Fix retry when kx fails

.gitignore

@@ -1,9 +1,9 @@
 *.o
 *.log
 *.scan
-*.m4
 *.cache
 *.status
+aclocal.m4
 Makefile
 Makefile.in
 configure

.travis.yml

@@ -14,7 +14,19 @@ before_script:
     - export PKG_CONFIG_PATH=/tmp/lib/pkgconfig
     - git clone https://github.com/jedisct1/libsodium.git --branch=stable
     - cd libsodium && ./autogen.sh && ./configure --enable-minimal --disable-dependency-tracking --prefix=/tmp && make install && cd -
-    - ./autogen.sh    
+    - ./autogen.sh
 
 script:
     - ./configure --disable-dependency-tracking && make distcheck
+
+deploy:
+    provider: releases
+    api_key:
+        secure: Ira1jd3j+17QVFbJ7KlkytTNp0oMZLTqCWPQLxNHLEt32PVY/IPs/16BcvTbFpKrY+Ma7E3KCihfufTVG8T+jRlZ5hFO7HNpoQMgi7L7yZZAGScYO5pnMQvsr8O9hf7jzSi1DjFXgFHznbPJJ3lOSwegcqzSrbZflokiCR50GTLLWewHoPpfs+1gJ5XbtVyRhZlmXhMPC0NEH2sh33X2WdUiKUJUMOnlYC0atPBL+4n12qxnugF9YA9wPK5NHJSLiPHue7I2rHlSrOLX5NkN3vqnEvusiuIFQX1y0NuKtkpOscFD9n1CLHThGLuzMvPlwpdQfzRMVxwjYFGu6Ma5alf64ksFnMKl8Oo0yCXEA7WvHXz+qUai/a1gzYZLTGuasHtjrHN/mgKxM4QRSiHo8t5hj3CczUW+OFglytawZQyGjyUUiKdwx2kvlO96RVDIYEhUD4DeHzHR8rhvDLmlMlGAWqUPXq7d4D+bExqKmqWCCSkhrbubq5B1kChRmgw7/gly4SryqGy+R0xsC4oq9jUUxd7Sl801BIKcYDb5r5gFSw+hEhOzBb+uE2xJYFNO2KZ+eG69lkFeG3oNJMTy8afs8fRRUXq0poQJ39wFWerps3Md7h8Sxs61YLIAKHvLJJMfoMI+AORTcjnnpqujMhgWGWt8wLhJZdxaSycoQkU=
+    skip_cleanup: true
+    file_glob: true
+    file: glorytun-*.tar.gz
+    on:
+        tags: true
+        repo: angt/glorytun
+        condition: "${TRAVIS_OS_NAME}-${CC} == linux-gcc"

Makefile.am

@@ -1,4 +1,7 @@
+ACLOCAL_AMFLAGS = -I m4 --install
+
 bin_PROGRAMS = glorytun
+
 glorytun_CFLAGS = $(libsodium_CFLAGS)
 glorytun_LDADD = $(libsodium_LIBS)
 glorytun_SOURCES = \
@@ -11,3 +14,9 @@ glorytun_SOURCES = \
     src/option.h \
     src/tun.c \
     src/tun.h
+
+EXTRA_DIST = \
+	LICENSE \
+	README.md \
+	autogen.sh \
+	version.sh

README.md

@@ -1,8 +1,10 @@
-# glorytun
+# Glorytun
 
-**Work In Progress:** Do not touch!
+Small, Simple and Stupid **TCP** VPN.
 
-glorytun depends on [libsodium](https://github.com/jedisct1/libsodium) version >= 1.0.4
+**Work In Progress:** Do not touch! This code will probably format your harddisk!
+
+Glorytun depends on [libsodium](https://github.com/jedisct1/libsodium) version >= 1.0.4
 and needs an AES-NI capable CPU.
 
 To build and install the latest version:
@@ -16,5 +18,5 @@ To build and install the latest version:
 
 To create and use a new secret key:
 
-    $ dd if=/dev/urandom of=glorytun.key bs=32 count=1
+    $ hexdump -n 32 /dev/urandom -e '"%X"' > glorytun.key
     # glorytun keyfile glorytun.key [...]

autogen.sh

@@ -1,2 +1,3 @@
 #!/bin/sh
+
 autoreconf -i -f

configure.ac

@@ -1,11 +1,16 @@
 AC_PREREQ([2.65])
-AC_INIT([glorytun], [0.0.3], [https://github.com/angt/glorytun/issues],
-        [glorytun], [https://github.com/angt/glorytun])
+AC_INIT([glorytun],
+        [m4_esyscmd([./version.sh])],
+        [https://github.com/angt/glorytun/issues],
+        [glorytun],
+        [https://github.com/angt/glorytun])
 AC_CONFIG_SRCDIR([src/common.h])
 AC_CONFIG_AUX_DIR([build-aux])
+AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([1.9 -Wall -Werror foreign tar-ustar subdir-objects])
 AM_DEP_TRACK
 AM_SILENT_RULES([yes])
+AM_PROG_CC_C_O
 AC_PROG_CC_C99
 AC_USE_SYSTEM_EXTENSIONS
 AC_SEARCH_LIBS([getaddrinfo], [resolv nsl])

m4/pkg.m4

@@ -0,0 +1,275 @@
+dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+dnl serial 11 (pkg-config-0.29)
+dnl
+dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
+dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2 of the License, or
+dnl (at your option) any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful, but
+dnl WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+dnl General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+dnl 02111-1307, USA.
+dnl
+dnl As a special exception to the GNU General Public License, if you
+dnl distribute this file as part of a program that contains a
+dnl configuration script generated by Autoconf, you may include it under
+dnl the same distribution terms that you use for the rest of that
+dnl program.
+
+dnl PKG_PREREQ(MIN-VERSION)
+dnl -----------------------
+dnl Since: 0.29
+dnl
+dnl Verify that the version of the pkg-config macros are at least
+dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
+dnl installed version of pkg-config, this checks the developer's version
+dnl of pkg.m4 when generating configure.
+dnl
+dnl To ensure that this macro is defined, also add:
+dnl m4_ifndef([PKG_PREREQ],
+dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
+dnl
+dnl See the "Since" comment for each macro you use to see what version
+dnl of the macros you require.
+m4_defun([PKG_PREREQ],
+[m4_define([PKG_MACROS_VERSION], [0.29])
+m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
+    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
+])dnl PKG_PREREQ
+
+dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
+dnl ----------------------------------
+dnl Since: 0.16
+dnl
+dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
+dnl first found in the path. Checks that the version of pkg-config found
+dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
+dnl used since that's the first version where most current features of
+dnl pkg-config existed.
+AC_DEFUN([PKG_PROG_PKG_CONFIG],
+[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
+m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
+m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
+AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
+AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
+AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
+
+if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
+	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
+fi
+if test -n "$PKG_CONFIG"; then
+	_pkg_min_version=m4_default([$1], [0.9.0])
+	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
+	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
+		AC_MSG_RESULT([yes])
+	else
+		AC_MSG_RESULT([no])
+		PKG_CONFIG=""
+	fi
+fi[]dnl
+])dnl PKG_PROG_PKG_CONFIG
+
+dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------------------------------
+dnl Since: 0.18
+dnl
+dnl Check to see whether a particular set of modules exists. Similar to
+dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
+dnl
+dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+dnl only at the first occurence in configure.ac, so if the first place
+dnl it's called might be skipped (such as if it is within an "if", you
+dnl have to call PKG_CHECK_EXISTS manually
+AC_DEFUN([PKG_CHECK_EXISTS],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+if test -n "$PKG_CONFIG" && \
+    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
+  m4_default([$2], [:])
+m4_ifvaln([$3], [else
+  $3])dnl
+fi])
+
+dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
+dnl ---------------------------------------------
+dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
+dnl pkg_failed based on the result.
+m4_define([_PKG_CONFIG],
+[if test -n "$$1"; then
+    pkg_cv_[]$1="$$1"
+ elif test -n "$PKG_CONFIG"; then
+    PKG_CHECK_EXISTS([$3],
+                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes ],
+		     [pkg_failed=yes])
+ else
+    pkg_failed=untried
+fi[]dnl
+])dnl _PKG_CONFIG
+
+dnl _PKG_SHORT_ERRORS_SUPPORTED
+dnl ---------------------------
+dnl Internal check to see if pkg-config supports short errors.
+AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi[]dnl
+])dnl _PKG_SHORT_ERRORS_SUPPORTED
+
+
+dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl --------------------------------------------------------------
+dnl Since: 0.4.0
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
+dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
+AC_DEFUN([PKG_CHECK_MODULES],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
+AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
+
+pkg_failed=no
+AC_MSG_CHECKING([for $1])
+
+_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
+_PKG_CONFIG([$1][_LIBS], [libs], [$2])
+
+m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
+and $1[]_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.])
+
+if test $pkg_failed = yes; then
+   	AC_MSG_RESULT([no])
+        _PKG_SHORT_ERRORS_SUPPORTED
+        if test $_pkg_short_errors_supported = yes; then
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+        else 
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+
+	m4_default([$4], [AC_MSG_ERROR(
+[Package requirements ($2) were not met:
+
+$$1_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+_PKG_TEXT])[]dnl
+        ])
+elif test $pkg_failed = untried; then
+     	AC_MSG_RESULT([no])
+	m4_default([$4], [AC_MSG_FAILURE(
+[The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+_PKG_TEXT
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
+        ])
+else
+	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        AC_MSG_RESULT([yes])
+	$3
+fi[]dnl
+])dnl PKG_CHECK_MODULES
+
+
+dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl ---------------------------------------------------------------------
+dnl Since: 0.29
+dnl
+dnl Checks for existence of MODULES and gathers its build flags with
+dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
+dnl and VARIABLE-PREFIX_LIBS from --libs.
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
+dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
+dnl configure.ac.
+AC_DEFUN([PKG_CHECK_MODULES_STATIC],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+_save_PKG_CONFIG=$PKG_CONFIG
+PKG_CONFIG="$PKG_CONFIG --static"
+PKG_CHECK_MODULES($@)
+PKG_CONFIG=$_save_PKG_CONFIG[]dnl
+])dnl PKG_CHECK_MODULES_STATIC
+
+
+dnl PKG_INSTALLDIR([DIRECTORY])
+dnl -------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable pkgconfigdir as the location where a module
+dnl should install pkg-config .pc files. By default the directory is
+dnl $libdir/pkgconfig, but the default can be changed by passing
+dnl DIRECTORY. The user can override through the --with-pkgconfigdir
+dnl parameter.
+AC_DEFUN([PKG_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([pkgconfigdir],
+    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
+    [with_pkgconfigdir=]pkg_default)
+AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_INSTALLDIR
+
+
+dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
+dnl --------------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable noarch_pkgconfigdir as the location where a
+dnl module should install arch-independent pkg-config .pc files. By
+dnl default the directory is $datadir/pkgconfig, but the default can be
+dnl changed by passing DIRECTORY. The user can override through the
+dnl --with-noarch-pkgconfigdir parameter.
+AC_DEFUN([PKG_NOARCH_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([noarch-pkgconfigdir],
+    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
+    [with_noarch_pkgconfigdir=]pkg_default)
+AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_NOARCH_INSTALLDIR
+
+
+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------
+dnl Since: 0.28
+dnl
+dnl Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])dnl PKG_CHECK_VAR

src/common-static.h

@@ -43,6 +43,7 @@ static inline size_t str_cpy (char *restrict dst, const char *restrict src, size
     return i;
 }
 
+_pure_
 static inline int str_cmp (const char *restrict sa, const char *restrict sb)
 {
     if (!sa || !sb)
@@ -55,6 +56,7 @@ static inline int str_cmp (const char *restrict sa, const char *restrict sb)
     return 1;
 }
 
+_pure_
 static inline size_t str_len (const char *restrict str)
 {
     if (!str)
@@ -111,16 +113,19 @@ static inline void buffer_format (buffer_t *buffer)
     buffer->read  = buffer->data;
 }
 
+_pure_
 static inline size_t buffer_size (buffer_t *buffer)
 {
     return buffer->end-buffer->data;
 }
 
+_pure_
 static inline size_t buffer_write_size (buffer_t *buffer)
 {
     return buffer->end-buffer->write;
 }
 
+_pure_
 static inline size_t buffer_read_size (buffer_t *buffer)
 {
     return buffer->write-buffer->read;

src/common.c

@@ -38,3 +38,53 @@ void gt_na (const char *name)
 {
     gt_log("%s is not available on your platform!\n", name);
 }
+
+int gt_tohex (char *dst, size_t dst_size, const uint8_t *src, size_t src_size)
+{
+    if _0_(dst_size<2*src_size+1)
+        return -1;
+
+    const char tbl[] = "0123456789ABCDEF";
+
+    for (size_t i=0; i<src_size; i++) {
+        dst[(i<<1)+0] = tbl[0xF&(src[i]>>4)];
+        dst[(i<<1)+1] = tbl[0xF&(src[i])];
+    }
+
+    dst[2*src_size] = 0;
+
+    return 0;
+}
+
+_const_
+static inline int fromhex (const char c)
+{
+    if (c>='0' && c<='9')
+        return c-'0';
+
+    if (c>='A' && c<='F')
+        return c-'a'+10;
+
+    return -1;
+}
+
+int gt_fromhex (uint8_t *dst, size_t dst_size, const char *src, size_t src_size)
+{
+    if _0_(src_size&1)
+        return -1;
+
+    if _0_(src_size>2*dst_size)
+        return -1;
+
+    for (size_t i=0; i<src_size; i+=2) {
+        const int a = fromhex(src[i]);
+        const int b = fromhex(src[i+1]);
+
+        if _0_(a==-1 || b==-1)
+            return -1;
+
+        dst[i>>1] = (a<<4)|b;
+    }
+
+    return 0;
+}

src/common.h

@@ -14,9 +14,15 @@
 #define PALIGN(x)      ((void *)ALIGN((size_t)(x)))
 #define PALIGN_DOWN(x) ((void *)ALIGN_DOWN((size_t)(x)))
 
+#define _1_(x)         (__builtin_expect((x), 1))
+#define _0_(x)         (__builtin_expect((x), 0))
+
 #define _printf_(A,B)  __attribute__((format(printf,A,B)))
 #define _noreturn_     __attribute__((noreturn))
 #define _unused_       __attribute__((unused))
+#define _pure_         __attribute__((pure))
+#define _const_        __attribute__((const))
+#define _align_(...)   __attribute__((aligned(__VA_ARGS__)))
 
 typedef struct buffer buffer_t;
 
@@ -31,3 +37,6 @@ int  gt_print (const char *, ...) _printf_(1,2);
 void gt_log   (const char *, ...) _printf_(1,2);
 void gt_fatal (const char *, ...) _printf_(1,2) _noreturn_;
 void gt_na    (const char *);
+
+int gt_tohex   (char *, size_t, const uint8_t *, size_t);
+int gt_fromhex (uint8_t *, size_t, const char *, size_t);

src/ip-static.h

@@ -2,6 +2,7 @@
 
 #include <stdint.h>
 
+_pure_
 static inline int ip_get_version (const uint8_t *data, size_t size)
 {
     if (size<20)   // XXX
@@ -10,17 +11,14 @@ static inline int ip_get_version (const uint8_t *data, size_t size)
     return data[0]>>4;
 }
 
-static inline void ip_set_size (uint8_t *data, size_t size)
-{
-    data[2] = 0xFF&(size>>8);
-    data[3] = 0xFF&(size);
-}
-
+_pure_
 static inline ssize_t ip_get_size (const uint8_t *data, size_t size)
 {
     switch (ip_get_version(data, size)) {
     case 4:
-        return (data[2]<<8)|data[3];
+        return ((data[2]<<8)|data[3]);
+    case 6:
+        return ((data[4]<<8)|data[5])+40;
     case -1:
         return -1;
     }
@@ -28,3 +26,32 @@ static inline ssize_t ip_get_size (const uint8_t *data, size_t size)
     return 0;
 }
 
+_pure_
+static inline ssize_t ip_get_proto (const uint8_t *data, size_t size)
+{
+    switch (ip_get_version(data, size)) {
+    case 4:
+        return data[9];
+    case 6:
+        return data[6];
+    case -1:
+        return -1;
+    }
+
+    return 0;
+}
+
+_pure_
+static inline ssize_t ip_get_hdr_size (const uint8_t *data, size_t size)
+{
+    switch (ip_get_version(data, size)) {
+    case 4:
+        return (data[0]&0xF)<<2;
+    case 6:
+        return 40;
+    case -1:
+        return -1;
+    }
+
+    return 0;
+}

src/main.c

@@ -6,6 +6,7 @@
 #include <sys/time.h>
 #include <sys/fcntl.h>
 #include <sys/socket.h>
+#include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <arpa/inet.h>
 #include <netdb.h>
@@ -22,14 +23,21 @@
 #define O_CLOEXEC 0
 #endif
 
-#define GT_BUFFER_SIZE (4*1024*1024)
-#define GT_TIMEOUT     (1000)
+#define GT_BUFFER_SIZE  (4*1024*1024)
+#define GT_TIMEOUT      (5000)
+#define GT_MTU_MAX      (1500)
+#define GT_TUNR_SIZE    (0x7FFF-16)
+#define GT_TUNW_SIZE    (0x7FFF)
 
-struct netio {
+struct fdbuf {
     int fd;
-    struct {
-        buffer_t buf;
-    } write, read;
+    buffer_t read;
+    buffer_t write;
+};
+
+struct blk {
+    size_t size;
+    uint8_t data[GT_MTU_MAX] _align_(16);
 };
 
 struct crypto_ctx {
@@ -41,7 +49,9 @@ struct crypto_ctx {
 };
 
 volatile sig_atomic_t gt_close = 0;
+volatile sig_atomic_t gt_info = 0;
 
+_pure_
 static int64_t dt_ms (struct timeval *ta, struct timeval *tb)
 {
     const int64_t s = ta->tv_sec-tb->tv_sec;
@@ -67,54 +77,81 @@ static void fd_set_nonblock (int fd)
         perror("fcntl O_NONBLOCK");
 }
 
-static void sk_set (int fd, const char *name, const void *val, socklen_t len)
+enum sk_opt {
+    sk_nodelay,
+    sk_reuseaddr,
+    sk_keepalive,
+    sk_keepcnt,
+    sk_keepidle,
+    sk_keepintvl,
+    sk_congestion,
+    sk_defer_accept,
+    sk_quickack,
+};
+
+static void sk_set (int fd, enum sk_opt opt, const void *val, socklen_t len)
 {
-    if (!name || !val || len<=0)
+    if (!val || len<=0)
         return;
 
     struct {
         const char *name;
+        const int present;
         const int level;
         const int option;
-    } ops[] = {
-        { "TCP_NODELAY",    IPPROTO_TCP, TCP_NODELAY    },
-        { "SO_REUSEADDR",   SOL_SOCKET,  SO_REUSEADDR   },
-        { "SO_KEEPALIVE",   SOL_SOCKET,  SO_KEEPALIVE   },
+    } opts[] = {
+        [sk_nodelay] = { "TCP_NODELAY", 1, IPPROTO_TCP, TCP_NODELAY, },
+        [sk_reuseaddr] = { "SO_REUSEADDR", 1, SOL_SOCKET, SO_REUSEADDR, },
+        [sk_keepalive] = { "SO_KEEPALIVE", 1, SOL_SOCKET, SO_KEEPALIVE, },
+        [sk_keepcnt] = { "TCP_KEEPCNT",
 #ifdef TCP_KEEPCNT
-        { "TCP_KEEPCNT",    IPPROTO_TCP, TCP_KEEPCNT    },
+            1, IPPROTO_TCP, TCP_KEEPCNT,
 #endif
+        },
+        [sk_keepidle] = { "TCP_KEEPIDLE",
 #ifdef TCP_KEEPIDLE
-        { "TCP_KEEPIDLE",   IPPROTO_TCP, TCP_KEEPIDLE   },
+            1, IPPROTO_TCP, TCP_KEEPIDLE,
 #endif
+        },
+        [sk_keepintvl] = { "TCP_KEEPINTVL",
 #ifdef TCP_KEEPINTVL
-        { "TCP_KEEPINTVL",  IPPROTO_TCP, TCP_KEEPINTVL  },
+            1, IPPROTO_TCP, TCP_KEEPINTVL,
 #endif
+        },
+        [sk_congestion] = { "TCP_CONGESTION",
 #ifdef TCP_CONGESTION
-        { "TCP_CONGESTION", IPPROTO_TCP, TCP_CONGESTION },
+            1, IPPROTO_TCP, TCP_CONGESTION,
 #endif
+        },
+        [sk_defer_accept] = { "TCP_DEFER_ACCEPT",
+#ifdef TCP_DEFER_ACCEPT
+            1, IPPROTO_TCP, TCP_DEFER_ACCEPT,
+#endif
+        },
+        [sk_quickack] = { "TCP_QUICKACK",
+#ifdef TCP_QUICKACK
+            1, IPPROTO_TCP, TCP_QUICKACK,
+#endif
+        },
     };
 
-    for (int k=0; k<COUNT(ops); k++) {
-        if (str_cmp(ops[k].name, name))
-            continue;
-
-        if (setsockopt(fd, ops[k].level, ops[k].option, val, len)==-1)
-            gt_log("couldn't set socket option `%s'\n", name);
-
+    if (!opts[opt].present) {
+        gt_na(opts[opt].name);
         return;
     }
 
-    gt_na(name);
+    if (setsockopt(fd, opts[opt].level, opts[opt].option, val, len)==-1)
+        gt_log("couldn't set socket option `%s'\n", opts[opt].name);
 }
 
-static void sk_set_int (int fd, const char *name, int val)
+static void sk_set_int (int fd, enum sk_opt opt, int val)
 {
-    return sk_set(fd, name, &val, sizeof(val));
+    return sk_set(fd, opt, &val, sizeof(val));
 }
 
 static int sk_listen (int fd, struct addrinfo *ai)
 {
-    sk_set_int(fd, "SO_REUSEADDR", 1);
+    sk_set_int(fd, sk_reuseaddr, 1);
 
     int ret = bind(fd, ai->ai_addr, ai->ai_addrlen);
 
@@ -123,13 +160,15 @@ static int sk_listen (int fd, struct addrinfo *ai)
         return -1;
     }
 
-    ret = listen(fd, 1);
+    ret = listen(fd, 8);
 
     if (ret==-1) {
         perror("listen");
         return -1;
     }
 
+    sk_set_int(fd, sk_defer_accept, GT_TIMEOUT/1000);
+
     return 0;
 }
 
@@ -208,38 +247,6 @@ static char *sk_get_name (int fd)
     return str_cat(strs, COUNT(strs));
 }
 
-#ifdef TCP_INFO
-static socklen_t sk_get_info (int fd, struct tcp_info *ti)
-{
-    socklen_t len = sizeof(struct tcp_info);
-
-    if (getsockopt(fd, SOL_TCP, TCP_INFO, ti, &len)==-1) {
-        perror("getsockopt TCP_INFO");
-        return 0;
-    }
-
-    return len;
-}
-
-static void print_tcp_info (const char *name, struct tcp_info *ti)
-{
-    gt_log("%s: tcpinfo"
-            " rto:%"     PRIu32 " ato:%"          PRIu32 " snd_mss:%"  PRIu32
-            " rcv_mss:%" PRIu32 " unacked:%"      PRIu32 " sacked:%"   PRIu32
-            " lost:%"    PRIu32 " retrans:%"      PRIu32 " fackets:%"  PRIu32
-            " pmtu:%"    PRIu32 " rcv_ssthresh:%" PRIu32 " rtt:%"      PRIu32
-            " rttvar:%"  PRIu32 " snd_ssthresh:%" PRIu32 " snd_cwnd:%" PRIu32
-            " advmss:%"  PRIu32 " reordering:%"   PRIu32 "\n",
-            name,
-            ti->tcpi_rto,       ti->tcpi_ato,            ti->tcpi_snd_mss,
-            ti->tcpi_rcv_mss,   ti->tcpi_unacked,        ti->tcpi_sacked,
-            ti->tcpi_lost,      ti->tcpi_retrans,        ti->tcpi_fackets,
-            ti->tcpi_pmtu,      ti->tcpi_rcv_ssthresh,   ti->tcpi_rtt,
-            ti->tcpi_rttvar,    ti->tcpi_snd_ssthresh,   ti->tcpi_snd_cwnd,
-            ti->tcpi_advmss,    ti->tcpi_reordering);
-}
-#endif
-
 static struct addrinfo *ai_create (const char *host, const char *port, int listener)
 {
     if (!port || !port[0]) {
@@ -279,24 +286,33 @@ static struct addrinfo *ai_create (const char *host, const char *port, int liste
     return NULL;
 }
 
-static void gt_sa_stop (int sig)
+static void gt_sa_handler (int sig)
 {
     switch (sig) {
     case SIGINT:
+    case SIGQUIT:
     case SIGTERM:
         gt_close = 1;
+        break;
+    case SIGUSR1:
+        gt_info = 1;
+        break;
     }
 }
 
 static void gt_set_signal (void)
 {
-    struct sigaction sa;
+    struct sigaction sa = {
+        .sa_flags = 0,
+    };
 
-    byte_set(&sa, 0, sizeof(sa));
+    sigemptyset(&sa.sa_mask);
 
-    sa.sa_handler = gt_sa_stop;
+    sa.sa_handler = gt_sa_handler;
     sigaction(SIGINT,  &sa, NULL);
+    sigaction(SIGQUIT, &sa, NULL);
     sigaction(SIGTERM, &sa, NULL);
+    sigaction(SIGUSR1, &sa, NULL);
 
     sa.sa_handler = SIG_IGN;
     sigaction(SIGHUP,  &sa, NULL);
@@ -306,7 +322,7 @@ static void gt_set_signal (void)
 static ssize_t fd_read (int fd, void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
     ssize_t ret = read(fd, data, size);
 
@@ -326,7 +342,7 @@ static ssize_t fd_read (int fd, void *data, size_t size)
 static ssize_t fd_write (int fd, const void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
     ssize_t ret = write(fd, data, size);
 
@@ -334,6 +350,9 @@ static ssize_t fd_write (int fd, const void *data, size_t size)
         if (errno==EAGAIN || errno==EINTR)
             return -1;
 
+        if (errno==EPIPE || errno==ECONNRESET)
+            return 0;
+
         if (errno)
             perror("write");
 
@@ -397,77 +416,117 @@ static ssize_t fd_write_all (int fd, const void *data, size_t size)
     return done;
 }
 
-static int encrypt_packet (struct crypto_ctx *ctx, uint8_t *packet, size_t size, buffer_t *buffer)
+static int gt_encrypt (struct crypto_ctx *ctx, buffer_t *dst, buffer_t *src)
 {
-    const size_t ws = size + crypto_aead_aes256gcm_ABYTES;
+    const size_t rs = buffer_read_size(src);
+    const size_t ws = buffer_write_size(dst);
 
-    if (buffer_write_size(buffer) < ws)
-        return 1;
+    if (!rs || !ws)
+        return 0;
 
-    const int hs = 4;
+    const size_t size = rs+crypto_aead_aes256gcm_ABYTES;
 
-    byte_cpy(buffer->write, packet, size);
+    if (size+2>ws)
+        return 0;
+
+    dst->write[0] = 0xFF&(size>>8);
+    dst->write[1] = 0xFF&(size);
 
     crypto_aead_aes256gcm_encrypt_afternm(
-            buffer->write + hs, NULL,
-            packet + hs, size - hs,
-            packet, hs,
+            dst->write+2, NULL,
+            src->read, rs,
+            dst->write, 2,
             NULL, ctx->write.nonce,
             (const crypto_aead_aes256gcm_state *)&ctx->write.state);
 
     sodium_increment(ctx->write.nonce, crypto_aead_aes256gcm_NPUBBYTES);
-    buffer->write += ws;
+
+    src->read += rs;
+    dst->write += size+2;
 
     return 0;
 }
 
-static int decrypt_packet (struct crypto_ctx *ctx, uint8_t *packet, size_t size, buffer_t *buffer)
+static int gt_decrypt (struct crypto_ctx *ctx, buffer_t *dst, buffer_t *src)
 {
-    const size_t rs = size + crypto_aead_aes256gcm_ABYTES;
+    const size_t rs = buffer_read_size(src);
+    const size_t ws = buffer_write_size(dst);
 
-    if (buffer_read_size(buffer) < rs)
-        return 1;
+    if (!rs || !ws)
+        return 0;
 
-    const int hs = 4;
+    if (rs<=2+crypto_aead_aes256gcm_ABYTES)
+        return 0;
 
-    byte_cpy(packet, buffer->read, hs);
+    const size_t size = (src->read[0]<<8)|src->read[1];
+
+    if (size-crypto_aead_aes256gcm_ABYTES>ws)
+        return 0;
+
+    if (size+2>rs)
+        return 0;
 
     if (crypto_aead_aes256gcm_decrypt_afternm(
-                packet + hs, NULL,
+                dst->write, NULL,
                 NULL,
-                buffer->read + hs, rs - hs,
-                packet, hs,
+                src->read+2, size,
+                src->read, 2,
                 ctx->read.nonce,
                 (const crypto_aead_aes256gcm_state *)&ctx->read.state))
         return -1;
 
     sodium_increment(ctx->read.nonce, crypto_aead_aes256gcm_NPUBBYTES);
-    buffer->read += rs;
+
+    src->read += size+2;
+    dst->write += size-crypto_aead_aes256gcm_ABYTES;
 
     return 0;
 }
 
-static void dump_ip_header (uint8_t *data, size_t size)
+static void gt_print_hdr (uint8_t *data, size_t ip_size, const char *sockname)
 {
-    if (size<20)
-        return;
+    const int ip_version = ip_get_version(data, GT_MTU_MAX);
+    const ssize_t ip_proto = ip_get_proto(data, GT_MTU_MAX);
+    const ssize_t ip_hdr_size = ip_get_hdr_size(data, GT_MTU_MAX);
 
-    const char tbl[] = "0123456789ABCDEF";
-    char hex[41];
+    char ip_src[33];
+    char ip_dst[33];
 
-    for (size_t i=0; i<20; i++) {
-        hex[(i<<1)+0] = tbl[0xF&(data[i]>>4)];
-        hex[(i<<1)+1] = tbl[0xF&(data[i])];
+    switch (ip_version) {
+        case 4:
+            gt_tohex(ip_src, sizeof(ip_src), &data[12], 4);
+            gt_tohex(ip_dst, sizeof(ip_dst), &data[16], 4);
+            break;
+        case 6:
+            gt_tohex(ip_src, sizeof(ip_src), &data[9], 16);
+            gt_tohex(ip_dst, sizeof(ip_dst), &data[25], 16);
+            break;
     }
 
-    hex[40] = 0;
+    gt_log("%s: version=%i size=%zi proto=%zi src=%s dst=%s\n", sockname, ip_version, ip_size, ip_proto, ip_src, ip_dst);
 
-    gt_log("DUMP(%zu): %s\n", size, hex);
+    if (ip_hdr_size<=0 || ip_proto!=6)
+        return;
+
+    struct tcphdr tcp;
+
+    byte_cpy(&tcp, &data[ip_hdr_size], sizeof(tcp));
+
+    tcp.source = ntohs(tcp.source);
+    tcp.dest = ntohs(tcp.dest);
+    tcp.seq = ntohl(tcp.seq);
+    tcp.ack_seq = ntohl(tcp.ack_seq);
+    tcp.window = ntohs(tcp.window);
+
+    gt_log("%s: tcp src=%i dst=%i seq=%u ack=%u win=%u %s%s%s%s%s%s\n",
+            sockname, tcp.source, tcp.dest, tcp.seq, tcp.ack_seq, tcp.window,
+            tcp.fin?"FIN ":"", tcp.syn?"SYN ":"", tcp.rst?"RST ":"",
+            tcp.psh?"PSH ":"", tcp.ack?"ACK ":"", tcp.urg?"URG ":"");
 }
 
 static int gt_setup_secretkey (struct crypto_ctx *ctx, char *keyfile)
 {
-    size_t size = sizeof(ctx->skey);
+    const size_t size = sizeof(ctx->skey);
 
     byte_set(ctx->skey, 1, size);
 
@@ -485,13 +544,20 @@ static int gt_setup_secretkey (struct crypto_ctx *ctx, char *keyfile)
         return -1;
     }
 
-    if (fd_read_all(fd, ctx->skey, size)!=size) {
-        gt_log("unable to read secret key in `%s'\n", keyfile);
-        close(fd);
+    char key[2*size];
+    size_t r = fd_read_all(fd, key, sizeof(key));
+
+    close(fd);
+
+    if (r!=sizeof(key)) {
+        gt_log("unable to read secret key\n");
         return -1;
     }
 
-    close(fd);
+    if (gt_fromhex(ctx->skey, size, key, sizeof(key))) {
+        gt_log("secret key is not valid\n");
+        return -1;
+    }
 
     return 0;
 }
@@ -581,27 +647,22 @@ int main (int argc, char **argv)
 {
     gt_set_signal();
 
-    int listener = 0;
     char *host = NULL;
     char *port = "5000";
     char *dev = PACKAGE_NAME;
     char *keyfile = NULL;
     char *congestion = NULL;
+
     long buffer_size = GT_BUFFER_SIZE;
-    int delay = 0;
-    int multiqueue = 0;
+
     long ka_count = -1;
     long ka_idle = -1;
     long ka_interval = -1;
-    int version = 0;
-    int debug = 0;
 
-#ifdef TCP_INFO
-    struct {
-        struct timeval time;
-        struct tcp_info info;
-    } tcpinfo = {0};
-#endif
+    long retry_count = -1;
+    long retry_slope = 0;
+    long retry_const = 0;
+    long retry_limit = 1000000;
 
     struct option ka_opts[] = {
         { "count",    &ka_count,    option_long },
@@ -610,37 +671,55 @@ int main (int argc, char **argv)
         { NULL },
     };
 
+    struct option retry_opts[] = {
+        { "count", &retry_count, option_long },
+        { "slope", &retry_slope, option_long },
+        { "const", &retry_const, option_long },
+        { "limit", &retry_limit, option_long },
+        { NULL },
+    };
+
     struct option opts[] = {
-        { "listener",    &listener,    option_flag   },
+        { "listener",    NULL,         option_option },
         { "host",        &host,        option_str    },
         { "port",        &port,        option_str    },
         { "dev",         &dev,         option_str    },
         { "keyfile",     &keyfile,     option_str    },
         { "congestion",  &congestion,  option_str    },
-        { "delay",       &delay,       option_flag   },
-        { "multiqueue",  &multiqueue,  option_flag   },
+        { "delay",       NULL,         option_option },
+        { "multiqueue",  NULL,         option_option },
         { "keepalive",   ka_opts,      option_option },
         { "buffer-size", &buffer_size, option_long   },
-        { "debug",       &debug,       option_flag   },
-        { "version",     &version,     option_flag   },
+        { "noquickack",  NULL,         option_option },
+        { "retry",       &retry_opts,  option_option },
+        { "daemon",      NULL,         option_option },
+        { "debug",       NULL,         option_option },
+        { "version",     NULL,         option_option },
         { NULL },
     };
 
     if (option(opts, argc, argv))
         return 1;
 
-    if (version) {
+    if (option_is_set(opts, "version")) {
         gt_print(PACKAGE_STRING"\n");
         return 0;
     }
 
-    int keepalive = option_is_set(opts, "keepalive");
+    const int listener = option_is_set(opts, "listener");
+    const int delay = option_is_set(opts, "delay");
+    const int keepalive = option_is_set(opts, "keepalive");
+    const int noquickack = option_is_set(opts, "noquickack");
+    const int debug = option_is_set(opts, "debug");
 
     if (buffer_size < 2048) {
         buffer_size = 2048;
         gt_log("buffer size must be greater than 2048!\n");
     }
 
+    if (!listener && !option_is_set(opts, "retry"))
+        retry_count = 0;
+
     if (sodium_init()==-1) {
         gt_log("libsodium initialization has failed!\n");
         return 1;
@@ -661,18 +740,29 @@ int main (int argc, char **argv)
     if (!ai)
         return 1;
 
-    struct netio tun  = { .fd = -1 };
-    struct netio sock = { .fd = -1 };
+    struct fdbuf tun  = { .fd = -1 };
+    struct fdbuf sock = { .fd = -1 };
 
-    tun.fd = tun_create(dev, multiqueue);
+    tun.fd = tun_create(dev, option_is_set(opts, "multiqueue"));
 
     if (tun.fd==-1)
         return 1;
 
+    struct blk *blks = calloc(256, sizeof(struct blk));
+    size_t blk_count = 0;
+    uint8_t blk_read = 0;
+    uint8_t blk_write = 0;
+
+    if (!blks)
+        return 1;
+
     fd_set_nonblock(tun.fd);
 
-    buffer_setup(&sock.write.buf, NULL, buffer_size);
-    buffer_setup(&sock.read.buf, NULL, buffer_size);
+    buffer_setup(&tun.write, NULL, GT_TUNW_SIZE);
+    buffer_setup(&tun.read,  NULL, GT_TUNR_SIZE);
+
+    buffer_setup(&sock.write, NULL, buffer_size);
+    buffer_setup(&sock.read,  NULL, buffer_size);
 
     int fd = -1;
 
@@ -683,196 +773,255 @@ int main (int argc, char **argv)
             return 1;
     }
 
+    if (option_is_set(opts, "daemon")) {
+        switch (fork()) {
+        case -1:
+            perror("fork");
+            return 1;
+        case 0:
+            if (setsid()==-1)
+                perror("setsid");
+            break;
+        default:
+            _exit(0);
+        }
+
+        chdir("/");
+    }
+
+    long retry = 0;
+
     while (!gt_close) {
+        if (retry_count>=0 && retry>=retry_count+1) {
+            gt_log("couldn't %s (%d attempt%s)\n", listener?"listen":"connect",
+                   (int)retry, (retry>1)?"s":"");
+            break;
+        }
+
+        if (retry_slope || retry_const) {
+            long usec = retry*retry_slope+retry_const;
+
+            if (usec>retry_limit)
+                usec = retry_limit;
+
+            if (usec>0 && usleep(usec)==-1 && errno==EINVAL)
+                sleep(usec/1000000);
+        }
+
+        if (retry<LONG_MAX)
+            retry++;
+
         sock.fd = listener?sk_accept(fd):sk_create(ai, sk_connect);
 
-        if (sock.fd==-1) {
-            usleep(100000);
-            goto restart;
-        }
+        if (sock.fd==-1)
+            continue;
 
         char *sockname = sk_get_name(sock.fd);
 
-        if (!sockname)
-            goto restart;
+        if (!sockname) {
+            close(sock.fd);
+            continue;
+        }
 
         gt_log("%s: connected\n", sockname);
 
         fd_set_nonblock(sock.fd);
 
-        sk_set_int(sock.fd, "TCP_NODELAY", !delay);
-        sk_set_int(sock.fd, "SO_KEEPALIVE", keepalive);
+        sk_set_int(sock.fd, sk_nodelay, !delay);
+        sk_set_int(sock.fd, sk_keepalive, keepalive);
 
         if (keepalive) {
             if (ka_count>=0 && ka_count<=INT_MAX)
-                sk_set_int(sock.fd, "TCP_KEEPCNT", ka_count);
+                sk_set_int(sock.fd, sk_keepcnt, ka_count);
 
             if (ka_idle>=0 && ka_idle<=INT_MAX)
-                sk_set_int(sock.fd, "TCP_KEEPIDLE", ka_idle);
+                sk_set_int(sock.fd, sk_keepidle, ka_idle);
 
             if (ka_interval>=0 && ka_interval<=INT_MAX)
-                sk_set_int(sock.fd, "TCP_KEEPINTVL", ka_interval);
+                sk_set_int(sock.fd, sk_keepintvl, ka_interval);
         }
 
-        sk_set(sock.fd, "TCP_CONGESTION", congestion, str_len(congestion));
+        sk_set(sock.fd, sk_congestion, congestion, str_len(congestion));
 
         switch (gt_setup_crypto(&ctx, sock.fd, listener)) {
-            case -2: gt_log("%s: key exchange could not be verified!\n", sockname);
-            case -1: goto restart;
-            default: break;
+        case -2:
+            gt_log("%s: key exchange could not be verified!\n", sockname);
+            goto restart;
+        case -1:
+            gt_log("%s: key exchange failed\n", sockname);
+            goto restart;
+        default:
+            break;
         }
 
-        struct {
-            uint8_t buf[2048];
-            size_t size;
-        } tunr, tunw;
+        retry = 0;
 
-        tunr.size = 0;
-        tunw.size = 0;
+        gt_log("%s: running\n", sockname);
 
-        fd_set rfds, wfds;
+        fd_set rfds;
         FD_ZERO(&rfds);
-        FD_ZERO(&wfds);
 
         int stop_loop = 0;
 
-        buffer_format(&sock.write.buf);
-        buffer_format(&sock.read.buf);
+        buffer_format(&sock.write);
+        buffer_format(&sock.read);
 
         while (1) {
-            if (gt_close)
-                stop_loop = 1;
+            if _0_(gt_close)
+                stop_loop |= 1;
 
-            if (stop_loop) {
-                if (((stop_loop&(1<<2)) || !buffer_read_size(&sock.write.buf)) &&
-                    ((stop_loop&(1<<1)) || !buffer_read_size(&sock.read.buf)))
+            if _0_(stop_loop) {
+                if (((stop_loop&(1<<2)) || !buffer_read_size(&sock.write)) &&
+                    ((stop_loop&(1<<1)) || !buffer_read_size(&sock.read)))
                     goto restart;
                 FD_CLR(tun.fd, &rfds);
             } else {
-                FD_SET(tun.fd, &rfds);
+                if (!blks[blk_write].size) {
+                    FD_SET(tun.fd, &rfds);
+                } else {
+                    FD_CLR(tun.fd, &rfds);
+                }
             }
 
-            FD_SET(sock.fd, &rfds);
+            buffer_shift(&sock.read);
 
-            if (select(sock.fd+1, &rfds, &wfds, NULL, NULL)==-1) {
+            if (buffer_write_size(&sock.read)) {
+                FD_SET(sock.fd, &rfds);
+            } else {
+                FD_CLR(sock.fd, &rfds);
+            }
+
+            struct timeval timeout = {
+                .tv_usec = 1000,
+            };
+
+            if _0_(select(sock.fd+1, &rfds, NULL, NULL, &timeout)==-1) {
                 if (errno==EINTR)
                     continue;
                 perror("select");
                 return 1;
             }
 
-#ifdef TCP_INFO
-            struct timeval now;
-            gettimeofday(&now, NULL);
-
-            if (debug && dt_ms(&now, &tcpinfo.time)>1000LL) {
-                tcpinfo.time = now;
-                if (sk_get_info(sock.fd, &tcpinfo.info))
-                    print_tcp_info(sockname, &tcpinfo.info);
-            }
-#endif
-
-            buffer_shift(&sock.write.buf);
+         // TODO
+         // struct timeval now;
+         // gettimeofday(&now, NULL);
 
             if (FD_ISSET(tun.fd, &rfds)) {
-                while (1) {
-                    if (buffer_write_size(&sock.write.buf)<sizeof(tunr.buf)+16)
+                while (!blks[blk_write].size) {
+                    uint8_t *data = blks[blk_write].data;
+                    const ssize_t r = tun_read(tun.fd, data, GT_MTU_MAX);
+
+                    if (r<=0) {
+                        gt_close |= !r;
                         break;
+                    }
 
-                    ssize_t r = tun_read(tun.fd, tunr.buf, sizeof(tunr.buf));
+                    const ssize_t ip_size = ip_get_size(data, GT_MTU_MAX);
 
-                    if (!r)
-                        return 2;
-
-                    if (r<0)
-                        break;
-
-                    ssize_t ip_size = ip_get_size(tunr.buf, sizeof(tunr.buf));
-
-                    if (ip_size<=0)
+                    if _0_(ip_size<=0)
                         continue;
 
-                    if (ip_size!=r) {
-                        dump_ip_header(tunr.buf, r);
-
-                        if (r<ip_size) {
-                            ip_set_size(tunr.buf, r);
-                        } else {
-                            continue;
-                        }
+                    if _0_(ip_size!=r) {
+                        char tmp[2*GT_MTU_MAX+1];
+                        gt_tohex(tmp, sizeof(tmp), data, r);
+                        gt_log("%s: DUMP %zi %s\n", sockname, r, tmp);
+                        continue;
                     }
 
-                    encrypt_packet(&ctx, tunr.buf, r, &sock.write.buf);
+                    if _0_(debug)
+                        gt_print_hdr(data, ip_size, sockname);
+
+
+                    blks[blk_write++].size = r;
+                    blk_count++;
                 }
             }
 
-            if (FD_ISSET(sock.fd, &wfds))
-                FD_CLR(sock.fd, &wfds);
-
-            if (buffer_read_size(&sock.write.buf)) {
-                ssize_t r = fd_write(sock.fd, sock.write.buf.read,
-                                     buffer_read_size(&sock.write.buf));
-
-                if (r==-1)
-                    FD_SET(sock.fd, &wfds);
-
-                if (!r)
-                    stop_loop |= (1<<2);
-
-                if (r>0)
-                    sock.write.buf.read += r;
-            } else {
-                if (stop_loop)
-                    shutdown(sock.fd, SHUT_WR);
-            }
-
-            buffer_shift(&sock.read.buf);
-
-            if (FD_ISSET(sock.fd, &rfds)) {
-                ssize_t r = fd_read(sock.fd, sock.read.buf.write,
-                                    buffer_write_size(&sock.read.buf));
-
-                if (!r)
-                    stop_loop |= (1<<1);
-
-                if (r>0)
-                    sock.read.buf.write += r;
-            }
-
-            if (FD_ISSET(tun.fd, &wfds))
-                FD_CLR(tun.fd, &wfds);
-
             while (1) {
-                if (!tunw.size) {
-                    size_t size = buffer_read_size(&sock.read.buf);
-                    ssize_t ip_size = ip_get_size(sock.read.buf.read, size);
+                buffer_shift(&tun.read);
 
-                    if (!ip_size)
-                        goto restart;
+                if _0_(!stop_loop) {
+                    for (; blk_count; blk_read++) {
+                        const size_t size = blks[blk_read].size;
 
-                    if (ip_size<0 || (size_t)ip_size+16>size)
-                        break;
+                        if (!size || buffer_write_size(&tun.read)<size)
+                            break;
 
-                    if (decrypt_packet(&ctx, tunw.buf, ip_size, &sock.read.buf)) {
-                        gt_log("%s: message could not be verified!\n", sockname);
-                        goto restart;
+                        byte_cpy(tun.read.write, blks[blk_read].data, size);
+                        tun.read.write += size;
+
+                        blks[blk_read].size = 0;
+                        blk_count--;
                     }
 
-                    tunw.size = ip_size;
+                    gt_encrypt(&ctx, &sock.write, &tun.read);
                 }
-                if (tunw.size) {
-                    ssize_t r = tun_write(tun.fd, tunw.buf, tunw.size);
 
+                if (!buffer_read_size(&sock.write))
+                    break;
+
+                const ssize_t r = fd_write(sock.fd, sock.write.read,
+                                           buffer_read_size(&sock.write));
+
+                if (r>0) {
+                    sock.write.read += r;
+                } else {
                     if (!r)
-                        return 2;
+                        stop_loop |= (1<<2);
+                    break;
+                }
+            }
 
-                    if (r==-1)
-                        FD_SET(tun.fd, &wfds);
+            if _0_(stop_loop && !buffer_read_size(&sock.write)) {
+                if (!(stop_loop&(1<<2))) {
+                    stop_loop |= (1<<2);
+                    shutdown(sock.fd, SHUT_WR);
+                    gt_log("%s: shutdown\n", sockname);
+                }
+            }
 
-                    if (r<0)
-                        break;
+            buffer_shift(&sock.write);
 
-                    tunw.size = 0;
+            if (FD_ISSET(sock.fd, &rfds)) {
+                if (noquickack)
+                    sk_set_int(sock.fd, sk_quickack, 0);
+
+                const ssize_t r = fd_read(sock.fd, sock.read.write,
+                                          buffer_write_size(&sock.read));
+
+                if (r>0) {
+                    sock.read.write += r;
+                } else if (!r) {
+                    stop_loop |= (1<<1);
+                }
+            }
+
+            while (1) {
+                buffer_shift(&tun.write);
+
+                if _0_(gt_decrypt(&ctx, &tun.write, &sock.read)) {
+                    gt_log("%s: message could not be verified!\n", sockname);
+                    goto restart;
+                }
+
+                size_t size = buffer_read_size(&tun.write);
+                ssize_t ip_size = ip_get_size(tun.write.read, size);
+
+                if _0_(!ip_size) {
+                    gt_log("%s: bad packet!\n", sockname);
+                    goto restart;
+                }
+
+                if (ip_size<0 || (size_t)ip_size>size)
+                    break;
+
+                ssize_t r = tun_write(tun.fd, tun.write.read, ip_size);
+
+                if (r>0) {
+                    tun.write.read += r;
+                } else {
+                    gt_close |= !r;
+                    break;
                 }
             }
         }
@@ -891,8 +1040,13 @@ int main (int argc, char **argv)
 
     freeaddrinfo(ai);
 
-    free(sock.write.buf.data);
-    free(sock.read.buf.data);
+    free(blks);
+
+    free(sock.write.data);
+    free(sock.read.data);
+
+    free(tun.write.data);
+    free(tun.read.data);
 
     return 0;
 }

src/option.c

@@ -5,14 +5,6 @@
 
 #include "option.h"
 
-int option_flag (void *data, _unused_ int argc, _unused_ char **argv)
-{
-    const int one = 1;
-    byte_cpy(data, &one, sizeof(one));
-
-    return 0;
-}
-
 int option_str (void *data, int argc, char **argv)
 {
     if (argc<2 || !argv[1]) {
@@ -58,6 +50,9 @@ int option_is_set (struct option *opts, const char *name)
 
 int option_option (void *data, int argc, char **argv)
 {
+    if (!data)
+        return 0;
+
     struct option *opts = (struct option *)data;
 
     for (int k=0; opts[k].name; k++)
@@ -96,22 +91,23 @@ int option_option (void *data, int argc, char **argv)
 
 static int option_usage (struct option *opts, int slen)
 {
-    int len = slen;
+    if (!opts)
+        return 0;
+
+    int len = 0;
 
     for (int k=0; opts[k].name; k++) {
-        if (len>60) {
-            gt_print("\n%*s", (int)slen, "");
-            len = slen;
+        if (len>40) {
+            gt_print("\n%*s", slen, "");
+            len = 0;
         }
 
         len += gt_print(" [%s", opts[k].name);
 
-        if (opts[k].call!=option_flag) {
-            if (opts[k].call==option_option) {
-                len += option_usage((struct option *)opts[k].data, len);
-            } else {
-                len += gt_print(" ARG");
-            }
+        if (opts[k].call==option_option) {
+            len += option_usage((struct option *)opts[k].data, slen+len);
+        } else {
+            len += gt_print(" ARG");
         }
 
         len += gt_print("]");
@@ -134,12 +130,13 @@ int option (struct option *opts, int argc, char **argv)
 
     int slen = gt_print("usage: %s", argv[0]);
 
-    if (slen>40)
+    if (slen>40) {
         slen = 12;
+        gt_print("\n%*s", slen, "");
+    }
 
     option_usage(opts, slen);
-
-    printf("\n");
+    gt_print("\n");
 
     return 1;
 }

src/option.h

@@ -7,10 +7,9 @@ struct option {
     int set;
 };
 
-int option_flag   (void *, int, char **);
+int option_option (void *, int, char **);
 int option_str    (void *, int, char **);
 int option_long   (void *, int, char **);
-int option_option (void *, int, char **);
 
 int option_is_set (struct option *, const char *);
 int option        (struct option *, int, char **);

src/tun.c

@@ -56,15 +56,16 @@ int tun_create (char *name, int multiqueue)
         return -1;
     }
 
-    gt_print("tun name: %s\n", ifr.ifr_name);
+    gt_log("tun name: %s\n", ifr.ifr_name);
 
     return fd;
 }
 #elif defined(__APPLE__)
 int tun_create (_unused_ char *name, _unused_ int mq)
 {
-    for (unsigned dev_id = 0U; dev_id<32U; dev_id++) {
+    for (unsigned dev_id = 0; dev_id < 32; dev_id++) {
         struct ctl_info ci;
+
         byte_set(&ci, 0, sizeof(ci));
         str_cpy(ci.ctl_name, UTUN_CONTROL_NAME, sizeof(ci.ctl_name)-1);
 
@@ -91,7 +92,7 @@ int tun_create (_unused_ char *name, _unused_ int mq)
             continue;
         }
 
-        gt_print("tun name: /dev/utun%u\n", dev_id);
+        gt_log("tun name: /dev/utun%u\n", dev_id);
 
         return fd;
     }
@@ -101,17 +102,19 @@ int tun_create (_unused_ char *name, _unused_ int mq)
 #else
 int tun_create (_unused_ char *name, _unused_ int mq)
 {
-    for (unsigned dev_id = 0U; dev_id<32U; dev_id++) {
-        char dev_path[11U];
+    for (unsigned dev_id = 0; dev_id < 32; dev_id++) {
+        char dev_path[11];
 
-        sngt_print(dev_path, sizeof(dev_path), "/dev/tun%u", dev_id);
+        snprintf(dev_path, sizeof(dev_path), "/dev/tun%u", dev_id);
 
         int fd = open(dev_path, O_RDWR);
 
-        if (fd!=-1) {
-            gt_print("tun name: /dev/tun%u\n", dev_id);
-            return fd;
-        }
+        if (fd==-1)
+            continue;
+
+        gt_log("tun name: %s\n", dev_path);
+
+        return fd;
     }
 
     return -1;
@@ -121,10 +124,11 @@ int tun_create (_unused_ char *name, _unused_ int mq)
 ssize_t tun_read (int fd, void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
 #ifdef GT_BSD_TUN
     uint32_t family;
+
     struct iovec iov[2] = {
         { .iov_base = &family, .iov_len = sizeof(family) },
         { .iov_base = data, .iov_len = size }
@@ -140,7 +144,7 @@ ssize_t tun_read (int fd, void *data, size_t size)
             return -1;
 
         if (errno)
-            perror("readv");
+            perror("tun read");
 
         return 0;
     }
@@ -158,7 +162,7 @@ ssize_t tun_read (int fd, void *data, size_t size)
 ssize_t tun_write (int fd, const void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
 #ifdef GT_BSD_TUN
     uint32_t family;
@@ -189,7 +193,7 @@ ssize_t tun_write (int fd, const void *data, size_t size)
             return -1;
 
         if (errno)
-            perror("write");
+            perror("tun write");
 
         return 0;
     }

version.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+[ -z "${VERSION}" ] && VERSION=`git describe --tags --always 2>/dev/null` \
+                    && VERSION=${VERSION#v}
+
+[ -z "${VERSION}" ] && VERSION=`basename \`pwd\`` \
+                    && VERSION=${VERSION#*-}
+
+printf ${VERSION}