summaryrefslogtreecommitdiff
path: root/tcp-proxy
diff options
context:
space:
mode:
authorAdam Ierymenko <adam.ierymenko@gmail.com>2015-05-22 14:52:23 -0700
committerAdam Ierymenko <adam.ierymenko@gmail.com>2015-05-22 14:52:23 -0700
commit9774f789f21c05267ef35cc35684b0a7ce2efb2a (patch)
tree8ca8c0c0ac9910f7d40845ddf419120ea56fbb48 /tcp-proxy
parentcdec05af24f129ed12cf2b43eaa876521c358a0b (diff)
downloadinfinitytier-9774f789f21c05267ef35cc35684b0a7ce2efb2a.tar.gz
infinitytier-9774f789f21c05267ef35cc35684b0a7ce2efb2a.zip
TCP fallback tunneling is now working. That hurt more than expected.
Diffstat (limited to 'tcp-proxy')
-rw-r--r--tcp-proxy/tcp-proxy.cpp184
1 files changed, 83 insertions, 101 deletions
diff --git a/tcp-proxy/tcp-proxy.cpp b/tcp-proxy/tcp-proxy.cpp
index cbc3d0cc..f7ba2c2f 100644
--- a/tcp-proxy/tcp-proxy.cpp
+++ b/tcp-proxy/tcp-proxy.cpp
@@ -25,6 +25,17 @@
* LLC. Start here: http://www.zerotier.com/
*/
+// HACK! Will eventually use epoll() or something in Phy<> instead of select().
+// Also be sure to change ulimit -n and fs.file-max in /etc/sysctl.conf on relays.
+#if defined(__linux__) || defined(__LINUX__) || defined(__LINUX) || defined(LINUX)
+#include <linux/posix_types.h>
+#include <bits/types.h>
+#undef __FD_SETSIZE
+#define __FD_SETSIZE 1048576
+#undef FD_SETSIZE
+#define FD_SETSIZE 1048576
+#endif
+
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
@@ -41,10 +52,7 @@
#include "../osdep/Phy.hpp"
-#define ZT_TCP_PROXY_UDP_POOL_SIZE 1024
-#define ZT_TCP_PROXY_UDP_POOL_START_PORT 10000
#define ZT_TCP_PROXY_CONNECTION_TIMEOUT_SECONDS 300
-
#define ZT_TCP_PROXY_TCP_PORT 443
using namespace ZeroTier;
@@ -90,8 +98,7 @@ struct TcpProxyService;
struct TcpProxyService
{
Phy<TcpProxyService *> *phy;
- PhySocket *udpPool[ZT_TCP_PROXY_UDP_POOL_SIZE];
-
+ int udpPortCounter;
struct Client
{
char tcpReadBuf[131072];
@@ -99,99 +106,101 @@ struct TcpProxyService
unsigned long tcpWritePtr;
unsigned long tcpReadPtr;
PhySocket *tcp;
- PhySocket *assignedUdp;
+ PhySocket *udp;
time_t lastActivity;
bool newVersion;
};
-
std::map< PhySocket *,Client > clients;
- struct ReverseMappingKey
+ PhySocket *getUnusedUdp(void *uptr)
{
- uint64_t sourceZTAddress;
- PhySocket *sendingUdpSocket;
- uint32_t destIp;
- unsigned int destPort;
-
- ReverseMappingKey() {}
- ReverseMappingKey(uint64_t zt,PhySocket *s,uint32_t ip,unsigned int port) : sourceZTAddress(zt),sendingUdpSocket(s),destIp(ip),destPort(port) {}
- inline bool operator<(const ReverseMappingKey &k) const throw() { return (memcmp((const void *)this,(const void *)&k,sizeof(ReverseMappingKey)) < 0); }
- inline bool operator==(const ReverseMappingKey &k) const throw() { return (memcmp((const void *)this,(const void *)&k,sizeof(ReverseMappingKey)) == 0); }
- };
-
- std::map< ReverseMappingKey,Client * > reverseMappings;
+ for(int i=0;i<65535;++i) {
+ ++udpPortCounter;
+ if (udpPortCounter > 0xfffe)
+ udpPortCounter = 1024;
+ struct sockaddr_in laddr;
+ memset(&laddr,0,sizeof(struct sockaddr_in));
+ laddr.sin_family = AF_INET;
+ laddr.sin_port = htons((uint16_t)udpPortCounter);
+ PhySocket *udp = phy->udpBind(reinterpret_cast<struct sockaddr *>(&laddr),uptr);
+ if (udp)
+ return udp;
+ }
+ return (PhySocket *)0;
+ }
void phyOnDatagram(PhySocket *sock,void **uptr,const struct sockaddr *from,void *data,unsigned long len)
{
- if ((from->sa_family == AF_INET)&&(len > 16)&&(len < 2048)) {
- const uint64_t destZt = (
- (((uint64_t)(((const unsigned char *)data)[8])) << 32) |
- (((uint64_t)(((const unsigned char *)data)[9])) << 24) |
- (((uint64_t)(((const unsigned char *)data)[10])) << 16) |
- (((uint64_t)(((const unsigned char *)data)[11])) << 8) |
- ((uint64_t)(((const unsigned char *)data)[12])) );
- const uint32_t fromIp = ((const struct sockaddr_in *)from)->sin_addr.s_addr;
- const unsigned int fromPort = ntohs(((const struct sockaddr_in *)from)->sin_port);
-
- std::map< ReverseMappingKey,Client * >::iterator rm(reverseMappings.find(ReverseMappingKey(destZt,sock,fromIp,fromPort)));
- if (rm != reverseMappings.end()) {
- Client &c = *(rm->second);
-
- unsigned long mlen = len;
- if (c.newVersion)
- mlen += 7; // new clients get IP info
-
- if ((c.tcpWritePtr + 5 + mlen) <= sizeof(c.tcpWriteBuf)) {
- if (!c.tcpWritePtr)
- phy->tcpSetNotifyWritable(c.tcp,true);
-
- c.tcpWriteBuf[c.tcpWritePtr++] = 0x17; // look like TLS data
- c.tcpWriteBuf[c.tcpWritePtr++] = 0x03; // look like TLS 1.2
- c.tcpWriteBuf[c.tcpWritePtr++] = 0x03; // look like TLS 1.2
-
- c.tcpWriteBuf[c.tcpWritePtr++] = (char)((mlen >> 8) & 0xff);
- c.tcpWriteBuf[c.tcpWritePtr++] = (char)(mlen & 0xff);
-
- if (c.newVersion) {
- c.tcpWriteBuf[c.tcpWritePtr++] = (char)4; // IPv4
- *((uint32_t *)(c.tcpWriteBuf + c.tcpWritePtr)) = fromIp;
- c.tcpWritePtr += 4;
- c.tcpWriteBuf[c.tcpWritePtr++] = (char)((fromPort >> 8) & 0xff);
- c.tcpWriteBuf[c.tcpWritePtr++] = (char)(fromPort & 0xff);
- }
+ if (!*uptr)
+ return;
+ if ((from->sa_family == AF_INET)&&(len >= 16)&&(len < 2048)) {
+ Client &c = *((Client *)*uptr);
+ c.lastActivity = time((time_t *)0);
+
+ unsigned long mlen = len;
+ if (c.newVersion)
+ mlen += 7; // new clients get IP info
+
+ if ((c.tcpWritePtr + 5 + mlen) <= sizeof(c.tcpWriteBuf)) {
+ if (!c.tcpWritePtr)
+ phy->tcpSetNotifyWritable(c.tcp,true);
+
+ c.tcpWriteBuf[c.tcpWritePtr++] = 0x17; // look like TLS data
+ c.tcpWriteBuf[c.tcpWritePtr++] = 0x03; // look like TLS 1.2
+ c.tcpWriteBuf[c.tcpWritePtr++] = 0x03; // look like TLS 1.2
+
+ c.tcpWriteBuf[c.tcpWritePtr++] = (char)((mlen >> 8) & 0xff);
+ c.tcpWriteBuf[c.tcpWritePtr++] = (char)(mlen & 0xff);
- for(unsigned long i=0;i<len;++i)
- c.tcpWriteBuf[c.tcpWritePtr++] = ((const char *)data)[i];
+ if (c.newVersion) {
+ c.tcpWriteBuf[c.tcpWritePtr++] = (char)4; // IPv4
+ *((uint32_t *)(c.tcpWriteBuf + c.tcpWritePtr)) = ((const struct sockaddr_in *)from)->sin_addr.s_addr;
+ c.tcpWritePtr += 4;
+ *((uint16_t *)(c.tcpWriteBuf + c.tcpWritePtr)) = ((const struct sockaddr_in *)from)->sin_port;
+ c.tcpWritePtr += 2;
}
+
+ for(unsigned long i=0;i<len;++i)
+ c.tcpWriteBuf[c.tcpWritePtr++] = ((const char *)data)[i];
}
+
+ //printf("<< UDP %s:%d -> %.16llx\n",inet_ntoa(reinterpret_cast<const struct sockaddr_in *>(from)->sin_addr),(int)ntohs(reinterpret_cast<const struct sockaddr_in *>(from)->sin_port),(unsigned long long)&c);
}
}
void phyOnTcpConnect(PhySocket *sock,void **uptr,bool success)
{
- // unused, we don't initiate
+ // unused, we don't initiate outbound connections
}
void phyOnTcpAccept(PhySocket *sockL,PhySocket *sockN,void **uptrL,void **uptrN,const struct sockaddr *from)
{
Client &c = clients[sockN];
+ PhySocket *udp = getUnusedUdp((void *)&c);
+ if (!udp) {
+ phy->close(sockN);
+ clients.erase(sockN);
+ //printf("** TCP rejected, no more UDP ports to assign\n");
+ return;
+ }
c.tcpWritePtr = 0;
c.tcpReadPtr = 0;
c.tcp = sockN;
- c.assignedUdp = udpPool[rand() % ZT_TCP_PROXY_UDP_POOL_SIZE];
+ c.udp = udp;
c.lastActivity = time((time_t *)0);
c.newVersion = false;
*uptrN = (void *)&c;
+ //printf("<< TCP from %s -> %.16llx\n",inet_ntoa(reinterpret_cast<const struct sockaddr_in *>(from)->sin_addr),(unsigned long long)&c);
}
void phyOnTcpClose(PhySocket *sock,void **uptr)
{
- for(std::map< ReverseMappingKey,Client * >::iterator rm(reverseMappings.begin());rm!=reverseMappings.end();) {
- if (rm->second == (Client *)*uptr)
- reverseMappings.erase(rm++);
- else ++rm;
- }
+ if (!*uptr)
+ return;
+ Client &c = *((Client *)*uptr);
+ phy->close(c.udp);
clients.erase(sock);
+ //printf("** TCP %.16llx closed\n",(unsigned long long)*uptr);
}
void phyOnTcpData(PhySocket *sock,void **uptr,void *data,unsigned long len)
@@ -212,6 +221,7 @@ struct TcpProxyService
if (mlen == 4) {
// Right now just sending this means the client is 'new enough' for the IP header
c.newVersion = true;
+ //printf("<< TCP %.16llx HELLO\n",(unsigned long long)*uptr);
} else if (mlen >= 7) {
char *payload = c.tcpReadBuf + 5;
unsigned long payloadLen = mlen;
@@ -241,22 +251,8 @@ struct TcpProxyService
// Note: we do not relay to privileged ports... just an abuse prevention rule.
if ((ntohs(dest.sin_port) > 1024)&&(payloadLen >= 16)) {
- if ((payloadLen >= 28)&&(payload[13] != (char)0xff)) {
- // Learn reverse mappings -- we will route replies to these packets
- // back to their sending TCP socket. They're on a first come first
- // served basis.
- const uint64_t sourceZt = (
- (((uint64_t)(((const unsigned char *)payload)[13])) << 32) |
- (((uint64_t)(((const unsigned char *)payload)[14])) << 24) |
- (((uint64_t)(((const unsigned char *)payload)[15])) << 16) |
- (((uint64_t)(((const unsigned char *)payload)[16])) << 8) |
- ((uint64_t)(((const unsigned char *)payload)[17])) );
- ReverseMappingKey k(sourceZt,c.assignedUdp,dest.sin_addr.s_addr,ntohl(dest.sin_port));
- if (reverseMappings.count(k) == 0)
- reverseMappings[k] = &c;
- }
-
- phy->udpSend(c.assignedUdp,(const struct sockaddr *)&dest,payload,payloadLen);
+ phy->udpSend(c.udp,(const struct sockaddr *)&dest,payload,payloadLen);
+ //printf(">> TCP %.16llx to %s:%d\n",(unsigned long long)*uptr,inet_ntoa(dest.sin_addr),(int)ntohs(dest.sin_port));
}
}
@@ -284,11 +280,13 @@ struct TcpProxyService
std::vector<PhySocket *> toClose;
time_t now = time((time_t *)0);
for(std::map< PhySocket *,Client >::iterator c(clients.begin());c!=clients.end();++c) {
- if ((now - c->second.lastActivity) >= ZT_TCP_PROXY_CONNECTION_TIMEOUT_SECONDS)
+ if ((now - c->second.lastActivity) >= ZT_TCP_PROXY_CONNECTION_TIMEOUT_SECONDS) {
toClose.push_back(c->first);
+ toClose.push_back(c->second.udp);
+ }
}
for(std::vector<PhySocket *>::iterator s(toClose.begin());s!=toClose.end();++s)
- phy->close(*s); // will call phyOnTcpClose() which does cleanup
+ phy->close(*s);
}
};
@@ -299,25 +297,9 @@ int main(int argc,char **argv)
srand(time((time_t *)0));
TcpProxyService svc;
- Phy<TcpProxyService *> phy(&svc,true);
+ Phy<TcpProxyService *> phy(&svc,false);
svc.phy = &phy;
-
- {
- int poolSize = 0;
- for(unsigned int p=ZT_TCP_PROXY_UDP_POOL_START_PORT;((poolSize<ZT_TCP_PROXY_UDP_POOL_SIZE)&&(p<=65535));++p) {
- struct sockaddr_in laddr;
- memset(&laddr,0,sizeof(laddr));
- laddr.sin_family = AF_INET;
- laddr.sin_port = htons((uint16_t)p);
- PhySocket *s = phy.udpBind((const struct sockaddr *)&laddr);
- if (s)
- svc.udpPool[poolSize++] = s;
- }
- if (poolSize < ZT_TCP_PROXY_UDP_POOL_SIZE) {
- fprintf(stderr,"%s: fatal error: cannot bind %d UDP ports\n",argv[0],ZT_TCP_PROXY_UDP_POOL_SIZE);
- return 1;
- }
- }
+ svc.udpPortCounter = 1023;
{
struct sockaddr_in laddr;