2 * curvetun - the cipherspace wormhole creator
3 * Part of the netsniff-ng project
4 * Copyright 2011 Daniel Borkmann <daniel@netsniff-ng.org>,
5 * Subject to the GPL, version 2.
20 #include <netinet/in.h>
21 #include <netinet/tcp.h>
22 #include <netinet/udp.h>
24 #include <sys/types.h>
25 #include <sys/socket.h>
27 #include <sys/epoll.h>
28 #include <arpa/inet.h>
29 #include <linux/if_tun.h>
42 #include "ct_usermgmt.h"
54 struct worker_struct
{
58 struct parent_info parent
;
59 int (*handler
)(int fd
, const struct worker_struct
*ws
,
60 char *buff
, size_t len
);
61 struct curve25519_struct
*c
;
64 static struct worker_struct
*threadpool
= NULL
;
66 static int auth_log
= 1;
68 extern volatile sig_atomic_t sigint
;
70 static int handler_udp_tun_to_net(int fd
, const struct worker_struct
*ws
,
71 char *buff
, size_t len
) __pure
;
72 static int handler_udp_net_to_tun(int fd
, const struct worker_struct
*ws
,
73 char *buff
, size_t len
) __pure
;
74 static int handler_udp(int fd
, const struct worker_struct
*ws
,
75 char *buff
, size_t len
) __pure
;
76 static int handler_tcp_tun_to_net(int fd
, const struct worker_struct
*ws
,
77 char *buff
, size_t len
) __pure
;
78 static int handler_tcp_net_to_tun(int fd
, const struct worker_struct
*ws
,
79 char *buff
, size_t len
) __pure
;
80 static int handler_tcp(int fd
, const struct worker_struct
*ws
,
81 char *buff
, size_t len
) __pure
;
82 ssize_t
handler_tcp_read(int fd
, char *buff
, size_t len
);
83 static void *worker(void *self
) __pure
;
85 static int handler_udp_tun_to_net(int fd
, const struct worker_struct
*ws
,
86 char *buff
, size_t len
)
90 ssize_t rlen
, err
, clen
;
92 struct curve25519_proto
*p
;
93 struct sockaddr_storage naddr
;
95 size_t off
= sizeof(struct ct_proto
) + crypto_box_zerobytes
;
97 if (!buff
|| len
<= off
)
100 memset(buff
, 0, len
);
101 while ((rlen
= read(fd
, buff
+ off
, len
- off
)) > 0) {
102 dfd
= -1; nlen
= 0; p
= NULL
;
104 memset(&naddr
, 0, sizeof(naddr
));
106 hdr
= (struct ct_proto
*) buff
;
107 memset(hdr
, 0, sizeof(*hdr
));
110 trie_addr_lookup(buff
+ off
, rlen
, ws
->parent
.ipv4
, &dfd
, &naddr
,
112 if (unlikely(dfd
< 0 || nlen
== 0)) {
113 memset(buff
, 0, len
);
117 err
= get_user_by_sockaddr(&naddr
, nlen
, &p
);
118 if (unlikely(err
|| !p
)) {
119 memset(buff
, 0, len
);
123 clen
= curve25519_encode(ws
->c
, p
, (unsigned char *) (buff
+ off
-
124 crypto_box_zerobytes
), (rlen
+
125 crypto_box_zerobytes
), (unsigned char **)
127 if (unlikely(clen
<= 0)) {
128 memset(buff
, 0, len
);
132 hdr
->payload
= htons((uint16_t) clen
);
136 sendto(dfd
, hdr
, sizeof(struct ct_proto
), 0, (struct sockaddr
*)
138 sendto(dfd
, cbuff
, clen
, 0, (struct sockaddr
*) &naddr
, nlen
);
142 memset(buff
, 0, len
);
148 static void handler_udp_notify_close(int fd
, struct sockaddr_storage
*addr
)
152 memset(&hdr
, 0, sizeof(hdr
));
153 hdr
.flags
|= PROTO_FLAG_EXIT
;
156 sendto(fd
, &hdr
, sizeof(hdr
), 0, (struct sockaddr
*) addr
,
160 static int handler_udp_net_to_tun(int fd
, const struct worker_struct
*ws
,
161 char *buff
, size_t len
)
165 ssize_t rlen
, err
, clen
;
166 struct ct_proto
*hdr
;
167 struct curve25519_proto
*p
;
168 struct sockaddr_storage naddr
;
169 socklen_t nlen
= sizeof(naddr
);
174 memset(&naddr
, 0, sizeof(naddr
));
175 while ((rlen
= recvfrom(fd
, buff
, len
, 0, (struct sockaddr
*) &naddr
,
179 hdr
= (struct ct_proto
*) buff
;
181 if (unlikely(rlen
< sizeof(struct ct_proto
)))
183 if (unlikely(rlen
- sizeof(*hdr
) != ntohs(hdr
->payload
)))
185 if (unlikely(ntohs(hdr
->payload
) == 0))
187 if (hdr
->flags
& PROTO_FLAG_EXIT
) {
189 remove_user_by_sockaddr(&naddr
, nlen
);
190 trie_addr_remove_addr(&naddr
, nlen
);
191 handler_udp_notify_close(fd
, &naddr
);
195 if (hdr
->flags
& PROTO_FLAG_INIT
) {
196 syslog_maybe(auth_log
, LOG_INFO
, "Got initial userhash "
197 "from remote end!\n");
199 if (unlikely(rlen
- sizeof(*hdr
) <
200 sizeof(struct username_struct
)))
203 err
= try_register_user_by_sockaddr(ws
->c
,
204 buff
+ sizeof(struct ct_proto
),
205 rlen
- sizeof(struct ct_proto
),
206 &naddr
, nlen
, auth_log
);
213 err
= get_user_by_sockaddr(&naddr
, nlen
, &p
);
214 if (unlikely(err
|| !p
))
217 clen
= curve25519_decode(ws
->c
, p
, (unsigned char *) buff
+
218 sizeof(struct ct_proto
),
219 rlen
- sizeof(struct ct_proto
),
220 (unsigned char **) &cbuff
, NULL
);
221 if (unlikely(clen
<= 0))
224 cbuff
+= crypto_box_zerobytes
;
225 clen
-= crypto_box_zerobytes
;
227 err
= trie_addr_maybe_update(cbuff
, clen
, ws
->parent
.ipv4
,
232 err
= write(ws
->parent
.tunfd
, cbuff
, clen
);
234 nlen
= sizeof(naddr
);
235 memset(&naddr
, 0, sizeof(naddr
));
241 static int handler_udp(int fd
, const struct worker_struct
*ws
,
242 char *buff
, size_t len
)
246 if (fd
== ws
->parent
.tunfd
)
247 ret
= handler_udp_tun_to_net(fd
, ws
, buff
, len
);
249 ret
= handler_udp_net_to_tun(fd
, ws
, buff
, len
);
254 static int handler_tcp_tun_to_net(int fd
, const struct worker_struct
*ws
,
255 char *buff
, size_t len
)
259 ssize_t rlen
, err
, clen
;
260 struct ct_proto
*hdr
;
261 struct curve25519_proto
*p
;
263 size_t off
= sizeof(struct ct_proto
) + crypto_box_zerobytes
;
265 if (!buff
|| len
<= off
)
268 memset(buff
, 0, len
);
269 while ((rlen
= read(fd
, buff
+ off
, len
- off
)) > 0) {
272 hdr
= (struct ct_proto
*) buff
;
273 memset(hdr
, 0, sizeof(*hdr
));
276 trie_addr_lookup(buff
+ off
, rlen
, ws
->parent
.ipv4
, &dfd
, NULL
,
278 if (unlikely(dfd
< 0)) {
279 memset(buff
, 0, len
);
283 err
= get_user_by_socket(dfd
, &p
);
284 if (unlikely(err
|| !p
)) {
285 memset(buff
, 0, len
);
289 clen
= curve25519_encode(ws
->c
, p
, (unsigned char *) (buff
+ off
-
290 crypto_box_zerobytes
), (rlen
+
291 crypto_box_zerobytes
), (unsigned char **)
293 if (unlikely(clen
<= 0)) {
294 memset(buff
, 0, len
);
298 hdr
->payload
= htons((uint16_t) clen
);
302 write_exact(dfd
, hdr
, sizeof(struct ct_proto
), 0);
303 write_exact(dfd
, cbuff
, clen
, 0);
307 memset(buff
, 0, len
);
313 ssize_t
handler_tcp_read(int fd
, char *buff
, size_t len
)
316 struct ct_proto
*hdr
= (struct ct_proto
*) buff
;
321 /* May exit on EAGAIN if 0 Byte read */
322 rlen
= read_exact(fd
, buff
, sizeof(struct ct_proto
), 1);
325 if (unlikely(ntohs(hdr
->payload
) > len
- sizeof(struct ct_proto
))) {
327 return 1; /* Force server to close connection */
330 /* May not exit on EAGAIN if 0 Byte read */
331 rlen
= read_exact(fd
, buff
+ sizeof(struct ct_proto
),
332 ntohs(hdr
->payload
), 0);
336 return sizeof(struct ct_proto
) + rlen
;
339 static void handler_tcp_notify_close(int fd
)
343 memset(&hdr
, 0, sizeof(hdr
));
344 hdr
.flags
|= PROTO_FLAG_EXIT
;
347 if (write(fd
, &hdr
, sizeof(hdr
))) { ; }
350 static int handler_tcp_net_to_tun(int fd
, const struct worker_struct
*ws
,
351 char *buff
, size_t len
)
353 int keep
= 1, count
= 0;
355 ssize_t rlen
, err
, clen
;
356 struct ct_proto
*hdr
;
357 struct curve25519_proto
*p
;
362 while ((rlen
= handler_tcp_read(fd
, buff
, len
)) > 0) {
365 hdr
= (struct ct_proto
*) buff
;
367 if (unlikely(rlen
< sizeof(struct ct_proto
)))
369 if (unlikely(rlen
- sizeof(*hdr
) != ntohs(hdr
->payload
)))
371 if (unlikely(ntohs(hdr
->payload
) == 0))
373 if (hdr
->flags
& PROTO_FLAG_EXIT
) {
375 remove_user_by_socket(fd
);
376 trie_addr_remove(fd
);
377 handler_tcp_notify_close(fd
);
378 rlen
= write(ws
->parent
.efd
, &fd
, sizeof(fd
));
383 if (hdr
->flags
& PROTO_FLAG_INIT
) {
384 syslog_maybe(auth_log
, LOG_INFO
, "Got initial userhash "
385 "from remote end!\n");
387 if (unlikely(rlen
- sizeof(*hdr
) <
388 sizeof(struct username_struct
)))
391 err
= try_register_user_by_socket(ws
->c
,
392 buff
+ sizeof(struct ct_proto
),
393 rlen
- sizeof(struct ct_proto
),
401 err
= get_user_by_socket(fd
, &p
);
402 if (unlikely(err
|| !p
))
405 clen
= curve25519_decode(ws
->c
, p
, (unsigned char *) buff
+
406 sizeof(struct ct_proto
),
407 rlen
- sizeof(struct ct_proto
),
408 (unsigned char **) &cbuff
, NULL
);
409 if (unlikely(clen
<= 0))
412 cbuff
+= crypto_box_zerobytes
;
413 clen
-= crypto_box_zerobytes
;
415 err
= trie_addr_maybe_update(cbuff
, clen
, ws
->parent
.ipv4
,
420 err
= write(ws
->parent
.tunfd
, cbuff
, clen
);
424 write_exact(ws
->efd
[1], &fd
, sizeof(fd
), 1);
425 /* Read later next data and let others process */
433 static int handler_tcp(int fd
, const struct worker_struct
*ws
,
434 char *buff
, size_t len
)
438 if (fd
== ws
->parent
.tunfd
)
439 ret
= handler_tcp_tun_to_net(fd
, ws
, buff
, len
);
441 ret
= handler_tcp_net_to_tun(fd
, ws
, buff
, len
);
446 static void *worker(void *self
)
450 size_t blen
= TUNBUFF_SIZ
; //FIXME
451 const struct worker_struct
*ws
= self
;
458 curve25519_alloc_or_maybe_die(ws
->c
);
460 buff
= xmalloc_aligned(blen
, 64);
462 syslog(LOG_INFO
, "curvetun thread on CPU%u up!\n", ws
->cpu
);
464 pthread_cleanup_push(xfree_func
, ws
->c
);
465 pthread_cleanup_push(curve25519_free
, ws
->c
);
466 pthread_cleanup_push(xfree_func
, buff
);
468 while (likely(!sigint
)) {
470 if ((fds
.revents
& POLLIN
) != POLLIN
)
473 pthread_setcancelstate(PTHREAD_CANCEL_DISABLE
, &old_state
);
475 while ((ret
= read_exact(ws
->efd
[0], &fd
, sizeof(fd
), 1)) > 0) {
476 if (ret
!= sizeof(fd
)) {
481 ret
= ws
->handler(fd
, ws
, buff
, blen
);
483 write_exact(ws
->parent
.refd
, &fd
, sizeof(fd
), 1);
486 pthread_setcancelstate(old_state
, NULL
);
489 syslog(LOG_INFO
, "curvetun thread on CPU%u down!\n", ws
->cpu
);
491 pthread_cleanup_pop(1);
492 pthread_cleanup_pop(1);
493 pthread_cleanup_pop(1);
495 pthread_exit((void *) ((long) ws
->cpu
));
498 static void thread_spawn_or_panic(unsigned int cpus
, int efd
, int refd
,
499 int tunfd
, int ipv4
, int udp
)
503 unsigned int threads
;
505 threads
= cpus
* THREADS_PER_CPU
;
507 for (i
= 0; i
< threads
; ++i
) {
509 threadpool
[i
].cpu
= i
% cpus
;
510 CPU_SET(threadpool
[i
].cpu
, &cpuset
);
512 ret
= pipe2(threadpool
[i
].efd
, O_NONBLOCK
);
514 syslog_panic("Cannot create event socket!\n");
516 threadpool
[i
].c
= xmalloc_aligned(sizeof(*threadpool
[i
].c
), 64);
517 threadpool
[i
].parent
.efd
= efd
;
518 threadpool
[i
].parent
.refd
= refd
;
519 threadpool
[i
].parent
.tunfd
= tunfd
;
520 threadpool
[i
].parent
.ipv4
= ipv4
;
521 threadpool
[i
].parent
.udp
= udp
;
522 threadpool
[i
].handler
= udp
? handler_udp
: handler_tcp
;
524 ret
= pthread_create(&threadpool
[i
].trid
, NULL
,
525 worker
, &threadpool
[i
]);
527 syslog_panic("Thread creation failed!\n");
529 ret
= pthread_setaffinity_np(threadpool
[i
].trid
,
530 sizeof(cpuset
), &cpuset
);
532 syslog_panic("Thread CPU migration failed!\n");
534 pthread_detach(threadpool
[i
].trid
);
540 static void thread_finish(unsigned int cpus
)
543 unsigned int threads
;
545 threads
= cpus
* THREADS_PER_CPU
;
547 for (i
= 0; i
< threads
; ++i
) {
548 while (pthread_join(threadpool
[i
].trid
, NULL
) < 0)
551 close(threadpool
[i
].efd
[0]);
552 close(threadpool
[i
].efd
[1]);
556 int server_main(char *home
, char *dev
, char *port
, int udp
, int ipv4
, int log
)
558 int lfd
= -1, kdpfd
, nfds
, nfd
, curfds
, efd
[2], refd
[2], tunfd
, i
;
559 unsigned int cpus
= 0, threads
, udp_cpu
= 0;
561 struct epoll_event
*events
;
562 struct addrinfo hints
, *ahead
, *ai
;
565 openlog("curvetun", LOG_PID
| LOG_CONS
| LOG_NDELAY
, LOG_DAEMON
);
567 syslog(LOG_INFO
, "curvetun server booting!\n");
568 syslog_maybe(!auth_log
, LOG_INFO
, "curvetun user logging disabled!\n");
570 parse_userfile_and_generate_user_store_or_die(home
);
572 memset(&hints
, 0, sizeof(hints
));
573 hints
.ai_family
= PF_UNSPEC
;
574 hints
.ai_socktype
= udp
? SOCK_DGRAM
: SOCK_STREAM
;
575 hints
.ai_protocol
= udp
? IPPROTO_UDP
: IPPROTO_TCP
;
576 hints
.ai_flags
= AI_PASSIVE
;
578 ret
= getaddrinfo(NULL
, port
, &hints
, &ahead
);
580 syslog_panic("Cannot get address info!\n");
582 for (ai
= ahead
; ai
!= NULL
&& lfd
< 0; ai
= ai
->ai_next
) {
583 lfd
= socket(ai
->ai_family
, ai
->ai_socktype
, ai
->ai_protocol
);
586 if (ai
->ai_family
== AF_INET6
) {
588 ret
= set_ipv6_only(lfd
);
598 #endif /* IPV6_V6ONLY */
602 set_mtu_disc_dont(lfd
);
604 ret
= bind(lfd
, ai
->ai_addr
, ai
->ai_addrlen
);
612 ret
= listen(lfd
, 5);
621 ipv4
= (ai
->ai_family
== AF_INET6
? 0 :
622 (ai
->ai_family
== AF_INET
? 1 : -1));
625 syslog_maybe(auth_log
, LOG_INFO
, "curvetun on IPv%d via %s "
626 "on port %s!\n", ai
->ai_family
== AF_INET
? 4 : 6,
627 udp
? "UDP" : "TCP", port
);
628 syslog_maybe(auth_log
, LOG_INFO
, "Allowed overlay proto is "
629 "IPv%d!\n", ipv4
? 4 : 6);
634 if (lfd
< 0 || ipv4
< 0)
635 syslog_panic("Cannot create socket!\n");
637 tunfd
= tun_open_or_die(dev
? dev
: DEVNAME_SERVER
, IFF_TUN
| IFF_NO_PI
);
639 pipe_or_die(efd
, O_NONBLOCK
);
640 pipe_or_die(refd
, O_NONBLOCK
);
642 set_nonblocking(lfd
);
644 events
= xzmalloc(MAX_EPOLL_SIZE
* sizeof(*events
));
645 for (i
= 0; i
< MAX_EPOLL_SIZE
; ++i
)
646 events
[i
].data
.fd
= -1;
648 kdpfd
= epoll_create(MAX_EPOLL_SIZE
);
650 syslog_panic("Cannot create socket!\n");
652 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, lfd
,
653 udp
? EPOLLIN
| EPOLLET
| EPOLLONESHOT
: EPOLLIN
);
654 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, efd
[0], EPOLLIN
);
655 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, refd
[0], EPOLLIN
);
656 set_epoll_descriptor(kdpfd
, EPOLL_CTL_ADD
, tunfd
,
657 EPOLLIN
| EPOLLET
| EPOLLONESHOT
);
662 cpus
= get_number_cpus_online();
663 threads
= cpus
* THREADS_PER_CPU
;
664 if (!ispow2(threads
))
665 syslog_panic("Thread number not power of two!\n");
667 threadpool
= xzmalloc(sizeof(*threadpool
) * threads
);
668 thread_spawn_or_panic(cpus
, efd
[1], refd
[1], tunfd
, ipv4
, udp
);
670 init_cpusched(threads
);
672 register_socket(tunfd
);
673 register_socket(lfd
);
675 syslog(LOG_INFO
, "curvetun up and running!\n");
677 while (likely(!sigint
)) {
678 nfds
= epoll_wait(kdpfd
, events
, curfds
, -1);
680 syslog(LOG_ERR
, "epoll_wait error: %s\n",
685 for (i
= 0; i
< nfds
; ++i
) {
686 if (unlikely(events
[i
].data
.fd
< 0))
689 if (events
[i
].data
.fd
== lfd
&& !udp
) {
691 char hbuff
[256], sbuff
[256];
692 struct sockaddr_storage taddr
;
695 tlen
= sizeof(taddr
);
696 nfd
= accept(lfd
, (struct sockaddr
*) &taddr
,
699 syslog(LOG_ERR
, "accept error: %s\n",
704 if (curfds
+ 1 > MAX_EPOLL_SIZE
) {
711 ncpu
= register_socket(nfd
);
713 memset(hbuff
, 0, sizeof(hbuff
));
714 memset(sbuff
, 0, sizeof(sbuff
));
715 getnameinfo((struct sockaddr
*) &taddr
, tlen
,
716 hbuff
, sizeof(hbuff
),
717 sbuff
, sizeof(sbuff
),
718 NI_NUMERICHOST
| NI_NUMERICSERV
);
720 syslog_maybe(auth_log
, LOG_INFO
, "New connection "
721 "from %s:%s (%d active client connections) - id %d on CPU%d",
722 hbuff
, sbuff
, curfds
-4, nfd
, ncpu
);
724 set_nonblocking(nfd
);
725 set_socket_keepalive(nfd
);
726 set_tcp_nodelay(nfd
);
727 ret
= set_epoll_descriptor2(kdpfd
, EPOLL_CTL_ADD
,
728 nfd
, EPOLLIN
| EPOLLET
| EPOLLONESHOT
);
734 } else if (events
[i
].data
.fd
== refd
[0]) {
737 ret
= read_exact(refd
[0], &fd_one
,
739 if (ret
!= sizeof(fd_one
) || fd_one
<= 0)
742 ret
= set_epoll_descriptor2(kdpfd
, EPOLL_CTL_MOD
,
743 fd_one
, EPOLLIN
| EPOLLET
| EPOLLONESHOT
);
748 } else if (events
[i
].data
.fd
== efd
[0]) {
751 ret
= read_exact(efd
[0], &fd_del
,
753 if (ret
!= sizeof(fd_del
) || fd_del
<= 0)
756 ret
= read(fd_del
, &test
, sizeof(test
));
757 if (ret
< 0 && errno
== EBADF
)
760 ret
= set_epoll_descriptor2(kdpfd
, EPOLL_CTL_DEL
,
769 unregister_socket(fd_del
);
771 syslog_maybe(auth_log
, LOG_INFO
, "Closed connection "
772 "with id %d (%d active client connections remain)\n", fd_del
,
775 int cpu
, fd_work
= events
[i
].data
.fd
;
778 cpu
= socket_to_cpu(fd_work
);
780 udp_cpu
= (udp_cpu
+ 1) & (threads
- 1);
782 write_exact(threadpool
[udp
? udp_cpu
: cpu
].efd
[1],
783 &fd_work
, sizeof(fd_work
), 1);
788 syslog(LOG_INFO
, "curvetun prepare shut down!\n");
802 unregister_socket(lfd
);
803 unregister_socket(tunfd
);
809 destroy_user_store();
811 syslog(LOG_INFO
, "curvetun shut down!\n");