1321 lines
53 KiB
C
1321 lines
53 KiB
C
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <arpa/inet.h>
|
|
#include <unistd.h>
|
|
#include <netdb.h>
|
|
#include <signal.h>
|
|
#include <time.h>
|
|
#include <stdarg.h>
|
|
#include <fcntl.h>
|
|
#include <pthread.h>
|
|
#include <poll.h>
|
|
#include "wg-obfuscator.h"
|
|
#include "config.h"
|
|
#include "obfuscation.h"
|
|
#include "uthash.h"
|
|
#include "masking.h"
|
|
|
|
// Verbosity level
|
|
int verbose = LL_DEFAULT;
|
|
// Section name (for multiple instances)
|
|
char section_name[256] = DEFAULT_INSTANCE_NAME;
|
|
// Listening socket for receiving data from the clients
|
|
static int listen_sock = 0;
|
|
// Hash table for client connections
|
|
static client_entry_t *conn_table = NULL;
|
|
// PIDs of the other instances, filled by the parent process only
|
|
static pid_t *child_pids = NULL;
|
|
static int child_pids_count = 0;
|
|
// Set by the SIGHUP handler, the log file is reopened from the main loop
|
|
static volatile sig_atomic_t log_reopen_pending = 0;
|
|
|
|
// Hostname re-resolve: the blocking getaddrinfo() runs in a helper thread
|
|
#define RESOLVE_TAG_TARGET (-1)
|
|
typedef struct {
|
|
int32_t tag; // RESOLVE_TAG_TARGET or index into resolve_bindings
|
|
int32_t err; // getaddrinfo() error, 0 on success
|
|
uint32_t addr; // IPv4 address in network byte order
|
|
} resolve_result_t;
|
|
|
|
static int resolve_wake_rd = -1;
|
|
static int resolve_wake_wr = -1;
|
|
static int resolve_result_rd = -1;
|
|
static int resolve_result_wr = -1;
|
|
static char resolve_target_host[256];
|
|
static int resolve_target_is_name = 0;
|
|
static long resolve_interval_ms = 0;
|
|
static client_entry_t **resolve_bindings = NULL;
|
|
static int resolve_bindings_count = 0;
|
|
|
|
#ifdef USE_EPOLL
|
|
static int epfd = 0;
|
|
#endif
|
|
|
|
/**
|
|
* @brief Handles incoming signals for the application.
|
|
*
|
|
* This function is registered as a signal handler and is invoked when the process
|
|
* receives a signal. The specific actions taken depend on the signal received.
|
|
*
|
|
* @param signal The signal number received by the process.
|
|
*/
|
|
static void signal_handler(int signal) {
|
|
client_entry_t *current_entry, *tmp;
|
|
|
|
// Close all connections and clean up
|
|
if (listen_sock) {
|
|
close(listen_sock);
|
|
}
|
|
HASH_ITER(hh, conn_table, current_entry, tmp) {
|
|
if (current_entry->server_sock) {
|
|
close(current_entry->server_sock);
|
|
}
|
|
HASH_DEL(conn_table, current_entry);
|
|
free(current_entry);
|
|
}
|
|
#ifdef USE_EPOLL
|
|
if (epfd) {
|
|
close(epfd);
|
|
}
|
|
#endif
|
|
log(LL_INFO, "Stopped.");
|
|
exit(signal != -1 ? EXIT_SUCCESS : EXIT_FAILURE);
|
|
}
|
|
#define FAILURE() signal_handler(-1)
|
|
|
|
/**
|
|
* @brief Returns 1 if the string is a dotted IPv4 address, 0 otherwise.
|
|
*/
|
|
static int is_ipv4_literal(const char *host)
|
|
{
|
|
struct in_addr tmp;
|
|
return host && *host && inet_pton(AF_INET, host, &tmp) == 1;
|
|
}
|
|
|
|
/**
|
|
* @brief Resolves a hostname to an IPv4 address.
|
|
*
|
|
* @param host Hostname or IPv4 literal.
|
|
* @param out Filled with the first IPv4 address on success.
|
|
* @return 0 on success, a getaddrinfo() error code otherwise.
|
|
*/
|
|
static int resolve_hostname(const char *host, struct in_addr *out)
|
|
{
|
|
struct addrinfo hints = {
|
|
.ai_family = AF_INET,
|
|
.ai_socktype = SOCK_DGRAM,
|
|
};
|
|
struct addrinfo *addr = NULL;
|
|
int err = getaddrinfo(host, NULL, &hints, &addr);
|
|
if (err != 0 || addr == NULL) {
|
|
if (addr) {
|
|
freeaddrinfo(addr);
|
|
}
|
|
return err ? err : EAI_NONAME;
|
|
}
|
|
*out = ((struct sockaddr_in *)addr->ai_addr)->sin_addr;
|
|
freeaddrinfo(addr);
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* @brief Resolves a hostname at startup.
|
|
*
|
|
* On failure: if interval_ms is 0, returns the error immediately. Otherwise
|
|
* retries every interval_ms until the name resolves, so the daemon can start
|
|
* before the network or DNS is up. Sleep is interruptible by SIGINT/SIGTERM.
|
|
*
|
|
* @param host Hostname or IPv4 literal.
|
|
* @param out Filled with the first IPv4 address on success.
|
|
* @param interval_ms Retry interval in milliseconds, 0 to fail immediately.
|
|
* @param what Short label for the log, e.g. "target" or "static binding".
|
|
* @return 0 on success, a getaddrinfo() error code if interval_ms is 0 and resolve failed.
|
|
*/
|
|
static int resolve_hostname_startup(const char *host, struct in_addr *out, long interval_ms, const char *what)
|
|
{
|
|
while (1) {
|
|
int err = resolve_hostname(host, out);
|
|
if (err == 0) {
|
|
return 0;
|
|
}
|
|
if (interval_ms <= 0) {
|
|
return err;
|
|
}
|
|
log(LL_WARN, "Can't resolve %s hostname '%s': %s, retrying in %ld seconds",
|
|
what, host, gai_strerror(err), interval_ms / 1000);
|
|
struct timespec ts = {
|
|
.tv_sec = interval_ms / 1000,
|
|
.tv_nsec = (interval_ms % 1000) * 1000000L,
|
|
};
|
|
while (nanosleep(&ts, &ts) < 0 && errno == EINTR) {
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @brief Sends one resolve result to the main thread. The write is at most
|
|
* PIPE_BUF bytes, so it is atomic and cannot interleave with another result.
|
|
*/
|
|
static void resolve_send_result(int32_t tag, int32_t err, uint32_t addr)
|
|
{
|
|
resolve_result_t r = { .tag = tag, .err = err, .addr = addr };
|
|
const char *p = (const char *)&r;
|
|
size_t left = sizeof(r);
|
|
while (left) {
|
|
ssize_t n = write(resolve_result_wr, p, left);
|
|
if (n < 0) {
|
|
if (errno == EINTR) {
|
|
continue;
|
|
}
|
|
return;
|
|
}
|
|
p += n;
|
|
left -= (size_t)n;
|
|
}
|
|
}
|
|
|
|
static void resolve_one(int32_t tag, const char *host)
|
|
{
|
|
struct in_addr addr;
|
|
int err = resolve_hostname(host, &addr);
|
|
resolve_send_result(tag, err, err ? 0 : addr.s_addr);
|
|
}
|
|
|
|
/**
|
|
* @brief Resolver thread: waits for SIGHUP (wake pipe) or the refresh interval,
|
|
* then re-resolves every non-literal hostname. Never calls log().
|
|
*/
|
|
static void *resolve_thread_fn(void *arg)
|
|
{
|
|
(void)arg;
|
|
struct pollfd pfd = { .fd = resolve_wake_rd, .events = POLLIN };
|
|
while (1) {
|
|
int timeout = resolve_interval_ms > 0 ? (int)resolve_interval_ms : -1;
|
|
int ret = poll(&pfd, 1, timeout);
|
|
if (ret < 0) {
|
|
if (errno == EINTR) {
|
|
continue;
|
|
}
|
|
continue;
|
|
}
|
|
if (ret > 0 && (pfd.revents & POLLIN)) {
|
|
char buf[64];
|
|
while (read(resolve_wake_rd, buf, sizeof(buf)) > 0) {
|
|
}
|
|
}
|
|
if (resolve_target_is_name) {
|
|
resolve_one(RESOLVE_TAG_TARGET, resolve_target_host);
|
|
}
|
|
for (int i = 0; i < resolve_bindings_count; i++) {
|
|
if (resolve_bindings[i] && resolve_bindings[i]->bind_host[0]) {
|
|
resolve_one(i, resolve_bindings[i]->bind_host);
|
|
}
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* @brief Wakes the resolver thread. Safe to call from a signal handler.
|
|
*/
|
|
static void resolve_wake(void)
|
|
{
|
|
char c = 1;
|
|
if (resolve_wake_wr < 0) {
|
|
return;
|
|
}
|
|
if (write(resolve_wake_wr, &c, 1) < 0 && errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR) {
|
|
// Nothing useful can be done from a signal handler
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @brief Applies one re-resolve result on the main thread.
|
|
*/
|
|
static void apply_resolve_result(const resolve_result_t *r, struct sockaddr_in *forward_addr)
|
|
{
|
|
if (r->err != 0) {
|
|
const char *name = "?";
|
|
if (r->tag == RESOLVE_TAG_TARGET) {
|
|
name = resolve_target_host;
|
|
} else if (r->tag >= 0 && r->tag < resolve_bindings_count && resolve_bindings[r->tag]) {
|
|
name = resolve_bindings[r->tag]->bind_host;
|
|
}
|
|
log(LL_WARN, "Can't re-resolve hostname '%s': %s", name, gai_strerror(r->err));
|
|
return;
|
|
}
|
|
|
|
if (r->tag == RESOLVE_TAG_TARGET) {
|
|
if (forward_addr->sin_addr.s_addr == r->addr) {
|
|
return;
|
|
}
|
|
char old_ip[INET_ADDRSTRLEN], new_ip[INET_ADDRSTRLEN];
|
|
inet_ntop(AF_INET, &forward_addr->sin_addr, old_ip, sizeof(old_ip));
|
|
forward_addr->sin_addr.s_addr = r->addr;
|
|
inet_ntop(AF_INET, &forward_addr->sin_addr, new_ip, sizeof(new_ip));
|
|
log(LL_INFO, "Target address changed: %s -> %s", old_ip, new_ip);
|
|
|
|
client_entry_t *e, *tmp;
|
|
HASH_ITER(hh, conn_table, e, tmp) {
|
|
if (connect(e->server_sock, (struct sockaddr *)forward_addr, sizeof(*forward_addr)) < 0) {
|
|
serror_level(LL_WARN, "Failed to update target address for client %s:%d",
|
|
inet_ntoa(e->client_addr.sin_addr), ntohs(e->client_addr.sin_port));
|
|
}
|
|
}
|
|
return;
|
|
}
|
|
|
|
if (r->tag < 0 || r->tag >= resolve_bindings_count) {
|
|
return;
|
|
}
|
|
client_entry_t *entry = resolve_bindings[r->tag];
|
|
if (!entry || !entry->is_static) {
|
|
return;
|
|
}
|
|
if (entry->client_addr.sin_addr.s_addr == r->addr) {
|
|
return;
|
|
}
|
|
|
|
struct sockaddr_in new_addr = entry->client_addr;
|
|
new_addr.sin_addr.s_addr = r->addr;
|
|
|
|
client_entry_t *collision = NULL;
|
|
HASH_FIND(hh, conn_table, &new_addr, sizeof(new_addr), collision);
|
|
if (collision && collision != entry) {
|
|
log(LL_WARN, "Static binding '%s' re-resolved to %s:%d, but that address is already in use",
|
|
entry->bind_host, inet_ntoa(new_addr.sin_addr), ntohs(new_addr.sin_port));
|
|
return;
|
|
}
|
|
|
|
char old_ip[INET_ADDRSTRLEN], new_ip[INET_ADDRSTRLEN];
|
|
inet_ntop(AF_INET, &entry->client_addr.sin_addr, old_ip, sizeof(old_ip));
|
|
inet_ntop(AF_INET, &new_addr.sin_addr, new_ip, sizeof(new_ip));
|
|
|
|
HASH_DEL(conn_table, entry);
|
|
entry->client_addr.sin_addr.s_addr = r->addr;
|
|
HASH_ADD(hh, conn_table, client_addr, sizeof(entry->client_addr), entry);
|
|
log(LL_INFO, "Static binding '%s' address changed: %s -> %s", entry->bind_host, old_ip, new_ip);
|
|
}
|
|
|
|
/**
|
|
* @brief Reads every queued re-resolve result. Each write is atomic, so one
|
|
* read of sizeof(resolve_result_t) is one message.
|
|
*/
|
|
static void drain_resolve_results(struct sockaddr_in *forward_addr)
|
|
{
|
|
resolve_result_t r;
|
|
while (1) {
|
|
ssize_t n = read(resolve_result_rd, &r, sizeof(r));
|
|
if (n < 0) {
|
|
if (errno == EINTR) {
|
|
continue;
|
|
}
|
|
if (errno == EAGAIN || errno == EWOULDBLOCK) {
|
|
break;
|
|
}
|
|
serror_level(LL_WARN, "Failed to read hostname re-resolve result");
|
|
break;
|
|
}
|
|
if (n == 0) {
|
|
break;
|
|
}
|
|
if (n != (ssize_t)sizeof(r)) {
|
|
log(LL_WARN, "Short read from hostname resolver (%zd bytes)", n);
|
|
break;
|
|
}
|
|
apply_resolve_result(&r, forward_addr);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @brief Starts the resolver thread if there is at least one hostname to refresh.
|
|
*/
|
|
static void resolve_start_thread(void)
|
|
{
|
|
int wake[2], result[2];
|
|
pthread_t thread;
|
|
|
|
if (!resolve_target_is_name && resolve_bindings_count == 0) {
|
|
return;
|
|
}
|
|
|
|
if (pipe(wake) < 0 || pipe(result) < 0) {
|
|
log(LL_WARN, "Can't create pipes for hostname re-resolve, periodic refresh disabled");
|
|
return;
|
|
}
|
|
resolve_wake_rd = wake[0];
|
|
resolve_wake_wr = wake[1];
|
|
resolve_result_rd = result[0];
|
|
resolve_result_wr = result[1];
|
|
|
|
fcntl(resolve_wake_rd, F_SETFL, O_NONBLOCK);
|
|
fcntl(resolve_wake_wr, F_SETFL, O_NONBLOCK);
|
|
fcntl(resolve_result_rd, F_SETFL, O_NONBLOCK);
|
|
|
|
if (pthread_create(&thread, NULL, resolve_thread_fn, NULL) != 0) {
|
|
log(LL_WARN, "Can't start hostname resolver thread, periodic refresh disabled");
|
|
close(resolve_wake_rd);
|
|
close(resolve_wake_wr);
|
|
close(resolve_result_rd);
|
|
close(resolve_result_wr);
|
|
resolve_wake_rd = resolve_wake_wr = resolve_result_rd = resolve_result_wr = -1;
|
|
return;
|
|
}
|
|
pthread_detach(thread);
|
|
|
|
if (resolve_interval_ms > 0) {
|
|
log(LL_INFO, "Re-resolving hostnames every %ld seconds (and on SIGHUP)", resolve_interval_ms / 1000);
|
|
} else {
|
|
log(LL_INFO, "Re-resolving hostnames on SIGHUP");
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @brief Remembers the PID of a forked instance.
|
|
*
|
|
* Called by the configuration parser for every additional section, so that the
|
|
* parent process can forward signals to all the instances.
|
|
*
|
|
* @param pid PID of the forked instance.
|
|
*/
|
|
void register_child_instance(pid_t pid)
|
|
{
|
|
pid_t *new_pids = realloc(child_pids, (child_pids_count + 1) * sizeof(pid_t));
|
|
if (!new_pids) {
|
|
log(LL_WARN, "Out of memory, instance with PID %ld will not receive forwarded signals", (long)pid);
|
|
return;
|
|
}
|
|
child_pids = new_pids;
|
|
child_pids[child_pids_count++] = pid;
|
|
}
|
|
|
|
#ifdef SIGHUP
|
|
/**
|
|
* @brief Handles SIGHUP: schedules reopening of the log file.
|
|
*
|
|
* The actual reopening is done by the main loop, the handler only sets a flag
|
|
* and forwards the signal to the instances of the other configuration sections.
|
|
*
|
|
* @param sig Signal number received by the process.
|
|
*/
|
|
static void sighup_handler(int sig)
|
|
{
|
|
(void)sig;
|
|
log_reopen_pending = 1;
|
|
resolve_wake();
|
|
// The list is filled before the handler is installed, so it can't change here
|
|
for (int i = 0; i < child_pids_count; i++) {
|
|
kill(child_pids[i], SIGHUP);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/**
|
|
* @brief Creates a new client_entry_t structure and initializes it with the provided client and forward addresses.
|
|
*
|
|
* @param config Pointer to the obfuscator configuration structure.
|
|
* @param client_addr Pointer to a struct sockaddr_in representing the client's address.
|
|
* @param forward_addr Pointer to a struct sockaddr_in representing the address to which traffic should be forwarded.
|
|
* @return Pointer to the newly created client_entry_t structure, or NULL on failure.
|
|
*/
|
|
static client_entry_t * new_client_entry(obfuscator_config_t *config, struct sockaddr_in *client_addr, struct sockaddr_in *forward_addr) {
|
|
if (HASH_COUNT(conn_table) >= config->max_clients) {
|
|
log(LL_ERROR, "Maximum number of clients reached (%d), cannot add new client", config->max_clients);
|
|
return NULL;
|
|
}
|
|
client_entry_t * client_entry = malloc(sizeof(client_entry_t));
|
|
if (!client_entry) {
|
|
log(LL_ERROR, "Failed to allocate memory for client entry");
|
|
return NULL;
|
|
}
|
|
memset(client_entry, 0, sizeof(client_entry_t));
|
|
// Set default version (latest)
|
|
client_entry->version = OBFUSCATION_VERSION;
|
|
// Set the client address
|
|
memcpy(&client_entry->client_addr, client_addr, sizeof(client_entry->client_addr));
|
|
// Create a socket for the server connection
|
|
client_entry->server_sock = socket(AF_INET, SOCK_DGRAM, 0);
|
|
// TODO: add client address to log
|
|
if (client_entry->server_sock < 0) {
|
|
serror("Failed to create server socket for client");
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
#ifdef __linux__
|
|
// Set "Don't Fragment" flag
|
|
int optval = 1;
|
|
if (setsockopt(client_entry->server_sock, IPPROTO_IP, IP_MTU_DISCOVER, &optval, sizeof(optval)) < 0) {
|
|
serror("Failed to set 'don't fragment' flag for client");
|
|
close(client_entry->server_sock);
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
if (config->fwmark) {
|
|
if (setsockopt(client_entry->server_sock, SOL_SOCKET, SO_MARK, &config->fwmark, sizeof(config->fwmark)) < 0) {
|
|
log(LL_WARN, "Failed to set 'firewall mark' for client: %s", strerror(errno));
|
|
}
|
|
}
|
|
#endif
|
|
// Set the server address to the specified one
|
|
connect(client_entry->server_sock, (struct sockaddr *)forward_addr, sizeof(*forward_addr));
|
|
// Get the assigned port number
|
|
socklen_t our_addr_len = sizeof(client_entry->our_addr);
|
|
if (getsockname(client_entry->server_sock, (struct sockaddr *)&client_entry->our_addr, &our_addr_len) == -1) {
|
|
serror("Failed to get socket port number");
|
|
close(client_entry->server_sock);
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
|
|
#ifdef USE_EPOLL
|
|
struct epoll_event e = {
|
|
.events = EPOLLIN,
|
|
.data.ptr = client_entry
|
|
};
|
|
if (epoll_ctl(epfd, EPOLL_CTL_ADD, client_entry->server_sock, &e) != 0) {
|
|
serror("epoll_ctl for client socket");
|
|
close(client_entry->server_sock);
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
#endif
|
|
|
|
HASH_ADD(hh, conn_table, client_addr, sizeof(*client_addr), client_entry);
|
|
|
|
log(LL_DEBUG, "Added binding: %s:%d:%d",
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port),
|
|
ntohs(client_entry->our_addr.sin_port));
|
|
|
|
return client_entry;
|
|
}
|
|
|
|
/**
|
|
* @brief Creates a new static client entry.
|
|
*
|
|
* This function allocates and initializes a new client_entry_t structure
|
|
* using the provided client and forward addresses, as well as the specified local port.
|
|
*
|
|
* @param config Pointer to the obfuscator configuration structure.
|
|
* @param client_addr Pointer to a sockaddr_in structure representing the client's address.
|
|
* @param forward_addr Pointer to a sockaddr_in structure representing the address to forward to.
|
|
* @param local_port The local port number to connect to the server.
|
|
* @param bind_host Original hostname from the configuration, stored if it is not an IPv4 literal.
|
|
* @return Pointer to the newly created client_entry_t structure, or NULL on failure.
|
|
*/
|
|
static client_entry_t * new_client_entry_static(obfuscator_config_t *config, struct sockaddr_in *client_addr, struct sockaddr_in *forward_addr, uint16_t local_port, const char *bind_host) {
|
|
if (HASH_COUNT(conn_table) >= config->max_clients) {
|
|
log(LL_ERROR, "Maximum number of clients reached (%d), cannot add new client", config->max_clients);
|
|
return NULL;
|
|
}
|
|
|
|
// Check if such client already exists
|
|
client_entry_t *existing_entry;
|
|
HASH_FIND(hh, conn_table, client_addr, sizeof(*client_addr), existing_entry);
|
|
if (existing_entry) {
|
|
log(LL_ERROR, "Binding with client %s:%d already exists",
|
|
inet_ntoa(client_addr->sin_addr), ntohs(client_addr->sin_port));
|
|
return NULL;
|
|
}
|
|
|
|
client_entry_t * client_entry = malloc(sizeof(client_entry_t));
|
|
if (!client_entry) {
|
|
log(LL_ERROR, "Failed to allocate memory for client entry");
|
|
return NULL;
|
|
}
|
|
memset(client_entry, 0, sizeof(client_entry_t));
|
|
// Set default version (latest)
|
|
client_entry->version = OBFUSCATION_VERSION;
|
|
// default masking type
|
|
client_entry->masking_handler = config->masking_handler;
|
|
// Set the client address
|
|
memcpy(&client_entry->client_addr, client_addr, sizeof(client_entry->client_addr));
|
|
// Create a socket for the server connection
|
|
client_entry->server_sock = socket(AF_INET, SOCK_DGRAM, 0);
|
|
if (client_entry->server_sock < 0) {
|
|
serror("Failed to create server socket for client");
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
// Bind the socket to the specified local port
|
|
client_entry->our_addr.sin_family = AF_INET;
|
|
// TODO: ability to bind to a specific address
|
|
client_entry->our_addr.sin_addr.s_addr = INADDR_ANY;
|
|
client_entry->our_addr.sin_port = htons(local_port);
|
|
// Set the local port number
|
|
if (bind(client_entry->server_sock, (struct sockaddr *)&client_entry->our_addr, sizeof(client_entry->our_addr)) < 0) {
|
|
serror("Failed to bind server socket to %s:%d",
|
|
inet_ntoa(client_entry->our_addr.sin_addr), local_port);
|
|
close(client_entry->server_sock);
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
#ifdef __linux__
|
|
// Set "Don't Fragment" flag
|
|
int optval = 1;
|
|
if (setsockopt(client_entry->server_sock, IPPROTO_IP, IP_MTU_DISCOVER, &optval, sizeof(optval)) < 0) {
|
|
serror("Failed to set 'don't fragment' flag for client %s:%d",
|
|
inet_ntoa(client_entry->client_addr.sin_addr), local_port);
|
|
close(client_entry->server_sock);
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
if (config->fwmark) {
|
|
if (setsockopt(client_entry->server_sock, SOL_SOCKET, SO_MARK, &config->fwmark, sizeof(config->fwmark)) < 0) {
|
|
log(LL_WARN, "Failed to set 'firewall mark' for client %s:%d: %s",
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port), strerror(errno));
|
|
}
|
|
}
|
|
|
|
#endif
|
|
// Set the server address to the specified one
|
|
connect(client_entry->server_sock, (struct sockaddr *)forward_addr, sizeof(*forward_addr));
|
|
|
|
#ifdef USE_EPOLL
|
|
struct epoll_event e = {
|
|
.events = EPOLLIN,
|
|
.data.ptr = client_entry
|
|
};
|
|
if (epoll_ctl(epfd, EPOLL_CTL_ADD, client_entry->server_sock, &e) != 0) {
|
|
serror("epoll_ctl for client socket");
|
|
close(client_entry->server_sock);
|
|
free(client_entry);
|
|
return NULL;
|
|
}
|
|
#endif
|
|
|
|
client_entry->is_static = 1;
|
|
if (bind_host && !is_ipv4_literal(bind_host)) {
|
|
strncpy(client_entry->bind_host, bind_host, sizeof(client_entry->bind_host) - 1);
|
|
}
|
|
|
|
HASH_ADD(hh, conn_table, client_addr, sizeof(*client_addr), client_entry);
|
|
|
|
return client_entry;
|
|
}
|
|
|
|
#ifndef USE_EPOLL
|
|
static client_entry_t *find_by_server_sock(int fd) {
|
|
client_entry_t *e, *tmp;
|
|
HASH_ITER(hh, conn_table, e, tmp) {
|
|
if (e->server_sock == fd) return e;
|
|
}
|
|
return NULL;
|
|
}
|
|
#endif
|
|
|
|
/**
|
|
* @brief Prints the version information of the program.
|
|
*
|
|
* This function outputs the current version of the application to the standard output.
|
|
* Typically used to inform users about the build or release version.
|
|
*/
|
|
const char *version_string(void) {
|
|
#ifdef COMMIT
|
|
#ifndef ARCH
|
|
return "WireGuard Obfuscator (commit " COMMIT " @ " WG_OBFUSCATOR_GIT_REPO ")";
|
|
#else
|
|
return "WireGuard Obfuscator (commit " COMMIT " @ " WG_OBFUSCATOR_GIT_REPO ") (" ARCH ")";
|
|
#endif
|
|
#else
|
|
#ifndef ARCH
|
|
return "WireGuard Obfuscator v" WG_OBFUSCATOR_VERSION;
|
|
#else
|
|
return "WireGuard Obfuscator v" WG_OBFUSCATOR_VERSION " (" ARCH ")";
|
|
#endif
|
|
#endif
|
|
}
|
|
|
|
void print_version(void) {
|
|
fprintf(stderr, "Starting %s\n", version_string());
|
|
}
|
|
|
|
int main(int argc, char *argv[]) {
|
|
obfuscator_config_t config = {0};
|
|
struct sockaddr_in
|
|
listen_addr, // Address for listening socket, for receiving data from the client
|
|
forward_addr; // Address for forwarding socket, for sending data to the server
|
|
uint8_t full_buffer[BUFFER_SIZE + PREBUFFER_SIZE];
|
|
char target_host[256] = {0};
|
|
int target_port = -1;
|
|
int key_length = 0;
|
|
in_addr_t s_listen_addr_client = INADDR_ANY;
|
|
long now, last_cleanup_time = 0;
|
|
struct addrinfo *addr;
|
|
int err;
|
|
struct addrinfo hints = { // for getaddrinfo
|
|
.ai_family = AF_INET, // IPv4
|
|
.ai_socktype = SOCK_DGRAM, // UDP
|
|
};
|
|
|
|
print_version();
|
|
|
|
if (parse_config(argc, argv, &config) != 0) {
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
/* Start writing to the log file before validating the rest of the parameters,
|
|
so that configuration errors are logged there too */
|
|
log_init(config.log_file_set ? config.log_file : NULL, config.log_timestamps);
|
|
|
|
#ifdef USE_EPOLL
|
|
struct epoll_event events[MAX_EVENTS];
|
|
#else
|
|
struct pollfd pollfds[config.max_clients + 2];
|
|
#endif
|
|
|
|
/* Check the parameters */
|
|
// Check the listening port
|
|
if (!config.listen_port_set) {
|
|
log(LL_ERROR, "'source-lport' is not set in the configuration file");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
// Check the key
|
|
key_length = strlen(config.xor_key);
|
|
if (!config.xor_key_set || key_length == 0) {
|
|
log(LL_ERROR, "'key' is not set in the configuration file");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
// Check the target host and port
|
|
if (!config.forward_host_port_set) {
|
|
log(LL_ERROR, "'target' is not set");
|
|
exit(EXIT_FAILURE);
|
|
} else {
|
|
char *port_delimiter = strchr(config.forward_host_port, ':');
|
|
if (port_delimiter == NULL) {
|
|
log(LL_ERROR, "Invalid target host:port format: %s", config.forward_host_port);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
*port_delimiter = 0;
|
|
strncpy(target_host, config.forward_host_port, sizeof(target_host) - 1);
|
|
target_host[sizeof(target_host) - 1] = 0; // Ensure null-termination
|
|
target_port = atoi(port_delimiter + 1);
|
|
if (target_port <= 0) {
|
|
log(LL_ERROR, "Invalid target port: %s", port_delimiter + 1);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
}
|
|
|
|
// 'allow-clean' is incompatible with static bindings: for a static binding
|
|
// there is no way to know in advance whether the client's traffic must be obfuscated
|
|
if (config.allow_clean && config.static_bindings_set) {
|
|
log(LL_ERROR, "'allow-clean' cannot be used together with 'static-bindings'");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
// Check the client interface
|
|
if (config.client_interface_set) {
|
|
s_listen_addr_client = inet_addr(config.client_interface);
|
|
if (s_listen_addr_client == INADDR_NONE) {
|
|
err = getaddrinfo(config.client_interface, NULL, &hints, &addr);
|
|
if (err != 0 || addr == NULL) {
|
|
log(LL_ERROR, "Invalid source interface '%s': %s", config.client_interface, gai_strerror(err));
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
s_listen_addr_client = ((struct sockaddr_in *)addr->ai_addr)->sin_addr.s_addr;
|
|
freeaddrinfo(addr);
|
|
}
|
|
}
|
|
|
|
/* Set up signal handlers */
|
|
signal(SIGINT, signal_handler);
|
|
signal(SIGTERM, signal_handler);
|
|
#ifdef SIGHUP
|
|
signal(SIGHUP, sighup_handler);
|
|
#endif
|
|
|
|
/* Create listening socket */
|
|
if ((listen_sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
|
|
serror("Can't create source socket to listen");
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
#ifdef __linux__
|
|
/* Set "Don't Fragment" flag */
|
|
int optval = 1;
|
|
if (setsockopt(listen_sock, IPPROTO_IP, IP_MTU_DISCOVER, &optval, sizeof(optval)) < 0) {
|
|
serror("Failed to set 'don't fragment' flag for listening socket");
|
|
FAILURE();
|
|
}
|
|
if (config.fwmark) {
|
|
if (setsockopt(listen_sock, SOL_SOCKET, SO_MARK, &config.fwmark, sizeof(config.fwmark)) < 0) {
|
|
log(LL_WARN, "Failed to set 'firewall mark' for listening socket: %s", strerror(errno));
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* Bind the listening socket to the specified address and port */
|
|
memset(&listen_addr, 0, sizeof(listen_addr));
|
|
listen_addr.sin_family = AF_INET;
|
|
listen_addr.sin_addr.s_addr = s_listen_addr_client;
|
|
listen_addr.sin_port = htons(config.listen_port);
|
|
if (bind(listen_sock, (struct sockaddr *)&listen_addr, sizeof(listen_addr)) < 0) {
|
|
serror("Failed to bind source socket to %s:%d",
|
|
inet_ntoa(listen_addr.sin_addr), ntohs(listen_addr.sin_port));
|
|
FAILURE();
|
|
}
|
|
log(LL_INFO, "Listening on port %s:%d for source", inet_ntoa(listen_addr.sin_addr), ntohs(listen_addr.sin_port));
|
|
|
|
if (config.masking_handler_set) {
|
|
log(LL_INFO, "Using masking type: %s", config.masking_handler ? config.masking_handler->name : "none");
|
|
}
|
|
|
|
if (config.allow_clean) {
|
|
log(LL_INFO, "Non-obfuscated (clean) clients are allowed, their traffic will be forwarded as is");
|
|
}
|
|
|
|
/* Use epoll for events if enabled */
|
|
#ifdef USE_EPOLL
|
|
epfd = epoll_create1(0);
|
|
if (epfd < 0) {
|
|
serror("epoll_create1");
|
|
FAILURE();
|
|
}
|
|
{
|
|
struct epoll_event ev = {
|
|
.events = EPOLLIN,
|
|
.data.fd = listen_sock
|
|
};
|
|
if (epoll_ctl(epfd, EPOLL_CTL_ADD, listen_sock, &ev) != 0) {
|
|
serror("epoll_ctl for listen_sock");
|
|
FAILURE();
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* Set up forward address */
|
|
memset(&forward_addr, 0, sizeof(forward_addr));
|
|
forward_addr.sin_family = AF_INET;
|
|
resolve_interval_ms = config.resolve_interval;
|
|
err = resolve_hostname_startup(target_host, &forward_addr.sin_addr, resolve_interval_ms, "target");
|
|
if (err != 0) {
|
|
log(LL_ERROR, "Can't resolve hostname '%s': %s", target_host, gai_strerror(err));
|
|
FAILURE();
|
|
}
|
|
log(LL_DEBUG, "Resolved target hostname '%s' to %s", target_host, inet_ntoa(forward_addr.sin_addr));
|
|
if (target_port > 65535) {
|
|
log(LL_ERROR, "Invalid target port: %d", target_port);
|
|
FAILURE();
|
|
}
|
|
forward_addr.sin_port = htons(target_port);
|
|
log(LL_INFO, "Target: %s:%d", target_host, target_port);
|
|
strncpy(resolve_target_host, target_host, sizeof(resolve_target_host) - 1);
|
|
resolve_target_is_name = !is_ipv4_literal(target_host);
|
|
|
|
/* Add static bindings if provided */
|
|
if (config.static_bindings) {
|
|
// Parse static bindings
|
|
char *binding = strtok(config.static_bindings, ",");
|
|
while (binding) {
|
|
// Trim leading and trailing spaces
|
|
binding = trim(binding);
|
|
char *colon1 = strchr(binding, ':');
|
|
if (!colon1) {
|
|
log(LL_ERROR, "Invalid static binding format: %s", binding);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
char *colon2 = strchr(colon1 + 1, ':');
|
|
if (!colon2) {
|
|
log(LL_ERROR, "Invalid static binding format: %s", binding);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
*colon1 = 0;
|
|
*colon2 = 0;
|
|
|
|
struct sockaddr_in client_addr = {0};
|
|
client_addr.sin_family = AF_INET;
|
|
err = resolve_hostname_startup(binding, &client_addr.sin_addr, resolve_interval_ms, "static binding");
|
|
if (err != 0) {
|
|
log(LL_ERROR, "Can't resolve hostname '%s' for static binding '%s:%s:%s': %s",
|
|
binding, binding, colon1 + 1, colon2 + 1, gai_strerror(err));
|
|
FAILURE();
|
|
}
|
|
log(LL_DEBUG, "Resolved static binding hostname '%s' to %s", binding, inet_ntoa(client_addr.sin_addr));
|
|
int remote_port = atoi(colon1 + 1);
|
|
if (remote_port <= 0 || remote_port > 65535) {
|
|
log(LL_ERROR, "Invalid port '%s' for static binding '%s:%s:%s'",
|
|
colon1 + 1, binding, colon1 + 1, colon2 + 1);
|
|
FAILURE();
|
|
}
|
|
int local_port = atoi(colon2 + 1);
|
|
if (local_port <= 0 || local_port > 65535) {
|
|
log(LL_ERROR, "Invalid port '%s' for static binding '%s:%s:%s'",
|
|
colon2 + 1, binding, colon1 + 1, colon2 + 1);
|
|
FAILURE();
|
|
}
|
|
client_addr.sin_port = htons(remote_port);
|
|
|
|
if (!new_client_entry_static(&config, &client_addr, &forward_addr, local_port, binding)) {
|
|
log(LL_ERROR, "Failed to create static binding: %s:%s:%s",
|
|
binding, colon1 + 1, colon2 + 1);
|
|
FAILURE();
|
|
}
|
|
|
|
log(LL_INFO, "Added static binding: %s:%d <-> %d:obfuscator:%d <-> %s:%d",
|
|
binding, remote_port, config.listen_port,
|
|
local_port, target_host, target_port);
|
|
|
|
binding = strtok(NULL, ",");
|
|
}
|
|
free(config.static_bindings);
|
|
config.static_bindings = NULL;
|
|
}
|
|
|
|
{
|
|
client_entry_t *e, *tmp;
|
|
int n = 0;
|
|
HASH_ITER(hh, conn_table, e, tmp) {
|
|
if (e->is_static && e->bind_host[0]) {
|
|
n++;
|
|
}
|
|
}
|
|
if (n > 0) {
|
|
resolve_bindings = calloc((size_t)n, sizeof(*resolve_bindings));
|
|
if (!resolve_bindings) {
|
|
log(LL_WARN, "Out of memory, static binding hostnames will not be re-resolved");
|
|
} else {
|
|
HASH_ITER(hh, conn_table, e, tmp) {
|
|
if (e->is_static && e->bind_host[0]) {
|
|
resolve_bindings[resolve_bindings_count++] = e;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
resolve_start_thread();
|
|
#ifdef USE_EPOLL
|
|
if (resolve_result_rd >= 0) {
|
|
struct epoll_event ev = {
|
|
.events = EPOLLIN,
|
|
.data.fd = resolve_result_rd
|
|
};
|
|
if (epoll_ctl(epfd, EPOLL_CTL_ADD, resolve_result_rd, &ev) != 0) {
|
|
serror("epoll_ctl for hostname resolver");
|
|
FAILURE();
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
log(LL_INFO, "WireGuard obfuscator successfully started");
|
|
|
|
/* Main loop */
|
|
while (1) {
|
|
// Reopen the log file after it has been rotated, requested by SIGHUP
|
|
if (log_reopen_pending) {
|
|
log_reopen_pending = 0;
|
|
log_reopen();
|
|
}
|
|
|
|
// Using epoll or poll to wait for events
|
|
#ifdef USE_EPOLL
|
|
int events_n = epoll_wait(epfd, events, MAX_EVENTS, POLL_TIMEOUT);
|
|
if (events_n < 0) {
|
|
if (errno == EINTR) {
|
|
// Interrupted by a signal, e.g. SIGHUP
|
|
continue;
|
|
}
|
|
serror("epoll_wait");
|
|
FAILURE();
|
|
}
|
|
#else
|
|
int nfds = 0;
|
|
pollfds[nfds].fd = listen_sock;
|
|
pollfds[nfds].events = POLLIN;
|
|
nfds++;
|
|
if (resolve_result_rd >= 0) {
|
|
pollfds[nfds].fd = resolve_result_rd;
|
|
pollfds[nfds].events = POLLIN;
|
|
nfds++;
|
|
}
|
|
client_entry_t *entry, *tmp_entry;
|
|
HASH_ITER(hh, conn_table, entry, tmp_entry) {
|
|
if (nfds >= config.max_clients + 2) {
|
|
log(LL_DEBUG, "Too many clients, cannot add more");
|
|
break;
|
|
}
|
|
pollfds[nfds].fd = entry->server_sock;
|
|
pollfds[nfds].events = POLLIN;
|
|
nfds++;
|
|
}
|
|
int ret = poll(pollfds, nfds, POLL_TIMEOUT);
|
|
if (ret < 0) {
|
|
if (errno == EINTR) {
|
|
// Interrupted by a signal, e.g. SIGHUP
|
|
continue;
|
|
}
|
|
serror("poll");
|
|
FAILURE();
|
|
}
|
|
#endif
|
|
|
|
// Get the current time
|
|
struct timespec now_ts;
|
|
clock_gettime(CLOCK_MONOTONIC, &now_ts);
|
|
now = now_ts.tv_sec * 1000 + now_ts.tv_nsec / 1000000;
|
|
|
|
#ifdef USE_EPOLL
|
|
for (int e = 0; e < events_n; e++) {
|
|
struct epoll_event *event = &events[e];
|
|
if (resolve_result_rd >= 0 && event->data.fd == resolve_result_rd) {
|
|
drain_resolve_results(&forward_addr);
|
|
continue;
|
|
}
|
|
if (event->data.fd == listen_sock) {
|
|
#else
|
|
for (int e = 0; e < nfds; e++) if (pollfds[e].revents & POLLIN) {
|
|
if (resolve_result_rd >= 0 && pollfds[e].fd == resolve_result_rd) {
|
|
drain_resolve_results(&forward_addr);
|
|
continue;
|
|
}
|
|
if (pollfds[e].fd == listen_sock) {
|
|
#endif
|
|
/* *** Handle incoming data from the clients *** */
|
|
uint8_t *buffer = full_buffer + PREBUFFER_SIZE;
|
|
struct sockaddr_in sender_addr = {0};
|
|
socklen_t sender_addr_len = sizeof(sender_addr);
|
|
int length = recvfrom(listen_sock, buffer, BUFFER_SIZE, MSG_TRUNC | MSG_DONTWAIT, (struct sockaddr *)&sender_addr, &sender_addr_len);
|
|
if (length < 0) {
|
|
// A readiness notification does not guarantee that there is something
|
|
// to read by the time we get here, so an empty socket is not an error
|
|
if (errno != EAGAIN && errno != EWOULDBLOCK) {
|
|
serror_level(LL_DEBUG, "recvfrom client");
|
|
}
|
|
continue;
|
|
}
|
|
if (length > BUFFER_SIZE) {
|
|
log(LL_DEBUG, "Received packet from %s:%d is too large (%d bytes), while buffer size is %d bytes, ignoring",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port), length, BUFFER_SIZE);
|
|
continue;
|
|
}
|
|
|
|
// Find the client entry if any
|
|
client_entry_t *client_entry;
|
|
HASH_FIND(hh, conn_table, &sender_addr, sizeof(sender_addr), client_entry);
|
|
|
|
uint8_t obfuscated = length >= 4 && is_obfuscated(buffer);
|
|
// Is it masked packet maybe?
|
|
masking_handler_t *masking_handler = config.masking_handler;
|
|
if (obfuscated) {
|
|
length = masking_unwrap_from_client(&buffer, length, &config, client_entry, listen_sock, &sender_addr, &forward_addr, &masking_handler);
|
|
if (length <= 0) {
|
|
// Nothing to do
|
|
continue;
|
|
}
|
|
}
|
|
// Check the length
|
|
if (length < 4) {
|
|
log(LL_DEBUG, "Received too short packet from %s:%d (%d bytes), ignoring", inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port), length);
|
|
continue;
|
|
}
|
|
|
|
uint8_t version = client_entry ? client_entry->version : OBFUSCATION_VERSION;
|
|
|
|
if (verbose >= LL_TRACE) {
|
|
log(LL_TRACE, "Received %d bytes from %s:%d to %s:%d (known=%s, obfuscated=%s)",
|
|
length,
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port),
|
|
target_host, target_port,
|
|
client_entry ? "yes" : "no", obfuscated ? "yes" : "no");
|
|
log_hexdump(LL_TRACE, obfuscated ? "X->: " : "O->: ", buffer, length);
|
|
}
|
|
|
|
if (obfuscated) {
|
|
// decode
|
|
int original_length = length;
|
|
length = decode(buffer, length, config.xor_key, key_length, &version);
|
|
if (length < 4 || length > original_length) {
|
|
log(LL_DEBUG, "Failed to decode packet from %s:%d (original_length=%d, decoded_length=%d)",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port), original_length, length);
|
|
continue;
|
|
}
|
|
}
|
|
|
|
// Is it handshake?
|
|
if (WG_TYPE(buffer) == WG_TYPE_HANDSHAKE) {
|
|
log(LL_DEBUG, "Received WireGuard handshake from %s:%d to %s:%d (%d bytes, obfuscated=%s)",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port),
|
|
target_host, target_port,
|
|
length,
|
|
obfuscated ? "yes" : "no");
|
|
|
|
if (!client_entry) {
|
|
client_entry = new_client_entry(&config, &sender_addr, &forward_addr);
|
|
if (!client_entry) {
|
|
continue;
|
|
}
|
|
client_entry->last_activity_time = now;
|
|
client_entry->last_incoming_time = 0;
|
|
client_entry->masking_handler = masking_handler;
|
|
}
|
|
if (config.allow_clean) {
|
|
// Remember whether this client speaks plain WireGuard,
|
|
// its traffic will be forwarded as is in both directions
|
|
if (!obfuscated && !client_entry->client_clean) {
|
|
log(LL_INFO, "Client %s:%d is not obfuscated, forwarding its traffic as is",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port));
|
|
}
|
|
client_entry->client_clean = !obfuscated;
|
|
if (client_entry->client_clean) {
|
|
// No masking for clean clients
|
|
client_entry->masking_handler = NULL;
|
|
}
|
|
}
|
|
if (!obfuscated && !client_entry->client_clean) {
|
|
masking_on_handshake_req_from_client(&config, client_entry, listen_sock, &sender_addr, &forward_addr);
|
|
}
|
|
client_entry->handshake_direction = DIR_CLIENT_TO_SERVER;
|
|
client_entry->last_handshake_request_time = now;
|
|
}
|
|
// Is it handshake response?
|
|
else if (WG_TYPE(buffer) == WG_TYPE_HANDSHAKE_RESP) {
|
|
if (!client_entry) {
|
|
log(LL_DEBUG, "Received WireGuard handshake response from %s:%d, but no connection entry found for this client",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port));
|
|
continue;
|
|
}
|
|
|
|
log(LL_DEBUG, "Received WireGuard handshake response from %s:%d to %s:%d (%d bytes, obfuscated=%s)",
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port),
|
|
target_host, target_port,
|
|
length, obfuscated ? "yes" : "no");
|
|
|
|
// Check handshake timeout
|
|
if (now - client_entry->last_handshake_request_time > HANDSHAKE_TIMEOUT) {
|
|
log(LL_DEBUG, "Ignoring WireGuard handshake response, handshake timeout");
|
|
continue;
|
|
}
|
|
|
|
if (client_entry->handshake_direction != DIR_SERVER_TO_CLIENT) {
|
|
log(LL_DEBUG, "Received handshake response from %s:%d to %s:%d, but the handshake direction is not set to server-to-client",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port),
|
|
target_host, target_port);
|
|
continue;;
|
|
}
|
|
|
|
log(!client_entry->handshaked ? LL_INFO : LL_DEBUG, "Handshake established with %s:%d to %s:%d (reverse)",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port),
|
|
target_host, target_port);
|
|
client_entry->handshaked = 1;
|
|
client_entry->client_obfuscated = obfuscated;
|
|
client_entry->server_obfuscated = !obfuscated;
|
|
client_entry->last_handshake_time = now;
|
|
}
|
|
// If it's not a handshake or handshake response, connection is not established yet
|
|
else if (!client_entry || !client_entry->handshaked) {
|
|
log(LL_DEBUG, "Ignoring data (packet type #%u) from %s:%d to %s:%d until the handshake is completed",
|
|
WG_TYPE(buffer),
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port),
|
|
target_host, target_port);
|
|
continue;
|
|
}
|
|
|
|
// Version downgrade check
|
|
if (version < client_entry->version) {
|
|
log(LL_WARN, "Client %s:%d uses old obfuscation version, downgrading from %d to %d", inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port),
|
|
client_entry->version, version);
|
|
client_entry->version = version;
|
|
}
|
|
|
|
if (!obfuscated && !client_entry->client_clean) {
|
|
// If the packet is not obfuscated, we need to encode it
|
|
length = encode(buffer, length, config.xor_key, key_length, client_entry->version, config.max_dummy_length_data);
|
|
if (length < 4) {
|
|
log(LL_ERROR, "Failed to encode packet from %s:%d (too short, length=%d)",
|
|
inet_ntoa(sender_addr.sin_addr), ntohs(sender_addr.sin_port), length);
|
|
continue;
|
|
}
|
|
length = masking_data_wrap_to_server(&buffer, length, &config, client_entry, listen_sock, &forward_addr);
|
|
}
|
|
|
|
log_hexdump(LL_TRACE, (!obfuscated && !client_entry->client_clean) ? "X->: " : "O->: ", buffer, length);
|
|
|
|
length = send(client_entry->server_sock, buffer, length, 0);
|
|
if (length < 0) {
|
|
serror_level(LL_DEBUG, "sendto %s:%d", target_host, target_port);
|
|
continue;
|
|
}
|
|
client_entry->last_activity_time = now;
|
|
} else { // if (event->data.fd == listen_sock)
|
|
/* *** Handle data from the server *** */
|
|
#ifdef USE_EPOLL
|
|
client_entry_t *client_entry = event->data.ptr;
|
|
#else
|
|
client_entry_t *client_entry = find_by_server_sock(pollfds[e].fd);
|
|
#endif
|
|
uint8_t *buffer = full_buffer + PREBUFFER_SIZE;
|
|
int length = recv(client_entry->server_sock, buffer, BUFFER_SIZE, MSG_TRUNC | MSG_DONTWAIT);
|
|
if (length < 0) {
|
|
if (errno != EAGAIN && errno != EWOULDBLOCK) {
|
|
serror_level(LL_DEBUG, "recv from server");
|
|
}
|
|
continue;
|
|
}
|
|
if (length > BUFFER_SIZE) {
|
|
log(LL_DEBUG, "Received packet from %s:%d is too large (%d bytes), while buffer size is %d bytes, ignoring",
|
|
target_host, target_port, length, BUFFER_SIZE);
|
|
continue;
|
|
}
|
|
uint8_t obfuscated = length >= 4 && is_obfuscated(buffer);
|
|
if (obfuscated) {
|
|
// Is it masked packet maybe?
|
|
length = masking_unwrap_from_server(&buffer, length, &config, client_entry, listen_sock, &forward_addr);
|
|
if (length <= 0) {
|
|
// Nothing to do
|
|
continue;
|
|
}
|
|
}
|
|
// Check the length
|
|
if (length < 4) {
|
|
log(LL_DEBUG, "Received too short packet from %s:%d (%d bytes), ignoring", target_host, target_port, length);
|
|
continue;
|
|
}
|
|
|
|
uint8_t version = client_entry->version;
|
|
|
|
if (verbose >= LL_TRACE) {
|
|
log(LL_TRACE, "Received %d bytes from %s:%d to %s:%d (obfuscated=%s)",
|
|
length,
|
|
target_host, target_port,
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port),
|
|
obfuscated ? "yes" : "no");
|
|
log_hexdump(LL_TRACE, obfuscated ? "<-X: " : "<-O: ", buffer, length);
|
|
}
|
|
|
|
if (obfuscated) {
|
|
// decode
|
|
int original_length = length;
|
|
length = decode(buffer, length, config.xor_key, key_length, &version);
|
|
if (length < 4 || length > original_length) {
|
|
log(LL_DEBUG, "Failed to decode packet from %s:%d (original_length=%d, decoded_length=%d)", target_host, target_port, original_length, length);
|
|
continue;
|
|
}
|
|
}
|
|
|
|
// Is it handshake?
|
|
if (WG_TYPE(buffer) == WG_TYPE_HANDSHAKE) {
|
|
log(LL_DEBUG, "Received WireGuard handshake from %s:%d to %s:%d (%d bytes, obfuscated=%s)",
|
|
target_host, target_port,
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port),
|
|
length,
|
|
obfuscated ? "yes" : "no");
|
|
if (!obfuscated && !client_entry->client_clean) {
|
|
// Send STUN binding request before the obfuscated handshake
|
|
masking_on_handshake_req_from_server(&config, client_entry, listen_sock, &client_entry->client_addr, &forward_addr);
|
|
}
|
|
client_entry->handshake_direction = DIR_SERVER_TO_CLIENT;
|
|
client_entry->last_handshake_request_time = now;
|
|
}
|
|
// Is it handshake response?
|
|
else if (WG_TYPE(buffer) == WG_TYPE_HANDSHAKE_RESP) {
|
|
log(LL_DEBUG, "Received WireGuard handshake response from %s:%d to %s:%d (%d bytes, obfuscated=%s)",
|
|
target_host, target_port,
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port),
|
|
length, obfuscated ? "yes" : "no");
|
|
|
|
// Check handshake timeout
|
|
if (now - client_entry->last_handshake_request_time > HANDSHAKE_TIMEOUT) {
|
|
log(LL_DEBUG, "Ignoring WireGuard handshake response, handshake timeout");
|
|
continue;
|
|
}
|
|
|
|
if (client_entry->handshake_direction != DIR_CLIENT_TO_SERVER) {
|
|
log(LL_DEBUG, "Received handshake response from %s:%d to %s:%d, but the handshake direction is not set to client-to-server",
|
|
target_host, target_port,
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port));
|
|
continue;
|
|
}
|
|
|
|
log(!client_entry->handshaked ? LL_INFO : LL_DEBUG, "Handshake established with %s:%d to %s:%d (direct)",
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port),
|
|
target_host, target_port);
|
|
if (!client_entry->handshaked && client_entry->masking_handler && !config.masking_handler_set) {
|
|
log(LL_INFO, "Autodetected masking handler for client %s:%d: %s", inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port), client_entry->masking_handler->name);
|
|
}
|
|
client_entry->handshaked = 1;
|
|
client_entry->client_obfuscated = !obfuscated && !client_entry->client_clean;
|
|
client_entry->server_obfuscated = obfuscated;
|
|
client_entry->last_handshake_time = now;
|
|
}
|
|
// If it's not a handshake or handshake response, connection is not established yet
|
|
else if (!client_entry->handshaked) {
|
|
log(LL_DEBUG, "Ignoring response (packet type #%u) from %s:%d to %s:%d until the handshake is completed",
|
|
WG_TYPE(buffer),
|
|
target_host, target_port,
|
|
inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port));
|
|
continue;
|
|
}
|
|
|
|
// Version downgrade check
|
|
if (version < client_entry->version) {
|
|
log(LL_WARN, "Server %s:%d uses old obfuscation version, downgrading from %d to %d",
|
|
target_host, target_port, client_entry->version, version);
|
|
client_entry->version = version;
|
|
}
|
|
|
|
if (!obfuscated && !client_entry->client_clean) {
|
|
// If the packet is not obfuscated, we need to encode it
|
|
length = encode(buffer, length, config.xor_key, key_length, client_entry->version, config.max_dummy_length_data);
|
|
if (length < 4) {
|
|
log(LL_ERROR, "Failed to encode packet from %s:%d", target_host, target_port);
|
|
continue;
|
|
}
|
|
length = masking_data_wrap_to_client(&buffer, length, &config, client_entry, listen_sock, &forward_addr);
|
|
}
|
|
|
|
log_hexdump(LL_TRACE, (!obfuscated && !client_entry->client_clean) ? "<-X: " : "<-O: ", buffer, length);
|
|
|
|
// Send the response back to the original client
|
|
length = sendto(listen_sock, buffer, length, 0, (struct sockaddr *)&client_entry->client_addr, sizeof(client_entry->client_addr));
|
|
if (length < 0) {
|
|
serror_level(LL_DEBUG, "sendto %s:%d", inet_ntoa(client_entry->client_addr.sin_addr), ntohs(client_entry->client_addr.sin_port));
|
|
continue;
|
|
}
|
|
client_entry->last_activity_time = now;
|
|
client_entry->last_incoming_time = now;
|
|
} // if (event->data.fd != listen_sock)
|
|
} // for (int e = 0; e < events_n; e++)
|
|
|
|
if (now - last_cleanup_time >= ITERATE_INTERVAL) {
|
|
client_entry_t *current_entry, *tmp_current_entry;
|
|
// Iterate over all client entries
|
|
HASH_ITER(hh, conn_table, current_entry, tmp_current_entry) {
|
|
// Check if the entry is idle for too long
|
|
uint8_t idle = now - current_entry->last_activity_time >= config.idle_timeout;
|
|
uint8_t incoming_timeout = config.in_timeout > 0 && now - current_entry->last_incoming_time >= config.in_timeout;
|
|
uint8_t handshake_timeout = !current_entry->handshaked && now - current_entry->last_activity_time >= HANDSHAKE_TIMEOUT;
|
|
if ((idle || incoming_timeout || handshake_timeout) && !current_entry->is_static) { // Do not remove static entries
|
|
// Remove old entry
|
|
if (idle) {
|
|
log(LL_INFO, "Removing idle client %s:%d", inet_ntoa(current_entry->client_addr.sin_addr), ntohs(current_entry->client_addr.sin_port));
|
|
} else if (incoming_timeout) {
|
|
log(LL_INFO, "Removing client %s:%d due to incoming timeout", inet_ntoa(current_entry->client_addr.sin_addr), ntohs(current_entry->client_addr.sin_port));
|
|
} else if (handshake_timeout) {
|
|
log(LL_DEBUG, "Removing client %s:%d due to handshake timeout", inet_ntoa(current_entry->client_addr.sin_addr), ntohs(current_entry->client_addr.sin_port));
|
|
}
|
|
#ifdef USE_EPOLL
|
|
epoll_ctl(epfd, EPOLL_CTL_DEL, current_entry->server_sock, NULL);
|
|
#endif
|
|
close(current_entry->server_sock);
|
|
HASH_DEL(conn_table, current_entry);
|
|
free(current_entry);
|
|
continue;
|
|
}
|
|
|
|
// Check if we need to call masking timer
|
|
if (current_entry->masking_handler && current_entry->masking_handler->timer_interval_s > 0
|
|
&& now - current_entry->last_masking_timer_time >= current_entry->masking_handler->timer_interval_s * 1000) {
|
|
current_entry->last_masking_timer_time = now;
|
|
masking_on_timer(&config, current_entry, listen_sock, &forward_addr);
|
|
}
|
|
}
|
|
// Update the last cleanup time
|
|
last_cleanup_time = now;
|
|
}
|
|
} // while (1)
|
|
|
|
// You should never reach this point, but just in case
|
|
return 0;
|
|
}
|