| - pdnsd Homepage - | -- pdnsd FAQ - | -- Documentation - | -- GNU GPL (pdnsd's License) - | -- Download Section - | -
pdnsd Download Page
The original author of pdnsd is Thomas Moestl,
- but since 2003, he no longer maintains pdnsd.
- However, Paul A. Rombouts has extensively revised the code and maintains
- a version with many fixes and improvements at
- http://members.home.nl/p.a.rombouts/pdnsd.html.
- He has pre-patched tarballs and RPM packages available for download at this site.
-
- If you are interested in the very latest code or if you want to participate in - pdnsd development, checkout the pdnsd git repository - at gitorious.org. -
- - The most recent tarball is pdnsd-1.2.9b-par.tar.gz - (GPG signature).- The most recent RPM packages are: -
| Package Name | -Size | -Description | -
| pdnsd-1.2.9b-par.src.rpm | -514kB | -Source RPM (binary packages can also be built directly from the tarball). - | -
| pdnsd-1.2.9b-par_sl6.i686.rpm | -??? | -i686 binary built on a Scientific Linux 6.2 system. - | -
| pdnsd-1.2.9b-par_sl6.x86_64.rpm | -282kB | -x86_64 binary built on a Scientific Linux 6.2 system. - | -
- There are also Debian,
- Ubuntu,
- Gentoo,
- Mandriva
- and FreeBSD
- packages, but these may not include the latest version.
- If you are looking for other versions released by Paul Rombouts, visit this
- download directory.
-
-
-
- Last revised: 24 Apr 2012 by Paul A. Rombouts -
- - diff --git a/jni/pdnsd/doc/html/dl.html.in b/jni/pdnsd/doc/html/dl.html.in deleted file mode 100644 index dffe2b02..00000000 --- a/jni/pdnsd/doc/html/dl.html.in +++ /dev/null @@ -1,96 +0,0 @@ - - - -| - pdnsd Homepage - | -- pdnsd FAQ - | -- Documentation - | -- GNU GPL (pdnsd's License) - | -- Download Section - | -
pdnsd Download Page
The original author of pdnsd is Thomas Moestl,
- but since 2003, he no longer maintains pdnsd.
- However, Paul A. Rombouts has extensively revised the code and maintains
- a version with many fixes and improvements at
- http://members.home.nl/p.a.rombouts/pdnsd.html.
- He has pre-patched tarballs and RPM packages available for download at this site.
-
- If you are interested in the very latest code or if you want to participate in - pdnsd development, checkout the pdnsd git repository - at gitorious.org. -
- - The most recent tarball is pdnsd-$version.tar.gz - (GPG signature).- The most recent RPM packages are: -
| Package Name | -Size | -Description | -
| pdnsd-$version.src.rpm | -$sizeof("$HOME/rpmbuild/SRPMS/pdnsd-$version.src.rpm") | -Source RPM (binary packages can also be built directly from the tarball). - | -
| pdnsd-${version}${extver}.${arch}.rpm | -$sizeof("$HOME/rpmbuild/RPMS/pdnsd-${version}${extver}.${arch}.rpm") | -${arch} binary built on a $system. - | -
| pdnsd-${version}${extver}.${arch2}.rpm | -$sizeof("$HOME/rpmbuild/RPMS/pdnsd-${version}${extver}.${arch2}.rpm") | -${arch2} binary built on a $system. - | -
- There are also Debian,
- Ubuntu,
- Gentoo,
- Mandriva
- and FreeBSD
- packages, but these may not include the latest version.
- If you are looking for other versions released by Paul Rombouts, visit this
- download directory.
-
-
-
- Last revised: $date by Paul A. Rombouts -
- - diff --git a/jni/pdnsd/doc/html/doc.html b/jni/pdnsd/doc/html/doc.html deleted file mode 100644 index 95828c5c..00000000 --- a/jni/pdnsd/doc/html/doc.html +++ /dev/null @@ -1,2630 +0,0 @@ - - - -| - pdnsd Homepage - | -- pdnsd FAQ - | -- Documentation - | -- GNU GPL (pdnsd's License) - | -- Download Section - | -
pdnsd Documentation
- This manual is a part of the pdnsd package, and may be distributed in - original or modified form under terms of the GNU General Public - License, as published by the Free Software Foundation; either version - 3, or (at your option) any later version.
- You can find a copy of the GNU GPL in the file
COPYING in the source or documentation directory.- This manual is up-to-date for version 1.2.9b. For older documentation, please refer to the doc - directory of the respective pdnsd package.
- If you want a quicker introduction to pdnsd, you can try some of the - HOWTOs available on the web. - For Apple Mac users, Brian Wells has published a good HOWTO at - http://web.mac.com/brianwells/main/pdnsd.html. - - -
0. Installation
-0.1 Installing binary RPM's
- To install a binary RPM, just do-
rpm -i pdnsd-<version>.rpm
/etc/pdnsd.conf)
- according to your needs (see below).
- In the Red Hat and SuSE RPMs, a start script is also installed; read the section
- 0.4, Start at Boot Time about that.
-
- -
0.2 Building RPM's
- It is possible to build a binary RPM from a source package using the command-
rpmbuild --rebuild pdnsd-<version>.src.rpm
-
rpmbuild -tb pdnsd-<version>.tar.gz
- Several pdnsd-specific options are available when building RPM packages: -
- --with isdn
- |
-
- Has the same effect as --enable-isdn (see below).
- |
-
- --without poll
- |
-
- Has the same effect as --disable-poll (see below).
- |
-
- --without nptl
- |
-
- Has the same effect as --with-thread-lib=linuxthreads (see below).
- |
-
- --with ipv6
- |
-
- Has the same effect as --enable-ipv6 (see below).
- |
-
- --without tcpqueries
- |
-
- Has the same effect as --disable-tcp-queries (see below).
- |
-
- --without debug
- |
-
- Has the same effect as --with-debug=0 (see below).
- |
-
- --define "distro <distro>"
- |
-
- Has the same effect as --with-distribution=<distro> (see below).
- |
-
- --define "run_as_user <user>"
- |
-
- Has the same effect as --with-default-id=<user> (see below).- For RPMs the default <user> is "pdnsd".
- |
-
- --define "run_as_uid <uid>"
- |
-
- If the user defined by the previous option does not exist when the RPM is installed,
- the pre-install script will try to create a new user with numerical id <uid>.
- The default is to let the system choose the numerical id at install time.
- |
-
- --define "cachedir <dir>"
- |
-
- Has the same effect as --with-cachedir=<dir> (see below).
- |
-
CFLAGS.
- Using a bash shell, you can do that on the command line like this:
- CFLAGS="-O1 -Wall" rpmbuild ...- This is useful if you prefer a different level of optimization, for instance. - -
-
0.3 Installing from pure sources (tar archives or git repositories)
-0.3.1 Setting up the source code tree
- Source code is available in the form of snapshots (tarballs) or a git repository - with the very latest development code and a (nearly) complete history of all the revisions. - Cloning a git repository is useful if you need a recent fix or feature - that is not yet contained in a main release or you want to participate in pdnsd development. - Otherwise you will probably find the tarballs more convenient because they are much more compact. -0.3.1.1 Unpacking a tar archive
- The pdsnsd snapshot releases come in the form of a gzip'ed tar archive. - To decompress it (using a modern tar) do-
tar -xzf pdnsd-<version>.tar.gz
-
gzip -dc pdnsd-<version>.tar.gz | tar -xf -
0.3.1.2 Cloning a git repository
- To clone a git repository you need to install, if not already installed, - the git version control system, which is available as a package in most modern Linux distributions. - Then run the command:-
git clone git://gitorious.org/pdnsd/pdnsd.git pdnsd
0.3.2 Configuring the source
- Change into the pdnsd source directory and run configure. It takes the following command line - options (if you do not specify an option, defaults will be used):-
- --prefix=dir
- |
-
- Specify the prefix directory. The pdnsd files are installed in subdirectories
- of the prefix, the pdnsd and pdnsd-ctl executables are for example installed
- in the sbin subdirectory of the prefix. The default for this is /usr/local;
- you might want to set this to /usr (using --prefix=/usr).
- |
-
- --sysconfdir=dir
- |
-
- Specify the config directory. pdnsd expects its pdnsd.conf file to reside
- there if the -c option is not given at startup.
- The default for this is the etc subdirectory of your prefix, e.g. /usr/local/etc
- if you did not specify a prefix. To set this e.g. to /etc, use --sysconfdir=/etc.
- |
-
- --with-distribution=distro
- |
-
- Specify target distribution (default=Generic; others: RedHat, SuSE, Debian) - See below for the effect of these settings. - |
-
- --with-target=platform
- |
-
- Change compilation target platform (default: autodetect; others: Linux, BSD, Cygwin). - autodetect will attempt to detect whether you are using Linux, *BSD or Cygwin and - should normally be sufficient. If this does not work, try specifying - your system manually (for the Darwin platform (Apple Mac OS X) specify BSD here). - |
-
- --with-cachedir=dir
- |
-
- Default directory for pdnsd cache (default=/var/cache/pdnsd) - This setting can be changed via config file settings when pdnsd has been built. - |
-
- --with-hash-buckets=num
- |
- - Number of hash buckets to use (default=1024). The default should be - sufficient for most purposes, but if you want to store a large number of names - in the cache, cache lookups may be faster if the number of hash buckets - is comparable to the number of names stored in the cache. - The number actually used is the smallest power of two - greater or equal to the number specified here. - | -
- --enable-isdn
- |
-
- Enable ISDN support - This option will work only on Linux and may cause problems with 2.0.x or - old 2.2.x kernels. You will need it for a proper if uptest
- under Linux for ISDN ppp devices.
- |
-
- --disable-ipv4
- |
- - Disable IPv4 networking support (default=enabled) - | -
- --enable-ipv6
- |
-
- Enable IPv6 networking support. - If your OS does support IPv6 properly, you should be able to serve also - IPv4 queries using this. Normally, this is disabled and you won't need - it. - |
-
- --disable-ipv4-startup
- |
- - Disable IPv4 on pdnsd startup by default (default=enabled) - | -
- --enable-ipv6-startup
- |
- - Enable IPV6 on pdnsd startup by default (default=IPv4). - These options are only defaults, you can specify on - the command line or in the config files which IP version - will really be used. - Normally, you won't need to change these. - | -
- --disable-udp-queries
- |
- - Disable UDP as query method. You shouldn't need to change - this. - | -
- --disable-tcp-queries
- |
- - Disable TCP as query method. This only effects the querying of - name servers by pdnsd, not the ability of pdnsd to answer - TCP queries from clients. - TCP queries are slower than UDP queries, but can be more secure - against certain types of attacks and are able to handle large answers. - For normal use this can be disabled. - (Note that the default has changed: TCP-query support - is now compiled in by default, but it still depends on the run-time - options whether it is actually used.) - | -
- --with-query-method=qm
- |
- - Specify the query method (default=udponly, others: tcponly, tcpudp, udptcp). - If you have enabled both UDP and TCP queries, this lets you control - which query method pdnsd will use by default. tcpudp will try TCP - first and fall back to UDP if TCP is not supported by the server; - udptcp will try UDP first and, if the answer was truncated, will repeat - the query using TCP. - udponly and tcponly should be clear. Note that this only effects - the compiled-in default; the query method can still be changed using - command-line options or options in the configuration file. - | -
- --disable-tcp-server
- |
- - Disable the TCP server. - In this case pdnsd will not be able to respond to TCP queries from clients. - This may cause problems with very large answers. - | -
- --disable-src-addr-disc
- |
-
- Disable the UDP source address discovery. - You need this only if you have trouble with messages saying - "could not discover udp source address". - For the Cygwin target, this option is disabled by default. - |
-
- --disable-poll
- |
-
- Disable poll(2) and use select(2) (default=enabled) - You will normally not need this. - |
-
- --disable-new-rrs
- |
-
- Since version 1.2.9 this option is obsolete and ignored.
- It is now possible to configure for each RR type separately whether it is
- cacheable by pdnsd by editing the file src/rr_types.in.
- The comments in this file explain how to do this.
- |
-
- --enable-strict-rfc2181
- |
-
- Enforce strict RFC 2181 compliance. - This will cause pdnsd to reject DNS answers with incorrect - timestamp settings (multiple RRs of the same type and for the same domain with - different TTLs). Normally not needed. - |
-
- --enable-underscores
- |
- - This option is obsolete. Since version 1.2, pdnsd places no restrictions - on the types of characters in domain names (there are still a few restrictions - for locally defined names, though). - | -
- --with-random-device=device
- |
-
- Specify random device; default: C Library random() PRNG- pdnsd uses (pseudo-) random numbers as query IDs for security reasons - (this makes forging DNS answers more difficult). This option - controls where pdnsd gets these from. The default is the C library - random() function, which is relatively weak.
- You can specify a device like /dev/urandom here if you like; pdnsd will read
- random numbers from it 16-bit-wise. /dev/urandom is present under Linux and
- most BSD derivates. You should not use /dev/random - it is more secure, but
- may block and delay pdnsd's answers for a long time.- You can specify arc4random to use the BSD arc4random()
- library function (default for FreeBSD target), which is considered safe.- You can also specify random as device to use the C Library
- random() function (described above).
- |
-
- --with-default-id=user
- |
-
- Specify default user for pdnsd (default=nobody).
- This is the user that will be entered for the run_as
- option in the config file (see below) that will be installed during make install.
- You can change this any time in your config file.
- |
-
- --with-debug=level
- |
-
- Specify debugging level. Normally you can safely switch debugging off
- by setting the level to 0. This will increase speed (although only
- marginally) and save space in the executable (only about 12kB).
- However, more significant may be the savings in stack space, especially
- if pdnsd is put under heavy load and there are many simultaneous
- running threads. - Presently the only defined debug levels are in the range 0 - 9. - Setting the level to 9 enables hex dumps of the queries and replies - pdnsd receives and should normally not be needed. Debug output will only - be generated if you turn on special switches; it might be useful for - debugging your config files, so I recommend using the default (1). - However, if you use pdnsd under heavy load, a better strategy may be - to compile one version of pdnsd without debug support (configured with - --with-debug=0) for production use, and one version with
- with debug support (e.g. --with-debug=9)
- for diagnostic purposes.
- |
-
- --with-verbosity=level
- |
- - Specify default message verbosity. The default should be ok. - | -
- --enable-rcsids
- |
-
- Enable RCS IDs in executables (default=disabled). - For personal use, there is no need to do this. If you build rpm's, it - might have advantages. - |
-
- --enable-tcp-subseq
- |
-
- Enable subsequent tcp queries. The DNS protocol standard
- requires that servers must be capable of answering multiple
- subsequent queries that are sent over the same tcp connection, and that
- the server may only close the connection by himself after a certain
- timeout. This feature is rarely used, but may make denial-of-service
- attacks easier, as it allows for an attacker to hold a connection open
- a long time (although the attacker's IP is most likely revealed then).
- For full standard compliance, you should use this option.
- If you do not use --enable-tcp-server, is option is not honored.
- |
-
- --with-tcp-qtimeout=secs
- |
-
- Specify default tcp query timeout after which the connection is closed
- if no full query has been received. The default is 30s.
- You can also change this option at run time using the tcp_qtimeout
- config file option.
- If you do not use --enable-tcp-server, is option is not honored.
- |
-
- --with-par-queries=num
- |
-
- Specify the default number of queries that can be executed in parallel.
- You can also change this option at run time using the par_queries
- config file option. See the description of that option for an explanation
- of what it really does. - The default for this option is 2. - |
-
- --with-max-nameserver-ips=num
- |
-
- New in version 1.2.9b:
- Specify the maximum number of IP addresses that can be used per nameserver obtained
- from NS records (when resolving names recursively).
- Just one IP address per nameserver is sufficient in the vast majority of cases
- (and this was the strategy used by pdnsd in previous versions),
- but in rare cases this will cause unnecessary resolve failures if the address chosen
- for each nameserver happens to be unreachable while the other addresses would lead to
- successful resolution. - The default for this option is 3. - |
-
- --with-thread-lib=lib
- |
-
- Added by Paul Rombouts: Use this option if you experience problems with
- signal handling under Linux. The usual symptom is that pdnsd fails to save
- the cache to disk, and /var/cache/pdnsd/pdnsd.cache remains empty.
- If you experience this kind of trouble, try reconfiguring with different values
- for the --with-thread-lib option. The allowable values are
- linuxthreads (or lt for short), linuxthreads2
- (or lt2 for short), and nptl.
- By default the configure script tries to detect automatically whether
- linuxthreads or nptl is more appropriate for your system,
- but the method used is not foolproof. Look for the line:
- checking if this is an NPTL-based system...- If the automatic test mistakenly indentifies the thread library on your system as - NPTL based, you should reconfigure with --with-thread-lib=lt and recompile.
- If the result of the automatic test is "no" or if
- --with-thread-lib=lt does not have the desired effect, try again using
- --with-thread-lib=lt2 .
- |
-
--prefix, --sysconfdir and
- --with-distribution.
- If you specify your distribution using --with-distribution, this has the
- following effects:
- -
-
- An rc script is copied in the appropriate localtion, which enables pdnsd to start - at machine boot time (see 0.4) -
- Distribution-specific portions might be included in the generated pdnsd.spec - file (only important if you want to build rpm archives yourself). -
Generic, no rc script is installed, and a generic spec
- file is generated.- - Further instructions are in the INSTALL document in the pdnsd source directory. -
./configure --help will give you a list of all supported command line
- options.- Note added by Paul Rombouts: Some people may want change the compiler optimization flag. - I use the
-O2 flag, but it might be safer to use a lower level of
- optimization or no optimization at all. In that case prefix the
- configure command with the desired compiler flags like this
- (assuming you're using a bash shell):
- CFLAGS="-O1 -Wall" ./configure ...
-
0.3.3 Building & installing
- Typemake in the source directory. Should work by now.- To install, type
make install or do the installation by hand (see 0.3.4).-
make install will do the following ($prefix is the prefix directory; see above):-
-
-
- copies pdnsd to
$(prefix)/sbin/- - copies pdnsd-ctl to
$(prefix)/sbin/- - copies docs/pdnsd.conf.sample (a sample configuration) to the pdnsd config directory. -
- creates your cache directory if it is not there.
- After installation, you should check the file permissions and create or edit
-
/etc/pdnsd.confto fit your needs (see below). - If you use therun_asoption, please make sure that your - cache directory is owned by the user you specified with this option! -
- Security notes: never make the pdnsd cache directory - writeable for untrusted users, or you will get several security holes: - the users might modify the cache contents, or plant dangerous links.
- If you use a pidfile, you should be aware that you introduce security - problems if you place the pidfile in a directory in a NFS filesystem that - is writeable for untrusted users. Generally, the pidfile directory - (typically /var/run) should not be writeable for untrusted users. -
-
0.3.4 Manual installation
- For a manual installation, you need to do the following steps: --
-
- Copy pdnsd and pdnsd-ctl from your build directory to an appropriate location (e.g.
/usr/sbin). - - Copy
docs/pdnsd.confinto the directory you want it to reside (/etcby default, - and change it according to your needs (see below). - - Create your caching directory; default is
/var/cache/pdnsd(you may change this - in yourpdnsd.conf); Permissions should be at maxrwxr-xr-x(if you want to - protect your cache and status socket, make itrwx------). -
- -
0.4 Start at boot time
- In thesrc/rc folder of the pdnsd distribution are start scripts
- for pdnsd designed for different Linux distros. There are scripts
- for SuSE, Redhat, Debian, Arch Linux and Slackware now.- The start scripts are automatically installed during RPM install, and also during
make install
- if you specified your distro.- For Slackware Linux there is a start-up script contributed by Nikola Kotur, but presently - it must be installed manually. - See
src/rc/README and src/rc/Slackware/rc.pdnsd for details.
-
- 0.4.1 SuSE Linux startup
-rc/SuSE/pdnsd is a start script for SuSE Linux. It was tested for 6.? but should run on some
- versions below. You can do make install as root in the rc/SuSE
- directory to install it, or you can install manually:-
| - manual installation - | -
- For manual installation, copy rc/SuSE/pdnsd into /sbin/init.d/, go to
- /sbin/init.d/rc2.d/ and create there the following two symlinks:- S11pdnsd to ../pdnsd (do ln -s ../pdnsd S11pdnsd in that dir) - K34pdnsd to ../pdnsd (do ln -s ../pdnsd K34pdnsd in that dir) - The numbers dictate the order different services are started and - might need to be modified. Then edit your /etc/rc.config file and
- add the line START_PDNSD=yes to start pdnsd at boot time.
- |
-
- If you used the make install command, START_PDNSD=yes has been
- appended to your /etc/rc.config file, causing pdnsd to be started
- at boot time. If you don't want that, change the yes into no.
-
/sbin/init.d/skeleton by me, so the
- most is copyrighted by SuSE. They put it under the GPL, however, so
- the license stated in COPYING also applies to this script.
- There is NO WARRANTY OF ANY KIND on these scripts.
- This is no official SuSE script, and SuSE naturally does NO support
- for it.
- 0.4.2 Red Hat Linux startup
-rc/Redhat/pdnsd is a start script for Red Hat Linux. It was contibuted by Torben
- Janssen. - This was tested for 6.1 but should run on 5.0+. You can do
make install as root in the
- rc/Redhat directory to install it, or you can install manually:-
| - manual installation - | -
- For manual installation, copy rc/Redhat/pdnsd into /etc/rc.d/init.d/- Then go to /etc/rc.d/rc3.d and create there the following symlink:- S78pdnsd -> ../init.d/pdnsd - (do ln -f -s ../init.d/pdnsd S78pdnsd in that dir)- - Then go to /etc/rc.d/rc0.d and create there the following symlink:- K78pdnsd -> ../init.d/pdnsd - (do ln -f -s ../init.d/pdnsd K78pdnsd in that dir)- - Then go to /etc/rc.d/rc6.d and create there the following symlink: - K78pdnsd -> ../init.d/pdnsd - (do ln -f -s ../init.d/pdnsd K78pdnsd in that dir)
- |
-
-
0.5 Notes for FreeBSD users
- The special handling of ISDN ppp devices is only supported on Linux. It is not needed in FreeBSD, the normal - device handling also works fine with isdn4bsd devices.- When compiled for FreeBSD, pdnsd as a small RFC compatability issue: RFC2181 demands answers on dns querys - to be sent with the same source address the query packet went to. In seldom cases, this will not be the case, - because the kernel selects the source address depending on the interface that was used for sending the answer.
- Setting the source address currently does not work for IPv4. I have written a kernel patch that will provide an easy way - to program this. We'll see if or when it gets commited.
-
-
-
1 Invocation
- When invoking pdnsd, you can specify various options at the command line. Command line options - always override config file options. The various --noX options are present to override - config file options. -- pdnsd --help (or -h) gives you an overview of the pdnsd command line options. -
-- pdnsd --version (or -V for short) prints licence and version information. -
-- To start pdnsd as background daemon, specifiy --daemon (or -d for short) on - the command line. Diagnostic and error messages after the actual daemon start - will be printed to the syslog instead of the console. --nodaemon will disable this. -
-
- When starting pdnsd as a daemon, the -p option may be helpful: It writes the pid
- of the server process to the file of the name given as argument to this option.
- Example: pdnsd -d -p /var/run/pdnsd.pid
-
- If you want to specify a configuration file other than /etc/pdnsd.conf, specify
- -c or --config-file on the command line, followed by a filename.
-
- If pdnsd was compiled with debugging support, you may specify -g or
- --debug on the command line. This will cause extra diagnostic messages to be
- printed. When pdnsd runs in daemon mode, the messages will be written to the pdnsd.debug
- file in your cache directory. --nodebug disables debugging.
-
- pdnsd -vn sets the verbosity level of pdnsd. n is normally a digit from 0 to 3,
- where 0 means normal operation, while 3 will most verbose.
- Level 9 can be used in combination with the --debug option for very
- extensive debug information.
- Note: The current implementation mostly ignores the verbosity level,
- so you may not notice much difference between the various levels.
-
- The option -s or --status enables the status control socket. This is a named socket in
- the cache directory called pdnsd.status. This socket allows run-time configuration of pdnsd
- using the utility pdnsd-ctl. See below for more details about pdnsd-ctl.
- --nostatus disables status control.
- See also the configuration option status_ctl in the global section.
-
- The option --notcp disables the seldom needed TCP server thread, which may
- save you some resources. -t or --tcp will enable it.
- See also the tcp_server configuration option.
-
- Using the -m option, you can select the method pdnsd uses to query other name servers.
- Following methods are supported (see also the query_method
- configuration option):
- -muo: pdnsd will use UDP only. This is the fastest method, and should be supported by all name servers
- on the Internet.
- -mto: pdnsd will use TCP only. TCP queries usually take longer time than UDP queries, but are more secure
- against certain attacks, where an attacker tries to guess your query id and to send forged answers. TCP queries
- are not supported by some name servers.
- -mtu: pdnsd will try to use TCP, and will fall back to UDP if its connection is refused or times out.
- -mut: New in version 1.2.5: pdnsd will try to use UDP, and will repeat the query using TCP if the UDP reply was truncated
- (i.e. the tc bit is set). This is the behaviour recommended by the DNS standards.
-
- The -4 option switches to IPv4 mode, providing pdnsd was compiled with IPv4 support.
- The -6 option switches to IPv6 mode, providing pdnsd was compiled with IPv6 support.
- The -a option is only available when pdnsd was compiled with both IPv4 and IPv6 support.
- With this option, pdnsd will try to detect automatically if a system supports IPv6, and fall back to IPv4 otherwise.
-
- With -i prefix or --ipv4_6_prefix=prefix you can set the prefix pdnsd uses (when running in IPv6
- mode) to map IPv4 addresses in the configuration file to IPv6 addresses.
- There is also a corresponding option for the config file, see below.
- Must be a valid IPv6 address.
- The default is ::ffff:0.0.0.0
-
2 The configuration file
- This section describes the layout of the configuration file and the available - configuration options. - The default location of the file is/etc/pdnsd.conf. This may be changed
- with the -c command line option.
- An example pdnsd.conf comes with the pdnsd distribution in the docs directory
- and will be installed to /etc/ by make install.
-
- -
2.1 Layout
- The configuration file is divided into sections. Each section is prefixed with - the section name and opening curlies ({) and closed with closing curlies (}). - In each section, configuration options can be given in the form -
- option_name=option_value;
- - Option value may be a string literal, a number, a time specification or a constant. - In previous versions of pdnsd strings had to be enclosed - in quotes ("), but since version 1.1.10 this is no longer necessary, unless - a string contains a special character such as whitespace, a token that normally starts - a comment, or one of "
,;{}\".
- Since version 1.2.9 a backslash (\) inside a string is interpreted as an escape character,
- so it is possible to include special characters in strings (both quoted or unquoted)
- by preceding them with a backslash. Some escape sequences are in interpreted as in the C
- programming language, e.g. \t becomes a tab,
- \n becomes a new-line control char.- A time specification consists a sequence of digits followed by a one-letter suffix. - The following suffixes are recognized: -
s (seconds), m (minutes), h (hours),
- d (days) and w (weeks).
- If the suffix is missing, seconds are assumed.
- If several time specifications are concatenated, their values are added together;
- e.g. 2h30m is interpreted as 2*60*60 + 30*60 = 9000 seconds.- Some options take more than one value; in this case, the values are separated with commas.
- If you may supply one of a set of possible values to an option, this is noted - in the documentation as -
(option1|option2|option3|...)- The constants
true|false and yes|no
- are accepted as synonyms for the constants on|off.- Comments may be enclosed in /* and */, nested comments are possible. If the - # sign or two slashes (//) appear in the configuration file, everything from - these signs to the end of the current line is regarded as a comment and ignored.
- There are examples for nearly all options in the sample config file. -
-
2.1.1 global Section
- The global section specifies parameters that affect the overall behaviour of the
- server. If you specify multiple global sections, the settings of those later in
- the file will overwrite the earlier given values.- These are the possible options:
-
- perm_cache=(number|off);- Switch the disk cache off or supply a maximum cache size in kB. If the disk - cache is switched off, 8 bytes will still be written to disk. - The memory cache is always 10kB larger than the file cache. - This value is 2048 (2 MB) by default. - |
-
- cache_dir=string;- Set the directory you want to keep the cache in. - The default is "/var/cache/pdnsd"
- (unless pdnsd was compiled with a different default).
- |
-
- server_port=number;- Set the server port. This is especially useful when you want to start the - server and are not root. Note that you may also not specify uptest=ping in - the server section as non-root. - The default port is 53, the RFC-standard one. Note that you should only use - non-standard ports when you only need clients on your machine to communicate - with the server; others will probably fail if the try to contact the server - on the basis of an NS record, since the A record that supplies the address for - (among others) name servers does not have a port number specification. - |
-
- server_ip=string;- or - interface=string;- Set the IP address pdnsd listens on for requests. This can be useful - when the host has several interfaces and you want pdnsd not to listen on - all interfaces. For example, it is possible to bind pdnsd to listen on - 127.0.0.2 to allow pdnsd to be a forwarder for BIND. - The default setting for this option is server_ip=any, which means that
- pdnsd will listen on all of your local interfaces.
- Presently you can only specify one address here; if you want pdnsd to listen on multiple
- interfaces but not all you will have to specify server_ip=any
- and use firewall rules to restrict access.- The IP address used to need quotation marks around it, but since version 1.1.10 - this is no longer necessary. - If pdnsd has been compiled with both IPv4 and IPv6 support, and you want to - specify an IPv6 address here, then unless pdnsd was compiled to start up in IPv6 mode - by default, you will need to use the -6 command-line option or
- set run_ipv4=off first (see below) in order to ensure that the
- IPv6 address is parsed correctly.- If pdnsd is running in IPv6 mode and you specify an IPv4 address here, - it will automatically be mapped to an IPv6 address. - New in version 1.2: You may also give the name of an interface - such as "lo" or "eth0" here, instead of an IP address
- (this has been tested on Linux, and may or may not work on other platforms).
- pdnsd will not bind to the interface name, but will look up the address of the
- interface at start-up and listen on that address. If the address of the interface
- changes while pdnsd is running, pdnsd will not notice that. You will need to
- restart pdnsd in that case.
- |
-
- outgoing_ip=string;- or - outside_interface=string;- New in version 1.2.9: - Set the IP address of the interface used by pdnsd for outgoing queries. - This can be useful when the host has several interfaces and you want pdnsd - to send outgoing queries via only one of them. - For example, if pdnsd is running on a host with one interface with IP address - 192.168.1.1 connected to the local network, and another with IP address 123.xxx.yyy.zzz - connected to the internet, you may specify server_ip=192.168.1.1
- and outgoing_ip=123.xxx.yyy.zzz to enforce that pdnsd only responds
- to queries received from the local network, and only sends outgoing queries via
- the interface connected to the internet.- The default setting for this option is any, which means that
- the kernel is free to decide which interface to use.
- Like with the server_ip option, you may also give the name of an
- interface here, instead of an IP address.
- |
-
- linkdown_kluge=(on|off);- This option enables a kluge that some people might need: when all servers are - marked down, with this option set the cache is not even used when a query is - received, and a DNS error is returned in any case. The only exception from this - is that local records (as specified in rr and source
- sections are still served normally.
- In general, you probably want to get cached entries even when the network is down,
- so this defaults to off.
- |
-
- max_ttl=timespec;- This option sets the maximum time a record is held in cache. All dns - resource records have a time to live field that says for what period of time the - record may be cached before it needs to be requeried. If this is more than the - value given with max_ttl, this time to live value is set to max_ttl.
- This is done to prevent records from being cached an inappropriate long period of time, because
- that is almost never a good thing to do. Default is 604800s (one week).
- |
-
- min_ttl=timespec;- This option sets the minimum time a record is held in cache. All dns - resource records have a time to live field that says for what period of time the - record may be cached before it needs to be requeried. If this is less than the - value given with min_ttl, this time to live value is set to min_ttl.
- Default is 120 seconds.
- |
-
- neg_ttl=timespec;- This option sets the time that negatively cached records will remain valid in the - cache if no time to live can be determined. This is always the case when whole - domains are being cached negatively, and additionally when record types are cached - negatively for a domain for which no SOA record is known to pdnsd. If a SOA is present, - the ttl of the SOA is taken. - |
-
- neg_rrs_pol=(on|off|auth|default);- This sets the RR set policy for negative caching; this tells pdnsd under which circumstances - it should cache a record type negatively for a certain domain. off will
- turn the negative caching of record types off, on will always add a negative
- cache entry when a name server did not return a record type we asked it for, and auth
- will only add such entries if the answer came from an authoritative name server for that
- domain.- New in version 1.2.8: The default setting will add a negatively cached record
- if either the answer was authoritive or the answer indicated the name server had "recursion available"
- while the query explicitly requested such recursion.- The preset is " default" (used to be auth).
- |
-
- neg_domain_pol=(on|off|auth);- This is analogue to neg_rrs_pol for whole domain negative caching. It should be safe
- to set this on, because I have not seen a caching server that will falsely claim that a
- domain does not exist.- The default is auth.
- |
-
- run_as=string;- This option allows you to let pdnsd change its user and group id after operations that needed - privileges have been done. This helps minimize security risks and is therefore recommended. The - supplied string gives a user name whose user id and primary group id are taken. - A little more details: after reading the config file, becoming a daemon (if specified) and starting - the server status thread, the main thread changes its gid and uid, as do all newly created threads - thereafter. By taking another uid and gid, those threads run with the privileges of the - specified user. - Under Linux and FreeBSD, the server status thread runs with the original privileges only when the strict_setuid option - is set to off (see below, on by default), because these may be needed
- for exec uptests. The manager thread also retains its original privileges in this case.
- You should take care that the user you specify has write permissions on your cache file and
- status pipe (if you need a status pipe). You should look out for error messages like "permission denied"
- and "operation not permitted" to discover permission problems.- |
-
- strict_setuid=(on|off);- When used together with the run_as option, this option lets you specify that all threads of the
- program will run with the privileges of the run_as user. This provides higher security than
- the normal run_as
- option, but is not always possible. See the run_as option for further discussion.- This option is on by default. - Note that this option has no effect on Non-Linux systems. - |
-
- paranoid=(on|off);- Normally, pdnsd queries all servers in recursive mode (i.e. instructs servers to query other servers themselves - if possible, - and to give back answers for domains that may not be in its authority), and accepts additional records with information - for servers that are not in the authority of the queried server. This opens the possibility of so-called cache poisoning: - a malicious attacker might set up a dns server that, when queried, returns forged additional records. This way, he might - replace trusted servers with his own ones by making your dns server return bad IP addresses. This option protects - you from cache poisoning by rejecting additional records - that do not describe domains in the queried servers authority space and not doing recursive queries any more. - An exception - to this rule are the servers you specify in your config file, which are trusted. - The penalty is a possible performance decrease, in particular, more queries might be necessary for the same - operation. - You should also notice that there may be other similar security problems, which are essentially problems of - the DNS, i.e. - any "traditional" server has them (the DNS security extensions solve these problems, but are not widely - supported). - One of this vulnerabilities is that an attacker may bombard you with forged answers in hopes that one may match a - query - you have done. If you have done such a query, one in 65536 forged packets will be succesful (i.e. an average packet - count of 32768 is needed for that attack). pdnsd can use TCP for queries, - which has a slightly higher overhead, but is much less vulnerable to such attacks on sane operating systems. Also, pdnsd - chooses random query ids, so that an attacker cannot take a shortcut. If the attacker is able to listen to your network - traffic, this attack is relatively easy, though. - This vulnerability is not pdnsd's fault, and is possible using any conventional - name server (pdnsd is perhaps a little more secured against this type of attacks if you make it use TCP). - The paranoid option is off by default.- |
-
- ignore_cd=(on|off);- New in version 1.2.8: This option lets you specify that the CD bit of a DNS query will be ignored. - Otherwise pdnsd will reply FORMERR to clients that set this bit in a query. - It is safe to enable this option, as the CD bit refers to 'Checking Disabled' - which means that the client will accept non-authenticated data. - This option is on by default. Turn it off if you want the old behaviour (before version 1.2.8). - |
-
- scheme_file=string;- In addition to normal uptests, you may specify that some servers shall only be queried when a certain - pcmcia-cs scheme is active (only under linux). For that, pdnsd needs to know where the file resides that - holds the pcmcia scheme information. Normally, this is either /var/lib/pcmcia/scheme or
- /var/state/pcmcia/scheme.
- |
-
- status_ctl=(on|off);- This has the same effect as the -s command line option: the status control is enabled when
- on is specified.- Added by Paul Rombouts: Note that pdnsd-ctl allows run-time configuration of pdnsd,
- even the IP addesses of the name servers can be changed. If you're not using pdnsd-ctl and
- you want maximum security, you should not enable this option. It is disabled by default.
- |
-
- daemon=(on|off);- This has the same effect as the -d command line option: the daemon mode is enabled when
- on is specified.- Default is off.
- |
-
- tcp_server=(on|off);- tcp_server=on has the same effect as the -t or --tcp
- command-line option: it enables TCP serving.
- Similarly, tcp_server=off is like the --notcp command-line option.- Default is on.
- |
-
- pid_file=string;- This has the same effect as the -p command line option: you can specify a file that pdnsd
- will write its pid into when it starts in daemon mode.
- |
-
- verbosity=number;- This has the same effect as the -v command line option: you can set the verbosity of pdnsd's
- messages with it. The argument is a number between 0 (few messages) to 3 (most messages).
- |
-
- query_method=(tcp_only|udp_only|tcp_udp|udp_tcp);- This has the same effect as the -m command line option.
- Read the documentation for the command line option on this.
- tcp_only corresponds to the to, udp_only to the uo,
- tcp_udp to the tu and udp_tcp to the ut
- argument of the command line option.- If you use query_method=tcp_udp, it is recommended that you also set the global timeout option to at least twice the longest server timeout.
- |
-
- run_ipv4=(on|off);- This has the same effect as the -4 or -6 command line option:
- if on is specified, IPv4 support is enabled, and IPv6 support is disabled (if available).
- If off is specified, IPv4 will be disabled and IPv6 will be enabled.
- For this option to be meaningful, pdnsd needs to be compiled with support for the protocol you choose.
- If pdnsd was compiled with both IPv4 and IPv6 support, and you want to include IPv6 addresses
- in the configuration file, you will probably need to specify run_ipv4=off first to
- ensure that the IPv6 addresses are parsed correctly.
- |
-
- debug=(on|off);- This has the same effect as the -g command line option: the debugging messages are enabled when
- on is specified.
- |
-
- ctl_perms=number;- This option allows you to set the file permissions that the pdnsd status control socket will have. These - are the same as file permissions. The owner of the file will be the run_as user, or, if none is specified, - the user who started pdnsd. If you want to specify the permissions in octal (as usual), don't forget - the leading zero (0600 instead of 600!). To use the status control, write access is needed. The default - is 0600 (only the owner may read or write). - Please note that the socket is kept in the cache directory, and that the cache directory permissions - might also need to be adjusted. Please ensure that the cache directory is not writeable for untrusted - users. - |
-
- proc_limit=number;- With this option, you can set a limit on the pdnsd threads that will be active simultaneously. If - this number is exceeded, queries are queued and may be delayed some time. - See also the procq_limit option.- The default for this option is 40. - |
-
- procq_limit=number;- When the query thread limit proc_limit is exceeded, connection attempts to pdnsd will be queued.
- With this option, you can set the maximum queue length.
- If this length is also exceeded, the incoming queries will be dropped.
- That means that tcp connections will be closed and udp queries will just be dropped, which
- will probably cause the querying resolver to wait for an answer until it times out.- See also the proc_limit option. A maximum of proc_limit+procq_limit
- query threads will exist at any one time (plus 3 to 6 threads that will always
- be present depending on your configuration).- The default for this option is 60. - |
-
- tcp_qtimeout=timespec;- This option sets a timeout for tcp queries. If no full query has been received on a tcp connection - after that time has passed, the connection will be closed. The default is set using the - --with-tcp-qtimeout option to configure.
- |
-
- par_queries=number;- This option used to set the maximum number of remote servers that would be queried simultaneously, - for every query that pdnsd receives. - Since version 1.1.11, the meaning of this option has changed slightly. - It is now the increment with which the number of parallel queries is - increased when the previous set of servers has timed out. - For example, if we have a list server1, server2, server3, etc. of available servers - and par_queries=2, then pdnsd will first send queries to server1 and server2,
- and listen for responses from these servers.- If these servers do not send a reply within their timeout period, pdnsd will send additional - queries to server3 and server4, and listen for responses from - server1, server2, server3 and server4, and so on until a useful reply is - received or the list is exhausted. - In the worst case there will be pending queries to all the servers in the list of available servers. - We may be using more system resources this way (but only if the first servers in the list - are slow or unresponsive), but the advantage is that we have a greater chance of catching a reply. - After all, if we wait longer anyway, why not for more servers. - See also the explanation of the global timeout option below. - 1 or 2 are good values for this option. - The default is set at compile time using the --with-par-queries option to configure.
- |
-
- timeout=timespec;- This is the global timeout parameter for dns queries. - This specifies the minimum period of time pdnsd will wait after sending the - first query to a remote server before giving up without having - received a reply. The timeout options in the configuration file are - now only minimum timeout intervals. Setting the global timeout option - makes it possible to specify quite short timeout intervals in the - server sections (see below). This will have the effect that pdnsd will start - querying additional servers fairly quickly if the first servers are - slow to respond (but will still continue to listen for responses from - the first ones). This may allow pdnsd to get an answer more quickly in - certain situations. - If you use query_method=tcp_udp it is recommended that
- you make the global timeout at least twice as large as the largest
- server timeout, otherwise pdnsd may not have time to try a UDP query
- if a TCP connection times out.- Default value is 0. - |
-
- randomize_recs=(on|off);- If this option is turned on, pdnsd will randomly reorder the cached records of one type - when creating an answer. This supports round-robin DNS schemes and increases fail - safety for hosts with multiple IP addresses, so this is usually a good idea. - On by default. - |
-
- query_port_start=(number|none);- If a number is given, this defines the start of the port range used for queries of pdnsd. The - value given must be >= 1024. The purpose of this option is to aid certain firewall - configurations that are based on the source port. Please keep in mind that another application - may bind a port in that range, so a stateful firewall using target port and/or process uid may - be more effective. In case a query start port is given pdnsd uses this port as the first port of a - specified port range (see query_port_end) used for queries.
- pdnsd will try to randomly select a free port from this range as local port for the query.- To ensure that there are enough ports for pdnsd to use, the range between query_port_start and
- query_port_end should be adjusted to at least (par_queries * proc_limit).
- A larger range is highly recommended for security reasons, and also because other applications may
- allocate ports in that range. If possible, this range should be kept out of the space
- that other applications usually use.- The default for this option is 1024. Together with the default value of query_port_end,
- this makes it the hardest for an attacker to guess the source port used by the pdnsd resolver.
- If you specify none here, pdnsd will let the kernel choose the source port, but
- this may leave pdnsd more vulnerable to an attack.
- |
-
- query_port_end=number;- Used if query_port_start is not none. Defines the last port of the range started by query_port_start
- used for querys by pdnsd. The default is 65535, which is also the maximum legal value for this option.
- For details see the description of query_port_start.
- |
-
- delegation_only=string;- Added by Paul Rombouts: This option specifies a "delegation-only" zone. - This means that if pdnsd receives a query for a name that is in a - subdomain of a "delegation-only" zone but the remote name server - returns an answer with an authority section lacking any NS RRs for - subdomains of that zone, pdnsd will answer NXDOMAIN (unknown domain). - This feature can be used for undoing the undesired effects of DNS - "wildcards". Several "delegation-only" zones may be specified together. - If you specify root servers in a server section it is
- important that you set root_server=on in such a section.- Example: -
|
-
- ipv4_6_prefix=string;- This option has the same effect as the -i command-line option.
- When pdnsd runs in IPv6 mode, this option specifies the prefix pdnsd uses to convert IPv4 addresses in
- the configuration file (or addresses specified with pdnsd-ctl)
- to IPv6-mapped addresses.
- The string must be a valid IPv6 address. Only the first 96 bits are used.
- Note that this only effects the parsing of IPv4 addresses listed after this option.- The default is "::ffff.0.0.0.0".
- |
-
- use_nss=(on|off);- If this option is turned on, pdnsd will call initgroups() to set up the group access list,
- whenever pdnsd changes its user and group id (see run_as option).
- There is a possible snag, though, if initgroups() uses NSS (Name Service Switch) and
- NSS in turn uses DNS. In such a case you may experience lengthy timeouts and stalls.
- By setting use_nss=off, you can disable the initgroups() call
- (only possible in versions 1.2.5 and later).- This option was contributed by Jan-Marek Glogowski. - On by default. - |
-
- udpbufsize=number;- New in version 1.2.9: - This option sets the upper limit on the size of UDP DNS messages. The default is 1024. - See also the edns_query server option below.
- |
-
-
2.1.2 server Section
- Each server section specifies a set of name servers that pdnsd should try to get
- resource records or authoritative name server information from. The servers are
- queried in the order of their appearance (or parallel to a limited extend).
- If one fails, the next one is taken and so on.- You probably want to specify the dns server in your LAN, the caching dns servers - of your internet provider or even a list of root servers in one or more server sections.
- The supported options in this section are:
- -
- label=string;- Specify a label for the server section. This can be used to refer to this section - when using pdnsd-ctl, the pdnsd control utility.- You can give several server sections the same label, but if you want to change the addresses - of a server section (see ip option below) during run-time with
- "pdnsd-ctl server label up dns1,dns2,...",
- the label must be unique.
- |
-
- ip=string;- Give the IP (the address, not the host name) of the server. - Multiple IP addresses can be given per server section. - This can be done by entering multiple lines of the form ip=string;
- or a single line like this:
-
pdnsd-ctl,
- the pdnsd control utility.- If pdnsd has been compiled with both IPv4 and IPv6 support, any IPv6 addresses you specify - here will be skipped with a warning message, unless pdnsd is running in IPv6 mode. - Thus, unless pdnsd was compiled to startup in IPv6 mode by default, you need to use the - command-line option -6 or set run_ipv4=off
- first (see global section) in order to ensure
- that IPv6 addresses are parsed correctly.- If pdnsd is running in IPv6 mode and you specify an IPv4 address here, - it will automatically be mapped to an IPv6 address. - |
-
- file=string;- New in version 1.2: This option allows you to give the name of a resolv.conf-style file.
- Of the lines beginning with the nameserver keyword, the second field will be parsed as an
- IP address, as if it were specified with the ip= option. The remaining lines will be ignored.
- If the contents of the file changes while pdnsd is running, you can make pdnsd aware of the changes through the
- use of pdnsd-ctl, the pdnsd control utility.
- This is usually most conveniently done by placing the command "pdnsd-ctl config" in a script
- that is automatically run whenever the DNS configuration changes.- For example, suppose you have a ppp client that writes the DNS configuration for your ISP to the file - /etc/ppp/resolv.conf and runs the script /etc/ppp/ip-up when a new
- connection is established. One way of ensuring that pdnsd is automatically reconfigured is to
- add a server section in the config file with file=/etc/ppp/resolv.conf and to
- add the command "pdnsd-ctl config" to /etc/ppp/ip-up.
- |
-
- port=number;- Give the port the remote name server listens on. Default is 53 (the official - dns port) - |
-
- uptest=(ping|none|if|dev|diald|exec|query);- Determine the method to check whether the server is available. Currently - defined methods are: - -
- The default value is |
-
- ping_timeout=number;- Sets the timeout for the ping test in tenths of seconds - (this unit is used for legacy reasons; actually the current implementation is - only accurate to a second). - The default is 600 (one minute). - |
-
- ping_ip=string;- The IP address for the ping test. The default is the IP of the name server. - |
-
- query_test_name=string;- New in version 1.2.9: - Sets the name to be queried when using uptest=query availability test.
- If the string is the unquoted constant none,
- an empty query is used (this the default), otherwise a query of type A will be
- sent for the domain name specified here. It is not necessary for the domain name
- to exist or have a record of type A in order for the uptest to succeed.- If the the remote server ignores empty queries, you will probably want to set - query_test_name="." (the root domain).
- |
-
- uptest_cmd=string,string;- or - uptest_cmd=string;- Sets the command for the uptest=exec function to the first string. - If the second string is given, it specifies a user with whose user - id and primary group id the command is executed. - This is especially useful if you are executing the server as root, - but do not want the uptest to be performed with root privileges. - In fact, you should never execute the uptest as root if you can help - it. - If the server is running setuid or setgid, the privileges thus gained - are attempted to be dropped even before changing identity to the - specified user to prevent setuid/gid security holes (otherwise, any - user might execute commands as root if you setuid the executable). - Note that this is not always possible, and that pdnsd should never - be installed as setuid or setgid. - The command is executed using /bin/sh, so you should be able to use
- shell builtin commands.
- |
-
- interval=(timespec|onquery|ontimeout);- Sets the interval for the server up-test. The default is 900 seconds; - however, a test is forced when a query times out and the timestamp is reset then. - If you specify onquery instead of a timeout, the interface will be
- tested before every query. This is to prevent automatically dialing
- interfaces (diald/pppd or ippp) to dial on dns queries. It is intended to be
- used in connection with an interface-testing uptest ;-) - Note that using uptest=exec, you might run into performance problems - on slow machines when you use that option. - DON'T use onquery with uptest=ping or
- uptest=query, as it may cause delays if the server does not answer
- (btw, it doesn't make sense anyway).
- Note also that using onquery is no guarantee that the interface
- will not be used. When another (reachable) dns server tells pdnsd
- to query a third dns server for data, pdnsd will do that and has
- no means of checking whether this will dial up the interface or not.
- This however should be a rare situation.- New in version 1.2.3: - A third possibility is to specify interval=ontimeout.
- In this case the server is not tested at startup/reconfiguration, nor at regular intervals,
- but only after a DNS query to a server times out. Certain types of network problems
- such as a refused connection will also cause the server to be considered unavailable.
- However, once a server is declared dead it is never considered again unless it is revived using a
- pdnsd-ctl config or server command.
- The idea behind this option is to minimize uptests by assuming all
- servers are available until there is reason to believe otherwise.
- |
-
- interface=string;- The network interface (or network device, e.g. "eth0") for the uptest=if option.
- Must be specified if uptest=if is given.
- |
-
- device=string;- The (modem-) device that is used for the dev uptest. If you use this for a dial-on-demand
- ppp uptest (together with uptest=dev), you need to enter the device you are using for your
- pppd here, e.g. modem for /dev/modem.- Must be specified if uptest=dev is given.
- |
-
- timeout=timespec;- Set the timeout for the dns query. The default is 120 seconds. You probably want to set this lower. - Timeouts specified in the configuration file are only treated as the - minimum period of time to wait for a reply. A queries to a remote - server are not canceled until a useful reply has been received, or all - the other queries have timed out or failed. - If you have also set the global timeout option, you may consider setting a fairly small value here. - See the explanation of the timeout option in the global
- section for what that means.
- |
-
- purge_cache=(on|off);- In every fetched dns record, there is a cache timeout given, which - specifies how long the fetched data may be cached until it needs to be - reloaded. If purge_cache is set to off, the stale records are not purged
- (unless the cache size would be exceeded, in this case the oldest records are purged).
- Instead, they are still served if they cannot succesfully be
- updated (e.g. because all servers are down).- Default is off.
- |
-
- caching=(on|off);- Specifies if caching shall be performed for this server at all. Default is - on.
- |
-
- lean_query=(on|off);- Specifies whether to use the "lean" query mode. In this mode, only the - information actually queried from pdnsd is resolved and cached. This has - the advantage that usually less cache space is used and the query is - usually faster. In 90% of the cases, only address (A) records are needed - anyway. If switched off, pdnsd will always cache all data about a host - it can find and will specifically ask for all available records - (well, at least it is a good approximation for what it really does ;-) - This will of course increase the answer packet sizes. - Some buggy name servers may not deliver CNAME records when not asked for - all records. I do not know if such servers are around, but if you have - trouble resolving certain host names, try turning this option off. - A last note: If you use multiple pdnsd's that access each other, turning - this option on is probably a big win. - This on by default. - |
-
- edns_query=(on|off);- New in version 1.2.9: - Specifies whether to use EDNS (Extension mechanisms for DNS) for outgoing queries. - Currently this is only useful for allowing UDP message sizes larger than 512 bytes. - Note that setting this option on can give problems in combination with some legacy - systems or software, including, embarrassingly enough, previous versions of pdnsd. - The default is off, but if your network can handle UDP payloads
- significantly larger than 512 bytes, the recommended value is on.- Note that this option only effects outgoing queries. If pdnsd receives a query using - EDNS, it will reply using EDNS regardless of the value of this option. - - See also the udpbufsize option above.
- |
-
- scheme=string;- You can specify a pcmcia-cs scheme that is used in addition to the uptests. If you specify - a scheme here, the server this section is for will only be queries if the given scheme - is active. Shell wildcards (* and ?) are allowed in the string under their special - meanings. You need to use the scheme_file option on the global
- section to make this option work.
- |
-
- preset=(on|off);- This allows you to specify the initial state of a server before any uptest is performed. - on specifies that the server is regarded available. The default is on.
- This is especially useful when you set uptest=none; and want to change
- the status of a server only via pdnsd-ctl.
- |
-
- proxy_only=(on|off);- When this option is set to on, answers given by the servers are always accepted, and no
- other servers (as, for example, specified in the NS records of the query domain) are
- queried. If you do not turn this option on, pdnsd will do such queries in some cases
- (in particular when processing ANY queries).- This option is useful when you do not want pdnsd to make connections to outside servers - for some reasons (e.g. when a firewall is blocking such queries). - I recommend that you turn on lean_query when using this option.- Default is off.
- |
-
- root_server=(on|off|discover);- Set this option to on if the servers specified in a section are root servers.
- A root server will typically only give the name servers for the top-level domain in its reply.
- Setting root_server=on will cause pdnsd to try to use cached information about
- top-level domains to reduce to number of queries to root servers, making the resolving of
- new names more efficient.
- You can get a list of available root servers by running the command
- "dig . ns".- This option is also necessary if you use the delegation_only option.- New in version 1.2.8: This option may also be set to " discover".
- This will cause pdnsd to query the servers provided with the ip= option
- to obtain the full list of root servers. The root-server addresses will replace the addresses
- specified with the ip= option.
- This will only be done once on startup, or after a "pdnsd-ctl config" command.
- In this case the name servers specified with the ip= option don't have to be
- root servers, they just have to know the names and addresses of the root servers.
- After root-server discovery pdnsd will behave just as if root_server=on
- had been specified.- Default is off.
- |
-
- randomize_servers=(on|off);- New in version 1.2.6: Set this option to on to give each name server
- in this section an equal chance of being queried. If this option is off, the name servers
- are always queried starting with the first one specified. Even with this option on, the
- query order is not truly random. Only the first server is selected randomly; the following
- ones are queried in consecutive order, wrapping around to the beginning of the list when
- the end is reached. Note that this option only effects the order within a section. The
- servers in the first (active) section are always queried before those in the second one,
- etc.The default is off, but if you are resolving from root servers setting this - option on is highly recommended. If root_server=on this option also effects
- the query order of the name servers for the top-level domains.
- |
-
- reject=string;- New in version 1.2.6: This option can be used to make pdnsd reject replies that - contain certain IP addresses. You can specify a single IP address, which will be matched - exactly, or a range of addresses using an address/mask pair. - The mask can be specified as a simple integer, indicating the number of initial 1 bits in - the mask, or in the usual IP address notation. IP addresses may be either IPv4 or IPv6 - (provided there is sufficient support in the C libraries and support for AAAA records was - not disabled). - When addresses in the reject list are compared with those in a reply, only the bits - corresponding to those set in the netmask are significant, the rest are ignored. - Multiple addresses or address/mask pairs may be specified; this can be done by entering - multiple lines of the form reject=string;
- or a single line like this:
-
reject list,
- depends on the reject_policy option, see below.
- |
-
- reject_policy=(fail|negate);- New in version 1.2.6: - This option determines what pdnsd does when an address in the reply from a name server - matches the reject list (see above). If this option is set to
- fail, pdnsd will try another server, or, if there no more servers to try,
- return the answer SERVFAIL. If this option is set to negate, pdnsd will
- immediately return the answer NXDOMAIN (unknown domain) without querying additional
- servers. The fail setting is useful if you don't always trust the servers in
- this section, but do trust the servers in the following section. The negate
- setting can be used to completely censor certain IP addresses. In this case you should put
- the same reject list in every server section, and also set the
- reject_recursively option (see below) to true.- The default is fail.
- |
-
- reject_recursively=(on|off);- New in version 1.2.6: Normally pdnsd checks for addresses in the - reject list (see above) only when the reply comes directly from a name server
- listed in the configuration file. With this option set to on, pdnsd will
- also do this check for name servers that where obtained from NS records in the authority
- section of a previous reply (which was incomplete and non-authoritative).- Default is off.
- |
-
- policy=(included|excluded|simple_only|fqdn_only);- pdnsd supports inclusion/exclusion lists for server sections: with include=
- and exclude= (see below) you can specify domain names for which this server
- will be used or will not be used. The first match counts (i.e., the first include or
- exclude rule in a server section that matches a domain name is applied, and the
- search for other rules is terminated). If no rule matched a given domain name,
- the policy= option determines whether this server is used for the
- lookup for that domain name; when included is given, the server will
- be asked, and when excluded is given, it will not.
- If simple_only is given the server will be used if the name to lookup
- is a simple (single-label) domain name, on the other hand if fqdn_only
- is given the server will be used only for names consisting of two or more labels
- (i.e. the name has at least one dot in-between).- If no server is available for a queried domain, pdnsd will return an error message - to the client that usually will stop the client's attempts to resolve a specific - domain from this server (the libc resolver will e.g. return an error to the application that - tried to resolve the domain if no other servers are available in the resolv.conf).
- This may be of use sometimes.- Note: the simple_only and fqdn_only constants
- were added by Paul Rombouts.
- They are useful for controlling which name servers (if any) will be used by
- pdnsd for resolving simple (single-label) host names.
- fqdn_only used to stand for "fully qualified domain name only", but this is
- actually a misnomer. The names in queries received by pdnsd are always considered to be
- fully qualified. If you do not exactly understand what the options simple_only and
- fqdn_only are good for, you are probably better off not using them.- The default for this option is included.
- |
-
- include=string;- This option adds an entry to the exclusion/inclusion list. If a domain matches - the name given as string, the server is queried if this was the first matching rule - (see also the entry for policy).- If the given name starts with a dot, the whole subdomain - of the given name including the one of that name is matched, e.g. ".foo.bar."
- will match the domain names a.foo.bar., a.b.c.foo.bar. and foo.bar.- If it does not start in a dot, only exactly the given name (ignoring the case, of course) - will be matched (hint: if you want to include all subdomains, but not the domain of the given - name itself, place an exact-match exclude rule before the include rule, e.g: - exclude="foo.bar."; include=".foo.bar.";- Previous versions of pdnsd - required that names given with this and the next option ended in a dot, but since - version 1.1.8b1-par8, pdnsd automatically adds a dot at the end if it - is missing. - pdnsd now also accepts a more compact notation for adding several "include" entries in
- one line, e.g.:
-
|
-
- exclude=string;- This option adds an entry to the exclusion/inclusion list. If a domain matches - the name given as string, the server is not queried if this was the first matching rule - (see also the entry for policy).- If the given name starts with a dot, the whole subdomain - of the given name including the one of that name is matched, e.g. ".foo.bar."
- will match the domain names a.foo.bar., a.b.c.foo.bar. and foo.bar.- If it does not start in a dot, only exactly the given name (ignoring the case, of course) - will be matched (hint: if you want to exclude all subdomains, but not the domain of the given - name itself, place an exact-match include rule before the exclude rule, e.g: - include="foo.bar."; exclude=".foo.bar.";- pdnsd now also accepts a more compact notation for adding several "exclude" entries in
- one line, e.g.:
-
|
-
-
2.1.3 rr Section
- Every rr section specifies a dns resource record that is stored locally. It
- allows you to specify own dns records that are served by pdnsd in a limited way.
- Only A, PTR, CNAME, MX, NS and SOA records are implemented.- This option is intended to allow you to define RRs for 1.0.0.127.in-addr.arpa. - and localhost. (and perhaps even one or two hosts) without having to start an - extra named if your cached name servers do not serve those records. - It is NOT intended and not capable to work as a full-featured name server. -
-
- name=string;- Specifies the name of the resource records, i.e. the domain name of - the resource the record describes. This option must be specified - before any a, ptr, cname,
- mx, ns or soa records.
- Names are interpreted as absolute domain names
- (i.e. pdnsd assumes they end in the root domain).
- For this and all following arguments that take domain names, you need to
- specify domain names in dotted notation (example venera.isi.edu.).- Previous versions of pdnsd - required that domain names given in the configuration file ended in a - dot, but since version 1.1.8b1-par8, pdnsd automatically assumes a - dot at the end if it is missing. - New in version 1.2: It is also possible to specify a name starting - with the label *. Such a name is called a wildcard. The * in a wildcard - can match one or more labels in a queried name, but only whole labels. - Any other * characters in a wildcard, apart from the leading one, - will only match a literal *. - For example, *.mydomain will match a.mydomain or www.a.mydomain, but not - mydomain. *.a*.mydomain will match www.a*.mydomain, but not www.ab.mydomain. - *a.mydomain will only match itself. - Before you can specify an rr section with name=*.mydomain
- you must define some records for mydomain, typically NS and/or SOA records.
- Example:
-
- rr {
- name = mydomain;
- ns = localhost;
- soa = localhost, root.localhost, 42, 86400, 900, 86400, 86400;
- }
- rr {
- name = *.mydomain;
- a = 192.168.1.10;
- }
- In this example, www.mydomain and ftp.mydomain will resolve to the numeric
- address 192.168.1.10 (unless you add rr sections explicitly
- specifying different addresses for www.mydomain or ftp.mydomain).
- If you want mydomain also to resolve to a numeric address,
- add an A record to the first rr section.
- |
-
- ttl=timespec;- Specifies the ttl (time to live) for all resource records in this section after this entry. - This may be redefined. The default is 86400 seconds (=1 day). - |
-
- authrec=(on|off);- If this is turned on, pdnsd will create authoritative local records for this rr section.
- This means that pdnsd flags the domain record so that records of this domain that are not
- present in the cache are treated as non-existent, i.e. no other servers are queried for
- that record type, and an response containing none of those records is returned. This is
- most time what people want: if you add an A record for a host, and it has no AAAA record
- (thus no IPv6 address), you normally don't want other name servers to be queried for it.- This is on by default. - Please note that this only has an effect if it precedes the name option!
- |
-
- reverse=(on|off);- New in version 1.2: If you want a locally defined name to resolve to a numeric address - and vice versa, you can achieve this by setting reverse=on before defining the A record - (see below). The alternative is to define a separate PTR record, but you will - probably find this option much more convenient. - The default is off.
- |
-
- a=string;- Defines an A (host address) record. The argument is an IPv4 address in dotted notation. - pdnsd will serve this address for the host name given in the name option.- Provided there is sufficient support in the C libraries and support for AAAA records was not - disabled, the argument string may also be an IPv6 address, in which case an AAAA record - will be defined. - This option be may used multiple times within an rr section, causing
- multiple addresses to be defined for the name. However, if you put the different addresses
- in different rr sections for the same name, the definition in the last
- rr section will cancel the definitions in the previous ones.
- |
-
- ptr=string;- Defines a PTR (domain name pointer) record. The argument is a host name in - dotted notation (see name). The ptr record is for resolving adresses into names. For example, if - you want the adress 127.0.0.1 to resolve into localhost, and localhost into 127.0.0.1, you need something - like the following sections: -
- rr {
- name = localhost;
- a = 127.0.0.1;
- owner = localhost;
- soa = localhost, root.localhost, 42, 86400, 900, 86400, 86400;
- }
- rr {
- name = 1.0.0.127.in-addr.arpa;
- ptr = localhost;
- owner = localhost;
- soa = localhost, root.localhost, 42, 86400, 900, 86400, 86400;
- }
- The second section is for reverse resolving and uses the ptr option.
- Note that you can get the same effect by specifying only the first rr section
- with reverse=on.- There is something special about the name in the second section: - when a resolver wants to get a host name from an internet address, - it composes an address that is built of the IP address in reverse byte order - ( 1.0.0.127 instead of 127.0.0.1) where each byte of the adress written
- as number constitutes a sub-domain under the domain in-addr.arpa. - So, if you want to compose an adress for reverse resolving, take your ip in dotted notation (e.g. 1.2.3.4),
- reverse the byte order (4.3.2.1) and append in-addr.arpa. (4.3.2.1.in-addr.arpa.)
- Then, define an rr section giving this address as name and the domain name corresponding to
- that ip in the ptr option.
- |
-
- cname=string;- Defines a CNAME (canonical name) record. - The argument should be a fully-qualified host name in dotted notation (see name). - A CNAME is the DNS equivalent of an alias or symbolic link. - A useful application for CNAMEs is giving short, easy to remember nicknames to hosts with complicated names. - For example, you might want the name "news" to refer to your ISP's news server "nntp2.myisp.com". - Instead of adding an A record for "news" with the same address as "nntp2.myisp.com", you could - put in a CNAME pointing to "nntp2.myisp.com", so that if the IP address of the news server changes, - there is no need to update the record for "news". - To implement this with pdnsd, you could add the following section to your configuration file: -
- rr {
- name = news;
- cname = nntp2.myisp.com;
- owner = localhost;
- }
- |
-
- mx=string,number;- Defines an MX (mail exchange) record. The string is the host name of the mail server in dotted notation (see name). - The number specifies the preference level. - When you send mail to someone, your mail typically goes from your E-mail client to an SMTP server. - The SMTP server then checks for the MX record of the domain in the E-mail address. - For example, with joe@example.com, it would look for the MX record for example.com and find - that the name of mail server for that domain is, say, mail.example.com. - The SMTP server then gets the A record for mail.example.com, and connects to the mail server. - If there are multiple MX records, the SMTP server will pick one based on the preference level - (starting with the lowest preference number, working its way up). - Don't define MX records with pdnsd unless you know what you're doing. - |
-
- owner=string;- or - ns=string;- Defines an NS (name server) record. Specifies the name of the host which should be authoritative for the records - you defined in the rr section. This is typically the host pdnsd runs on.- Note: In previous versions of pdnsd this option had to be specified before - any a, ptr, cname, mx or soa entries.
- In version 1.2, the restrictions on this option are same as the options just mentioned,
- and it must listed after the name= option.
- This can be a pain if you want to use an old config file which specifies owner=
- before name= (sorry about that).
- Apart from greater consistency, the advantage is that you can now specify as many NS records as you like (including zero).
- |
-
- soa=string,string,number,timespec,timespec,timespec,timespec;- This defines a soa (start of authority) record. The first string is the - domain name of the server and should be equal to the name you specified as - owner. - The second string specifies the email address of the maintainer of the name - server. It is also specified as a domain name, so you will have to replace the - @ sign in the name with a dot (.) to get the name you have to specify here. - The next parameter (the first number) is the serial number of the record. You - should increment this number if you change the record. - The 4th parameter is the refresh timeout. It specifies after what amount - of time a caching server should attempt to refresh the cached record. - The 5th parameter specifies a time after which a caching server should attempt - to refresh the record after a refresh failure. - The 6th parameter defines the timeout after which a cached record expires if it - has not been refreshed. - The 7th parameter is the ttl that is specified in every rr and should be the - same as given with the ttl option (if you do not specify a ttl, use the default 86400). - |
-
- txt=string,...,string;- New in version 1.2.9: - Defines an TXT record. You can specify one or more strings here. - |
-
-
2.1.4 neg Section
- Every neg section specifies a dns resource record or a dns domain that should be
- cached negatively locally. Queries for negatively cached records are always answered
- immediatley with an error or an empty answer without querying other hosts as long
- as the record is valid. The records defined with neg sections remain
- valid until they are explicitely invalidated or deleted by the user using
- pdnsd-ctl.- This is useful if a certain application asks periodically for nonexisting hosts or - RR types and you do not want a query to go out every time the cached record has - timed out. Example: Netscape Communicator will ask for the servers news and mail - on startup if unconfigured. If you do not have a dns search list for your network, - you can inhibit outgoing queries for these by specifying
-
- neg {
- name = news;
- types = domain;
- }
- neg {
- name = mail;
- types = domain;
- }
- in your config file. If you have a search list, you have to repeat that for any
- entry in your search list in addition to the entries given above!- In versions 1.1.11 and later, if you negate whole domains this way, all subdomains - will be negated as well. Thus if you specify
-
neg {name=example.com; types=domain;} in the
- config file, this will also negate www.example.com, xxx.adserver.example.com, etc.
- -
- name=string;- Specifies the name of the domain for which negative cache entries are created. - This option must be specified before the types option. - Names are interpreted as absolute domain names (i.e. pdnsd - assumes they end in the root domain). - You need to specify domain names in dotted notation (example venera.isi.edu.). - Previous versions of pdnsd - required that domain names given in the configuration file ended in a - dot, but since version 1.1.8b1-par8, pdnsd automatically assumes a - dot at the end if it is missing. - |
-
- ttl=timespec;- Specifies the ttl (time to live) for all resource records in this section after this entry. - This may be redefined. The default is 86400 seconds (=1 day). - |
-
- types=(domain|rr_type[,rr_type[,rr_type[,...]]]);- Specifies what is to be cached negatively: domain will cache the whole
- domain negatively; alternatively, you can specify a comma-separated list of RR types
- which are to be cached negatively. You may specify multiple types options, but
- domain and the RR types are mutually exclusive.- The RR types are specified using their official names from the RFC's in capitals, - e.g. A, CNAME, NS, PTR, MX,
- AAAA, ...- The command pdnsd-ctl list-rrtypes will give you a complete list
- of those types. pdnsd-ctl is built along with pdnsd
- and will be installed in the same directory as the pdnsd binary during make install.
- |
-
-
2.1.5 source Section
- Every source section allows you to let pdnsd read the records from a file in an
- /etc/hosts-like format. pdnsd will generate records to resolve the entries
- address from its host name and vice versa for every entry in the file. This is
- normally easier than defining an rr for every of your addresses, since localhost
- and your other FQDNs are normally given in /etc/hosts.- The accepted format is as follows: The #-sign initiates a comment, the rest of - the line from the first occurence of this character on is ignored. Empty lines - are tolerated.
- The first entry on a line (predeceded by an arbitrary number of tabs and spaces) - is the IP in dotted notation, the second entry on one line (separated by the - first by an arbitrary number of tabs and spaces) is the FQDN (fully qualified - domain name) for that ip. The rest of the line is ignored by default (in the original -
/etc/hosts, it may contain information not needed by pdnsd).
- -
- owner=string;- Specifies the name of the host pdnsd runs on and that are specified in dns - answers (specifically, nameserver records). - Must be specified before any file entries. - Names are interpreted as absolute domain names (i.e. pdnsd - assumes they end in the root domain). - You need to specify domain names in dotted notation (example venera.isi.edu.). - Previous versions of pdnsd - required that domain names given in the configuration file ended in a - dot, but since version 1.1.8b1-par8, pdnsd automatically assumes a - dot at the end if it is missing. - |
-
- ttl=timespec;- Specifies the ttl (time to live) for all resource records in this section after - this entry. This may be redefined. The default is 86400 seconds (=1 day). - |
-
- file=string;- The string specifies a file name. For every file entry in a source section, - pdnsd will try to load the given file as described above. Failure is indicated - only when the file cannot be opened, malformed entries will be ignored. - |
-
- serve_aliases=(on|off);- If this is turned on pdnsd will serve the aliases given in a hosts-style file.
- These are the third entry in a line of a hosts-style file, which usually give a "short name" for the host.
- This may be used to support broken clients without a proper domain-search option.
- If no aliases are given in a line of the file, pdnsd behaves as without this option for this line.- This feature was suggested by Bert Frederiks. - It is off by default. - |
-
- authrec=(on|off);- If this is turned on, pdnsd will create authoritative local records with the data from the hosts file. - Please see the description of the option of the same name in the rr section for a closer description of - what this means. Please note that this only has an effect for files sourced with file options
- subsequent to this option.- This is on by default. - |
-
-
2.1.6 include Section
- A configuration file may include other configuration files.
- However, only the top-level configuration file may contain global
- and server sections,
- thus include files are effectively limited to sections that add local definitions to the cache.- Include sections currently only have one type of option, which may be given multiple times within a single section. -
-
- file=string;- The string specifies a file name. For every file option in an include section,
- pdnsd will parse the given file as described above. The file may contain include sections itself,
- but as a precaution pdnsd checks that a certain maximum depth is not exceeded to guard against
- the possibility of infinite recursion.
- |
-
-
3 pdnsd-ctl
-
- pdnsd-ctl allows you to configure pdnsd at run time. To make this work, you have to start pdnsd with the -s
- option (or use the status_ctl option in the config file). You also should make sure that you
- have appropriate permissions on the control socket (use the ctl_perms option to make this sure) and of your pdnsd
- cache directory (pdnsd keeps its socket there). Please make sure the pdnsd cache directory is not writeable for untrusted users!
- pdnsd-ctl accepts two command-line options starting with a dash.
- -c may be used to specify the cache directory (and takes this as argument).
- The default for this setting is the pdnsd default cache directory (specified at compile time).
- The cache directory for pdnsd-ctl must be the same pdnsd uses!
- -q can be used to make the output of pdnsd-ctl less verbose.
- The following table lists the commands that pdnsd-ctl supports. The command must always be
- the first command-line option (not starting with a dash), the arguments to the command must follow in the given order.
- In the following table, keywords are in a normal font, while placeholders are in italics.
- Alternatives are specified like (alt1|alt2|alt3).
- Optional arguments are placed between square brackets [].
| Command | -Arguments | -Description | -
| help | -- | Print a command summary. | -
| version | -- | Print version and license info. | -
| status | -- | - Print a description of pdnsd's cache status, thread status and configuration. - Also shows which remote name servers are assumed to be available. - | -
| server | -(index|label) (up|down|retest) [dns1[,dns2[,...]]] | -
- Set the status of the server with the given index or label (where the given label
- matches the one given with the label option in the respective server section in the config file)
- to up or down, or force a retest. The index is assigned in the order of definition in
- pdnsd.conf starting with 0. Use the status command to view the indices and labels.
- You can specify all instead of an index or label to perform the action for all
- servers registered with pdnsd. Example:- pdnsd-ctl server 0 retest- An optional third argument consisting of a list of IP addresses (separated by commas or - white-space characters) can be given. - This list will replace the previous list of addresses of name servers used by pdnsd in the - specified section of the config file. - For example in the /etc/ppp/ip-up script called by pppd you could
- place the following line:- pdnsd-ctl server isplabel up $DNS1,$DNS2- If white space is used to separate addresses the list will have to be quoted. - Spurious commas and white-space characters are ignored. - The last argument may also be an empty string, in which case the existing IP addresses are - removed and the corresponding server section becomes inactive. - |
-
| record | -name (delete|invalidate) | -
- Delete or invalidate the records of the given domain name if it is in the
- cache. Invalidation means that the records are marked as timed out, and
- will be reloaded if possible (if purge_cache is set to on, they will
- be deleted in any case). - For local records (i.e., records that were given in the config file - using a rr section, records read from a hosts-style file
- and records added using pdnsd-ctl), invalidation has no effect. Deletion
- will work, though. Example:- pdnsd-ctl record localhost. delete
- |
-
| source | -fn owner [ttl] [(on|off)] [noauth] | -
- Load a hosts-style file. Works like using the pdnsd
- source configuration section.
- owner and ttl are used as in the source section. ttl has a default
- of 900 (it does not need to be specified). The next to last argument corresponds
- to the serve_aliases option, and is off by default (i.e. if it is not specified).
- noauth is used to make the domains non-authoritative - please see
- the description of the authrec config file options for a description of what
- that means.
- fn is the filename. The file must be readable by pdnsd! Example:- pdnsd-ctl source /etc/hosts localhost. 900 off
- |
-
| add | -a addr name [ttl] [noauth] | -
- Add a record of the given type to the pdnsd cache, replacing existing
- records for the same name and type. The 2nd argument corresponds
- to the value of the option in the rr section that is named like
- the first argument: a is a record for hostname-to-address mapping,
- aaaa is the same thing for IPv6 addresses, and ptr is for address-to-hostname
- mapping. See the documentation for the rr section for more details.
- In case of A and AAAA records, the addr argument may be a list of IP addresses,
- separated by commas or white space, causing multiple addresses to be defined
- for the same name.
- The ttl is optional, the default is 900 seconds.
- noauth is used to make the domains non-authoritative - please see
- the description of the authrec config file options for a description of what
- that means.
- If you want no other record than the newly added in the cache, do- pdnsd-ctl record name delete
- before adding records. This is also better when overwriting local records. Example:- pdnsd-ctl add a 127.0.0.1 localhost. 900
- |
-
| add | -aaaa addr name [ttl] [noauth] | -|
| add | -ptr host name [ttl] [noauth] | -|
| add | -cname host name [ttl] [noauth] | -|
| add | -mx host name pref [ttl] [noauth] | -|
| add | -ns host name [ttl] [noauth] | -|
| neg | -name [type] [ttl] | -
- Add a negatively cached record to pdnsd's cache, replacing existing
- records for the same name and type. If no type is given, the whole
- domain is cached negatively. For negatively cached records, errors are
- immediately returned on a query, without querying other servers first.
- The ttl is optional, the default is 900 seconds. - You can get a list of all types you can pass to this command using - pdnsd-ctl list-rrtypes. The type is treated case-sensitive!
- Example:- pdnsd-ctl neg foo.bar A 900- pdnsd-ctl neg foo.baz 900- |
-
| config | -[filename] | -
- Reload pdnsd's configuration file. - The config file must be owned by the uid that pdnsd had when it was - started, and be readable by pdnsd's run_as uid. If no file name is
- specified, the config file used at start-up is reloaded.- Note that some configuration changes, like the port or IP address pdnsd listens on, - cannot be made this way and you will receive an error message. - In these cases, you will have to restart pdnsd instead. - |
-
| include | -filename | -
- Parse the given file as an include file, see the documentation on
- include sections for a description
- what this file may contain. - This command is useful for adding definitions to the cache without reconfiguring pdnsd. - |
-
| eval | -string | -
- Parse the given string as if it were part of pdnsd's configuration file.
- The string should hold one or more complete configuration sections.
- However, global and
- server sections are not allowed,
- just as in include files.
- If multiple strings are given, they will be joined using newline chars
- and parsed together.- This command is useful for adding records interactively to the cache - that cannot be defined using the " pdnsd-ctl add" command,
- (e.g. soa records).
- |
-
| empty-cache | -[[+|-]name ...] | -
- If no arguments are provided, the cache will be completely emptied,
- freeing all existing entries.
- Note that this also removes local records, as defined by the config file.
- To restore local records, run "pdnsd-ctl config" or
- "pdnsd-ctl include filename" immediately afterwards.- The "pdnsd-ctl empty-cache" command now accepts additional arguments;
- these are interpreted as include/exclude names. If an argument starts with a '+'
- the name will be included. If an argument starts with a '-' it will be
- excluded. If an argument does not begin with '+' or '-', a '+' is
- assumed. If the domain name of a cache entry ends in one of the names in
- the list, the first match will determine what happens. If the matching
- name is to be included, the cache entry is deleted, otherwise not.
- If there are no matches, the default action is not to delete.
- Note that if you want to delete exactly one name and no others, you should
- use "pdnsd-ctl record name delete",
- this is also much more efficient.- Examples: - pdnsd-ctl empty-cache- This command will remove all cache entries. - - pdnsd-ctl empty-cache microsoft.com msft.net- This will remove all entries ending in microsoft.com or msft.net. - - pdnsd-ctl empty-cache -localdomain -168.192.in-addr.arpa .- This will remove all entries except those ending in localdomain or - 168.192.in-addr.arpa. Note that '.' is the root domain which matches any - domain name. - |
-
| dump | -[name] | -
- Print information stored in the cache about name.
- If name begins with a dot and is not the root domain, information about
- the names in the cache ending in name (including name without
- the leading dot) will be printed.
- If name is not specified, information about all the names in the cache will
- be printed. - For each RR record the time and date that this record has been added to the cache - will be printed in the form mm/dd HH:MM:SS (locally defined records are printed without a time stamp). - After that the type of record is printed with the data. For the more common types - of RR records the data will be printed in human readable form, the remaining ones in a - hexadecimal representation. - This command is mainly useful for diagnostic purposes. - Note that if you pipe the output of this command through an application that - reads only part of the output and then blocks (such as more or less),
- pdnsd will not be able to add new entries to the cache until the pipe is closed.
- It is preferable to capture the output in a file in such a case.
- |
-
| list-rrtypes | -- | - List available rr types for the neg command. - Note that those are only used for the neg command, not for add! - | -
-
-
4 contrib/
- The contrib directory in the pdnsd distribution contains useful user-contributed scripts.- So far, there are scripts contributed by Marko Stolle and Paul Rombouts that make pdnsd - usable in a DHCP setup. - Please take a look into the README file in the contrib directory for further information. -
-
-
5 Problems...
- If you have problems with configuring or running pdnsd, be sure to read the FAQ. - If this does not help you, pdnsd crashes or you find bugs, please mail one of the authors.- Note added by Paul A. Rombouts: - Thomas Moestl no longer maintains the code. I have revised the code and added new features. - See
README.par and the
- ChangeLog in the source directory
- (or /usr/share/doc/pdnsd-<version> if you have installed a binary package)
- for more details.
- If you have questions about my modifications, you can find my email address at the end of
- README.par.
- -
-
6 Hacking
- Here comes some information you might find useful for hacking pdnsd. --
6.1 Source files
-| Makefile.am, configure.in, acconfig.h | -- autoconf/automake/autoheader scripts. Makefile.am's are in most subdirectories. - | -
| pdnsd.spec.in | -- A template from which configure generates a spec file for building rpm's for various - distributions. - | -
| version | -- Contains only the program version string. Needed for several templates. - | -
| src/rc/* | -- rc (start-up) scripts for various linux distributions. - | -
| src/cache.c | -- The pdnsd cache subsystem(s) as defined in src/cache.h. - This is the "traditional" pdnsd system which keeps the cache in memory and uses hash tables for accesses. - Sourav K. Mandal is working on a system using gdbm. - | -
| src/pdnsd-ctl/* | -- Contains the code for pdnsd-ctl, a program that allows you to control pdnsd at run time. - | -
| src/conf-lex.l.in | -- The lex/flex source file for the config file lexer. This is a template because there might be - inserted "%option yylineno" for proper flex support. - (obsolete, superseded by src/conf-parser.c) - | -
| src/conf-lex.l | -- This is automatically generated by configure from conf-lex.l.in. It may be overwritten - in any make, so never modify this, but conf-lex.l.in instead! - (obsolete, superseded by src/conf-parser.c) - | -
| src/conf-parse.y | -- The yacc/bison source of the config file parser. - (obsolete, superseded by src/conf-parser.c) - | -
| src/conf-parser.c, src/conf-parser.h, src/conf-keywords.h | -- The config file parser written purely in C (versions 1.1.10-par and later). - | -
| src/conff.c, src/conff.h | -- The configuration handler functions and their prototypes. The parser is called from here. - | -
| src/consts.h | -- Some constants used by the parser, config file handler functions and in the server status thread, - among others. - | -
| src/dns.c, src/dns.h | -- Define dns message structures, constants, and some common dns data handlers. dns.h contains gcc-specific - code (in praticular, "__attribute__((packed))"). - | -
| src/dns_answer.c, src/dns_answer.h | -- Define functions that answer incoming dns queries. - | -
| src/dns_query.c, src/dns_query.h | -- Define functions to manage outgoing dns queries. - | -
| src/error.c, src/error.h | -
- Functions for error output to stderr or the syslog, and debug output to stderr or pdnsd.debug.
- |
-
| src/hash.c, src/hash.h | -- Contains the code for storing and looking up cache entries in the hash table. - | -
| src/helpers.c, src/helpers.h | -- Define miscellaneous helper functions. - | -
| src/icmp.c, src/icmp.h | -- Define a function for performing a ping test. This contains OS-specific code. - | -
| src/main.c | -- Contains main(), which holds the command line parser, performs initialisations and signal handling. - | -
| src/make_hashconvtable.c | -
- Contains the code for the executable make_hashconvtable, which is only run once, during build time, to generate the file hashconvtable.h, used by src/hash.c (versions 1.1.10-par and later).
- (obsolete since version 1.2)
- |
-
| src/make_rr_types_h.pl | -- A perl script for generating src/rr_types.h, - a C header file containing macro definitions and tables needed for handling the - RR types known to pdnsd, from the text file src/rr_types.in. - | -
| src/rr_types.c, src/rr_types.h, src/rr_types.in | -- These define tables and macros needed for handling the RR types known to pdnsd. - Since version 1.2.9, rr_types.h is an automatically generated file, - see make_rr_types_h.pl. - | -
| src/netdev.c, src/netdev.h | -- Define functions for network device handling. OS-specific. - | -
| src/servers.c, src/servers.h | -- Define functions for the server status thread that performs the periodical uptests. - | -
| src/status.c, src/status.h | -- Define functions for the status control thread. This is pdnsd's interface to pdnsd-ctl. - | -
-
- - Copyright (C) 2000, 2001 Thomas Moestl
- Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2012 Paul A. Rombouts - -
- Last revised: 19 April 2012 by Paul A. Rombouts -
- - diff --git a/jni/pdnsd/doc/html/doc_makefile b/jni/pdnsd/doc/html/doc_makefile deleted file mode 100644 index 28fb7d50..00000000 --- a/jni/pdnsd/doc/html/doc_makefile +++ /dev/null @@ -1,23 +0,0 @@ - -versionfile = ../../version -arch = i686 -arch2 = x86_64 -extver = _sl6 -system = Scientific Linux 6.2 system - -doc: dl.html -.PHONY: doc clean - -# If the existing dl.html contains '???', then certain packages were missing -# during the previous build and dl.html needs to be built again. -ifneq ($(shell grep -F -l -e '???' dl.html),) -.PHONY: dl.html -endif - -dl.html: %.html: %.html.in htmlsubst.pl $(versionfile) - perl htmlsubst.pl version=`cat $(versionfile)` \ - baseurl='http://members.home.nl/p.a.rombouts/pdnsd/' \ - arch=$(arch) arch2=$(arch2) extver=$(extver) system="$(system)" $< > $@ - -clean: - @rm -fv dl.html diff --git a/jni/pdnsd/doc/html/faq.html b/jni/pdnsd/doc/html/faq.html deleted file mode 100644 index eec65993..00000000 --- a/jni/pdnsd/doc/html/faq.html +++ /dev/null @@ -1,412 +0,0 @@ - - - -| - pdnsd Homepage - | -- pdnsd FAQ - | -- Documentation - | -- GNU GPL (pdnsd's License) - | -- Download Section - | -
The pdnsd FAQ
- -| Q: | -- There are complete and well-tested name servers around, such as the BIND. - These do also perform caching. Why should I use pdnsd? - | -
| A: | -
- pdnsd does not aim to be a complete name server implementation, such as the
- BIND. It is optimized for caching, and you can only specify a small subset of all
- dns record types pdnsd knows in your local "zone" definitions.
- This of course reduces the code size drastically, and such the memory footprint.
- There are some features especially interesting for dialin networks, ordinary
- (non-server) internet hosts and computers that are often not connected to
- to their network, e.g. notebooks (I originally wrote this program for use
- with my notebook).
- These features are:
-
|
-
- -
| Q: | -- When I look at the process size with ps, top, gtop, or a similar tool, I see - some processes with a total size well above 3.5 MB. This is much more than - e.g. BIND named (about 1.4 MB). Why? - | -
| A: | -- Really, it is not. - pdnsd uses multithreading, not multiprocessing. That means that the processes - share most of their process space. In the LinuxThreads library - or NPTL (Native Posix Thread Libary), - which are used by pdnsd on Linux, in fact the total process address space is shared - (although the processes have different stacks, these are in one process - address space). You may check this by looking at the at the process sizes of - the pdnsd threads: all should be the same. The effective size that pdnsd - occupies is thus the size of any of the processes, not the sum of those. - So, pdnsd with empty cache occupies about 800 kB, and the maximum size - should be about the cache size plus this size (in fact, ca 5-10% more). - | -
- -
| Q: | -- What do I need the status control (option -s) for? - | -
| A: | -
- It enables you to do some things you might or might not need. With it, you can:
-
|
-
- -
| Q: | -- What do I need local records (rr- and source-sections in the config file) for? - | -
| A: | -
- Some resolver programs, e.g. nslookup, want to look up the name of the
- server they are using before doing anything else. This option is for defining
- a PTR record for your IP such that those programs get an answer even if the
- name server you are caching is not available or does not offer these records.
- By extension, you may also define A and SOA records. This allows you to build
- very small zones without having to use a "big" name server. It is NOT
- intended to replace such a complete server in anything but VERY small
- networks. Alternatively, you may start a named on another host or on the
- same host on another port and cache it with pdnsd in addition to other (more
- distant) name servers.
- - The source section allows you to let pdnsd read in your
- /etc/hosts file on startup and serve its contents. This file is used by your local
- resolver before it even tries the name servers and usually contains
- fully-qualified domain names (FQDNs) for all of the internet addresses your host has.
- If you source this file, you usually won't need any additional rr sections. Sourcing it also allows
- other hosts (eg. in your local network) to access the names defined in your
- hosts file. You can of course just add other hosts in your local network to the
- servers hosts file, thus making them known to your server's resolver
- and pdnsd (if you sourced that file).
- - If you don't know what this answer was all about, you should just take the - source section in the sample config file that comes with pdnsd, copy it - into your config file and forget about it. - |
-
- -
| Q: | -
- When compiling, I get an error message like Please define __BYTE_ORDER to - be __LITTLE_ENDIAN or __BIG_ENDIAN What's up? - |
-
| A: | -
- Normally, this macros should be defined in your C library's header files.
- There are two different methods, most C libraries support both (and pdnsd
- honors both): either __BYTE_ORDER is set to __LITTLE_ENDIAN
- or __BIG_ENDIAN, or __LITTLE_ENDIAN or __BIG_ENDIAN
- are directly defined as macros.
- - Linux glibc, for example, does set those macros correctly. Never mind. You just have to know - whether your machine is little-endian or big-endian, this means wheter your - machine saves the least significant byte of a word or double-word first in memory (little-endian) or - the most significant first (big-endian). - All intel x86 and Alpha machines are little-endian, for example, while SPARC - and PowerPC architectures are big-endian. - If your machine is little-endian, add the following line to your config.h: -
- #define __BYTE_ORDER __LITTLE_ENDIAN
- - Likewise, if your machines byte order is big-endian: -
- #define __BYTE_ORDER __BIG_ENDIAN
- - Pathological byte orders like pdp-endian are not yet supported really; - However, for the place the endianess is needed, __LITTLE_ENDIAN should do
- (it deals only with 16 bits; for all other occurances, ntoh[sl]/hton[sl] is used).
- |
-
- -
| Q: | -
- At startup, I get a warning saying: - - Uptest command [...] will implicitly be executed as root - - What does that mean? - |
-
| A: | -
- This warning only occurs if you use the uptest=exec option in your
- configuration. It means that the uptest command is run as root
- because pdnsd is running as root, and this was not explicitely specified.
- The idea is that it may introduce security holes (in the programs being run)
- when they run as root, and so they shouldn't do that if possible.
- You can specify the user that shall run the command by appending its name
- comma-separated as string to the uptest_cmd line: -
- uptest_cmd="<your command>","<user>";
- - If it is correctly running as root, just append the user string "root" to
- the command and the warning will not occur again.
- |
-
- -
| Q: | -
- I cannot run my uptest_cmd command as root (it says permission denied),
- although the pdnsd executable is setuid root. Why?
- |
-
| A: | -- pdnsd will drop privileges gained through setuid/setgid before executing the - uptest commands (you shouldn't set the pdnsd executable setuid/setgid anyway). - The reason is clear: if you install the pdnsd - executable as setuid root and this wouln't be done, any user could execute - shellcode with root privileges using that option! - | -
- -
| Q: | -
- At startup, I get an error saying: - - Bad config file permissions: the file must be only writeable by the user - - Why is that? - |
-
| A: | -
- pdnsd has an option (uptest=exec) that allows the execution of arbitrary
- shell code (for testing whether an interface is up). This must be
- of course secured against unauthorized use. One of these
- protection is the one that produces the error message: if you routinely run
- pdnsd, e.g. at system startup, and your config file is editable for others,
- someone could change it and insert shell code that is executed in the next
- pdnsd run -- with your user privileges! To prevent this, pdnsd will exit if the config file is writeable
- by others than the owner.
- To get rid of this message, just do -
- chmod go-w <filename>
- - on your config - file (for the default file: chmod go-w /etc/pdnsd.conf).
- You should also check that the ownership is set correct.
- |
-
- -
| Q: | -
- serve_aliases does not seem to work.
- |
-
| A: | -- Some resolvers (e.g. of the glibc 2.1) seem sometimes not to look up unmodified names, but the names with - an entry of the search path already appended. Since pdnsd will serve short names with this - option anyway, you can delete the search an domain options from your /etc/resolv.conf. This is reported to - work in some cases. - | -
- -
| Q: | -- Some queries for domains that have many records (e.g. www.gmx.de) fail mysteriously. - | -
| A: | -
- pdnsd versions prior to 1.1.0 had the tcp server thread disabled by default. Most resolvers
- repeat their query using tcp when they receive a truncated answer (the answer is truncated
- when it exceeds a length of 512 bytes). You need to recompile pdnsd with the option
- --enable-tcp-server to fix this.
- |
-
- -
| Q: | -- I am behind some kind of firewall. In the configuration file - I have only listed addresses of name servers on the local (ISP's) network, - but pdnsd is slow and DNS queries frequently time out. - | -
| A: | -
- In some cases pdnsd will not consider the answer of the local name server
- authoritative enough, and will try to get answers from the name servers listed in the
- authority section of the reply message. If pdnsd is behind a firewall that blocks the
- UDP reply packets from remote name servers, pdnsd will wait in vain for a reply.
- One solution is to set proxy_only=on
- in the servers sections of the configuration file.
- This will prevent pdnsd from querying name servers that are not listed in the configuration
- file.
- Another solution that can be tried is specifying
- query_method=tcp_only
- in the global section of the configuration file, because a firewall that blocks
- UDP packets from outside might still allow outgoing TCP connections to port 53.
- |
-
- -
| Q: | -- Is pdnsd vulnerable to DNS cache poisoning as described in - CERT vulnerability note VU#800113? - | -
| A: | -
- Short answer: Yes. - Somewhat longer answer: The problem is not so much that pdnsd's implementation is flawed - but rather that the DNS protocol currently being used is fundamentally flawed from - a security viewpoint. As long as a more secure protocol is not in place, - all that the developers of pdnsd can do is to try to tweak the current implementation - to make it as difficult as possible for an attacker to succeed. - From version 1.2.7 onwards, the default for the query_port_start option
- is 1024, which means that the pdnsd resolver will randomly select source ports
- in the range 1024-65535. (In previous versions the default was to let the kernel select
- the source ports, which will often result in a more or less predictable sequence of ports.)
- It also helps to use a good quality source of random numbers. On platforms where this is
- supported, it is preferable to configure with --with-random-device=/dev/urandom.
- There is still more that can be done to make pdnsd less vulnerable, but this remains
- (as of this writing) a work in progress.
- - Please note that pdnsd was designed for small (private) networks, and that it is generally - not recommended to let untrusted users access pdnsd. - |
-
- Thomas Moestl - and Paul Rombouts - -
-
- Last revised: 18 August 2008 by Paul Rombouts -
- - - diff --git a/jni/pdnsd/doc/html/htmlsubst.pl b/jni/pdnsd/doc/html/htmlsubst.pl deleted file mode 100644 index a9e3e9ff..00000000 --- a/jni/pdnsd/doc/html/htmlsubst.pl +++ /dev/null @@ -1,36 +0,0 @@ -#!/usr/bin/perl -w - -# Primitive ad-hoc script for updating pdnsd html doc files. -# Written by Paul Rombouts. - -use strict; -use integer; -use POSIX qw(strftime); - -my %paramvals=(); - -while(@ARGV && $ARGV[0]=~/^([^=]*)=(.*)$/) { - my $param=$1; my $val=$2; - if($param =~ /^[[:alpha:]]\w*$/) { - $paramvals{$param}=$val; - } - else {warn "Warning: invalid parameter '$param' ignored.\n"} - shift @ARGV; -} - -sub sizeof { - my($arg)=@_; - (my $str= $arg) =~ s/\$(?:([[:alpha:]]\w*)\b|\{([[:alpha:]]\w*)\})/ - defined($paramvals{$+})?$paramvals{$+}:defined($ENV{$+})?$ENV{$+}:''/eg; - my $filename=eval($str); - (-f $filename) or return '???'; - (((-s $filename)+1023)/1024).'kB'; -} - -while(<>) { - s/\$(?:date\b|\{date\})/strftime("%d %b %Y",localtime)/eg; - s/\$sizeof\(([^()]*)\)/sizeof($1)/eg; - s/\$(?:([[:alpha:]]\w*)\b|\{([[:alpha:]]\w*)\})/ - defined($paramvals{$+})?$paramvals{$+}:defined($ENV{$+})?$ENV{$+}:''/eg; - print; -} diff --git a/jni/pdnsd/doc/html/index.html b/jni/pdnsd/doc/html/index.html deleted file mode 100644 index d2e426aa..00000000 --- a/jni/pdnsd/doc/html/index.html +++ /dev/null @@ -1,686 +0,0 @@ - - - -| - About pdnsd - | -- pdnsd FAQ - | -- Documentation - | -- GNU GPL (pdnsd's License) - | -- Download Section - | -
The pdnsd Homepage
News
| 2012-03-17 | -Version 1.2.9a-par has been released.
- Version 1.2.9a fixes a bug in the 1.2.9 release that causes a build failure when pdnsd is
- configured with --enable-strict-rfc2181.
- If you do not use this option to compile pdnsd, there is no need to upgrade from 1.2.9 to 1.2.9a.
- |
-
| 2012-02-27 | -Version 1.2.9-par has been released. - Version 1.2.9 supports many more RR types (including those necessary for DNSSEC) and - EDNS (Extension mechanisms for DNS) to enable UDP messages larger than 512 bytes. - It also has support for defining local TXT records and has several new options and bugfixes - (including file descriptor leaks that effect FreeBSD users). - | -
| 2011-05-03 | -The latest source code is available from a
- git repository. - In response to frequent requests I have uploaded a git tree including the latest code - and a fairly extensive history of pdnsd development to - gitorious.org. - Anyone who wants to participate in pdnsd development is free to create a - clone repo on gitorious.org - and push his modifications there. - |
-
| 2010-02-22 | -Version 1.2.8-par has been released. - The main new feature of version 1.2.8 is automatic discovery of root servers. - Furthermore, there are some additional improvements in the resolver. - | -
| 2008-09-04 | -Version 1.2.7-par has been released.
- Foremost, this release fixes some security problems.
- It contains a fix for a "dangling pointer" bug that could cause pdnsd to
- crash when it received a long reply. It also addresses some of the issues
- raised in the CERT
- vulnerability note VU#800113 by making the default of
- query_port_start equal to 1024, thereby ensuring that source
- ports are randomly selected by the pdnsd resolver in the range 1024-65535.
- This release also fixes problems with compiling pdnsd for the ARM architecture
- and for the Darwin platform (Max OS X).
- - There are a number of (minor) new features. - pdnsd now supports "include" files, essentially configuration files that - only contain definitions for local records. - It is now possible to define interactively, using pdnsd-ctl,
- any local record that can be defined in a configuration file.
- |
-
| 2007-09-04 | -Version 1.2.6-par has been released.
- pdnsd's license has been upgraded to GPL version 3.
- A bug has been fixed which which caused pdnsd to handle NXDOMAIN replies
- inefficiently when configured with neg_domain_pol=on. The
- code that implements the ping test has been fixed, which was broken for
- 64-bit systems. A new option randomize_servers can be used
- to give each server in a section of the configuration file an equal
- chance of being queried. The new options reject,
- reject_policy and reject_recursively make it
- possible to check for the presence of certain IP addresses in the
- replies of name servers and to avoid some types of unwanted replies.
- The pdnsd-ctl 'add a' and 'add aaaa' commands
- now allow multiple IP addresses to be specified for the same name.
- pdnsd's ability to resolve from root servers has been improved.
- |
-
| 2006-09-02 | -Version 1.2.5-par has been released.
- This release introduces a new query method: udp_tcp.
- With this method a UDP query is tried first and, if the UDP answer is
- truncated, the query is repeated using TCP, which is the behaviour that
- seems to be recommended by the DNS standards. There is a new
- configuration option use_nss, which can be turned off to
- prevent lengthy timeouts and stalls in certain situations. A bug has
- been fixed which could cause pdnsd to crash if debug output was
- generated before the debug output stream was properly initialized.
- |
-
| 2006-01-09 | -Version 1.2.4-par has been released.
- A memory leak and a minor buffer-overflow problem have been fixed.
- There is now a fix for some situations that would previously cause pdnsd to
- exit prematurely (such as ACPI S3 sleep or trying to attach strace to pdnsd).
- Time intervals specified in the configuration file can now be expressed in
- minutes, hours, days and weeks as well as seconds.
- Support for Apple Mac OS X v10.4 Tiger has been improved.
- The "pdnsd-ctl status" command now also provides some
- information about the status of the running threads.
- There are some further improvements in the debugging information provided by pdnsd.- TCP-query support is now compiled in by default (but can still be disabled using - the configure option --disable-tcp-queries).
- |
-
| 2005-07-11 | -Version 1.2.3-par has been released.
- New feature in this release: the "pdnsd-ctl empty-cache" command can
- be provided with an include/exclude list, allowing the user to specify a
- selection of names to be removed, instead of emptying the cache completely.- Additional improvements: pdnsd should now remain responsive while executing the - " pdnsd-ctl empty-cache" command.
- With the query_method=tcp_udp option pdnsd will now also
- try a UDP query after a TCP connection times out, which should allow
- pdnsd to resolve the same names with query_method=tcp_udp
- as with query_method=udp_only, although perhaps with an
- occasional delay.
- "pdnsd-ctl config" or "pdnsd-ctl server"
- commands should now run without delays, even if pdnsd is performing
- ping or query uptests at the time.
- Some problems with resolving certain names using root servers have been fixed.
- |
-
| 2005-04-03 | -Version 1.2.2-par has been released. - The main emphasis of this release is improved portability. - A bug has been fixed that prevented pdnsd from compiling successfully on some - 64 bit architectures. - This release has (experimental) support for the Darwin (Apple Mac OS X) platform. - On Linux systems, the configure script will now try to detect automatically whether - the system implements the Native POSIX Thread Library, but the method used may not - necessarily be foolproof. - In addition, the debug features have been improved and should make it easier to find out - why pdnsd considers some queries or replies malformed. - | -
| 2004-11-07 | -Version 1.2.1-par has been released.
- The main new feature of this release is improved support for non-Linux platforms. - This release has (experimental) support for the Cygwin platform, and should also fix - some compilation glitches that have been reported by FreeBSD users. - |
-
| 2004-10-10 | -Version 1.2-par has been released.
- pdnsd is new and improved! Most of the changes effect the internal workings
- of pdnsd, but there also a number of interesting new features (well, I think they are interesting). - Among the bugs fixed are two rather nasty ones which involve the handling of NXT and NAPTR records - and which can cause pdnsd to crash or abort. - The new features include a new server availability test which can be specified with uptest=query,
- support for reading the DNS configuration from resolv.conf files,
- a new option for optimizing the use of root servers,
- a new option that makes defining local records for reverse resolving easier,
- support for defining wildcard records,
- a new pdnsd-ctl command for reloading the config file without restarting pdnsd, and
- a new pdnsd-ctl command for dumping information about the names stored in the cache.
- The documentation has also been updated: there is now a pdnsd.conf man page.- For a more complete list of the changes I'll have to refer you to README.par and the ChangeLog.
- |
-
| 2004-05-22 | -Version 1.1.11a-par has been released.
- This release contains a fix for FreeBSD users that bypasses a problem
- with the macro ENONET, which can cause a compilation failure when it is undefined.
- Linux users will notice no difference between 1.1.11a-par and 1.1.11-par.
- |
-
| 2004-05-10 | -Version 1.1.11-par has been released.
- This version has a rather large number of small changes, which are rather difficult to summarize.
- Among the bugs fixed are a race condition in the cache lookup code, a
- flaw in the code that caused a busy spin when a remote server answered
- with "Not Implemented", and problems with the -4 and -6 command-line
- options. Among the improvements are an alternative sorting algorithm
- which should allow pdnsd to start up faster when reading a large cache
- file from disk, automatic mapping of IPv4 to IPv6 addresses when running
- in IPv6 mode, somewhat more efficient memory use, better compression of
- the replies and changes in the parallel querying algorithm that should
- improve the chances of catching a reply from a remote server. - - For a more complete list of the changes I'll have to refer you to README.par and the ChangeLog.
- |
-
| 2004-02-10 | -Version 1.1.10-par has been released.
-
- The main new feature of this release is a new parser for configuration
- files, completely rewritten from scratch in C. The main advantages are:
- (f)lex and yacc/bison are no longer needed to build pdnsd, more
- informative error messages instead of merely "parse error",
- and string literals no longer need to be enclosed in quotes in most
- cases.Furthermore, a bug has been fixed that caused incorrect - IPV6-type PTR records to be generated when sourcing - /etc/hosts like files.- - There have been other small changes, more details can be found in the ChangeLog.
- |
-
| 2004-01-08 | -Version 1.1.9-par has been released.
- "maintenance" release by Paul Rombouts. - - The change of version number is not very significant; the - difference between 1.1.9-par and the previous 1.1.8b1-par8 is marginal. - However, I felt the need to simplify the numbering, because it was - becoming rather baroque. - - I've added some missing pieces to the documentation (the pdnsd manual and the man page for pdnsd-ctl). BTW, did you - know that it's possible to define aliases for domain names with pdnsd? I - had plans to implement such a feature when I discovered that pdnsd - already supports it. It was just poorly documented. (If want to try this - for your self, look for the new information about CNAME records under - the rr Section in the manual.) The - changes to the code consist mostly of optimizations, removal of some - size limits due to fixed-size buffers, and some cleaning up. I've also - tried to make the error responses of pdnsd-ctl more helpful.- - More details can be found in the ChangeLog.
- |
-
| 2003-10-10 | -Version 1.1.8b1-par8 has been released.
- "maintenance" release by Paul Rombouts. - This version introduces a "delegation-only" feature that may be useful - for blocking Verisign's Sitefinder. - The parser for the configuration file now tolerates domain names missing - a dot at the end. - I have provided alternative implementations for some GNU extensions that I - used in an effort to make the code more portable. In particular, the - code should build on FreeBSD again. - More details can be found in the README.par file.
- |
-
| 2003-09-19 | -Version 1.1.8b1-par7 has been released.
- "maintenance" release by Paul Rombouts. Besides fixing a number of bugs I have
- reworked some of the code for adding and removing entries in the cache in an
- effort to improve efficiency and stability. - More details can be found in the ChangeLog.
- |
-
| 2003-07-28 | -Version 1.1.8b1-par6 has been released. - "maintenance" release by Paul Rombouts. In addition to some further code cleanup, - the documentation has been revised. - | -
| 2003-07-10 | -Version 1.1.8b1-par5 has been released.
- A troublesome allocation size error has been discovered in Thomas Moestl's code.
- In practice this bug only wastes memory but it could
- also potentially lead to memory corruption. Upgrading is recommended.
- More details can be found in the ChangeLog.
- |
-
| 2003-06-30 | -Version 1.1.8b1-par4 has been released.
- Due to incompatibilities between various implementations of
- the pthread library on Linux systems, problems can occur with signal handling in
- pdnsd. The usual symptom is failure by pdnsd to save the cache to disk, and
- /var/cache/pdnsd/pdnsd.cache remaining empty. If you experience
- this kind of trouble, try reconfiguring with different values for the new
- --with-thread-lib option. The allowable values are
- described in the documentation.
- |
-
| 2003-04-07 | -pdnsd is no longer maintained by Thomas Moestl: - I have not had time to maintain pdnsd for quite a while now, and have been very slow to - respond to issues, or did not respond at all. It is time that I officially announce that - pdnsd is no longer actively maintained; I apologize to all those who reported bugs or - asked questions without receiving any reply. However, Paul A. Rombouts has published - a patch set against the last released version at - http://members.home.nl/p.a.rombouts/pdnsd.html, - which cleans up a lot of code fixes many bugs. - | -
| 2002-07-19 | -Documentation update. - Please note that pdnsd should never be installed with setuid or setgid attributes, - as it is not always possible to give up all privileges due to operating system restrictions. - While this was never intended and I don't think that anybody would actually do this, the - documentation was updated to explicitely mention this to avoid misunderstandings. - | -
| 2002-01-15 | -Version 1.1.7a has been released. - This fixes a reversed test in an assertion that would cause pdnsd to termintate when the ping uptest - was used. No other changes were made. - | -
| 2002-01-15 | -Version 1.1.7 has been released.
- This fixes some problems that might be remotely exploitable to gain access as the user pdnsd runs as
- (an unprivileged user by default). To do this, an attacker needs to control a name server that is
- queried by pdnsd, and send a malicious reply to such a query. - Upgrading is strongly recommended! - There are also minor bug fixes and stability improvements. - |
-
-
About pdnsd
- pdnsd is a proxy DNS server with permanent caching (the cache contents - are written to hard disk on exit) that is designed to cope with unreachable - or down DNS servers (for example in dial-in networking).- Since version 1.1.0, pdnsd supports negative caching.
-
- It is licensed under the GNU General Public License (GPL, - also available in html and - translated into various languages.). - This, in short, means that the sources are distributed togehter with the program, and - that you are free to modify the sources and redistribute them as long as you - also license them under the GPL. You do not need to pay anything for pdnsd. - It also means that there is ABSOLUTELY NO WARRANTY for pdnsd or any part - of it. For details, please read the GPL. -
- pdnsd can be used with applications that do DNS lookups, e.g. on startup, and - can't be configured to change that behaviour, to prevent the often minute-long - hangs (or even crashes) that result from stalled DNS queries. Some Netscape Navigator - versions for Unix, for example, expose this behaviour. -
- pdnsd is configurable via a file and supports run-time configuration using the program pdnsd-ctl that comes - with pdnsd. This allows you to set the status flags of servers that pdnsd knows (to influence which servers - pdnsd will query), and the addition, deletion and invalidation of DNS records in pdnsd's cache. -- Parallel name server queries are supported. This is a technique that allows - querying several servers at the same time so that very slow or unavailable - servers will not block the answer for one timeout interval. -
- Since version 1.0.0, pdnsd has full IPv6 support. -
- There is also a limited support for local zone records, intended for defining - 1.0.0.127.in-addr.arpa. and localhost. , since some clients request that - information and it must be served even if the cached servers are not available - or do not serve these records. pdnsd may also read your /etc/hosts file - (this file is normally used by your local resolver and usually contains - information for localhost as well as for your machines FQDN) and serve its - contents. -
- pdnsd was started on Linux, and has since been ported to FreeBSD (and Cygwin and Darwin). - 90% of the source code should be easily portable to POSIX- - and BSD-compatible systems, provided that those systems support the POSIX threads (pthreads). - The rest might need OS-specific rewrites. -
- Currently, pdnsd is only compileable by gcc. This should be easy to fix, but I just - do not have documentation for other compilers. If you are not able or do not want - to use gcc, I would recommend you just try to do the minor changes. -
-
- pdnsd must be started as root in some cases (raw sockets are needed for icmp
- echoes for the option uptest=ping, and the default port is 53, this must be
- >1024 to allow non-root execution). However, pdnsd can be configured to change it's user
- and group id to those of a non-privileged user after opening the sockets needed for this.
-
- The server should support the full standard DNS queries following the rfcs 1034 - and 1035. As of version 1.0.0, the rfc compliance has been improved again, and pdnsd is now - believed (or hoped?) to be fully rfc-compatible. It completely follows rfc 2181 (except - for one minor issue in the FreeBSD port, see the documentation). - It does not support the - following features, of which most are marked optional, experimental or obsolete - in these rfcs: -
--
-
- Inverse queries -
- Status queries -
- Completion queries -
- Namespaces other than IN (Internet) -
- AXFR and IXFR queries (whole zone transfers); since pdnsd does not maintain zones, that should not violate the standard -
src/rr_types.in):
- -
-
- RP (responsible person, RFC 1183) -
- AFSDB (AFS database location, RFC 1183) -
- X25 (X25 address, RFC 1183) -
- ISDN (ISDN number/address, RFC 1183) -
- RT (route through, RFC 1183) -
- NSAP (Network Service Access Protocol address , RFC 1348) -
- PX (X.400/RFC822 mapping information, RFC 1995) -
- GPOS (geographic position, deprecated) -
- AAAA (IPv6 address, RFC 1886) -
- LOC (location, RFC 1876) -
- EID (Nimrod EID) -
- NIMLOC (Nimrod locator) -
- SRV (service record, RFC 2782) -
- ATMA (ATM address) -
- NAPTR (URI mapping, RFC 2168) -
- KX (key exchange, RFC 2230) -
- CERT (Certificate record, RFC 4398) -
- DS (Delegation Signer, RFC 4034) -
- RRSIG (Resource Record Signature, RFC 4034) -
- NSEC (Next Secure, RFC 4034) -
- DNSKEY (record containing the public key for a zone, RFC 4034) -
- NSEC3 (Next Secure version 3, RFC 5155) -
- NSEC3PARAM (NSEC3 parameters, RFC 5155) -
- Note: This list is incomplete. For the complete list see the source file src/rr_types.in.
-
- If you have questions left, you should take a look into the FAQ.
-
- Bugfixes, patches and compatability fixes for other OSs are very welcome!
-
Features in detail
-- This section describes some of pdnsds features in detail. Most of the options are set - in the config file. For more information on the configuration file, see - the documenation page. -
- -
Uptests
- pdnsd provides several methods to test whether a remote DNS server should be regarded as available - (so that pdnsd can query it), in - addition to the obvious "none" test (the server is always regarded as available, - or availability is set on or off using thepdnsd-ctl utility).
- These tests are:
- -
-
- ping: a given adress is ping'ed in a given interval. If it there is no response - or the host is unreachable, the server is seen to be not available (for those who don't know: - pinging is sending a certain Internet packet type to a host to which any standard-conformant - host is required to reply). -
- if: a given network interface is tested whether it is existent, up and running. If - it is not, the server is regarded to be not available. This is especially useful for ppp and - similar interfaces. A special case test for Linux isdn (ippp*) interfaces is integrated, so that the uptests - should also work for these. -
- dev: this is a variant of the if uptest for use with Linux dial-on-demand ppp interfaces. In addition - to performing an if-style interface uptest, it also tests whether a specified program (e.g. pppd) owns - a lock to a given (modem-) device. -
- exec: a given shell command line is executed and the exit status of the whole command line (which - is normally the exit status of the last command) is evaluated. If it is not zero, the server is regarded - to be not available. This is a very flexible testing method with which it should be able to perform - virtually any needed test. -
- query: New in version 1.2: - This works like the ping test, except it sends an (empty) DNS query to the remote server. - If the server sends a well-formed response back within the timeout period (except SERVFAIL), - it will be regarded as available. - This test is useful if a remote server does not respond to ICMP_ECHO requests at all, - which unfortunately is quite common these days. - In many cases this test will be a more reliable indicator of availability - than the ones mentioned above. -
-
Local Records ("Zones")
- As mentioned above, there are only very basic local record types (ie the record types that you may use in record - declarations in your local configuration for records that pdnsd shall serve in addion to the cached ones). - They are organized roughly in zones but have not complete zone declarations, so I generally do not use the - term "zone" for them, but rather "local records". - These are the local record types pdnsd can understand: --
-
- SOA (information about the name server) -
- A (domain-name-to-address mapping) -
- PTR (pointer, used normally for address-to-domain-name mapping) -
- NS (name server, generated automatically by pdnsd for any local record set) -
- CNAME (canonical host name) -
- MX (mail exchange for the domain) -
- TXT (arbitrary text strings, often used for Sender Policy Framework) -
- You may "source" a file in a format like that used in the
/etc/hosts file, that means
- that pdnsd reads this file, extracts addresses and domain names from it and automatically generates
- A records for name to address mapping, PTR records for address to name mapping and NS records (name
- server specifiation) for each entry in the file.- Records can also be changed dynamically at run time.
- A script contributed by Marko Stolle makes pdnsd usable in a DHCP setup using this feature. -
-
System requirements
- As mentioned, pdnsd currently runs under Linux, FreeBSD and Cygwin. - Other BSD flavours may or may not work (feedback is very welcome!). - The system and software requirements under Linux are: --
-
- Kernel version >2.2.0 -
- glibc version >2.0.1 (aka libc6) with LinuxThreads (normally included)
- or NPTL (Native Posix Thread Library, recommended).
- Due to a bug, pdnsd 0.9.8 does not run with glibc2.1.1. This behaviour was - fixed in pdnsd 0.9.9. - - For IPv6: glibc>=2.1 -
-
-
- FreeBSD versions >=2.6 (prior ones may or may not work) -
- For IPv6: FreeBSD >=4.0 is recommended (no idea if it runs on prior versions) -
-
-
- GCC, preferably egcs-2.* or 3.* (other compilers are currently not supported; the needed patch for another compiler - should not be difficult, however) -
- GNU or BSD make -
- the standard commands install, grep, sed, awk, touch and which (along with the REALLY - standard ones mv, cp, ln, rm, pwd, test, echo, cat, mkdir, chown, chmod, tar). In - any standard Unix installation, this should be no problem. -
- for hacking and building own packages, you might also need gzip, bzip2, perl and rpmbuild -
-
Download
- If you want to download pdnsd, please visit the download page. --
Authors
-
- pdnsd was originally written by Thomas Moestl,
- but is no longer maintained by him. Paul A. Rombouts
- has revised large portions of the code and has added a number of new features.
- See README.par and the ChangeLog
- in the source directory (or /usr/share/doc/pdnsd-<version>
- if you have installed a binary package) for more details.
- If you have questions about the recent modifications, you can find
- the email address of the current maintainer
- at the end of README.par.
-
- Daniel Smolik has contributed RedHat RPMs (the most recent RPMs are available here).
- Torben Janssen contributed start scripts for Red Hat Linux.
- Soenke J. Peters contributed patches and suggestions for Red Hat compatability.
- Wolfgang Ocker has contributed the code and documentation for the server_ip option.
- Markus Mohr contributed a Debian rc script.
- Nikita V. Youschenko contributed extensions to the "if" uptest.
- Lyonel Vincent extended the serve_aliases option to support an arbitrary number of aliases.
- Sourav K. Mandal wrote the autoconf scripts and contributed many fixes and suggestions.
- Stephan Boettcher contributed the SCHEME= option.
- Ron Yorston contributed the uptest for Linux ppp dial-on-demand devices.
- Alexandre Nunes fixed some bugs in the autoconf files.
- Sverker Wiberg contributed fixes for IPv6.
- Carsten Block contributed configure-able rc scripts.
- Olaf Kirch contributed a security fix for the run_as code.
- Paul Wagland contributed various patches for bind9-compatability and other issues.
- Roman Shterenzon contributed patches and lots of helpful hints for FreeBSD compatability.
- Bernd Leibing has contributed spec file fixes.
- Michael Wiedmann has contributed the pdnsd-ctl.8 man page.
- Marko Stolle has contributed the contrib/pdnsd_update.pl script that makes pdnsd usable in a DHCP setup.
- P.J. Bostley has contributed patches to get pdnsd working on alpha properly.
- Christian Engstler contributed patches for SuSE compatability.
- Bjoern Fischer contributed code to make pdnsd leave the case of names in the cache unchanged.
- Marko Stolle contributed the contrib/pdnsd_update.pl script that makes pdnsd usable in a DHCP setup.
- Andrew M. Bishop contributed the support for the label server option and the pdnsd-ctl interface for using it.
- Frank Elsner contributed rc script fixes.
- Andreas Steinmetz contributed the code for query_port_start and query_port_end options.
- Mahesh T. Pai contributed the pdnsd.8 man page.
- Nikola Kotur contributed the Slackware start-up script.
- Kiyo Kelvin Lee contributed a patch for Cygwin support.
- Rodney Brown contributed a patch for Darwin (Apple Mac OS X) support.
- Jan-Marek Glogowski contributed a patch implementing the use_nss option.
-
- Special thanks to Bert Frederiks for letting me do a late-night debugging run on his machine to - spot obscure bugs! -
-
- Thanks to the following persons for reporting bugs and being helpful:
- David G. Andersen,
- Dirk Armbrust,
- Daniel Black,
- Kevin A. Burton,
- Juliusz Chroboczek,
- Joachim Dorner,
- Stefan Erhardt,
- Stefan Frster,
- Mike Hammer,
- Jonathan Hudson,
- Dan Jacobson,
- Byrial Jensen,
- Patrick Loschmidt,
- James MacLean,
- Fraser McCrossan,
- Michael Mller,
- Erich Reitz,
- Brian Schroeder,
- Milan P. Stanic,
- Michael Steiner,
- Norbert Steinl,
- Markus Storm,
- Michael Strder,
- Alan Swanson,
- Eelco Vriezekolk.
-
Links
- Well, this is the obligatory link section. --
-
 - The GNU homepage - - |
-  - Freecode (formerly Freshmeat) - large free software index - - |
-
 - The FreeBSD project - - |
-
-
- Thomas Moestl - and Paul A. Rombouts - -
-
- Last revised: 17 March 2012 by Paul A. Rombouts -
- - diff --git a/jni/pdnsd/doc/html2confman.pl b/jni/pdnsd/doc/html2confman.pl deleted file mode 100644 index abade119..00000000 --- a/jni/pdnsd/doc/html2confman.pl +++ /dev/null @@ -1,161 +0,0 @@ -#!/usr/bin/perl -w -# -# A Perl script for converting pdnsd html documentation to a man page. -# -# Written by Paul A. Rombouts -# -# This file Copyright 2004 Paul A. Rombouts -# It may be distributed under the GNU Public License, version 2, or -# any higher version. See section COPYING of the GNU Public license -# for conditions under which this file may be redistributed. -# - -use strict; -use POSIX qw(strftime); - - -while(<>) { - if(/)?\s*$}{.SS $1$2$3\n}i; - if(s{^\s*
)?\s*$}{.B $1$2$3\n}i if $taggedparagraph; - s{^\s*((?:<[^<>]+>)*?or(?:<[^<>]+>)*?)(?:
)?\s*$}{$1\n.PD 0\n.TP\n.PD\n}i if $taggedparagraph; - if(s{^\s*
}{.DS L\n}i) {$displayed=1}
- s{^\t}{ } if $displayed;
- if(s{\s*$}{\n.DE\n\n}i) {$displayed=0}
- elsif(!$displayed) {s{^\s*}{}}
- s{^\s*- }{\n}i;
- s{
|
)(<[^<>]+>)*\s*$}{\n}i) {
- s{
}{.br\n}i; - s{
\s*
\s*$}{\n\n}i; - s{
\s*$}{\n.br\n}i; - s{
}{\n.br\n}i; - s{^\s*(<[^<>]+>)*\s*$}{}; - } - s{<[^<>]+>}{}g; - s{<}{<}ig; - s{>}{>}ig; - s{"}{"}ig; - s{ }{\\ }ig; - s{/var/cache/pdnsd\b}{\@cachedir\@}g; - s{(? -.UE -and was extensively revised by Paul A. Rombouts -.UR -
+ * This method should return an array {inputstream,outputstream + * [,UDPEncapsulation]}. The reason for that is that SOCKS5 protocol allows + * to have method specific encapsulation of data on the socket for purposes + * of integrity or security. And this encapsulation should be performed by + * those streams returned from the method. It is also possible to + * encapsulate datagrams. If authentication method supports such + * encapsulation an instance of the UDPEncapsulation interface should be + * returned as third element of the array, otherwise either null should be + * returned as third element, or array should contain only 2 elements. + * + * @param methodId + * Authentication method selected by the server. + * @param proxySocket + * Socket used to conect to the proxy. + * @return Two or three element array containing Input/Output streams which + * should be used on this connection. Third argument is optional and + * should contain an instance of UDPEncapsulation. It should be + * provided if the authentication method used requires any + * encapsulation to be done on the datagrams. + */ + Object[] doSocksAuthentication(int methodId, java.net.Socket proxySocket) + throws java.io.IOException; +} diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/AuthenticationNone.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/AuthenticationNone.java new file mode 100644 index 00000000..e6821545 --- /dev/null +++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/AuthenticationNone.java @@ -0,0 +1,22 @@ +package com.runjva.sourceforge.jsocks.protocol; + +import java.io.InputStream; +import java.io.OutputStream; + +/** + * SOCKS5 none authentication. Dummy class does almost nothing. + */ +public class AuthenticationNone implements Authentication { + + public Object[] doSocksAuthentication(final int methodId, + final java.net.Socket proxySocket) throws java.io.IOException { + + if (methodId != 0) { + return null; + } + + InputStream in = proxySocket.getInputStream(); + OutputStream out = proxySocket.getOutputStream(); + return new Object[] { in, out }; + } +} diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/InetRange.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/InetRange.java new file mode 100644 index 00000000..fae13587 --- /dev/null +++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/InetRange.java @@ -0,0 +1,492 @@ +package com.runjva.sourceforge.jsocks.protocol; + +import java.net.InetAddress; +import java.net.UnknownHostException; +import java.util.Enumeration; +import java.util.Hashtable; +import java.util.StringTokenizer; +import java.util.Vector; + +/** + * Class InetRange provides the means of defining the range of inetaddresses. + * It's used by Proxy class to store and look up addresses of machines, that + * should be contacted directly rather then through the proxy. + *
+ * InetRange provides several methods to add either standalone addresses, or
+ * ranges (e.g. 100.200.300.0:100.200.300.255, which covers all addresses on on
+ * someones local network). It also provides methods for checking wether given
+ * address is in this range. Any number of ranges and standalone addresses can
+ * be added to the range.
+ */
+public class InetRange implements Cloneable {
+
+ Hashtable
+ * Algorithm:
+ * Allows Proxy chaining so that one Proxy server is connected to another
+ * and so on. If proxy supports SOCKSv4, then only some SOCKSv5 requests can
+ * be handled, UDP would not work, however CONNECT and BIND will be
+ * translated.
+ *
+ * @param p
+ * Proxy which should be used to handle user requests.
+ */
+ public static void setProxy(final SocksProxyBase p) {
+ proxy = p;
+ // FIXME: Side effect.
+ UDPRelayServer.proxy = proxy;
+ }
+
+ public static void setVpnService (final VpnService v)
+ {
+ vpnService = v;
+ }
+ /**
+ * Get proxy.
+ *
+ * @return Proxy wich is used to handle user requests.
+ */
+ public static SocksProxyBase getProxy() {
+ return proxy;
+ }
+
+ /**
+ * Sets the timeout for connections, how long shoud server wait for data to
+ * arrive before dropping the connection.
+ * SOCKS5 protocol allows to send host address as either:
+ *
+ * NOTE:
+ * See documentation on java.net.DatagramSocket for full details on how to
+ * use this method.
+ *
+ * @param dp
+ * Datagram to send.
+ * @throws IOException
+ * If error happens with I/O.
+ */
+ public void send(DatagramPacket dp) throws IOException {
+ // If the host should be accessed directly, send it as is.
+ if (!server_mode && proxy.isDirect(dp.getAddress())) {
+ super.send(dp);
+ //log.debug("Sending datagram packet directly:");
+ return;
+ }
+
+ final byte[] head = formHeader(dp.getAddress(), dp.getPort());
+ byte[] buf = new byte[head.length + dp.getLength()];
+ final byte[] data = dp.getData();
+
+ // Merge head and data
+ System.arraycopy(head, 0, buf, 0, head.length);
+ // System.arraycopy(data,dp.getOffset(),buf,head.length,dp.getLength());
+ System.arraycopy(data, 0, buf, head.length, dp.getLength());
+
+ if (encapsulation != null) {
+ buf = encapsulation.udpEncapsulate(buf, true);
+ }
+
+ super.send(new DatagramPacket(buf, buf.length, relayIP, relayPort));
+ }
+
+ /**
+ * This method allows to send datagram packets with address type DOMAINNAME.
+ * SOCKS5 allows to specify host as names rather than ip addresses.Using
+ * this method one can send udp datagrams through the proxy, without having
+ * to know the ip address of the destination host.
+ *
+ * If proxy specified for that socket has an option resolveAddrLocally set
+ * to true host will be resolved, and the datagram will be send with address
+ * type IPV4, if resolve fails, UnknownHostException is thrown.
+ *
+ * @param dp
+ * Datagram to send, it should contain valid port and data
+ * @param host
+ * Host name to which datagram should be send.
+ * @throws IOException
+ * If error happens with I/O, or the host can't be resolved when
+ * proxy settings say that hosts should be resolved locally.
+ * @see Socks5Proxy#resolveAddrLocally(boolean)
+ */
+ public void send(DatagramPacket dp, String host) throws IOException {
+ if (proxy.isDirect(host)) {
+ dp.setAddress(InetAddress.getByName(host));
+ super.send(dp);
+ return;
+ }
+
+ if ((proxy).resolveAddrLocally) {
+ dp.setAddress(InetAddress.getByName(host));
+ }
+
+ final byte[] head = formHeader(host, dp.getPort());
+ byte[] buf = new byte[head.length + dp.getLength()];
+ final byte[] data = dp.getData();
+ // Merge head and data
+ System.arraycopy(head, 0, buf, 0, head.length);
+ // System.arraycopy(data,dp.getOffset(),buf,head.length,dp.getLength());
+ System.arraycopy(data, 0, buf, head.length, dp.getLength());
+
+ if (encapsulation != null) {
+ buf = encapsulation.udpEncapsulate(buf, true);
+ }
+
+ super.send(new DatagramPacket(buf, buf.length, relayIP, relayPort));
+ }
+
+ /**
+ * Receives udp packet. If packet have arrived from the proxy relay server,
+ * it is processed and address and port of the packet are set to the address
+ * and port of sending host.
+ * This methods checks wether the primary connection to proxy server is
+ * active. If it is, chances are that proxy continues to forward datagrams
+ * being send from this socket. If it was closed, most likely datagrams are
+ * no longer being forwarded by the server.
+ *
+ * Proxy might decide to stop forwarding datagrams, in which case it should
+ * close primary connection. This method allows to check, wether this have
+ * been done.
+ *
+ * You can specify timeout for which we should be checking EOF condition on
+ * the primary connection. Timeout is in milliseconds. Specifying 0 as
+ * timeout implies infinity, in which case method will block, until
+ * connection to proxy is closed or an error happens, and then return false.
+ *
+ * One possible scenario is to call isProxyactive(0) in separate thread, and
+ * once it returned notify other threads about this event.
+ *
+ * @param timeout
+ * For how long this method should block, before returning.
+ * @return true if connection to proxy is active, false if eof or error
+ * condition have been encountered on the connection.
+ */
+ public boolean isProxyAlive(int timeout) {
+ if (server_mode) {
+ return false;
+ }
+ if (proxy != null) {
+ try {
+ proxy.proxySocket.setSoTimeout(timeout);
+
+ final int eof = proxy.in.read();
+ if (eof < 0) {
+ return false; // EOF encountered.
+ } else {
+ //log.warn("This really should not happen");
+ return true; // This really should not happen
+ }
+
+ } catch (final InterruptedIOException iioe) {
+ return true; // read timed out.
+ } catch (final IOException ioe) {
+ return false;
+ }
+ }
+ return false;
+ }
+
+ // PRIVATE METHODS
+ // ////////////////
+
+ private byte[] formHeader(InetAddress ip, int port) {
+ final Socks5Message request = new Socks5Message(0, ip, port);
+ request.data[0] = 0;
+ return request.data;
+ }
+
+ private byte[] formHeader(String host, int port) {
+ final Socks5Message request = new Socks5Message(0, host, port);
+ request.data[0] = 0;
+ return request.data;
+ }
+
+ /*
+ * ======================================================================
+ *
+ * //Mainly Test functions //////////////////////
+ *
+ * private String bytes2String(byte[] b){ String s=""; char[] hex_digit = {
+ * '0','1','2','3','4','5','6','7','8','9', 'A','B','C','D','E','F'};
+ * for(int i=0;i
+ * SOCKS5 protocol allows to send host names rather then IPs in the
+ * requests, this option controls wether the hostnames should be send to the
+ * proxy server as names, or should they be resolved locally.
+ *
+ * @param doResolve
+ * Wether to perform resolution locally.
+ * @return Previous settings.
+ */
+ public boolean resolveAddrLocally(boolean doResolve) {
+ final boolean old = resolveAddrLocally;
+ resolveAddrLocally = doResolve;
+ return old;
+ }
+
+ /**
+ * Get current setting on how the addresses should be handled.
+ *
+ * @return Current setting for address resolution.
+ * @see Socks5Proxy#resolveAddrLocally(boolean doResolve)
+ */
+ public boolean resolveAddrLocally() {
+ return resolveAddrLocally;
+ }
+
+ /**
+ * Adds another authentication method.
+ *
+ * @param methodId
+ * Authentication method id, see rfc1928
+ * @param method
+ * Implementation of Authentication
+ * @see Authentication
+ */
+ public boolean setAuthenticationMethod(int methodId, Authentication method) {
+ if ((methodId < 0) || (methodId > 255)) {
+ return false;
+ }
+ if (method == null) {
+ // Want to remove a particular method
+ return (authMethods.remove(new Integer(methodId)) != null);
+ } else {// Add the method, or rewrite old one
+ authMethods.put(new Integer(methodId), method);
+ }
+ return true;
+ }
+
+ /**
+ * Get authentication method, which corresponds to given method id
+ *
+ * @param methodId
+ * Authentication method id.
+ * @return Implementation for given method or null, if one was not set.
+ */
+ public Authentication getAuthenticationMethod(int methodId) {
+ final Object method = authMethods.get(new Integer(methodId));
+ if (method == null) {
+ return null;
+ }
+ return (Authentication) method;
+ }
+
+ /**
+ * Creates a clone of this Proxy. clone() returns an
+ */
+ @SuppressWarnings("unchecked")
+ public Object clone() {
+ final Socks5Proxy newProxy = new Socks5Proxy(proxyIP, proxyPort);
+
+ final Object o = this.authMethods.clone();
+ newProxy.authMethods = (Hashtable
+ * Tries to look up message which corresponds to this error code.
+ *
+ * @param errCode
+ * Error code for this exception.
+ */
+ public SocksException(int errCode) {
+ this.errCode = errCode;
+ lookupErrorString(errCode);
+ }
+
+ private void lookupErrorString(int errCode) {
+ if ((errCode >> 16) == 0) {
+ if (errCode <= serverReplyMessage.length) {
+ errString = serverReplyMessage[errCode];
+ } else {
+ errString = UNASSIGNED_ERROR_MESSAGE;
+ }
+ } else {
+ // Local error
+ errCode = (errCode >> 16) - 1;
+ if (errCode <= localErrorMessage.length) {
+ errString = localErrorMessage[errCode];
+ } else {
+ errString = UNASSIGNED_ERROR_MESSAGE;
+ }
+ }
+ }
+
+ /**
+ * Construct a SocksException with given error code, and a Throwable cause
+ *
+ * @param errCode
+ * @param t
+ * Nested exception for debugging purposes.
+ */
+ public SocksException(int errCode, Throwable t) {
+ super(t); // Java 1.6+
+ this.errCode = errCode;
+ lookupErrorString(errCode);
+ }
+
+ /**
+ * Constructs a SocksException with given error code and message.
+ *
+ * @param errCode
+ * Error code.
+ * @param errString
+ * Error Message.
+ */
+ public SocksException(int errCode, String errString) {
+ this.errCode = errCode;
+ this.errString = errString;
+ }
+
+ public SocksException(int errCode, String string, Throwable t) {
+ super(string, t); // Java 1.6+
+ this.errCode = errCode;
+ this.errString = string;
+ }
+
+ /**
+ * Get the error code associated with this exception.
+ *
+ * @return Error code associated with this exception.
+ */
+ public int getErrorCode() {
+ return errCode;
+ }
+
+ /**
+ * Get human readable representation of this exception.
+ *
+ * @return String represntation of this exception.
+ */
+ public String toString() {
+ return errString;
+ }
+
+ static final String UNASSIGNED_ERROR_MESSAGE = "Unknown error message";
+
+ static final String serverReplyMessage[] = { "Succeeded",
+ "General SOCKS server failure",
+ "Connection not allowed by ruleset", "Network unreachable",
+ "Host unreachable", "Connection refused", "TTL expired",
+ "Command not supported", "Address type not supported" };
+
+ static final String localErrorMessage[] = { "SOCKS server not specified",
+ "Unable to contact SOCKS server", "IO error",
+ "None of Authentication methods are supported",
+ "Authentication failed", "General SOCKS fault" };
+
+ String errString;
+ int errCode;
+
+}// End of SocksException class
+
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksProxyBase.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksProxyBase.java
new file mode 100644
index 00000000..ebf4fdb8
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksProxyBase.java
@@ -0,0 +1,543 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InterruptedIOException;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.Socket;
+import java.net.UnknownHostException;
+
+/**
+ * Abstract class Proxy, base for classes Socks4Proxy and Socks5Proxy. Defines
+ * methods for specifying default proxy, to be used by all classes of this
+ * package.
+ */
+
+public abstract class SocksProxyBase {
+
+ // Data members
+ protected InetRange directHosts = new InetRange();
+
+ protected InetAddress proxyIP = null;
+ protected String proxyHost = null;
+ protected int proxyPort;
+ protected Socket proxySocket = null;
+
+ protected InputStream in;
+ protected OutputStream out;
+
+ protected int version;
+
+ protected SocksProxyBase chainProxy = null;
+
+ // Protected static/class variables
+ protected static SocksProxyBase defaultProxy = null;
+
+ // Constructors
+ // ====================
+ SocksProxyBase(SocksProxyBase chainProxy, String proxyHost, int proxyPort)
+ throws UnknownHostException {
+ this.chainProxy = chainProxy;
+ this.proxyHost = proxyHost;
+
+ if (chainProxy == null) {
+ this.proxyIP = InetAddress.getByName(proxyHost);
+ }
+
+ this.proxyPort = proxyPort;
+ }
+
+ SocksProxyBase(String proxyHost, int proxyPort) throws UnknownHostException {
+ this(null, proxyHost, proxyPort);
+ }
+
+ SocksProxyBase(SocksProxyBase chainProxy, InetAddress proxyIP, int proxyPort) {
+ this.chainProxy = chainProxy;
+ this.proxyIP = proxyIP;
+ this.proxyPort = proxyPort;
+ }
+
+ SocksProxyBase(InetAddress proxyIP, int proxyPort) {
+ this(null, proxyIP, proxyPort);
+ }
+
+ SocksProxyBase(SocksProxyBase p) {
+ this.proxyIP = p.proxyIP;
+ this.proxyPort = p.proxyPort;
+ this.version = p.version;
+ this.directHosts = p.directHosts;
+ }
+
+ // Public instance methods
+ // ========================
+
+ /**
+ * Get the port on which proxy server is running.
+ *
+ * @return Proxy port.
+ */
+ public int getPort() {
+ return proxyPort;
+ }
+
+ /**
+ * Get the ip address of the proxy server host.
+ *
+ * @return Proxy InetAddress.
+ */
+ public InetAddress getInetAddress() {
+ return proxyIP;
+ }
+
+ /**
+ * Adds given ip to the list of direct addresses. This machine will be
+ * accessed without using proxy.
+ */
+ public void addDirect(InetAddress ip) {
+ directHosts.add(ip);
+ }
+
+ /**
+ * Adds host to the list of direct addresses. This machine will be accessed
+ * without using proxy.
+ */
+ public boolean addDirect(String host) {
+ return directHosts.add(host);
+ }
+
+ /**
+ * Adds given range of addresses to the lsit of direct addresses, machines
+ * within this range will be accessed without using proxy.
+ */
+ public void addDirect(InetAddress from, InetAddress to) {
+ directHosts.add(from, to);
+ }
+
+ /**
+ * Sets given InetRange as the list of direct address, previous list will be
+ * discarded, any changes done previously with addDirect(Inetaddress) will
+ * be lost. The machines in this range will be accessed without using proxy.
+ *
+ * @param ir
+ * InetRange which should be used to look up direct addresses.
+ * @see InetRange
+ */
+ public void setDirect(InetRange ir) {
+ directHosts = ir;
+ }
+
+ /**
+ * Get the list of direct hosts.
+ *
+ * @return Current range of direct address as InetRange object.
+ * @see InetRange
+ */
+ public InetRange getDirect() {
+ return directHosts;
+ }
+
+ /**
+ * Check wether the given host is on the list of direct address.
+ *
+ * @param host
+ * Host name to check.
+ * @return true if the given host is specified as the direct addresses.
+ */
+ public boolean isDirect(String host) {
+ return directHosts.contains(host);
+ }
+
+ /**
+ * Check wether the given host is on the list of direct addresses.
+ *
+ * @param host
+ * Host address to check.
+ * @return true if the given host is specified as the direct address.
+ */
+ public boolean isDirect(InetAddress host) {
+ return directHosts.contains(host);
+ }
+
+ /**
+ * Set the proxy which should be used to connect to given proxy.
+ *
+ * @param chainProxy
+ * Proxy to use to connect to this proxy.
+ */
+ public void setChainProxy(SocksProxyBase chainProxy) {
+ this.chainProxy = chainProxy;
+ }
+
+ /**
+ * Get proxy which is used to connect to this proxy.
+ *
+ * @return Proxy which is used to connect to this proxy, or null if proxy is
+ * to be contacted directly.
+ */
+ public SocksProxyBase getChainProxy() {
+ return chainProxy;
+ }
+
+ /**
+ * Get string representation of this proxy.
+ *
+ * @returns string in the form:proxyHost:proxyPort \t Version versionNumber
+ */
+ public String toString() {
+ return ("" + proxyIP.getHostName() + ":" + proxyPort + "\tVersion " + version);
+ }
+
+ // Public Static(Class) Methods
+ // ==============================
+
+ /**
+ * Sets SOCKS4 proxy as default.
+ *
+ * @param hostName
+ * Host name on which SOCKS4 server is running.
+ * @param port
+ * Port on which SOCKS4 server is running.
+ * @param user
+ * Username to use for communications with proxy.
+ */
+ public static void setDefaultProxy(String hostName, int port, String user)
+ throws UnknownHostException {
+ defaultProxy = new Socks4Proxy(hostName, port, user);
+ }
+
+ /**
+ * Sets SOCKS4 proxy as default.
+ *
+ * @param ipAddress
+ * Host address on which SOCKS4 server is running.
+ * @param port
+ * Port on which SOCKS4 server is running.
+ * @param user
+ * Username to use for communications with proxy.
+ */
+ public static void setDefaultProxy(InetAddress ipAddress, int port,
+ String user) {
+ defaultProxy = new Socks4Proxy(ipAddress, port, user);
+ }
+
+ /**
+ * Sets SOCKS5 proxy as default. Default proxy only supports
+ * no-authentication.
+ *
+ * @param hostName
+ * Host name on which SOCKS5 server is running.
+ * @param port
+ * Port on which SOCKS5 server is running.
+ */
+ public static void setDefaultProxy(String hostName, int port)
+ throws UnknownHostException {
+ defaultProxy = new Socks5Proxy(hostName, port);
+ }
+
+ /**
+ * Sets SOCKS5 proxy as default. Default proxy only supports
+ * no-authentication.
+ *
+ * @param ipAddress
+ * Host address on which SOCKS5 server is running.
+ * @param port
+ * Port on which SOCKS5 server is running.
+ */
+ public static void setDefaultProxy(InetAddress ipAddress, int port) {
+ defaultProxy = new Socks5Proxy(ipAddress, port);
+ }
+
+ /**
+ * Sets default proxy.
+ *
+ * @param p
+ * Proxy to use as default proxy.
+ */
+ public static void setDefaultProxy(SocksProxyBase p) {
+ defaultProxy = p;
+ }
+
+ /**
+ * Get current default proxy.
+ *
+ * @return Current default proxy, or null if none is set.
+ */
+ public static SocksProxyBase getDefaultProxy() {
+ return defaultProxy;
+ }
+
+ /**
+ * Parses strings in the form: host[:port:user:password], and creates proxy
+ * from information obtained from parsing.
+ *
+ * Defaults: port = 1080.
+ * Usefull when address is returned by proxy as the hostname.
+ *
+ * @return the hostname of the address proxy is using to listen for incoming
+ * connection.
+ */
+ public String getHost() {
+ return localHost;
+ }
+
+ /**
+ * Get address assigned by proxy to listen for incomming connections, or the
+ * local machine address if doing direct connection.
+ */
+ public InetAddress getInetAddress() {
+ if (localIP == null) {
+ try {
+ localIP = InetAddress.getByName(localHost);
+ } catch (final UnknownHostException e) {
+ return null;
+ }
+ }
+ return localIP;
+ }
+
+ /**
+ * Get port assigned by proxy to listen for incoming connections, or the
+ * port chosen by local system, if accepting directly.
+ */
+ public int getLocalPort() {
+ return localPort;
+ }
+
+ /**
+ * Set Timeout.
+ *
+ * @param timeout
+ * Amount of time in milliseconds, accept should wait for
+ * incoming connection before failing with exception. Zero
+ * timeout implies infinity.
+ */
+ public void setSoTimeout(int timeout) throws SocketException {
+ super.setSoTimeout(timeout);
+ if (!doing_direct) {
+ proxy.proxySocket.setSoTimeout(timeout);
+ }
+ }
+
+ // Private Methods
+ // ////////////////
+
+ private void processReply(ProxyMessage reply) throws SocksException {
+ localPort = reply.port;
+ /*
+ * If the server have assigned same host as it was contacted on it might
+ * return an address of all zeros
+ */
+ if (reply.host.equals("0.0.0.0")) {
+ localIP = proxy.proxyIP;
+ localHost = localIP.getHostName();
+ } else {
+ localHost = reply.host;
+ localIP = reply.ip;
+ }
+ }
+
+ private void doDirect() {
+ doing_direct = true;
+ localPort = super.getLocalPort();
+ localIP = super.getInetAddress();
+ localHost = localIP.getHostName();
+ }
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksSocket.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksSocket.java
new file mode 100644
index 00000000..0e70c7ae
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksSocket.java
@@ -0,0 +1,385 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.Socket;
+import java.net.SocketException;
+import java.net.UnknownHostException;
+
+/**
+ * SocksSocket tryies to look very similar to normal Socket, while allowing
+ * connections through the SOCKS4 or 5 proxy. To use this class you will have to
+ * identify proxy you need to use, Proxy class allows you to set default proxy,
+ * which will be used by all Socks aware sockets. You can also create either
+ * Socks4Proxy or Socks5Proxy, and use them by passing to the appropriate
+ * constructors.
+ *
+ * Using Socks package can be as easy as that:
+ *
+ *
+ * However if the need exist for more control, like resolving addresses
+ * remotely, or using some non-trivial authentication schemes, it can be done.
+ */
+
+public class SocksSocket extends Socket {
+ // Data members
+ protected SocksProxyBase proxy;
+ protected String localHost, remoteHost;
+ protected InetAddress localIP, remoteIP;
+ protected int localPort, remotePort;
+
+ private Socket directSock = null;
+
+ /**
+ * Tryies to connect to given host and port using default proxy. If no
+ * default proxy speciefied it throws SocksException with error code
+ * SOCKS_NO_PROXY.
+ *
+ * @param host
+ * Machine to connect to.
+ * @param port
+ * Port to which to connect.
+ * @see SocksSocket#SocksSocket(SocksProxyBase,String,int)
+ * @see Socks5Proxy#resolveAddrLocally
+ */
+ public SocksSocket(String host, int port) throws SocksException,
+ UnknownHostException {
+ this(SocksProxyBase.defaultProxy, host, port);
+ }
+
+ /**
+ * Connects to host port using given proxy server.
+ *
+ * @param p
+ * Proxy to use.
+ * @param host
+ * Machine to connect to.
+ * @param port
+ * Port to which to connect.
+ * @throws UnknownHostException
+ * If one of the following happens:
+ *
+ * SOCKSv5 allows for datagrams to be encapsulated for purposes of integrity
+ * and/or authenticity. How it should be done is aggreed during the
+ * authentication stage, and is authentication dependent. This interface is
+ * provided to allow this encapsulation.
+ *
+ * @see Authentication
+ */
+public interface UDPEncapsulation {
+
+ /**
+ * This method should provide any authentication depended transformation on
+ * datagrams being send from/to the client.
+ *
+ * @param data
+ * Datagram data (including any SOCKS related bytes), to be
+ * encapsulated/decapsulated.
+ * @param out
+ * Wether the data is being send out. If true method should
+ * encapsulate/encrypt data, otherwise it should decapsulate/
+ * decrypt data.
+ * @throw IOException if for some reason data can be transformed correctly.
+ * @return Should return byte array containing data after transformation. It
+ * is possible to return same array as input, if transformation only
+ * involves bit mangling, and no additional data is being added or
+ * removed.
+ */
+ byte[] udpEncapsulate(byte[] data, boolean out) throws java.io.IOException;
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UDPRelayServer.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UDPRelayServer.java
new file mode 100644
index 00000000..33ec4ed5
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UDPRelayServer.java
@@ -0,0 +1,227 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.IOException;
+import java.io.InterruptedIOException;
+import java.net.DatagramPacket;
+import java.net.DatagramSocket;
+import java.net.InetAddress;
+import java.net.Socket;
+import java.net.UnknownHostException;
+
+import com.runjva.sourceforge.jsocks.server.ServerAuthenticator;
+
+/**
+ * UDP Relay server, used by ProxyServer to perform udp forwarding.
+ */
+class UDPRelayServer implements Runnable {
+
+ DatagramSocket client_sock;
+ DatagramSocket remote_sock;
+
+ Socket controlConnection;
+
+ int relayPort;
+ InetAddress relayIP;
+
+ Thread pipe_thread1, pipe_thread2;
+ Thread master_thread;
+
+ ServerAuthenticator auth;
+
+ long lastReadTime;
+
+ static SocksProxyBase proxy = null;
+ static int datagramSize = 0xFFFF;// 64K, a bit more than max udp size
+ static int iddleTimeout = 180000;// 3 minutes
+
+ /**
+ * Constructs UDP relay server to communicate with client on given ip and
+ * port.
+ *
+ * @param clientIP
+ * Address of the client from whom datagrams will be recieved and
+ * to whom they will be forwarded.
+ * @param clientPort
+ * Clients port.
+ * @param master_thread
+ * Thread which will be interrupted, when UDP relay server
+ * stoppes for some reason.
+ * @param controlConnection
+ * Socket which will be closed, before interrupting the master
+ * thread, it is introduced due to a bug in windows JVM which
+ * does not throw InterruptedIOException in threads which block
+ * in I/O operation.
+ */
+ public UDPRelayServer(InetAddress clientIP, int clientPort,
+ Thread master_thread, Socket controlConnection,
+ ServerAuthenticator auth) throws IOException {
+
+ this.master_thread = master_thread;
+ this.controlConnection = controlConnection;
+ this.auth = auth;
+
+ client_sock = new Socks5DatagramSocket(true,
+ auth.getUdpEncapsulation(), clientIP, clientPort);
+
+ relayPort = client_sock.getLocalPort();
+ relayIP = client_sock.getLocalAddress();
+
+ if (relayIP.getHostAddress().equals("0.0.0.0")) {
+ relayIP = InetAddress.getLocalHost();
+ }
+
+ if (proxy == null) {
+ remote_sock = new DatagramSocket();
+ } else {
+ remote_sock = new Socks5DatagramSocket(proxy, 0, null);
+ }
+ }
+
+ // Public methods
+ // ///////////////
+
+ /**
+ * Sets the timeout for UDPRelay server.
+ * Does not close control connection, does not interrupt master_thread.
+ */
+ public synchronized void stop() {
+ master_thread = null;
+ controlConnection = null;
+ abort();
+ }
+
+ // Runnable interface
+ // //////////////////
+ public void run() {
+ try {
+ if (Thread.currentThread().getName().equals("pipe1")) {
+ pipe(remote_sock, client_sock, false);
+ } else {
+ pipe(client_sock, remote_sock, true);
+ }
+ } catch (final IOException ioe) {
+ } finally {
+ abort();
+ //log.info("UDP Pipe thread " + Thread.currentThread().getName()
+ // + " stopped.");
+ }
+
+ }
+
+ // Private methods
+ // ///////////////
+ private synchronized void abort() {
+ if (pipe_thread1 == null) {
+ return;
+ }
+
+ //log.info("Aborting UDP Relay Server");
+
+ remote_sock.close();
+ client_sock.close();
+
+ if (controlConnection != null) {
+ try {
+ controlConnection.close();
+ } catch (final IOException ioe) {
+ }
+ }
+
+ if (master_thread != null) {
+ master_thread.interrupt();
+ }
+
+ pipe_thread1.interrupt();
+ pipe_thread2.interrupt();
+
+ pipe_thread1 = null;
+ }
+
+ private void pipe(DatagramSocket from, DatagramSocket to, boolean out)
+ throws IOException {
+ final byte[] data = new byte[datagramSize];
+ final DatagramPacket dp = new DatagramPacket(data, data.length);
+
+ while (true) {
+ try {
+ from.receive(dp);
+ lastReadTime = System.currentTimeMillis();
+
+ if (auth.checkRequest(dp, out)) {
+ to.send(dp);
+ }
+
+ } catch (final UnknownHostException uhe) {
+ //log.info("Dropping datagram for unknown host");
+ } catch (final InterruptedIOException iioe) {
+ // log("Interrupted: "+iioe);
+ // If we were interrupted by other thread.
+ if (iddleTimeout == 0) {
+ return;
+ }
+
+ // If last datagram was received, long time ago, return.
+ final long timeSinceRead = System.currentTimeMillis()
+ - lastReadTime;
+ if (timeSinceRead >= iddleTimeout - 100) {
+ return;
+ }
+ }
+ dp.setLength(data.length);
+ }
+ }
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UserPasswordAuthentication.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UserPasswordAuthentication.java
new file mode 100644
index 00000000..2d5e6001
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UserPasswordAuthentication.java
@@ -0,0 +1,91 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+/**
+ * SOCKS5 User Password authentication scheme.
+ */
+public class UserPasswordAuthentication implements Authentication {
+
+ /** SOCKS ID for User/Password authentication method */
+ public final static int METHOD_ID = 2;
+
+ String userName, password;
+ byte[] request;
+
+ /**
+ * Create an instance of UserPasswordAuthentication.
+ *
+ * @param userName
+ * User Name to send to SOCKS server.
+ * @param password
+ * Password to send to SOCKS server.
+ */
+ public UserPasswordAuthentication(String userName, String password) {
+ this.userName = userName;
+ this.password = password;
+ formRequest();
+ }
+
+ /**
+ * Get the user name.
+ *
+ * @return User name.
+ */
+ public String getUser() {
+ return userName;
+ }
+
+ /**
+ * Get password
+ *
+ * @return Password
+ */
+ public String getPassword() {
+ return password;
+ }
+
+ /**
+ * Does User/Password authentication as defined in rfc1929.
+ *
+ * @return An array containnig in, out streams, or null if authentication
+ * fails.
+ */
+ public Object[] doSocksAuthentication(int methodId,
+ java.net.Socket proxySocket) throws java.io.IOException {
+
+ if (methodId != METHOD_ID) {
+ return null;
+ }
+
+ final java.io.InputStream in = proxySocket.getInputStream();
+ final java.io.OutputStream out = proxySocket.getOutputStream();
+
+ out.write(request);
+ final int version = in.read();
+ if (version < 0) {
+ return null; // Server closed connection
+ }
+ final int status = in.read();
+ if (status != 0) {
+ return null; // Server closed connection, or auth failed.
+ }
+
+ return new Object[] { in, out };
+ }
+
+ // Private methods
+ // ////////////////
+
+ /** Convert UserName password in to binary form, ready to be send to server */
+ private void formRequest() {
+ final byte[] user_bytes = userName.getBytes();
+ final byte[] password_bytes = password.getBytes();
+
+ request = new byte[3 + user_bytes.length + password_bytes.length];
+ request[0] = (byte) 1;
+ request[1] = (byte) user_bytes.length;
+ System.arraycopy(user_bytes, 0, request, 2, user_bytes.length);
+ request[2 + user_bytes.length] = (byte) password_bytes.length;
+ System.arraycopy(password_bytes, 0, request, 3 + user_bytes.length,
+ password_bytes.length);
+ }
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/Ident.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/Ident.java
new file mode 100644
index 00000000..f2b16829
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/Ident.java
@@ -0,0 +1,171 @@
+package com.runjva.sourceforge.jsocks.server;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.InterruptedIOException;
+import java.net.ConnectException;
+import java.net.Socket;
+import java.util.StringTokenizer;
+
+/**
+ * Class Ident provides means to obtain user name of the owner of the socket on
+ * remote machine, providing remote machine runs identd daemon.
+ *
+ * To use it:
+ * If user name was successfully retrieved successful is set to true, and
+ * userName and hostType are set to whatever server returned. If however for
+ * some reason user name was not obtained, successful is set to false and
+ * errorCode contains the code explaining the reason of failure, and
+ * errorMessage contains human readable explanation.
+ *
+ * Constructor may block, for a while.
+ *
+ * @param s
+ * Socket whose ownership on remote end should be obtained.
+ */
+ public Ident(Socket s) {
+ Socket sock = null;
+ successful = false; // We are pessimistic
+
+ try {
+ sock = new Socket(s.getInetAddress(), 113);
+ sock.setSoTimeout(connectionTimeout);
+ final byte[] request = ("" + s.getPort() + " , " + s.getLocalPort() + "\r\n")
+ .getBytes();
+
+ sock.getOutputStream().write(request);
+
+ final BufferedReader in = new BufferedReader(new InputStreamReader(
+ sock.getInputStream()));
+
+ parseResponse(in.readLine());
+
+ } catch (final InterruptedIOException iioe) {
+ errorCode = ERR_TIMEOUT;
+ errorMessage = "Connection to identd timed out.";
+ } catch (final ConnectException ce) {
+ errorCode = ERR_NO_CONNECT;
+ errorMessage = "Connection to identd server failed.";
+
+ } catch (final IOException ioe) {
+ errorCode = ERR_NO_CONNECT;
+ errorMessage = "" + ioe;
+ } finally {
+ try {
+ if (sock != null) {
+ sock.close();
+ }
+ } catch (final IOException ioe) {
+ //log.warn("Could not close socket", ioe);
+ }
+ }
+ }
+
+ private void parseResponse(String response) {
+ if (response == null) {
+ errorCode = ERR_PROTOCOL_INCORRECT;
+ errorMessage = "Identd server closed connection.";
+ return;
+ }
+
+ final StringTokenizer st = new StringTokenizer(response, ":");
+ if (st.countTokens() < 3) {
+ errorCode = ERR_PROTOCOL_INCORRECT;
+ errorMessage = "Can't parse server response.";
+ return;
+ }
+
+ st.nextToken(); // Discard first token, it's basically what we have send
+ final String command = st.nextToken().trim().toUpperCase();
+
+ if (command.equals("USERID") && (st.countTokens() >= 2)) {
+ successful = true;
+ hostType = st.nextToken().trim();
+ userName = st.nextToken("").substring(1);// Get all that is left
+ } else if (command.equals("ERROR")) {
+ errorCode = ERR_PROTOCOL;
+ errorMessage = st.nextToken();
+ } else {
+ errorCode = ERR_PROTOCOL_INCORRECT;
+ System.out.println("Opa!");
+ errorMessage = "Can't parse server response.";
+ }
+
+ }
+
+ // /////////////////////////////////////////////
+ // USED for Testing
+ /*
+ * public static void main(String[] args) throws IOException{
+ *
+ * Socket s = null; s = new Socket("gp101-16", 1391);
+ *
+ * Ident id = new Ident(s); if(id.successful){
+ * System.out.println("User: "+id.userName);
+ * System.out.println("HostType: "+id.hostType); }else{
+ * System.out.println("ErrorCode: "+id.errorCode);
+ * System.out.println("ErrorMessage: "+id.errorMessage);
+ *
+ * }
+ *
+ * if(s!= null) s.close(); } //
+ */
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/IdentAuthenticator.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/IdentAuthenticator.java
new file mode 100644
index 00000000..70e25936
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/IdentAuthenticator.java
@@ -0,0 +1,182 @@
+package com.runjva.sourceforge.jsocks.server;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.Socket;
+import java.util.Enumeration;
+import java.util.Hashtable;
+import java.util.Vector;
+
+import com.runjva.sourceforge.jsocks.protocol.InetRange;
+import com.runjva.sourceforge.jsocks.protocol.ProxyMessage;
+
+/**
+ * An implementation of socks.ServerAuthentication which provides simple
+ * authentication based on the host from which the connection is made and the
+ * name of the user on the remote machine, as reported by identd daemon on the
+ * remote machine.
+ *
+ * It can also be used to provide authentication based only on the contacting
+ * host address.
+ */
+
+public class IdentAuthenticator extends ServerAuthenticatorBase {
+ /** Vector of InetRanges */
+ Vector
+ * At this point no data have been extracted from the connection. It is
+ * responsibility of this method to ensure that the next byte in the stream
+ * after this method have been called is the first byte of the socks request
+ * message. For SOCKSv4 there is no authentication data and the first byte
+ * in the stream is part of the request. With SOCKSv5 however there is an
+ * authentication data first. It is expected that implementaions will
+ * process this authentication data.
+ *
+ * If authentication was successful an instance of ServerAuthentication
+ * should be returned, it later will be used by the server to perform
+ * authorization and some other things. If authentication fails null should
+ * be returned, or an exception may be thrown.
+ *
+ * @param s
+ * Accepted Socket.
+ * @return An instance of ServerAuthenticator to be used for this connection
+ * or null
+ */
+ ServerAuthenticator startSession(Socket s) throws IOException;
+
+ /**
+ * This method should return input stream which should be used on the
+ * accepted socket.
+ *
+ * SOCKSv5 allows to have multiple authentication methods, and these methods
+ * might require some kind of transformations being made on the data.
+ *
+ * This method is called on the object returned from the startSession
+ * function.
+ */
+ InputStream getInputStream();
+
+ /**
+ * This method should return output stream to use to write to the accepted
+ * socket.
+ *
+ * SOCKSv5 allows to have multiple authentication methods, and these methods
+ * might require some kind of transformations being made on the data.
+ *
+ * This method is called on the object returned from the startSession
+ * function.
+ */
+ OutputStream getOutputStream();
+
+ /**
+ * This method should return UDPEncapsulation, which should be used on the
+ * datagrams being send in/out.
+ *
+ * If no transformation should be done on the datagrams, this method should
+ * return null.
+ *
+ * This method is called on the object returned from the startSession
+ * function.
+ */
+
+ UDPEncapsulation getUdpEncapsulation();
+
+ /**
+ * This method is called when a request have been read.
+ *
+ * Implementation should decide wether to grant request or not. Returning
+ * true implies granting the request, false means request should be
+ * rejected.
+ *
+ * This method is called on the object returned from the startSession
+ * function.
+ *
+ * @param msg
+ * Request message.
+ * @return true to grant request, false to reject it.
+ */
+ boolean checkRequest(ProxyMessage msg);
+
+ /**
+ * This method is called when datagram is received by the server.
+ *
+ * Implementaions should decide wether it should be forwarded or dropped. It
+ * is expecteed that implementation will use datagram address and port
+ * information to make a decision, as well as anything else. Address and
+ * port of the datagram are always correspond to remote machine. It is
+ * either destination or source address. If out is true address is
+ * destination address, else it is a source address, address of the machine
+ * from which datagram have been received for the client.
+ *
+ * Implementaions should return true if the datagram is to be forwarded, and
+ * false if the datagram should be dropped.
+ *
+ * This method is called on the object returned from the startSession
+ * function.
+ *
+ * @param out
+ * If true the datagram is being send out(from the client),
+ * otherwise it is an incoming datagram.
+ * @return True to forward datagram false drop it silently.
+ */
+ boolean checkRequest(DatagramPacket dp, boolean out);
+
+ /**
+ * This method is called when session is completed. Either due to normal
+ * termination or due to any error condition.
+ *
+ * This method is called on the object returned from the startSession
+ * function.
+ */
+ void endSession();
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/ServerAuthenticatorBase.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/ServerAuthenticatorBase.java
new file mode 100644
index 00000000..79acd582
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/ServerAuthenticatorBase.java
@@ -0,0 +1,187 @@
+package com.runjva.sourceforge.jsocks.server;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.PushbackInputStream;
+import java.net.Socket;
+
+import com.runjva.sourceforge.jsocks.protocol.ProxyMessage;
+import com.runjva.sourceforge.jsocks.protocol.UDPEncapsulation;
+
+/**
+ * An implementation of ServerAuthenticator, which does not do any
+ * authentication.
+ *
+ * Warning!!
+ * It is only provided to make implementing other authentication schemes easier.
+ *
+ * This method reads in authentication methods that client supports, checks
+ * wether it supports given method. If it does, the notification method is
+ * written back to client, that this method have been chosen for
+ * authentication. If given method was not found, authentication failure
+ * message is send to client ([5,FF]).
+ *
+ * @param in
+ * Input stream, version byte should be removed from the stream
+ * before calling this method.
+ * @param out
+ * Output stream.
+ * @param methodId
+ * Method which should be selected.
+ * @return true if methodId was found, false otherwise.
+ */
+ static public boolean selectSocks5Authentication(InputStream in,
+ OutputStream out, int methodId) throws IOException {
+
+ final int num_methods = in.read();
+ if (num_methods <= 0) {
+ return false;
+ }
+ final byte method_ids[] = new byte[num_methods];
+ final byte response[] = new byte[2];
+ boolean found = false;
+
+ response[0] = (byte) 5; // SOCKS version
+ response[1] = (byte) 0xFF; // Not found, we are pessimistic
+
+ int bread = 0; // bytes read so far
+ while (bread < num_methods) {
+ bread += in.read(method_ids, bread, num_methods - bread);
+ }
+
+ for (int i = 0; i < num_methods; ++i) {
+ if (method_ids[i] == methodId) {
+ found = true;
+ response[1] = (byte) methodId;
+ break;
+ }
+ }
+
+ out.write(response);
+ return found;
+ }
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/ServerAuthenticatorNone.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/ServerAuthenticatorNone.java
new file mode 100644
index 00000000..0e976773
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/ServerAuthenticatorNone.java
@@ -0,0 +1,16 @@
+package com.runjva.sourceforge.jsocks.server;
+
+import java.io.InputStream;
+import java.io.OutputStream;
+
+/**
+ * Simplest possible ServerAuthenticator implementation. Extends common base.
+ *
+ */
+public class ServerAuthenticatorNone extends ServerAuthenticatorBase {
+
+ public ServerAuthenticatorNone(InputStream in, OutputStream out) {
+ super(in, out);
+ }
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/UserPasswordAuthenticator.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/UserPasswordAuthenticator.java
new file mode 100644
index 00000000..82980f29
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/UserPasswordAuthenticator.java
@@ -0,0 +1,82 @@
+package com.runjva.sourceforge.jsocks.server;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.Socket;
+
+/**
+ * This class implements SOCKS5 User/Password authentication scheme as defined
+ * in rfc1929,the server side of it. (see docs/rfc1929.txt)
+ */
+public class UserPasswordAuthenticator extends ServerAuthenticatorBase {
+
+ static final int METHOD_ID = 2;
+
+ UserValidation validator;
+
+ /**
+ * Construct a new UserPasswordAuthentication object, with given
+ * UserVlaidation scheme.
+ *
+ * @param v
+ * UserValidation to use for validating users.
+ */
+ public UserPasswordAuthenticator(UserValidation validator) {
+ this.validator = validator;
+ }
+
+ public ServerAuthenticator startSession(Socket s) throws IOException {
+ final InputStream in = s.getInputStream();
+ final OutputStream out = s.getOutputStream();
+
+ if (in.read() != 5) {
+ return null; // Drop non version 5 messages.
+ }
+
+ if (!selectSocks5Authentication(in, out, METHOD_ID)) {
+ return null;
+ }
+ if (!doUserPasswordAuthentication(s, in, out)) {
+ return null;
+ }
+
+ return new ServerAuthenticatorNone(in, out);
+ }
+
+ // Private Methods
+ // ////////////////
+
+ private boolean doUserPasswordAuthentication(Socket s, InputStream in,
+ OutputStream out) throws IOException {
+ final int version = in.read();
+ if (version != 1) {
+ return false;
+ }
+
+ final int ulen = in.read();
+ if (ulen < 0) {
+ return false;
+ }
+
+ final byte[] user = new byte[ulen];
+ in.read(user);
+ final int plen = in.read();
+ if (plen < 0) {
+ return false;
+ }
+ final byte[] password = new byte[plen];
+ in.read(password);
+
+ if (validator.isUserValid(new String(user), new String(password), s)) {
+ // System.out.println("user valid");
+ out.write(new byte[] { 1, 0 });
+ } else {
+ // System.out.println("user invalid");
+ out.write(new byte[] { 1, 1 });
+ return false;
+ }
+
+ return true;
+ }
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/UserValidation.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/UserValidation.java
new file mode 100644
index 00000000..c4f77703
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/server/UserValidation.java
@@ -0,0 +1,24 @@
+package com.runjva.sourceforge.jsocks.server;
+
+/**
+ * Interface which provides for user validation, based on user name password and
+ * where it connects from.
+ */
+public interface UserValidation {
+ /**
+ * Implementations of this interface are expected to use some or all of the
+ * information provided plus any information they can extract from other
+ * sources to decide wether given user should be allowed access to SOCKS
+ * server, or whatever you use it for.
+ *
+ * @return true to indicate user is valid, false otherwise.
+ * @param username
+ * User whom implementation should validate.
+ * @param password
+ * Password this user provided.
+ * @param connection
+ * Socket which user used to connect to the server.
+ */
+ boolean isUserValid(String username, String password,
+ java.net.Socket connection);
+}
diff --git a/libs/android-support-v4.jar b/libs/android-support-v4.jar
deleted file mode 100644
index aa0b1a5c..00000000
Binary files a/libs/android-support-v4.jar and /dev/null differ
diff --git a/orbotservice/.gitignore b/orbotservice/.gitignore
new file mode 100644
index 00000000..796b96d1
--- /dev/null
+++ b/orbotservice/.gitignore
@@ -0,0 +1 @@
+/build
diff --git a/orbotservice/build.gradle b/orbotservice/build.gradle
new file mode 100644
index 00000000..cfc0a533
--- /dev/null
+++ b/orbotservice/build.gradle
@@ -0,0 +1,33 @@
+apply plugin: 'com.android.library'
+
+android {
+ compileSdkVersion 23
+ buildToolsVersion "23.0.3"
+
+ sourceSets {
+ main {
+ jni.srcDirs = []
+ }
+ }
+
+ defaultConfig {
+ minSdkVersion 9
+ targetSdkVersion 23
+ versionCode 1
+ versionName "1.0"
+
+ }
+ buildTypes {
+ release {
+ minifyEnabled false
+ proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+ }
+ }
+}
+
+dependencies {
+ compile project(':jsocksAndroid')
+ compile 'com.android.support:appcompat-v7:23.4.0'
+ compile fileTree(dir: 'libs', include: ['*.jar','*.so'])
+ testCompile 'junit:junit:4.12'
+}
diff --git a/orbotservice/proguard-rules.pro b/orbotservice/proguard-rules.pro
new file mode 100644
index 00000000..48384c8b
--- /dev/null
+++ b/orbotservice/proguard-rules.pro
@@ -0,0 +1,17 @@
+# Add project specific ProGuard rules here.
+# By default, the flags in this file are appended to flags specified
+# in /home/n8fr8/dev/android/sdk/tools/proguard/proguard-android.txt
+# You can edit the include path and order by changing the proguardFiles
+# directive in build.gradle.
+#
+# For more details, see
+# http://developer.android.com/guide/developing/tools/proguard.html
+
+# Add any project specific keep options here:
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+# public *;
+#}
diff --git a/orbotservice/src/androidTest/java/org/torproject/android/service/ApplicationTest.java b/orbotservice/src/androidTest/java/org/torproject/android/service/ApplicationTest.java
new file mode 100644
index 00000000..70ee563e
--- /dev/null
+++ b/orbotservice/src/androidTest/java/org/torproject/android/service/ApplicationTest.java
@@ -0,0 +1,13 @@
+package org.torproject.android.service;
+
+import android.app.Application;
+import android.test.ApplicationTestCase;
+
+/**
+ * Testing Fundamentals
+ */
+public class ApplicationTest extends ApplicationTestCase
+ *
+ */
+ public synchronized boolean add(final String s0) {
+ if (s0 == null) {
+ return false;
+ }
+
+ String s = s0.trim();
+ if (s.length() == 0) {
+ return false;
+ }
+
+ Object[] entry;
+
+ if (s.endsWith(".")) {
+ // thing like: 111.222.33.
+ // it is being treated as range 111.222.33.000 - 111.222.33.255
+
+ final int[] addr = ip2intarray(s);
+ long from, to;
+ from = to = 0;
+
+ if (addr == null) {
+ return false;
+ }
+ for (int i = 0; i < 4; i++) {
+ if (addr[i] >= 0) {
+ from += (((long) addr[i]) << 8 * (3 - i));
+ } else {
+ to = from;
+ while (i < 4) {
+ to += 255l << 8 * (3 - i++);
+ }
+ break;
+ }
+ }
+ entry = new Object[] { s, null, new Long(from), new Long(to) };
+ all.addElement(entry);
+
+ } else if (s.startsWith(".")) {
+ // Thing like: .myhost.com
+
+ end_names.addElement(s);
+ all.addElement(new Object[] { s, null, null, null });
+ } else {
+ final StringTokenizer tokens = new StringTokenizer(s, " \t\r\n\f:");
+ if (tokens.countTokens() > 1) {
+ entry = new Object[] { s, null, null, null };
+ resolve(entry, tokens.nextToken(), tokens.nextToken());
+ all.addElement(entry);
+ } else {
+ entry = new Object[] { s, null, null, null };
+ all.addElement(entry);
+ host_names.put(s, entry);
+ resolve(entry);
+ }
+
+ }
+
+ return true;
+ }
+
+ /**
+ * Adds another ip for this range.
+ *
+ * @param ip
+ * IP os the host which should be added to this range.
+ */
+ public synchronized void add(final InetAddress ip) {
+ long from, to;
+ from = to = ip2long(ip);
+ all.addElement(new Object[] { ip.getHostName(), ip, new Long(from),
+ new Long(to) });
+ }
+
+ /**
+ * Adds another range of ips for this range.Any host with ip address greater
+ * than or equal to the address of from and smaller than or equal to the
+ * address of to will be included in the range.
+ *
+ * @param from
+ * IP from where range starts(including).
+ * @param to
+ * IP where range ends(including).
+ */
+ public synchronized void add(final InetAddress from, final InetAddress to) {
+ all.addElement(new Object[] {
+ from.getHostAddress() + ":" + to.getHostAddress(), null,
+ new Long(ip2long(from)), new Long(ip2long(to)) });
+ }
+
+ /**
+ * Checks wether the givan host is in the range. Attempts to resolve host
+ * name if required.
+ *
+ * @param host
+ * Host name to check.
+ * @return true If host is in the range, false otherwise.
+ * @see InetRange#contains(String,boolean)
+ */
+ public synchronized boolean contains(final String host) {
+ return contains(host, true);
+ }
+
+ /**
+ * Checks wether the given host is in the range.
+ *
+ * In which case anything that ends with .myhost.net.au will be considered
+ * in the range.
+ *
+ *
+ * This will be treated as range ddd.ddd.ddd.0 to ddd.ddd.ddd.255. It is not
+ * necessary to specify 3 first bytes you can use just one or two. For
+ * example 130. will cover address between 130.0.0.0 and 13.255.255.255.
+ *
+ *
+ * That is two hostnames or ips separated by either whitespace or colon.
+ *
+ *
+ *
+ *
+ * @param host
+ * Host name to check.
+ * @param attemptResolve
+ * Wether to lookup ip address which corresponds to the host,if
+ * required.
+ * @return true If host is in the range, false otherwise.
+ */
+ public synchronized boolean contains(final String host0,
+ final boolean attemptResolve) {
+ if (all.size() == 0) {
+ return false; // Empty range
+ }
+
+ String host = host0.trim();
+ if (host.length() == 0) {
+ return false;
+ }
+
+ if (checkHost(host)) {
+ return true;
+ }
+ if (checkHostEnding(host)) {
+ return true;
+ }
+
+ final long l = host2long(host);
+ if (l >= 0) {
+ return contains(l);
+ }
+
+ if (!attemptResolve) {
+ return false;
+ }
+
+ try {
+ final InetAddress ip = InetAddress.getByName(host);
+ return contains(ip);
+ } catch (final UnknownHostException uhe) {
+
+ }
+
+ return false;
+ }
+
+ /**
+ * Checks wether the given ip is in the range.
+ *
+ * @param ip
+ * Address of the host to check.
+ * @return true If host is in the range, false otherwise.
+ */
+ public synchronized boolean contains(final InetAddress ip) {
+ if (checkHostEnding(ip.getHostName())) {
+ return true;
+ }
+ if (checkHost(ip.getHostName())) {
+ return true;
+ }
+ return contains(ip2long(ip));
+ }
+
+ /**
+ * Get all entries in the range as strings.
+ * These strings can be used to delete entries from the range with remove
+ * function.
+ *
+ * @return Array of entries as strings.
+ * @see InetRange#remove(String)
+ */
+ public synchronized String[] getAll() {
+ final int size = all.size();
+ Object entry[];
+ final String all_names[] = new String[size];
+
+ for (int i = 0; i < size; ++i) {
+ entry = all.elementAt(i);
+ all_names[i] = (String) entry[0];
+ }
+ return all_names;
+ }
+
+ /**
+ * Removes an entry from this range.
+ *
+ * @param s
+ * Entry to remove.
+ * @return true if successfull.
+ */
+ public synchronized boolean remove(final String s) {
+ final Enumeration
+ * Zero timeout implies infinity.
+ * Default timeout is 3 minutes.
+ */
+ public static void setIddleTimeout(final int timeout) {
+ iddleTimeout = timeout;
+ }
+
+ /**
+ * Sets the timeout for BIND command, how long the server should wait for
+ * the incoming connection.
+ * Zero timeout implies infinity.
+ * Default timeout is 3 minutes.
+ */
+ public static void setAcceptTimeout(final int timeout) {
+ acceptTimeout = timeout;
+ }
+
+ /**
+ * Sets the timeout for UDPRelay server.
+ * Zero timeout implies infinity.
+ * Default timeout is 3 minutes.
+ */
+ public static void setUDPTimeout(final int timeout) {
+ UDPRelayServer.setTimeout(timeout);
+ }
+
+ /**
+ * Sets the size of the datagrams used in the UDPRelayServer.
+ * Default size is 64K, a bit more than maximum possible size of the
+ * datagram.
+ */
+ public static void setDatagramSize(final int size) {
+ UDPRelayServer.setDatagramSize(size);
+ }
+
+ /**
+ * Start the Proxy server at given port.
+ * This methods blocks.
+ */
+ public void start(final int port) {
+ start(port, 5, null);
+ }
+
+ /**
+ * Create a server with the specified port, listen backlog, and local IP
+ * address to bind to. The localIP argument can be used on a multi-homed
+ * host for a ServerSocket that will only accept connect requests to one of
+ * its addresses. If localIP is null, it will default accepting connections
+ * on any/all local addresses. The port must be between 0 and 65535,
+ * inclusive.
+ * This methods blocks.
+ */
+ public void start(final int port, final int backlog,
+ final InetAddress localIP) {
+ try {
+ ss = new ServerSocket(port, backlog, localIP);
+ final String address = ss.getInetAddress().getHostAddress();
+ final int localPort = ss.getLocalPort();
+ debug("Starting SOCKS Proxy on: {}:{}", address, localPort);
+
+ while (true) {
+ final Socket s = ss.accept();
+ final String hostName = s.getInetAddress().getHostName();
+ final int port2 = s.getPort();
+ debug("Accepted from:{}:{}", hostName, port2);
+
+ final ProxyServer ps = new ProxyServer(auth, s);
+ (new Thread(ps)).start();
+ }
+ } catch (final Exception ioe) {
+ ioe.printStackTrace();
+ } finally {
+ }
+ }
+
+ /**
+ * Stop server operation.It would be wise to interrupt thread running the
+ * server afterwards.
+ */
+ public void stop() {
+ try {
+ if (ss != null) {
+ ss.close();
+ }
+ } catch (final IOException ioe) {
+ }
+ }
+
+ // Runnable interface
+ // //////////////////
+ public void run() {
+ switch (mode) {
+ case START_MODE:
+ try {
+ startSession();
+ } catch (final IOException ioe) {
+ handleException(ioe);
+ // ioe.printStackTrace();
+ } finally {
+ abort();
+ if (auth != null) {
+ auth.endSession();
+ }
+ debug("Main thread(client->remote)stopped.");
+ }
+ break;
+ case ACCEPT_MODE:
+ try {
+ doAccept();
+ mode = PIPE_MODE;
+ pipe_thread1.interrupt(); // Tell other thread that connection
+ // have
+ // been accepted.
+ pipe(remote_in, out);
+ } catch (final IOException ioe) {
+ // log("Accept exception:"+ioe);
+ handleException(ioe);
+ } finally {
+ abort();
+ debug("Accept thread(remote->client) stopped");
+ }
+ break;
+ case PIPE_MODE:
+ try {
+ pipe(remote_in, out);
+ } catch (final IOException ioe) {
+ } finally {
+ abort();
+ debug("Support thread(remote->client) stopped");
+ }
+ break;
+ case ABORT_MODE:
+ break;
+ default:
+ debug("Unexpected MODE " + mode);
+ }
+ }
+
+ // Private methods
+ // ///////////////
+ private void startSession() throws IOException {
+ sock.setSoTimeout(iddleTimeout);
+
+ try {
+ auth = auth.startSession(sock);
+ } catch (final IOException ioe) {
+ debug("Auth throwed exception:", ioe);
+ auth = null;
+ return;
+ }
+
+ if (auth == null) { // Authentication failed
+ debug("Authentication failed");
+ return;
+ }
+
+ in = auth.getInputStream();
+ out = auth.getOutputStream();
+
+ msg = readMsg(in);
+ handleRequest(msg);
+ }
+
+ private void handleRequest(final ProxyMessage msg) throws IOException {
+ if (!auth.checkRequest(msg)) {
+ throw new SocksException(SocksProxyBase.SOCKS_FAILURE);
+ }
+
+ if (msg.ip == null) {
+ if (msg instanceof Socks5Message) {
+ msg.ip = InetAddress.getByName(msg.host);
+ } else {
+ throw new SocksException(SocksProxyBase.SOCKS_FAILURE);
+ }
+ }
+ log(msg);
+
+ switch (msg.command) {
+ case SocksProxyBase.SOCKS_CMD_CONNECT:
+ onConnect(msg);
+ break;
+ case SocksProxyBase.SOCKS_CMD_BIND:
+ onBind(msg);
+ break;
+ case SocksProxyBase.SOCKS_CMD_UDP_ASSOCIATE:
+ onUDP(msg);
+ break;
+ default:
+ throw new SocksException(SocksProxyBase.SOCKS_CMD_NOT_SUPPORTED);
+ }
+ }
+
+ private void handleException(final IOException ioe) {
+ // If we couldn't read the request, return;
+ if (msg == null) {
+ return;
+ }
+ // If have been aborted by other thread
+ if (mode == ABORT_MODE) {
+ return;
+ }
+ // If the request was successfully completed, but exception happened
+ // later
+ if (mode == PIPE_MODE) {
+ return;
+ }
+
+ int error_code = SocksProxyBase.SOCKS_FAILURE;
+
+ if (ioe instanceof SocksException) {
+ error_code = ((SocksException) ioe).errCode;
+ } else if (ioe instanceof NoRouteToHostException) {
+ error_code = SocksProxyBase.SOCKS_HOST_UNREACHABLE;
+ } else if (ioe instanceof ConnectException) {
+ error_code = SocksProxyBase.SOCKS_CONNECTION_REFUSED;
+ } else if (ioe instanceof InterruptedIOException) {
+ error_code = SocksProxyBase.SOCKS_TTL_EXPIRE;
+ }
+
+ if ((error_code > SocksProxyBase.SOCKS_ADDR_NOT_SUPPORTED)
+ || (error_code < 0)) {
+ error_code = SocksProxyBase.SOCKS_FAILURE;
+ }
+
+ sendErrorMessage(error_code);
+ }
+
+ @SuppressLint("NewApi")
+ private void onConnect(final ProxyMessage msg) throws IOException {
+ Socket s;
+
+ if (proxy == null) {
+
+ s = SocketChannel.open().socket();
+ if ((null != s) && (null != vpnService)) {
+ vpnService.protect(s);
+ }
+
+ s.connect(new InetSocketAddress(msg.ip,msg.port));
+
+ } else {
+ s = new SocksSocket(proxy, msg.ip, msg.port);
+
+ if (vpnService != null)
+ vpnService.protect(s);
+ }
+
+
+ debug("Connected to " + s.getInetAddress() + ":" + s.getPort());
+
+ ProxyMessage response = null;
+ final InetAddress localAddress = s.getLocalAddress();
+ final int localPort = s.getLocalPort();
+
+ if (msg instanceof Socks5Message) {
+ final int cmd = SocksProxyBase.SOCKS_SUCCESS;
+ response = new Socks5Message(cmd, localAddress, localPort);
+ } else {
+ final int cmd = Socks4Message.REPLY_OK;
+ response = new Socks4Message(cmd, localAddress, localPort);
+
+ }
+ response.write(out);
+ startPipe(s);
+ }
+
+ private void onBind(final ProxyMessage msg) throws IOException {
+ ProxyMessage response = null;
+
+ if (proxy == null) {
+ ss = new ServerSocket(0);
+ } else {
+ ss = new SocksServerSocket(proxy, msg.ip, msg.port);
+ }
+
+ ss.setSoTimeout(acceptTimeout);
+
+ final InetAddress inetAddress = ss.getInetAddress();
+ final int localPort = ss.getLocalPort();
+ debug("Trying accept on {}:{}", inetAddress, localPort);
+
+ if (msg.version == 5) {
+ final int cmd = SocksProxyBase.SOCKS_SUCCESS;
+ response = new Socks5Message(cmd, inetAddress, localPort);
+ } else {
+ final int cmd = Socks4Message.REPLY_OK;
+ response = new Socks4Message(cmd, inetAddress, localPort);
+ }
+ response.write(out);
+
+ mode = ACCEPT_MODE;
+
+ pipe_thread1 = Thread.currentThread();
+ pipe_thread2 = new Thread(this);
+ pipe_thread2.start();
+
+ // Make timeout infinit.
+ sock.setSoTimeout(0);
+ int eof = 0;
+
+ try {
+ while ((eof = in.read()) >= 0) {
+ if (mode != ACCEPT_MODE) {
+ if (mode != PIPE_MODE) {
+ return;// Accept failed
+ }
+
+ remote_out.write(eof);
+ break;
+ }
+ }
+ } catch (final EOFException e) {
+ debug("Connection closed while we were trying to accept", e);
+ return;
+ } catch (final InterruptedIOException e) {
+ debug("Interrupted by unsucessful accept thread", e);
+ if (mode != PIPE_MODE) {
+ return;
+ }
+ } finally {
+ // System.out.println("Finnaly!");
+ }
+
+ if (eof < 0) {
+ return;
+ }
+
+ // Do not restore timeout, instead timeout is set on the
+ // remote socket. It does not make any difference.
+
+ pipe(in, remote_out);
+ }
+
+ private void onUDP(final ProxyMessage msg) throws IOException {
+ if (msg.ip.getHostAddress().equals("0.0.0.0")) {
+ msg.ip = sock.getInetAddress();
+ }
+ debug("Creating UDP relay server for {}:{}", msg.ip, msg.port);
+
+ relayServer = new UDPRelayServer(msg.ip, msg.port,
+ Thread.currentThread(), sock, auth);
+
+ ProxyMessage response;
+
+ response = new Socks5Message(SocksProxyBase.SOCKS_SUCCESS,
+ relayServer.relayIP, relayServer.relayPort);
+
+ response.write(out);
+
+ relayServer.start();
+
+ // Make timeout infinit.
+ sock.setSoTimeout(0);
+ try {
+ while (in.read() >= 0) {
+ /* do nothing */;
+ // FIXME: Consider a slight delay here?
+ }
+ } catch (final EOFException eofe) {
+ }
+ }
+
+ // Private methods
+ // ////////////////
+
+ private void doAccept() throws IOException {
+ Socket s = null;
+ final long startTime = System.currentTimeMillis();
+
+ while (true) {
+ s = ss.accept();
+ if (s.getInetAddress().equals(msg.ip)) {
+ // got the connection from the right host
+ // Close listenning socket.
+ ss.close();
+ break;
+ } else if (ss instanceof SocksServerSocket) {
+ // We can't accept more then one connection
+ s.close();
+ ss.close();
+ throw new SocksException(SocksProxyBase.SOCKS_FAILURE);
+ } else {
+ if (acceptTimeout != 0) { // If timeout is not infinit
+ final long passed = System.currentTimeMillis() - startTime;
+ final int newTimeout = acceptTimeout - (int) passed;
+
+ if (newTimeout <= 0) {
+ throw new InterruptedIOException("newTimeout <= 0");
+ }
+ ss.setSoTimeout(newTimeout);
+ }
+ s.close(); // Drop all connections from other hosts
+ }
+ }
+
+ // Accepted connection
+ remote_sock = s;
+ remote_in = s.getInputStream();
+ remote_out = s.getOutputStream();
+
+ // Set timeout
+ remote_sock.setSoTimeout(iddleTimeout);
+
+ final InetAddress inetAddress = s.getInetAddress();
+ final int port = s.getPort();
+ debug("Accepted from {}:{}", s.getInetAddress(), port);
+
+ ProxyMessage response;
+
+ if (msg.version == 5) {
+ final int cmd = SocksProxyBase.SOCKS_SUCCESS;
+ response = new Socks5Message(cmd, inetAddress, port);
+ } else {
+ final int cmd = Socks4Message.REPLY_OK;
+ response = new Socks4Message(cmd, inetAddress, port);
+ }
+ response.write(out);
+ }
+
+ private ProxyMessage readMsg(final InputStream in) throws IOException {
+ PushbackInputStream push_in;
+ if (in instanceof PushbackInputStream) {
+ push_in = (PushbackInputStream) in;
+ } else {
+ push_in = new PushbackInputStream(in);
+ }
+
+ final int version = push_in.read();
+ push_in.unread(version);
+
+ ProxyMessage msg;
+
+ if (version == 5) {
+ msg = new Socks5Message(push_in, false);
+ } else if (version == 4) {
+ msg = new Socks4Message(push_in, false);
+ } else {
+ throw new SocksException(SocksProxyBase.SOCKS_FAILURE);
+ }
+ return msg;
+ }
+
+ private void startPipe(final Socket s) {
+ mode = PIPE_MODE;
+ remote_sock = s;
+ try {
+ remote_in = s.getInputStream();
+ remote_out = s.getOutputStream();
+ pipe_thread1 = Thread.currentThread();
+ pipe_thread2 = new Thread(this);
+ pipe_thread2.start();
+ pipe(in, remote_out);
+ } catch (final IOException ioe) {
+ }
+ }
+
+ private void sendErrorMessage(final int error_code) {
+ ProxyMessage err_msg;
+ if (msg instanceof Socks4Message) {
+ err_msg = new Socks4Message(Socks4Message.REPLY_REJECTED);
+ } else {
+ err_msg = new Socks5Message(error_code);
+ }
+ try {
+ err_msg.write(out);
+ } catch (final IOException ioe) {
+ }
+ }
+
+ private synchronized void abort() {
+ if (mode == ABORT_MODE) {
+ return;
+ }
+ mode = ABORT_MODE;
+ try {
+ debug("Aborting operation");
+ if (remote_sock != null) {
+ remote_sock.close();
+ }
+ if (sock != null) {
+ sock.close();
+ }
+ if (relayServer != null) {
+ relayServer.stop();
+ }
+ if (ss != null) {
+ ss.close();
+ }
+ if (pipe_thread1 != null) {
+ pipe_thread1.interrupt();
+ }
+ if (pipe_thread2 != null) {
+ pipe_thread2.interrupt();
+ }
+ } catch (final IOException ioe) {
+ }
+ }
+
+ static final void log(final ProxyMessage msg) {
+ debug("Request version: {}, Command: ", msg.version,
+ command2String(msg.command));
+
+ final String user = msg.version == 4 ? ", User:" + msg.user : "";
+ debug("IP:" + msg.ip + ", Port:" + msg.port + user);
+ }
+
+ private void pipe(final InputStream in, final OutputStream out)
+ throws IOException {
+ lastReadTime = System.currentTimeMillis();
+ final byte[] buf = new byte[BUF_SIZE];
+ int len = 0;
+ while (len >= 0) {
+ try {
+ if (len != 0) {
+ out.write(buf, 0, len);
+ out.flush();
+ }
+ len = in.read(buf);
+ lastReadTime = System.currentTimeMillis();
+ } catch (final InterruptedIOException iioe) {
+ if (iddleTimeout == 0) {
+ return;// Other thread interrupted us.
+ }
+ final long timeSinceRead = System.currentTimeMillis()
+ - lastReadTime;
+
+ if (timeSinceRead >= iddleTimeout - 1000) {
+ return;
+ }
+ len = 0;
+
+ }
+ }
+ }
+
+ static final String command_names[] = { "CONNECT", "BIND", "UDP_ASSOCIATE" };
+
+ static final String command2String(int cmd) {
+ if ((cmd > 0) && (cmd < 4)) {
+ return command_names[cmd - 1];
+ } else {
+ return "Unknown Command " + cmd;
+ }
+ }
+
+ public static void debug (String msg)
+ {
+ if (DEBUG)
+ Log.d("Proxy",msg);
+ }
+
+ public static void debug (String msg, String host, int port)
+ {
+ if (DEBUG)
+ debug (msg + ": " + host + ":" + port);
+ }
+
+ public static void debug (String msg, Exception e)
+ {
+ if (DEBUG)
+ Log.e("Proxy",msg,e);
+ }
+
+ public static void debug (String msg, InetAddress addr, int port)
+ {
+ if (DEBUG)
+ debug (msg + ": " + addr.getHostAddress() + ": " + port);
+ }
+
+ public static void debug (String msg, int type, String log)
+ {
+ if (DEBUG)
+ debug (msg + " type:" + type + "=" + log);
+ }
+}
\ No newline at end of file
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks4Message.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks4Message.java
new file mode 100644
index 00000000..484ad969
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks4Message.java
@@ -0,0 +1,167 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+/**
+ * SOCKS4 Reply/Request message.
+ */
+
+class Socks4Message extends ProxyMessage {
+
+ private byte[] msgBytes;
+ private int msgLength;
+
+ /**
+ * Server failed reply, cmd command for failed request
+ */
+ public Socks4Message(final int cmd) {
+ super(cmd, null, 0);
+ this.user = null;
+
+ msgLength = 2;
+ msgBytes = new byte[2];
+
+ msgBytes[0] = (byte) 0;
+ msgBytes[1] = (byte) command;
+ }
+
+ /**
+ * Server successfull reply
+ */
+ public Socks4Message(final int cmd, final InetAddress ip, final int port) {
+ this(0, cmd, ip, port, null);
+ }
+
+ /**
+ * Client request
+ */
+ public Socks4Message(final int cmd, final InetAddress ip, final int port,
+ final String user) {
+ this(SOCKS_VERSION, cmd, ip, port, user);
+ }
+
+ /**
+ * Most general constructor
+ */
+ public Socks4Message(final int version, final int cmd,
+ final InetAddress ip, final int port, final String user) {
+
+ super(cmd, ip, port);
+ this.user = user;
+ this.version = version;
+
+ msgLength = user == null ? 8 : 9 + user.length();
+ msgBytes = new byte[msgLength];
+
+ msgBytes[0] = (byte) version;
+ msgBytes[1] = (byte) command;
+ msgBytes[2] = (byte) (port >> 8);
+ msgBytes[3] = (byte) port;
+
+ byte[] addr;
+
+ if (ip != null) {
+ addr = ip.getAddress();
+ } else {
+ addr = new byte[4];
+ addr[0] = addr[1] = addr[2] = addr[3] = 0;
+ }
+ System.arraycopy(addr, 0, msgBytes, 4, 4);
+
+ if (user != null) {
+ final byte[] buf = user.getBytes();
+ System.arraycopy(buf, 0, msgBytes, 8, buf.length);
+ msgBytes[msgBytes.length - 1] = 0;
+ }
+ }
+
+ /**
+ * Initialise from the stream If clientMode is true attempts to read a
+ * server response otherwise reads a client request see read for more detail
+ */
+ public Socks4Message(final InputStream in, final boolean clientMode)
+ throws IOException {
+ msgBytes = null;
+ read(in, clientMode);
+ }
+
+ public void read(final InputStream in) throws IOException {
+ read(in, true);
+ }
+
+ public void read(final InputStream in, final boolean clientMode)
+ throws IOException {
+ final DataInputStream d_in = new DataInputStream(in);
+ version = d_in.readUnsignedByte();
+ command = d_in.readUnsignedByte();
+ if (clientMode && (command != REPLY_OK)) {
+ String errMsg;
+ // FIXME: Range should be replaced with cases.
+ if ((command > REPLY_OK) && (command < REPLY_BAD_IDENTD)) {
+ errMsg = replyMessage[command - REPLY_OK];
+ } else {
+ errMsg = "Unknown Reply Code";
+ }
+ throw new SocksException(command, errMsg);
+ }
+ port = d_in.readUnsignedShort();
+ final byte[] addr = new byte[4];
+ d_in.readFully(addr);
+ ip = bytes2IP(addr);
+ host = ip.getHostName();
+ if (!clientMode) {
+ int b = in.read();
+ // FIXME: Hope there are no idiots with user name bigger than this
+ final byte[] userBytes = new byte[256];
+ int i = 0;
+ for (i = 0; (i < userBytes.length) && (b > 0); ++i) {
+ userBytes[i] = (byte) b;
+ b = in.read();
+ }
+ user = new String(userBytes, 0, i);
+ }
+ }
+
+ public void write(final OutputStream out) throws IOException {
+ if (msgBytes == null) {
+ final Socks4Message msg;
+ msg = new Socks4Message(version, command, ip, port, user);
+ msgBytes = msg.msgBytes;
+ msgLength = msg.msgLength;
+ }
+ out.write(msgBytes);
+ }
+
+ // Class methods
+ static InetAddress bytes2IP(final byte[] addr) {
+ final String s = bytes2IPV4(addr, 0);
+ try {
+ return InetAddress.getByName(s);
+ } catch (final UnknownHostException uh_ex) {
+ return null;
+ }
+ }
+
+ // Constants
+
+ static final String[] replyMessage = { "Request Granted",
+ "Request Rejected or Failed",
+ "Failed request, can't connect to Identd",
+ "Failed request, bad user name" };
+
+ static final int SOCKS_VERSION = 4;
+
+ public final static int REQUEST_CONNECT = 1;
+ public final static int REQUEST_BIND = 2;
+
+ public final static int REPLY_OK = 90;
+ public final static int REPLY_REJECTED = 91;
+ public final static int REPLY_NO_CONNECT = 92;
+ public final static int REPLY_BAD_IDENTD = 93;
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks4Proxy.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks4Proxy.java
new file mode 100644
index 00000000..5850b5e2
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks4Proxy.java
@@ -0,0 +1,144 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+/**
+ * Proxy which describes SOCKS4 proxy.
+ */
+
+public class Socks4Proxy extends SocksProxyBase implements Cloneable {
+
+ // Data members
+ String user;
+
+ // Public Constructors
+ // ====================
+
+ /**
+ * Creates the SOCKS4 proxy
+ *
+ * @param p
+ * Proxy to use to connect to this proxy, allows proxy chaining.
+ * @param proxyHost
+ * Address of the proxy server.
+ * @param proxyPort
+ * Port of the proxy server
+ * @param user
+ * User name to use for identification purposes.
+ * @throws UnknownHostException
+ * If proxyHost can't be resolved.
+ */
+ public Socks4Proxy(SocksProxyBase p, String proxyHost, int proxyPort,
+ String user) throws UnknownHostException {
+ super(p, proxyHost, proxyPort);
+ this.user = new String(user);
+ version = 4;
+ }
+
+ /**
+ * Creates the SOCKS4 proxy
+ *
+ * @param proxyHost
+ * Address of the proxy server.
+ * @param proxyPort
+ * Port of the proxy server
+ * @param user
+ * User name to use for identification purposes.
+ * @throws UnknownHostException
+ * If proxyHost can't be resolved.
+ */
+ public Socks4Proxy(String proxyHost, int proxyPort, String user)
+ throws UnknownHostException {
+ this(null, proxyHost, proxyPort, user);
+ }
+
+ /**
+ * Creates the SOCKS4 proxy
+ *
+ * @param p
+ * Proxy to use to connect to this proxy, allows proxy chaining.
+ * @param proxyIP
+ * Address of the proxy server.
+ * @param proxyPort
+ * Port of the proxy server
+ * @param user
+ * User name to use for identification purposes.
+ */
+ public Socks4Proxy(SocksProxyBase p, InetAddress proxyIP, int proxyPort,
+ String user) {
+ super(p, proxyIP, proxyPort);
+ this.user = new String(user);
+ version = 4;
+ }
+
+ /**
+ * Creates the SOCKS4 proxy
+ *
+ * @param proxyIP
+ * Address of the proxy server.
+ * @param proxyPort
+ * Port of the proxy server
+ * @param user
+ * User name to use for identification purposes.
+ */
+ public Socks4Proxy(InetAddress proxyIP, int proxyPort, String user) {
+ this(null, proxyIP, proxyPort, user);
+ }
+
+ // Public instance methods
+ // ========================
+
+ /**
+ * Creates a clone of this proxy. Changes made to the clone should not
+ * affect this object.
+ */
+ public Object clone() {
+ final Socks4Proxy newProxy = new Socks4Proxy(proxyIP, proxyPort, user);
+ newProxy.directHosts = (InetRange) directHosts.clone();
+ newProxy.chainProxy = chainProxy;
+ return newProxy;
+ }
+
+ // Public Static(Class) Methods
+ // ==============================
+
+ // Protected Methods
+ // =================
+
+ protected SocksProxyBase copy() {
+ final Socks4Proxy copy = new Socks4Proxy(proxyIP, proxyPort, user);
+ copy.directHosts = this.directHosts;
+ copy.chainProxy = chainProxy;
+ return copy;
+ }
+
+ protected ProxyMessage formMessage(int cmd, InetAddress ip, int port) {
+ switch (cmd) {
+ case SOCKS_CMD_CONNECT:
+ cmd = Socks4Message.REQUEST_CONNECT;
+ break;
+ case SOCKS_CMD_BIND:
+ cmd = Socks4Message.REQUEST_BIND;
+ break;
+ default:
+ return null;
+ }
+ return new Socks4Message(cmd, ip, port, user);
+ }
+
+ protected ProxyMessage formMessage(int cmd, String host, int port)
+ throws UnknownHostException {
+
+ return formMessage(cmd, InetAddress.getByName(host), port);
+ }
+
+ protected ProxyMessage formMessage(InputStream in) throws SocksException,
+ IOException {
+
+ return new Socks4Message(in, true);
+ }
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks5DatagramSocket.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks5DatagramSocket.java
new file mode 100644
index 00000000..114d5906
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/Socks5DatagramSocket.java
@@ -0,0 +1,480 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InterruptedIOException;
+import java.net.DatagramPacket;
+import java.net.DatagramSocket;
+import java.net.InetAddress;
+
+/**
+ * Datagram socket to interract through the firewall.
+ * Can be used same way as the normal DatagramSocket. One should be carefull
+ * though with the datagram sizes used, as additional data is present in both
+ * incomming and outgoing datagrams.
+ *
+ *
+ * As with other Socks equivalents, direct addresses are handled transparently,
+ * that is data will be send directly when required by the proxy settings.
+ *
+ * Unlike other SOCKS Sockets, it does not support proxy chaining, and
+ * will throw an exception if proxy has a chain proxy attached. The reason for
+ * that is not my laziness, but rather the restrictions of the SOCKSv5 protocol.
+ * Basicaly SOCKSv5 proxy server, needs to know from which host:port datagrams
+ * will be send for association, and returns address to which datagrams should
+ * be send by the client, but it does not inform client from which host:port it
+ * is going to send datagrams, in fact there is even no guarantee they will be
+ * send at all and from the same address each time.
+ */
+public class Socks5DatagramSocket extends DatagramSocket {
+
+ InetAddress relayIP;
+ int relayPort;
+ Socks5Proxy proxy;
+ private boolean server_mode = false;
+ UDPEncapsulation encapsulation;
+
+ /**
+ * Construct Datagram socket for communication over SOCKS5 proxy server.
+ * This constructor uses default proxy, the one set with
+ * Proxy.setDefaultProxy() method. If default proxy is not set or it is set
+ * to version4 proxy, which does not support datagram forwarding, throws
+ * SocksException.
+ */
+ public Socks5DatagramSocket() throws SocksException, IOException {
+ this(SocksProxyBase.defaultProxy, 0, null);
+ }
+
+ /**
+ * Construct Datagram socket for communication over SOCKS5 proxy server. And
+ * binds it to the specified local port. This constructor uses default
+ * proxy, the one set with Proxy.setDefaultProxy() method. If default proxy
+ * is not set or it is set to version4 proxy, which does not support
+ * datagram forwarding, throws SocksException.
+ */
+ public Socks5DatagramSocket(int port) throws SocksException, IOException {
+ this(SocksProxyBase.defaultProxy, port, null);
+ }
+
+ /**
+ * Construct Datagram socket for communication over SOCKS5 proxy server. And
+ * binds it to the specified local port and address. This constructor uses
+ * default proxy, the one set with Proxy.setDefaultProxy() method. If
+ * default proxy is not set or it is set to version4 proxy, which does not
+ * support datagram forwarding, throws SocksException.
+ */
+ public Socks5DatagramSocket(int port, InetAddress ip)
+ throws SocksException, IOException {
+ this(SocksProxyBase.defaultProxy, port, ip);
+ }
+
+ /**
+ * Constructs datagram socket for communication over specified proxy. And
+ * binds it to the given local address and port. Address of null and port of
+ * 0, signify any availabale port/address. Might throw SocksException, if:
+ *
+ *
+ * Might throw IOException if binding datagram socket to given address/port
+ * fails. See java.net.DatagramSocket for more details.
+ */
+ public Socks5DatagramSocket(SocksProxyBase p, int port, InetAddress ip)
+ throws SocksException, IOException {
+
+ super(port, ip);
+
+ if (p == null) {
+ throw new SocksException(SocksProxyBase.SOCKS_NO_PROXY);
+ }
+
+ if (!(p instanceof Socks5Proxy)) {
+ final String s = "Datagram Socket needs Proxy version 5";
+ throw new SocksException(-1, s);
+ }
+
+ if (p.chainProxy != null) {
+ final String s = "Datagram Sockets do not support proxy chaining.";
+ throw new SocksException(SocksProxyBase.SOCKS_JUST_ERROR, s);
+ }
+
+ proxy = (Socks5Proxy) p.copy();
+
+ final ProxyMessage msg = proxy.udpAssociate(super.getLocalAddress(),
+ super.getLocalPort());
+
+ relayIP = msg.ip;
+ if (relayIP.getHostAddress().equals("0.0.0.0")) {
+ // FIXME: What happens here?
+ relayIP = proxy.proxyIP;
+ }
+ relayPort = msg.port;
+
+ encapsulation = proxy.udp_encapsulation;
+
+ //log.debug("Datagram Socket:{}:{}", getLocalAddress(), getLocalPort());
+ //log.debug("Socks5Datagram: {}:{}", relayIP, relayPort);
+ }
+
+ /**
+ * Used by UDPRelayServer.
+ */
+ Socks5DatagramSocket(boolean server_mode, UDPEncapsulation encapsulation,
+ InetAddress relayIP, int relayPort) throws IOException {
+ super();
+ this.server_mode = server_mode;
+ this.relayIP = relayIP;
+ this.relayPort = relayPort;
+ this.encapsulation = encapsulation;
+ this.proxy = null;
+ }
+
+ /**
+ * Sends the Datagram either through the proxy or directly depending on
+ * current proxy settings and destination address.
+ *
+ * NOTE: DatagramPacket size should be at least 10 bytes less than
+ * the systems limit.
+ *
+ *
+ * If the packet arrived from anywhere else it is not changed.
+ * NOTE: DatagramPacket size should be at least 10 bytes bigger
+ * than the largest packet you expect (this is for IPV4 addresses). For
+ * hostnames and IPV6 it is even more.
+ *
+ * @param dp
+ * Datagram in which all relevent information will be copied.
+ */
+ public void receive(DatagramPacket dp) throws IOException {
+ super.receive(dp);
+
+ if (server_mode) {
+ // Drop all datagrams not from relayIP/relayPort
+ final int init_length = dp.getLength();
+ final int initTimeout = getSoTimeout();
+ final long startTime = System.currentTimeMillis();
+
+ while (!relayIP.equals(dp.getAddress())
+ || (relayPort != dp.getPort())) {
+
+ // Restore datagram size
+ dp.setLength(init_length);
+
+ // If there is a non-infinit timeout on this socket
+ // Make sure that it happens no matter how often unexpected
+ // packets arrive.
+ if (initTimeout != 0) {
+ final long passed = System.currentTimeMillis() - startTime;
+ final int newTimeout = initTimeout - (int) passed;
+
+ if (newTimeout <= 0) {
+ throw new InterruptedIOException(
+ "In Socks5DatagramSocket->receive()");
+ }
+ setSoTimeout(newTimeout);
+ }
+
+ super.receive(dp);
+ }
+
+ // Restore timeout settings
+ if (initTimeout != 0) {
+ setSoTimeout(initTimeout);
+ }
+
+ } else if (!relayIP.equals(dp.getAddress())
+ || (relayPort != dp.getPort())) {
+ return; // Recieved direct packet
+ // If the datagram is not from the relay server, return it it as is.
+ }
+
+ byte[] data;
+ data = dp.getData();
+
+ if (encapsulation != null) {
+ data = encapsulation.udpEncapsulate(data, false);
+ }
+
+ // FIXME: What is this?
+ final int offset = 0; // Java 1.1
+ // int offset = dp.getOffset(); //Java 1.2
+
+ final ByteArrayInputStream bIn = new ByteArrayInputStream(data, offset,
+ dp.getLength());
+
+ final ProxyMessage msg = new Socks5Message(bIn);
+ dp.setPort(msg.port);
+ dp.setAddress(msg.getInetAddress());
+
+ // what wasn't read by the Message is the data
+ final int data_length = bIn.available();
+ // Shift data to the left
+ System.arraycopy(data, offset + dp.getLength() - data_length, data,
+ offset, data_length);
+
+ dp.setLength(data_length);
+ }
+
+ /**
+ * Returns port assigned by the proxy, to which datagrams are relayed. It is
+ * not the same port to which other party should send datagrams.
+ *
+ * @return Port assigned by socks server to which datagrams are send for
+ * association.
+ */
+ public int getLocalPort() {
+ if (server_mode) {
+ return super.getLocalPort();
+ }
+ return relayPort;
+ }
+
+ /**
+ * Address assigned by the proxy, to which datagrams are send for relay. It
+ * is not necesseraly the same address, to which other party should send
+ * datagrams.
+ *
+ * @return Address to which datagrams are send for association.
+ */
+ public InetAddress getLocalAddress() {
+ if (server_mode) {
+ return super.getLocalAddress();
+ }
+ return relayIP;
+ }
+
+ /**
+ * Closes datagram socket, and proxy connection.
+ */
+ public void close() {
+ if (!server_mode) {
+ proxy.endSession();
+ }
+ super.close();
+ }
+
+ /**
+ * This method checks wether proxy still runs udp forwarding service for
+ * this socket.
+ *
+ * If user specified but not password, creates Socks4Proxy, if user not
+ * specified creates Socks5Proxy, if both user and password are speciefied
+ * creates Socks5Proxy with user/password authentication.
+ *
+ * @param proxy_entry
+ * String in the form host[:port:user:password]
+ * @return Proxy created from the string, null if entry was somehow
+ * invalid(host unknown for example, or empty string)
+ */
+ public static SocksProxyBase parseProxy(String proxy_entry) {
+
+ String proxy_host;
+ int proxy_port = 1080;
+ String proxy_user = null;
+ String proxy_password = null;
+ SocksProxyBase proxy;
+
+ final java.util.StringTokenizer st = new java.util.StringTokenizer(
+ proxy_entry, ":");
+ if (st.countTokens() < 1) {
+ return null;
+ }
+
+ proxy_host = st.nextToken();
+ if (st.hasMoreTokens()) {
+ try {
+ proxy_port = Integer.parseInt(st.nextToken().trim());
+ } catch (final NumberFormatException nfe) {
+ }
+ }
+
+ if (st.hasMoreTokens()) {
+ proxy_user = st.nextToken();
+ }
+
+ if (st.hasMoreTokens()) {
+ proxy_password = st.nextToken();
+ }
+
+ try {
+ if (proxy_user == null) {
+ proxy = new Socks5Proxy(proxy_host, proxy_port);
+ } else if (proxy_password == null) {
+ proxy = new Socks4Proxy(proxy_host, proxy_port, proxy_user);
+ } else {
+ proxy = new Socks5Proxy(proxy_host, proxy_port);
+ final UserPasswordAuthentication upa = new UserPasswordAuthentication(
+ proxy_user, proxy_password);
+
+ ((Socks5Proxy) proxy).setAuthenticationMethod(
+ UserPasswordAuthentication.METHOD_ID, upa);
+ }
+ } catch (final UnknownHostException uhe) {
+ return null;
+ }
+
+ return proxy;
+ }
+
+ // Protected Methods
+ // =================
+
+ protected void startSession() throws SocksException {
+ try {
+ if (chainProxy == null) {
+ proxySocket = new Socket(proxyIP, proxyPort);
+ } else if (proxyIP != null) {
+ proxySocket = new SocksSocket(chainProxy, proxyIP, proxyPort);
+ } else {
+ proxySocket = new SocksSocket(chainProxy, proxyHost, proxyPort);
+ }
+
+ in = proxySocket.getInputStream();
+ out = proxySocket.getOutputStream();
+ } catch (final SocksException se) {
+ throw se;
+ } catch (final IOException io_ex) {
+ throw new SocksException(SOCKS_PROXY_IO_ERROR, "" + io_ex);
+ }
+ }
+
+ /**
+ * Create a copy of this proxy for use by individual threads.
+ *
+ * @return proxy
+ */
+ protected abstract SocksProxyBase copy();
+
+ protected abstract ProxyMessage formMessage(int cmd, InetAddress ip,
+ int port);
+
+ protected abstract ProxyMessage formMessage(int cmd, String host, int port)
+ throws UnknownHostException;
+
+ protected abstract ProxyMessage formMessage(InputStream in)
+ throws SocksException, IOException;
+
+ protected ProxyMessage connect(InetAddress ip, int port)
+ throws SocksException {
+ try {
+ startSession();
+ final ProxyMessage request = formMessage(SOCKS_CMD_CONNECT, ip,
+ port);
+ return exchange(request);
+ } catch (final SocksException se) {
+ endSession();
+ throw se;
+ }
+ }
+
+ protected ProxyMessage connect(String host, int port)
+ throws UnknownHostException, SocksException {
+ try {
+ startSession();
+ final ProxyMessage request = formMessage(SOCKS_CMD_CONNECT, host,
+ port);
+ return exchange(request);
+ } catch (final SocksException se) {
+ endSession();
+ throw se;
+ }
+ }
+
+ protected ProxyMessage bind(InetAddress ip, int port) throws SocksException {
+ try {
+ startSession();
+ final ProxyMessage request = formMessage(SOCKS_CMD_BIND, ip, port);
+ return exchange(request);
+ } catch (final SocksException se) {
+ endSession();
+ throw se;
+ }
+ }
+
+ protected ProxyMessage bind(String host, int port)
+ throws UnknownHostException, SocksException {
+ try {
+ startSession();
+ final ProxyMessage request = formMessage(SOCKS_CMD_BIND, host, port);
+ return exchange(request);
+ } catch (final SocksException se) {
+ endSession();
+ throw se;
+ }
+ }
+
+ protected ProxyMessage accept() throws IOException, SocksException {
+ ProxyMessage msg;
+ try {
+ msg = formMessage(in);
+ } catch (final InterruptedIOException iioe) {
+ throw iioe;
+ } catch (final IOException io_ex) {
+ endSession();
+ throw new SocksException(SOCKS_PROXY_IO_ERROR,
+ "While Trying accept:" + io_ex);
+ }
+ return msg;
+ }
+
+ protected ProxyMessage udpAssociate(InetAddress ip, int port)
+ throws SocksException {
+ try {
+ startSession();
+ final ProxyMessage request = formMessage(SOCKS_CMD_UDP_ASSOCIATE,
+ ip, port);
+ if (request != null) {
+ return exchange(request);
+ }
+ } catch (final SocksException se) {
+ endSession();
+ throw se;
+ }
+ // Only get here if request was null
+ endSession();
+ throw new SocksException(SOCKS_METHOD_NOTSUPPORTED,
+ "This version of proxy does not support UDP associate, use version 5");
+ }
+
+ protected ProxyMessage udpAssociate(String host, int port)
+ throws UnknownHostException, SocksException {
+ try {
+ startSession();
+ final ProxyMessage request = formMessage(SOCKS_CMD_UDP_ASSOCIATE,
+ host, port);
+ if (request != null) {
+ return exchange(request);
+ }
+ } catch (final SocksException se) {
+ endSession();
+ throw se;
+ }
+ // Only get here if request was null
+ endSession();
+ throw new SocksException(SOCKS_METHOD_NOTSUPPORTED,
+ "This version of proxy does not support UDP associate, use version 5");
+ }
+
+ protected void endSession() {
+ try {
+ if (proxySocket != null) {
+ proxySocket.close();
+ }
+ proxySocket = null;
+ } catch (final IOException io_ex) {
+ }
+ }
+
+ /**
+ *Sends the request to SOCKS server
+ */
+ protected void sendMsg(ProxyMessage msg) throws SocksException, IOException {
+ msg.write(out);
+ }
+
+ /**
+ * Reads the reply from the SOCKS server
+ */
+ protected ProxyMessage readMsg() throws SocksException, IOException {
+ return formMessage(in);
+ }
+
+ /**
+ *Sends the request reads reply and returns it throws exception if
+ * something wrong with IO or the reply code is not zero
+ */
+ protected ProxyMessage exchange(ProxyMessage request) throws SocksException {
+ ProxyMessage reply;
+ try {
+ request.write(out);
+ reply = formMessage(in);
+ } catch (final SocksException s_ex) {
+ throw s_ex;
+ } catch (final IOException ioe) {
+ throw (new SocksException(SOCKS_PROXY_IO_ERROR, "" + ioe));
+ }
+ return reply;
+ }
+
+ // Private methods
+ // ===============
+
+ // Constants
+
+ public static final int SOCKS_SUCCESS = 0;
+ public static final int SOCKS_FAILURE = 1;
+ public static final int SOCKS_BADCONNECT = 2;
+ public static final int SOCKS_BADNETWORK = 3;
+ public static final int SOCKS_HOST_UNREACHABLE = 4;
+ public static final int SOCKS_CONNECTION_REFUSED = 5;
+ public static final int SOCKS_TTL_EXPIRE = 6;
+ public static final int SOCKS_CMD_NOT_SUPPORTED = 7;
+ public static final int SOCKS_ADDR_NOT_SUPPORTED = 8;
+
+ public static final int SOCKS_NO_PROXY = 1 << 16;
+ public static final int SOCKS_PROXY_NO_CONNECT = 2 << 16;
+ public static final int SOCKS_PROXY_IO_ERROR = 3 << 16;
+ public static final int SOCKS_AUTH_NOT_SUPPORTED = 4 << 16;
+ public static final int SOCKS_AUTH_FAILURE = 5 << 16;
+ public static final int SOCKS_JUST_ERROR = 6 << 16;
+
+ public static final int SOCKS_DIRECT_FAILED = 7 << 16;
+ public static final int SOCKS_METHOD_NOTSUPPORTED = 8 << 16;
+
+ static final int SOCKS_CMD_CONNECT = 0x1;
+ static final int SOCKS_CMD_BIND = 0x2;
+ static final int SOCKS_CMD_UDP_ASSOCIATE = 0x3;
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksServerSocket.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksServerSocket.java
new file mode 100644
index 00000000..8d009cbf
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/SocksServerSocket.java
@@ -0,0 +1,235 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.net.SocketException;
+import java.net.UnknownHostException;
+
+/**
+ * SocksServerSocket allows to accept connections from one particular host
+ * through the SOCKS4 or SOCKS5 proxy.
+ */
+public class SocksServerSocket extends ServerSocket {
+ // Data members
+ protected SocksProxyBase proxy;
+ protected String localHost;
+ protected InetAddress localIP;
+ protected int localPort;
+
+ boolean doing_direct = false;
+ InetAddress remoteAddr;
+
+ /**
+ * Creates ServerSocket capable of accepting one connection through the
+ * firewall, uses default Proxy.
+ *
+ * @param host
+ * Host from which the connection should be recieved.
+ *@param port
+ * Port number of the primary connection.
+ */
+ public SocksServerSocket(String host, int port) throws SocksException,
+ UnknownHostException, IOException {
+ this(SocksProxyBase.defaultProxy, host, port);
+ }
+
+ /**
+ *Creates ServerSocket capable of accepting one connection through the
+ * firewall, uses given proxy.
+ *
+ * @param p
+ * Proxy object to use.
+ *@param host
+ * Host from which the connection should be recieved.
+ *@param port
+ * Port number of the primary connection.
+ */
+ public SocksServerSocket(SocksProxyBase p, String host, int port)
+ throws SocksException, UnknownHostException, IOException {
+
+ super(0);
+ if (p == null) {
+ throw new SocksException(SocksProxyBase.SOCKS_NO_PROXY);
+ }
+ // proxy=p;
+ proxy = p.copy();
+ if (proxy.isDirect(host)) {
+ remoteAddr = InetAddress.getByName(host);
+ proxy = null;
+ doDirect();
+ } else {
+ processReply(proxy.bind(host, port));
+ }
+ }
+
+ /**
+ * Creates ServerSocket capable of accepting one connection through the
+ * firewall, uses default Proxy.
+ *
+ * @param ip
+ * Host from which the connection should be recieved.
+ *@param port
+ * Port number of the primary connection.
+ */
+ public SocksServerSocket(InetAddress ip, int port) throws SocksException,
+ IOException {
+ this(SocksProxyBase.defaultProxy, ip, port);
+ }
+
+ /**
+ *Creates ServerSocket capable of accepting one connection through the
+ * firewall, uses given proxy.
+ *
+ * @param p
+ * Proxy object to use.
+ *@param ip
+ * Host from which the connection should be recieved.
+ *@param port
+ * Port number of the primary connection.
+ */
+ public SocksServerSocket(SocksProxyBase p, InetAddress ip, int port)
+ throws SocksException, IOException {
+ super(0);
+
+ if (p == null) {
+ throw new SocksException(SocksProxyBase.SOCKS_NO_PROXY);
+ }
+ this.proxy = p.copy();
+
+ if (proxy.isDirect(ip)) {
+ remoteAddr = ip;
+ doDirect();
+ } else {
+ processReply(proxy.bind(ip, port));
+ }
+ }
+
+ /**
+ * Accepts the incoming connection.
+ */
+ public Socket accept() throws IOException {
+ Socket s;
+
+ if (!doing_direct) {
+ if (proxy == null) {
+ return null;
+ }
+
+ final ProxyMessage msg = proxy.accept();
+ s = msg.ip == null ? new SocksSocket(msg.host, msg.port, proxy)
+ : new SocksSocket(msg.ip, msg.port, proxy);
+ // Set timeout back to 0
+ proxy.proxySocket.setSoTimeout(0);
+ } else { // Direct Connection
+
+ // Mimic the proxy behaviour,
+ // only accept connections from the speciefed host.
+ while (true) {
+ s = super.accept();
+ if (s.getInetAddress().equals(remoteAddr)) {
+ // got the connection from the right host
+ // Close listenning socket.
+ break;
+ } else {
+ s.close(); // Drop all connections from other hosts
+ }
+ }
+
+ }
+ proxy = null;
+ // Return accepted socket
+ return s;
+ }
+
+ /**
+ * Closes the connection to proxy if socket have not been accepted, if the
+ * direct connection is used, closes direct ServerSocket. If the client
+ * socket have been allready accepted, does nothing.
+ */
+ public void close() throws IOException {
+ super.close();
+ if (proxy != null) {
+ proxy.endSession();
+ }
+ proxy = null;
+ }
+
+ /**
+ * Get the name of the host proxy is using to listen for incoming
+ * connection.
+ *
+ * <tt>
+ *
+ * import Socks.*;
+ * ....
+ *
+ * try{
+ * //Specify SOCKS5 proxy
+ * Proxy.setDefaultProxy("socks-proxy",1080);
+ *
+ * //OR you still use SOCKS4
+ * //Code below uses SOCKS4 proxy
+ * //Proxy.setDefaultProxy("socks-proxy",1080,userName);
+ *
+ * Socket s = SocksSocket("some.host.of.mine",13);
+ * readTimeFromSock(s);
+ * }catch(SocksException sock_ex){
+ * //Usually it will turn in more or less meaningfull message
+ * System.err.println("SocksException:"+sock_ex);
+ * }
+ *
+ * </tt>
+ *
+ *
+ *
+ *
+ * @throws SocksException
+ * If one of the following happens:
+ *
+ *
+ * @throws IOexception
+ * if anything is wrong with I/O.
+ * @see Socks5Proxy#resolveAddrLocally
+ */
+ public SocksSocket(SocksProxyBase p, String host, int port)
+ throws SocksException, UnknownHostException {
+
+ if (p == null) {
+ throw new SocksException(SocksProxyBase.SOCKS_NO_PROXY);
+ }
+ // proxy=p;
+ proxy = p.copy();
+ remoteHost = host;
+ remotePort = port;
+ if (proxy.isDirect(host)) {
+ remoteIP = InetAddress.getByName(host);
+ doDirect();
+ } else {
+ processReply(proxy.connect(host, port));
+ }
+ }
+
+ /**
+ * Tryies to connect to given ip and port using default proxy. If no default
+ * proxy speciefied it throws SocksException with error code SOCKS_NO_PROXY.
+ *
+ * @param ip
+ * Machine to connect to.
+ * @param port
+ * Port to which to connect.
+ * @see SocksSocket#SocksSocket(SocksProxyBase,String,int)
+ */
+ public SocksSocket(InetAddress ip, int port) throws SocksException {
+ this(SocksProxyBase.defaultProxy, ip, port);
+ }
+
+ /**
+ * Connects to given ip and port using given Proxy server.
+ *
+ * @param p
+ * Proxy to use.
+ * @param ip
+ * Machine to connect to.
+ * @param port
+ * Port to which to connect.
+ */
+ public SocksSocket(SocksProxyBase p, InetAddress ip, int port)
+ throws SocksException {
+ if (p == null) {
+ throw new SocksException(SocksProxyBase.SOCKS_NO_PROXY);
+ }
+ this.proxy = p.copy();
+ this.remoteIP = ip;
+ this.remotePort = port;
+ this.remoteHost = ip.getHostName();
+ if (proxy.isDirect(remoteIP)) {
+ doDirect();
+ } else {
+ processReply(proxy.connect(ip, port));
+ }
+ }
+
+ /**
+ * These 2 constructors are used by the SocksServerSocket. This socket
+ * simply overrides remoteHost, remotePort
+ */
+ protected SocksSocket(String host, int port, SocksProxyBase proxy) {
+ this.remotePort = port;
+ this.proxy = proxy;
+ this.localIP = proxy.proxySocket.getLocalAddress();
+ this.localPort = proxy.proxySocket.getLocalPort();
+ this.remoteHost = host;
+ }
+
+ protected SocksSocket(InetAddress ip, int port, SocksProxyBase proxy) {
+ remoteIP = ip;
+ remotePort = port;
+ this.proxy = proxy;
+ this.localIP = proxy.proxySocket.getLocalAddress();
+ this.localPort = proxy.proxySocket.getLocalPort();
+ remoteHost = remoteIP.getHostName();
+ }
+
+ /**
+ * Same as Socket
+ */
+ public void close() throws IOException {
+ if (proxy != null) {
+ proxy.endSession();
+ }
+ proxy = null;
+ }
+
+ /**
+ * Same as Socket
+ */
+ public InputStream getInputStream() {
+ return proxy.in;
+ }
+
+ /**
+ * Same as Socket
+ */
+ public OutputStream getOutputStream() {
+ return proxy.out;
+ }
+
+ /**
+ * Same as Socket
+ */
+ public int getPort() {
+ return remotePort;
+ }
+
+ /**
+ * Returns remote host name, it is usefull in cases when addresses are
+ * resolved by proxy, and we can't create InetAddress object.
+ *
+ * @return The name of the host this socket is connected to.
+ */
+ public String getHost() {
+ return remoteHost;
+ }
+
+ /**
+ * Get remote host as InetAddress object, might return null if addresses are
+ * resolved by proxy, and it is not possible to resolve it locally
+ *
+ * @return Ip address of the host this socket is connected to, or null if
+ * address was returned by the proxy as DOMAINNAME and can't be
+ * resolved locally.
+ */
+ public InetAddress getInetAddress() {
+ if (remoteIP == null) {
+ try {
+ remoteIP = InetAddress.getByName(remoteHost);
+ } catch (final UnknownHostException e) {
+ return null;
+ }
+ }
+ return remoteIP;
+ }
+
+ /**
+ * Get the port assigned by the proxy for the socket, not the port on locall
+ * machine as in Socket.
+ *
+ * @return Port of the socket used on the proxy server.
+ */
+ public int getLocalPort() {
+ return localPort;
+ }
+
+ /**
+ * Get address assigned by proxy to make a remote connection, it might be
+ * different from the host specified for the proxy. Can return null if socks
+ * server returned this address as hostname and it can't be resolved
+ * locally, use getLocalHost() then.
+ *
+ * @return Address proxy is using to make a connection.
+ */
+ public InetAddress getLocalAddress() {
+ if (localIP == null) {
+ try {
+ localIP = InetAddress.getByName(localHost);
+ } catch (final UnknownHostException e) {
+ return null;
+ }
+ }
+ return localIP;
+ }
+
+ /**
+ * Get name of the host, proxy has assigned to make a remote connection for
+ * this socket. This method is usefull when proxy have returned address as
+ * hostname, and we can't resolve it on this machine.
+ *
+ * @return The name of the host proxy is using to make a connection.
+ */
+ public String getLocalHost() {
+ return localHost;
+ }
+
+ /**
+ * Same as socket.
+ */
+ public void setSoLinger(boolean on, int val) throws SocketException {
+ proxy.proxySocket.setSoLinger(on, val);
+ }
+
+ /**
+ * Same as socket.
+ */
+ public int getSoLinger(int timeout) throws SocketException {
+ return proxy.proxySocket.getSoLinger();
+ }
+
+ /**
+ * Same as socket.
+ */
+ public void setSoTimeout(int timeout) throws SocketException {
+ proxy.proxySocket.setSoTimeout(timeout);
+ }
+
+ /**
+ * Same as socket.
+ */
+ public int getSoTimeout(int timeout) throws SocketException {
+ return proxy.proxySocket.getSoTimeout();
+ }
+
+ /**
+ * Same as socket.
+ */
+ public void setTcpNoDelay(boolean on) throws SocketException {
+ proxy.proxySocket.setTcpNoDelay(on);
+ }
+
+ /**
+ * Same as socket.
+ */
+ public boolean getTcpNoDelay() throws SocketException {
+ return proxy.proxySocket.getTcpNoDelay();
+ }
+
+ /**
+ * Get string representation of the socket.
+ */
+ public String toString() {
+ if (directSock != null) {
+ return "Direct connection:" + directSock;
+ }
+ StringBuffer sb = new StringBuffer();
+ sb.append("Proxy:");
+ sb.append(proxy);
+ sb.append(";");
+ sb.append("addr:");
+ sb.append(remoteHost);
+ sb.append(",port:");
+ sb.append(remotePort);
+ sb.append(",localport:");
+ sb.append(localPort);
+ return sb.toString();
+
+ }
+
+ // Private Methods
+ // ////////////////
+
+ private void processReply(ProxyMessage reply) throws SocksException {
+ localPort = reply.port;
+ /*
+ * If the server have assigned same host as it was contacted on it might
+ * return an address of all zeros
+ */
+ if (reply.host.equals("0.0.0.0")) {
+ localIP = proxy.proxyIP;
+ localHost = localIP.getHostName();
+ } else {
+ localHost = reply.host;
+ localIP = reply.ip;
+ }
+ }
+
+ private void doDirect() throws SocksException {
+ try {
+ //log.debug("IP: {}_{}", remoteIP, remotePort);
+ directSock = new Socket(remoteIP, remotePort);
+ proxy.out = directSock.getOutputStream();
+ proxy.in = directSock.getInputStream();
+ proxy.proxySocket = directSock;
+ localIP = directSock.getLocalAddress();
+ localPort = directSock.getLocalPort();
+ } catch (final IOException io_ex) {
+ final int errCode = SocksProxyBase.SOCKS_DIRECT_FAILED;
+ throw new SocksException(errCode, "Direct connect failed:", io_ex);
+ }
+ }
+
+}
diff --git a/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UDPEncapsulation.java b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UDPEncapsulation.java
new file mode 100644
index 00000000..eaa46141
--- /dev/null
+++ b/jsocksAndroid/src/main/java/com/runjva/sourceforge/jsocks/protocol/UDPEncapsulation.java
@@ -0,0 +1,33 @@
+package com.runjva.sourceforge.jsocks.protocol;
+
+/**
+ * This interface provides for datagram encapsulation for SOCKSv5 protocol.
+ *
+ * Zero timeout implies infinity.
+ * Default timeout is 3 minutes.
+ */
+
+ static public void setTimeout(int timeout) {
+ iddleTimeout = timeout;
+ }
+
+ /**
+ * Sets the size of the datagrams used in the UDPRelayServer.
+ * Default size is 64K, a bit more than maximum possible size of the
+ * datagram.
+ */
+ static public void setDatagramSize(int size) {
+ datagramSize = size;
+ }
+
+ /**
+ * Port to which client should send datagram for association.
+ */
+ public int getRelayPort() {
+ return relayPort;
+ }
+
+ /**
+ * IP address to which client should send datagrams for association.
+ */
+ public InetAddress getRelayIP() {
+ return relayIP;
+ }
+
+ /**
+ * Starts udp relay server. Spawns two threads of execution and returns.
+ */
+ public void start() throws IOException {
+ remote_sock.setSoTimeout(iddleTimeout);
+ client_sock.setSoTimeout(iddleTimeout);
+
+ //log.info("Starting UDP relay server on {}:{}", relayIP, relayPort);
+ //log.info("Remote socket {}:{}", remote_sock.getLocalAddress(),
+ // remote_sock.getLocalPort());
+
+ pipe_thread1 = new Thread(this, "pipe1");
+ pipe_thread2 = new Thread(this, "pipe2");
+
+ lastReadTime = System.currentTimeMillis();
+
+ pipe_thread1.start();
+ pipe_thread2.start();
+ }
+
+ /**
+ * Stops Relay server.
+ *
+ Socket s = ss.accept();
+ Ident id = new Ident(s);
+ if(id.successful) goUseUser(id.userName);
+ else handleIdentError(id.errorCode,id.errorMessage)
+
+ */
+public class Ident {
+
+ /** Error Message can be null. */
+ public String errorMessage;
+
+ /** Host type as returned by daemon, can be null, if error happened */
+ public String hostType;
+
+ /** User name as returned by the identd daemon, or null, if it failed */
+ public String userName;
+
+ /**
+ * If this is true then userName and hostType contain valid values. Else
+ * errorCode contain the error code, and errorMessage contains the
+ * corresponding message.
+ */
+ public boolean successful;
+
+ /** Error code */
+ public int errorCode;
+
+ /** Identd on port 113 can't be contacted */
+ public static final int ERR_NO_CONNECT = 1;
+
+ /** Connection timed out */
+ public static final int ERR_TIMEOUT = 2;
+
+ /**
+ * Identd daemon responded with ERROR, in this case errorMessage contains
+ * the string explanation, as send by the daemon.
+ */
+ public static final int ERR_PROTOCOL = 3;
+
+ /**
+ * When parsing server response protocol error happened.
+ */
+ public static final int ERR_PROTOCOL_INCORRECT = 4;
+
+ /**
+ * Maximum amount of time we should wait before dropping the connection to
+ * identd server.Setting it to 0 implies infinit timeout.
+ */
+ public static final int connectionTimeout = 10000;
+
+ /**
+ * Constructor tries to connect to Identd daemon on the host of the given
+ * socket, and retrieve user name of the owner of given socket connection on
+ * remote machine. After constructor returns public fields are initialised
+ * to whatever the server returned.
+ *
+ * Should not be used on machines which are not behind the firewall.
+ *
+ * For Example:
+ class MyAuth extends socks.server.ServerAuthenticator{
+ ...
+ public ServerAuthenticator startSession(java.net.Socket s){
+ if(!checkHost(s.getInetAddress()) return null;
+ return super.startSession(s);
+ }
+
+ boolean checkHost(java.net.Inetaddress addr){
+ boolean allow;
+ //Do it somehow
+ return allow;
+ }
+ }
+
+ */
+public abstract class ServerAuthenticatorBase implements ServerAuthenticator {
+
+ static final byte[] socks5response = { 5, 0 };
+
+ InputStream in;
+ OutputStream out;
+
+ /**
+ * Creates new instance of the ServerAuthenticatorNone.
+ */
+ public ServerAuthenticatorBase() {
+ this.in = null;
+ this.out = null;
+ }
+
+ /**
+ * Constructs new ServerAuthenticatorNone object suitable for returning from
+ * the startSession function.
+ *
+ * @param in
+ * Input stream to return from getInputStream method.
+ * @param out
+ * Output stream to return from getOutputStream method.
+ */
+ public ServerAuthenticatorBase(InputStream in, OutputStream out) {
+ this.in = in;
+ this.out = out;
+ }
+
+ /**
+ * Grants access to everyone.Removes authentication related bytes from the
+ * stream, when a SOCKS5 connection is being made, selects an authentication
+ * NONE.
+ */
+ public ServerAuthenticator startSession(Socket s) throws IOException {
+
+ final PushbackInputStream in = new PushbackInputStream(s
+ .getInputStream());
+ final OutputStream out = s.getOutputStream();
+
+ final int version = in.read();
+ if (version == 5) {
+ if (!selectSocks5Authentication(in, out, 0)) {
+ return null;
+ }
+ } else if (version == 4) {
+ // Else it is the request message already, version 4
+ in.unread(version);
+ } else {
+ return null;
+ }
+
+ return new ServerAuthenticatorNone(in, out);
+ }
+
+ /**
+ * Get input stream.
+ *
+ * @return Input stream speciefied in the constructor.
+ */
+ public InputStream getInputStream() {
+ return in;
+ }
+
+ /**
+ * Get output stream.
+ *
+ * @return Output stream speciefied in the constructor.
+ */
+ public OutputStream getOutputStream() {
+ return out;
+ }
+
+ /**
+ * Allways returns null.
+ *
+ * @return null
+ */
+ public UDPEncapsulation getUdpEncapsulation() {
+ return null;
+ }
+
+ /**
+ * Allways returns true.
+ */
+ public boolean checkRequest(ProxyMessage msg) {
+ return true;
+ }
+
+ /**
+ * Allways returns true.
+ */
+ public boolean checkRequest(java.net.DatagramPacket dp, boolean out) {
+ return true;
+ }
+
+ /**
+ * Does nothing.
+ */
+ public void endSession() {
+ }
+
+ /**
+ * Convinience routine for selecting SOCKSv5 authentication.
+ *
+ *
+ *
+ * circID is the alphanumeric identifier of the affected circuit,
+ * and path is a comma-separated list of alphanumeric ServerIDs.
+ */
+ public void circuitStatus(String status, String circID, String path);
+ /**
+ * Invoked when a stream's status has changed.
+ * Possible values for status are:
+ *
+ *
+ *
+ * streamID is the alphanumeric identifier of the affected stream,
+ * and its target is specified as address:port.
+ */
+ public void streamStatus(String status, String streamID, String target);
+ /**
+ * Invoked when the status of a connection to an OR has changed.
+ * Possible values for status are ["LAUNCHED" | "CONNECTED" | "FAILED" | "CLOSED"].
+ * orName is the alphanumeric identifier of the OR affected.
+ */
+ public void orConnStatus(String status, String orName);
+ /**
+ * Invoked once per second. read and written are
+ * the number of bytes read and written, respectively, in
+ * the last second.
+ */
+ public void bandwidthUsed(long read, long written);
+ /**
+ * Invoked whenever Tor learns about new ORs. The orList object
+ * contains the alphanumeric ServerIDs associated with the new ORs.
+ */
+ public void newDescriptors(java.util.List
+ *
+ */
+ public void signal(String signal) throws IOException {
+ String cmd = "SIGNAL " + signal + "\r\n";
+ sendAndWaitForResponse(cmd, null);
+ }
+
+ /** Send a signal to the Tor process to shut it down or halt it.
+ * Does not wait for a response. */
+ public void shutdownTor(String signal) throws IOException {
+ String s = "SIGNAL " + signal + "\r\n";
+ Waiter w = new Waiter();
+ if (debugOutput != null)
+ debugOutput.print(">> "+s);
+ synchronized (waiters) {
+ output.write(s);
+ output.flush();
+ }
+ }
+
+ /** Tells the Tor server that future SOCKS requests for connections to a set of original
+ * addresses should be replaced with connections to the specified replacement
+ * addresses. Each element of kvLines is a String of the form
+ * "old-address new-address". This function returns the new address mapping.
+ *
+ * The client may decline to provide a body for the original address, and
+ * instead send a special null address ("0.0.0.0" for IPv4, "::0" for IPv6, or
+ * "." for hostname), signifying that the server should choose the original
+ * address itself, and return that address in the reply. The server
+ * should ensure that it returns an element of address space that is unlikely
+ * to be in actual use. If there is already an address mapped to the
+ * destination address, the server may reuse that mapping.
+ *
+ * If the original address is already mapped to a different address, the old
+ * mapping is removed. If the original address and the destination address
+ * are the same, the server removes any mapping in place for the original
+ * address.
+ *
+ * Mappings set by the controller last until the Tor process exits:
+ * they never expire. If the controller wants the mapping to last only
+ * a certain time, then it must explicitly un-map the address when that
+ * time has elapsed.
+ */
+ public Map
+ *
+ */
+ public Map
+ *
+ *
+ * Tor may hold the stream open for a while to flush any data that is pending.
+ */
+ public void closeStream(String streamID, byte reason)
+ throws IOException {
+ sendAndWaitForResponse("CLOSESTREAM "+streamID+" "+reason+"\r\n",null);
+ }
+
+ /** Tells Tor to close the circuit identified by circID.
+ * If ifUnused is true, do not close the circuit unless it is unused.
+ */
+ public void closeCircuit(String circID, boolean ifUnused) throws IOException {
+ sendAndWaitForResponse("CLOSECIRCUIT "+circID+
+ (ifUnused?" IFUNUSED":"")+"\r\n", null);
+ }
+}
+
diff --git a/orbotservice/src/main/java/net/freehaven/tor/control/TorControlError.java b/orbotservice/src/main/java/net/freehaven/tor/control/TorControlError.java
new file mode 100644
index 00000000..d07ee514
--- /dev/null
+++ b/orbotservice/src/main/java/net/freehaven/tor/control/TorControlError.java
@@ -0,0 +1,39 @@
+// Copyright 2005 Nick Mathewson, Roger Dingledine
+// See LICENSE file for copying information
+package org.torproject.android.control;
+
+import java.io.IOException;
+
+/**
+ * An exception raised when Tor tells us about an error.
+ */
+public class TorControlError extends IOException {
+
+ static final long serialVersionUID = 3;
+
+ private final int errorType;
+
+ public TorControlError(int type, String s) {
+ super(s);
+ errorType = type;
+ }
+
+ public TorControlError(String s) {
+ this(-1, s);
+ }
+
+ public int getErrorType() {
+ return errorType;
+ }
+
+ public String getErrorMsg() {
+ try {
+ if (errorType == -1)
+ return null;
+ return TorControlCommands.ERROR_MSGS[errorType];
+ } catch (ArrayIndexOutOfBoundsException ex) {
+ return "Unrecongized error #"+errorType;
+ }
+ }
+}
+
diff --git a/orbotservice/src/main/java/net/freehaven/tor/control/TorControlSyntaxError.java b/orbotservice/src/main/java/net/freehaven/tor/control/TorControlSyntaxError.java
new file mode 100644
index 00000000..dba4f44b
--- /dev/null
+++ b/orbotservice/src/main/java/net/freehaven/tor/control/TorControlSyntaxError.java
@@ -0,0 +1,16 @@
+// Copyright 2005 Nick Mathewson, Roger Dingledine
+// See LICENSE file for copying information
+package org.torproject.android.control;
+
+import java.io.IOException;
+
+/**
+ * An exception raised when Tor behaves in an unexpected way.
+ */
+public class TorControlSyntaxError extends IOException {
+
+ static final long serialVersionUID = 3;
+
+ public TorControlSyntaxError(String s) { super(s); }
+}
+
diff --git a/orbotservice/src/main/java/net/freehaven/tor/control/examples/.cvsignore b/orbotservice/src/main/java/net/freehaven/tor/control/examples/.cvsignore
new file mode 100644
index 00000000..6b468b62
--- /dev/null
+++ b/orbotservice/src/main/java/net/freehaven/tor/control/examples/.cvsignore
@@ -0,0 +1 @@
+*.class
diff --git a/orbotservice/src/main/java/net/freehaven/tor/control/examples/DebuggingEventHandler.java b/orbotservice/src/main/java/net/freehaven/tor/control/examples/DebuggingEventHandler.java
new file mode 100644
index 00000000..48c49a28
--- /dev/null
+++ b/orbotservice/src/main/java/net/freehaven/tor/control/examples/DebuggingEventHandler.java
@@ -0,0 +1,44 @@
+// Copyright 2005 Nick Mathewson, Roger Dingledine
+// See LICENSE file for copying information
+package org.torproject.android.control.examples;
+
+import java.io.PrintWriter;
+import java.util.Iterator;
+import org.torproject.android.control.EventHandler;
+
+public class DebuggingEventHandler implements EventHandler {
+
+ private final PrintWriter out;
+
+ public DebuggingEventHandler(PrintWriter p) {
+ out = p;
+ }
+
+ public void circuitStatus(String status, String circID, String path) {
+ out.println("Circuit "+circID+" is now "+status+" (path="+path+")");
+ }
+ public void streamStatus(String status, String streamID, String target) {
+ out.println("Stream "+streamID+" is now "+status+" (target="+target+")");
+ }
+ public void orConnStatus(String status, String orName) {
+ out.println("OR connection to "+orName+" is now "+status);
+ }
+ public void bandwidthUsed(long read, long written) {
+ out.println("Bandwidth usage: "+read+" bytes read; "+
+ written+" bytes written.");
+ }
+ public void newDescriptors(java.util.List