2 * curvetun - the cipherspace wormhole creator
3 * Part of the netsniff-ng project
4 * Copyright 2011 Daniel Borkmann <daniel@netsniff-ng.org>,
5 * Subject to the GPL, version 2.
20 #include <netinet/in.h>
21 #include <netinet/tcp.h>
22 #include <netinet/udp.h>
24 #include <sys/types.h>
25 #include <sys/socket.h>
27 #include <sys/epoll.h>
28 #include <arpa/inet.h>
29 #include <linux/if_tun.h>
41 #include "ct_usermgmt.h"
53 struct worker_struct
{
57 struct parent_info parent
;
58 int (*handler
)(int fd
, const struct worker_struct
*ws
,
59 char *buff
, size_t len
);
60 struct curve25519_struct
*c
;
63 static struct worker_struct
*threadpool
= NULL
;
65 static int auth_log
= 1;
67 extern volatile sig_atomic_t sigint
;
69 static int handler_udp_tun_to_net(int fd
, const struct worker_struct
*ws
,
70 char *buff
, size_t len
) __pure
;
71 static int handler_udp_net_to_tun(int fd
, const struct worker_struct
*ws
,
72 char *buff
, size_t len
) __pure
;
73 static int handler_udp(int fd
, const struct worker_struct
*ws
,
74 char *buff
, size_t len
) __pure
;
75 static int handler_tcp_tun_to_net(int fd
, const struct worker_struct
*ws
,
76 char *buff
, size_t len
) __pure
;
77 static int handler_tcp_net_to_tun(int fd
, const struct worker_struct
*ws
,
78 char *buff
, size_t len
) __pure
;
79 static int handler_tcp(int fd
, const struct worker_struct
*ws
,
80 char *buff
, size_t len
) __pure
;
81 ssize_t
handler_tcp_read(int fd
, char *buff
, size_t len
);
82 static void *worker(void *self
) __pure
;
84 static int handler_udp_tun_to_net(int fd
, const struct worker_struct
*ws
,
85 char *buff
, size_t len
)
89 ssize_t rlen
, err
, clen
;
91 struct curve25519_proto
*p
;
92 struct sockaddr_storage naddr
;
94 size_t off
= sizeof(struct ct_proto
) + crypto_box_zerobytes
;
96 if (!buff
|| len
<= off
)
100 while ((rlen
= read(fd
, buff
+ off
, len
- off
)) > 0) {
101 dfd
= -1; nlen
= 0; p
= NULL
;
103 memset(&naddr
, 0, sizeof(naddr
));
105 hdr
= (struct ct_proto
*) buff
;
106 memset(hdr
, 0, sizeof(*hdr
));
109 trie_addr_lookup(buff
+ off
, rlen
, ws
->parent
.ipv4
, &dfd
, &naddr
,
111 if (unlikely(dfd
< 0 || nlen
== 0)) {
112 memset(buff
, 0, len
);
116 err
= get_user_by_sockaddr(&naddr
, nlen
, &p
);
117 if (unlikely(err
|| !p
)) {
118 memset(buff
, 0, len
);
122 clen
= curve25519_encode(ws
->c
, p
, (unsigned char *) (buff
+ off
-
123 crypto_box_zerobytes
), (rlen
+
124 crypto_box_zerobytes
), (unsigned char **)
126 if (unlikely(clen
<= 0)) {
127 memset(buff
, 0, len
);
131 hdr
->payload
= htons((uint16_t) clen
);
135 sendto(dfd
, hdr
, sizeof(struct ct_proto
), 0, (struct sockaddr
*)
137 sendto(dfd
, cbuff
, clen
, 0, (struct sockaddr
*) &naddr
, nlen
);
141 memset(buff
, 0, len
);
147 static void handler_udp_notify_close(int fd
, struct sockaddr_storage
*addr
)
151 memset(&hdr
, 0, sizeof(hdr
));
152 hdr
.flags
|= PROTO_FLAG_EXIT
;
155 sendto(fd
, &hdr
, sizeof(hdr
), 0, (struct sockaddr
*) addr
,
159 static int handler_udp_net_to_tun(int fd
, const struct worker_struct
*ws
,
160 char *buff
, size_t len
)
164 ssize_t rlen
, err
, clen
;
165 struct ct_proto
*hdr
;
166 struct curve25519_proto
*p
;
167 struct sockaddr_storage naddr
;
168 socklen_t nlen
= sizeof(naddr
);
173 memset(&naddr
, 0, sizeof(naddr
));
174 while ((rlen
= recvfrom(fd
, buff
, len
, 0, (struct sockaddr
*) &naddr
,
178 hdr
= (struct ct_proto
*) buff
;
180 if (unlikely(rlen
< sizeof(struct ct_proto
)))
182 if (unlikely(rlen
- sizeof(*hdr
) != ntohs(hdr
->payload
)))
184 if (unlikely(ntohs(hdr
->payload
) == 0))
186 if (hdr
->flags
& PROTO_FLAG_EXIT
) {
188 remove_user_by_sockaddr(&naddr
, nlen
);
189 trie_addr_remove_addr(&naddr
, nlen
);
190 handler_udp_notify_close(fd
, &naddr
);
194 if (hdr
->flags
& PROTO_FLAG_INIT
) {
195 syslog_maybe(auth_log
, LOG_INFO
, "Got initial userhash "
196 "from remote end!\n");
198 if (unlikely(rlen
- sizeof(*hdr
) <
199 sizeof(struct username_struct
)))
202 err
= try_register_user_by_sockaddr(ws
->c
,
203 buff
+ sizeof(struct ct_proto
),
204 rlen
- sizeof(struct ct_proto
),
205 &naddr
, nlen
, auth_log
);
212 err
= get_user_by_sockaddr(&naddr
, nlen
, &p
);
213 if (unlikely(err
|| !p
))
216 clen
= curve25519_decode(ws
->c
, p
, (unsigned char *) buff
+
217 sizeof(struct ct_proto
),
218 rlen
- sizeof(struct ct_proto
),
219 (unsigned char **) &cbuff
, NULL
);
220 if (unlikely(clen
<= 0))
223 cbuff
+= crypto_box_zerobytes
;
224 clen
-= crypto_box_zerobytes
;
226 err
= trie_addr_maybe_update(cbuff
, clen
, ws
->parent
.ipv4
,
231 err
= write(ws
->parent
.tunfd
, cbuff
, clen
);
233 nlen
= sizeof(naddr
);
234 memset(&naddr
, 0, sizeof(naddr
));
240 static int handler_udp(int fd
, const struct worker_struct
*ws
,
241 char *buff
, size_t len
)
245 if (fd
== ws
->parent
.tunfd
)
246 ret
= handler_udp_tun_to_net(fd
, ws
, buff
, len
);
248 ret
= handler_udp_net_to_tun(fd
, ws
, buff
, len
);
253 static int handler_tcp_tun_to_net(int fd
, const struct worker_struct
*ws
,
254 char *buff
, size_t len
)
258 ssize_t rlen
, err
, clen
;
259 struct ct_proto
*hdr
;
260 struct curve25519_proto
*p
;
262 size_t off
= sizeof(struct ct_proto
) + crypto_box_zerobytes
;
264 if (!buff
|| len
<= off
)
267 memset(buff
, 0, len
);
268 while ((rlen
= read(fd
, buff
+ off
, len
- off
)) > 0) {
271 hdr
= (struct ct_proto
*) buff
;
272 memset(hdr
, 0, sizeof(*hdr
));
275 trie_addr_lookup(buff
+ off
, rlen
, ws
->parent
.ipv4
, &dfd
, NULL
,
277 if (unlikely(dfd
< 0)) {
278 memset(buff
, 0, len
);
282 err
= get_user_by_socket(dfd
, &p
);
283 if (unlikely(err
|| !p
)) {
284 memset(buff
, 0, len
);
288 clen
= curve25519_encode(ws
->c
, p
, (unsigned char *) (buff
+ off
-
289 crypto_box_zerobytes
), (rlen
+
290 crypto_box_zerobytes
), (unsigned char **)
292 if (unlikely(clen
<= 0)) {
293 memset(buff
, 0, len
);
297 hdr
->payload
= htons((uint16_t) clen
);
301 write_exact(dfd
, hdr
, sizeof(struct ct_proto
), 0);
302 write_exact(dfd
, cbuff
, clen
, 0);
306 memset(buff
, 0, len
);
312 ssize_t
handler_tcp_read(int fd
, char *buff
, size_t len
)
315 struct ct_proto
*hdr
= (struct ct_proto
*) buff
;
320 /* May exit on EAGAIN if 0 Byte read */
321 rlen
= read_exact(fd
, buff
, sizeof(struct ct_proto
), 1);
324 if (unlikely(ntohs(hdr
->payload
) > len
- sizeof(struct ct_proto
))) {
326 return 1; /* Force server to close connection */
329 /* May not exit on EAGAIN if 0 Byte read */
330 rlen
= read_exact(fd
, buff
+ sizeof(struct ct_proto
),
331 ntohs(hdr
->payload
), 0);
335 return sizeof(struct ct_proto
) + rlen
;
338 static void handler_tcp_notify_close(int fd
)
342 memset(&hdr
, 0, sizeof(hdr
));
343 hdr
.flags
|= PROTO_FLAG_EXIT
;
346 if (write(fd
, &hdr
, sizeof(hdr
))) { ; }
349 static int handler_tcp_net_to_tun(int fd
, const struct worker_struct
*ws
,
350 char *buff
, size_t len
)
352 int keep
= 1, count
= 0;
354 ssize_t rlen
, err
, clen
;
355 struct ct_proto
*hdr
;
356 struct curve25519_proto
*p
;
361 while ((rlen
= handler_tcp_read(fd
, buff
, len
)) > 0) {
364 hdr
= (struct ct_proto
*) buff
;
366 if (unlikely(rlen
< sizeof(struct ct_proto
)))
368 if (unlikely(rlen
- sizeof(*hdr
) != ntohs(hdr
->payload
)))
370 if (unlikely(ntohs(hdr
->payload
) == 0))
372 if (hdr
->flags
& PROTO_FLAG_EXIT
) {
374 remove_user_by_socket(fd
);
375 trie_addr_remove(fd
);
376 handler_tcp_notify_close(fd
);
377 rlen
= write(ws
->parent
.efd
, &fd
, sizeof(fd
));
382 if (hdr
->flags
& PROTO_FLAG_INIT
) {
383 syslog_maybe(auth_log
, LOG_INFO
, "Got initial userhash "
384 "from remote end!\n");
386 if (unlikely(rlen
- sizeof(*hdr
) <
387 sizeof(struct username_struct
)))
390 err
= try_register_user_by_socket(ws
->c
,
391 buff
+ sizeof(struct ct_proto
),
392 rlen
- sizeof(struct ct_proto
),
400 err
= get_user_by_socket(fd
, &p
);
401 if (unlikely(err
|| !p
))
404 clen
= curve25519_decode(ws
->c
, p
, (unsigned char *) buff
+
405 sizeof(struct ct_proto
),
406 rlen
- sizeof(struct ct_proto
),
407 (unsigned char **) &cbuff
, NULL
);
408 if (unlikely(clen
<= 0))
411 cbuff
+= crypto_box_zerobytes
;
412 clen
-= crypto_box_zerobytes
;
414 err
= trie_addr_maybe_update(cbuff
, clen
, ws
->parent
.ipv4
,
419 err
= write(ws
->parent
.tunfd
, cbuff
, clen
);
423 write_exact(ws
->efd
[1], &fd
, sizeof(fd
), 1);
424 /* Read later next data and let others process */
432 static int handler_tcp(int fd
, const struct worker_struct
*ws
,
433 char *buff
, size_t len
)
437 if (fd
== ws
->parent
.tunfd
)
438 ret
= handler_tcp_tun_to_net(fd
, ws
, buff
, len
);
440 ret
= handler_tcp_net_to_tun(fd
, ws
, buff
, len
);
445 static void *worker(void *self
)
449 size_t blen
= TUNBUFF_SIZ
; //FIXME
450 const struct worker_struct
*ws
= self
;
457 curve25519_alloc_or_maybe_die(ws
->c
);
459 buff
= xmalloc_aligned(blen
, 64);
461 syslog(LOG_INFO
, "curvetun thread on CPU%u up!\n", ws
->cpu
);
463 pthread_cleanup_push(xfree_func
, ws
->c
);
464 pthread_cleanup_push(curve25519_free
, ws
->c
);
465 pthread_cleanup_push(xfree_func
, buff
);
467 while (likely(!sigint
)) {
469 if ((fds
.revents
& POLLIN
) != POLLIN
)
472 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE
, &old_state
);
474 while ((ret
= read_exact(ws
->efd
[0], &fd
, sizeof(fd
), 1)) > 0) {
475 if (ret
!= sizeof(fd
)) {
480 ret
= ws
->handler(fd
, ws
, buff
, blen
);
482 write_exact(ws
->parent
.refd
, &fd
, sizeof(fd
), 1);
485 pthread_setcancelstate(old_state
, NULL
);
488 syslog(LOG_INFO
, "curvetun thread on CPU%u down!\n", ws
->cpu
);
490 pthread_cleanup_pop(1);
491 pthread_cleanup_pop(1);
492 pthread_cleanup_pop(1);
494 pthread_exit((void *) ((long) ws
->cpu
));
497 static void thread_spawn_or_panic(unsigned int cpus
, int efd
, int refd
,
498 int tunfd
, int ipv4
, int udp
)
502 unsigned int threads
;
504 threads
= cpus
* THREADS_PER_CPU
;
506 for (i
= 0; i
< threads
; ++i
) {
508 threadpool
[i
].cpu
= i
% cpus
;
509 CPU_SET(threadpool
[i
].cpu
, &cpuset
);
511 ret
= pipe2(threadpool
[i
].efd
, O_NONBLOCK
);
513 syslog_panic("Cannot create event socket!\n");
515 threadpool
[i
].c
= xmalloc_aligned(sizeof(*threadpool
[i
].c
), 64);
516 threadpool
[i
].parent
.efd
= efd
;
517 threadpool
[i
].parent
.refd
= refd
;
518 threadpool
[i
].parent
.tunfd
= tunfd
;
519 threadpool
[i
].parent
.ipv4
= ipv4
;
520 threadpool
[i
].parent
.udp
= udp
;
521 threadpool
[i
].handler
= udp
? handler_udp
: handler_tcp
;
523 ret
= pthread_create(&threadpool
[i
].trid
, NULL
,
524 worker
, &threadpool
[i
]);
526 syslog_panic("Thread creation failed!\n");
528 ret
= pthread_setaffinity_np(threadpool
[i
].trid
,
529 sizeof(cpuset
), &cpuset
);
531 syslog_panic("Thread CPU migration failed!\n");
533 pthread_detach(threadpool
[i
].trid
);
539 static void thread_finish(unsigned int cpus
)
542 unsigned int threads
;
544 threads
= cpus
* THREADS_PER_CPU
;
546 for (i
= 0; i
< threads
; ++i
) {
547 while (pthread_join(threadpool
[i
].trid
, NULL
) < 0)
550 close(threadpool
[i
].efd
[0]);
551 close(threadpool
[i
].efd
[1]);
555 int server_main(char *home
, char *dev
, char *port
, int udp
, int ipv4
, int log
)
557 int lfd
= -1, kdpfd
, nfds
, nfd
, curfds
, efd
[2], refd
[2], tunfd
, i
;
558 unsigned int cpus
= 0, threads
, udp_cpu
= 0;
560 struct epoll_event
*events
;
561 struct addrinfo hints
, *ahead
, *ai
;
564 openlog("curvetun", LOG_PID
| LOG_CONS
| LOG_NDELAY
, LOG_DAEMON
);
566 syslog(LOG_INFO
, "curvetun server booting!\n");
567 syslog_maybe(!auth_log
, LOG_INFO
, "curvetun user logging disabled!\n");
569 parse_userfile_and_generate_user_store_or_die(home
);
571 memset(&hints
, 0, sizeof(hints
));
572 hints
.ai_family
= PF_UNSPEC
;
573 hints
.ai_socktype
= udp
? SOCK_DGRAM
: SOCK_STREAM
;
574 hints
.ai_protocol
= udp
? IPPROTO_UDP
: IPPROTO_TCP
;
575 hints
.ai_flags
= AI_PASSIVE
;
577 ret
= getaddrinfo(NULL
, port
, &hints
, &ahead
);
579 syslog_panic("Cannot get address info!\n");
581 for (ai
= ahead
; ai
!= NULL
&& lfd
< 0; ai
= ai
->ai_next
) {
582 lfd
= socket(ai
->ai_family
, ai
->ai_socktype
, ai
->ai_protocol
);
585 if (ai
->ai_family
== AF_INET6
) {
587 ret
= set_ipv6_only(lfd
);
597 #endif /* IPV6_V6ONLY */
601 set_mtu_disc_dont(lfd
);
603 ret
= bind(lfd
, ai
->ai_addr
, ai
->ai_addrlen
);
611 ret
= listen(lfd
, 5);
620 ipv4
= (ai
->ai_family
== AF_INET6
? 0 :
621 (ai
->ai_family
== AF_INET
? 1 : -1));
624 syslog_maybe(auth_log
, LOG_INFO
, "curvetun on IPv%d via %s "
625 "on port %s!\n", ai
->ai_family
== AF_INET
? 4 : 6,
626 udp
? "UDP" : "TCP", port
);
627 syslog_maybe(auth_log
, LOG_INFO
, "Allowed overlay proto is "
628 "IPv%d!\n", ipv4
? 4 : 6);
633 if (lfd
< 0 || ipv4
< 0)
634 syslog_panic("Cannot create socket!\n");
636 tunfd
= tun_open_or_die(dev
? dev
: DEVNAME_SERVER
, IFF_TUN
| IFF_NO_PI
);
638 pipe_or_die(efd
, O_NONBLOCK
);
639 pipe_or_die(refd
, O_NONBLOCK
);
641 set_nonblocking(lfd
);
643 events
= xzmalloc(MAX_EPOLL_SIZE
* sizeof(*events
));
644 for (i
= 0; i
< MAX_EPOLL_SIZE
; ++i
)
645 events
[i
].data
.fd
= -1;
647 kdpfd
= epoll_create(MAX_EPOLL_SIZE
);
649 syslog_panic("Cannot create socket!\n");
651 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, lfd
,
652 udp
? EPOLLIN
| EPOLLET
| EPOLLONESHOT
: EPOLLIN
);
653 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, efd
[0], EPOLLIN
);
654 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, refd
[0], EPOLLIN
);
655 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, tunfd
,
656 EPOLLIN
| EPOLLET
| EPOLLONESHOT
);
661 cpus
= get_number_cpus_online();
662 threads
= cpus
* THREADS_PER_CPU
;
663 if (!ispow2(threads
))
664 syslog_panic("Thread number not power of two!\n");
666 threadpool
= xzmalloc(sizeof(*threadpool
) * threads
);
667 thread_spawn_or_panic(cpus
, efd
[1], refd
[1], tunfd
, ipv4
, udp
);
669 init_cpusched(threads
);
671 register_socket(tunfd
);
672 register_socket(lfd
);
674 syslog(LOG_INFO
, "curvetun up and running!\n");
676 while (likely(!sigint
)) {
677 nfds
= epoll_wait(kdpfd
, events
, curfds
, -1);
679 syslog(LOG_ERR
, "epoll_wait error: %s\n",
684 for (i
= 0; i
< nfds
; ++i
) {
685 if (unlikely(events
[i
].data
.fd
< 0))
688 if (events
[i
].data
.fd
== lfd
&& !udp
) {
690 char hbuff
[256], sbuff
[256];
691 struct sockaddr_storage taddr
;
694 tlen
= sizeof(taddr
);
695 nfd
= accept(lfd
, (struct sockaddr
*) &taddr
,
698 syslog(LOG_ERR
, "accept error: %s\n",
703 if (curfds
+ 1 > MAX_EPOLL_SIZE
) {
710 ncpu
= register_socket(nfd
);
712 memset(hbuff
, 0, sizeof(hbuff
));
713 memset(sbuff
, 0, sizeof(sbuff
));
714 getnameinfo((struct sockaddr
*) &taddr
, tlen
,
715 hbuff
, sizeof(hbuff
),
716 sbuff
, sizeof(sbuff
),
717 NI_NUMERICHOST
| NI_NUMERICSERV
);
719 syslog_maybe(auth_log
, LOG_INFO
, "New connection "
720 "from %s:%s (%d active client connections) - id %d on CPU%d",
721 hbuff
, sbuff
, curfds
-4, nfd
, ncpu
);
723 set_nonblocking(nfd
);
724 set_socket_keepalive(nfd
);
725 set_tcp_nodelay(nfd
);
726 ret
= set_epoll_descriptor2(kdpfd
, EPOLL_CTL_ADD
,
727 nfd
, EPOLLIN
| EPOLLET
| EPOLLONESHOT
);
733 } else if (events
[i
].data
.fd
== refd
[0]) {
736 ret
= read_exact(refd
[0], &fd_one
,
738 if (ret
!= sizeof(fd_one
) || fd_one
<= 0)
741 ret
= set_epoll_descriptor2(kdpfd
, EPOLL_CTL_MOD
,
742 fd_one
, EPOLLIN
| EPOLLET
| EPOLLONESHOT
);
747 } else if (events
[i
].data
.fd
== efd
[0]) {
750 ret
= read_exact(efd
[0], &fd_del
,
752 if (ret
!= sizeof(fd_del
) || fd_del
<= 0)
755 ret
= read(fd_del
, &test
, sizeof(test
));
756 if (ret
< 0 && errno
== EBADF
)
759 ret
= set_epoll_descriptor2(kdpfd
, EPOLL_CTL_DEL
,
768 unregister_socket(fd_del
);
770 syslog_maybe(auth_log
, LOG_INFO
, "Closed connection "
771 "with id %d (%d active client connections remain)\n", fd_del
,
774 int cpu
, fd_work
= events
[i
].data
.fd
;
777 cpu
= socket_to_cpu(fd_work
);
779 udp_cpu
= (udp_cpu
+ 1) & (threads
- 1);
781 write_exact(threadpool
[udp
? udp_cpu
: cpu
].efd
[1],
782 &fd_work
, sizeof(fd_work
), 1);
787 syslog(LOG_INFO
, "curvetun prepare shut down!\n");
801 unregister_socket(lfd
);
802 unregister_socket(tunfd
);
808 destroy_user_store();
810 syslog(LOG_INFO
, "curvetun shut down!\n");