Use a new random secret key without keyfile

.gitignore

@@ -1,9 +1,9 @@
 *.o
 *.log
 *.scan
-*.m4
 *.cache
 *.status
+aclocal.m4
 Makefile
 Makefile.in
 configure

.travis.yml

@@ -18,3 +18,15 @@ before_script:
 
 script:
     - ./configure --disable-dependency-tracking && make distcheck
+
+deploy:
+    provider: releases
+    api_key:
+        secure: Ira1jd3j+17QVFbJ7KlkytTNp0oMZLTqCWPQLxNHLEt32PVY/IPs/16BcvTbFpKrY+Ma7E3KCihfufTVG8T+jRlZ5hFO7HNpoQMgi7L7yZZAGScYO5pnMQvsr8O9hf7jzSi1DjFXgFHznbPJJ3lOSwegcqzSrbZflokiCR50GTLLWewHoPpfs+1gJ5XbtVyRhZlmXhMPC0NEH2sh33X2WdUiKUJUMOnlYC0atPBL+4n12qxnugF9YA9wPK5NHJSLiPHue7I2rHlSrOLX5NkN3vqnEvusiuIFQX1y0NuKtkpOscFD9n1CLHThGLuzMvPlwpdQfzRMVxwjYFGu6Ma5alf64ksFnMKl8Oo0yCXEA7WvHXz+qUai/a1gzYZLTGuasHtjrHN/mgKxM4QRSiHo8t5hj3CczUW+OFglytawZQyGjyUUiKdwx2kvlO96RVDIYEhUD4DeHzHR8rhvDLmlMlGAWqUPXq7d4D+bExqKmqWCCSkhrbubq5B1kChRmgw7/gly4SryqGy+R0xsC4oq9jUUxd7Sl801BIKcYDb5r5gFSw+hEhOzBb+uE2xJYFNO2KZ+eG69lkFeG3oNJMTy8afs8fRRUXq0poQJ39wFWerps3Md7h8Sxs61YLIAKHvLJJMfoMI+AORTcjnnpqujMhgWGWt8wLhJZdxaSycoQkU=
+    skip_cleanup: true
+    file_glob: true
+    file: glorytun-*.tar.gz
+    on:
+        tags: true
+        repo: angt/glorytun
+        condition: "${TRAVIS_OS_NAME}-${CC} == linux-gcc"

Makefile.am

@@ -1,4 +1,7 @@
+ACLOCAL_AMFLAGS = -I m4 --install
+
 bin_PROGRAMS = glorytun
+
 glorytun_CFLAGS = $(libsodium_CFLAGS)
 glorytun_LDADD = $(libsodium_LIBS)
 glorytun_SOURCES = \
@@ -11,3 +14,9 @@ glorytun_SOURCES = \
     src/option.h \
     src/tun.c \
     src/tun.h
+
+EXTRA_DIST = \
+	LICENSE \
+	README.md \
+	autogen.sh \
+	version.sh

README.md

@@ -1,8 +1,10 @@
-# glorytun
+# Glorytun
 
-**Work In Progress:** Do not touch!
+Small, Simple and Stupid **TCP** VPN.
 
-glorytun depends on [libsodium](https://github.com/jedisct1/libsodium) version >= 1.0.4
+**Work In Progress:** Do not touch! This code will probably format your harddisk!
+
+Glorytun depends on [libsodium](https://github.com/jedisct1/libsodium) version >= 1.0.4
 and needs an AES-NI capable CPU.
 
 To build and install the latest version:
@@ -16,5 +18,5 @@ To build and install the latest version:
 
 To create and use a new secret key:
 
-    $ dd if=/dev/urandom of=glorytun.key bs=32 count=1
+    $ hexdump -n 32 /dev/urandom -e '"%X"' > glorytun.key
     # glorytun keyfile glorytun.key [...]

autogen.sh

@@ -1,2 +1,3 @@
 #!/bin/sh
+
 autoreconf -i -f

configure.ac

@@ -1,11 +1,16 @@
 AC_PREREQ([2.65])
-AC_INIT([glorytun], [0.0.6], [https://github.com/angt/glorytun/issues],
-        [glorytun], [https://github.com/angt/glorytun])
+AC_INIT([glorytun],
+        [m4_esyscmd([./version.sh])],
+        [https://github.com/angt/glorytun/issues],
+        [glorytun],
+        [https://github.com/angt/glorytun])
 AC_CONFIG_SRCDIR([src/common.h])
 AC_CONFIG_AUX_DIR([build-aux])
+AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([1.9 -Wall -Werror foreign tar-ustar subdir-objects])
 AM_DEP_TRACK
 AM_SILENT_RULES([yes])
+AM_PROG_CC_C_O
 AC_PROG_CC_C99
 AC_USE_SYSTEM_EXTENSIONS
 AC_SEARCH_LIBS([getaddrinfo], [resolv nsl])

m4/pkg.m4

@@ -0,0 +1,275 @@
+dnl pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
+dnl serial 11 (pkg-config-0.29)
+dnl
+dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
+dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2 of the License, or
+dnl (at your option) any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful, but
+dnl WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+dnl General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+dnl 02111-1307, USA.
+dnl
+dnl As a special exception to the GNU General Public License, if you
+dnl distribute this file as part of a program that contains a
+dnl configuration script generated by Autoconf, you may include it under
+dnl the same distribution terms that you use for the rest of that
+dnl program.
+
+dnl PKG_PREREQ(MIN-VERSION)
+dnl -----------------------
+dnl Since: 0.29
+dnl
+dnl Verify that the version of the pkg-config macros are at least
+dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
+dnl installed version of pkg-config, this checks the developer's version
+dnl of pkg.m4 when generating configure.
+dnl
+dnl To ensure that this macro is defined, also add:
+dnl m4_ifndef([PKG_PREREQ],
+dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
+dnl
+dnl See the "Since" comment for each macro you use to see what version
+dnl of the macros you require.
+m4_defun([PKG_PREREQ],
+[m4_define([PKG_MACROS_VERSION], [0.29])
+m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
+    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
+])dnl PKG_PREREQ
+
+dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
+dnl ----------------------------------
+dnl Since: 0.16
+dnl
+dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
+dnl first found in the path. Checks that the version of pkg-config found
+dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
+dnl used since that's the first version where most current features of
+dnl pkg-config existed.
+AC_DEFUN([PKG_PROG_PKG_CONFIG],
+[m4_pattern_forbid([^_?PKG_[A-Z_]+$])
+m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
+m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
+AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
+AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
+AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
+
+if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
+	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
+fi
+if test -n "$PKG_CONFIG"; then
+	_pkg_min_version=m4_default([$1], [0.9.0])
+	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
+	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
+		AC_MSG_RESULT([yes])
+	else
+		AC_MSG_RESULT([no])
+		PKG_CONFIG=""
+	fi
+fi[]dnl
+])dnl PKG_PROG_PKG_CONFIG
+
+dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------------------------------
+dnl Since: 0.18
+dnl
+dnl Check to see whether a particular set of modules exists. Similar to
+dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
+dnl
+dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+dnl only at the first occurence in configure.ac, so if the first place
+dnl it's called might be skipped (such as if it is within an "if", you
+dnl have to call PKG_CHECK_EXISTS manually
+AC_DEFUN([PKG_CHECK_EXISTS],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+if test -n "$PKG_CONFIG" && \
+    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
+  m4_default([$2], [:])
+m4_ifvaln([$3], [else
+  $3])dnl
+fi])
+
+dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
+dnl ---------------------------------------------
+dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
+dnl pkg_failed based on the result.
+m4_define([_PKG_CONFIG],
+[if test -n "$$1"; then
+    pkg_cv_[]$1="$$1"
+ elif test -n "$PKG_CONFIG"; then
+    PKG_CHECK_EXISTS([$3],
+                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
+		      test "x$?" != "x0" && pkg_failed=yes ],
+		     [pkg_failed=yes])
+ else
+    pkg_failed=untried
+fi[]dnl
+])dnl _PKG_CONFIG
+
+dnl _PKG_SHORT_ERRORS_SUPPORTED
+dnl ---------------------------
+dnl Internal check to see if pkg-config supports short errors.
+AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])
+if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
+        _pkg_short_errors_supported=yes
+else
+        _pkg_short_errors_supported=no
+fi[]dnl
+])dnl _PKG_SHORT_ERRORS_SUPPORTED
+
+
+dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl --------------------------------------------------------------
+dnl Since: 0.4.0
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
+dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
+AC_DEFUN([PKG_CHECK_MODULES],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
+AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
+
+pkg_failed=no
+AC_MSG_CHECKING([for $1])
+
+_PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
+_PKG_CONFIG([$1][_LIBS], [libs], [$2])
+
+m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
+and $1[]_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.])
+
+if test $pkg_failed = yes; then
+   	AC_MSG_RESULT([no])
+        _PKG_SHORT_ERRORS_SUPPORTED
+        if test $_pkg_short_errors_supported = yes; then
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
+        else 
+	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
+        fi
+	# Put the nasty error message in config.log where it belongs
+	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
+
+	m4_default([$4], [AC_MSG_ERROR(
+[Package requirements ($2) were not met:
+
+$$1_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+_PKG_TEXT])[]dnl
+        ])
+elif test $pkg_failed = untried; then
+     	AC_MSG_RESULT([no])
+	m4_default([$4], [AC_MSG_FAILURE(
+[The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+_PKG_TEXT
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
+        ])
+else
+	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
+	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
+        AC_MSG_RESULT([yes])
+	$3
+fi[]dnl
+])dnl PKG_CHECK_MODULES
+
+
+dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
+dnl   [ACTION-IF-NOT-FOUND])
+dnl ---------------------------------------------------------------------
+dnl Since: 0.29
+dnl
+dnl Checks for existence of MODULES and gathers its build flags with
+dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
+dnl and VARIABLE-PREFIX_LIBS from --libs.
+dnl
+dnl Note that if there is a possibility the first call to
+dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
+dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
+dnl configure.ac.
+AC_DEFUN([PKG_CHECK_MODULES_STATIC],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+_save_PKG_CONFIG=$PKG_CONFIG
+PKG_CONFIG="$PKG_CONFIG --static"
+PKG_CHECK_MODULES($@)
+PKG_CONFIG=$_save_PKG_CONFIG[]dnl
+])dnl PKG_CHECK_MODULES_STATIC
+
+
+dnl PKG_INSTALLDIR([DIRECTORY])
+dnl -------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable pkgconfigdir as the location where a module
+dnl should install pkg-config .pc files. By default the directory is
+dnl $libdir/pkgconfig, but the default can be changed by passing
+dnl DIRECTORY. The user can override through the --with-pkgconfigdir
+dnl parameter.
+AC_DEFUN([PKG_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([pkgconfigdir],
+    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
+    [with_pkgconfigdir=]pkg_default)
+AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_INSTALLDIR
+
+
+dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
+dnl --------------------------------
+dnl Since: 0.27
+dnl
+dnl Substitutes the variable noarch_pkgconfigdir as the location where a
+dnl module should install arch-independent pkg-config .pc files. By
+dnl default the directory is $datadir/pkgconfig, but the default can be
+dnl changed by passing DIRECTORY. The user can override through the
+dnl --with-noarch-pkgconfigdir parameter.
+AC_DEFUN([PKG_NOARCH_INSTALLDIR],
+[m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
+m4_pushdef([pkg_description],
+    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
+AC_ARG_WITH([noarch-pkgconfigdir],
+    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
+    [with_noarch_pkgconfigdir=]pkg_default)
+AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
+m4_popdef([pkg_default])
+m4_popdef([pkg_description])
+])dnl PKG_NOARCH_INSTALLDIR
+
+
+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------
+dnl Since: 0.28
+dnl
+dnl Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])dnl PKG_CHECK_VAR

src/common-static.h

@@ -43,6 +43,7 @@ static inline size_t str_cpy (char *restrict dst, const char *restrict src, size
     return i;
 }
 
+_pure_
 static inline int str_cmp (const char *restrict sa, const char *restrict sb)
 {
     if (!sa || !sb)
@@ -55,6 +56,7 @@ static inline int str_cmp (const char *restrict sa, const char *restrict sb)
     return 1;
 }
 
+_pure_
 static inline size_t str_len (const char *restrict str)
 {
     if (!str)
@@ -111,16 +113,19 @@ static inline void buffer_format (buffer_t *buffer)
     buffer->read  = buffer->data;
 }
 
+_pure_
 static inline size_t buffer_size (buffer_t *buffer)
 {
     return buffer->end-buffer->data;
 }
 
+_pure_
 static inline size_t buffer_write_size (buffer_t *buffer)
 {
     return buffer->end-buffer->write;
 }
 
+_pure_
 static inline size_t buffer_read_size (buffer_t *buffer)
 {
     return buffer->write-buffer->read;

src/common.c

@@ -38,3 +38,59 @@ void gt_na (const char *name)
 {
     gt_log("%s is not available on your platform!\n", name);
 }
+
+int gt_tohex (char *dst, size_t dst_size, const uint8_t *src, size_t src_size)
+{
+    if _0_(!dst_size)
+        return -1;
+
+    if _0_(((dst_size-1)/2)<src_size)
+        return -1;
+
+    static const char tbl[] = "0123456789ABCDEF";
+
+    for (size_t i=0; i<src_size; i++) {
+        *dst++ = tbl[0xF&(src[i]>>4)];
+        *dst++ = tbl[0xF&(src[i])];
+    }
+
+    *dst = 0;
+
+    return 0;
+}
+
+_const_
+static inline int fromhex (const char c)
+{
+    if (c>='0' && c<='9')
+        return c-'0';
+
+    if (c>='A' && c<='F')
+        return c-'A'+10;
+
+    if (c>='a' && c<='f')
+        return c-'a'+10;
+
+    return -1;
+}
+
+int gt_fromhex (uint8_t *dst, size_t dst_size, const char *src, size_t src_size)
+{
+    if _0_(src_size&1)
+        return -1;
+
+    if _0_(dst_size<(src_size/2))
+        return -1;
+
+    for (size_t i=0; i<src_size; i+=2) {
+        const int a = fromhex(src[i]);
+        const int b = fromhex(src[i+1]);
+
+        if _0_(a==-1 || b==-1)
+            return -1;
+
+        *dst++ = (a<<4)|b;
+    }
+
+    return 0;
+}

src/common.h

@@ -14,9 +14,15 @@
 #define PALIGN(x)      ((void *)ALIGN((size_t)(x)))
 #define PALIGN_DOWN(x) ((void *)ALIGN_DOWN((size_t)(x)))
 
+#define _1_(x)         (__builtin_expect((x), 1))
+#define _0_(x)         (__builtin_expect((x), 0))
+
 #define _printf_(A,B)  __attribute__((format(printf,A,B)))
 #define _noreturn_     __attribute__((noreturn))
 #define _unused_       __attribute__((unused))
+#define _pure_         __attribute__((pure))
+#define _const_        __attribute__((const))
+#define _align_(...)   __attribute__((aligned(__VA_ARGS__)))
 
 typedef struct buffer buffer_t;
 
@@ -31,3 +37,6 @@ int  gt_print (const char *, ...) _printf_(1,2);
 void gt_log   (const char *, ...) _printf_(1,2);
 void gt_fatal (const char *, ...) _printf_(1,2) _noreturn_;
 void gt_na    (const char *);
+
+int gt_tohex   (char *, size_t, const uint8_t *, size_t);
+int gt_fromhex (uint8_t *, size_t, const char *, size_t);

src/ip-static.h

@@ -2,6 +2,7 @@
 
 #include <stdint.h>
 
+_pure_
 static inline int ip_get_version (const uint8_t *data, size_t size)
 {
     if (size<20)   // XXX
@@ -10,17 +11,14 @@ static inline int ip_get_version (const uint8_t *data, size_t size)
     return data[0]>>4;
 }
 
-static inline void ip_set_size (uint8_t *data, size_t size)
+_pure_
+static inline ssize_t ip_get_size (const int ip_version, const uint8_t *data, size_t size)
 {
-    data[2] = 0xFF&(size>>8);
-    data[3] = 0xFF&(size);
-}
-
-static inline ssize_t ip_get_size (const uint8_t *data, size_t size)
-{
-    switch (ip_get_version(data, size)) {
+    switch (ip_version) {
     case 4:
-        return (data[2]<<8)|data[3];
+        return ((data[2]<<8)|data[3]);
+    case 6:
+        return ((data[4]<<8)|data[5])+40;
     case -1:
         return -1;
     }
@@ -28,11 +26,31 @@ static inline ssize_t ip_get_size (const uint8_t *data, size_t size)
     return 0;
 }
 
-static inline int ip_get_dscp (const uint8_t *data, size_t size)
+_pure_
+static inline ssize_t ip_get_proto (const int ip_version, const uint8_t *data, size_t size)
 {
-    switch (ip_get_version(data, size)) {
+    switch (ip_version) {
     case 4:
-        return data[1]>>2;
+        return data[9];
+    case 6:
+        return data[6];
+    case -1:
+        return -1;
+    }
+
+    return 0;
+}
+
+_pure_
+static inline ssize_t ip_get_hdr_size (const int ip_version, const uint8_t *data, size_t size)
+{
+    switch (ip_version) {
+    case 4:
+        return (data[0]&0xF)<<2;
+    case 6:
+        return 40;
+    case -1:
+        return -1;
     }
 
     return 0;

src/main.c

@@ -5,8 +5,15 @@
 #include <poll.h>
 #include <sys/time.h>
 #include <sys/fcntl.h>
-#include <sys/socket.h>
+
+#ifndef __FAVOR_BSD
+#define __FAVOR_BSD 1
+#endif
+
+#include <netinet/in.h>
 #include <netinet/tcp.h>
+#include <netinet/udp.h>
+
 #include <arpa/inet.h>
 #include <netdb.h>
 
@@ -22,9 +29,11 @@
 #define O_CLOEXEC 0
 #endif
 
-#define GT_BUFFER_SIZE (4*1024*1024)
-#define GT_TIMEOUT     (1000)
-#define GT_MTU_MAX     (1500)
+#define GT_BUFFER_SIZE  (4*1024*1024)
+#define GT_TIMEOUT      (5000)
+#define GT_MTU_MAX      (1500)
+#define GT_TUNR_SIZE    (0x7FFF-16)
+#define GT_TUNW_SIZE    (0x7FFF)
 
 struct fdbuf {
     int fd;
@@ -33,9 +42,8 @@ struct fdbuf {
 };
 
 struct blk {
-    uint8_t prio;
     size_t size;
-    uint8_t data[GT_MTU_MAX];
+    uint8_t data[GT_MTU_MAX] _align_(16);
 };
 
 struct crypto_ctx {
@@ -47,7 +55,9 @@ struct crypto_ctx {
 };
 
 volatile sig_atomic_t gt_close = 0;
+volatile sig_atomic_t gt_info = 0;
 
+_pure_
 static int64_t dt_ms (struct timeval *ta, struct timeval *tb)
 {
     const int64_t s = ta->tv_sec-tb->tv_sec;
@@ -82,6 +92,7 @@ enum sk_opt {
     sk_keepintvl,
     sk_congestion,
     sk_defer_accept,
+    sk_quickack,
 };
 
 static void sk_set (int fd, enum sk_opt opt, const void *val, socklen_t len)
@@ -121,6 +132,11 @@ static void sk_set (int fd, enum sk_opt opt, const void *val, socklen_t len)
         [sk_defer_accept] = { "TCP_DEFER_ACCEPT",
 #ifdef TCP_DEFER_ACCEPT
             1, IPPROTO_TCP, TCP_DEFER_ACCEPT,
+#endif
+        },
+        [sk_quickack] = { "TCP_QUICKACK",
+#ifdef TCP_QUICKACK
+            1, IPPROTO_TCP, TCP_QUICKACK,
 #endif
         },
     };
@@ -237,38 +253,6 @@ static char *sk_get_name (int fd)
     return str_cat(strs, COUNT(strs));
 }
 
-#ifdef TCP_INFO
-static socklen_t sk_get_info (int fd, struct tcp_info *ti)
-{
-    socklen_t len = sizeof(struct tcp_info);
-
-    if (getsockopt(fd, SOL_TCP, TCP_INFO, ti, &len)==-1) {
-        perror("getsockopt TCP_INFO");
-        return 0;
-    }
-
-    return len;
-}
-
-static void print_tcp_info (const char *name, struct tcp_info *ti)
-{
-    gt_log("%s: tcpinfo"
-            " rto:%"     PRIu32 " ato:%"          PRIu32 " snd_mss:%"  PRIu32
-            " rcv_mss:%" PRIu32 " unacked:%"      PRIu32 " sacked:%"   PRIu32
-            " lost:%"    PRIu32 " retrans:%"      PRIu32 " fackets:%"  PRIu32
-            " pmtu:%"    PRIu32 " rcv_ssthresh:%" PRIu32 " rtt:%"      PRIu32
-            " rttvar:%"  PRIu32 " snd_ssthresh:%" PRIu32 " snd_cwnd:%" PRIu32
-            " advmss:%"  PRIu32 " reordering:%"   PRIu32 "\n",
-            name,
-            ti->tcpi_rto,       ti->tcpi_ato,            ti->tcpi_snd_mss,
-            ti->tcpi_rcv_mss,   ti->tcpi_unacked,        ti->tcpi_sacked,
-            ti->tcpi_lost,      ti->tcpi_retrans,        ti->tcpi_fackets,
-            ti->tcpi_pmtu,      ti->tcpi_rcv_ssthresh,   ti->tcpi_rtt,
-            ti->tcpi_rttvar,    ti->tcpi_snd_ssthresh,   ti->tcpi_snd_cwnd,
-            ti->tcpi_advmss,    ti->tcpi_reordering);
-}
-#endif
-
 static struct addrinfo *ai_create (const char *host, const char *port, int listener)
 {
     if (!port || !port[0]) {
@@ -308,24 +292,33 @@ static struct addrinfo *ai_create (const char *host, const char *port, int liste
     return NULL;
 }
 
-static void gt_sa_stop (int sig)
+static void gt_sa_handler (int sig)
 {
     switch (sig) {
     case SIGINT:
+    case SIGQUIT:
     case SIGTERM:
         gt_close = 1;
+        break;
+    case SIGUSR1:
+        gt_info = 1;
+        break;
     }
 }
 
 static void gt_set_signal (void)
 {
-    struct sigaction sa;
+    struct sigaction sa = {
+        .sa_flags = 0,
+    };
 
-    byte_set(&sa, 0, sizeof(sa));
+    sigemptyset(&sa.sa_mask);
 
-    sa.sa_handler = gt_sa_stop;
+    sa.sa_handler = gt_sa_handler;
     sigaction(SIGINT,  &sa, NULL);
+    sigaction(SIGQUIT, &sa, NULL);
     sigaction(SIGTERM, &sa, NULL);
+    sigaction(SIGUSR1, &sa, NULL);
 
     sa.sa_handler = SIG_IGN;
     sigaction(SIGHUP,  &sa, NULL);
@@ -335,7 +328,7 @@ static void gt_set_signal (void)
 static ssize_t fd_read (int fd, void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
     ssize_t ret = read(fd, data, size);
 
@@ -355,7 +348,7 @@ static ssize_t fd_read (int fd, void *data, size_t size)
 static ssize_t fd_write (int fd, const void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
     ssize_t ret = write(fd, data, size);
 
@@ -363,6 +356,9 @@ static ssize_t fd_write (int fd, const void *data, size_t size)
         if (errno==EAGAIN || errno==EINTR)
             return -1;
 
+        if (errno==EPIPE || errno==ECONNRESET)
+            return 0;
+
         if (errno)
             perror("write");
 
@@ -372,15 +368,10 @@ static ssize_t fd_write (int fd, const void *data, size_t size)
     return ret;
 }
 
-static ssize_t fd_read_all (int fd, void *data, size_t size)
+static size_t fd_read_all (int fd, void *data, size_t size)
 {
     size_t done = 0;
 
-    struct pollfd pollfd = {
-        .fd = fd,
-        .events = POLLIN,
-    };
-
     while (done<size) {
         ssize_t ret = fd_read(fd, (uint8_t *)data+done, size-done);
 
@@ -388,8 +379,14 @@ static ssize_t fd_read_all (int fd, void *data, size_t size)
             break;
 
         if (ret<0) {
+            struct pollfd pollfd = {
+                .fd = fd,
+                .events = POLLIN,
+            };
+
             if (!poll(&pollfd, 1, GT_TIMEOUT))
                 break;
+
             continue;
         }
 
@@ -399,15 +396,10 @@ static ssize_t fd_read_all (int fd, void *data, size_t size)
     return done;
 }
 
-static ssize_t fd_write_all (int fd, const void *data, size_t size)
+static size_t fd_write_all (int fd, const void *data, size_t size)
 {
     size_t done = 0;
 
-    struct pollfd pollfd = {
-        .fd = fd,
-        .events = POLLOUT,
-    };
-
     while (done<size) {
         ssize_t ret = fd_write(fd, (const uint8_t *)data+done, size-done);
 
@@ -415,8 +407,14 @@ static ssize_t fd_write_all (int fd, const void *data, size_t size)
             break;
 
         if (ret<0) {
+            struct pollfd pollfd = {
+                .fd = fd,
+                .events = POLLOUT,
+            };
+
             if (!poll(&pollfd, 1, GT_TIMEOUT))
                 break;
+
             continue;
         }
 
@@ -428,13 +426,13 @@ static ssize_t fd_write_all (int fd, const void *data, size_t size)
 
 static int gt_encrypt (struct crypto_ctx *ctx, buffer_t *dst, buffer_t *src)
 {
-    size_t rs = buffer_read_size(src);
-    size_t ws = buffer_write_size(dst);
+    const size_t rs = buffer_read_size(src);
+    const size_t ws = buffer_write_size(dst);
 
     if (!rs || !ws)
         return 0;
 
-    size_t size = rs+crypto_aead_aes256gcm_ABYTES;
+    const size_t size = rs+crypto_aead_aes256gcm_ABYTES;
 
     if (size+2>ws)
         return 0;
@@ -459,16 +457,16 @@ static int gt_encrypt (struct crypto_ctx *ctx, buffer_t *dst, buffer_t *src)
 
 static int gt_decrypt (struct crypto_ctx *ctx, buffer_t *dst, buffer_t *src)
 {
-    size_t rs = buffer_read_size(src);
-    size_t ws = buffer_write_size(dst);
+    const size_t rs = buffer_read_size(src);
+    const size_t ws = buffer_write_size(dst);
 
     if (!rs || !ws)
         return 0;
 
-    if (rs<=2+16)
+    if (rs<=2+crypto_aead_aes256gcm_ABYTES)
         return 0;
 
-    size_t size = (src->read[0]<<8)|src->read[1];
+    const size_t size = (src->read[0]<<8)|src->read[1];
 
     if (size-crypto_aead_aes256gcm_ABYTES>ws)
         return 0;
@@ -493,32 +491,79 @@ static int gt_decrypt (struct crypto_ctx *ctx, buffer_t *dst, buffer_t *src)
     return 0;
 }
 
-static void dump_ip_header (uint8_t *data, size_t size)
+static void gt_print_hdr (const int ip_version, uint8_t *data, size_t ip_size, const char *sockname)
 {
-    if (size<20)
-        return;
+    const ssize_t ip_proto = ip_get_proto(ip_version, data, ip_size);
+    const ssize_t ip_hdr_size = ip_get_hdr_size(ip_version, data, ip_size);
 
-    const char tbl[] = "0123456789ABCDEF";
-    char hex[41];
+    char ip_src[33];
+    char ip_dst[33];
 
-    for (size_t i=0; i<20; i++) {
-        hex[(i<<1)+0] = tbl[0xF&(data[i]>>4)];
-        hex[(i<<1)+1] = tbl[0xF&(data[i])];
+    switch (ip_version) {
+        case 4:
+            gt_tohex(ip_src, sizeof(ip_src), &data[12], 4);
+            gt_tohex(ip_dst, sizeof(ip_dst), &data[16], 4);
+            break;
+        case 6:
+            gt_tohex(ip_src, sizeof(ip_src), &data[9], 16);
+            gt_tohex(ip_dst, sizeof(ip_dst), &data[25], 16);
+            break;
     }
 
-    hex[40] = 0;
+    gt_log("%s: version=%i size=%zi proto=%zi src=%s dst=%s\n", sockname, ip_version, ip_size, ip_proto, ip_src, ip_dst);
 
-    gt_log("DUMP(%zu): %s\n", size, hex);
+    if (ip_hdr_size<=0)
+        return;
+
+    if (ip_proto==6) {
+        struct tcphdr tcp;
+
+        byte_cpy(&tcp, &data[ip_hdr_size], sizeof(tcp));
+
+        tcp.th_sport = ntohs(tcp.th_sport);
+        tcp.th_dport = ntohs(tcp.th_dport);
+        tcp.th_seq = ntohl(tcp.th_seq);
+        tcp.th_ack = ntohl(tcp.th_ack);
+        tcp.th_win = ntohs(tcp.th_win);
+
+        gt_log("%s: tcp src=%u dst=%u seq=%u ack=%u win=%u %c%c%c%c%c%c\n",
+                sockname, tcp.th_sport, tcp.th_dport, tcp.th_seq, tcp.th_ack, tcp.th_win,
+                (tcp.th_flags&TH_FIN) ?'F':'.',
+                (tcp.th_flags&TH_SYN) ?'S':'.',
+                (tcp.th_flags&TH_RST) ?'R':'.',
+                (tcp.th_flags&TH_PUSH)?'P':'.',
+                (tcp.th_flags&TH_ACK) ?'A':'.',
+                (tcp.th_flags&TH_URG) ?'U':'.');
+    }
+
+    if (ip_proto==17) {
+        struct udphdr udp;
+
+        byte_cpy(&udp, &data[ip_hdr_size], sizeof(udp));
+
+        udp.uh_sport = ntohs(udp.uh_sport);
+        udp.uh_dport = ntohs(udp.uh_dport);
+        udp.uh_ulen = ntohs(udp.uh_ulen);
+
+        gt_log("%s: udp src=%u dst=%u len=%u\n",
+                sockname, udp.uh_sport, udp.uh_dport, udp.uh_ulen);
+    }
 }
 
 static int gt_setup_secretkey (struct crypto_ctx *ctx, char *keyfile)
 {
-    size_t size = sizeof(ctx->skey);
+    const size_t size = sizeof(ctx->skey);
 
-    byte_set(ctx->skey, 1, size);
+    if (!keyfile) {
+        char buf[2*size+1];
+
+        randombytes_buf(ctx->skey, size);
+        gt_tohex(buf, sizeof(buf), ctx->skey, size);
+
+        gt_print("new secret key: %s\n", buf);
 
-    if (!keyfile)
         return 0;
+    }
 
     int fd;
 
@@ -531,13 +576,20 @@ static int gt_setup_secretkey (struct crypto_ctx *ctx, char *keyfile)
         return -1;
     }
 
-    if (fd_read_all(fd, ctx->skey, size)!=size) {
-        gt_log("unable to read secret key in `%s'\n", keyfile);
-        close(fd);
+    char key[2*size];
+    size_t r = fd_read_all(fd, key, sizeof(key));
+
+    close(fd);
+
+    if (r!=sizeof(key)) {
+        gt_log("unable to read secret key\n");
         return -1;
     }
 
-    close(fd);
+    if (gt_fromhex(ctx->skey, size, key, sizeof(key))) {
+        gt_log("secret key is not valid\n");
+        return -1;
+    }
 
     return 0;
 }
@@ -632,18 +684,17 @@ int main (int argc, char **argv)
     char *dev = PACKAGE_NAME;
     char *keyfile = NULL;
     char *congestion = NULL;
+
     long buffer_size = GT_BUFFER_SIZE;
+
     long ka_count = -1;
     long ka_idle = -1;
     long ka_interval = -1;
-    long dscp_prio = 0x3F;
 
-#ifdef TCP_INFO
-    struct {
-        struct timeval time;
-        struct tcp_info info;
-    } tcpinfo = {0};
-#endif
+    long retry_count = -1;
+    long retry_slope = 0;
+    long retry_const = 0;
+    long retry_limit = 1000000;
 
     struct option ka_opts[] = {
         { "count",    &ka_count,    option_long },
@@ -652,6 +703,14 @@ int main (int argc, char **argv)
         { NULL },
     };
 
+    struct option retry_opts[] = {
+        { "count", &retry_count, option_long },
+        { "slope", &retry_slope, option_long },
+        { "const", &retry_const, option_long },
+        { "limit", &retry_limit, option_long },
+        { NULL },
+    };
+
     struct option opts[] = {
         { "listener",    NULL,         option_option },
         { "host",        &host,        option_str    },
@@ -663,7 +722,8 @@ int main (int argc, char **argv)
         { "multiqueue",  NULL,         option_option },
         { "keepalive",   ka_opts,      option_option },
         { "buffer-size", &buffer_size, option_long   },
-        { "dscp-prio",   &dscp_prio,   option_long   },
+        { "noquickack",  NULL,         option_option },
+        { "retry",       &retry_opts,  option_option },
         { "daemon",      NULL,         option_option },
         { "debug",       NULL,         option_option },
         { "version",     NULL,         option_option },
@@ -678,16 +738,20 @@ int main (int argc, char **argv)
         return 0;
     }
 
-    int listener = option_is_set(opts, "listener");
-    int delay = option_is_set(opts, "delay");
-    int debug = option_is_set(opts, "debug");
-    int keepalive = option_is_set(opts, "keepalive");
+    const int listener = option_is_set(opts, "listener");
+    const int delay = option_is_set(opts, "delay");
+    const int keepalive = option_is_set(opts, "keepalive");
+    const int noquickack = option_is_set(opts, "noquickack");
+    const int debug = option_is_set(opts, "debug");
 
     if (buffer_size < 2048) {
         buffer_size = 2048;
         gt_log("buffer size must be greater than 2048!\n");
     }
 
+    if (!listener && !option_is_set(opts, "retry"))
+        retry_count = 0;
+
     if (sodium_init()==-1) {
         gt_log("libsodium initialization has failed!\n");
         return 1;
@@ -698,11 +762,6 @@ int main (int argc, char **argv)
         return 1;
     }
 
-    struct crypto_ctx ctx;
-
-    if (gt_setup_secretkey(&ctx, keyfile))
-        return 1;
-
     struct addrinfo *ai = ai_create(host, port, listener);
 
     if (!ai)
@@ -718,7 +777,6 @@ int main (int argc, char **argv)
 
     struct blk *blks = calloc(256, sizeof(struct blk));
     size_t blk_count = 0;
-    size_t blk_prio = 0;
     uint8_t blk_read = 0;
     uint8_t blk_write = 0;
 
@@ -727,11 +785,11 @@ int main (int argc, char **argv)
 
     fd_set_nonblock(tun.fd);
 
-    buffer_setup(&tun.write, NULL, 0x7FFF);
-    buffer_setup(&tun.read, NULL, 0x7FFF-16);
+    buffer_setup(&tun.write, NULL, GT_TUNW_SIZE);
+    buffer_setup(&tun.read,  NULL, GT_TUNR_SIZE);
 
     buffer_setup(&sock.write, NULL, buffer_size);
-    buffer_setup(&sock.read, NULL, buffer_size);
+    buffer_setup(&sock.read,  NULL, buffer_size);
 
     int fd = -1;
 
@@ -742,6 +800,11 @@ int main (int argc, char **argv)
             return 1;
     }
 
+    struct crypto_ctx ctx;
+
+    if (gt_setup_secretkey(&ctx, keyfile))
+        return 1;
+
     if (option_is_set(opts, "daemon")) {
         switch (fork()) {
         case -1:
@@ -754,15 +817,36 @@ int main (int argc, char **argv)
         default:
             _exit(0);
         }
+
+        chdir("/");
     }
 
+    long retry = 0;
+
     while (!gt_close) {
+        if (retry_count>=0 && retry>=retry_count+1) {
+            gt_log("couldn't %s (%d attempt%s)\n", listener?"listen":"connect",
+                   (int)retry, (retry>1)?"s":"");
+            break;
+        }
+
+        if (retry_slope || retry_const) {
+            long usec = retry*retry_slope+retry_const;
+
+            if (usec>retry_limit)
+                usec = retry_limit;
+
+            if (usec>0 && usleep(usec)==-1 && errno==EINVAL)
+                sleep(usec/1000000);
+        }
+
+        if (retry<LONG_MAX)
+            retry++;
+
         sock.fd = listener?sk_accept(fd):sk_create(ai, sk_connect);
 
-        if (sock.fd==-1) {
-            usleep(100000);
+        if (sock.fd==-1)
             continue;
-        }
 
         char *sockname = sk_get_name(sock.fd);
 
@@ -792,14 +876,22 @@ int main (int argc, char **argv)
         sk_set(sock.fd, sk_congestion, congestion, str_len(congestion));
 
         switch (gt_setup_crypto(&ctx, sock.fd, listener)) {
-            case -2: gt_log("%s: key exchange could not be verified!\n", sockname);
-            case -1: goto restart;
-            default: break;
+        case -2:
+            gt_log("%s: key exchange could not be verified!\n", sockname);
+            goto restart;
+        case -1:
+            gt_log("%s: key exchange failed\n", sockname);
+            goto restart;
+        default:
+            break;
         }
 
-        fd_set rfds, wfds;
+        retry = 0;
+
+        gt_log("%s: running\n", sockname);
+
+        fd_set rfds;
         FD_ZERO(&rfds);
-        FD_ZERO(&wfds);
 
         int stop_loop = 0;
 
@@ -807,172 +899,149 @@ int main (int argc, char **argv)
         buffer_format(&sock.read);
 
         while (1) {
-            if (gt_close)
+            if _0_(gt_close)
                 stop_loop |= 1;
 
-            if (stop_loop) {
+            if _0_(stop_loop) {
                 if (((stop_loop&(1<<2)) || !buffer_read_size(&sock.write)) &&
                     ((stop_loop&(1<<1)) || !buffer_read_size(&sock.read)))
                     goto restart;
                 FD_CLR(tun.fd, &rfds);
             } else {
-                FD_SET(tun.fd, &rfds);
+                if (!blks[blk_write].size) {
+                    FD_SET(tun.fd, &rfds);
+                } else {
+                    FD_CLR(tun.fd, &rfds);
+                }
             }
 
-            FD_SET(sock.fd, &rfds);
+            buffer_shift(&sock.read);
 
-            if (buffer_read_size(&tun.read) || blk_count)
-                FD_SET(sock.fd, &wfds);
+            if (buffer_write_size(&sock.read)) {
+                FD_SET(sock.fd, &rfds);
+            } else {
+                FD_CLR(sock.fd, &rfds);
+            }
 
-            if (buffer_read_size(&sock.read))
-                FD_SET(tun.fd, &wfds);
+            struct timeval timeout = {
+                .tv_usec = 1000,
+            };
 
-            if (select(sock.fd+1, &rfds, &wfds, NULL, NULL)==-1) {
+            if _0_(select(sock.fd+1, &rfds, NULL, NULL, &timeout)==-1) {
                 if (errno==EINTR)
                     continue;
                 perror("select");
                 return 1;
             }
 
-            FD_CLR(sock.fd, &wfds);
-            FD_CLR(tun.fd, &wfds);
-
-#ifdef TCP_INFO
-            struct timeval now;
-            gettimeofday(&now, NULL);
-
-            if (debug && dt_ms(&now, &tcpinfo.time)>1000LL) {
-                tcpinfo.time = now;
-                if (sk_get_info(sock.fd, &tcpinfo.info))
-                    print_tcp_info(sockname, &tcpinfo.info);
-            }
-#endif
+         // TODO
+         // struct timeval now;
+         // gettimeofday(&now, NULL);
 
             if (FD_ISSET(tun.fd, &rfds)) {
                 while (!blks[blk_write].size) {
                     uint8_t *data = blks[blk_write].data;
-                    ssize_t r = tun_read(tun.fd, data, GT_MTU_MAX);
+                    const ssize_t r = tun_read(tun.fd, data, GT_MTU_MAX);
 
-                    if (!r)
-                        return 2;
-
-                    if (r<0)
+                    if (r<=0) {
+                        gt_close |= !r;
                         break;
+                    }
 
-                    ssize_t ip_size = ip_get_size(data, GT_MTU_MAX);
+                    const int ip_version = ip_get_version(data, GT_MTU_MAX);
+                    const ssize_t ip_size = ip_get_size(ip_version, data, GT_MTU_MAX);
 
-                    if (ip_size<=0)
+                    if _0_(ip_size<=0)
                         continue;
 
-                    if (ip_size!=r) {
-                        dump_ip_header(data, r);
-
-                        if (r<ip_size) {
-                            ip_set_size(data, r);
-                        } else {
-                            continue;
-                        }
+                    if _0_(ip_size!=r) {
+                        char tmp[2*GT_MTU_MAX+1];
+                        gt_tohex(tmp, sizeof(tmp), data, r);
+                        gt_log("%s: DUMP %zi %s\n", sockname, r, tmp);
+                        continue;
                     }
 
-                    if (ip_get_dscp(data, GT_MTU_MAX)==dscp_prio) {
-                        blks[blk_write].prio = 1;
-                        blk_prio++;
-                    }
+                    if _0_(debug)
+                        gt_print_hdr(ip_version, data, ip_size, sockname);
 
                     blks[blk_write++].size = r;
                     blk_count++;
                 }
             }
 
-            buffer_shift(&tun.read);
+            while (1) {
+                buffer_shift(&tun.read);
 
-            // XXX prio code needs a full rewrite :)
+                if _0_(!stop_loop) {
+                    for (; blk_count; blk_read++) {
+                        const size_t size = blks[blk_read].size;
 
-            if (blk_prio) {
-                uint8_t k = blk_read;
+                        if (!size || buffer_write_size(&tun.read)<size)
+                            break;
 
-                while (blk_prio && buffer_write_size(&tun.read)>8*GT_MTU_MAX) {
-                    while (!blks[k].prio)
-                        k++;
+                        byte_cpy(tun.read.write, blks[blk_read].data, size);
+                        tun.read.write += size;
 
-                    byte_cpy(tun.read.write, blks[k].data, blks[k].size);
-                    tun.read.write += blks[k].size;
+                        blks[blk_read].size = 0;
+                        blk_count--;
+                    }
 
-                    blks[k].size = 0;
-                    blk_count--;
-                    blk_prio--;
-
-                    if (blk_read==k)
-                        blk_read++;
-
-                    k++;
-                }
-            }
-
-            while (blk_count) {
-                if (!blks[blk_read].size) {
-                    blk_read++;
-                    continue;
+                    gt_encrypt(&ctx, &sock.write, &tun.read);
                 }
 
-                if (buffer_write_size(&tun.read)<blks[blk_read].size)
+                if (!buffer_read_size(&sock.write))
                     break;
 
-                byte_cpy(tun.read.write, blks[blk_read].data, blks[blk_read].size);
-                tun.read.write += blks[blk_read].size;
+                const ssize_t r = fd_write(sock.fd, sock.write.read,
+                                           buffer_read_size(&sock.write));
 
-                if (blks[blk_read].prio)
-                    blk_prio--;
-
-                blks[blk_read++].size = 0;
-                blk_count--;
+                if (r>0) {
+                    sock.write.read += r;
+                } else {
+                    if (!r)
+                        stop_loop |= (1<<2);
+                    break;
+                }
             }
 
-            gt_encrypt(&ctx, &sock.write, &tun.read);
-
-            if (buffer_read_size(&sock.write)) {
-                ssize_t r = fd_write(sock.fd, sock.write.read,
-                                     buffer_read_size(&sock.write));
-
-                if (r==-1)
-                    FD_SET(sock.fd, &wfds);
-
-                if (!r)
+            if _0_(stop_loop && !buffer_read_size(&sock.write)) {
+                if (!(stop_loop&(1<<2))) {
                     stop_loop |= (1<<2);
-
-                if (r>0)
-                    sock.write.read += r;
-            } else {
-                if (stop_loop) {
-                    gt_log("%s: shutdown\n", sockname);
                     shutdown(sock.fd, SHUT_WR);
+                    gt_log("%s: shutdown\n", sockname);
                 }
             }
 
             buffer_shift(&sock.write);
-            buffer_shift(&sock.read);
 
             if (FD_ISSET(sock.fd, &rfds)) {
-                ssize_t r = fd_read(sock.fd, sock.read.write,
-                                    buffer_write_size(&sock.read));
+                if (noquickack)
+                    sk_set_int(sock.fd, sk_quickack, 0);
 
-                if (!r)
-                    stop_loop |= (1<<1);
+                const ssize_t r = fd_read(sock.fd, sock.read.write,
+                                          buffer_write_size(&sock.read));
 
-                if (r>0)
+                if (r>0) {
                     sock.read.write += r;
+                } else if (!r) {
+                    stop_loop |= (1<<1);
+                }
             }
 
             while (1) {
-                if (gt_decrypt(&ctx, &tun.write, &sock.read)) {
+                buffer_shift(&tun.write);
+
+                if _0_(gt_decrypt(&ctx, &tun.write, &sock.read)) {
                     gt_log("%s: message could not be verified!\n", sockname);
                     goto restart;
                 }
 
                 size_t size = buffer_read_size(&tun.write);
-                ssize_t ip_size = ip_get_size(tun.write.read, size);
 
-                if (!ip_size) {
+                const int ip_version = ip_get_version(tun.write.read, size);
+                ssize_t ip_size = ip_get_size(ip_version, tun.write.read, size);
+
+                if _0_(!ip_size) {
                     gt_log("%s: bad packet!\n", sockname);
                     goto restart;
                 }
@@ -982,17 +1051,13 @@ int main (int argc, char **argv)
 
                 ssize_t r = tun_write(tun.fd, tun.write.read, ip_size);
 
-                if (!r)
-                    return 2;
-
-                if (r==-1)
-                    FD_SET(tun.fd, &wfds);
-
-                if (r>0)
+                if (r>0) {
                     tun.write.read += r;
+                } else {
+                    gt_close |= !r;
+                    break;
+                }
             }
-
-            buffer_shift(&tun.write);
         }
 
     restart:
@@ -1009,8 +1074,13 @@ int main (int argc, char **argv)
 
     freeaddrinfo(ai);
 
+    free(blks);
+
     free(sock.write.data);
     free(sock.read.data);
 
+    free(tun.write.data);
+    free(tun.read.data);
+
     return 0;
 }

src/option.c

@@ -94,18 +94,18 @@ static int option_usage (struct option *opts, int slen)
     if (!opts)
         return 0;
 
-    int len = slen;
+    int len = 0;
 
     for (int k=0; opts[k].name; k++) {
-        if (len>60) {
-            gt_print("\n%*s", (int)slen, "");
-            len = slen;
+        if (len>40) {
+            gt_print("\n%*s", slen, "");
+            len = 0;
         }
 
         len += gt_print(" [%s", opts[k].name);
 
         if (opts[k].call==option_option) {
-            len += option_usage((struct option *)opts[k].data, len);
+            len += option_usage((struct option *)opts[k].data, slen+len);
         } else {
             len += gt_print(" ARG");
         }
@@ -130,12 +130,13 @@ int option (struct option *opts, int argc, char **argv)
 
     int slen = gt_print("usage: %s", argv[0]);
 
-    if (slen>40)
+    if (slen>40) {
         slen = 12;
+        gt_print("\n%*s", slen, "");
+    }
 
     option_usage(opts, slen);
-
-    printf("\n");
+    gt_print("\n");
 
     return 1;
 }

src/tun.c

@@ -124,7 +124,7 @@ int tun_create (_unused_ char *name, _unused_ int mq)
 ssize_t tun_read (int fd, void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
 #ifdef GT_BSD_TUN
     uint32_t family;
@@ -162,7 +162,7 @@ ssize_t tun_read (int fd, void *data, size_t size)
 ssize_t tun_write (int fd, const void *data, size_t size)
 {
     if (!size)
-        return -2;
+        return -1;
 
 #ifdef GT_BSD_TUN
     uint32_t family;

version.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+[ -z "${VERSION}" ] && VERSION=`git describe --tags --always 2>/dev/null` \
+                    && VERSION=${VERSION#v}
+
+[ -z "${VERSION}" ] && VERSION=`basename \`pwd\`` \
+                    && VERSION=${VERSION#*-}
+
+printf ${VERSION}