gnunet-daemon-exit.c File Reference

tool to allow IP traffic exit from the GNUnet cadet to the Internet More...

#include "gnunet_common.h"
#include "gnunet_pils_service.h"
#include "platform.h"
#include "gnunet_util_lib.h"
#include "gnunet_protocols.h"
#include "gnunet_applications.h"
#include "gnunet_dht_service.h"
#include "gnunet_cadet_service.h"
#include "gnunet_statistics_service.h"
#include "gnunet_signatures.h"
#include "gnunet_regex_service.h"
#include "exit.h"
#include "block_dns.h"

Include dependency graph for gnunet-daemon-exit.c:

Go to the source code of this file.

Data Structures
struct	SocketAddress
	Information about an address. More...
struct	LocalService
	This struct is saved into the services-hashmap to represent a service this peer is specifically offering an exit for (for a specific domain name). More...
struct	RedirectInformation
	Information we use to track a connection (the classical 6-tuple of IP-version, protocol, source-IP, destination-IP, source-port and destinatin-port. More...
struct	ChannelState
	This struct is saved into connections_map to allow finding the right channel given an IP packet from TUN. More...
struct	DnsResponseMessage
	Message with a DNS response. More...

Macros
#define	REGEX_MAX_PATH_LEN_IPV4   4
	Maximum path compression length for cadet regex announcing for IPv4 address based regex.
#define	REGEX_MAX_PATH_LEN_IPV6   8
	Maximum path compression length for cadet regex announcing for IPv6 address based regex.
#define	REGEX_REFRESH_FREQUENCY
	How frequently do we re-announce the regex for the exit?
#define	DHT_PUT_FREQUENCY
	How frequently do we re-announce the DNS exit in the DHT?
#define	DNS_ADVERTISEMENT_TIMEOUT
	How long do we typically sign the DNS exit advertisement for?
#define	LOG(kind, ...)    GNUNET_log_from (kind, "exit", __VA_ARGS__);
	Generic logging shorthand.

Functions
static GNUNET_NETWORK_STRUCT_END void	process_dns_result (void *cls, const struct GNUNET_TUN_DnsHeader *dns, size_t r)
	Callback called from DNSSTUB resolver when a resolution succeeded.
static int	check_dns_request (void *cls, const struct DnsResponseMessage *msg)
	Check a request via cadet to perform a DNS query.
static void	handle_dns_request (void *cls, const struct DnsResponseMessage *msg)
	Process a request via cadet to perform a DNS query.
static void	hash_redirect_info (struct GNUNET_HashCode *hash, const struct RedirectInformation *ri)
	Given IP information about a connection, calculate the respective hash we would use for the connections_map.
static struct ChannelState *	get_redirect_state (int af, int protocol, const void *destination_ip, uint16_t destination_port, const void *local_ip, uint16_t local_port, struct GNUNET_HashCode *state_key)
	Get our connection tracking state.
static int	check_tcp_service (void *cls, const struct GNUNET_EXIT_TcpServiceStartMessage *start)
	Check a request via cadet to send a request to a TCP service offered by this system.
static void	prepare_ipv4_packet (const void *payload, size_t payload_length, int protocol, const struct GNUNET_TUN_TcpHeader *tcp_header, const struct SocketAddress *src_address, const struct SocketAddress *dst_address, struct GNUNET_TUN_IPv4Header *pkt4)
	Prepare an IPv4 packet for transmission via the TUN interface.
static void	prepare_ipv6_packet (const void *payload, size_t payload_length, int protocol, const struct GNUNET_TUN_TcpHeader *tcp_header, const struct SocketAddress *src_address, const struct SocketAddress *dst_address, struct GNUNET_TUN_IPv6Header *pkt6)
	Prepare an IPv6 packet for transmission via the TUN interface.
static void	send_tcp_packet_via_tun (const struct SocketAddress *destination_address, const struct SocketAddress *source_address, const struct GNUNET_TUN_TcpHeader *tcp_header, const void *payload, size_t payload_length)
	Send a TCP packet via the TUN interface.
static void	send_icmp_packet_via_tun (const struct SocketAddress *destination_address, const struct SocketAddress *source_address, const struct GNUNET_TUN_IcmpHeader *icmp_header, const void *payload, size_t payload_length)
	Send an ICMP packet via the TUN interface.
static void	setup_fresh_address (int af, uint8_t proto, struct SocketAddress *local_address)
	We need to create a (unique) fresh local address (IP+port).
static void	setup_state_record (struct ChannelState *state)
	We are starting a fresh connection (TCP or UDP) and need to pick a source port and IP address (within the correct range and address family) to associate replies with the connection / correct cadet channel.
static void	send_udp_packet_via_tun (const struct SocketAddress *destination_address, const struct SocketAddress *source_address, const void *payload, size_t payload_length)
	Send a UDP packet via the TUN interface.
static int	check_udp_remote (void *cls, const struct GNUNET_EXIT_UdpInternetMessage *msg)
	Check a request to forward UDP data to the Internet via this peer.
static void	handle_udp_remote (void *cls, const struct GNUNET_EXIT_UdpInternetMessage *msg)
	Process a request to forward UDP data to the Internet via this peer.
static int	check_udp_service (void *cls, const struct GNUNET_EXIT_UdpServiceMessage *msg)
	Check a request via cadet to send a request to a UDP service offered by this system.
static void	handle_udp_service (void *cls, const struct GNUNET_EXIT_UdpServiceMessage *msg)
	Process a request via cadet to send a request to a UDP service offered by this system.
static void	handle_tcp_service (void *cls, const struct GNUNET_EXIT_TcpServiceStartMessage *start)
	Process a request via cadet to send a request to a TCP service offered by this system.
static int	check_tcp_remote (void *cls, const struct GNUNET_EXIT_TcpInternetStartMessage *start)
	Check a request to forward TCP data to the Internet via this peer.
static void	handle_tcp_remote (void *cls, const struct GNUNET_EXIT_TcpInternetStartMessage *start)
	Process a request to forward TCP data to the Internet via this peer.
static int	check_tcp_data (void *cls, const struct GNUNET_EXIT_TcpDataMessage *data)
	Check a request to forward TCP data on an established connection via this peer.
static void	handle_tcp_data (void *cls, const struct GNUNET_EXIT_TcpDataMessage *data)
	Process a request to forward TCP data on an established connection via this peer.
static void	make_up_icmpv4_payload (struct ChannelState *state, struct GNUNET_TUN_IPv4Header *ipp, struct GNUNET_TUN_UdpHeader *udp)
	Synthesize a plausible ICMP payload for an ICMPv4 error response on the given channel.
static void	make_up_icmpv6_payload (struct ChannelState *state, struct GNUNET_TUN_IPv6Header *ipp, struct GNUNET_TUN_UdpHeader *udp)
	Synthesize a plausible ICMP payload for an ICMPv6 error response on the given channel.
static int	check_icmp_remote (void *cls, const struct GNUNET_EXIT_IcmpInternetMessage *msg)
	Check a request to forward ICMP data to the Internet via this peer.
static void	handle_icmp_remote (void *cls, const struct GNUNET_EXIT_IcmpInternetMessage *msg)
	Process a request to forward ICMP data to the Internet via this peer.
static uint16_t	make_up_icmp_service_payload (struct ChannelState *state, char *buf)
	Setup ICMP payload for ICMP error messages.
static int	check_icmp_service (void *cls, const struct GNUNET_EXIT_IcmpServiceMessage *msg)
	Check a request via cadet to send ICMP data to a service offered by this system.
static void	handle_icmp_service (void *cls, const struct GNUNET_EXIT_IcmpServiceMessage *msg)
	Process a request via cadet to send ICMP data to a service offered by this system.
static int	free_service_record (void *cls, const struct GNUNET_HashCode *key, void *value)
	Free memory associated with a service record.
static void *	new_service_channel (void *cls, struct GNUNET_CADET_Channel *channel, const struct GNUNET_PeerIdentity *initiator)
	Callback from CADET for new channels.
static void	clean_channel (void *cls, const struct GNUNET_CADET_Channel *channel)
	Function called by cadet whenever an inbound channel is destroyed.
static void	store_service (int proto, const char *name, uint16_t destination_port, struct LocalService *service)
	Given a service descriptor and a destination port, find the respective service entry.
static void	send_packet_to_cadet_channel (struct ChannelState *s, struct GNUNET_MQ_Envelope *env)
	Send the given packet via the cadet channel.
static void	icmp_from_helper (const struct GNUNET_TUN_IcmpHeader *icmp, size_t pktlen, int af, const void *destination_ip, const void *source_ip)
	Handles an ICMP packet received from the helper.
static void	udp_from_helper (const struct GNUNET_TUN_UdpHeader *udp, size_t pktlen, int af, const void *destination_ip, const void *source_ip)
	Handles an UDP packet received from the helper.
static void	tcp_from_helper (const struct GNUNET_TUN_TcpHeader *tcp, size_t pktlen, int af, const void *destination_ip, const void *source_ip)
	Handles a TCP packet received from the helper.
static int	message_token (void *cls, const struct GNUNET_MessageHeader *message)
	Receive packets from the helper-process.
static void *	new_channel (void *cls, struct GNUNET_CADET_Channel *channel, const struct GNUNET_PeerIdentity *initiator)
	Callback from CADET for new channels.
static int	free_iterate (void *cls, const struct GNUNET_HashCode *hash, void *value)
	Function that frees everything from a hashmap.
static void	dummy_task (void *cls)
	Function scheduled as very last function if the service disabled itself because the helper is not installed properly.
static void	cleanup (void *cls)
	Function scheduled as very last function, cleans up after us.
static void	add_services (int proto, char *cpy, const char *name)
	Add services to the service map.
static void	read_service_conf (void *cls, const char *section)
	Reads the configuration and populates #udp_services and #tcp_services.
static void	do_dht_put (void *cls)
	We are running a DNS exit service, advertise it in the DHT.
static void	dht_put_cont (void *cls)
	Function called when the DHT PUT operation is complete.
static void	sign_dns_advertisement (void *cls, const struct GNUNET_PeerIdentity *pid, const struct GNUNET_CRYPTO_EddsaSignature *sig)
static void	do_initial_dht_put (void *cls, const struct GNUNET_HELLO_Parser *parser, const struct GNUNET_HashCode *hash)
static void	parse_ip_options ()
	Figure out which IP versions we should support (and which are supported by the OS) according to our configuration.
static void	advertise_dns_exit ()
	Helper function to open the CADET port for DNS exits and to advertise the DNS exit (if applicable).
static int	setup_exit_helper_args ()
	Initialize exit_argv.
static void	run (void *cls, char *const *args, const char *cfgfile, const struct GNUNET_CONFIGURATION_Handle *cfg_)
	Main function that will be run by the scheduler.
int	main (int argc, char *const *argv)
	The main function.

Variables
static int	global_ret
	Return value from 'main'.
static struct GNUNET_REGEX_Announcement *	regex4
	Handle to our regex announcement for IPv4.
static struct GNUNET_REGEX_Announcement *	regex6
	Handle to our regex announcement for IPv4.
static const struct GNUNET_CONFIGURATION_Handle *	cfg
	The handle to the configuration used throughout the process.
static struct GNUNET_HELPER_Handle *	helper_handle
	The handle to the helper.
static char *	exit_argv [8]
	Arguments to the exit helper.
static struct in6_addr	exit_ipv6addr
	IPv6 address of our TUN interface.
static unsigned long long	ipv6prefix
	IPv6 prefix (0..127) from configuration file.
static struct in_addr	exit_ipv4addr
	IPv4 address of our TUN interface.
static struct in_addr	exit_ipv4mask
	IPv4 netmask of our TUN interface.
static struct GNUNET_STATISTICS_Handle *	stats
	Statistics.
static struct GNUNET_CADET_Handle *	cadet_handle
	The handle to cadet.
static struct GNUNET_CONTAINER_MultiHashMap *	connections_map
	This hashmaps contains the mapping from peer, service-descriptor, source-port and destination-port to a struct ChannelState.
static struct GNUNET_CONTAINER_Heap *	connections_heap
	Heap so we can quickly find "old" connections.
static unsigned long long	max_connections
	If there are at least this many connections, old ones will be removed.
static struct GNUNET_CONTAINER_MultiHashMap *	services
	This hashmaps saves interesting things about the configured services.
static struct ChannelState *	channels [UINT16_MAX+1]
	Array of all open DNS requests from channels.
static struct GNUNET_DNSSTUB_Context *	dnsstub
	Handle to the DNS Stub resolver.
static struct GNUNET_DHT_PutHandle *	dht_put
	Handle for ongoing DHT PUT operations to advertise exit service.
static struct GNUNET_DHT_Handle *	dht
	Handle to the DHT.
static struct GNUNET_SCHEDULER_Task *	dht_task
	Task for doing DHT PUTs to advertise exit service.
static struct GNUNET_DNS_Advertisement	dns_advertisement
	Advertisement message we put into the DHT to advertise us as a DNS exit.
static struct GNUNET_HashCode	dht_put_key
	Key we store the DNS advertismenet under.
static struct GNUNET_PILS_Handle *	pils
	The pils service handle.
static struct GNUNET_PILS_Operation *	sign_op
	Operation for signing the dns advertisement.
static struct GNUNET_CADET_Port *	dns_port
	Port for DNS exit.
static struct GNUNET_CADET_Port *	cadet_port4
	Port for IPv4 exit.
static struct GNUNET_CADET_Port *	cadet_port6
	Port for IPv6 exit.
static int	ipv4_exit
	Are we an IPv4-exit?
static int	ipv6_exit
	Are we an IPv6-exit?
static int	ipv4_enabled
	Do we support IPv4 at all on the TUN interface?
static int	ipv6_enabled
	Do we support IPv6 at all on the TUN interface?

Detailed Description

tool to allow IP traffic exit from the GNUnet cadet to the Internet

Author

Philipp Toelke

Christian Grothoff

TODO:

• test

Design:

• which code should advertise services? the service model is right now a bit odd, especially as this code DOES the exit and knows the DNS "name", but OTOH this is clearly NOT the place to advertise the service's existence; maybe the daemon should turn into a service with an API to add local-exit services dynamically?

Definition in file gnunet-daemon-exit.c.

Macro Definition Documentation

REGEX_MAX_PATH_LEN_IPV4

#define REGEX_MAX_PATH_LEN_IPV4   4

Maximum path compression length for cadet regex announcing for IPv4 address based regex.

Definition at line 56 of file gnunet-daemon-exit.c.

REGEX_MAX_PATH_LEN_IPV6

#define REGEX_MAX_PATH_LEN_IPV6   8

Maximum path compression length for cadet regex announcing for IPv6 address based regex.

Definition at line 62 of file gnunet-daemon-exit.c.

REGEX_REFRESH_FREQUENCY

#define REGEX_REFRESH_FREQUENCY

Value:

          GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_MINUTES, 30)

How frequently do we re-announce the regex for the exit?

Definition at line 67 of file gnunet-daemon-exit.c.

{
  int af;
 
  union
  {
    struct in_addr ipv4;
 
    struct in6_addr ipv6;
  } address;
 
  uint8_t proto;
 
  uint16_t port;
};
 
 
struct LocalService
{
  struct SocketAddress address;
 
  struct GNUNET_HashCode descriptor;
 
  char *name;
 
  struct GNUNET_CADET_Port *port;
 
  int16_t is_udp;
};
 
 
struct RedirectInformation
{
  struct SocketAddress remote_address;
 
  struct SocketAddress local_address;
 
  /*
     Note 1: additional information might be added here in the
     future to support protocols that require special handling,
     such as ftp/tftp
 
     Note 2: we might also sometimes not match on all components
     of the tuple, to support protocols where things do not always
     fully map.
   */
};
 
 
struct ChannelState
{
  struct GNUNET_CADET_Channel *channel;
 
  struct GNUNET_PeerIdentity peer;
 
  int is_dns;
 
  union
  {
    struct
    {
      struct GNUNET_CONTAINER_HeapNode *heap_node;
 
      struct GNUNET_HashCode state_key;
 
      struct LocalService *serv;
 
      struct RedirectInformation ri;
    } tcp_udp;
 
    struct
    {
      struct GNUNET_DNSSTUB_RequestSocket *rs;
 
      uint16_t original_id;
 
      uint16_t my_id;
    } dns;
  } specifics;
};
 
 
static int global_ret;
 
static struct GNUNET_REGEX_Announcement *regex4;
 
static struct GNUNET_REGEX_Announcement *regex6;
 
static const struct GNUNET_CONFIGURATION_Handle *cfg;
 
static struct GNUNET_HELPER_Handle *helper_handle;
 
static char *exit_argv[8];
 
static struct in6_addr exit_ipv6addr;
 
static unsigned long long ipv6prefix;
 
static struct in_addr exit_ipv4addr;
 
static struct in_addr exit_ipv4mask;
 
static struct GNUNET_STATISTICS_Handle *stats;
 
static struct GNUNET_CADET_Handle *cadet_handle;
 
static struct GNUNET_CONTAINER_MultiHashMap *connections_map;
 
static struct GNUNET_CONTAINER_Heap *connections_heap;
 
static unsigned long long max_connections;
 
static struct GNUNET_CONTAINER_MultiHashMap *services;
 
static struct ChannelState *channels[UINT16_MAX + 1];
 
static struct GNUNET_DNSSTUB_Context *dnsstub;
 
static struct GNUNET_DHT_PutHandle *dht_put;
 
static struct GNUNET_DHT_Handle *dht;
 
static struct GNUNET_SCHEDULER_Task *dht_task;
 
static struct GNUNET_DNS_Advertisement dns_advertisement;
 
static struct GNUNET_HashCode dht_put_key;
 
static struct GNUNET_PILS_Handle *pils;
 
static struct GNUNET_PILS_Operation *sign_op;
 
static struct GNUNET_CADET_Port *dns_port;
 
static struct GNUNET_CADET_Port *cadet_port4;
 
static struct GNUNET_CADET_Port *cadet_port6;
 
static int ipv4_exit;
 
static int ipv6_exit;
 
static int ipv4_enabled;
 
static int ipv6_enabled;
 
 
GNUNET_NETWORK_STRUCT_BEGIN
 
struct DnsResponseMessage
{
  struct GNUNET_MessageHeader header;
 
  struct GNUNET_TUN_DnsHeader dns;
 
  /* Followed by more DNS payload */
};
 
GNUNET_NETWORK_STRUCT_END
 
 
static void
process_dns_result (void *cls,
                    const struct GNUNET_TUN_DnsHeader *dns,
                    size_t r)
{
  struct ChannelState *ts;
  struct GNUNET_MQ_Envelope *env;
  struct DnsResponseMessage *resp;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Processing DNS result from stub resolver\n");
  GNUNET_assert (NULL == cls);
  if (NULL == dns)
    return;
  /* Handle case that this is a reply to a request from a CADET DNS channel */
  ts = channels[dns->id];
  if (NULL == ts)
    return;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Got a response from the stub resolver for DNS request received via CADET!\n");
  channels[dns->id] = NULL;
  env = GNUNET_MQ_msg_extra (resp,
                             r - sizeof(struct GNUNET_TUN_DnsHeader),
                             GNUNET_MESSAGE_TYPE_VPN_DNS_FROM_INTERNET);
  GNUNET_memcpy (&resp->dns,
                 dns,
                 r);
  resp->dns.id = ts->specifics.dns.original_id;
  GNUNET_MQ_send (GNUNET_CADET_get_mq (ts->channel),
                  env);
}
 
 
static int
check_dns_request (void *cls,
                   const struct DnsResponseMessage *msg)
{
  struct ChannelState *ts = cls;
 
  if (NULL == dnsstub)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_NO == ts->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_dns_request (void *cls,
                    const struct DnsResponseMessage *msg)
{
  struct ChannelState *ts = cls;
  size_t mlen = ntohs (msg->header.size);
  size_t dlen = mlen - sizeof(struct GNUNET_MessageHeader);
  char buf[dlen] GNUNET_ALIGN;
  struct GNUNET_TUN_DnsHeader *dns_out;
 
  if (GNUNET_SYSERR == ts->is_dns)
  {
    /* channel is DNS from now on */
    ts->is_dns = GNUNET_YES;
  }
  ts->specifics.dns.original_id = msg->dns.id;
  if (channels[ts->specifics.dns.my_id] == ts)
    channels[ts->specifics.dns.my_id] = NULL;
  ts->specifics.dns.my_id = (uint16_t) GNUNET_CRYPTO_random_u32 (
    UINT16_MAX
    + 1);
  channels[ts->specifics.dns.my_id] = ts;
  GNUNET_memcpy (buf,
                 &msg->dns,
                 dlen);
  dns_out = (struct GNUNET_TUN_DnsHeader *) buf;
  dns_out->id = ts->specifics.dns.my_id;
  ts->specifics.dns.rs = GNUNET_DNSSTUB_resolve (dnsstub,
                                                 buf,
                                                 dlen,
                                                 &process_dns_result,
                                                 NULL);
  if (NULL == ts->specifics.dns.rs)
  {
    GNUNET_break_op (0);
    return;
  }
  GNUNET_CADET_receive_done (ts->channel);
}
 
 
static void
hash_redirect_info (struct GNUNET_HashCode *hash,
                    const struct RedirectInformation *ri)
{
  char *off;
 
  memset (hash,
          0,
          sizeof(struct GNUNET_HashCode));
  /* the GNUnet hashmap only uses the first sizeof(unsigned int) of the hash,
     so we put the IP address in there (and hope for few collisions) */
  off = (char *) hash;
  switch (ri->remote_address.af)
  {
  case AF_INET:
    GNUNET_memcpy (off,
                   &ri->remote_address.address.ipv4,
                   sizeof(struct in_addr));
    off += sizeof(struct in_addr);
    break;
 
  case AF_INET6:
    GNUNET_memcpy (off,
                   &ri->remote_address.address.ipv6,
                   sizeof(struct in6_addr));
    off += sizeof(struct in_addr);
    break;
 
  default:
    GNUNET_assert (0);
  }
  GNUNET_memcpy (off,
                 &ri->remote_address.port,
                 sizeof(uint16_t));
  off += sizeof(uint16_t);
  switch (ri->local_address.af)
  {
  case AF_INET:
    GNUNET_memcpy (off,
                   &ri->local_address.address.ipv4,
                   sizeof(struct in_addr));
    off += sizeof(struct in_addr);
    break;
 
  case AF_INET6:
    GNUNET_memcpy (off,
                   &ri->local_address.address.ipv6,
                   sizeof(struct in6_addr));
    off += sizeof(struct in_addr);
    break;
 
  default:
    GNUNET_assert (0);
  }
  GNUNET_memcpy (off,
                 &ri->local_address.port,
                 sizeof(uint16_t));
  off += sizeof(uint16_t);
  GNUNET_memcpy (off,
                 &ri->remote_address.proto,
                 sizeof(uint8_t));
  /* off += sizeof (uint8_t); */
}
 
 
static struct ChannelState *
get_redirect_state (int af,
                    int protocol,
                    const void *destination_ip,
                    uint16_t destination_port,
                    const void *local_ip,
                    uint16_t local_port,
                    struct GNUNET_HashCode *state_key)
{
  struct RedirectInformation ri;
  struct GNUNET_HashCode key;
  struct ChannelState *state;
 
  if (((af == AF_INET) && (protocol == IPPROTO_ICMP)) ||
      ((af == AF_INET6) && (protocol == IPPROTO_ICMPV6)))
  {
    /* ignore ports */
    destination_port = 0;
    local_port = 0;
  }
  ri.remote_address.af = af;
  if (af == AF_INET)
    ri.remote_address.address.ipv4 = *((struct in_addr*) destination_ip);
  else
    ri.remote_address.address.ipv6 = *((struct in6_addr*) destination_ip);
  ri.remote_address.port = destination_port;
  ri.remote_address.proto = protocol;
  ri.local_address.af = af;
  if (af == AF_INET)
    ri.local_address.address.ipv4 = *((struct in_addr*) local_ip);
  else
    ri.local_address.address.ipv6 = *((struct in6_addr*) local_ip);
  ri.local_address.port = local_port;
  ri.local_address.proto = protocol;
  hash_redirect_info (&key,
                      &ri);
  if (NULL != state_key)
    *state_key = key;
  state = GNUNET_CONTAINER_multihashmap_get (connections_map,
                                             &key);
  if (NULL == state)
    return NULL;
  /* Mark this connection as freshly used */
  if (NULL == state_key)
    GNUNET_CONTAINER_heap_update_cost (state->specifics.tcp_udp.heap_node,
                                       GNUNET_TIME_absolute_get ().abs_value_us)
    ;
  return state;
}
 
 
static int
check_tcp_service (void *cls,
                   const struct GNUNET_EXIT_TcpServiceStartMessage *start)
{
  struct ChannelState *state = cls;
 
  if (NULL == state)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (NULL == state->specifics.tcp_udp.serv)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (NULL != state->specifics.tcp_udp.heap_node)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (start->tcp_header.off * 4 < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
prepare_ipv4_packet (const void *payload,
                     size_t payload_length,
                     int protocol,
                     const struct GNUNET_TUN_TcpHeader *tcp_header,
                     const struct SocketAddress *src_address,
                     const struct SocketAddress *dst_address,
                     struct GNUNET_TUN_IPv4Header *pkt4)
{
  size_t len;
 
  len = payload_length;
  switch (protocol)
  {
  case IPPROTO_UDP:
    len += sizeof(struct GNUNET_TUN_UdpHeader);
    break;
 
  case IPPROTO_TCP:
    len += sizeof(struct GNUNET_TUN_TcpHeader);
    GNUNET_assert (NULL != tcp_header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  if (len + sizeof(struct GNUNET_TUN_IPv4Header) > UINT16_MAX)
  {
    GNUNET_break (0);
    return;
  }
 
  GNUNET_TUN_initialize_ipv4_header (pkt4,
                                     protocol,
                                     len,
                                     &src_address->address.ipv4,
                                     &dst_address->address.ipv4);
  switch (protocol)
  {
  case IPPROTO_UDP:
    {
      struct GNUNET_TUN_UdpHeader *pkt4_udp = (struct
                                               GNUNET_TUN_UdpHeader *) &pkt4[1];
 
      pkt4_udp->source_port = htons (src_address->port);
      pkt4_udp->destination_port = htons (dst_address->port);
      pkt4_udp->len = htons ((uint16_t) payload_length);
      GNUNET_TUN_calculate_udp4_checksum (pkt4,
                                          pkt4_udp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt4_udp[1],
                     payload,
                     payload_length);
    }
    break;
 
  case IPPROTO_TCP:
    {
      struct GNUNET_TUN_TcpHeader *pkt4_tcp = (struct
                                               GNUNET_TUN_TcpHeader *) &pkt4[1];
 
      *pkt4_tcp = *tcp_header;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Sending TCP packet from port %u to port %u\n",
                  src_address->port,
                  dst_address->port);
      pkt4_tcp->source_port = htons (src_address->port);
      pkt4_tcp->destination_port = htons (dst_address->port);
      GNUNET_TUN_calculate_tcp4_checksum (pkt4,
                                          pkt4_tcp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt4_tcp[1],
                     payload,
                     payload_length);
    }
    break;
 
  default:
    GNUNET_assert (0);
  }
}
 
 
static void
prepare_ipv6_packet (const void *payload,
                     size_t payload_length,
                     int protocol,
                     const struct GNUNET_TUN_TcpHeader *tcp_header,
                     const struct SocketAddress *src_address,
                     const struct SocketAddress *dst_address,
                     struct GNUNET_TUN_IPv6Header *pkt6)
{
  size_t len;
 
  len = payload_length;
  switch (protocol)
  {
  case IPPROTO_UDP:
    len += sizeof(struct GNUNET_TUN_UdpHeader);
    break;
 
  case IPPROTO_TCP:
    len += sizeof(struct GNUNET_TUN_TcpHeader);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  if (len > UINT16_MAX)
  {
    GNUNET_break (0);
    return;
  }
 
  GNUNET_TUN_initialize_ipv6_header (pkt6,
                                     protocol,
                                     len,
                                     &src_address->address.ipv6,
                                     &dst_address->address.ipv6);
 
  switch (protocol)
  {
  case IPPROTO_UDP:
    {
      struct GNUNET_TUN_UdpHeader *pkt6_udp = (struct
                                               GNUNET_TUN_UdpHeader *) &pkt6[1];
 
      pkt6_udp->source_port = htons (src_address->port);
      pkt6_udp->destination_port = htons (dst_address->port);
      pkt6_udp->len = htons ((uint16_t) payload_length);
      GNUNET_TUN_calculate_udp6_checksum (pkt6,
                                          pkt6_udp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt6_udp[1],
                     payload,
                     payload_length);
    }
    break;
 
  case IPPROTO_TCP:
    {
      struct GNUNET_TUN_TcpHeader *pkt6_tcp = (struct
                                               GNUNET_TUN_TcpHeader *) &pkt6[1];
 
      /* GNUNET_memcpy first here as some TCP header fields are initialized this way! */
      *pkt6_tcp = *tcp_header;
      pkt6_tcp->source_port = htons (src_address->port);
      pkt6_tcp->destination_port = htons (dst_address->port);
      GNUNET_TUN_calculate_tcp6_checksum (pkt6,
                                          pkt6_tcp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt6_tcp[1],
                     payload,
                     payload_length);
    }
    break;
 
  default:
    GNUNET_assert (0);
    break;
  }
}
 
 
static void
send_tcp_packet_via_tun (const struct SocketAddress *destination_address,
                         const struct SocketAddress *source_address,
                         const struct GNUNET_TUN_TcpHeader *tcp_header,
                         const void *payload,
                         size_t payload_length)
{
  size_t len;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# TCP packets sent via TUN"),
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending packet with %u bytes TCP payload via TUN\n",
              (unsigned int) payload_length);
  len = sizeof(struct GNUNET_MessageHeader) + sizeof(struct
                                                     GNUNET_TUN_Layer2PacketHeader);
  switch (source_address->af)
  {
  case AF_INET:
    len += sizeof(struct GNUNET_TUN_IPv4Header);
    break;
 
  case AF_INET6:
    len += sizeof(struct GNUNET_TUN_IPv6Header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  len += sizeof(struct GNUNET_TUN_TcpHeader);
  len += payload_length;
  if (len >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  {
    char buf[len] GNUNET_ALIGN;
    struct GNUNET_MessageHeader *hdr;
    struct GNUNET_TUN_Layer2PacketHeader *tun;
 
    hdr = (struct GNUNET_MessageHeader *) buf;
    hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
    hdr->size = htons (len);
    tun = (struct GNUNET_TUN_Layer2PacketHeader*) &hdr[1];
    tun->flags = htons (0);
    switch (source_address->af)
    {
    case AF_INET:
      {
        struct GNUNET_TUN_IPv4Header *ipv4
          = (struct GNUNET_TUN_IPv4Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV4);
        prepare_ipv4_packet (payload,
                             payload_length,
                             IPPROTO_TCP,
                             tcp_header,
                             source_address,
                             destination_address,
                             ipv4);
      }
      break;
 
    case AF_INET6:
      {
        struct GNUNET_TUN_IPv6Header *ipv6
          = (struct GNUNET_TUN_IPv6Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV6);
        prepare_ipv6_packet (payload,
                             payload_length,
                             IPPROTO_TCP,
                             tcp_header,
                             source_address,
                             destination_address,
                             ipv6);
      }
      break;
 
    default:
      GNUNET_assert (0);
      break;
    }
    if (NULL != helper_handle)
      (void) GNUNET_HELPER_send (helper_handle,
                                 (const struct GNUNET_MessageHeader*) buf,
                                 GNUNET_YES,
                                 NULL,
                                 NULL);
  }
}
 
 
static void
send_icmp_packet_via_tun (const struct SocketAddress *destination_address,
                          const struct SocketAddress *source_address,
                          const struct GNUNET_TUN_IcmpHeader *icmp_header,
                          const void *payload, size_t payload_length)
{
  size_t len;
  struct GNUNET_TUN_IcmpHeader *icmp;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# ICMP packets sent via TUN"),
                            1, GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending packet with %u bytes ICMP payload via TUN\n",
              (unsigned int) payload_length);
  len = sizeof(struct GNUNET_MessageHeader) + sizeof(struct
                                                     GNUNET_TUN_Layer2PacketHeader);
  switch (destination_address->af)
  {
  case AF_INET:
    len += sizeof(struct GNUNET_TUN_IPv4Header);
    break;
 
  case AF_INET6:
    len += sizeof(struct GNUNET_TUN_IPv6Header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  len += sizeof(struct GNUNET_TUN_IcmpHeader);
  len += payload_length;
  if (len >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  {
    char buf[len] GNUNET_ALIGN;
    struct GNUNET_MessageHeader *hdr;
    struct GNUNET_TUN_Layer2PacketHeader *tun;
 
    hdr = (struct GNUNET_MessageHeader *) buf;
    hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
    hdr->size = htons (len);
    tun = (struct GNUNET_TUN_Layer2PacketHeader*) &hdr[1];
    tun->flags = htons (0);
    switch (source_address->af)
    {
    case AF_INET:
      {
        struct GNUNET_TUN_IPv4Header *ipv4 = (struct
                                              GNUNET_TUN_IPv4Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV4);
        GNUNET_TUN_initialize_ipv4_header (ipv4,
                                           IPPROTO_ICMP,
                                           sizeof(struct
                                                  GNUNET_TUN_IcmpHeader)
                                           + payload_length,
                                           &source_address->address.ipv4,
                                           &destination_address->address.ipv4);
        icmp = (struct GNUNET_TUN_IcmpHeader*) &ipv4[1];
      }
      break;
 
    case AF_INET6:
      {
        struct GNUNET_TUN_IPv6Header *ipv6 = (struct
                                              GNUNET_TUN_IPv6Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV6);
        GNUNET_TUN_initialize_ipv6_header (ipv6,
                                           IPPROTO_ICMPV6,
                                           sizeof(struct
                                                  GNUNET_TUN_IcmpHeader)
                                           + payload_length,
                                           &source_address->address.ipv6,
                                           &destination_address->address.ipv6);
        icmp = (struct GNUNET_TUN_IcmpHeader*) &ipv6[1];
      }
      break;
 
    default:
      GNUNET_assert (0);
      break;
    }
    *icmp = *icmp_header;
    GNUNET_memcpy (&icmp[1],
                   payload,
                   payload_length);
    GNUNET_TUN_calculate_icmp_checksum (icmp,
                                        payload,
                                        payload_length);
    if (NULL != helper_handle)
      (void) GNUNET_HELPER_send (helper_handle,
                                 (const struct GNUNET_MessageHeader*) buf,
                                 GNUNET_YES,
                                 NULL, NULL);
  }
}
 
 
static void
setup_fresh_address (int af,
                     uint8_t proto,
                     struct SocketAddress *local_address)
{
  local_address->af = af;
  local_address->proto = (uint8_t) proto;
  /* default "local" port range is often 32768--61000,
     so we pick a random value in that range */
  if (((af == AF_INET) && (proto == IPPROTO_ICMP)) ||
      ((af == AF_INET6) && (proto == IPPROTO_ICMPV6)))
    local_address->port = 0;
  else
    local_address->port
      = (uint16_t) 32768 + GNUNET_CRYPTO_random_u32 (28232);
  switch (af)
  {
  case AF_INET:
    {
      struct in_addr addr;
      struct in_addr mask;
      struct in_addr rnd;
 
      addr = exit_ipv4addr;
      mask = exit_ipv4mask;
      if (0 == ~mask.s_addr)
      {
        /* only one valid IP anyway */
        local_address->address.ipv4 = addr;
        return;
      }
      /* Given 192.168.0.1/255.255.0.0, we want a mask
         of '192.168.255.255', thus:  */
      mask.s_addr = addr.s_addr | ~mask.s_addr;
      /* Pick random IPv4 address within the subnet, except 'addr' or 'mask' itself */
      do
      {
        rnd.s_addr = GNUNET_CRYPTO_random_u32 (UINT32_MAX);
        local_address->address.ipv4.s_addr = (addr.s_addr | rnd.s_addr)
                                             & mask.s_addr;
      }
      while ((local_address->address.ipv4.s_addr == addr.s_addr) ||
             (local_address->address.ipv4.s_addr == mask.s_addr));
    }
    break;
 
  case AF_INET6:
    {
      struct in6_addr addr;
      struct in6_addr mask;
      struct in6_addr rnd;
      int i;
 
      addr = exit_ipv6addr;
      GNUNET_assert (ipv6prefix < 128);
      if (ipv6prefix == 127)
      {
        /* only one valid IP anyway */
        local_address->address.ipv6 = addr;
        return;
      }
      /* Given ABCD::/96, we want a mask of 'ABCD::FFFF:FFFF,
         thus: */
      mask = addr;
      for (i = 127; i >= ipv6prefix; i--)
        mask.s6_addr[i / 8] |= (1 << (i % 8));
 
      /* Pick random IPv6 address within the subnet, except 'addr' or 'mask' itself */
      do
      {
        for (i = 0; i < 16; i++)
        {
          rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (
            256);
          local_address->address.ipv6.s6_addr[i]
            = (addr.s6_addr[i] | rnd.s6_addr[i]) & mask.s6_addr[i];
        }
      }
      while ((0 == GNUNET_memcmp (&local_address->address.ipv6,
                                  &addr)) ||
             (0 == GNUNET_memcmp (&local_address->address.ipv6,
                                  &mask)));
    }
    break;
 
  default:
    GNUNET_assert (0);
  }
}
 
 
static void
setup_state_record (struct ChannelState *state)
{
  struct GNUNET_HashCode key;
  struct ChannelState *s;
 
  /* generate fresh, unique address */
  do
  {
    if (NULL == state->specifics.tcp_udp.serv)
      setup_fresh_address (state->specifics.tcp_udp.ri.remote_address.af,
                           state->specifics.tcp_udp.ri.remote_address.proto,
                           &state->specifics.tcp_udp.ri.local_address);
    else
      setup_fresh_address (state->specifics.tcp_udp.serv->address.af,
                           state->specifics.tcp_udp.serv->address.proto,
                           &state->specifics.tcp_udp.ri.local_address);
  }
  while (NULL !=
         get_redirect_state (state->specifics.tcp_udp.ri.remote_address.af,
                             state->specifics.tcp_udp.ri.remote_address.proto,
                             &state->specifics.tcp_udp.ri.remote_address.address
                             ,
                             state->specifics.tcp_udp.ri.remote_address.port,
                             &state->specifics.tcp_udp.ri.local_address.address,
                             state->specifics.tcp_udp.ri.local_address.port,
                             &key));
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Picked local address %s:%u for new connection\n",
                inet_ntop (state->specifics.tcp_udp.ri.local_address.af,
                           &state->specifics.tcp_udp.ri.local_address.address,
                           buf,
                           sizeof(buf)),
                (unsigned int) state->specifics.tcp_udp.ri.local_address.port);
  }
  state->specifics.tcp_udp.state_key = key;
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CONTAINER_multihashmap_put (connections_map,
                                                    &key, state,
                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  state->specifics.tcp_udp.heap_node
    = GNUNET_CONTAINER_heap_insert (connections_heap,
                                    state,
                                    GNUNET_TIME_absolute_get ().abs_value_us);
  while (GNUNET_CONTAINER_heap_get_size (connections_heap) > max_connections)
  {
    s = GNUNET_CONTAINER_heap_remove_root (connections_heap);
    GNUNET_assert (state != s);
    s->specifics.tcp_udp.heap_node = NULL;
    GNUNET_CADET_channel_destroy (s->channel);
    GNUNET_assert (GNUNET_OK ==
                   GNUNET_CONTAINER_multihashmap_remove (connections_map,
                                                         &s->specifics.tcp_udp.
                                                         state_key,
                                                         s));
    GNUNET_free (s);
  }
}
 
 
static void
send_udp_packet_via_tun (const struct SocketAddress *destination_address,
                         const struct SocketAddress *source_address,
                         const void *payload, size_t payload_length)
{
  size_t len;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# UDP packets sent via TUN"),
                            1, GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending packet with %u bytes UDP payload via TUN\n",
              (unsigned int) payload_length);
  len = sizeof(struct GNUNET_MessageHeader) + sizeof(struct
                                                     GNUNET_TUN_Layer2PacketHeader);
  switch (source_address->af)
  {
  case AF_INET:
    len += sizeof(struct GNUNET_TUN_IPv4Header);
    break;
 
  case AF_INET6:
    len += sizeof(struct GNUNET_TUN_IPv6Header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  len += sizeof(struct GNUNET_TUN_UdpHeader);
  len += payload_length;
  if (len >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  {
    char buf[len] GNUNET_ALIGN;
    struct GNUNET_MessageHeader *hdr;
    struct GNUNET_TUN_Layer2PacketHeader *tun;
 
    hdr = (struct GNUNET_MessageHeader *) buf;
    hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
    hdr->size = htons (len);
    tun = (struct GNUNET_TUN_Layer2PacketHeader*) &hdr[1];
    tun->flags = htons (0);
    switch (source_address->af)
    {
    case AF_INET:
      {
        struct GNUNET_TUN_IPv4Header *ipv4 = (struct
                                              GNUNET_TUN_IPv4Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV4);
        prepare_ipv4_packet (payload,
                             payload_length,
                             IPPROTO_UDP,
                             NULL,
                             source_address,
                             destination_address,
                             ipv4);
      }
      break;
 
    case AF_INET6:
      {
        struct GNUNET_TUN_IPv6Header *ipv6 = (struct
                                              GNUNET_TUN_IPv6Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV6);
        prepare_ipv6_packet (payload,
                             payload_length,
                             IPPROTO_UDP,
                             NULL,
                             source_address,
                             destination_address,
                             ipv6);
      }
      break;
 
    default:
      GNUNET_assert (0);
      break;
    }
    if (NULL != helper_handle)
      (void) GNUNET_HELPER_send (helper_handle,
                                 (const struct GNUNET_MessageHeader*) buf,
                                 GNUNET_YES,
                                 NULL, NULL);
  }
}
 
 
static int
check_udp_remote (void *cls,
                  const struct GNUNET_EXIT_UdpInternetMessage *msg)
{
  struct ChannelState *state = cls;
 
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_udp_remote (void *cls,
                   const struct GNUNET_EXIT_UdpInternetMessage *msg)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_UdpInternetMessage);
  const struct in_addr *v4;
  const struct in6_addr *v6;
  const void *payload;
  int af;
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# UDP IP-exit requests received via cadet"),
                            1, GNUNET_NO);
  af = (int) ntohl (msg->af);
  state->specifics.tcp_udp.ri.remote_address.af = af;
  switch (af)
  {
  case AF_INET:
    if (pkt_len < sizeof(struct in_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv4_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v4 = (const struct in_addr*) &msg[1];
    payload = &v4[1];
    pkt_len -= sizeof(struct in_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv4 = *v4;
    break;
 
  case AF_INET6:
    if (pkt_len < sizeof(struct in6_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv6_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v6 = (const struct in6_addr*) &msg[1];
    payload = &v6[1];
    pkt_len -= sizeof(struct in6_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv6 = *v6;
    break;
 
  default:
    GNUNET_break_op (0);
    return;
  }
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received data from %s for forwarding to UDP %s:%u\n",
                GNUNET_i2s (&state->peer),
                inet_ntop (af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf, sizeof(buf)),
                (unsigned int) ntohs (msg->destination_port));
  }
  state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_UDP;
  state->specifics.tcp_udp.ri.remote_address.port = msg->destination_port;
  if (NULL == state->specifics.tcp_udp.heap_node)
    setup_state_record (state);
  if (0 != ntohs (msg->source_port))
    state->specifics.tcp_udp.ri.local_address.port = msg->source_port;
  send_udp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           payload,
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static int
check_udp_service (void *cls,
                   const struct GNUNET_EXIT_UdpServiceMessage *msg)
{
  struct ChannelState *state = cls;
 
  if (NULL == state->specifics.tcp_udp.serv)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_udp_service (void *cls,
                    const struct GNUNET_EXIT_UdpServiceMessage *msg)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_UdpServiceMessage);
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# UDP service requests received via cadet"),
                            1, GNUNET_NO);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received data from %s for forwarding to UDP service %s on port %u\n",
       GNUNET_i2s (&state->peer),
       GNUNET_h2s (&state->specifics.tcp_udp.serv->descriptor),
       (unsigned int) ntohs (msg->destination_port));
  setup_state_record (state);
  if (0 != ntohs (msg->source_port))
    state->specifics.tcp_udp.ri.local_address.port = msg->source_port;
  send_udp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &msg[1],
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static void
handle_tcp_service (void *cls,
                    const struct GNUNET_EXIT_TcpServiceStartMessage *start)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (start->header.size) - sizeof(struct
                                                         GNUNET_EXIT_TcpServiceStartMessage);
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# TCP service creation requests received via cadet"),
                            1,
                            GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len,
                            GNUNET_NO);
  GNUNET_break_op (ntohl (start->reserved) == 0);
  /* setup fresh connection */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received data from %s for forwarding to TCP service %s on port %u\n",
              GNUNET_i2s (&state->peer),
              GNUNET_h2s (&state->specifics.tcp_udp.serv->descriptor),
              (unsigned int) ntohs (start->tcp_header.destination_port));
  setup_state_record (state);
  send_tcp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &start->tcp_header,
                           &start[1],
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static int
check_tcp_remote (void *cls,
                  const struct GNUNET_EXIT_TcpInternetStartMessage *start)
{
  struct ChannelState *state = cls;
 
  if (NULL == state)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if ((NULL != state->specifics.tcp_udp.serv) ||
      (NULL != state->specifics.tcp_udp.heap_node))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (start->tcp_header.off * 4 < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_tcp_remote (void *cls,
                   const struct GNUNET_EXIT_TcpInternetStartMessage *start)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (start->header.size) - sizeof(struct
                                                         GNUNET_EXIT_TcpInternetStartMessage);
  const struct in_addr *v4;
  const struct in6_addr *v6;
  const void *payload;
  int af;
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# TCP IP-exit creation requests received via cadet"),
                            1, GNUNET_NO);
  af = (int) ntohl (start->af);
  state->specifics.tcp_udp.ri.remote_address.af = af;
  switch (af)
  {
  case AF_INET:
    if (pkt_len < sizeof(struct in_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv4_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v4 = (const struct in_addr*) &start[1];
    payload = &v4[1];
    pkt_len -= sizeof(struct in_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv4 = *v4;
    break;
 
  case AF_INET6:
    if (pkt_len < sizeof(struct in6_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv6_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v6 = (const struct in6_addr*) &start[1];
    payload = &v6[1];
    pkt_len -= sizeof(struct in6_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv6 = *v6;
    break;
 
  default:
    GNUNET_break_op (0);
    return;
  }
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received payload from %s for existing TCP stream to %s:%u\n",
                GNUNET_i2s (&state->peer),
                inet_ntop (af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf, sizeof(buf)),
                (unsigned int) ntohs (start->tcp_header.destination_port));
  }
  state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_TCP;
  state->specifics.tcp_udp.ri.remote_address.port = ntohs (
    start->tcp_header.destination_port);
  setup_state_record (state);
  send_tcp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &start->tcp_header,
                           payload,
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static int
check_tcp_data (void *cls,
                const struct GNUNET_EXIT_TcpDataMessage *data)
{
  struct ChannelState *state = cls;
 
  if ((NULL == state) ||
      (NULL == state->specifics.tcp_udp.heap_node))
  {
    /* connection should have been up! */
    GNUNET_STATISTICS_update (stats,
                              gettext_noop (
                                "# TCP DATA requests dropped (no session)"),
                              1, GNUNET_NO);
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (data->tcp_header.off * 4 < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_tcp_data (void *cls,
                 const struct GNUNET_EXIT_TcpDataMessage *data)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (data->header.size) - sizeof(struct
                                                        GNUNET_EXIT_TcpDataMessage);
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# TCP data requests received via cadet"),
                            1, GNUNET_NO);
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
 
  GNUNET_break_op (ntohl (data->reserved) == 0);
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received additional %u bytes of data from %s for TCP stream to %s:%u\n",
                pkt_len,
                GNUNET_i2s (&state->peer),
                inet_ntop (state->specifics.tcp_udp.ri.remote_address.af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf, sizeof(buf)),
                (unsigned int) state->specifics.tcp_udp.ri.remote_address.port);
  }
 
  send_tcp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &data->tcp_header,
                           &data[1], pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static void
make_up_icmpv4_payload (struct ChannelState *state,
                        struct GNUNET_TUN_IPv4Header *ipp,
                        struct GNUNET_TUN_UdpHeader *udp)
{
  GNUNET_TUN_initialize_ipv4_header (ipp,
                                     state->specifics.tcp_udp.ri.remote_address.
                                     proto,
                                     sizeof(struct GNUNET_TUN_TcpHeader),
                                     &state->specifics.tcp_udp.ri.remote_address
                                     .address.ipv4,
                                     &state->specifics.tcp_udp.ri.local_address.
                                     address.ipv4);
  udp->source_port = htons (state->specifics.tcp_udp.ri.remote_address.port);
  udp->destination_port = htons (
    state->specifics.tcp_udp.ri.local_address.port);
  udp->len = htons (0);
  udp->crc = htons (0);
}
 
 
static void
make_up_icmpv6_payload (struct ChannelState *state,
                        struct GNUNET_TUN_IPv6Header *ipp,
                        struct GNUNET_TUN_UdpHeader *udp)
{
  GNUNET_TUN_initialize_ipv6_header (ipp,
                                     state->specifics.tcp_udp.ri.remote_address.
                                     proto,
                                     sizeof(struct GNUNET_TUN_TcpHeader),
                                     &state->specifics.tcp_udp.ri.remote_address
                                     .address.ipv6,
                                     &state->specifics.tcp_udp.ri.local_address.
                                     address.ipv6);
  udp->source_port = htons (state->specifics.tcp_udp.ri.remote_address.port);
  udp->destination_port = htons (
    state->specifics.tcp_udp.ri.local_address.port);
  udp->len = htons (0);
  udp->crc = htons (0);
}
 
 
static int
check_icmp_remote (void *cls,
                   const struct GNUNET_EXIT_IcmpInternetMessage *msg)
{
  struct ChannelState *state = cls;
 
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_icmp_remote (void *cls,
                    const struct GNUNET_EXIT_IcmpInternetMessage *msg)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_IcmpInternetMessage);
  const struct in_addr *v4;
  const struct in6_addr *v6;
  const void *payload;
  char buf[sizeof(struct GNUNET_TUN_IPv6Header) + 8] GNUNET_ALIGN;
  int af;
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# ICMP IP-exit requests received via cadet"),
                            1, GNUNET_NO);
 
  af = (int) ntohl (msg->af);
  if ((NULL != state->specifics.tcp_udp.heap_node) &&
      (af != state->specifics.tcp_udp.ri.remote_address.af))
  {
    /* other peer switched AF on this channel; not allowed */
    GNUNET_break_op (0);
    return;
  }
 
  switch (af)
  {
  case AF_INET:
    if (pkt_len < sizeof(struct in_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv4_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v4 = (const struct in_addr*) &msg[1];
    payload = &v4[1];
    pkt_len -= sizeof(struct in_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv4 = *v4;
    if (NULL == state->specifics.tcp_udp.heap_node)
    {
      state->specifics.tcp_udp.ri.remote_address.af = af;
      state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_ICMP;
      setup_state_record (state);
    }
    /* check that ICMP type is something we want to support
       and possibly make up payload! */
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
    case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
      break;
 
    case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
    case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      /* make up payload */
      {
        struct GNUNET_TUN_IPv4Header *ipp = (struct
                                             GNUNET_TUN_IPv4Header *) buf;
        struct GNUNET_TUN_UdpHeader *udp = (struct
                                            GNUNET_TUN_UdpHeader *) &ipp[1];
 
        GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
        pkt_len = sizeof(struct GNUNET_TUN_IPv4Header) + 8;
        make_up_icmpv4_payload (state,
                                ipp,
                                udp);
        payload = ipp;
      }
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv4 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end AF_INET */
    break;
 
  case AF_INET6:
    if (pkt_len < sizeof(struct in6_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv6_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v6 = (const struct in6_addr*) &msg[1];
    payload = &v6[1];
    pkt_len -= sizeof(struct in6_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv6 = *v6;
    if (NULL == state->specifics.tcp_udp.heap_node)
    {
      state->specifics.tcp_udp.ri.remote_address.af = af;
      state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_ICMPV6;
      setup_state_record (state);
    }
    /* check that ICMP type is something we want to support
       and possibly make up payload! */
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
    case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
      break;
 
    case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
    case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
    case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      /* make up payload */
      {
        struct GNUNET_TUN_IPv6Header *ipp = (struct
                                             GNUNET_TUN_IPv6Header *) buf;
        struct GNUNET_TUN_UdpHeader *udp = (struct
                                            GNUNET_TUN_UdpHeader *) &ipp[1];
 
        GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
        pkt_len = sizeof(struct GNUNET_TUN_IPv6Header) + 8;
        make_up_icmpv6_payload (state,
                                ipp,
                                udp);
        payload = ipp;
      }
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv6 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end AF_INET6 */
    break;
 
  default:
    /* bad AF */
    GNUNET_break_op (0);
    return;
  }
 
  {
    char buf_tmp[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received ICMP data from %s for forwarding to %s\n",
                GNUNET_i2s (&state->peer),
                inet_ntop (af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf_tmp, sizeof(buf_tmp)));
  }
  send_icmp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                            &state->specifics.tcp_udp.ri.local_address,
                            &msg->icmp_header,
                            payload, pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static uint16_t
make_up_icmp_service_payload (struct ChannelState *state,
                              char *buf)
{
  switch (state->specifics.tcp_udp.serv->address.af)
  {
  case AF_INET:
    {
      struct GNUNET_TUN_IPv4Header *ipv4;
      struct GNUNET_TUN_UdpHeader *udp;
 
      ipv4 = (struct GNUNET_TUN_IPv4Header *) buf;
      udp = (struct GNUNET_TUN_UdpHeader *) &ipv4[1];
      make_up_icmpv4_payload (state,
                              ipv4,
                              udp);
      GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
      return sizeof(struct GNUNET_TUN_IPv4Header) + 8;
    }
    break;
 
  case AF_INET6:
    {
      struct GNUNET_TUN_IPv6Header *ipv6;
      struct GNUNET_TUN_UdpHeader *udp;
 
      ipv6 = (struct GNUNET_TUN_IPv6Header *) buf;
      udp = (struct GNUNET_TUN_UdpHeader *) &ipv6[1];
      make_up_icmpv6_payload (state,
                              ipv6,
                              udp);
      GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
      return sizeof(struct GNUNET_TUN_IPv6Header) + 8;
    }
    break;
 
  default:
    GNUNET_break (0);
  }
  return 0;
}
 
 
static int
check_icmp_service (void *cls,
                    const struct GNUNET_EXIT_IcmpServiceMessage *msg)
{
  struct ChannelState *state = cls;
 
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (NULL == state->specifics.tcp_udp.serv)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_icmp_service (void *cls,
                     const struct GNUNET_EXIT_IcmpServiceMessage *msg)
{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_IcmpServiceMessage);
  struct GNUNET_TUN_IcmpHeader icmp;
  char buf[sizeof(struct GNUNET_TUN_IPv6Header) + 8] GNUNET_ALIGN;
  const void *payload;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# ICMP service requests received via cadet"),
                            1, GNUNET_NO);
  /* check that we got at least a valid header */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received data from %s for forwarding to ICMP service %s\n",
              GNUNET_i2s (&state->peer),
              GNUNET_h2s (&state->specifics.tcp_udp.serv->descriptor));
  icmp = msg->icmp_header;
  payload = &msg[1];
  state->specifics.tcp_udp.ri.remote_address
    = state->specifics.tcp_udp.serv->address;
  setup_state_record (state);
 
  /* check that ICMP type is something we want to support,
     perform ICMP PT if needed and possibly make up payload */
  switch (msg->af)
  {
  case AF_INET:
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_ECHO_REPLY;
      break;
 
    case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST;
      break;
 
    case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
      {
        GNUNET_STATISTICS_update (stats,
                                  gettext_noop (
                                    "# ICMPv4 packets dropped (impossible PT to v6)"),
                                  1, GNUNET_NO);
        return;
      }
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv4 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end of AF_INET */
    break;
 
  case AF_INET6:
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_ECHO_REPLY;
      break;
 
    case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_ECHO_REQUEST;
      break;
 
    case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
    case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
      {
        GNUNET_STATISTICS_update (stats,
                                  gettext_noop (
                                    "# ICMPv6 packets dropped (impossible PT to v4)"),
                                  1, GNUNET_NO);
        return;
      }
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv6 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end of AF_INET6 */
    break;
 
  default:
    GNUNET_break_op (0);
    return;
  }
 
  send_icmp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                            &state->specifics.tcp_udp.ri.local_address,
                            &icmp,
                            payload,
                            pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}
 
 
static int
free_service_record (void *cls,
                     const struct GNUNET_HashCode *key,
                     void *value)
{
  struct LocalService *service = value;
 
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap_remove (services,
                                                       key,
                                                       service));
  GNUNET_CADET_close_port (service->port);
  GNUNET_free (service->name);
  GNUNET_free (service);
  return GNUNET_OK;
}
 
 
static void *
new_service_channel (void *cls,
                     struct GNUNET_CADET_Channel *channel,
                     const struct GNUNET_PeerIdentity *initiator)
{
  struct LocalService *ls = cls;
  struct ChannelState *s = GNUNET_new (struct ChannelState);
 
  s->peer = *initiator;
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Inbound CADET channels created"),
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received inbound channel from `%s'\n",
              GNUNET_i2s (initiator));
  s->channel = channel;
  s->specifics.tcp_udp.serv = ls;
  s->specifics.tcp_udp.ri.remote_address = ls->address;
  return s;
}
 
 
static void
clean_channel (void *cls,
               const struct GNUNET_CADET_Channel *channel)
{
  struct ChannelState *s = cls;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Channel destroyed\n");
  if (GNUNET_SYSERR == s->is_dns)
  {
    GNUNET_free (s);
    return;
  }
  if (GNUNET_YES == s->is_dns)
  {
    if (channels[s->specifics.dns.my_id] == s)
      channels[s->specifics.dns.my_id] = NULL;
  }
  else
  {
    if (NULL != s->specifics.tcp_udp.heap_node)
    {
      GNUNET_assert (GNUNET_YES ==
                     GNUNET_CONTAINER_multihashmap_remove (connections_map,
                                                           &s->specifics.tcp_udp
                                                           .state_key,
                                                           s));
      GNUNET_CONTAINER_heap_remove_node (s->specifics.tcp_udp.heap_node);
      s->specifics.tcp_udp.heap_node = NULL;
    }
  }
  GNUNET_free (s);
}
 
 
static void
store_service (int proto,
               const char *name,
               uint16_t destination_port,
               struct LocalService *service)
{
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (icmp_service,
                           GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_SERVICE,
                           struct GNUNET_EXIT_IcmpServiceMessage,
                           service),
    GNUNET_MQ_hd_var_size (udp_service,
                           GNUNET_MESSAGE_TYPE_VPN_UDP_TO_SERVICE,
                           struct GNUNET_EXIT_UdpServiceMessage,
                           service),
    GNUNET_MQ_hd_var_size (tcp_service,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_TO_SERVICE_START,
                           struct GNUNET_EXIT_TcpServiceStartMessage,
                           service),
    GNUNET_MQ_hd_var_size (tcp_data,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT,
                           struct GNUNET_EXIT_TcpDataMessage,
                           service),
    GNUNET_MQ_handler_end ()
  };
 
  struct GNUNET_HashCode cadet_port;
 
  service->name = GNUNET_strdup (name);
  GNUNET_TUN_service_name_to_hash (name,
                                   &service->descriptor);
  GNUNET_TUN_compute_service_cadet_port (&service->descriptor,
                                         destination_port,
                                         &cadet_port);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Opening CADET port %s for SERVICE exit %s on port %u\n",
              GNUNET_h2s (&cadet_port),
              name,
              (unsigned int) destination_port);
  service->port = GNUNET_CADET_open_port (cadet_handle,
                                          &cadet_port,
                                          &new_service_channel,
                                          service,
                                          NULL,
                                          &clean_channel,
                                          handlers);
  service->is_udp = (IPPROTO_UDP == proto);
  if (GNUNET_OK !=
      GNUNET_CONTAINER_multihashmap_put (services,
                                         &cadet_port,
                                         service,
                                         GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
  {
    GNUNET_CADET_close_port (service->port);
    GNUNET_free (service->name);
    GNUNET_free (service);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                _ ("Got duplicate service records for `%s:%u'\n"),
                name,
                (unsigned int) destination_port);
  }
}
 
 
static void
send_packet_to_cadet_channel (struct ChannelState *s,
                              struct GNUNET_MQ_Envelope *env)
{
  GNUNET_assert (NULL != s);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# Messages transmitted via cadet channels"),
                            1,
                            GNUNET_NO);
  GNUNET_MQ_send (GNUNET_CADET_get_mq (s->channel),
                  env);
}
 
 
static void
icmp_from_helper (const struct GNUNET_TUN_IcmpHeader *icmp,
                  size_t pktlen,
                  int af,
                  const void *destination_ip,
                  const void *source_ip)
{
  struct ChannelState *state;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_EXIT_IcmpToVPNMessage *i2v;
  const struct GNUNET_TUN_IPv4Header *ipv4;
  const struct GNUNET_TUN_IPv6Header *ipv6;
  const struct GNUNET_TUN_UdpHeader *udp;
  uint16_t source_port;
  uint16_t destination_port;
  uint8_t protocol;
 
  {
    char sbuf[INET6_ADDRSTRLEN];
    char dbuf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received ICMP packet going from %s to %s\n",
                inet_ntop (af,
                           source_ip,
                           sbuf, sizeof(sbuf)),
                inet_ntop (af,
                           destination_ip,
                           dbuf, sizeof(dbuf)));
  }
 
  if (pktlen < sizeof(struct GNUNET_TUN_IcmpHeader))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
 
  /* Find out if this is an ICMP packet in response to an existing
     TCP/UDP packet and if so, figure out ports / protocol of the
     existing session from the IP data in the ICMP payload */
  source_port = 0;
  destination_port = 0;
  switch (af)
  {
  case AF_INET:
    protocol = IPPROTO_ICMP;
    switch (icmp->type)
    {
    case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
    case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
      break;
 
    case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
    case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
      if (pktlen <
          sizeof(struct GNUNET_TUN_IcmpHeader)
          + sizeof(struct GNUNET_TUN_IPv4Header) + 8)
      {
        /* blame kernel */
        GNUNET_break (0);
        return;
      }
      ipv4 = (const struct GNUNET_TUN_IPv4Header *) &icmp[1];
      protocol = ipv4->protocol;
      /* could be TCP or UDP, but both have the ports in the right
         place, so that doesn't matter here */
      udp = (const struct GNUNET_TUN_UdpHeader *) &ipv4[1];
      /* swap ports, as they are from the original message */
      destination_port = ntohs (udp->source_port);
      source_port = ntohs (udp->destination_port);
      /* throw away ICMP payload, won't be useful for the other side anyway */
      pktlen = sizeof(struct GNUNET_TUN_IcmpHeader);
      break;
 
    default:
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv4 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    break;
 
  case AF_INET6:
    protocol = IPPROTO_ICMPV6;
    switch (icmp->type)
    {
    case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
    case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
    case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
      if (pktlen <
          sizeof(struct GNUNET_TUN_IcmpHeader)
          + sizeof(struct GNUNET_TUN_IPv6Header) + 8)
      {
        /* blame kernel */
        GNUNET_break (0);
        return;
      }
      ipv6 = (const struct GNUNET_TUN_IPv6Header *) &icmp[1];
      protocol = ipv6->next_header;
      /* could be TCP or UDP, but both have the ports in the right
         place, so that doesn't matter here */
      udp = (const struct GNUNET_TUN_UdpHeader *) &ipv6[1];
      /* swap ports, as they are from the original message */
      destination_port = ntohs (udp->source_port);
      source_port = ntohs (udp->destination_port);
      /* throw away ICMP payload, won't be useful for the other side anyway */
      pktlen = sizeof(struct GNUNET_TUN_IcmpHeader);
      break;
 
    case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
    case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
      break;
 
    default:
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv6 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    break;
 
  default:
    GNUNET_assert (0);
  }
  switch (protocol)
  {
  case IPPROTO_ICMP:
    state = get_redirect_state (af,
                                IPPROTO_ICMP,
                                source_ip,
                                0,
                                destination_ip,
                                0,
                                NULL);
    break;
 
  case IPPROTO_ICMPV6:
    state = get_redirect_state (af,
                                IPPROTO_ICMPV6,
                                source_ip,
                                0,
                                destination_ip,
                                0,
                                NULL);
    break;
 
  case IPPROTO_UDP:
    state = get_redirect_state (af,
                                IPPROTO_UDP,
                                source_ip,
                                source_port,
                                destination_ip,
                                destination_port,
                                NULL);
    break;
 
  case IPPROTO_TCP:
    state = get_redirect_state (af,
                                IPPROTO_TCP,
                                source_ip,
                                source_port,
                                destination_ip,
                                destination_port,
                                NULL);
    break;
 
  default:
    GNUNET_STATISTICS_update (stats,
                              gettext_noop (
                                "# ICMP packets dropped (not allowed)"),
                              1,
                              GNUNET_NO);
    return;
  }
  if (NULL == state)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                _ (
                  "ICMP Packet dropped, have no matching connection information\n"));
    return;
  }
  env = GNUNET_MQ_msg_extra (i2v,
                             pktlen - sizeof(struct GNUNET_TUN_IcmpHeader),
                             GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_VPN);
  i2v->af = htonl (af);
  GNUNET_memcpy (&i2v->icmp_header,
                 icmp,
                 pktlen);
  send_packet_to_cadet_channel (state,
                                env);
}
 
 
static void
udp_from_helper (const struct GNUNET_TUN_UdpHeader *udp,
                 size_t pktlen,
                 int af,
                 const void *destination_ip,
                 const void *source_ip)
{
  struct ChannelState *state;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_EXIT_UdpReplyMessage *urm;
 
  {
    char sbuf[INET6_ADDRSTRLEN];
    char dbuf[INET6_ADDRSTRLEN];
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received UDP packet going from %s:%u to %s:%u\n",
                inet_ntop (af,
                           source_ip,
                           sbuf, sizeof(sbuf)),
                (unsigned int) ntohs (udp->source_port),
                inet_ntop (af,
                           destination_ip,
                           dbuf, sizeof(dbuf)),
                (unsigned int) ntohs (udp->destination_port));
  }
 
  if (pktlen < sizeof(struct GNUNET_TUN_UdpHeader))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
  if (pktlen != ntohs (udp->len))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
  state = get_redirect_state (af,
                              IPPROTO_UDP,
                              source_ip,
                              ntohs (udp->source_port),
                              destination_ip,
                              ntohs (udp->destination_port),
                              NULL);
  if (NULL == state)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                _ (
                  "UDP Packet dropped, have no matching connection information\n"));
    return;
  }
  env = GNUNET_MQ_msg_extra (urm,
                             pktlen - sizeof(struct GNUNET_TUN_UdpHeader),
                             GNUNET_MESSAGE_TYPE_VPN_UDP_REPLY);
  urm->source_port = htons (0);
  urm->destination_port = htons (0);
  GNUNET_memcpy (&urm[1],
                 &udp[1],
                 pktlen - sizeof(struct GNUNET_TUN_UdpHeader));
  send_packet_to_cadet_channel (state,
                                env);
}
 
 
static void
tcp_from_helper (const struct GNUNET_TUN_TcpHeader *tcp,
                 size_t pktlen,
                 int af,
                 const void *destination_ip,
                 const void *source_ip)
{
  struct ChannelState *state;
  char buf[pktlen] GNUNET_ALIGN;
  struct GNUNET_TUN_TcpHeader *mtcp;
  struct GNUNET_EXIT_TcpDataMessage *tdm;
  struct GNUNET_MQ_Envelope *env;
  size_t mlen;
 
  {
    char sbuf[INET6_ADDRSTRLEN];
    char dbuf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received TCP packet with %u bytes going from %s:%u to %s:%u\n",
                (unsigned int) (pktlen - sizeof(struct GNUNET_TUN_TcpHeader)),
                inet_ntop (af,
                           source_ip,
                           sbuf, sizeof(sbuf)),
                (unsigned int) ntohs (tcp->source_port),
                inet_ntop (af,
                           destination_ip,
                           dbuf, sizeof(dbuf)),
                (unsigned int) ntohs (tcp->destination_port));
  }
 
  if (pktlen < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
  state = get_redirect_state (af,
                              IPPROTO_TCP,
                              source_ip,
                              ntohs (tcp->source_port),
                              destination_ip,
                              ntohs (tcp->destination_port),
                              NULL);
  if (NULL == state)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                _ (
                  "TCP Packet dropped, have no matching connection information\n"));
 
    return;
  }
  /* mug port numbers and crc to avoid information leakage;
     sender will need to lookup the correct values anyway */
  GNUNET_memcpy (buf, tcp, pktlen);
  mtcp = (struct GNUNET_TUN_TcpHeader *) buf;
  mtcp->source_port = 0;
  mtcp->destination_port = 0;
  mtcp->crc = 0;
 
  mlen = sizeof(struct GNUNET_EXIT_TcpDataMessage) + (pktlen - sizeof(struct
                                                                      GNUNET_TUN_TcpHeader));
  if (mlen >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  env = GNUNET_MQ_msg_extra (tdm,
                             pktlen - sizeof(struct GNUNET_TUN_TcpHeader),
                             GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_VPN);
  tdm->reserved = htonl (0);
  GNUNET_memcpy (&tdm->tcp_header,
                 buf,
                 pktlen);
  send_packet_to_cadet_channel (state,
                                env);
}
 
 
static int
message_token (void *cls GNUNET_UNUSED,
               const struct GNUNET_MessageHeader *message)
{
  const struct GNUNET_TUN_Layer2PacketHeader *pkt_tun;
  size_t size;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Got %u-byte message of type %u from gnunet-helper-exit\n",
              ntohs (message->size),
              ntohs (message->type));
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Packets received from TUN"),
                            1, GNUNET_NO);
  if (ntohs (message->type) != GNUNET_MESSAGE_TYPE_VPN_HELPER)
  {
    GNUNET_break (0);
    return GNUNET_OK;
  }
  size = ntohs (message->size);
  if (size < sizeof(struct GNUNET_TUN_Layer2PacketHeader) + sizeof(struct
                                                                   GNUNET_MessageHeader))
  {
    GNUNET_break (0);
    return GNUNET_OK;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from TUN"),
                            size, GNUNET_NO);
  pkt_tun = (const struct GNUNET_TUN_Layer2PacketHeader *) &message[1];
  size -= sizeof(struct GNUNET_TUN_Layer2PacketHeader) + sizeof(struct
                                                                GNUNET_MessageHeader);
  switch (ntohs (pkt_tun->proto))
  {
  case ETH_P_IPV4:
    {
      const struct GNUNET_TUN_IPv4Header *pkt4;
 
      if (size < sizeof(struct GNUNET_TUN_IPv4Header))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      pkt4 = (const struct GNUNET_TUN_IPv4Header *) &pkt_tun[1];
      if (size != ntohs (pkt4->total_length))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      if (pkt4->header_length * 4 != sizeof(struct GNUNET_TUN_IPv4Header))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ ("IPv4 packet options received.  Ignored.\n"));
        return GNUNET_OK;
      }
 
      size -= sizeof(struct GNUNET_TUN_IPv4Header);
      switch (pkt4->protocol)
      {
      case IPPROTO_UDP:
        udp_from_helper ((const struct GNUNET_TUN_UdpHeader *) &pkt4[1], size,
                         AF_INET,
                         &pkt4->destination_address,
                         &pkt4->source_address);
        break;
 
      case IPPROTO_TCP:
        tcp_from_helper ((const struct GNUNET_TUN_TcpHeader *) &pkt4[1], size,
                         AF_INET,
                         &pkt4->destination_address,
                         &pkt4->source_address);
        break;
 
      case IPPROTO_ICMP:
        icmp_from_helper ((const struct GNUNET_TUN_IcmpHeader *) &pkt4[1], size,
                          AF_INET,
                          &pkt4->destination_address,
                          &pkt4->source_address);
        break;
 
      default:
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "IPv4 packet with unsupported next header %u received.  Ignored.\n"),
                    (int) pkt4->protocol);
        return GNUNET_OK;
      }
    }
    break;
 
  case ETH_P_IPV6:
    {
      const struct GNUNET_TUN_IPv6Header *pkt6;
 
      if (size < sizeof(struct GNUNET_TUN_IPv6Header))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      pkt6 = (struct GNUNET_TUN_IPv6Header *) &pkt_tun[1];
      if (size != ntohs (pkt6->payload_length) + sizeof(struct
                                                        GNUNET_TUN_IPv6Header))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      size -= sizeof(struct GNUNET_TUN_IPv6Header);
      switch (pkt6->next_header)
      {
      case IPPROTO_UDP:
        udp_from_helper ((const struct GNUNET_TUN_UdpHeader *) &pkt6[1], size,
                         AF_INET6,
                         &pkt6->destination_address,
                         &pkt6->source_address);
        break;
 
      case IPPROTO_TCP:
        tcp_from_helper ((const struct GNUNET_TUN_TcpHeader *) &pkt6[1], size,
                         AF_INET6,
                         &pkt6->destination_address,
                         &pkt6->source_address);
        break;
 
      case IPPROTO_ICMPV6:
        icmp_from_helper ((const struct GNUNET_TUN_IcmpHeader *) &pkt6[1], size,
                          AF_INET6,
                          &pkt6->destination_address,
                          &pkt6->source_address);
        break;
 
      default:
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "IPv6 packet with unsupported next header %d received.  Ignored.\n"),
                    pkt6->next_header);
        return GNUNET_OK;
      }
    }
    break;
 
  default:
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                _ ("Packet from unknown protocol %u received.  Ignored.\n"),
                ntohs (pkt_tun->proto));
    break;
  }
  return GNUNET_OK;
}
 
 
static void *
new_channel (void *cls,
             struct GNUNET_CADET_Channel *channel,
             const struct GNUNET_PeerIdentity *initiator)
{
  struct ChannelState *s = GNUNET_new (struct ChannelState);
 
  s->is_dns = GNUNET_SYSERR;
  s->peer = *initiator;
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Inbound CADET channels created"),
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received inbound channel from `%s'\n",
              GNUNET_i2s (initiator));
  s->channel = channel;
  return s;
}
 
 
static int
free_iterate (void *cls,
              const struct GNUNET_HashCode *hash,
              void *value)
{
  GNUNET_free (value);
  return GNUNET_YES;
}
 
 
static void
dummy_task (void *cls)
{
  /* just terminate */
}
 
 
static void
cleanup (void *cls)
{
  unsigned int i;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Exit service is shutting down now\n");
 
  if (NULL != helper_handle)
  {
    GNUNET_HELPER_stop (helper_handle, GNUNET_NO);
    helper_handle = NULL;
  }
  if (NULL != regex4)
  {
    GNUNET_REGEX_announce_cancel (regex4);
    regex4 = NULL;
  }
  if (NULL != regex6)
  {
    GNUNET_REGEX_announce_cancel (regex6);
    regex6 = NULL;
  }
  if (NULL != services)
  {
    GNUNET_CONTAINER_multihashmap_iterate (services,
                                           &free_service_record,
                                           NULL);
    GNUNET_CONTAINER_multihashmap_destroy (services);
  }
  if (NULL != dns_port)
  {
    GNUNET_CADET_close_port (dns_port);
    dns_port = NULL;
  }
  if (NULL != cadet_port4)
  {
    GNUNET_CADET_close_port (cadet_port4);
    cadet_port4 = NULL;
  }
  if (NULL != cadet_port6)
  {
    GNUNET_CADET_close_port (cadet_port6);
    cadet_port6 = NULL;
  }
  if (NULL != cadet_handle)
  {
    GNUNET_CADET_disconnect (cadet_handle);
    cadet_handle = NULL;
  }
  if (NULL != connections_map)
  {
    GNUNET_CONTAINER_multihashmap_iterate (connections_map,
                                           &free_iterate,
                                           NULL);
    GNUNET_CONTAINER_multihashmap_destroy (connections_map);
    connections_map = NULL;
  }
  if (NULL != connections_heap)
  {
    GNUNET_CONTAINER_heap_destroy (connections_heap);
    connections_heap = NULL;
  }
  if (NULL != dnsstub)
  {
    GNUNET_DNSSTUB_stop (dnsstub);
    dnsstub = NULL;
  }
  if (NULL != sign_op)
  {
    GNUNET_PILS_cancel (sign_op);
    sign_op = NULL;
  }
  if (NULL != pils)
  {
    GNUNET_PILS_disconnect (pils);
    pils = NULL;
  }
  if (NULL != dht_task)
  {
    GNUNET_SCHEDULER_cancel (dht_task);
    dht_task = NULL;
  }
  if (NULL != dht_put)
  {
    GNUNET_DHT_put_cancel (dht_put);
    dht_put = NULL;
  }
  if (NULL != dht)
  {
    GNUNET_DHT_disconnect (dht);
    dht = NULL;
  }
  if (NULL != stats)
  {
    GNUNET_STATISTICS_destroy (stats,
                               GNUNET_NO);
    stats = NULL;
  }
  for (i = 0; i < 8; i++)
    GNUNET_free (exit_argv[i]);
}
 
 
static void
add_services (int proto,
              char *cpy,
              const char *name)
{
  char *redirect;
  char *hostname;
  char *hostport;
  struct LocalService *serv;
  char *n;
  size_t slen;
  int local_port;
  int remote_port;
 
  slen = strlen (name);
  GNUNET_assert (slen >= 8);
  n = GNUNET_strndup (name, slen - 8 /* remove .gnunet. */);
 
  for (redirect = strtok (cpy, " ;"); redirect != NULL;
       redirect = strtok (NULL, " ;"))
  {
    if (NULL == (hostname = strstr (redirect, ":")))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ (
                    "Option `%s' for domain `%s' is not formatted correctly!\n")
                  ,
                  redirect,
                  name);
      continue;
    }
    hostname[0] = '\0';
    hostname++;
    if (NULL == (hostport = strstr (hostname, ":")))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ (
                    "Option `%s' for domain `%s' is not formatted correctly!\n")
                  ,
                  redirect,
                  name);
      continue;
    }
    hostport[0] = '\0';
    hostport++;
 
    local_port = atoi (redirect);
    remote_port = atoi (hostport);
 
    if (! ((local_port > 0) && (local_port < 65536)))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ ("`%s' is not a valid port number (for domain `%s')!"),
                  redirect,
                  name);
      continue;
    }
    if (! ((remote_port > 0) && (remote_port < 65536)))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ ("`%s' is not a valid port number (for domain `%s')!"),
                  hostport,
                  name);
      continue;
    }
 
    serv = GNUNET_new (struct LocalService);
    serv->address.proto = proto;
    serv->address.port = remote_port;
    if (0 == strcmp ("localhost4",
                     hostname))
    {
      const char *ip4addr = exit_argv[5];
 
      serv->address.af = AF_INET;
      GNUNET_assert (1 == inet_pton (AF_INET,
                                     ip4addr,
                                     &serv->address.address.ipv4));
    }
    else if (0 == strcmp ("localhost6",
                          hostname))
    {
      const char *ip6addr = exit_argv[3];
 
      serv->address.af = AF_INET6;
      GNUNET_assert (1 == inet_pton (AF_INET6,
                                     ip6addr,
                                     &serv->address.address.ipv6));
    }
    else
    {
      struct addrinfo *res;
      int ret;
 
      ret = getaddrinfo (hostname,
                         NULL,
                         NULL,
                         &res);
      if ((0 != ret) || (NULL == res))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "No addresses found for hostname `%s' of service `%s'!\n")
                    ,
                    hostname,
                    n);
        GNUNET_free (serv);
        continue;
      }
 
      serv->address.af = res->ai_family;
      switch (res->ai_family)
      {
      case AF_INET:
        if (! ipv4_enabled)
        {
          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                      _ (
                        "Service `%s' configured for IPv4, but IPv4 is disabled!\n"),
                      n);
          freeaddrinfo (res);
          GNUNET_free (serv);
          continue;
        }
        serv->address.address.ipv4
          = ((struct sockaddr_in *) res->ai_addr)->sin_addr;
        break;
 
      case AF_INET6:
        if (! ipv6_enabled)
        {
          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                      _ (
                        "Service `%s' configured for IPv4, but IPv4 is disabled!\n"),
                      n);
          freeaddrinfo (res);
          GNUNET_free (serv);
          continue;
        }
        serv->address.address.ipv6
          = ((struct sockaddr_in6 *) res->ai_addr)->sin6_addr;
        break;
 
      default:
        freeaddrinfo (res);
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "No IP addresses found for hostname `%s' of service `%s'!\n"),
                    hostname,
                    n);
        GNUNET_free (serv);
        continue;
      }
      freeaddrinfo (res);
    }
    store_service (proto,
                   n,
                   local_port,
                   serv);
  }
  GNUNET_free (n);
}
 
 
static void
read_service_conf (void *cls,
                   const char *section)
{
  char *cpy;
 
  if ((strlen (section) < 8) ||
      (0 != strcmp (".gnunet.", section + (strlen (section) - 8))))
    return;
  if (GNUNET_OK ==
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             section,
                                             "UDP_REDIRECTS",
                                             &cpy))
  {
    add_services (IPPROTO_UDP,
                  cpy,
                  section);
    GNUNET_free (cpy);
  }
  if (GNUNET_OK ==
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             section,
                                             "TCP_REDIRECTS",
                                             &cpy))
  {
    add_services (IPPROTO_TCP,
                  cpy,
                  section);
    GNUNET_free (cpy);
  }
}
 
 
static void
do_dht_put (void *cls);
 
 
static void
dht_put_cont (void *cls)
{
  dht_put = NULL;
}
 
 
static void
sign_dns_advertisement (void *cls,
                        const struct GNUNET_PeerIdentity *pid,
                        const struct GNUNET_CRYPTO_EddsaSignature *sig)
{
  GNUNET_assert (sig);
 
  sign_op = NULL;
 
  GNUNET_memcpy (&dns_advertisement.signature, sig,
                 sizeof (dns_advertisement.signature));
 
  do_dht_put (cls);
}
 
 
static void
do_dht_put (void *cls)
{
  struct GNUNET_TIME_Absolute expiration;
 
  dht_task = GNUNET_SCHEDULER_add_delayed (DHT_PUT_FREQUENCY,
                                           &do_dht_put,
                                           NULL);
  expiration = GNUNET_TIME_absolute_ntoh (dns_advertisement.expiration_time);
  if (GNUNET_TIME_absolute_get_remaining (expiration).rel_value_us <
      GNUNET_TIME_UNIT_HOURS.rel_value_us)
  {
    /* refresh advertisement */
    expiration = GNUNET_TIME_relative_to_absolute (DNS_ADVERTISEMENT_TIMEOUT);
    dns_advertisement.expiration_time = GNUNET_TIME_absolute_hton (expiration);
 
    if (NULL != sign_op)
      GNUNET_PILS_cancel (sign_op);
 
    sign_op = GNUNET_PILS_sign_by_peer_identity (pils, &dns_advertisement.
                                                 purpose,
                                                 &sign_dns_advertisement, cls);
    return;
  }
  if (NULL != dht_put)
    GNUNET_DHT_put_cancel (dht_put);
  dht_put = GNUNET_DHT_put (dht,
                            &dht_put_key,
                            1 /* replication */,
                            GNUNET_DHT_RO_NONE,
                            GNUNET_BLOCK_TYPE_DNS,
                            sizeof(struct GNUNET_DNS_Advertisement),
                            &dns_advertisement,
                            expiration,
                            &dht_put_cont,
                            NULL);
}
 
 
static void
do_initial_dht_put (void *cls,
                    const struct GNUNET_HELLO_Parser *parser,
                    const struct GNUNET_HashCode *hash)
{
  const struct GNUNET_PeerIdentity *my_identity;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  GNUNET_memcpy (&dns_advertisement.peer,
                 my_identity, sizeof (*my_identity));
  dns_advertisement.purpose.size = htonl (sizeof(struct
                                                 GNUNET_DNS_Advertisement)
                                          - sizeof(struct
                                                   GNUNET_CRYPTO_EddsaSignature)
                                          );
  dns_advertisement.purpose.purpose = htonl (
    GNUNET_SIGNATURE_PURPOSE_DNS_RECORD);
  GNUNET_CRYPTO_hash ("dns",
                      strlen ("dns"),
                      &dht_put_key);
 
  if (NULL != sign_op)
  {
    GNUNET_PILS_cancel (sign_op);
    sign_op = NULL;
  }
 
  if (NULL != dht_task)
    GNUNET_SCHEDULER_cancel (dht_task);
 
  dht_task = GNUNET_SCHEDULER_add_now (&do_dht_put,
                                       NULL);
}
 
 
static void
parse_ip_options ()
{
  ipv4_exit = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                    "exit",
                                                    "EXIT_IPV4");
  ipv6_exit = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                    "exit",
                                                    "EXIT_IPV6");
  ipv4_enabled = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                       "exit",
                                                       "ENABLE_IPV4");
  ipv6_enabled = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                       "exit",
                                                       "ENABLE_IPV6");
  if ((ipv4_exit || ipv4_enabled) &&
      (GNUNET_OK != GNUNET_NETWORK_test_pf (PF_INET)) )
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "This system does not support IPv4, will disable IPv4 functions despite them being enabled in the configuration\n"));
    ipv4_exit = GNUNET_NO;
    ipv4_enabled = GNUNET_NO;
  }
  if ((ipv6_exit || ipv6_enabled) &&
      (GNUNET_OK != GNUNET_NETWORK_test_pf (PF_INET6)) )
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "This system does not support IPv6, will disable IPv6 functions despite them being enabled in the configuration\n"));
    ipv6_exit = GNUNET_NO;
    ipv6_enabled = GNUNET_NO;
  }
  if (ipv4_exit && (! ipv4_enabled))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "Cannot enable IPv4 exit but disable IPv4 on TUN interface, will use ENABLE_IPv4=YES\n"));
    ipv4_enabled = GNUNET_YES;
  }
  if (ipv6_exit && (! ipv6_enabled))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "Cannot enable IPv6 exit but disable IPv6 on TUN interface, will use ENABLE_IPv6=YES\n"));
    ipv6_enabled = GNUNET_YES;
  }
}
 
 
static void
advertise_dns_exit ()
{
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (dns_request,
                           GNUNET_MESSAGE_TYPE_VPN_DNS_TO_INTERNET,
                           struct DnsResponseMessage,
                           NULL),
    GNUNET_MQ_handler_end ()
  };
  char *dns_exit;
  struct GNUNET_HashCode port;
 
  if (GNUNET_YES !=
      GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                            "exit",
                                            "EXIT_DNS"))
    return;
  GNUNET_assert (NULL != (dnsstub = GNUNET_DNSSTUB_start (128)));
  dns_exit = NULL;
  /* TODO: support using multiple DNS resolvers */
  if ((GNUNET_OK !=
       GNUNET_CONFIGURATION_get_value_string (cfg,
                                              "exit",
                                              "DNS_RESOLVER",
                                              &dns_exit)) ||
      (GNUNET_OK !=
       GNUNET_DNSSTUB_add_dns_ip (dnsstub,
                                  dns_exit)))
  {
    GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                               "dns",
                               "DNS_RESOLVER",
                               _ ("need a valid IPv4 or IPv6 address\n"));
    GNUNET_free (dns_exit);
    return;
  }
  /* open port */
  GNUNET_CRYPTO_hash (GNUNET_APPLICATION_PORT_INTERNET_RESOLVER,
                      strlen (GNUNET_APPLICATION_PORT_INTERNET_RESOLVER),
                      &port);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Opening CADET port %s for DNS exit service\n",
              GNUNET_h2s (&port));
  dns_port = GNUNET_CADET_open_port (cadet_handle,
                                     &port,
                                     &new_channel,
                                     NULL,
                                     NULL,
                                     &clean_channel,
                                     handlers);
  /* advertise exit */
  dht = GNUNET_DHT_connect (cfg, 1);
  dht_task = NULL;
  pils = GNUNET_PILS_connect (cfg, &do_initial_dht_put, NULL);
  sign_op = NULL;
  GNUNET_free (dns_exit);
}
 
 
static int
setup_exit_helper_args ()
{
  char *exit_ifname;
  char *tun_ifname;
  char *ipv6addr;
  char *ipv6prefix_s;
  char *ipv4addr;
  char *ipv4mask;
 
  exit_argv[0] = GNUNET_strdup ("exit-gnunet");
  if (GNUNET_SYSERR ==
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             "exit",
                                             "TUN_IFNAME",
                                             &tun_ifname))
  {
    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                               "EXIT",
                               "TUN_IFNAME");
    return GNUNET_SYSERR;
  }
  exit_argv[1] = tun_ifname;
  if (ipv4_enabled)
  {
    if (GNUNET_SYSERR ==
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "EXIT_IFNAME",
                                               &exit_ifname))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "EXIT_IFNAME");
      return GNUNET_SYSERR;
    }
    exit_argv[2] = exit_ifname;
  }
  else
  {
    exit_argv[2] = GNUNET_strdup ("-");
  }
 
  if (GNUNET_YES == ipv6_enabled)
  {
    ipv6addr = NULL;
    if (((GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg,
                                                 "exit",
                                                 "IPV6ADDR",
                                                 &ipv6addr)) ||
         (1 != inet_pton (AF_INET6,
                          ipv6addr,
                          &exit_ipv6addr))))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV6ADDR");
      GNUNET_free (ipv6addr);
      return GNUNET_SYSERR;
    }
    exit_argv[3] = ipv6addr;
    if (GNUNET_SYSERR ==
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "IPV6PREFIX",
                                               &ipv6prefix_s))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV6PREFIX");
      return GNUNET_SYSERR;
    }
    exit_argv[4] = ipv6prefix_s;
    if ((GNUNET_OK !=
         GNUNET_CONFIGURATION_get_value_number (cfg,
                                                "exit",
                                                "IPV6PREFIX",
                                                &ipv6prefix)) ||
        (ipv6prefix >= 127))
    {
      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV6PREFIX",
                                 _ ("Must be a number"));
      return GNUNET_SYSERR;
    }
  }
  else
  {
    /* IPv6 explicitly disabled */
    exit_argv[3] = GNUNET_strdup ("-");
    exit_argv[4] = GNUNET_strdup ("-");
  }
  if (GNUNET_YES == ipv4_enabled)
  {
    ipv4addr = NULL;
    if (((GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg,
                                                 "exit",
                                                 "IPV4ADDR",
                                                 &ipv4addr)) ||
         (1 != inet_pton (AF_INET,
                          ipv4addr,
                          &exit_ipv4addr))))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV4ADDR");
      GNUNET_free (ipv4addr);
      return GNUNET_SYSERR;
    }
    exit_argv[5] = ipv4addr;
    ipv4mask = NULL;
    if (((GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg,
                                                 "exit",
                                                 "IPV4MASK",
                                                 &ipv4mask)) ||
         (1 != inet_pton (AF_INET,
                          ipv4mask,
                          &exit_ipv4mask))))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV4MASK");
      GNUNET_free (ipv4mask);
      return GNUNET_SYSERR;
    }
    exit_argv[6] = ipv4mask;
  }
  else
  {
    /* IPv4 explicitly disabled */
    exit_argv[5] = GNUNET_strdup ("-");
    exit_argv[6] = GNUNET_strdup ("-");
  }
  exit_argv[7] = NULL;
  return GNUNET_OK;
}
 
 
static void
run (void *cls,
     char *const *args,
     const char *cfgfile,
     const struct GNUNET_CONFIGURATION_Handle *cfg_)
{
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (icmp_remote,
                           GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_INTERNET,
                           struct GNUNET_EXIT_IcmpInternetMessage,
                           NULL),
    GNUNET_MQ_hd_var_size (udp_remote,
                           GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET,
                           struct GNUNET_EXIT_UdpInternetMessage,
                           NULL),
    GNUNET_MQ_hd_var_size (tcp_remote,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_TO_INTERNET_START,
                           struct GNUNET_EXIT_TcpInternetStartMessage,
                           NULL),
    GNUNET_MQ_hd_var_size (tcp_data,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT,
                           struct GNUNET_EXIT_TcpDataMessage,
                           NULL),
    GNUNET_MQ_handler_end ()
  };
  struct GNUNET_HashCode port;
  char *policy;
  char *binary;
  char *regex;
  char *prefixed_regex;
 
  cfg = cfg_;
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_number (cfg,
                                             "exit",
                                             "MAX_CONNECTIONS",
                                             &max_connections))
    max_connections = 1024;
  parse_ip_options ();
  binary = GNUNET_CONFIGURATION_get_suid_binary_path (
    GNUNET_OS_project_data_gnunet (),
    cfg,
    "gnunet-helper-exit");
  if ((ipv4_exit) || (ipv6_exit))
  {
    if (GNUNET_YES !=
        GNUNET_OS_check_helper_binary (binary,
                                       GNUNET_YES,
                                       "gnunet-vpn - - - 169.1.3.7 255.255.255.0"))
    // no nat, ipv4 only
    {
      GNUNET_free (binary);
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                  _ (
                    "`%s' is not SUID or the path is invalid, EXIT will not work\n"),
                  "gnunet-helper-exit");
      GNUNET_SCHEDULER_add_shutdown (&dummy_task,
                                     NULL);
      global_ret = 1;
      return;
    }
  }
  if (! (ipv4_enabled || ipv6_enabled))
  {
    GNUNET_free (binary);
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("No useful service enabled.  Exiting.\n"));
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
 
  GNUNET_SCHEDULER_add_shutdown (&cleanup,
                                 NULL);
  stats = GNUNET_STATISTICS_create ("exit",
                                    cfg);
  cadet_handle = GNUNET_CADET_connect (cfg);
  if (NULL == cadet_handle)
  {
    GNUNET_free (binary);
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
  advertise_dns_exit ();
  if (GNUNET_OK !=
      setup_exit_helper_args ())
  {
    GNUNET_free (binary);
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
 
  services = GNUNET_CONTAINER_multihashmap_create (65536,
                                                   GNUNET_NO);
  connections_map = GNUNET_CONTAINER_multihashmap_create (65536,
                                                          GNUNET_NO);
  connections_heap = GNUNET_CONTAINER_heap_create (
    GNUNET_CONTAINER_HEAP_ORDER_MIN);
  GNUNET_CONFIGURATION_iterate_sections (cfg,
                                         &read_service_conf,
                                         NULL);
 
  /* Cadet handle acquired, now open ports and announce regular
     expressions matching our exit */
  if ((GNUNET_YES == ipv4_enabled) &&
      (GNUNET_YES == ipv4_exit))
  {
    GNUNET_CRYPTO_hash (GNUNET_APPLICATION_PORT_IPV4_GATEWAY,
                        strlen (GNUNET_APPLICATION_PORT_IPV4_GATEWAY),
                        &port);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Opening CADET port %s for IPv4 gateway service\n",
                GNUNET_h2s (&port));
    cadet_port4 = GNUNET_CADET_open_port (cadet_handle,
                                          &port,
                                          &new_channel,
                                          NULL,
                                          NULL,
                                          &clean_channel,
                                          handlers);
    policy = NULL;
    if (GNUNET_OK !=
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "EXIT_RANGE_IPV4_POLICY",
                                               &policy))
      regex = NULL;
    else
      regex = GNUNET_REGEX_ipv4policy2regex (policy);
    GNUNET_free (policy);
    if (NULL != regex)
    {
      (void) GNUNET_asprintf (&prefixed_regex,
                              "%s%s",
                              GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
                              regex);
      regex4 = GNUNET_REGEX_announce (cfg,
                                      prefixed_regex,
                                      REGEX_REFRESH_FREQUENCY,
                                      REGEX_MAX_PATH_LEN_IPV4);
      GNUNET_free (regex);
      GNUNET_free (prefixed_regex);
    }
  }
 
  if ((GNUNET_YES == ipv6_enabled) && (GNUNET_YES == ipv6_exit))
  {
    GNUNET_CRYPTO_hash (GNUNET_APPLICATION_PORT_IPV6_GATEWAY,
                        strlen (GNUNET_APPLICATION_PORT_IPV6_GATEWAY),
                        &port);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Opening CADET port %s for IPv6 gateway service\n",
                GNUNET_h2s (&port));
    cadet_port6 = GNUNET_CADET_open_port (cadet_handle,
                                          &port,
                                          &new_channel,
                                          NULL,
                                          NULL,
                                          &clean_channel,
                                          handlers);
    policy = NULL;
    if (GNUNET_OK !=
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "EXIT_RANGE_IPV6_POLICY",
                                               &policy))
      regex = NULL;
    else
      regex = GNUNET_REGEX_ipv6policy2regex (policy);
    GNUNET_free (policy);
    if (NULL != regex)
    {
      (void) GNUNET_asprintf (&prefixed_regex,
                              "%s%s",
                              GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
                              regex);
      regex6 = GNUNET_REGEX_announce (cfg,
                                      prefixed_regex,
                                      REGEX_REFRESH_FREQUENCY,
                                      REGEX_MAX_PATH_LEN_IPV6);
      GNUNET_free (regex);
      GNUNET_free (prefixed_regex);
    }
  }
  helper_handle = GNUNET_HELPER_start (GNUNET_OS_project_data_gnunet (),
                                       GNUNET_NO,
                                       binary,
                                       exit_argv,
                                       &message_token,
                                       NULL,
                                       NULL);
  GNUNET_free (binary);
}
 
 
int
main (int argc,
      char *const *argv)
{
  static const struct GNUNET_GETOPT_CommandLineOption options[] = {
    GNUNET_GETOPT_OPTION_END
  };
 
  return (GNUNET_OK ==
          GNUNET_PROGRAM_run (GNUNET_OS_project_data_gnunet (),
                              argc,
                              argv,
                              "gnunet-daemon-exit",
                              gettext_noop (
                                "Daemon to run to provide an IP exit node for the VPN"),
                              options,
                              &run,
                              NULL)) ? global_ret : 1;
}
 
 
/* end of gnunet-daemon-exit.c */

DHT_PUT_FREQUENCY

#define DHT_PUT_FREQUENCY

Value:

          GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_MINUTES, 15)

How frequently do we re-announce the DNS exit in the DHT?

Definition at line 73 of file gnunet-daemon-exit.c.

DNS_ADVERTISEMENT_TIMEOUT

#define DNS_ADVERTISEMENT_TIMEOUT

Value:

          GNUNET_TIME_relative_multiply ( \
          GNUNET_TIME_UNIT_HOURS, 3)

How long do we typically sign the DNS exit advertisement for?

Definition at line 79 of file gnunet-daemon-exit.c.

LOG

#define LOG	(		kind,
			...
	)		GNUNET_log_from (kind, "exit", __VA_ARGS__);

Generic logging shorthand.

Definition at line 86 of file gnunet-daemon-exit.c.

Function Documentation

process_dns_result()

static GNUNET_NETWORK_STRUCT_END void process_dns_result ( void *  cls, const struct GNUNET_TUN_DnsHeader *  dns, size_t  r  )

static

Callback called from DNSSTUB resolver when a resolution succeeded.

Parameters

cls	NULL
dns	the response itself
r	number of bytes in dns

Definition at line 462 of file gnunet-daemon-exit.c.

{
  struct ChannelState *ts;
  struct GNUNET_MQ_Envelope *env;
  struct DnsResponseMessage *resp;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Processing DNS result from stub resolver\n");
  GNUNET_assert (NULL == cls);
  if (NULL == dns)
    return;
  /* Handle case that this is a reply to a request from a CADET DNS channel */
  ts = channels[dns->id];
  if (NULL == ts)
    return;
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Got a response from the stub resolver for DNS request received via CADET!\n");
  channels[dns->id] = NULL;
  env = GNUNET_MQ_msg_extra (resp,
                             r - sizeof(struct GNUNET_TUN_DnsHeader),
                             GNUNET_MESSAGE_TYPE_VPN_DNS_FROM_INTERNET);
  GNUNET_memcpy (&resp->dns,
                 dns,
                 r);
  resp->dns.id = ts->specifics.dns.original_id;
  GNUNET_MQ_send (GNUNET_CADET_get_mq (ts->channel),
                  env);
}

References ChannelState::channel, channels, ChannelState::dns, DnsResponseMessage::dns, env, GNUNET_assert, GNUNET_CADET_get_mq(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_log, GNUNET_memcpy, GNUNET_MESSAGE_TYPE_VPN_DNS_FROM_INTERNET, GNUNET_MQ_msg_extra, GNUNET_MQ_send(), GNUNET_TUN_DnsHeader::id, LOG, ChannelState::original_id, and ChannelState::specifics.

Referenced by handle_dns_request().

Here is the call graph for this function:

Here is the caller graph for this function:

check_dns_request()

static int check_dns_request ( void *  cls, const struct DnsResponseMessage *  msg  )

static

Check a request via cadet to perform a DNS query.

Parameters

cls	our struct ChannelState *
msg	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 503 of file gnunet-daemon-exit.c.

{
  struct ChannelState *ts = cls;
 
  if (NULL == dnsstub)
  {
    GNUNET_break (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_NO == ts->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References dnsstub, GNUNET_break, GNUNET_break_op, GNUNET_NO, GNUNET_OK, GNUNET_SYSERR, and ChannelState::is_dns.

handle_dns_request()

static void handle_dns_request ( void *  cls, const struct DnsResponseMessage *  msg  )

static

Process a request via cadet to perform a DNS query.

Parameters

cls	our struct ChannelState *
msg	the actual message

Definition at line 529 of file gnunet-daemon-exit.c.

{
  struct ChannelState *ts = cls;
  size_t mlen = ntohs (msg->header.size);
  size_t dlen = mlen - sizeof(struct GNUNET_MessageHeader);
  char buf[dlen] GNUNET_ALIGN;
  struct GNUNET_TUN_DnsHeader *dns_out;
 
  if (GNUNET_SYSERR == ts->is_dns)
  {
    /* channel is DNS from now on */
    ts->is_dns = GNUNET_YES;
  }
  ts->specifics.dns.original_id = msg->dns.id;
  if (channels[ts->specifics.dns.my_id] == ts)
    channels[ts->specifics.dns.my_id] = NULL;
  ts->specifics.dns.my_id = (uint16_t) GNUNET_CRYPTO_random_u32 (
    UINT16_MAX
    + 1);
  channels[ts->specifics.dns.my_id] = ts;
  GNUNET_memcpy (buf,
                 &msg->dns,
                 dlen);
  dns_out = (struct GNUNET_TUN_DnsHeader *) buf;
  dns_out->id = ts->specifics.dns.my_id;
  ts->specifics.dns.rs = GNUNET_DNSSTUB_resolve (dnsstub,
                                                 buf,
                                                 dlen,
                                                 &process_dns_result,
                                                 NULL);
  if (NULL == ts->specifics.dns.rs)
  {
    GNUNET_break_op (0);
    return;
  }
  GNUNET_CADET_receive_done (ts->channel);
}

References ChannelState::channel, channels, ChannelState::dns, dnsstub, GNUNET_ALIGN, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_CRYPTO_random_u32(), GNUNET_DNSSTUB_resolve(), GNUNET_memcpy, GNUNET_SYSERR, GNUNET_YES, GNUNET_TUN_DnsHeader::id, ChannelState::is_dns, msg, ChannelState::my_id, ChannelState::original_id, process_dns_result(), ChannelState::rs, GNUNET_MessageHeader::size, and ChannelState::specifics.

Here is the call graph for this function:

hash_redirect_info()

static void hash_redirect_info ( struct GNUNET_HashCode *  hash, const struct RedirectInformation *  ri  )

static

Given IP information about a connection, calculate the respective hash we would use for the connections_map.

Parameters

hash	resulting hash
ri	information about the connection

Definition at line 577 of file gnunet-daemon-exit.c.

{
  char *off;
 
  memset (hash,
          0,
          sizeof(struct GNUNET_HashCode));
  /* the GNUnet hashmap only uses the first sizeof(unsigned int) of the hash,
     so we put the IP address in there (and hope for few collisions) */
  off = (char *) hash;
  switch (ri->remote_address.af)
  {
  case AF_INET:
    GNUNET_memcpy (off,
                   &ri->remote_address.address.ipv4,
                   sizeof(struct in_addr));
    off += sizeof(struct in_addr);
    break;
 
  case AF_INET6:
    GNUNET_memcpy (off,
                   &ri->remote_address.address.ipv6,
                   sizeof(struct in6_addr));
    off += sizeof(struct in_addr);
    break;
 
  default:
    GNUNET_assert (0);
  }
  GNUNET_memcpy (off,
                 &ri->remote_address.port,
                 sizeof(uint16_t));
  off += sizeof(uint16_t);
  switch (ri->local_address.af)
  {
  case AF_INET:
    GNUNET_memcpy (off,
                   &ri->local_address.address.ipv4,
                   sizeof(struct in_addr));
    off += sizeof(struct in_addr);
    break;
 
  case AF_INET6:
    GNUNET_memcpy (off,
                   &ri->local_address.address.ipv6,
                   sizeof(struct in6_addr));
    off += sizeof(struct in_addr);
    break;
 
  default:
    GNUNET_assert (0);
  }
  GNUNET_memcpy (off,
                 &ri->local_address.port,
                 sizeof(uint16_t));
  off += sizeof(uint16_t);
  GNUNET_memcpy (off,
                 &ri->remote_address.proto,
                 sizeof(uint8_t));
  /* off += sizeof (uint8_t); */
}

References GNUNET_assert, GNUNET_memcpy, and ri.

Referenced by get_redirect_state().

Here is the caller graph for this function:

get_redirect_state()

static struct ChannelState * get_redirect_state ( int  af, int  protocol, const void *  destination_ip, uint16_t  destination_port, const void *  local_ip, uint16_t  local_port, struct GNUNET_HashCode *  state_key  )

static

Get our connection tracking state.

Warns if it does not exists, refreshes the timestamp if it does exist.

Parameters

af	address family
protocol	IPPROTO_UDP or IPPROTO_TCP
destination_ip	target IP
destination_port	target port
local_ip	local IP
local_port	local port
state_key	set to hash's state if non-NULL

Returns

NULL if we have no tracking information for this tuple

Definition at line 655 of file gnunet-daemon-exit.c.

{
  struct RedirectInformation ri;
  struct GNUNET_HashCode key;
  struct ChannelState *state;
 
  if (((af == AF_INET) && (protocol == IPPROTO_ICMP)) ||
      ((af == AF_INET6) && (protocol == IPPROTO_ICMPV6)))
  {
    /* ignore ports */
    destination_port = 0;
    local_port = 0;
  }
  ri.remote_address.af = af;
  if (af == AF_INET)
    ri.remote_address.address.ipv4 = *((struct in_addr*) destination_ip);
  else
    ri.remote_address.address.ipv6 = *((struct in6_addr*) destination_ip);
  ri.remote_address.port = destination_port;
  ri.remote_address.proto = protocol;
  ri.local_address.af = af;
  if (af == AF_INET)
    ri.local_address.address.ipv4 = *((struct in_addr*) local_ip);
  else
    ri.local_address.address.ipv6 = *((struct in6_addr*) local_ip);
  ri.local_address.port = local_port;
  ri.local_address.proto = protocol;
  hash_redirect_info (&key,
                      &ri);
  if (NULL != state_key)
    *state_key = key;
  state = GNUNET_CONTAINER_multihashmap_get (connections_map,
                                             &key);
  if (NULL == state)
    return NULL;
  /* Mark this connection as freshly used */
  if (NULL == state_key)
    GNUNET_CONTAINER_heap_update_cost (state->specifics.tcp_udp.heap_node,
                                       GNUNET_TIME_absolute_get ().abs_value_us)
    ;
  return state;
}

References ChannelState::af, connections_map, ChannelState::destination_port, GNUNET_CONTAINER_heap_update_cost(), GNUNET_CONTAINER_multihashmap_get(), GNUNET_TIME_absolute_get(), hash_redirect_info(), key, ChannelState::protocol, ri, and state.

Referenced by icmp_from_helper(), setup_state_record(), tcp_from_helper(), and udp_from_helper().

Here is the call graph for this function:

Here is the caller graph for this function:

check_tcp_service()

static int check_tcp_service ( void *  cls, const struct GNUNET_EXIT_TcpServiceStartMessage *  start  )

static

Check a request via cadet to send a request to a TCP service offered by this system.

Parameters

cls	our struct ChannelState *
start	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 715 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if (NULL == state)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (NULL == state->specifics.tcp_udp.serv)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (NULL != state->specifics.tcp_udp.heap_node)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (start->tcp_header.off * 4 < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_break_op, GNUNET_OK, GNUNET_SYSERR, GNUNET_YES, start, and state.

prepare_ipv4_packet()

static void prepare_ipv4_packet ( const void *  payload, size_t  payload_length, int  protocol, const struct GNUNET_TUN_TcpHeader *  tcp_header, const struct SocketAddress *  src_address, const struct SocketAddress *  dst_address, struct GNUNET_TUN_IPv4Header *  pkt4  )

static

Prepare an IPv4 packet for transmission via the TUN interface.

Initializes the IP header and calculates checksums (IP+UDP/TCP). For UDP, the UDP header will be fully created, whereas for TCP only the ports and checksum will be filled in. So for TCP, a skeleton TCP header must be part of the provided payload.

Parameters

payload	payload of the packet (starting with UDP payload or TCP header, depending on protocol)
payload_length	number of bytes in payload
protocol	IPPROTO_UDP or IPPROTO_TCP
tcp_header	skeleton of the TCP header, NULL for UDP
src_address	source address to use (IP and port)
dst_address	destination address to use (IP and port)
pkt4	where to write the assembled packet; must contain enough space for the IP header, UDP/TCP header AND the payload

Definition at line 768 of file gnunet-daemon-exit.c.

{
  size_t len;
 
  len = payload_length;
  switch (protocol)
  {
  case IPPROTO_UDP:
    len += sizeof(struct GNUNET_TUN_UdpHeader);
    break;
 
  case IPPROTO_TCP:
    len += sizeof(struct GNUNET_TUN_TcpHeader);
    GNUNET_assert (NULL != tcp_header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  if (len + sizeof(struct GNUNET_TUN_IPv4Header) > UINT16_MAX)
  {
    GNUNET_break (0);
    return;
  }
 
  GNUNET_TUN_initialize_ipv4_header (pkt4,
                                     protocol,
                                     len,
                                     &src_address->address.ipv4,
                                     &dst_address->address.ipv4);
  switch (protocol)
  {
  case IPPROTO_UDP:
    {
      struct GNUNET_TUN_UdpHeader *pkt4_udp = (struct
                                               GNUNET_TUN_UdpHeader *) &pkt4[1];
 
      pkt4_udp->source_port = htons (src_address->port);
      pkt4_udp->destination_port = htons (dst_address->port);
      pkt4_udp->len = htons ((uint16_t) payload_length);
      GNUNET_TUN_calculate_udp4_checksum (pkt4,
                                          pkt4_udp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt4_udp[1],
                     payload,
                     payload_length);
    }
    break;
 
  case IPPROTO_TCP:
    {
      struct GNUNET_TUN_TcpHeader *pkt4_tcp = (struct
                                               GNUNET_TUN_TcpHeader *) &pkt4[1];
 
      *pkt4_tcp = *tcp_header;
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "Sending TCP packet from port %u to port %u\n",
                  src_address->port,
                  dst_address->port);
      pkt4_tcp->source_port = htons (src_address->port);
      pkt4_tcp->destination_port = htons (dst_address->port);
      GNUNET_TUN_calculate_tcp4_checksum (pkt4,
                                          pkt4_tcp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt4_tcp[1],
                     payload,
                     payload_length);
    }
    break;
 
  default:
    GNUNET_assert (0);
  }
}

References GNUNET_TUN_UdpHeader::destination_port, GNUNET_assert, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_log, GNUNET_memcpy, GNUNET_TUN_calculate_tcp4_checksum(), GNUNET_TUN_calculate_udp4_checksum(), GNUNET_TUN_initialize_ipv4_header(), GNUNET_TUN_UdpHeader::len, GNUNET_TUN_TcpHeader::off, payload, SocketAddress::port, ChannelState::protocol, and GNUNET_TUN_UdpHeader::source_port.

Referenced by send_tcp_packet_via_tun(), and send_udp_packet_via_tun().

Here is the call graph for this function:

Here is the caller graph for this function:

prepare_ipv6_packet()

static void prepare_ipv6_packet ( const void *  payload, size_t  payload_length, int  protocol, const struct GNUNET_TUN_TcpHeader *  tcp_header, const struct SocketAddress *  src_address, const struct SocketAddress *  dst_address, struct GNUNET_TUN_IPv6Header *  pkt6  )

static

Prepare an IPv6 packet for transmission via the TUN interface.

Initializes the IP header and calculates checksums (IP+UDP/TCP). For UDP, the UDP header will be fully created, whereas for TCP only the ports and checksum will be filled in. So for TCP, a skeleton TCP header must be part of the provided payload.

Parameters

payload	payload of the packet (starting with UDP payload or TCP header, depending on protocol)
payload_length	number of bytes in payload
protocol	IPPROTO_UDP or IPPROTO_TCP
tcp_header	skeleton TCP header data to send, NULL for UDP
src_address	source address to use (IP and port)
dst_address	destination address to use (IP and port)
pkt6	where to write the assembled packet; must contain enough space for the IP header, UDP/TCP header AND the payload

Definition at line 872 of file gnunet-daemon-exit.c.

{
  size_t len;
 
  len = payload_length;
  switch (protocol)
  {
  case IPPROTO_UDP:
    len += sizeof(struct GNUNET_TUN_UdpHeader);
    break;
 
  case IPPROTO_TCP:
    len += sizeof(struct GNUNET_TUN_TcpHeader);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  if (len > UINT16_MAX)
  {
    GNUNET_break (0);
    return;
  }
 
  GNUNET_TUN_initialize_ipv6_header (pkt6,
                                     protocol,
                                     len,
                                     &src_address->address.ipv6,
                                     &dst_address->address.ipv6);
 
  switch (protocol)
  {
  case IPPROTO_UDP:
    {
      struct GNUNET_TUN_UdpHeader *pkt6_udp = (struct
                                               GNUNET_TUN_UdpHeader *) &pkt6[1];
 
      pkt6_udp->source_port = htons (src_address->port);
      pkt6_udp->destination_port = htons (dst_address->port);
      pkt6_udp->len = htons ((uint16_t) payload_length);
      GNUNET_TUN_calculate_udp6_checksum (pkt6,
                                          pkt6_udp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt6_udp[1],
                     payload,
                     payload_length);
    }
    break;
 
  case IPPROTO_TCP:
    {
      struct GNUNET_TUN_TcpHeader *pkt6_tcp = (struct
                                               GNUNET_TUN_TcpHeader *) &pkt6[1];
 
      /* GNUNET_memcpy first here as some TCP header fields are initialized this way! */
      *pkt6_tcp = *tcp_header;
      pkt6_tcp->source_port = htons (src_address->port);
      pkt6_tcp->destination_port = htons (dst_address->port);
      GNUNET_TUN_calculate_tcp6_checksum (pkt6,
                                          pkt6_tcp,
                                          payload,
                                          payload_length);
      GNUNET_memcpy (&pkt6_tcp[1],
                     payload,
                     payload_length);
    }
    break;
 
  default:
    GNUNET_assert (0);
    break;
  }
}

References GNUNET_TUN_UdpHeader::destination_port, GNUNET_assert, GNUNET_break, GNUNET_memcpy, GNUNET_TUN_calculate_tcp6_checksum(), GNUNET_TUN_calculate_udp6_checksum(), GNUNET_TUN_initialize_ipv6_header(), GNUNET_TUN_UdpHeader::len, GNUNET_TUN_TcpHeader::off, payload, SocketAddress::port, GNUNET_TUN_TcpHeader::source_port, and GNUNET_TUN_UdpHeader::source_port.

Referenced by send_tcp_packet_via_tun(), and send_udp_packet_via_tun().

Here is the call graph for this function:

Here is the caller graph for this function:

send_tcp_packet_via_tun()

static void send_tcp_packet_via_tun ( const struct SocketAddress *  destination_address, const struct SocketAddress *  source_address, const struct GNUNET_TUN_TcpHeader *  tcp_header, const void *  payload, size_t  payload_length  )

static

Send a TCP packet via the TUN interface.

Parameters

destination_address	IP and port to use for the TCP packet's destination
source_address	IP and port to use for the TCP packet's source
tcp_header	header template to use
payload	payload of the TCP packet
payload_length	number of bytes in payload

Definition at line 965 of file gnunet-daemon-exit.c.

{
  size_t len;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# TCP packets sent via TUN"),
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending packet with %u bytes TCP payload via TUN\n",
              (unsigned int) payload_length);
  len = sizeof(struct GNUNET_MessageHeader) + sizeof(struct
                                                     GNUNET_TUN_Layer2PacketHeader);
  switch (source_address->af)
  {
  case AF_INET:
    len += sizeof(struct GNUNET_TUN_IPv4Header);
    break;
 
  case AF_INET6:
    len += sizeof(struct GNUNET_TUN_IPv6Header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  len += sizeof(struct GNUNET_TUN_TcpHeader);
  len += payload_length;
  if (len >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  {
    char buf[len] GNUNET_ALIGN;
    struct GNUNET_MessageHeader *hdr;
    struct GNUNET_TUN_Layer2PacketHeader *tun;
 
    hdr = (struct GNUNET_MessageHeader *) buf;
    hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
    hdr->size = htons (len);
    tun = (struct GNUNET_TUN_Layer2PacketHeader*) &hdr[1];
    tun->flags = htons (0);
    switch (source_address->af)
    {
    case AF_INET:
      {
        struct GNUNET_TUN_IPv4Header *ipv4
          = (struct GNUNET_TUN_IPv4Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV4);
        prepare_ipv4_packet (payload,
                             payload_length,
                             IPPROTO_TCP,
                             tcp_header,
                             source_address,
                             destination_address,
                             ipv4);
      }
      break;
 
    case AF_INET6:
      {
        struct GNUNET_TUN_IPv6Header *ipv6
          = (struct GNUNET_TUN_IPv6Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV6);
        prepare_ipv6_packet (payload,
                             payload_length,
                             IPPROTO_TCP,
                             tcp_header,
                             source_address,
                             destination_address,
                             ipv6);
      }
      break;
 
    default:
      GNUNET_assert (0);
      break;
    }
    if (NULL != helper_handle)
      (void) GNUNET_HELPER_send (helper_handle,
                                 (const struct GNUNET_MessageHeader*) buf,
                                 GNUNET_YES,
                                 NULL,
                                 NULL);
  }
}

References SocketAddress::af, GNUNET_TUN_IPv4Header::destination_address, GNUNET_TUN_IPv6Header::destination_address, ETH_P_IPV4, ETH_P_IPV6, GNUNET_TUN_Layer2PacketHeader::flags, gettext_noop, GNUNET_ALIGN, GNUNET_assert, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_HELPER_send(), GNUNET_log, GNUNET_MAX_MESSAGE_SIZE, GNUNET_MESSAGE_TYPE_VPN_HELPER, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_YES, helper_handle, ipv4, ipv6, payload, GNUNET_TUN_IPv6Header::payload_length, prepare_ipv4_packet(), prepare_ipv6_packet(), GNUNET_TUN_Layer2PacketHeader::proto, GNUNET_MessageHeader::size, GNUNET_TUN_IPv4Header::source_address, GNUNET_TUN_IPv6Header::source_address, stats, and GNUNET_MessageHeader::type.

Referenced by handle_tcp_data(), handle_tcp_remote(), and handle_tcp_service().

Here is the call graph for this function:

Here is the caller graph for this function:

send_icmp_packet_via_tun()

static void send_icmp_packet_via_tun ( const struct SocketAddress *  destination_address, const struct SocketAddress *  source_address, const struct GNUNET_TUN_IcmpHeader *  icmp_header, const void *  payload, size_t  payload_length  )

static

Send an ICMP packet via the TUN interface.

Parameters

destination_address	IP to use for the ICMP packet's destination
source_address	IP to use for the ICMP packet's source
icmp_header	ICMP header to send
payload	payload of the ICMP packet (does NOT include ICMP header)
payload_length	number of bytes of data in payload

Definition at line 1071 of file gnunet-daemon-exit.c.

{
  size_t len;
  struct GNUNET_TUN_IcmpHeader *icmp;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# ICMP packets sent via TUN"),
                            1, GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending packet with %u bytes ICMP payload via TUN\n",
              (unsigned int) payload_length);
  len = sizeof(struct GNUNET_MessageHeader) + sizeof(struct
                                                     GNUNET_TUN_Layer2PacketHeader);
  switch (destination_address->af)
  {
  case AF_INET:
    len += sizeof(struct GNUNET_TUN_IPv4Header);
    break;
 
  case AF_INET6:
    len += sizeof(struct GNUNET_TUN_IPv6Header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  len += sizeof(struct GNUNET_TUN_IcmpHeader);
  len += payload_length;
  if (len >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  {
    char buf[len] GNUNET_ALIGN;
    struct GNUNET_MessageHeader *hdr;
    struct GNUNET_TUN_Layer2PacketHeader *tun;
 
    hdr = (struct GNUNET_MessageHeader *) buf;
    hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
    hdr->size = htons (len);
    tun = (struct GNUNET_TUN_Layer2PacketHeader*) &hdr[1];
    tun->flags = htons (0);
    switch (source_address->af)
    {
    case AF_INET:
      {
        struct GNUNET_TUN_IPv4Header *ipv4 = (struct
                                              GNUNET_TUN_IPv4Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV4);
        GNUNET_TUN_initialize_ipv4_header (ipv4,
                                           IPPROTO_ICMP,
                                           sizeof(struct
                                                  GNUNET_TUN_IcmpHeader)
                                           + payload_length,
                                           &source_address->address.ipv4,
                                           &destination_address->address.ipv4);
        icmp = (struct GNUNET_TUN_IcmpHeader*) &ipv4[1];
      }
      break;
 
    case AF_INET6:
      {
        struct GNUNET_TUN_IPv6Header *ipv6 = (struct
                                              GNUNET_TUN_IPv6Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV6);
        GNUNET_TUN_initialize_ipv6_header (ipv6,
                                           IPPROTO_ICMPV6,
                                           sizeof(struct
                                                  GNUNET_TUN_IcmpHeader)
                                           + payload_length,
                                           &source_address->address.ipv6,
                                           &destination_address->address.ipv6);
        icmp = (struct GNUNET_TUN_IcmpHeader*) &ipv6[1];
      }
      break;
 
    default:
      GNUNET_assert (0);
      break;
    }
    *icmp = *icmp_header;
    GNUNET_memcpy (&icmp[1],
                   payload,
                   payload_length);
    GNUNET_TUN_calculate_icmp_checksum (icmp,
                                        payload,
                                        payload_length);
    if (NULL != helper_handle)
      (void) GNUNET_HELPER_send (helper_handle,
                                 (const struct GNUNET_MessageHeader*) buf,
                                 GNUNET_YES,
                                 NULL, NULL);
  }
}

References SocketAddress::af, GNUNET_TUN_IPv4Header::destination_address, GNUNET_TUN_IPv6Header::destination_address, ETH_P_IPV4, ETH_P_IPV6, GNUNET_TUN_Layer2PacketHeader::flags, gettext_noop, GNUNET_ALIGN, GNUNET_assert, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_HELPER_send(), GNUNET_log, GNUNET_MAX_MESSAGE_SIZE, GNUNET_memcpy, GNUNET_MESSAGE_TYPE_VPN_HELPER, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_TUN_calculate_icmp_checksum(), GNUNET_TUN_initialize_ipv4_header(), GNUNET_TUN_initialize_ipv6_header(), GNUNET_YES, helper_handle, ipv4, ipv6, payload, GNUNET_TUN_IPv6Header::payload_length, GNUNET_TUN_Layer2PacketHeader::proto, GNUNET_MessageHeader::size, GNUNET_TUN_IPv4Header::source_address, GNUNET_TUN_IPv6Header::source_address, stats, and GNUNET_MessageHeader::type.

Referenced by handle_icmp_remote(), and handle_icmp_service().

Here is the call graph for this function:

Here is the caller graph for this function:

setup_fresh_address()

static void setup_fresh_address ( int  af, uint8_t  proto, struct SocketAddress *  local_address  )

static

We need to create a (unique) fresh local address (IP+port).

Fill one in.

Parameters

af	desired address family
proto	desired protocol (IPPROTO_UDP or IPPROTO_TCP)
local_address	address to initialize

Definition at line 1183 of file gnunet-daemon-exit.c.

{
  local_address->af = af;
  local_address->proto = (uint8_t) proto;
  /* default "local" port range is often 32768--61000,
     so we pick a random value in that range */
  if (((af == AF_INET) && (proto == IPPROTO_ICMP)) ||
      ((af == AF_INET6) && (proto == IPPROTO_ICMPV6)))
    local_address->port = 0;
  else
    local_address->port
      = (uint16_t) 32768 + GNUNET_CRYPTO_random_u32 (28232);
  switch (af)
  {
  case AF_INET:
    {
      struct in_addr addr;
      struct in_addr mask;
      struct in_addr rnd;
 
      addr = exit_ipv4addr;
      mask = exit_ipv4mask;
      if (0 == ~mask.s_addr)
      {
        /* only one valid IP anyway */
        local_address->address.ipv4 = addr;
        return;
      }
      /* Given 192.168.0.1/255.255.0.0, we want a mask
         of '192.168.255.255', thus:  */
      mask.s_addr = addr.s_addr | ~mask.s_addr;
      /* Pick random IPv4 address within the subnet, except 'addr' or 'mask' itself */
      do
      {
        rnd.s_addr = GNUNET_CRYPTO_random_u32 (UINT32_MAX);
        local_address->address.ipv4.s_addr = (addr.s_addr | rnd.s_addr)
                                             & mask.s_addr;
      }
      while ((local_address->address.ipv4.s_addr == addr.s_addr) ||
             (local_address->address.ipv4.s_addr == mask.s_addr));
    }
    break;
 
  case AF_INET6:
    {
      struct in6_addr addr;
      struct in6_addr mask;
      struct in6_addr rnd;
      int i;
 
      addr = exit_ipv6addr;
      GNUNET_assert (ipv6prefix < 128);
      if (ipv6prefix == 127)
      {
        /* only one valid IP anyway */
        local_address->address.ipv6 = addr;
        return;
      }
      /* Given ABCD::/96, we want a mask of 'ABCD::FFFF:FFFF,
         thus: */
      mask = addr;
      for (i = 127; i >= ipv6prefix; i--)
        mask.s6_addr[i / 8] |= (1 << (i % 8));
 
      /* Pick random IPv6 address within the subnet, except 'addr' or 'mask' itself */
      do
      {
        for (i = 0; i < 16; i++)
        {
          rnd.s6_addr[i] = (unsigned char) GNUNET_CRYPTO_random_u32 (
            256);
          local_address->address.ipv6.s6_addr[i]
            = (addr.s6_addr[i] | rnd.s6_addr[i]) & mask.s6_addr[i];
        }
      }
      while ((0 == GNUNET_memcmp (&local_address->address.ipv6,
                                  &addr)) ||
             (0 == GNUNET_memcmp (&local_address->address.ipv6,
                                  &mask)));
    }
    break;
 
  default:
    GNUNET_assert (0);
  }
}

References SocketAddress::address, SocketAddress::af, exit_ipv4addr, exit_ipv4mask, exit_ipv6addr, GNUNET_assert, GNUNET_CRYPTO_random_u32(), GNUNET_memcmp, SocketAddress::ipv4, SocketAddress::ipv6, ipv6prefix, SocketAddress::port, proto, and SocketAddress::proto.

Referenced by setup_state_record().

Here is the call graph for this function:

Here is the caller graph for this function:

setup_state_record()

static void setup_state_record ( struct ChannelState *  state )

static

We are starting a fresh connection (TCP or UDP) and need to pick a source port and IP address (within the correct range and address family) to associate replies with the connection / correct cadet channel.

This function generates a "fresh" source IP and source port number for a connection After picking a good source address, this function sets up the state in the 'connections_map' and 'connections_heap' to allow finding the state when needed later. The function also makes sure that we remain within memory limits by cleaning up 'old' states.

Parameters

state

skeleton state to setup a record for; should 'state->specifics.tcp_udp.ri.remote_address' filled in so that this code can determine which AF/protocol is going to be used (the 'channel' should also already be set); after calling this function, heap_node and the local_address will be also initialized (heap_node != NULL can be used to test if a state has been fully setup).

Definition at line 1295 of file gnunet-daemon-exit.c.

{
  struct GNUNET_HashCode key;
  struct ChannelState *s;
 
  /* generate fresh, unique address */
  do
  {
    if (NULL == state->specifics.tcp_udp.serv)
      setup_fresh_address (state->specifics.tcp_udp.ri.remote_address.af,
                           state->specifics.tcp_udp.ri.remote_address.proto,
                           &state->specifics.tcp_udp.ri.local_address);
    else
      setup_fresh_address (state->specifics.tcp_udp.serv->address.af,
                           state->specifics.tcp_udp.serv->address.proto,
                           &state->specifics.tcp_udp.ri.local_address);
  }
  while (NULL !=
         get_redirect_state (state->specifics.tcp_udp.ri.remote_address.af,
                             state->specifics.tcp_udp.ri.remote_address.proto,
                             &state->specifics.tcp_udp.ri.remote_address.address
                             ,
                             state->specifics.tcp_udp.ri.remote_address.port,
                             &state->specifics.tcp_udp.ri.local_address.address,
                             state->specifics.tcp_udp.ri.local_address.port,
                             &key));
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Picked local address %s:%u for new connection\n",
                inet_ntop (state->specifics.tcp_udp.ri.local_address.af,
                           &state->specifics.tcp_udp.ri.local_address.address,
                           buf,
                           sizeof(buf)),
                (unsigned int) state->specifics.tcp_udp.ri.local_address.port);
  }
  state->specifics.tcp_udp.state_key = key;
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CONTAINER_multihashmap_put (connections_map,
                                                    &key, state,
                                                    GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY));
  state->specifics.tcp_udp.heap_node
    = GNUNET_CONTAINER_heap_insert (connections_heap,
                                    state,
                                    GNUNET_TIME_absolute_get ().abs_value_us);
  while (GNUNET_CONTAINER_heap_get_size (connections_heap) > max_connections)
  {
    s = GNUNET_CONTAINER_heap_remove_root (connections_heap);
    GNUNET_assert (state != s);
    s->specifics.tcp_udp.heap_node = NULL;
    GNUNET_CADET_channel_destroy (s->channel);
    GNUNET_assert (GNUNET_OK ==
                   GNUNET_CONTAINER_multihashmap_remove (connections_map,
                                                         &s->specifics.tcp_udp.
                                                         state_key,
                                                         s));
    GNUNET_free (s);
  }
}

References ChannelState::channel, connections_heap, connections_map, get_redirect_state(), GNUNET_assert, GNUNET_CADET_channel_destroy(), GNUNET_CONTAINER_heap_get_size(), GNUNET_CONTAINER_heap_insert(), GNUNET_CONTAINER_heap_remove_root(), GNUNET_CONTAINER_multihashmap_put(), GNUNET_CONTAINER_multihashmap_remove(), GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY, GNUNET_ERROR_TYPE_DEBUG, GNUNET_free, GNUNET_log, GNUNET_OK, GNUNET_TIME_absolute_get(), ChannelState::heap_node, key, max_connections, setup_fresh_address(), ChannelState::specifics, state, ChannelState::state_key, and ChannelState::tcp_udp.

Referenced by handle_icmp_remote(), handle_icmp_service(), handle_tcp_remote(), handle_tcp_service(), handle_udp_remote(), and handle_udp_service().

Here is the call graph for this function:

Here is the caller graph for this function:

send_udp_packet_via_tun()

static void send_udp_packet_via_tun ( const struct SocketAddress *  destination_address, const struct SocketAddress *  source_address, const void *  payload, size_t  payload_length  )

static

Send a UDP packet via the TUN interface.

Parameters

destination_address	IP and port to use for the UDP packet's destination
source_address	IP and port to use for the UDP packet's source
payload	payload of the UDP packet (does NOT include UDP header)
payload_length	number of bytes of data in payload

Definition at line 1365 of file gnunet-daemon-exit.c.

{
  size_t len;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# UDP packets sent via TUN"),
                            1, GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending packet with %u bytes UDP payload via TUN\n",
              (unsigned int) payload_length);
  len = sizeof(struct GNUNET_MessageHeader) + sizeof(struct
                                                     GNUNET_TUN_Layer2PacketHeader);
  switch (source_address->af)
  {
  case AF_INET:
    len += sizeof(struct GNUNET_TUN_IPv4Header);
    break;
 
  case AF_INET6:
    len += sizeof(struct GNUNET_TUN_IPv6Header);
    break;
 
  default:
    GNUNET_break (0);
    return;
  }
  len += sizeof(struct GNUNET_TUN_UdpHeader);
  len += payload_length;
  if (len >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  {
    char buf[len] GNUNET_ALIGN;
    struct GNUNET_MessageHeader *hdr;
    struct GNUNET_TUN_Layer2PacketHeader *tun;
 
    hdr = (struct GNUNET_MessageHeader *) buf;
    hdr->type = htons (GNUNET_MESSAGE_TYPE_VPN_HELPER);
    hdr->size = htons (len);
    tun = (struct GNUNET_TUN_Layer2PacketHeader*) &hdr[1];
    tun->flags = htons (0);
    switch (source_address->af)
    {
    case AF_INET:
      {
        struct GNUNET_TUN_IPv4Header *ipv4 = (struct
                                              GNUNET_TUN_IPv4Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV4);
        prepare_ipv4_packet (payload,
                             payload_length,
                             IPPROTO_UDP,
                             NULL,
                             source_address,
                             destination_address,
                             ipv4);
      }
      break;
 
    case AF_INET6:
      {
        struct GNUNET_TUN_IPv6Header *ipv6 = (struct
                                              GNUNET_TUN_IPv6Header*) &tun[1];
 
        tun->proto = htons (ETH_P_IPV6);
        prepare_ipv6_packet (payload,
                             payload_length,
                             IPPROTO_UDP,
                             NULL,
                             source_address,
                             destination_address,
                             ipv6);
      }
      break;
 
    default:
      GNUNET_assert (0);
      break;
    }
    if (NULL != helper_handle)
      (void) GNUNET_HELPER_send (helper_handle,
                                 (const struct GNUNET_MessageHeader*) buf,
                                 GNUNET_YES,
                                 NULL, NULL);
  }
}

References SocketAddress::af, GNUNET_TUN_IPv4Header::destination_address, GNUNET_TUN_IPv6Header::destination_address, ETH_P_IPV4, ETH_P_IPV6, GNUNET_TUN_Layer2PacketHeader::flags, gettext_noop, GNUNET_ALIGN, GNUNET_assert, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_HELPER_send(), GNUNET_log, GNUNET_MAX_MESSAGE_SIZE, GNUNET_MESSAGE_TYPE_VPN_HELPER, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_YES, helper_handle, ipv4, ipv6, GNUNET_TUN_UdpHeader::len, payload, GNUNET_TUN_IPv6Header::payload_length, prepare_ipv4_packet(), prepare_ipv6_packet(), GNUNET_TUN_Layer2PacketHeader::proto, GNUNET_MessageHeader::size, GNUNET_TUN_IPv4Header::source_address, GNUNET_TUN_IPv6Header::source_address, stats, and GNUNET_MessageHeader::type.

Referenced by handle_udp_remote(), and handle_udp_service().

Here is the call graph for this function:

Here is the caller graph for this function:

check_udp_remote()

static int check_udp_remote ( void *  cls, const struct GNUNET_EXIT_UdpInternetMessage *  msg  )

static

Check a request to forward UDP data to the Internet via this peer.

Parameters

cls	our struct ChannelState *
msg	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 1466 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_break_op, GNUNET_OK, GNUNET_SYSERR, GNUNET_YES, and state.

handle_udp_remote()

static void handle_udp_remote ( void *  cls, const struct GNUNET_EXIT_UdpInternetMessage *  msg  )

static

Process a request to forward UDP data to the Internet via this peer.

Parameters

cls	our struct ChannelState *
msg	the actual message

Definition at line 1487 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_UdpInternetMessage);
  const struct in_addr *v4;
  const struct in6_addr *v6;
  const void *payload;
  int af;
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# UDP IP-exit requests received via cadet"),
                            1, GNUNET_NO);
  af = (int) ntohl (msg->af);
  state->specifics.tcp_udp.ri.remote_address.af = af;
  switch (af)
  {
  case AF_INET:
    if (pkt_len < sizeof(struct in_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv4_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v4 = (const struct in_addr*) &msg[1];
    payload = &v4[1];
    pkt_len -= sizeof(struct in_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv4 = *v4;
    break;
 
  case AF_INET6:
    if (pkt_len < sizeof(struct in6_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv6_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v6 = (const struct in6_addr*) &msg[1];
    payload = &v6[1];
    pkt_len -= sizeof(struct in6_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv6 = *v6;
    break;
 
  default:
    GNUNET_break_op (0);
    return;
  }
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received data from %s for forwarding to UDP %s:%u\n",
                GNUNET_i2s (&state->peer),
                inet_ntop (af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf, sizeof(buf)),
                (unsigned int) ntohs (msg->destination_port));
  }
  state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_UDP;
  state->specifics.tcp_udp.ri.remote_address.port = msg->destination_port;
  if (NULL == state->specifics.tcp_udp.heap_node)
    setup_state_record (state);
  if (0 != ntohs (msg->source_port))
    state->specifics.tcp_udp.ri.local_address.port = msg->source_port;
  send_udp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           payload,
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References gettext_noop, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_log, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_SYSERR, ipv4_exit, ipv6_exit, ChannelState::is_dns, msg, payload, send_udp_packet_via_tun(), setup_state_record(), GNUNET_MessageHeader::size, state, and stats.

Here is the call graph for this function:

check_udp_service()

static int check_udp_service ( void *  cls, const struct GNUNET_EXIT_UdpServiceMessage *  msg  )

static

Check a request via cadet to send a request to a UDP service offered by this system.

Parameters

cls	our struct ChannelState *
msg	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 1586 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if (NULL == state->specifics.tcp_udp.serv)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_break_op, GNUNET_OK, GNUNET_SYSERR, and state.

handle_udp_service()

static void handle_udp_service ( void *  cls, const struct GNUNET_EXIT_UdpServiceMessage *  msg  )

static

Process a request via cadet to send a request to a UDP service offered by this system.

Parameters

cls	our struct ChannelState *
msg	the actual message

Definition at line 1608 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_UdpServiceMessage);
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# UDP service requests received via cadet"),
                            1, GNUNET_NO);
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Received data from %s for forwarding to UDP service %s on port %u\n",
       GNUNET_i2s (&state->peer),
       GNUNET_h2s (&state->specifics.tcp_udp.serv->descriptor),
       (unsigned int) ntohs (msg->destination_port));
  setup_state_record (state);
  if (0 != ntohs (msg->source_port))
    state->specifics.tcp_udp.ri.local_address.port = msg->source_port;
  send_udp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &msg[1],
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References gettext_noop, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_h2s(), GNUNET_i2s(), GNUNET_NO, GNUNET_STATISTICS_update(), LOG, msg, send_udp_packet_via_tun(), setup_state_record(), GNUNET_MessageHeader::size, state, and stats.

Here is the call graph for this function:

handle_tcp_service()

static void handle_tcp_service ( void *  cls, const struct GNUNET_EXIT_TcpServiceStartMessage *  start  )

static

Process a request via cadet to send a request to a TCP service offered by this system.

Parameters

cls	our struct ChannelState *
start	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 1648 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (start->header.size) - sizeof(struct
                                                         GNUNET_EXIT_TcpServiceStartMessage);
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# TCP service creation requests received via cadet"),
                            1,
                            GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len,
                            GNUNET_NO);
  GNUNET_break_op (ntohl (start->reserved) == 0);
  /* setup fresh connection */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received data from %s for forwarding to TCP service %s on port %u\n",
              GNUNET_i2s (&state->peer),
              GNUNET_h2s (&state->specifics.tcp_udp.serv->descriptor),
              (unsigned int) ntohs (start->tcp_header.destination_port));
  setup_state_record (state);
  send_tcp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &start->tcp_header,
                           &start[1],
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References gettext_noop, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_h2s(), GNUNET_i2s(), GNUNET_log, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_SYSERR, ChannelState::is_dns, send_tcp_packet_via_tun(), setup_state_record(), start, state, and stats.

Here is the call graph for this function:

check_tcp_remote()

static int check_tcp_remote ( void *  cls, const struct GNUNET_EXIT_TcpInternetStartMessage *  start  )

static

Check a request to forward TCP data to the Internet via this peer.

Parameters

cls	our struct ChannelState *
start	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 1695 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if (NULL == state)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if ((NULL != state->specifics.tcp_udp.serv) ||
      (NULL != state->specifics.tcp_udp.heap_node))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (start->tcp_header.off * 4 < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_break_op, GNUNET_OK, GNUNET_SYSERR, GNUNET_YES, start, and state.

handle_tcp_remote()

static void handle_tcp_remote ( void *  cls, const struct GNUNET_EXIT_TcpInternetStartMessage *  start  )

static

Process a request to forward TCP data to the Internet via this peer.

Parameters

cls	our struct ChannelState *
start	the actual message

Definition at line 1732 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (start->header.size) - sizeof(struct
                                                         GNUNET_EXIT_TcpInternetStartMessage);
  const struct in_addr *v4;
  const struct in6_addr *v6;
  const void *payload;
  int af;
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# TCP IP-exit creation requests received via cadet"),
                            1, GNUNET_NO);
  af = (int) ntohl (start->af);
  state->specifics.tcp_udp.ri.remote_address.af = af;
  switch (af)
  {
  case AF_INET:
    if (pkt_len < sizeof(struct in_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv4_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v4 = (const struct in_addr*) &start[1];
    payload = &v4[1];
    pkt_len -= sizeof(struct in_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv4 = *v4;
    break;
 
  case AF_INET6:
    if (pkt_len < sizeof(struct in6_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv6_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v6 = (const struct in6_addr*) &start[1];
    payload = &v6[1];
    pkt_len -= sizeof(struct in6_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv6 = *v6;
    break;
 
  default:
    GNUNET_break_op (0);
    return;
  }
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received payload from %s for existing TCP stream to %s:%u\n",
                GNUNET_i2s (&state->peer),
                inet_ntop (af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf, sizeof(buf)),
                (unsigned int) ntohs (start->tcp_header.destination_port));
  }
  state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_TCP;
  state->specifics.tcp_udp.ri.remote_address.port = ntohs (
    start->tcp_header.destination_port);
  setup_state_record (state);
  send_tcp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &start->tcp_header,
                           payload,
                           pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References gettext_noop, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_log, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_SYSERR, ipv4_exit, ipv6_exit, ChannelState::is_dns, payload, send_tcp_packet_via_tun(), setup_state_record(), start, state, and stats.

Here is the call graph for this function:

check_tcp_data()

static int check_tcp_data ( void *  cls, const struct GNUNET_EXIT_TcpDataMessage *  data  )

static

Check a request to forward TCP data on an established connection via this peer.

Parameters

cls	our struct ChannelState *
data	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 1830 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if ((NULL == state) ||
      (NULL == state->specifics.tcp_udp.heap_node))
  {
    /* connection should have been up! */
    GNUNET_STATISTICS_update (stats,
                              gettext_noop (
                                "# TCP DATA requests dropped (no session)"),
                              1, GNUNET_NO);
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (data->tcp_header.off * 4 < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References data, gettext_noop, GNUNET_break_op, GNUNET_NO, GNUNET_OK, GNUNET_STATISTICS_update(), GNUNET_SYSERR, GNUNET_YES, state, and stats.

Here is the call graph for this function:

handle_tcp_data()

static void handle_tcp_data ( void *  cls, const struct GNUNET_EXIT_TcpDataMessage *  data  )

static

Process a request to forward TCP data on an established connection via this peer.

Parameters

cls	our struct ChannelState *
data	the actual message

Definition at line 1868 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (data->header.size) - sizeof(struct
                                                        GNUNET_EXIT_TcpDataMessage);
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# TCP data requests received via cadet"),
                            1, GNUNET_NO);
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
 
  GNUNET_break_op (ntohl (data->reserved) == 0);
  {
    char buf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received additional %u bytes of data from %s for TCP stream to %s:%u\n",
                pkt_len,
                GNUNET_i2s (&state->peer),
                inet_ntop (state->specifics.tcp_udp.ri.remote_address.af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf, sizeof(buf)),
                (unsigned int) state->specifics.tcp_udp.ri.remote_address.port);
  }
 
  send_tcp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                           &state->specifics.tcp_udp.ri.local_address,
                           &data->tcp_header,
                           &data[1], pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References data, gettext_noop, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_log, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_SYSERR, send_tcp_packet_via_tun(), state, and stats.

Here is the call graph for this function:

make_up_icmpv4_payload()

static void make_up_icmpv4_payload ( struct ChannelState *  state, struct GNUNET_TUN_IPv4Header *  ipp, struct GNUNET_TUN_UdpHeader *  udp  )

static

Synthesize a plausible ICMP payload for an ICMPv4 error response on the given channel.

Parameters

state	channel information
ipp	IPv6 header to fill in (ICMP payload)
udp	"UDP" header to fill in (ICMP payload); might actually also be the first 8 bytes of the TCP header

Definition at line 1919 of file gnunet-daemon-exit.c.

{
  GNUNET_TUN_initialize_ipv4_header (ipp,
                                     state->specifics.tcp_udp.ri.remote_address.
                                     proto,
                                     sizeof(struct GNUNET_TUN_TcpHeader),
                                     &state->specifics.tcp_udp.ri.remote_address
                                     .address.ipv4,
                                     &state->specifics.tcp_udp.ri.local_address.
                                     address.ipv4);
  udp->source_port = htons (state->specifics.tcp_udp.ri.remote_address.port);
  udp->destination_port = htons (
    state->specifics.tcp_udp.ri.local_address.port);
  udp->len = htons (0);
  udp->crc = htons (0);
}

References address, GNUNET_TUN_initialize_ipv4_header(), proto, state, and udp.

Referenced by handle_icmp_remote(), and make_up_icmp_service_payload().

Here is the call graph for this function:

Here is the caller graph for this function:

make_up_icmpv6_payload()

static void make_up_icmpv6_payload ( struct ChannelState *  state, struct GNUNET_TUN_IPv6Header *  ipp, struct GNUNET_TUN_UdpHeader *  udp  )

static

Synthesize a plausible ICMP payload for an ICMPv6 error response on the given channel.

Parameters

state	channel information
ipp	IPv6 header to fill in (ICMP payload)
udp	"UDP" header to fill in (ICMP payload); might actually also be the first 8 bytes of the TCP header

Definition at line 1949 of file gnunet-daemon-exit.c.

{
  GNUNET_TUN_initialize_ipv6_header (ipp,
                                     state->specifics.tcp_udp.ri.remote_address.
                                     proto,
                                     sizeof(struct GNUNET_TUN_TcpHeader),
                                     &state->specifics.tcp_udp.ri.remote_address
                                     .address.ipv6,
                                     &state->specifics.tcp_udp.ri.local_address.
                                     address.ipv6);
  udp->source_port = htons (state->specifics.tcp_udp.ri.remote_address.port);
  udp->destination_port = htons (
    state->specifics.tcp_udp.ri.local_address.port);
  udp->len = htons (0);
  udp->crc = htons (0);
}

References address, GNUNET_TUN_initialize_ipv6_header(), proto, state, and udp.

Referenced by handle_icmp_remote(), and make_up_icmp_service_payload().

Here is the call graph for this function:

Here is the caller graph for this function:

check_icmp_remote()

static int check_icmp_remote ( void *  cls, const struct GNUNET_EXIT_IcmpInternetMessage *  msg  )

static

Check a request to forward ICMP data to the Internet via this peer.

Parameters

cls	our struct ChannelState *
msg	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 1978 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_break_op, GNUNET_OK, GNUNET_SYSERR, GNUNET_YES, and state.

handle_icmp_remote()

static void handle_icmp_remote ( void *  cls, const struct GNUNET_EXIT_IcmpInternetMessage *  msg  )

static

Process a request to forward ICMP data to the Internet via this peer.

Parameters

cls	our struct ChannelState *
msg	the actual message

Definition at line 1999 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_IcmpInternetMessage);
  const struct in_addr *v4;
  const struct in6_addr *v6;
  const void *payload;
  char buf[sizeof(struct GNUNET_TUN_IPv6Header) + 8] GNUNET_ALIGN;
  int af;
 
  if (GNUNET_SYSERR == state->is_dns)
  {
    /* channel is UDP/TCP from now on */
    state->is_dns = GNUNET_NO;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# ICMP IP-exit requests received via cadet"),
                            1, GNUNET_NO);
 
  af = (int) ntohl (msg->af);
  if ((NULL != state->specifics.tcp_udp.heap_node) &&
      (af != state->specifics.tcp_udp.ri.remote_address.af))
  {
    /* other peer switched AF on this channel; not allowed */
    GNUNET_break_op (0);
    return;
  }
 
  switch (af)
  {
  case AF_INET:
    if (pkt_len < sizeof(struct in_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv4_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v4 = (const struct in_addr*) &msg[1];
    payload = &v4[1];
    pkt_len -= sizeof(struct in_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv4 = *v4;
    if (NULL == state->specifics.tcp_udp.heap_node)
    {
      state->specifics.tcp_udp.ri.remote_address.af = af;
      state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_ICMP;
      setup_state_record (state);
    }
    /* check that ICMP type is something we want to support
       and possibly make up payload! */
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
    case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
      break;
 
    case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
    case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      /* make up payload */
      {
        struct GNUNET_TUN_IPv4Header *ipp = (struct
                                             GNUNET_TUN_IPv4Header *) buf;
        struct GNUNET_TUN_UdpHeader *udp = (struct
                                            GNUNET_TUN_UdpHeader *) &ipp[1];
 
        GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
        pkt_len = sizeof(struct GNUNET_TUN_IPv4Header) + 8;
        make_up_icmpv4_payload (state,
                                ipp,
                                udp);
        payload = ipp;
      }
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv4 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end AF_INET */
    break;
 
  case AF_INET6:
    if (pkt_len < sizeof(struct in6_addr))
    {
      GNUNET_break_op (0);
      return;
    }
    if (! ipv6_exit)
    {
      GNUNET_break_op (0);
      return;
    }
    v6 = (const struct in6_addr*) &msg[1];
    payload = &v6[1];
    pkt_len -= sizeof(struct in6_addr);
    state->specifics.tcp_udp.ri.remote_address.address.ipv6 = *v6;
    if (NULL == state->specifics.tcp_udp.heap_node)
    {
      state->specifics.tcp_udp.ri.remote_address.af = af;
      state->specifics.tcp_udp.ri.remote_address.proto = IPPROTO_ICMPV6;
      setup_state_record (state);
    }
    /* check that ICMP type is something we want to support
       and possibly make up payload! */
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
    case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
      break;
 
    case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
    case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
    case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      /* make up payload */
      {
        struct GNUNET_TUN_IPv6Header *ipp = (struct
                                             GNUNET_TUN_IPv6Header *) buf;
        struct GNUNET_TUN_UdpHeader *udp = (struct
                                            GNUNET_TUN_UdpHeader *) &ipp[1];
 
        GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
        pkt_len = sizeof(struct GNUNET_TUN_IPv6Header) + 8;
        make_up_icmpv6_payload (state,
                                ipp,
                                udp);
        payload = ipp;
      }
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv6 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end AF_INET6 */
    break;
 
  default:
    /* bad AF */
    GNUNET_break_op (0);
    return;
  }
 
  {
    char buf_tmp[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received ICMP data from %s for forwarding to %s\n",
                GNUNET_i2s (&state->peer),
                inet_ntop (af,
                           &state->specifics.tcp_udp.ri.remote_address.address,
                           buf_tmp, sizeof(buf_tmp)));
  }
  send_icmp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                            &state->specifics.tcp_udp.ri.local_address,
                            &msg->icmp_header,
                            payload, pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References gettext_noop, GNUNET_ALIGN, GNUNET_assert, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_log, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_SYSERR, GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE, GNUNET_TUN_ICMPTYPE6_ECHO_REPLY, GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST, GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG, GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM, GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED, GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE, GNUNET_TUN_ICMPTYPE_ECHO_REPLY, GNUNET_TUN_ICMPTYPE_ECHO_REQUEST, GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH, GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED, ipv4_exit, ipv6_exit, ChannelState::is_dns, make_up_icmpv4_payload(), make_up_icmpv6_payload(), msg, payload, send_icmp_packet_via_tun(), setup_state_record(), GNUNET_MessageHeader::size, state, stats, GNUNET_MessageHeader::type, and udp.

Here is the call graph for this function:

make_up_icmp_service_payload()

static uint16_t make_up_icmp_service_payload ( struct ChannelState *  state, char *  buf  )

static

Setup ICMP payload for ICMP error messages.

Called for both IPv4 and IPv6 addresses.

Parameters

state	context for creating the IP Packet
buf	where to create the payload, has at least sizeof (struct GNUNET_TUN_IPv6Header) + 8 bytes

Returns

number of bytes of payload we created in buf

Definition at line 2199 of file gnunet-daemon-exit.c.

{
  switch (state->specifics.tcp_udp.serv->address.af)
  {
  case AF_INET:
    {
      struct GNUNET_TUN_IPv4Header *ipv4;
      struct GNUNET_TUN_UdpHeader *udp;
 
      ipv4 = (struct GNUNET_TUN_IPv4Header *) buf;
      udp = (struct GNUNET_TUN_UdpHeader *) &ipv4[1];
      make_up_icmpv4_payload (state,
                              ipv4,
                              udp);
      GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
      return sizeof(struct GNUNET_TUN_IPv4Header) + 8;
    }
    break;
 
  case AF_INET6:
    {
      struct GNUNET_TUN_IPv6Header *ipv6;
      struct GNUNET_TUN_UdpHeader *udp;
 
      ipv6 = (struct GNUNET_TUN_IPv6Header *) buf;
      udp = (struct GNUNET_TUN_UdpHeader *) &ipv6[1];
      make_up_icmpv6_payload (state,
                              ipv6,
                              udp);
      GNUNET_assert (8 == sizeof(struct GNUNET_TUN_UdpHeader));
      return sizeof(struct GNUNET_TUN_IPv6Header) + 8;
    }
    break;
 
  default:
    GNUNET_break (0);
  }
  return 0;
}

References GNUNET_assert, GNUNET_break, ipv4, ipv6, make_up_icmpv4_payload(), make_up_icmpv6_payload(), state, and udp.

Referenced by handle_icmp_service().

Here is the call graph for this function:

Here is the caller graph for this function:

check_icmp_service()

static int check_icmp_service ( void *  cls, const struct GNUNET_EXIT_IcmpServiceMessage *  msg  )

static

Check a request via cadet to send ICMP data to a service offered by this system.

Parameters

cls	our struct ChannelState *
msg	the actual message

Returns

GNUNET_OK to keep the connection open, GNUNET_SYSERR to close it (signal serious error)

Definition at line 2251 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
 
  if (GNUNET_YES == state->is_dns)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  if (NULL == state->specifics.tcp_udp.serv)
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}

References GNUNET_break_op, GNUNET_OK, GNUNET_SYSERR, GNUNET_YES, and state.

handle_icmp_service()

static void handle_icmp_service ( void *  cls, const struct GNUNET_EXIT_IcmpServiceMessage *  msg  )

static

Process a request via cadet to send ICMP data to a service offered by this system.

Parameters

cls	our struct ChannelState *
msg	the actual message

Definition at line 2278 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state = cls;
  uint16_t pkt_len = ntohs (msg->header.size) - sizeof(struct
                                                       GNUNET_EXIT_IcmpServiceMessage);
  struct GNUNET_TUN_IcmpHeader icmp;
  char buf[sizeof(struct GNUNET_TUN_IPv6Header) + 8] GNUNET_ALIGN;
  const void *payload;
 
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from CADET"),
                            pkt_len, GNUNET_NO);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# ICMP service requests received via cadet"),
                            1, GNUNET_NO);
  /* check that we got at least a valid header */
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received data from %s for forwarding to ICMP service %s\n",
              GNUNET_i2s (&state->peer),
              GNUNET_h2s (&state->specifics.tcp_udp.serv->descriptor));
  icmp = msg->icmp_header;
  payload = &msg[1];
  state->specifics.tcp_udp.ri.remote_address
    = state->specifics.tcp_udp.serv->address;
  setup_state_record (state);
 
  /* check that ICMP type is something we want to support,
     perform ICMP PT if needed and possibly make up payload */
  switch (msg->af)
  {
  case AF_INET:
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_ECHO_REPLY;
      break;
 
    case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST;
      break;
 
    case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
        icmp.type = GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET6)
      {
        GNUNET_STATISTICS_update (stats,
                                  gettext_noop (
                                    "# ICMPv4 packets dropped (impossible PT to v6)"),
                                  1, GNUNET_NO);
        return;
      }
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv4 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end of AF_INET */
    break;
 
  case AF_INET6:
    switch (msg->icmp_header.type)
    {
    case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_ECHO_REPLY;
      break;
 
    case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_ECHO_REQUEST;
      break;
 
    case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
        icmp.type = GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED;
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
    case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
      if (state->specifics.tcp_udp.serv->address.af == AF_INET)
      {
        GNUNET_STATISTICS_update (stats,
                                  gettext_noop (
                                    "# ICMPv6 packets dropped (impossible PT to v4)"),
                                  1, GNUNET_NO);
        return;
      }
      if (0 != pkt_len)
      {
        GNUNET_break_op (0);
        return;
      }
      payload = buf;
      pkt_len = make_up_icmp_service_payload (state, buf);
      break;
 
    default:
      GNUNET_break_op (0);
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv6 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    /* end of AF_INET6 */
    break;
 
  default:
    GNUNET_break_op (0);
    return;
  }
 
  send_icmp_packet_via_tun (&state->specifics.tcp_udp.ri.remote_address,
                            &state->specifics.tcp_udp.ri.local_address,
                            &icmp,
                            payload,
                            pkt_len);
  GNUNET_CADET_receive_done (state->channel);
}

References gettext_noop, GNUNET_ALIGN, GNUNET_break_op, GNUNET_CADET_receive_done(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_h2s(), GNUNET_i2s(), GNUNET_log, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE, GNUNET_TUN_ICMPTYPE6_ECHO_REPLY, GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST, GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG, GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM, GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED, GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE, GNUNET_TUN_ICMPTYPE_ECHO_REPLY, GNUNET_TUN_ICMPTYPE_ECHO_REQUEST, GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH, GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED, make_up_icmp_service_payload(), msg, payload, send_icmp_packet_via_tun(), setup_state_record(), GNUNET_MessageHeader::size, state, stats, GNUNET_MessageHeader::type, and GNUNET_TUN_IcmpHeader::type.

Here is the call graph for this function:

free_service_record()

static int free_service_record ( void *  cls, const struct GNUNET_HashCode *  key, void *  value  )

static

Free memory associated with a service record.

Parameters

cls	unused
key	service descriptor
value	service record to free

Returns

GNUNET_OK

Definition at line 2468 of file gnunet-daemon-exit.c.

{
  struct LocalService *service = value;
 
  GNUNET_assert (GNUNET_YES ==
                 GNUNET_CONTAINER_multihashmap_remove (services,
                                                       key,
                                                       service));
  GNUNET_CADET_close_port (service->port);
  GNUNET_free (service->name);
  GNUNET_free (service);
  return GNUNET_OK;
}

References GNUNET_assert, GNUNET_CADET_close_port(), GNUNET_CONTAINER_multihashmap_remove(), GNUNET_free, GNUNET_OK, GNUNET_YES, key, service, services, and value.

Referenced by cleanup().

Here is the call graph for this function:

Here is the caller graph for this function:

new_service_channel()

static void * new_service_channel ( void *  cls, struct GNUNET_CADET_Channel *  channel, const struct GNUNET_PeerIdentity *  initiator  )

static

Callback from CADET for new channels.

Parameters

cls	closure
channel	new handle to the channel
initiator	peer that started the channel

Returns

initial channel context for the channel

Definition at line 2494 of file gnunet-daemon-exit.c.

{
  struct LocalService *ls = cls;
  struct ChannelState *s = GNUNET_new (struct ChannelState);
 
  s->peer = *initiator;
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Inbound CADET channels created"),
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received inbound channel from `%s'\n",
              GNUNET_i2s (initiator));
  s->channel = channel;
  s->specifics.tcp_udp.serv = ls;
  s->specifics.tcp_udp.ri.remote_address = ls->address;
  return s;
}

References ChannelState::channel, gettext_noop, GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_log, GNUNET_new, GNUNET_NO, GNUNET_STATISTICS_update(), ls, ChannelState::peer, RedirectInformation::remote_address, ChannelState::ri, ChannelState::serv, ChannelState::specifics, stats, and ChannelState::tcp_udp.

Referenced by store_service().

Here is the call graph for this function:

Here is the caller graph for this function:

clean_channel()

static void clean_channel ( void *  cls, const struct GNUNET_CADET_Channel *  channel  )

static

Function called by cadet whenever an inbound channel is destroyed.

Should clean up any associated state.

Parameters

cls	our struct ChannelState *
channel	connection to the other end (henceforth invalid)

Definition at line 2524 of file gnunet-daemon-exit.c.

{
  struct ChannelState *s = cls;
 
  LOG (GNUNET_ERROR_TYPE_DEBUG,
       "Channel destroyed\n");
  if (GNUNET_SYSERR == s->is_dns)
  {
    GNUNET_free (s);
    return;
  }
  if (GNUNET_YES == s->is_dns)
  {
    if (channels[s->specifics.dns.my_id] == s)
      channels[s->specifics.dns.my_id] = NULL;
  }
  else
  {
    if (NULL != s->specifics.tcp_udp.heap_node)
    {
      GNUNET_assert (GNUNET_YES ==
                     GNUNET_CONTAINER_multihashmap_remove (connections_map,
                                                           &s->specifics.tcp_udp
                                                           .state_key,
                                                           s));
      GNUNET_CONTAINER_heap_remove_node (s->specifics.tcp_udp.heap_node);
      s->specifics.tcp_udp.heap_node = NULL;
    }
  }
  GNUNET_free (s);
}

References channels, connections_map, ChannelState::dns, GNUNET_assert, GNUNET_CONTAINER_heap_remove_node(), GNUNET_CONTAINER_multihashmap_remove(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_free, GNUNET_SYSERR, GNUNET_YES, ChannelState::heap_node, ChannelState::is_dns, LOG, ChannelState::my_id, ChannelState::specifics, ChannelState::state_key, and ChannelState::tcp_udp.

Referenced by advertise_dns_exit(), run(), and store_service().

Here is the call graph for this function:

Here is the caller graph for this function:

store_service()

static void store_service ( int  proto, const char *  name, uint16_t  destination_port, struct LocalService *  service  )

static

Given a service descriptor and a destination port, find the respective service entry.

Parameters

proto	IPPROTO_TCP or IPPROTO_UDP
name	name of the service
destination_port	destination port
service	service information record to store (service->name will be set).

Definition at line 2568 of file gnunet-daemon-exit.c.

{
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (icmp_service,
                           GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_SERVICE,
                           struct GNUNET_EXIT_IcmpServiceMessage,
                           service),
    GNUNET_MQ_hd_var_size (udp_service,
                           GNUNET_MESSAGE_TYPE_VPN_UDP_TO_SERVICE,
                           struct GNUNET_EXIT_UdpServiceMessage,
                           service),
    GNUNET_MQ_hd_var_size (tcp_service,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_TO_SERVICE_START,
                           struct GNUNET_EXIT_TcpServiceStartMessage,
                           service),
    GNUNET_MQ_hd_var_size (tcp_data,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT,
                           struct GNUNET_EXIT_TcpDataMessage,
                           service),
    GNUNET_MQ_handler_end ()
  };
 
  struct GNUNET_HashCode cadet_port;
 
  service->name = GNUNET_strdup (name);
  GNUNET_TUN_service_name_to_hash (name,
                                   &service->descriptor);
  GNUNET_TUN_compute_service_cadet_port (&service->descriptor,
                                         destination_port,
                                         &cadet_port);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Opening CADET port %s for SERVICE exit %s on port %u\n",
              GNUNET_h2s (&cadet_port),
              name,
              (unsigned int) destination_port);
  service->port = GNUNET_CADET_open_port (cadet_handle,
                                          &cadet_port,
                                          &new_service_channel,
                                          service,
                                          NULL,
                                          &clean_channel,
                                          handlers);
  service->is_udp = (IPPROTO_UDP == proto);
  if (GNUNET_OK !=
      GNUNET_CONTAINER_multihashmap_put (services,
                                         &cadet_port,
                                         service,
                                         GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY))
  {
    GNUNET_CADET_close_port (service->port);
    GNUNET_free (service->name);
    GNUNET_free (service);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                _ ("Got duplicate service records for `%s:%u'\n"),
                name,
                (unsigned int) destination_port);
  }
}

References _, cadet_handle, cadet_port, clean_channel(), GNUNET_CADET_close_port(), GNUNET_CADET_open_port(), GNUNET_CONTAINER_multihashmap_put(), GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_WARNING, GNUNET_free, GNUNET_h2s(), GNUNET_log, GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_SERVICE, GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT, GNUNET_MESSAGE_TYPE_VPN_TCP_TO_SERVICE_START, GNUNET_MESSAGE_TYPE_VPN_UDP_TO_SERVICE, GNUNET_MQ_handler_end, GNUNET_MQ_hd_var_size, GNUNET_OK, GNUNET_strdup, GNUNET_TUN_compute_service_cadet_port(), GNUNET_TUN_service_name_to_hash(), handlers, name, new_service_channel(), proto, service, and services.

Referenced by add_services().

Here is the call graph for this function:

Here is the caller graph for this function:

send_packet_to_cadet_channel()

static void send_packet_to_cadet_channel ( struct ChannelState *  s, struct GNUNET_MQ_Envelope *  env  )

static

Send the given packet via the cadet channel.

Parameters

s	channel destination
env	message to queue

Definition at line 2638 of file gnunet-daemon-exit.c.

{
  GNUNET_assert (NULL != s);
  GNUNET_STATISTICS_update (stats,
                            gettext_noop (
                              "# Messages transmitted via cadet channels"),
                            1,
                            GNUNET_NO);
  GNUNET_MQ_send (GNUNET_CADET_get_mq (s->channel),
                  env);
}

References ChannelState::channel, env, gettext_noop, GNUNET_assert, GNUNET_CADET_get_mq(), GNUNET_MQ_send(), GNUNET_NO, GNUNET_STATISTICS_update(), and stats.

Referenced by icmp_from_helper(), tcp_from_helper(), and udp_from_helper().

Here is the call graph for this function:

Here is the caller graph for this function:

icmp_from_helper()

static void icmp_from_helper ( const struct GNUNET_TUN_IcmpHeader *  icmp, size_t  pktlen, int  af, const void *  destination_ip, const void *  source_ip  )

static

Handles an ICMP packet received from the helper.

Parameters

icmp	A pointer to the Packet
pktlen	number of bytes in icmp
af	address family (AFINET or AF_INET6)
destination_ip	destination IP-address of the IP packet (should be our local address)
source_ip	original source IP-address of the IP packet (should be the original destination address)

Definition at line 2664 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_EXIT_IcmpToVPNMessage *i2v;
  const struct GNUNET_TUN_IPv4Header *ipv4;
  const struct GNUNET_TUN_IPv6Header *ipv6;
  const struct GNUNET_TUN_UdpHeader *udp;
  uint16_t source_port;
  uint16_t destination_port;
  uint8_t protocol;
 
  {
    char sbuf[INET6_ADDRSTRLEN];
    char dbuf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received ICMP packet going from %s to %s\n",
                inet_ntop (af,
                           source_ip,
                           sbuf, sizeof(sbuf)),
                inet_ntop (af,
                           destination_ip,
                           dbuf, sizeof(dbuf)));
  }
 
  if (pktlen < sizeof(struct GNUNET_TUN_IcmpHeader))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
 
  /* Find out if this is an ICMP packet in response to an existing
     TCP/UDP packet and if so, figure out ports / protocol of the
     existing session from the IP data in the ICMP payload */
  source_port = 0;
  destination_port = 0;
  switch (af)
  {
  case AF_INET:
    protocol = IPPROTO_ICMP;
    switch (icmp->type)
    {
    case GNUNET_TUN_ICMPTYPE_ECHO_REPLY:
    case GNUNET_TUN_ICMPTYPE_ECHO_REQUEST:
      break;
 
    case GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH:
    case GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED:
      if (pktlen <
          sizeof(struct GNUNET_TUN_IcmpHeader)
          + sizeof(struct GNUNET_TUN_IPv4Header) + 8)
      {
        /* blame kernel */
        GNUNET_break (0);
        return;
      }
      ipv4 = (const struct GNUNET_TUN_IPv4Header *) &icmp[1];
      protocol = ipv4->protocol;
      /* could be TCP or UDP, but both have the ports in the right
         place, so that doesn't matter here */
      udp = (const struct GNUNET_TUN_UdpHeader *) &ipv4[1];
      /* swap ports, as they are from the original message */
      destination_port = ntohs (udp->source_port);
      source_port = ntohs (udp->destination_port);
      /* throw away ICMP payload, won't be useful for the other side anyway */
      pktlen = sizeof(struct GNUNET_TUN_IcmpHeader);
      break;
 
    default:
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv4 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    break;
 
  case AF_INET6:
    protocol = IPPROTO_ICMPV6;
    switch (icmp->type)
    {
    case GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE:
    case GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG:
    case GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED:
    case GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM:
      if (pktlen <
          sizeof(struct GNUNET_TUN_IcmpHeader)
          + sizeof(struct GNUNET_TUN_IPv6Header) + 8)
      {
        /* blame kernel */
        GNUNET_break (0);
        return;
      }
      ipv6 = (const struct GNUNET_TUN_IPv6Header *) &icmp[1];
      protocol = ipv6->next_header;
      /* could be TCP or UDP, but both have the ports in the right
         place, so that doesn't matter here */
      udp = (const struct GNUNET_TUN_UdpHeader *) &ipv6[1];
      /* swap ports, as they are from the original message */
      destination_port = ntohs (udp->source_port);
      source_port = ntohs (udp->destination_port);
      /* throw away ICMP payload, won't be useful for the other side anyway */
      pktlen = sizeof(struct GNUNET_TUN_IcmpHeader);
      break;
 
    case GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST:
    case GNUNET_TUN_ICMPTYPE6_ECHO_REPLY:
      break;
 
    default:
      GNUNET_STATISTICS_update (stats,
                                gettext_noop (
                                  "# ICMPv6 packets dropped (type not allowed)")
                                ,
                                1, GNUNET_NO);
      return;
    }
    break;
 
  default:
    GNUNET_assert (0);
  }
  switch (protocol)
  {
  case IPPROTO_ICMP:
    state = get_redirect_state (af,
                                IPPROTO_ICMP,
                                source_ip,
                                0,
                                destination_ip,
                                0,
                                NULL);
    break;
 
  case IPPROTO_ICMPV6:
    state = get_redirect_state (af,
                                IPPROTO_ICMPV6,
                                source_ip,
                                0,
                                destination_ip,
                                0,
                                NULL);
    break;
 
  case IPPROTO_UDP:
    state = get_redirect_state (af,
                                IPPROTO_UDP,
                                source_ip,
                                source_port,
                                destination_ip,
                                destination_port,
                                NULL);
    break;
 
  case IPPROTO_TCP:
    state = get_redirect_state (af,
                                IPPROTO_TCP,
                                source_ip,
                                source_port,
                                destination_ip,
                                destination_port,
                                NULL);
    break;
 
  default:
    GNUNET_STATISTICS_update (stats,
                              gettext_noop (
                                "# ICMP packets dropped (not allowed)"),
                              1,
                              GNUNET_NO);
    return;
  }
  if (NULL == state)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                _ (
                  "ICMP Packet dropped, have no matching connection information\n"));
    return;
  }
  env = GNUNET_MQ_msg_extra (i2v,
                             pktlen - sizeof(struct GNUNET_TUN_IcmpHeader),
                             GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_VPN);
  i2v->af = htonl (af);
  GNUNET_memcpy (&i2v->icmp_header,
                 icmp,
                 pktlen);
  send_packet_to_cadet_channel (state,
                                env);
}

References _, GNUNET_EXIT_IcmpToVPNMessage::af, GNUNET_TUN_UdpHeader::destination_port, env, get_redirect_state(), gettext_noop, GNUNET_assert, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_INFO, GNUNET_log, GNUNET_memcpy, GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_VPN, GNUNET_MQ_msg_extra, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_TUN_ICMPTYPE6_DESTINATION_UNREACHABLE, GNUNET_TUN_ICMPTYPE6_ECHO_REPLY, GNUNET_TUN_ICMPTYPE6_ECHO_REQUEST, GNUNET_TUN_ICMPTYPE6_PACKET_TOO_BIG, GNUNET_TUN_ICMPTYPE6_PARAMETER_PROBLEM, GNUNET_TUN_ICMPTYPE6_TIME_EXCEEDED, GNUNET_TUN_ICMPTYPE_DESTINATION_UNREACHABLE, GNUNET_TUN_ICMPTYPE_ECHO_REPLY, GNUNET_TUN_ICMPTYPE_ECHO_REQUEST, GNUNET_TUN_ICMPTYPE_SOURCE_QUENCH, GNUNET_TUN_ICMPTYPE_TIME_EXCEEDED, GNUNET_EXIT_IcmpToVPNMessage::icmp_header, ipv4, ipv6, GNUNET_TUN_IPv4Header::protocol, send_packet_to_cadet_channel(), GNUNET_TUN_UdpHeader::source_port, state, stats, GNUNET_TUN_IcmpHeader::type, and udp.

Referenced by message_token().

Here is the call graph for this function:

Here is the caller graph for this function:

udp_from_helper()

static void udp_from_helper ( const struct GNUNET_TUN_UdpHeader *  udp, size_t  pktlen, int  af, const void *  destination_ip, const void *  source_ip  )

static

Handles an UDP packet received from the helper.

Parameters

udp	A pointer to the Packet
pktlen	number of bytes in 'udp'
af	address family (AFINET or AF_INET6)
destination_ip	destination IP-address of the IP packet (should be our local address)
source_ip	original source IP-address of the IP packet (should be the original destination address)

Definition at line 2874 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_EXIT_UdpReplyMessage *urm;
 
  {
    char sbuf[INET6_ADDRSTRLEN];
    char dbuf[INET6_ADDRSTRLEN];
 
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received UDP packet going from %s:%u to %s:%u\n",
                inet_ntop (af,
                           source_ip,
                           sbuf, sizeof(sbuf)),
                (unsigned int) ntohs (udp->source_port),
                inet_ntop (af,
                           destination_ip,
                           dbuf, sizeof(dbuf)),
                (unsigned int) ntohs (udp->destination_port));
  }
 
  if (pktlen < sizeof(struct GNUNET_TUN_UdpHeader))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
  if (pktlen != ntohs (udp->len))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
  state = get_redirect_state (af,
                              IPPROTO_UDP,
                              source_ip,
                              ntohs (udp->source_port),
                              destination_ip,
                              ntohs (udp->destination_port),
                              NULL);
  if (NULL == state)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                _ (
                  "UDP Packet dropped, have no matching connection information\n"));
    return;
  }
  env = GNUNET_MQ_msg_extra (urm,
                             pktlen - sizeof(struct GNUNET_TUN_UdpHeader),
                             GNUNET_MESSAGE_TYPE_VPN_UDP_REPLY);
  urm->source_port = htons (0);
  urm->destination_port = htons (0);
  GNUNET_memcpy (&urm[1],
                 &udp[1],
                 pktlen - sizeof(struct GNUNET_TUN_UdpHeader));
  send_packet_to_cadet_channel (state,
                                env);
}

References _, GNUNET_EXIT_UdpReplyMessage::destination_port, env, get_redirect_state(), GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_INFO, GNUNET_log, GNUNET_memcpy, GNUNET_MESSAGE_TYPE_VPN_UDP_REPLY, GNUNET_MQ_msg_extra, send_packet_to_cadet_channel(), GNUNET_EXIT_UdpReplyMessage::source_port, state, and udp.

Referenced by message_token().

Here is the call graph for this function:

Here is the caller graph for this function:

tcp_from_helper()

static void tcp_from_helper ( const struct GNUNET_TUN_TcpHeader *  tcp, size_t  pktlen, int  af, const void *  destination_ip, const void *  source_ip  )

static

Handles a TCP packet received from the helper.

Parameters

tcp	A pointer to the Packet
pktlen	the length of the packet, including its TCP header
af	address family (AFINET or AF_INET6)
destination_ip	destination IP-address of the IP packet (should be our local address)
source_ip	original source IP-address of the IP packet (should be the original destination address)

Definition at line 2951 of file gnunet-daemon-exit.c.

{
  struct ChannelState *state;
  char buf[pktlen] GNUNET_ALIGN;
  struct GNUNET_TUN_TcpHeader *mtcp;
  struct GNUNET_EXIT_TcpDataMessage *tdm;
  struct GNUNET_MQ_Envelope *env;
  size_t mlen;
 
  {
    char sbuf[INET6_ADDRSTRLEN];
    char dbuf[INET6_ADDRSTRLEN];
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Received TCP packet with %u bytes going from %s:%u to %s:%u\n",
                (unsigned int) (pktlen - sizeof(struct GNUNET_TUN_TcpHeader)),
                inet_ntop (af,
                           source_ip,
                           sbuf, sizeof(sbuf)),
                (unsigned int) ntohs (tcp->source_port),
                inet_ntop (af,
                           destination_ip,
                           dbuf, sizeof(dbuf)),
                (unsigned int) ntohs (tcp->destination_port));
  }
 
  if (pktlen < sizeof(struct GNUNET_TUN_TcpHeader))
  {
    /* blame kernel */
    GNUNET_break (0);
    return;
  }
  state = get_redirect_state (af,
                              IPPROTO_TCP,
                              source_ip,
                              ntohs (tcp->source_port),
                              destination_ip,
                              ntohs (tcp->destination_port),
                              NULL);
  if (NULL == state)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                _ (
                  "TCP Packet dropped, have no matching connection information\n"));
 
    return;
  }
  /* mug port numbers and crc to avoid information leakage;
     sender will need to lookup the correct values anyway */
  GNUNET_memcpy (buf, tcp, pktlen);
  mtcp = (struct GNUNET_TUN_TcpHeader *) buf;
  mtcp->source_port = 0;
  mtcp->destination_port = 0;
  mtcp->crc = 0;
 
  mlen = sizeof(struct GNUNET_EXIT_TcpDataMessage) + (pktlen - sizeof(struct
                                                                      GNUNET_TUN_TcpHeader));
  if (mlen >= GNUNET_MAX_MESSAGE_SIZE)
  {
    GNUNET_break (0);
    return;
  }
  env = GNUNET_MQ_msg_extra (tdm,
                             pktlen - sizeof(struct GNUNET_TUN_TcpHeader),
                             GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_VPN);
  tdm->reserved = htonl (0);
  GNUNET_memcpy (&tdm->tcp_header,
                 buf,
                 pktlen);
  send_packet_to_cadet_channel (state,
                                env);
}

References _, env, get_redirect_state(), GNUNET_ALIGN, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_INFO, GNUNET_log, GNUNET_MAX_MESSAGE_SIZE, GNUNET_memcpy, GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_VPN, GNUNET_MQ_msg_extra, GNUNET_TUN_TcpHeader::off, GNUNET_EXIT_TcpDataMessage::reserved, send_packet_to_cadet_channel(), GNUNET_TUN_TcpHeader::source_port, state, tcp, and GNUNET_EXIT_TcpDataMessage::tcp_header.

Referenced by message_token().

Here is the call graph for this function:

Here is the caller graph for this function:

message_token()

static int message_token ( void *  cls, const struct GNUNET_MessageHeader *  message  )

static

Receive packets from the helper-process.

Parameters

cls	unused
message	message received from helper

Definition at line 3035 of file gnunet-daemon-exit.c.

{
  const struct GNUNET_TUN_Layer2PacketHeader *pkt_tun;
  size_t size;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Got %u-byte message of type %u from gnunet-helper-exit\n",
              ntohs (message->size),
              ntohs (message->type));
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Packets received from TUN"),
                            1, GNUNET_NO);
  if (ntohs (message->type) != GNUNET_MESSAGE_TYPE_VPN_HELPER)
  {
    GNUNET_break (0);
    return GNUNET_OK;
  }
  size = ntohs (message->size);
  if (size < sizeof(struct GNUNET_TUN_Layer2PacketHeader) + sizeof(struct
                                                                   GNUNET_MessageHeader))
  {
    GNUNET_break (0);
    return GNUNET_OK;
  }
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Bytes received from TUN"),
                            size, GNUNET_NO);
  pkt_tun = (const struct GNUNET_TUN_Layer2PacketHeader *) &message[1];
  size -= sizeof(struct GNUNET_TUN_Layer2PacketHeader) + sizeof(struct
                                                                GNUNET_MessageHeader);
  switch (ntohs (pkt_tun->proto))
  {
  case ETH_P_IPV4:
    {
      const struct GNUNET_TUN_IPv4Header *pkt4;
 
      if (size < sizeof(struct GNUNET_TUN_IPv4Header))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      pkt4 = (const struct GNUNET_TUN_IPv4Header *) &pkt_tun[1];
      if (size != ntohs (pkt4->total_length))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      if (pkt4->header_length * 4 != sizeof(struct GNUNET_TUN_IPv4Header))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ ("IPv4 packet options received.  Ignored.\n"));
        return GNUNET_OK;
      }
 
      size -= sizeof(struct GNUNET_TUN_IPv4Header);
      switch (pkt4->protocol)
      {
      case IPPROTO_UDP:
        udp_from_helper ((const struct GNUNET_TUN_UdpHeader *) &pkt4[1], size,
                         AF_INET,
                         &pkt4->destination_address,
                         &pkt4->source_address);
        break;
 
      case IPPROTO_TCP:
        tcp_from_helper ((const struct GNUNET_TUN_TcpHeader *) &pkt4[1], size,
                         AF_INET,
                         &pkt4->destination_address,
                         &pkt4->source_address);
        break;
 
      case IPPROTO_ICMP:
        icmp_from_helper ((const struct GNUNET_TUN_IcmpHeader *) &pkt4[1], size,
                          AF_INET,
                          &pkt4->destination_address,
                          &pkt4->source_address);
        break;
 
      default:
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "IPv4 packet with unsupported next header %u received.  Ignored.\n"),
                    (int) pkt4->protocol);
        return GNUNET_OK;
      }
    }
    break;
 
  case ETH_P_IPV6:
    {
      const struct GNUNET_TUN_IPv6Header *pkt6;
 
      if (size < sizeof(struct GNUNET_TUN_IPv6Header))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      pkt6 = (struct GNUNET_TUN_IPv6Header *) &pkt_tun[1];
      if (size != ntohs (pkt6->payload_length) + sizeof(struct
                                                        GNUNET_TUN_IPv6Header))
      {
        /* Kernel to blame? */
        GNUNET_break (0);
        return GNUNET_OK;
      }
      size -= sizeof(struct GNUNET_TUN_IPv6Header);
      switch (pkt6->next_header)
      {
      case IPPROTO_UDP:
        udp_from_helper ((const struct GNUNET_TUN_UdpHeader *) &pkt6[1], size,
                         AF_INET6,
                         &pkt6->destination_address,
                         &pkt6->source_address);
        break;
 
      case IPPROTO_TCP:
        tcp_from_helper ((const struct GNUNET_TUN_TcpHeader *) &pkt6[1], size,
                         AF_INET6,
                         &pkt6->destination_address,
                         &pkt6->source_address);
        break;
 
      case IPPROTO_ICMPV6:
        icmp_from_helper ((const struct GNUNET_TUN_IcmpHeader *) &pkt6[1], size,
                          AF_INET6,
                          &pkt6->destination_address,
                          &pkt6->source_address);
        break;
 
      default:
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "IPv6 packet with unsupported next header %d received.  Ignored.\n"),
                    pkt6->next_header);
        return GNUNET_OK;
      }
    }
    break;
 
  default:
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                _ ("Packet from unknown protocol %u received.  Ignored.\n"),
                ntohs (pkt_tun->proto));
    break;
  }
  return GNUNET_OK;
}

References _, ETH_P_IPV4, ETH_P_IPV6, gettext_noop, GNUNET_break, GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_WARNING, GNUNET_log, GNUNET_MESSAGE_TYPE_VPN_HELPER, GNUNET_NO, GNUNET_OK, GNUNET_STATISTICS_update(), GNUNET_TUN_IPv4Header::header_length, icmp_from_helper(), GNUNET_TUN_IPv6Header::next_header, GNUNET_TUN_IPv6Header::payload_length, GNUNET_TUN_Layer2PacketHeader::proto, GNUNET_TUN_IPv4Header::protocol, GNUNET_MessageHeader::size, size, stats, tcp_from_helper(), GNUNET_TUN_IPv4Header::total_length, GNUNET_MessageHeader::type, and udp_from_helper().

Referenced by run().

Here is the call graph for this function:

Here is the caller graph for this function:

new_channel()

static void * new_channel ( void *  cls, struct GNUNET_CADET_Channel *  channel, const struct GNUNET_PeerIdentity *  initiator  )

static

Callback from CADET for new channels.

Parameters

cls	closure
channel	new handle to the channel
initiator	peer that started the channel

Returns

initial channel context for the channel

Definition at line 3197 of file gnunet-daemon-exit.c.

{
  struct ChannelState *s = GNUNET_new (struct ChannelState);
 
  s->is_dns = GNUNET_SYSERR;
  s->peer = *initiator;
  GNUNET_STATISTICS_update (stats,
                            gettext_noop ("# Inbound CADET channels created"),
                            1,
                            GNUNET_NO);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received inbound channel from `%s'\n",
              GNUNET_i2s (initiator));
  s->channel = channel;
  return s;
}

References ChannelState::channel, gettext_noop, GNUNET_ERROR_TYPE_DEBUG, GNUNET_i2s(), GNUNET_log, GNUNET_new, GNUNET_NO, GNUNET_STATISTICS_update(), GNUNET_SYSERR, ChannelState::is_dns, ChannelState::peer, and stats.

Referenced by advertise_dns_exit(), and run().

Here is the call graph for this function:

Here is the caller graph for this function:

free_iterate()

static int free_iterate ( void *  cls, const struct GNUNET_HashCode *  hash, void *  value  )

static

Function that frees everything from a hashmap.

Parameters

cls	unused
hash	key
value	value to free

Definition at line 3225 of file gnunet-daemon-exit.c.

{
  GNUNET_free (value);
  return GNUNET_YES;
}

References GNUNET_free, GNUNET_YES, and value.

Referenced by cleanup().

Here is the caller graph for this function:

dummy_task()

static void dummy_task ( void *  cls )

static

Function scheduled as very last function if the service disabled itself because the helper is not installed properly.

Does nothing, except for keeping the service process alive by virtue of being scheduled.

Parameters

cls

NULL

Definition at line 3243 of file gnunet-daemon-exit.c.

{
  /* just terminate */
}

Referenced by run().

Here is the caller graph for this function:

cleanup()

static void cleanup ( void *  cls )

static

Function scheduled as very last function, cleans up after us.

Parameters

cls

NULL

Definition at line 3255 of file gnunet-daemon-exit.c.

{
  unsigned int i;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Exit service is shutting down now\n");
 
  if (NULL != helper_handle)
  {
    GNUNET_HELPER_stop (helper_handle, GNUNET_NO);
    helper_handle = NULL;
  }
  if (NULL != regex4)
  {
    GNUNET_REGEX_announce_cancel (regex4);
    regex4 = NULL;
  }
  if (NULL != regex6)
  {
    GNUNET_REGEX_announce_cancel (regex6);
    regex6 = NULL;
  }
  if (NULL != services)
  {
    GNUNET_CONTAINER_multihashmap_iterate (services,
                                           &free_service_record,
                                           NULL);
    GNUNET_CONTAINER_multihashmap_destroy (services);
  }
  if (NULL != dns_port)
  {
    GNUNET_CADET_close_port (dns_port);
    dns_port = NULL;
  }
  if (NULL != cadet_port4)
  {
    GNUNET_CADET_close_port (cadet_port4);
    cadet_port4 = NULL;
  }
  if (NULL != cadet_port6)
  {
    GNUNET_CADET_close_port (cadet_port6);
    cadet_port6 = NULL;
  }
  if (NULL != cadet_handle)
  {
    GNUNET_CADET_disconnect (cadet_handle);
    cadet_handle = NULL;
  }
  if (NULL != connections_map)
  {
    GNUNET_CONTAINER_multihashmap_iterate (connections_map,
                                           &free_iterate,
                                           NULL);
    GNUNET_CONTAINER_multihashmap_destroy (connections_map);
    connections_map = NULL;
  }
  if (NULL != connections_heap)
  {
    GNUNET_CONTAINER_heap_destroy (connections_heap);
    connections_heap = NULL;
  }
  if (NULL != dnsstub)
  {
    GNUNET_DNSSTUB_stop (dnsstub);
    dnsstub = NULL;
  }
  if (NULL != sign_op)
  {
    GNUNET_PILS_cancel (sign_op);
    sign_op = NULL;
  }
  if (NULL != pils)
  {
    GNUNET_PILS_disconnect (pils);
    pils = NULL;
  }
  if (NULL != dht_task)
  {
    GNUNET_SCHEDULER_cancel (dht_task);
    dht_task = NULL;
  }
  if (NULL != dht_put)
  {
    GNUNET_DHT_put_cancel (dht_put);
    dht_put = NULL;
  }
  if (NULL != dht)
  {
    GNUNET_DHT_disconnect (dht);
    dht = NULL;
  }
  if (NULL != stats)
  {
    GNUNET_STATISTICS_destroy (stats,
                               GNUNET_NO);
    stats = NULL;
  }
  for (i = 0; i < 8; i++)
    GNUNET_free (exit_argv[i]);
}

References cadet_handle, cadet_port4, cadet_port6, connections_heap, connections_map, dht, dht_put, dht_task, dns_port, dnsstub, exit_argv, free_iterate(), free_service_record(), GNUNET_CADET_close_port(), GNUNET_CADET_disconnect(), GNUNET_CONTAINER_heap_destroy(), GNUNET_CONTAINER_multihashmap_destroy(), GNUNET_CONTAINER_multihashmap_iterate(), GNUNET_DHT_disconnect(), GNUNET_DHT_put_cancel(), GNUNET_DNSSTUB_stop(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_free, GNUNET_HELPER_stop(), GNUNET_log, GNUNET_NO, GNUNET_PILS_cancel(), GNUNET_PILS_disconnect(), GNUNET_REGEX_announce_cancel(), GNUNET_SCHEDULER_cancel(), GNUNET_STATISTICS_destroy(), helper_handle, pils, regex4, regex6, services, sign_op, and stats.

Here is the call graph for this function:

add_services()

static void add_services ( int  proto, char *  cpy, const char *  name  )

static

Add services to the service map.

Parameters

proto	IPPROTO_TCP or IPPROTO_UDP
cpy	copy of the service descriptor (can be mutilated)
name	DNS name of the service

Definition at line 3366 of file gnunet-daemon-exit.c.

{
  char *redirect;
  char *hostname;
  char *hostport;
  struct LocalService *serv;
  char *n;
  size_t slen;
  int local_port;
  int remote_port;
 
  slen = strlen (name);
  GNUNET_assert (slen >= 8);
  n = GNUNET_strndup (name, slen - 8 /* remove .gnunet. */);
 
  for (redirect = strtok (cpy, " ;"); redirect != NULL;
       redirect = strtok (NULL, " ;"))
  {
    if (NULL == (hostname = strstr (redirect, ":")))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ (
                    "Option `%s' for domain `%s' is not formatted correctly!\n")
                  ,
                  redirect,
                  name);
      continue;
    }
    hostname[0] = '\0';
    hostname++;
    if (NULL == (hostport = strstr (hostname, ":")))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ (
                    "Option `%s' for domain `%s' is not formatted correctly!\n")
                  ,
                  redirect,
                  name);
      continue;
    }
    hostport[0] = '\0';
    hostport++;
 
    local_port = atoi (redirect);
    remote_port = atoi (hostport);
 
    if (! ((local_port > 0) && (local_port < 65536)))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ ("`%s' is not a valid port number (for domain `%s')!"),
                  redirect,
                  name);
      continue;
    }
    if (! ((remote_port > 0) && (remote_port < 65536)))
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  _ ("`%s' is not a valid port number (for domain `%s')!"),
                  hostport,
                  name);
      continue;
    }
 
    serv = GNUNET_new (struct LocalService);
    serv->address.proto = proto;
    serv->address.port = remote_port;
    if (0 == strcmp ("localhost4",
                     hostname))
    {
      const char *ip4addr = exit_argv[5];
 
      serv->address.af = AF_INET;
      GNUNET_assert (1 == inet_pton (AF_INET,
                                     ip4addr,
                                     &serv->address.address.ipv4));
    }
    else if (0 == strcmp ("localhost6",
                          hostname))
    {
      const char *ip6addr = exit_argv[3];
 
      serv->address.af = AF_INET6;
      GNUNET_assert (1 == inet_pton (AF_INET6,
                                     ip6addr,
                                     &serv->address.address.ipv6));
    }
    else
    {
      struct addrinfo *res;
      int ret;
 
      ret = getaddrinfo (hostname,
                         NULL,
                         NULL,
                         &res);
      if ((0 != ret) || (NULL == res))
      {
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "No addresses found for hostname `%s' of service `%s'!\n")
                    ,
                    hostname,
                    n);
        GNUNET_free (serv);
        continue;
      }
 
      serv->address.af = res->ai_family;
      switch (res->ai_family)
      {
      case AF_INET:
        if (! ipv4_enabled)
        {
          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                      _ (
                        "Service `%s' configured for IPv4, but IPv4 is disabled!\n"),
                      n);
          freeaddrinfo (res);
          GNUNET_free (serv);
          continue;
        }
        serv->address.address.ipv4
          = ((struct sockaddr_in *) res->ai_addr)->sin_addr;
        break;
 
      case AF_INET6:
        if (! ipv6_enabled)
        {
          GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                      _ (
                        "Service `%s' configured for IPv4, but IPv4 is disabled!\n"),
                      n);
          freeaddrinfo (res);
          GNUNET_free (serv);
          continue;
        }
        serv->address.address.ipv6
          = ((struct sockaddr_in6 *) res->ai_addr)->sin6_addr;
        break;
 
      default:
        freeaddrinfo (res);
        GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                    _ (
                      "No IP addresses found for hostname `%s' of service `%s'!\n"),
                    hostname,
                    n);
        GNUNET_free (serv);
        continue;
      }
      freeaddrinfo (res);
    }
    store_service (proto,
                   n,
                   local_port,
                   serv);
  }
  GNUNET_free (n);
}

References _, SocketAddress::address, LocalService::address, SocketAddress::af, exit_argv, GNUNET_assert, GNUNET_ERROR_TYPE_WARNING, GNUNET_free, GNUNET_log, GNUNET_new, GNUNET_strndup, SocketAddress::ipv4, ipv4_enabled, SocketAddress::ipv6, ipv6_enabled, name, SocketAddress::port, proto, SocketAddress::proto, remote_port, res, ret, and store_service().

Referenced by read_service_conf().

Here is the call graph for this function:

Here is the caller graph for this function:

read_service_conf()

static void read_service_conf ( void *  cls, const char *  section  )

static

Reads the configuration and populates #udp_services and #tcp_services.

Parameters

cls	unused
section	name of section in config

Definition at line 3536 of file gnunet-daemon-exit.c.

{
  char *cpy;
 
  if ((strlen (section) < 8) ||
      (0 != strcmp (".gnunet.", section + (strlen (section) - 8))))
    return;
  if (GNUNET_OK ==
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             section,
                                             "UDP_REDIRECTS",
                                             &cpy))
  {
    add_services (IPPROTO_UDP,
                  cpy,
                  section);
    GNUNET_free (cpy);
  }
  if (GNUNET_OK ==
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             section,
                                             "TCP_REDIRECTS",
                                             &cpy))
  {
    add_services (IPPROTO_TCP,
                  cpy,
                  section);
    GNUNET_free (cpy);
  }
}

References add_services(), cfg, GNUNET_CONFIGURATION_get_value_string(), GNUNET_free, and GNUNET_OK.

Referenced by run().

Here is the call graph for this function:

Here is the caller graph for this function:

do_dht_put()

static void do_dht_put ( void *  cls )

static

We are running a DNS exit service, advertise it in the DHT.

This task is run periodically to do the DHT PUT.

Parameters

cls

closure

Definition at line 3615 of file gnunet-daemon-exit.c.

{
  struct GNUNET_TIME_Absolute expiration;
 
  dht_task = GNUNET_SCHEDULER_add_delayed (DHT_PUT_FREQUENCY,
                                           &do_dht_put,
                                           NULL);
  expiration = GNUNET_TIME_absolute_ntoh (dns_advertisement.expiration_time);
  if (GNUNET_TIME_absolute_get_remaining (expiration).rel_value_us <
      GNUNET_TIME_UNIT_HOURS.rel_value_us)
  {
    /* refresh advertisement */
    expiration = GNUNET_TIME_relative_to_absolute (DNS_ADVERTISEMENT_TIMEOUT);
    dns_advertisement.expiration_time = GNUNET_TIME_absolute_hton (expiration);
 
    if (NULL != sign_op)
      GNUNET_PILS_cancel (sign_op);
 
    sign_op = GNUNET_PILS_sign_by_peer_identity (pils, &dns_advertisement.
                                                 purpose,
                                                 &sign_dns_advertisement, cls);
    return;
  }
  if (NULL != dht_put)
    GNUNET_DHT_put_cancel (dht_put);
  dht_put = GNUNET_DHT_put (dht,
                            &dht_put_key,
                            1 /* replication */,
                            GNUNET_DHT_RO_NONE,
                            GNUNET_BLOCK_TYPE_DNS,
                            sizeof(struct GNUNET_DNS_Advertisement),
                            &dns_advertisement,
                            expiration,
                            &dht_put_cont,
                            NULL);
}

References dht, dht_put, dht_put_cont(), DHT_PUT_FREQUENCY, dht_put_key, dht_task, dns_advertisement, DNS_ADVERTISEMENT_TIMEOUT, do_dht_put(), expiration, GNUNET_DNS_Advertisement::expiration_time, GNUNET_BLOCK_TYPE_DNS, GNUNET_DHT_put(), GNUNET_DHT_put_cancel(), GNUNET_DHT_RO_NONE, GNUNET_PILS_cancel(), GNUNET_PILS_sign_by_peer_identity(), GNUNET_SCHEDULER_add_delayed(), GNUNET_TIME_absolute_get_remaining(), GNUNET_TIME_absolute_hton(), GNUNET_TIME_absolute_ntoh(), GNUNET_TIME_relative_to_absolute(), GNUNET_TIME_UNIT_HOURS, pils, GNUNET_TIME_Relative::rel_value_us, sign_dns_advertisement(), and sign_op.

Referenced by do_dht_put(), do_initial_dht_put(), and sign_dns_advertisement().

Here is the call graph for this function:

Here is the caller graph for this function:

dht_put_cont()

static void dht_put_cont ( void *  cls )

static

Function called when the DHT PUT operation is complete.

Schedules the next PUT.

Parameters

cls	closure, NULL

Definition at line 3586 of file gnunet-daemon-exit.c.

{
  dht_put = NULL;
}

References dht_put.

Referenced by do_dht_put().

Here is the caller graph for this function:

sign_dns_advertisement()

static void sign_dns_advertisement ( void *  cls, const struct GNUNET_PeerIdentity *  pid, const struct GNUNET_CRYPTO_EddsaSignature *  sig  )

static

Definition at line 3593 of file gnunet-daemon-exit.c.

{
  GNUNET_assert (sig);
 
  sign_op = NULL;
 
  GNUNET_memcpy (&dns_advertisement.signature, sig,
                 sizeof (dns_advertisement.signature));
 
  do_dht_put (cls);
}

References dns_advertisement, do_dht_put(), GNUNET_assert, GNUNET_memcpy, sign_op, and GNUNET_DNS_Advertisement::signature.

Referenced by do_dht_put().

Here is the call graph for this function:

Here is the caller graph for this function:

do_initial_dht_put()

static void do_initial_dht_put ( void *  cls, const struct GNUNET_HELLO_Parser *  parser, const struct GNUNET_HashCode *  hash  )

static

Definition at line 3654 of file gnunet-daemon-exit.c.

{
  const struct GNUNET_PeerIdentity *my_identity;
 
  my_identity = GNUNET_PILS_get_identity (pils);
  GNUNET_assert (my_identity);
 
  GNUNET_memcpy (&dns_advertisement.peer,
                 my_identity, sizeof (*my_identity));
  dns_advertisement.purpose.size = htonl (sizeof(struct
                                                 GNUNET_DNS_Advertisement)
                                          - sizeof(struct
                                                   GNUNET_CRYPTO_EddsaSignature)
                                          );
  dns_advertisement.purpose.purpose = htonl (
    GNUNET_SIGNATURE_PURPOSE_DNS_RECORD);
  GNUNET_CRYPTO_hash ("dns",
                      strlen ("dns"),
                      &dht_put_key);
 
  if (NULL != sign_op)
  {
    GNUNET_PILS_cancel (sign_op);
    sign_op = NULL;
  }
 
  if (NULL != dht_task)
    GNUNET_SCHEDULER_cancel (dht_task);
 
  dht_task = GNUNET_SCHEDULER_add_now (&do_dht_put,
                                       NULL);
}

References dht_put_key, dht_task, dns_advertisement, do_dht_put(), GNUNET_assert, GNUNET_CRYPTO_hash(), GNUNET_memcpy, GNUNET_PILS_cancel(), GNUNET_PILS_get_identity(), GNUNET_SCHEDULER_add_now(), GNUNET_SCHEDULER_cancel(), GNUNET_SIGNATURE_PURPOSE_DNS_RECORD, my_identity, GNUNET_DNS_Advertisement::peer, pils, GNUNET_DNS_Advertisement::purpose, GNUNET_CRYPTO_SignaturePurpose::purpose, sign_op, and GNUNET_CRYPTO_SignaturePurpose::size.

Referenced by advertise_dns_exit().

Here is the call graph for this function:

Here is the caller graph for this function:

parse_ip_options()

static void parse_ip_options ( )

static

Figure out which IP versions we should support (and which are supported by the OS) according to our configuration.

Definition at line 3695 of file gnunet-daemon-exit.c.

{
  ipv4_exit = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                    "exit",
                                                    "EXIT_IPV4");
  ipv6_exit = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                    "exit",
                                                    "EXIT_IPV6");
  ipv4_enabled = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                       "exit",
                                                       "ENABLE_IPV4");
  ipv6_enabled = GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                                       "exit",
                                                       "ENABLE_IPV6");
  if ((ipv4_exit || ipv4_enabled) &&
      (GNUNET_OK != GNUNET_NETWORK_test_pf (PF_INET)) )
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "This system does not support IPv4, will disable IPv4 functions despite them being enabled in the configuration\n"));
    ipv4_exit = GNUNET_NO;
    ipv4_enabled = GNUNET_NO;
  }
  if ((ipv6_exit || ipv6_enabled) &&
      (GNUNET_OK != GNUNET_NETWORK_test_pf (PF_INET6)) )
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "This system does not support IPv6, will disable IPv6 functions despite them being enabled in the configuration\n"));
    ipv6_exit = GNUNET_NO;
    ipv6_enabled = GNUNET_NO;
  }
  if (ipv4_exit && (! ipv4_enabled))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "Cannot enable IPv4 exit but disable IPv4 on TUN interface, will use ENABLE_IPv4=YES\n"));
    ipv4_enabled = GNUNET_YES;
  }
  if (ipv6_exit && (! ipv6_enabled))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ (
                  "Cannot enable IPv6 exit but disable IPv6 on TUN interface, will use ENABLE_IPv6=YES\n"));
    ipv6_enabled = GNUNET_YES;
  }
}

References _, cfg, GNUNET_CONFIGURATION_get_value_yesno(), GNUNET_ERROR_TYPE_ERROR, GNUNET_log, GNUNET_NETWORK_test_pf(), GNUNET_NO, GNUNET_OK, GNUNET_YES, ipv4_enabled, ipv4_exit, ipv6_enabled, and ipv6_exit.

Referenced by run().

Here is the call graph for this function:

Here is the caller graph for this function:

advertise_dns_exit()

static void advertise_dns_exit ( )

static

Helper function to open the CADET port for DNS exits and to advertise the DNS exit (if applicable).

Definition at line 3749 of file gnunet-daemon-exit.c.

{
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (dns_request,
                           GNUNET_MESSAGE_TYPE_VPN_DNS_TO_INTERNET,
                           struct DnsResponseMessage,
                           NULL),
    GNUNET_MQ_handler_end ()
  };
  char *dns_exit;
  struct GNUNET_HashCode port;
 
  if (GNUNET_YES !=
      GNUNET_CONFIGURATION_get_value_yesno (cfg,
                                            "exit",
                                            "EXIT_DNS"))
    return;
  GNUNET_assert (NULL != (dnsstub = GNUNET_DNSSTUB_start (128)));
  dns_exit = NULL;
  /* TODO: support using multiple DNS resolvers */
  if ((GNUNET_OK !=
       GNUNET_CONFIGURATION_get_value_string (cfg,
                                              "exit",
                                              "DNS_RESOLVER",
                                              &dns_exit)) ||
      (GNUNET_OK !=
       GNUNET_DNSSTUB_add_dns_ip (dnsstub,
                                  dns_exit)))
  {
    GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                               "dns",
                               "DNS_RESOLVER",
                               _ ("need a valid IPv4 or IPv6 address\n"));
    GNUNET_free (dns_exit);
    return;
  }
  /* open port */
  GNUNET_CRYPTO_hash (GNUNET_APPLICATION_PORT_INTERNET_RESOLVER,
                      strlen (GNUNET_APPLICATION_PORT_INTERNET_RESOLVER),
                      &port);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Opening CADET port %s for DNS exit service\n",
              GNUNET_h2s (&port));
  dns_port = GNUNET_CADET_open_port (cadet_handle,
                                     &port,
                                     &new_channel,
                                     NULL,
                                     NULL,
                                     &clean_channel,
                                     handlers);
  /* advertise exit */
  dht = GNUNET_DHT_connect (cfg, 1);
  dht_task = NULL;
  pils = GNUNET_PILS_connect (cfg, &do_initial_dht_put, NULL);
  sign_op = NULL;
  GNUNET_free (dns_exit);
}

References _, cadet_handle, cfg, clean_channel(), dht, dht_task, dns_port, dnsstub, do_initial_dht_put(), GNUNET_APPLICATION_PORT_INTERNET_RESOLVER, GNUNET_assert, GNUNET_CADET_open_port(), GNUNET_CONFIGURATION_get_value_string(), GNUNET_CONFIGURATION_get_value_yesno(), GNUNET_CRYPTO_hash(), GNUNET_DHT_connect(), GNUNET_DNSSTUB_add_dns_ip(), GNUNET_DNSSTUB_start(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_h2s(), GNUNET_log, GNUNET_log_config_invalid(), GNUNET_MESSAGE_TYPE_VPN_DNS_TO_INTERNET, GNUNET_MQ_handler_end, GNUNET_MQ_hd_var_size, GNUNET_OK, GNUNET_PILS_connect(), GNUNET_YES, handlers, new_channel(), pils, port, and sign_op.

Referenced by run().

Here is the call graph for this function:

Here is the caller graph for this function:

setup_exit_helper_args()

static int setup_exit_helper_args ( )

static

Initialize exit_argv.

Returns

GNUNET_OK on success, GNUNET_SYSERR if we should shutdown

Definition at line 3814 of file gnunet-daemon-exit.c.

{
  char *exit_ifname;
  char *tun_ifname;
  char *ipv6addr;
  char *ipv6prefix_s;
  char *ipv4addr;
  char *ipv4mask;
 
  exit_argv[0] = GNUNET_strdup ("exit-gnunet");
  if (GNUNET_SYSERR ==
      GNUNET_CONFIGURATION_get_value_string (cfg,
                                             "exit",
                                             "TUN_IFNAME",
                                             &tun_ifname))
  {
    GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                               "EXIT",
                               "TUN_IFNAME");
    return GNUNET_SYSERR;
  }
  exit_argv[1] = tun_ifname;
  if (ipv4_enabled)
  {
    if (GNUNET_SYSERR ==
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "EXIT_IFNAME",
                                               &exit_ifname))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "EXIT_IFNAME");
      return GNUNET_SYSERR;
    }
    exit_argv[2] = exit_ifname;
  }
  else
  {
    exit_argv[2] = GNUNET_strdup ("-");
  }
 
  if (GNUNET_YES == ipv6_enabled)
  {
    ipv6addr = NULL;
    if (((GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg,
                                                 "exit",
                                                 "IPV6ADDR",
                                                 &ipv6addr)) ||
         (1 != inet_pton (AF_INET6,
                          ipv6addr,
                          &exit_ipv6addr))))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV6ADDR");
      GNUNET_free (ipv6addr);
      return GNUNET_SYSERR;
    }
    exit_argv[3] = ipv6addr;
    if (GNUNET_SYSERR ==
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "IPV6PREFIX",
                                               &ipv6prefix_s))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV6PREFIX");
      return GNUNET_SYSERR;
    }
    exit_argv[4] = ipv6prefix_s;
    if ((GNUNET_OK !=
         GNUNET_CONFIGURATION_get_value_number (cfg,
                                                "exit",
                                                "IPV6PREFIX",
                                                &ipv6prefix)) ||
        (ipv6prefix >= 127))
    {
      GNUNET_log_config_invalid (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV6PREFIX",
                                 _ ("Must be a number"));
      return GNUNET_SYSERR;
    }
  }
  else
  {
    /* IPv6 explicitly disabled */
    exit_argv[3] = GNUNET_strdup ("-");
    exit_argv[4] = GNUNET_strdup ("-");
  }
  if (GNUNET_YES == ipv4_enabled)
  {
    ipv4addr = NULL;
    if (((GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg,
                                                 "exit",
                                                 "IPV4ADDR",
                                                 &ipv4addr)) ||
         (1 != inet_pton (AF_INET,
                          ipv4addr,
                          &exit_ipv4addr))))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV4ADDR");
      GNUNET_free (ipv4addr);
      return GNUNET_SYSERR;
    }
    exit_argv[5] = ipv4addr;
    ipv4mask = NULL;
    if (((GNUNET_SYSERR ==
          GNUNET_CONFIGURATION_get_value_string (cfg,
                                                 "exit",
                                                 "IPV4MASK",
                                                 &ipv4mask)) ||
         (1 != inet_pton (AF_INET,
                          ipv4mask,
                          &exit_ipv4mask))))
    {
      GNUNET_log_config_missing (GNUNET_ERROR_TYPE_ERROR,
                                 "EXIT",
                                 "IPV4MASK");
      GNUNET_free (ipv4mask);
      return GNUNET_SYSERR;
    }
    exit_argv[6] = ipv4mask;
  }
  else
  {
    /* IPv4 explicitly disabled */
    exit_argv[5] = GNUNET_strdup ("-");
    exit_argv[6] = GNUNET_strdup ("-");
  }
  exit_argv[7] = NULL;
  return GNUNET_OK;
}

References _, cfg, exit_argv, exit_ipv4addr, exit_ipv4mask, exit_ipv6addr, GNUNET_CONFIGURATION_get_value_number(), GNUNET_CONFIGURATION_get_value_string(), GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_log_config_invalid(), GNUNET_log_config_missing(), GNUNET_OK, GNUNET_strdup, GNUNET_SYSERR, GNUNET_YES, ipv4_enabled, ipv6_enabled, and ipv6prefix.

Referenced by run().

Here is the call graph for this function:

Here is the caller graph for this function:

run()

static void run ( void *  cls, char *const *  args, const char *  cfgfile, const struct GNUNET_CONFIGURATION_Handle *  cfg_  )

static

Main function that will be run by the scheduler.

Parameters

cls	closure
args	remaining command-line arguments
cfgfile	name of the configuration file used (for saving, can be NULL!)
cfg_	configuration

Definition at line 3964 of file gnunet-daemon-exit.c.

{
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (icmp_remote,
                           GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_INTERNET,
                           struct GNUNET_EXIT_IcmpInternetMessage,
                           NULL),
    GNUNET_MQ_hd_var_size (udp_remote,
                           GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET,
                           struct GNUNET_EXIT_UdpInternetMessage,
                           NULL),
    GNUNET_MQ_hd_var_size (tcp_remote,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_TO_INTERNET_START,
                           struct GNUNET_EXIT_TcpInternetStartMessage,
                           NULL),
    GNUNET_MQ_hd_var_size (tcp_data,
                           GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT,
                           struct GNUNET_EXIT_TcpDataMessage,
                           NULL),
    GNUNET_MQ_handler_end ()
  };
  struct GNUNET_HashCode port;
  char *policy;
  char *binary;
  char *regex;
  char *prefixed_regex;
 
  cfg = cfg_;
  if (GNUNET_OK !=
      GNUNET_CONFIGURATION_get_value_number (cfg,
                                             "exit",
                                             "MAX_CONNECTIONS",
                                             &max_connections))
    max_connections = 1024;
  parse_ip_options ();
  binary = GNUNET_CONFIGURATION_get_suid_binary_path (
    GNUNET_OS_project_data_gnunet (),
    cfg,
    "gnunet-helper-exit");
  if ((ipv4_exit) || (ipv6_exit))
  {
    if (GNUNET_YES !=
        GNUNET_OS_check_helper_binary (binary,
                                       GNUNET_YES,
                                       "gnunet-vpn - - - 169.1.3.7 255.255.255.0"))
    // no nat, ipv4 only
    {
      GNUNET_free (binary);
      GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                  _ (
                    "`%s' is not SUID or the path is invalid, EXIT will not work\n"),
                  "gnunet-helper-exit");
      GNUNET_SCHEDULER_add_shutdown (&dummy_task,
                                     NULL);
      global_ret = 1;
      return;
    }
  }
  if (! (ipv4_enabled || ipv6_enabled))
  {
    GNUNET_free (binary);
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("No useful service enabled.  Exiting.\n"));
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
 
  GNUNET_SCHEDULER_add_shutdown (&cleanup,
                                 NULL);
  stats = GNUNET_STATISTICS_create ("exit",
                                    cfg);
  cadet_handle = GNUNET_CADET_connect (cfg);
  if (NULL == cadet_handle)
  {
    GNUNET_free (binary);
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
  advertise_dns_exit ();
  if (GNUNET_OK !=
      setup_exit_helper_args ())
  {
    GNUNET_free (binary);
    GNUNET_SCHEDULER_shutdown ();
    return;
  }
 
  services = GNUNET_CONTAINER_multihashmap_create (65536,
                                                   GNUNET_NO);
  connections_map = GNUNET_CONTAINER_multihashmap_create (65536,
                                                          GNUNET_NO);
  connections_heap = GNUNET_CONTAINER_heap_create (
    GNUNET_CONTAINER_HEAP_ORDER_MIN);
  GNUNET_CONFIGURATION_iterate_sections (cfg,
                                         &read_service_conf,
                                         NULL);
 
  /* Cadet handle acquired, now open ports and announce regular
     expressions matching our exit */
  if ((GNUNET_YES == ipv4_enabled) &&
      (GNUNET_YES == ipv4_exit))
  {
    GNUNET_CRYPTO_hash (GNUNET_APPLICATION_PORT_IPV4_GATEWAY,
                        strlen (GNUNET_APPLICATION_PORT_IPV4_GATEWAY),
                        &port);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Opening CADET port %s for IPv4 gateway service\n",
                GNUNET_h2s (&port));
    cadet_port4 = GNUNET_CADET_open_port (cadet_handle,
                                          &port,
                                          &new_channel,
                                          NULL,
                                          NULL,
                                          &clean_channel,
                                          handlers);
    policy = NULL;
    if (GNUNET_OK !=
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "EXIT_RANGE_IPV4_POLICY",
                                               &policy))
      regex = NULL;
    else
      regex = GNUNET_REGEX_ipv4policy2regex (policy);
    GNUNET_free (policy);
    if (NULL != regex)
    {
      (void) GNUNET_asprintf (&prefixed_regex,
                              "%s%s",
                              GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
                              regex);
      regex4 = GNUNET_REGEX_announce (cfg,
                                      prefixed_regex,
                                      REGEX_REFRESH_FREQUENCY,
                                      REGEX_MAX_PATH_LEN_IPV4);
      GNUNET_free (regex);
      GNUNET_free (prefixed_regex);
    }
  }
 
  if ((GNUNET_YES == ipv6_enabled) && (GNUNET_YES == ipv6_exit))
  {
    GNUNET_CRYPTO_hash (GNUNET_APPLICATION_PORT_IPV6_GATEWAY,
                        strlen (GNUNET_APPLICATION_PORT_IPV6_GATEWAY),
                        &port);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Opening CADET port %s for IPv6 gateway service\n",
                GNUNET_h2s (&port));
    cadet_port6 = GNUNET_CADET_open_port (cadet_handle,
                                          &port,
                                          &new_channel,
                                          NULL,
                                          NULL,
                                          &clean_channel,
                                          handlers);
    policy = NULL;
    if (GNUNET_OK !=
        GNUNET_CONFIGURATION_get_value_string (cfg,
                                               "exit",
                                               "EXIT_RANGE_IPV6_POLICY",
                                               &policy))
      regex = NULL;
    else
      regex = GNUNET_REGEX_ipv6policy2regex (policy);
    GNUNET_free (policy);
    if (NULL != regex)
    {
      (void) GNUNET_asprintf (&prefixed_regex,
                              "%s%s",
                              GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX,
                              regex);
      regex6 = GNUNET_REGEX_announce (cfg,
                                      prefixed_regex,
                                      REGEX_REFRESH_FREQUENCY,
                                      REGEX_MAX_PATH_LEN_IPV6);
      GNUNET_free (regex);
      GNUNET_free (prefixed_regex);
    }
  }
  helper_handle = GNUNET_HELPER_start (GNUNET_OS_project_data_gnunet (),
                                       GNUNET_NO,
                                       binary,
                                       exit_argv,
                                       &message_token,
                                       NULL,
                                       NULL);
  GNUNET_free (binary);
}

References _, advertise_dns_exit(), cadet_handle, cadet_port4, cadet_port6, cfg, clean_channel(), cleanup(), connections_heap, connections_map, dummy_task(), exit_argv, global_ret, GNUNET_APPLICATION_PORT_IPV4_GATEWAY, GNUNET_APPLICATION_PORT_IPV6_GATEWAY, GNUNET_APPLICATION_TYPE_EXIT_REGEX_PREFIX, GNUNET_asprintf(), GNUNET_CADET_connect(), GNUNET_CADET_open_port(), GNUNET_CONFIGURATION_get_suid_binary_path(), GNUNET_CONFIGURATION_get_value_number(), GNUNET_CONFIGURATION_get_value_string(), GNUNET_CONFIGURATION_iterate_sections(), GNUNET_CONTAINER_heap_create(), GNUNET_CONTAINER_HEAP_ORDER_MIN, GNUNET_CONTAINER_multihashmap_create(), GNUNET_CRYPTO_hash(), GNUNET_ERROR_TYPE_DEBUG, GNUNET_ERROR_TYPE_ERROR, GNUNET_free, GNUNET_h2s(), GNUNET_HELPER_start(), GNUNET_log, GNUNET_MESSAGE_TYPE_VPN_ICMP_TO_INTERNET, GNUNET_MESSAGE_TYPE_VPN_TCP_DATA_TO_EXIT, GNUNET_MESSAGE_TYPE_VPN_TCP_TO_INTERNET_START, GNUNET_MESSAGE_TYPE_VPN_UDP_TO_INTERNET, GNUNET_MQ_handler_end, GNUNET_MQ_hd_var_size, GNUNET_NO, GNUNET_OK, GNUNET_OS_check_helper_binary(), GNUNET_OS_project_data_gnunet(), GNUNET_REGEX_announce(), GNUNET_REGEX_ipv4policy2regex(), GNUNET_REGEX_ipv6policy2regex(), GNUNET_SCHEDULER_add_shutdown(), GNUNET_SCHEDULER_shutdown(), GNUNET_STATISTICS_create(), GNUNET_YES, handlers, helper_handle, ipv4_enabled, ipv4_exit, ipv6_enabled, ipv6_exit, max_connections, message_token(), new_channel(), parse_ip_options(), port, read_service_conf(), regex4, regex6, REGEX_MAX_PATH_LEN_IPV4, REGEX_MAX_PATH_LEN_IPV6, REGEX_REFRESH_FREQUENCY, services, setup_exit_helper_args(), and stats.

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

main()

int main	(	int	argc,
		char *const *	argv
	)

The main function.

Parameters

argc	number of arguments from the command line
argv	command line arguments

Returns

0 ok, 1 on error

Definition at line 4165 of file gnunet-daemon-exit.c.

{
  static const struct GNUNET_GETOPT_CommandLineOption options[] = {
    GNUNET_GETOPT_OPTION_END
  };
 
  return (GNUNET_OK ==
          GNUNET_PROGRAM_run (GNUNET_OS_project_data_gnunet (),
                              argc,
                              argv,
                              "gnunet-daemon-exit",
                              gettext_noop (
                                "Daemon to run to provide an IP exit node for the VPN"),
                              options,
                              &run,
                              NULL)) ? global_ret : 1;
}

References gettext_noop, global_ret, GNUNET_GETOPT_OPTION_END, GNUNET_OK, GNUNET_OS_project_data_gnunet(), GNUNET_PROGRAM_run(), options, and run().

Here is the call graph for this function:

Variable Documentation

global_ret

int global_ret

static

Return value from 'main'.

Definition at line 270 of file gnunet-daemon-exit.c.

Referenced by main(), and run().

regex4

struct GNUNET_REGEX_Announcement* regex4

static

Handle to our regex announcement for IPv4.

Definition at line 275 of file gnunet-daemon-exit.c.

Referenced by cleanup(), and run().

regex6

struct GNUNET_REGEX_Announcement* regex6

static

Handle to our regex announcement for IPv4.

Definition at line 280 of file gnunet-daemon-exit.c.

Referenced by cleanup(), and run().

cfg

const struct GNUNET_CONFIGURATION_Handle* cfg

static

The handle to the configuration used throughout the process.

Definition at line 285 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), parse_ip_options(), read_service_conf(), run(), and setup_exit_helper_args().

helper_handle

struct GNUNET_HELPER_Handle* helper_handle

static

The handle to the helper.

Definition at line 290 of file gnunet-daemon-exit.c.

Referenced by cleanup(), run(), send_icmp_packet_via_tun(), send_tcp_packet_via_tun(), and send_udp_packet_via_tun().

exit_argv

char* exit_argv[8]

static

Arguments to the exit helper.

Definition at line 295 of file gnunet-daemon-exit.c.

Referenced by add_services(), cleanup(), run(), and setup_exit_helper_args().

exit_ipv6addr

struct in6_addr exit_ipv6addr

static

IPv6 address of our TUN interface.

Definition at line 300 of file gnunet-daemon-exit.c.

Referenced by setup_exit_helper_args(), and setup_fresh_address().

ipv6prefix

unsigned long long ipv6prefix

static

IPv6 prefix (0..127) from configuration file.

Definition at line 305 of file gnunet-daemon-exit.c.

Referenced by run(), setup_exit_helper_args(), and setup_fresh_address().

exit_ipv4addr

struct in_addr exit_ipv4addr

static

IPv4 address of our TUN interface.

Definition at line 310 of file gnunet-daemon-exit.c.

Referenced by setup_exit_helper_args(), and setup_fresh_address().

exit_ipv4mask

struct in_addr exit_ipv4mask

static

IPv4 netmask of our TUN interface.

Definition at line 315 of file gnunet-daemon-exit.c.

Referenced by setup_exit_helper_args(), and setup_fresh_address().

stats

struct GNUNET_STATISTICS_Handle* stats

static

Statistics.

Definition at line 320 of file gnunet-daemon-exit.c.

Referenced by check_tcp_data(), cleanup(), handle_icmp_remote(), handle_icmp_service(), handle_tcp_data(), handle_tcp_remote(), handle_tcp_service(), handle_udp_remote(), handle_udp_service(), icmp_from_helper(), message_token(), new_channel(), new_service_channel(), run(), send_icmp_packet_via_tun(), send_packet_to_cadet_channel(), send_tcp_packet_via_tun(), and send_udp_packet_via_tun().

cadet_handle

struct GNUNET_CADET_Handle* cadet_handle

static

The handle to cadet.

Definition at line 325 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), cleanup(), run(), and store_service().

connections_map

struct GNUNET_CONTAINER_MultiHashMap* connections_map

static

This hashmaps contains the mapping from peer, service-descriptor, source-port and destination-port to a struct ChannelState.

Definition at line 331 of file gnunet-daemon-exit.c.

Referenced by clean_channel(), cleanup(), get_redirect_state(), run(), and setup_state_record().

connections_heap

struct GNUNET_CONTAINER_Heap* connections_heap

static

Heap so we can quickly find "old" connections.

Definition at line 336 of file gnunet-daemon-exit.c.

Referenced by cleanup(), run(), and setup_state_record().

max_connections

unsigned long long max_connections

static

If there are at least this many connections, old ones will be removed.

Definition at line 341 of file gnunet-daemon-exit.c.

Referenced by run(), and setup_state_record().

services

struct GNUNET_CONTAINER_MultiHashMap* services

static

This hashmaps saves interesting things about the configured services.

Definition at line 346 of file gnunet-daemon-exit.c.

Referenced by cleanup(), free_service_record(), GSC_SVCI_add(), GSC_SVCI_remove(), run(), and store_service().

channels

struct ChannelState* channels[UINT16_MAX+1]

static

Array of all open DNS requests from channels.

Definition at line 351 of file gnunet-daemon-exit.c.

Referenced by clean_channel(), handle_dns_request(), and process_dns_result().

dnsstub

struct GNUNET_DNSSTUB_Context* dnsstub

static

Handle to the DNS Stub resolver.

Definition at line 356 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), check_dns_request(), cleanup(), and handle_dns_request().

dht_put

struct GNUNET_DHT_PutHandle* dht_put

static

Handle for ongoing DHT PUT operations to advertise exit service.

Definition at line 361 of file gnunet-daemon-exit.c.

Referenced by cleanup(), dht_put_cont(), and do_dht_put().

dht

struct GNUNET_DHT_Handle* dht

static

Handle to the DHT.

Definition at line 366 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), cleanup(), do_dht_put(), GNS_resolver_init(), REGEX_INTERNAL_announce(), and REGEX_INTERNAL_search().

dht_task

struct GNUNET_SCHEDULER_Task* dht_task

static

Task for doing DHT PUTs to advertise exit service.

Definition at line 371 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), cleanup(), do_dht_put(), and do_initial_dht_put().

dns_advertisement

struct GNUNET_DNS_Advertisement dns_advertisement

static

Advertisement message we put into the DHT to advertise us as a DNS exit.

Definition at line 377 of file gnunet-daemon-exit.c.

Referenced by do_dht_put(), do_initial_dht_put(), and sign_dns_advertisement().

dht_put_key

struct GNUNET_HashCode dht_put_key

static

Key we store the DNS advertismenet under.

Definition at line 382 of file gnunet-daemon-exit.c.

Referenced by do_dht_put(), and do_initial_dht_put().

pils

struct GNUNET_PILS_Handle* pils

static

The pils service handle.

Definition at line 387 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), cleanup(), do_dht_put(), and do_initial_dht_put().

sign_op

struct GNUNET_PILS_Operation* sign_op

static

Operation for signing the dns advertisement.

Definition at line 392 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), cleanup(), do_dht_put(), do_initial_dht_put(), and sign_dns_advertisement().

dns_port

struct GNUNET_CADET_Port* dns_port

static

Port for DNS exit.

Definition at line 397 of file gnunet-daemon-exit.c.

Referenced by advertise_dns_exit(), and cleanup().

cadet_port4

struct GNUNET_CADET_Port* cadet_port4

static

Port for IPv4 exit.

Definition at line 402 of file gnunet-daemon-exit.c.

Referenced by cleanup(), and run().

cadet_port6

struct GNUNET_CADET_Port* cadet_port6

static

Port for IPv6 exit.

Definition at line 407 of file gnunet-daemon-exit.c.

Referenced by cleanup(), and run().

ipv4_exit

int ipv4_exit

static

Are we an IPv4-exit?

Definition at line 412 of file gnunet-daemon-exit.c.

Referenced by handle_icmp_remote(), handle_tcp_remote(), handle_udp_remote(), parse_ip_options(), and run().

ipv6_exit

int ipv6_exit

static

Are we an IPv6-exit?

Definition at line 417 of file gnunet-daemon-exit.c.

Referenced by handle_icmp_remote(), handle_tcp_remote(), handle_udp_remote(), parse_ip_options(), and run().

ipv4_enabled

int ipv4_enabled

static

Do we support IPv4 at all on the TUN interface?

Definition at line 422 of file gnunet-daemon-exit.c.

Referenced by add_services(), parse_ip_options(), run(), and setup_exit_helper_args().

ipv6_enabled

int ipv6_enabled

static

Do we support IPv6 at all on the TUN interface?

Definition at line 427 of file gnunet-daemon-exit.c.

Referenced by add_services(), parse_ip_options(), run(), and setup_exit_helper_args().