==EAGAIN) rd=0;
if (rd>0) if (rd>0)
{ {
@ -1112,22 +1155,22 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
if (split_pos && bs<sizeof(buf) && split_pos<sizeof(buf)) if (split_pos && bs<sizeof(buf) && split_pos<sizeof(buf))
{ {
VPRINT("Splitting at pos %zu%s", split_pos, (split_flags & SPLIT_FLAG_DISORDER) ? " with disorder" : "") VPRINT("Splitting at pos %zu%s\n", split_pos, (split_flags & SPLIT_FLAG_DISORDER) ? " with disorder" : "");
wr = send_or_buffer_oob(conn->partner->wr_buf, conn->partner->fd, buf, split_pos, !!(split_flags & SPLIT_FLAG_DISORDER), !!(split_flags & SPLIT_FLAG_OOB)); wr = send_or_buffer_oob(conn->partner->wr_buf, conn->partner->fd, buf, split_pos, !!(split_flags & SPLIT_FLAG_DISORDER), !!(split_flags & SPLIT_FLAG_OOB));
DBGPRINT("send_or_buffer(1) fd=%d wr=%zd err=%d",conn->partner->fd,wr,errno) DBGPRINT("send_or_buffer(1) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
if (wr >= 0) if (wr >= 0)
{ {
conn->partner->twr += wr; conn->partner->twr += wr;
wr = send_or_buffer(conn->partner->wr_buf + 1, conn->partner->fd, buf + split_pos, bs - split_pos, 0, 0); wr = send_or_buffer(conn->partner->wr_buf + 1, conn->partner->fd, buf + split_pos, bs - split_pos, 0, 0);
DBGPRINT("send_or_buffer(2) fd=%d wr=%zd err=%d",conn->partner->fd,wr,errno) DBGPRINT("send_or_buffer(2) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
if (wr>0) conn->partner->twr += wr; if (wr>0) conn->partner->twr += wr;
} }
} }
else else
{ {
wr = send_or_buffer(conn->partner->wr_buf, conn->partner->fd, buf, bs, 0, 0); wr = send_or_buffer(conn->partner->wr_buf, conn->partner->fd, buf, bs, 0, 0);
DBGPRINT("send_or_buffer(3) fd=%d wr=%zd err=%d",conn->partner->fd,wr,errno) DBGPRINT("send_or_buffer(3) fd=%d wr=%zd err=%d\n",conn->partner->fd,wr,errno);
if (wr>0) conn->partner->twr += wr; if (wr>0) conn->partner->twr += wr;
} }
if (wr<0 && errno==ENOMEM) oom=true; if (wr<0 && errno==ENOMEM) oom=true;
@ -1138,8 +1181,8 @@ static bool handle_epoll(tproxy_conn_t *conn, struct tailhead *conn_list, uint32
return false; return false;
} }
DBGPRINT("-handle_epoll rd=%zd wr=%zd",rd,wr) DBGPRINT("-handle_epoll rd=%zd wr=%zd\n",rd,wr);
if (oom) DBGPRINT("handle_epoll: OUT_OF_MEMORY") if (oom) DBGPRINT("handle_epoll: OUT_OF_MEMORY\n");
// do not fail if partner fails. // do not fail if partner fails.
// if partner fails there will be another epoll event with EPOLLHUP or EPOLLERR // if partner fails there will be another epoll event with EPOLLHUP or EPOLLERR
@ -1157,8 +1200,8 @@ static bool remove_closed_connections(int efd, struct tailhead *close_list)
shutdown(conn->fd,SHUT_RDWR); shutdown(conn->fd,SHUT_RDWR);
epoll_del(conn); epoll_del(conn);
VPRINT("Socket fd=%d (partner_fd=%d, remote=%d) closed, connection removed. total_read=%" PRIu64 " total_write=%" PRIu64 " event_count=%u", VPRINT("Socket fd=%d (partner_fd=%d, remote=%d) closed, connection removed. total_read=%" PRIu64 " total_write=%" PRIu64 " event_count=%u\n",
conn->fd, conn->partner ? conn->partner->fd : 0, conn->remote, conn->trd, conn->twr, conn->event_count) conn->fd, conn->partner ? conn->partner->fd : 0, conn->remote, conn->trd, conn->twr, conn->event_count);
if (conn->remote) legs_remote--; else legs_local--; if (conn->remote) legs_remote--; else legs_local--;
free_conn(conn); free_conn(conn);
bRemoved = true; bRemoved = true;
@ -1183,7 +1226,7 @@ static bool read_all_and_buffer(tproxy_conn_t *conn, int buffer_number)
if (conn_partner_alive(conn)) if (conn_partner_alive(conn))
{ {
int numbytes=conn_bytes_unread(conn); int numbytes=conn_bytes_unread(conn);
DBGPRINT("read_all_and_buffer(%d) numbytes=%d",buffer_number,numbytes) DBGPRINT("read_all_and_buffer(%d) numbytes=%d\n",buffer_number,numbytes);
if (numbytes>0) if (numbytes>0)
{ {
if (send_buffer_create(conn->partner->wr_buf+buffer_number, NULL, numbytes, 5, 0, 0)) if (send_buffer_create(conn->partner->wr_buf+buffer_number, NULL, numbytes, 5, 0, 0))
@ -1227,7 +1270,7 @@ static void conn_close_timed_out(struct tailhead *conn_list, struct tailhead *cl
{ {
tproxy_conn_t *c,*cnext = NULL; tproxy_conn_t *c,*cnext = NULL;
DBGPRINT("conn_close_timed_out") DBGPRINT("conn_close_timed_out\n");
c = TAILQ_FIRST(conn_list); c = TAILQ_FIRST(conn_list);
while(c) while(c)
@ -1235,7 +1278,7 @@ static void conn_close_timed_out(struct tailhead *conn_list, struct tailhead *cl
cnext = TAILQ_NEXT(c,conn_ptrs); cnext = TAILQ_NEXT(c,conn_ptrs);
if (conn_timed_out(c)) if (conn_timed_out(c))
{ {
DBGPRINT("closing timed out connection: fd=%d remote=%d",c->fd,c->remote) DBGPRINT("closing timed out connection: fd=%d remote=%d\n",c->fd,c->remote);
close_tcp_conn(conn_list,close_list,c); close_tcp_conn(conn_list,close_list,c);
} }
c = cnext; c = cnext;
@ -1269,13 +1312,13 @@ static bool handle_resolve_pipe(tproxy_conn_t **conn, struct tailhead *conn_list
rd = read(fd,&ri,sizeof(void*)); rd = read(fd,&ri,sizeof(void*));
if (rd<0) if (rd<0)
{ {
perror("resolve_pipe read"); DLOG_PERROR("resolve_pipe read");
return false; return false;
} }
else if (rd!=sizeof(void*)) else if (rd!=sizeof(void*))
{ {
// partial pointer read is FATAL. in any case it will cause pointer corruption and coredump // partial pointer read is FATAL. in any case it will cause pointer corruption and coredump
fprintf(stderr,"resolve_pipe not full read %zu\n",rd); DLOG_ERR("resolve_pipe not full read %zu\n",rd);
exit(1000); exit(1000);
} }
b = resolve_complete(ri, conn_list); b = resolve_complete(ri, conn_list);
@ -1310,13 +1353,13 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
TAILQ_INIT(&close_list); TAILQ_INIT(&close_list);
if ((efd = epoll_create(1)) == -1) { if ((efd = epoll_create(1)) == -1) {
perror("epoll_create"); DLOG_PERROR("epoll_create");
return -1; return -1;
} }
if (!(listen_conn=calloc(listen_fd_ct,sizeof(*listen_conn)))) if (!(listen_conn=calloc(listen_fd_ct,sizeof(*listen_conn))))
{ {
perror("calloc listen_conn"); DLOG_PERROR("calloc listen_conn");
return -1; return -1;
} }
@ -1329,7 +1372,7 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
listen_conn[sct].fd = listen_fd[sct]; listen_conn[sct].fd = listen_fd[sct];
ev.data.ptr = listen_conn + sct; ev.data.ptr = listen_conn + sct;
if (epoll_ctl(efd, EPOLL_CTL_ADD, listen_conn[sct].fd, &ev) == -1) { if (epoll_ctl(efd, EPOLL_CTL_ADD, listen_conn[sct].fd, &ev) == -1) {
perror("epoll_ctl (listen socket)"); DLOG_PERROR("epoll_ctl (listen socket)");
retval = -1; retval = -1;
goto ex; goto ex;
} }
@ -1338,39 +1381,39 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
{ {
if (pipe(resolve_pipe)==-1) if (pipe(resolve_pipe)==-1)
{ {
perror("pipe (resolve_pipe)"); DLOG_PERROR("pipe (resolve_pipe)");
retval = -1; retval = -1;
goto ex; goto ex;
} }
if (fcntl(resolve_pipe[0], F_SETFL, O_NONBLOCK) < 0) if (fcntl(resolve_pipe[0], F_SETFL, O_NONBLOCK) < 0)
{ {
perror("resolve_pipe set O_NONBLOCK"); DLOG_PERROR("resolve_pipe set O_NONBLOCK");
retval = -1; retval = -1;
goto ex; goto ex;
} }
ev.data.ptr = NULL; ev.data.ptr = NULL;
if (epoll_ctl(efd, EPOLL_CTL_ADD, resolve_pipe[0], &ev) == -1) { if (epoll_ctl(efd, EPOLL_CTL_ADD, resolve_pipe[0], &ev) == -1) {
perror("epoll_ctl (listen socket)"); DLOG_PERROR("epoll_ctl (listen socket)");
retval = -1; retval = -1;
goto ex; goto ex;
} }
if (!resolver_init(params.resolver_threads,resolve_pipe[1])) if (!resolver_init(params.resolver_threads,resolve_pipe[1]))
{ {
fprintf(stderr,"could not initialize multithreaded resolver\n"); DLOG_ERR("could not initialize multithreaded resolver\n");
retval = -1; retval = -1;
goto ex; goto ex;
} }
VPRINT("initialized multi threaded resolver with %d threads",resolver_thread_count()); VPRINT("initialized multi threaded resolver with %d threads\n",resolver_thread_count());
} }
for(;;) for(;;)
{ {
DBGPRINT("epoll_wait") DBGPRINT("epoll_wait\n");
if ((num_events = epoll_wait(efd, events, MAX_EPOLL_EVENTS, -1)) == -1) if ((num_events = epoll_wait(efd, events, MAX_EPOLL_EVENTS, -1)) == -1)
{ {
if (errno == EINTR) continue; // system call was interrupted if (errno == EINTR) continue; // system call was interrupted
perror("epoll_wait"); DLOG_PERROR("epoll_wait");
retval = -1; retval = -1;
break; break;
} }
@ -1382,13 +1425,13 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
conn = (tproxy_conn_t*)events[i].data.ptr; conn = (tproxy_conn_t*)events[i].data.ptr;
if (!conn) if (!conn)
{ {
DBGPRINT("\nEVENT mask %08X resolve_pipe",events[i].events) DBGPRINT("\nEVENT mask %08X resolve_pipe\n",events[i].events);
if (events[i].events & EPOLLIN) if (events[i].events & EPOLLIN)
{ {
DBGPRINT("EPOLLIN") DBGPRINT("EPOLLIN\n");
if (!handle_resolve_pipe(&conn, &conn_list, resolve_pipe[0])) if (!handle_resolve_pipe(&conn, &conn_list, resolve_pipe[0]))
{ {
DBGPRINT("handle_resolve_pipe false") DBGPRINT("handle_resolve_pipe false\n");
if (conn) close_tcp_conn(&conn_list,&close_list,conn); if (conn) close_tcp_conn(&conn_list,&close_list,conn);
} }
} }
@ -1397,7 +1440,7 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
conn->event_count++; conn->event_count++;
if (conn->listener) if (conn->listener)
{ {
DBGPRINT("\nEVENT mask %08X fd=%d accept",events[i].events,conn->fd) DBGPRINT("\nEVENT mask %08X fd=%d accept\n",events[i].events,conn->fd);
accept_salen = sizeof(accept_sa); accept_salen = sizeof(accept_sa);
//Accept new connection //Accept new connection
@ -1409,35 +1452,35 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
#endif #endif
if (tmp_fd < 0) if (tmp_fd < 0)
{ {
perror("Failed to accept connection"); DLOG_PERROR("Failed to accept connection");
} }
else if (legs_local >= params.maxconn) // each connection has 2 legs - local and remote else if (legs_local >= params.maxconn) // each connection has 2 legs - local and remote
{ {
close(tmp_fd); close(tmp_fd);
VPRINT("Too many local legs : %d", legs_local) VPRINT("Too many local legs : %d\n", legs_local);
} }
#if defined (__APPLE__) #if defined (__APPLE__)
// separate fcntl call to comply with macos // separate fcntl call to comply with macos
else if (fcntl(tmp_fd, F_SETFL, O_NONBLOCK) < 0) else if (fcntl(tmp_fd, F_SETFL, O_NONBLOCK) < 0)
{ {
perror("socket set O_NONBLOCK (accept)"); DLOG_PERROR("socket set O_NONBLOCK (accept)");
close(tmp_fd); close(tmp_fd);
} }
#endif #endif
else if (!(conn=add_tcp_connection(efd, &conn_list, tmp_fd, (struct sockaddr*)&accept_sa, params.port, params.proxy_type))) else if (!(conn=add_tcp_connection(efd, &conn_list, tmp_fd, (struct sockaddr*)&accept_sa, params.port, params.proxy_type)))
{ {
// add_tcp_connection closes fd in case of failure // add_tcp_connection closes fd in case of failure
VPRINT("Failed to add connection"); VPRINT("Failed to add connection\n");
} }
else else
{ {
print_legs(); print_legs();
VPRINT("Socket fd=%d (local) connected", conn->fd) VPRINT("Socket fd=%d (local) connected\n", conn->fd);
} }
} }
else else
{ {
DBGPRINT("\nEVENT mask %08X fd=%d remote=%d fd_partner=%d",events[i].events,conn->fd,conn->remote,conn_partner_alive(conn) ? conn->partner->fd : 0) DBGPRINT("\nEVENT mask %08X fd=%d remote=%d fd_partner=%d\n",events[i].events,conn->fd,conn->remote,conn_partner_alive(conn) ? conn->partner->fd : 0);
if (conn->state != CONN_CLOSED) if (conn->state != CONN_CLOSED)
{ {
@ -1452,7 +1495,7 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
case EPOLLHUP|EPOLLERR: se="EPOLLERR EPOLLHUP"; break; case EPOLLHUP|EPOLLERR: se="EPOLLERR EPOLLHUP"; break;
default: se=NULL; default: se=NULL;
} }
VPRINT("Socket fd=%d (partner_fd=%d, remote=%d) %s so_error=%d (%s)",conn->fd,conn->partner ? conn->partner->fd : 0,conn->remote,se,errn,strerror(errn)); VPRINT("Socket fd=%d (partner_fd=%d, remote=%d) %s so_error=%d (%s)\n",conn->fd,conn->partner ? conn->partner->fd : 0,conn->remote,se,errn,strerror(errn));
proxy_remote_conn_ack(conn,errn); proxy_remote_conn_ack(conn,errn);
read_all_and_buffer(conn,3); read_all_and_buffer(conn,3);
if (errn==ECONNRESET && conn->remote && params.tamper && conn_partner_alive(conn)) rst_in(&conn->partner->track); if (errn==ECONNRESET && conn->remote && params.tamper && conn_partner_alive(conn)) rst_in(&conn->partner->track);
@ -1464,26 +1507,26 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
{ {
if (!check_connection_attempt(conn, efd)) if (!check_connection_attempt(conn, efd))
{ {
VPRINT("Connection attempt failed for fd=%d", conn->fd) VPRINT("Connection attempt failed for fd=%d\n", conn->fd);
conn_close_both(&conn_list,&close_list,conn); conn_close_both(&conn_list,&close_list,conn);
continue; continue;
} }
} }
if (events[i].events & EPOLLRDHUP) if (events[i].events & EPOLLRDHUP)
{ {
DBGPRINT("EPOLLRDHUP") DBGPRINT("EPOLLRDHUP\n");
read_all_and_buffer(conn,2); read_all_and_buffer(conn,2);
if (!conn->remote && params.tamper) hup_out(&conn->track); if (!conn->remote && params.tamper) hup_out(&conn->track);
if (conn_has_unsent(conn)) if (conn_has_unsent(conn))
{ {
DBGPRINT("conn fd=%d has unsent, not closing", conn->fd) DBGPRINT("conn fd=%d has unsent, not closing\n", conn->fd);
conn->state = CONN_RDHUP; // only writes conn->state = CONN_RDHUP; // only writes
epoll_set_flow(conn,false,true); epoll_set_flow(conn,false,true);
} }
else else
{ {
DBGPRINT("conn fd=%d has no unsent, closing", conn->fd) DBGPRINT("conn fd=%d has no unsent, closing\n", conn->fd);
conn_close_with_partner_check(&conn_list,&close_list,conn); conn_close_with_partner_check(&conn_list,&close_list,conn);
} }
continue; continue;
@ -1494,7 +1537,7 @@ int event_loop(const int *listen_fd, size_t listen_fd_ct)
// will not receive this until successful check_connection_attempt() // will not receive this until successful check_connection_attempt()
if (!handle_epoll(conn, &conn_list, events[i].events)) if (!handle_epoll(conn, &conn_list, events[i].events))
{ {
DBGPRINT("handle_epoll false") DBGPRINT("handle_epoll false\n");
conn_close_with_partner_check(&conn_list,&close_list,conn); conn_close_with_partner_check(&conn_list,&close_list,conn);
continue; continue;
} }