Merge branch 'restricted_routes' into meshnet

Config.cpp

@@ -124,6 +124,8 @@ namespace config {
       ("notransit", value<bool>()->zero_tokens()->default_value(false), "Router will not accept transit tunnels at startup")
       ("floodfill", value<bool>()->zero_tokens()->default_value(false), "Router will be floodfill")
       ("bandwidth", value<std::string>()->default_value(""), "Bandwidth limit: integer in kbps or letters: L (32), O (256), P (2048), X (>9000)")
+      ("ntcp", value<bool>()->zero_tokens()->default_value(true), "enable ntcp transport")
+      ("ssu", value<bool>()->zero_tokens()->default_value(true), "enable ssu transport")
 #ifdef _WIN32
       ("svcctl",    value<std::string>()->default_value(""),     "Windows service management ('install' or 'remove')")
       ("insomnia", value<bool>()->zero_tokens()->default_value(false), "Prevent system from sleeping")
@@ -206,6 +208,12 @@ namespace config {
 	   "Enable or disable elgamal precomputation table")
 	  ;
 
+  options_description trust("Trust options");
+  trust.add_options()
+    ("trust.enabled", value<bool>()->default_value(false), "enable explicit trust options")
+    ("trust.family", value<std::string>()->default_value(""), "Router Familiy to trust for first hops")
+    ("trust.hidden", value<bool>()->default_value(false), "should we hide our router from other routers?");
+  
     m_OptionsDesc
       .add(general)
 	  .add(limits)	
@@ -217,6 +225,7 @@ namespace config {
 	  .add(i2cp)	
       .add(i2pcontrol)
 	  .add(precomputation)
+      .add(trust)
       ;
   }
 

Daemon.cpp

@@ -197,11 +197,50 @@ namespace i2p
 			i2p::context.SetFamily (family);
 			if (family.length () > 0)
 				LogPrint(eLogInfo, "Daemon: family set to ", family);	
+
+      bool trust; i2p::config::GetOption("trust.enabled", trust);
+      if (trust)
+      {
+        LogPrint(eLogInfo, "Daemon: explicit trust enabled");
+        std::string fam; i2p::config::GetOption("trust.family", fam);
+        if (fam.length() > 0)
+        {
+          LogPrint(eLogInfo, "Daemon: setting restricted routes to use family ", fam);
+          i2p::transport::transports.RestrictRoutes({fam});
+        } else
+          LogPrint(eLogError, "Daemon: no family specified for restricted routes");
+      }
+      bool hidden; i2p::config::GetOption("trust.hidden", hidden);
+      if (hidden)
+      {
+        LogPrint(eLogInfo, "Daemon: using hidden mode");
+        i2p::data::netdb.SetHidden(true);
+      }
       return true;
 		}
 			
 		bool Daemon_Singleton::start()
 		{
+			LogPrint(eLogInfo, "Daemon: starting NetDB");
+			i2p::data::netdb.Start();
+
+#ifdef USE_UPNP
+			LogPrint(eLogInfo, "Daemon: starting UPnP");
+			d.m_UPnP.Start ();
+#endif
+      bool ntcp; i2p::config::GetOption("ntcp", ntcp);
+      bool ssu; i2p::config::GetOption("ssu", ssu);
+			LogPrint(eLogInfo, "Daemon: starting Transports");
+			i2p::transport::transports.Start(ntcp, ssu);
+			if (i2p::transport::transports.IsBoundNTCP() || i2p::transport::transports.IsBoundSSU()) {
+				LogPrint(eLogInfo, "Daemon: Transports started");
+			} else {
+				LogPrint(eLogError, "Daemon: failed to start Transports");
+				/** shut down netdb right away */
+				i2p::data::netdb.Stop();
+				return false;
+			}
+						
 			bool http; i2p::config::GetOption("http.enabled", http);
 			if (http) {
 				std::string httpAddr; i2p::config::GetOption("http.address", httpAddr);
@@ -211,15 +250,6 @@ namespace i2p
 				d.httpServer->Start();
 			}
 
-			LogPrint(eLogInfo, "Daemon: starting NetDB");
-			i2p::data::netdb.Start();
-
-#ifdef USE_UPNP
-			LogPrint(eLogInfo, "Daemon: starting UPnP");
-			d.m_UPnP.Start ();
-#endif			
-			LogPrint(eLogInfo, "Daemon: starting Transports");
-			i2p::transport::transports.Start();
 			
 			LogPrint(eLogInfo, "Daemon: starting Tunnels");
 			i2p::tunnel::tunnels.Start();
@@ -236,6 +266,7 @@ namespace i2p
 				d.m_I2PControlService = std::unique_ptr<i2p::client::I2PControlService>(new i2p::client::I2PControlService (i2pcpAddr, i2pcpPort));
 				d.m_I2PControlService->Start ();
 			}
+
 			return true;
 		}
 

HTTP.cpp

@@ -72,7 +72,11 @@ namespace http {
   bool URL::parse(const std::string& url) {
     std::size_t pos_p = 0; /* < current parse position */
     std::size_t pos_c = 0; /* < work position */
-    if (url.at(0) != '/') {
+    if (url.at(0) == '/' && url.find("/http://") == 0) {
+      /* special case for i2p.rocks inproxy */
+      pos_p ++;
+    }
+    if(url.at(0) != '/' || pos_p > 0) {
       /* schema */
       pos_c = url.find("://");
       if (pos_c != std::string::npos) {

I2CP.cpp

@@ -424,14 +424,25 @@ namespace client
 			if (m_Destination)
 			{
 				i2p::data::IdentityEx identity;
-				offset += identity.FromBuffer (buf + offset, len - offset);
+				size_t identsize = identity.FromBuffer (buf + offset, len - offset);
+        if (identsize)
+        {
+          offset += identsize;
           uint32_t payloadLen = bufbe32toh (buf + offset);
+          if (payloadLen + offset <= len)
+          {            
             offset += 4;
             uint32_t nonce = bufbe32toh (buf + offset + payloadLen);
             if (m_IsSendAccepted) 
               SendMessageStatusMessage (nonce, eI2CPMessageStatusAccepted); // accepted
             m_Destination->SendMsgTo (buf + offset, payloadLen, identity.GetIdentHash (), nonce);
           }
+          else
+            LogPrint(eLogError, "I2CP: cannot send message, too big");
+        }
+        else
+          LogPrint(eLogError, "I2CP: invalid identity");
+			} 
 		}	
 		else
 			LogPrint (eLogError, "I2CP: unexpected sessionID ", sessionID);

Makefile.linux

@@ -28,7 +28,7 @@ endif
 NEEDED_CXXFLAGS += -fPIC
 
 ifeq ($(USE_STATIC),yes)
-  LIBDIR := /usr/lib
+  #LIBDIR = /usr/lib
   LDLIBS  = $(LIBDIR)/libboost_system.a
   LDLIBS += $(LIBDIR)/libboost_date_time.a
   LDLIBS += $(LIBDIR)/libboost_filesystem.a

NTCPSession.cpp

@@ -760,21 +760,33 @@ namespace transport
 			auto& addresses = context.GetRouterInfo ().GetAddresses ();
 			for (auto address: addresses)
 			{
-				if (address->transportStyle == i2p::data::RouterInfo::eTransportNTCP && address->host.is_v4 ())
+				if (address->transportStyle == i2p::data::RouterInfo::eTransportNTCP)
+				{
+					if (address->host.is_v4())
+					{
+						try
 						{
 							m_NTCPAcceptor = new boost::asio::ip::tcp::acceptor (m_Service,
 								boost::asio::ip::tcp::endpoint(boost::asio::ip::tcp::v4(), address->port));
+						} catch ( std::exception & ex ) {
+							/** fail to bind ip4 */
+							LogPrint(eLogError, "NTCP: Failed to bind to ip4 port ",address->port, ex.what());
+							continue;
+						}
 						
 						LogPrint (eLogInfo, "NTCP: Start listening TCP port ", address->port);
 						auto conn = std::make_shared<NTCPSession>(*this);
 						m_NTCPAcceptor->async_accept(conn->GetSocket (), std::bind (&NTCPServer::HandleAccept, this, 
 							conn, std::placeholders::_1));	
-				
+					}
-					if (context.SupportsV6 ())
+					else if (address->host.is_v6() && context.SupportsV6 ())
 					{
 						m_NTCPV6Acceptor = new boost::asio::ip::tcp::acceptor (m_Service);							
+						try
+						{
 							m_NTCPV6Acceptor->open (boost::asio::ip::tcp::v6());
 							m_NTCPV6Acceptor->set_option (boost::asio::ip::v6_only (true));
+							
 							m_NTCPV6Acceptor->bind (boost::asio::ip::tcp::endpoint(boost::asio::ip::tcp::v6(), address->port));
 							m_NTCPV6Acceptor->listen ();
 							
@@ -782,6 +794,10 @@ namespace transport
 							auto conn = std::make_shared<NTCPSession> (*this);
 							m_NTCPV6Acceptor->async_accept(conn->GetSocket (), std::bind (&NTCPServer::HandleAcceptV6,
 								this, conn, std::placeholders::_1));
+						} catch ( std::exception & ex ) {
+							LogPrint(eLogError, "NTCP: failed to bind to ip6 port ", address->port);
+							continue;
+						}
 					}	
 				}
 			}	
@@ -795,8 +811,10 @@ namespace transport
 		if (m_IsRunning)
 		{	
 			m_IsRunning = false;
+      if (m_NTCPAcceptor)
         delete m_NTCPAcceptor;
 			m_NTCPAcceptor = nullptr;
+      if (m_NTCPV6Acceptor)
         delete m_NTCPV6Acceptor;
 			m_NTCPV6Acceptor = nullptr;
 

NTCPSession.h

@@ -145,6 +145,9 @@ namespace transport
 			std::shared_ptr<NTCPSession> FindNTCPSession (const i2p::data::IdentHash& ident);
 			void Connect (const boost::asio::ip::address& address, int port, std::shared_ptr<NTCPSession> conn);
 
+      bool IsBoundV4() const { return m_NTCPAcceptor != nullptr; };
+      bool IsBoundV6() const { return m_NTCPV6Acceptor != nullptr; };
+      
 			boost::asio::io_service& GetService () { return m_Service; };
 			void Ban (const boost::asio::ip::address& addr);			
 

NetDb.cpp

@@ -24,7 +24,7 @@ namespace data
 {		
 	NetDb netdb;
 
-	NetDb::NetDb (): m_IsRunning (false), m_Thread (nullptr), m_Reseeder (nullptr), m_Storage("netDb", "r", "routerInfo-", "dat")
+	NetDb::NetDb (): m_IsRunning (false), m_Thread (nullptr), m_Reseeder (nullptr), m_Storage("netDb", "r", "routerInfo-", "dat"), m_HiddenMode(false)
 	{
 	}
 	
@@ -122,6 +122,10 @@ namespace data
 					}	
 					lastSave = ts;
 				}
+
+        // if we're in hidden mode don't publish or explore
+        if (m_HiddenMode) continue;
+        
 				if (ts - lastPublish >= 2400) // publish every 40 minutes
 				{
 					Publish ();
@@ -161,6 +165,11 @@ namespace data
 		return false;
 	}
 
+  void NetDb::SetHidden(bool hide) {
+    // TODO: remove reachable addresses from router info
+    m_HiddenMode = hide;
+  }
+  
 	bool NetDb::AddRouterInfo (const IdentHash& ident, const uint8_t * buf, int len)
 	{	
 		bool updated = true;	
@@ -955,6 +964,14 @@ namespace data
 		return res;
 	}
 
+  std::shared_ptr<const RouterInfo> NetDb::GetRandomRouterInFamily(const std::string & fam) const {
+    return GetRandomRouter(
+      [fam](std::shared_ptr<const RouterInfo> router)->bool
+      {
+        return router->IsFamily(fam);
+      });
+  }
+  
 	std::shared_ptr<const RouterInfo> NetDb::GetClosestNonFloodfill (const IdentHash& destination, 
 		const std::set<IdentHash>& excluded) const
 	{

NetDb.h

@@ -64,10 +64,14 @@ namespace data
 			std::vector<IdentHash> GetClosestFloodfills (const IdentHash& destination, size_t num,
 				std::set<IdentHash>& excluded, bool closeThanUsOnly = false) const;
 			std::shared_ptr<const RouterInfo> GetClosestNonFloodfill (const IdentHash& destination, const std::set<IdentHash>& excluded) const;
+      std::shared_ptr<const RouterInfo> GetRandomRouterInFamily(const std::string & fam) const;
 			void SetUnreachable (const IdentHash& ident, bool unreachable);			
 
 			void PostI2NPMsg (std::shared_ptr<const I2NPMessage> msg);
 
+      /** set hidden mode, aka don't publish our RI to netdb and don't explore */
+      void SetHidden(bool hide); 
+      
 			void Reseed ();
 			Families& GetFamilies () { return m_Families; };
 
@@ -113,6 +117,9 @@ namespace data
 			NetDbRequests m_Requests;
 
 			std::map<IdentHash, std::pair<std::vector<IdentHash>, uint64_t> > m_LookupResponses; // ident->(closest FFs, timestamp)
+
+      /** true if in hidden mode */
+      bool m_HiddenMode;
 	};
 
 	extern NetDb netdb;

RouterInfo.cpp

@@ -292,6 +292,10 @@ namespace data
 			SetUnreachable (true);
 	}
 
+  bool RouterInfo::IsFamily(const std::string & fam) const {
+    return m_Family == fam;
+  }
+
 	void RouterInfo::ExtractCaps (const char * value)
 	{
 		const char * cap = value;

RouterInfo.h

@@ -171,6 +171,9 @@ namespace data
 			void DeleteBuffer () { delete[] m_Buffer; m_Buffer = nullptr; };
 			bool IsNewer (const uint8_t * buf, size_t len) const;			
 
+      /** return true if we are in a router family and the signature is valid */
+      bool IsFamily(const std::string & fam) const;
+      
 			// implements RoutingDestination
 			const IdentHash& GetIdentHash () const { return m_RouterIdentity->GetIdentHash (); };
 			const uint8_t * GetEncryptionPublicKey () const { return m_RouterIdentity->GetStandardIdentity ().publicKey; };

SAM.cpp

@@ -56,6 +56,7 @@ namespace client
 				if (m_Session)
 				{	
 					m_Session->DelSocket (shared_from_this ());
+					if (m_Session->localDestination)
 						m_Session->localDestination->StopAcceptingStreams ();
 				}
 				break;

Transports.cpp

@@ -105,7 +105,7 @@ namespace transport
 		Stop ();
 	}	
 
-	void Transports::Start ()
+	void Transports::Start (bool enableNTCP, bool enableSSU)
 	{
 		m_DHKeysPairSupplier.Start ();
 		m_IsRunning = true;
@@ -114,22 +114,36 @@ namespace transport
 		auto& addresses = context.GetRouterInfo ().GetAddresses ();
 		for (auto address : addresses)
 		{
-			if (!m_NTCPServer)
+			if (!m_NTCPServer && enableNTCP)
 			{
 				m_NTCPServer = new NTCPServer ();
 				m_NTCPServer->Start ();
+				if (!(m_NTCPServer->IsBoundV6() || m_NTCPServer->IsBoundV4())) {
+					/** failed to bind to NTCP */
+					LogPrint(eLogError, "Transports: failed to bind to TCP");
+					m_NTCPServer->Stop();
+					delete m_NTCPServer;
+					m_NTCPServer = nullptr;
+				}
 			}	
 			
 			if (address->transportStyle == RouterInfo::eTransportSSU)
 			{
-				if (!m_SSUServer)
+				if (!m_SSUServer && enableSSU)
 				{
 					if (address->host.is_v4())
 						m_SSUServer = new SSUServer (address->port);
 					else
 						m_SSUServer = new SSUServer (address->host, address->port);
 					LogPrint (eLogInfo, "Transports: Start listening UDP port ", address->port);
+					try {
 						m_SSUServer->Start ();
+					} catch ( std::exception & ex ) {
+						LogPrint(eLogError, "Transports: Failed to bind to UDP port", address->port);
+						delete m_SSUServer;
+						m_SSUServer = nullptr;
+						continue;
+					}
 					DetectExternalIP ();
 				}
 				else
@@ -291,7 +305,7 @@ namespace transport
 					}
 				}	
 				else
-					LogPrint (eLogWarning, "Transports: NTCP address is not present for ", i2p::data::GetIdentHashAbbreviation (ident), ", trying SSU");
+					LogPrint (eLogDebug, "Transports: NTCP address is not present for ", i2p::data::GetIdentHashAbbreviation (ident), ", trying SSU");
 			}
 			if (peer.numAttempts == 1)// SSU
 			{
@@ -623,6 +637,30 @@ namespace transport
 		std::advance (it, rand () % m_Peers.size ());	
 		return it != m_Peers.end () ? it->second.router : nullptr;
 	}
+  void Transports::RestrictRoutes(std::vector<std::string> families)
+  {
+    std::lock_guard<std::mutex> lock(m_FamilyMutex);
+    m_TrustedFamilies.clear();
+    for ( auto fam : families )
+      m_TrustedFamilies.push_back(fam);
+  }
+
+  bool Transports::RoutesRestricted() const {
+    std::lock_guard<std::mutex> lock(m_FamilyMutex);
+    return m_TrustedFamilies.size() > 0;
+  }
+
+  /** XXX: if routes are not restricted this dies */
+  std::shared_ptr<const i2p::data::RouterInfo> Transports::GetRestrictedPeer() const {
+    std::string fam;
+    {
+      std::lock_guard<std::mutex> lock(m_FamilyMutex);
+      // TODO: random family (?)
+      fam = m_TrustedFamilies[0];
+    }
+    boost::to_lower(fam);
+    return i2p::data::netdb.GetRandomRouterInFamily(fam);
+  }
 }
 }
 

Transports.h

@@ -73,9 +73,12 @@ namespace transport
 			Transports ();
 			~Transports ();
 
-			void Start ();
+			void Start (bool enableNTCP=true, bool enableSSU=true);
 			void Stop ();
 
+			bool IsBoundNTCP() const { return m_NTCPServer != nullptr; }
+			bool IsBoundSSU() const { return m_SSUServer != nullptr; }
+			
 			boost::asio::io_service& GetService () { return m_Service; };
 			std::shared_ptr<i2p::crypto::DHKeys> GetNextDHKeysPair ();	
 			void ReuseDHKeysPair (std::shared_ptr<i2p::crypto::DHKeys> pair);
@@ -98,6 +101,13 @@ namespace transport
 			size_t GetNumPeers () const { return m_Peers.size (); };
 			std::shared_ptr<const i2p::data::RouterInfo> GetRandomPeer () const;
 
+    /** get a trusted first hop for restricted routes */
+    std::shared_ptr<const i2p::data::RouterInfo> GetRestrictedPeer() const;
+    /** do we want to use restricted routes? */
+    bool RoutesRestricted() const;  
+    /** restrict routes to use only these router families for first hops */
+    void RestrictRoutes(std::vector<std::string> families);
+    
 			void PeerTest ();
 			
 		private:
@@ -140,6 +150,10 @@ namespace transport
 			uint64_t m_LastInBandwidthUpdateBytes, m_LastOutBandwidthUpdateBytes;	
 			uint64_t m_LastBandwidthUpdateTime;		
 
+    /** which router families to trust for first hops */
+    std::vector<std::string> m_TrustedFamilies;
+    mutable std::mutex m_FamilyMutex;
+    
 		public:
 
 			// for HTTP only

Tunnel.cpp

@@ -642,7 +642,11 @@ namespace tunnel
 		{
 			// trying to create one more oubound tunnel
 			auto inboundTunnel = GetNextInboundTunnel ();
-			auto router = i2p::data::netdb.GetRandomRouter ();
+      std::shared_ptr<const i2p::data::RouterInfo> router(nullptr);
+      if (i2p::transport::transports.RoutesRestricted())
+        router = i2p::transport::transports.GetRestrictedPeer();
+      else
+        router = i2p::data::netdb.GetRandomRouter ();
 			if (!inboundTunnel || !router) return;
 			LogPrint (eLogDebug, "Tunnel: creating one hop outbound tunnel");
 			CreateTunnel<OutboundTunnel> (
@@ -704,7 +708,11 @@ namespace tunnel
 		if (m_OutboundTunnels.empty () || m_InboundTunnels.size () < 5) 
 		{
 			// trying to create one more inbound tunnel
-			auto router = i2p::data::netdb.GetRandomRouter ();
+      std::shared_ptr<const i2p::data::RouterInfo> router(nullptr);
+      if (i2p::transport::transports.RoutesRestricted())
+        router = i2p::transport::transports.GetRestrictedPeer();
+      else
+        router = i2p::data::netdb.GetRandomRouter ();
       if (!router) {
 				LogPrint (eLogWarning, "Tunnel: can't find any router, skip creating tunnel");
 				return;

TunnelPool.cpp

@@ -331,15 +331,13 @@ namespace tunnel
 		if (m_ExplicitPeers) return SelectExplicitPeers (peers, isInbound);
 		auto prevHop = i2p::context.GetSharedRouterInfo ();	
 		int numHops = isInbound ? m_NumInboundHops : m_NumOutboundHops;
-		if (i2p::transport::transports.GetNumPeers () > 25)
+    if(i2p::transport::transports.RoutesRestricted())
     {
-			auto r = i2p::transport::transports.GetRandomPeer ();
+      /** if routes are restricted prepend trusted first hop */
-			if (r && !r->GetProfile ()->IsBad ())
+      auto hop = i2p::transport::transports.GetRestrictedPeer();
-			{
+      if(!hop) return false;
-				prevHop = r;
+      peers.push_back(hop->GetRouterIdentity());
-				peers.push_back (r->GetRouterIdentity ());
+      prevHop = hop;
-				numHops--;
-			}
     }
     for (int i = 0; i < numHops; i++)
 		{