path: root/ptunnel.c

/*	ptunnel.c
	ptunnel is licensed under the BSD license:
	
	Copyright (c) 2004-2011, Daniel Stoedle <daniels@cs.uit.no>,
	Yellow Lemon Software. All rights reserved.
	
	Redistribution and use in source and binary forms, with or without
	modification, are permitted provided that the following conditions are met:

	- Redistributions of source code must retain the above copyright notice,
	  this list of conditions and the following disclaimer.

	- Redistributions in binary form must reproduce the above copyright notice,
	  this list of conditions and the following disclaimer in the documentation
	  and/or other materials provided with the distribution.

	- Neither the name of the Yellow Lemon Software nor the names of its
	  contributors may be used to endorse or promote products derived from this
	  software without specific prior written permission.

	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
	AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
	LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
	CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	POSSIBILITY OF SUCH DAMAGE.
		
	Contacting the author:
	You can get in touch with me, Daniel St�dle (that's the Norwegian letter oe,
	in case your text editor didn't realize), here: <daniels@cs.uit.no>
	
	The official ptunnel website is here:
	<http://www.cs.uit.no/~daniels/PingTunnel/>
	
	Note that the source code is best viewed with tabs set to 4 spaces.
*/

#include	"ptunnel.h"
#include	"md5.h"

#ifdef WIN32
	/* pthread porting to windows */
	typedef CRITICAL_SECTION  pthread_mutex_t;
	typedef unsigned long     pthread_t;
	#define pthread_mutex_init    InitializeCriticalSectionAndSpinCount
	#define pthread_mutex_lock    EnterCriticalSection
	#define pthread_mutex_unlock  LeaveCriticalSection

	#include <winsock2.h>
	/* Map errno (which Winsock doesn't use) to GetLastError; include the code in the strerror */
	#ifdef errno
		#undef errno
	#endif /* errno */
	#define errno GetLastError()
	/* Local error string storage */
	static char errorstr[255];
	static char * print_last_windows_error()  {
		DWORD last_error = GetLastError();
		memset(errorstr, 0, sizeof(errorstr));
		FormatMessage(FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_FROM_SYSTEM, NULL, last_error, 0, errorstr, sizeof(errorstr), NULL);
		snprintf(errorstr, sizeof(errorstr), "%s (%d)", errorstr, last_error);
		return errorstr;
	}
	#define strerror(x) print_last_windows_error()
#else
#ifdef HAVE_SELINUX
	#include <selinux/selinux.h>
	static char		*selinux_context = NULL;
#endif
	static uid_t		uid = 0;
	static gid_t		gid = 0;
	static char		*root_dir = NULL;
	static bool		daemonize = false;
	static FILE		*pid_file = NULL;
#endif /* WIN32 */


//	Lots of globals
pthread_mutex_t		chain_lock,				//	Lock protecting the chain of connections
  					num_threads_lock;		//	Lock protecting the num_threads variable

bool				unprivileged			= false,	//	True if user wants to run without root
					pcap					= false,	//	True if user wants packet capturing
					print_stats				= false,	//	True if user wants continuous statistics printed.
					use_syslog              = false;	//  True if user wants to log to syslog
FILE				*log_file				= 0;		//	Usually stdout, but can be altered by the user

int					tcp_port				= -1,		//	Port to send data to from the proxy
					tcp_listen_port			= -1,		//	Port the client listens on
					log_level				= kLog_event,	//	Default log level
					mode					= kMode_proxy,	//	Default mode (proxy)
					num_threads				= 0,			//	Current thread count
					max_tunnels				= kMax_tunnels,	//	Default maximum number of tunnels to support at once
					num_tunnels				= 0,			//	Current tunnel count
					use_udp					= 0;			//	True if UDP should be used for transport (proxy runs on port 53)
uint32_t			*seq_expiry_tbl			= 0,			//	Table indicating when a connection ID is allowable (used by proxy)
					given_proxy_ip			= 0,			//	Proxy's internet address
					given_dst_ip			= 0;			//	Destination client wants data forwarded to
char				*password				= 0,			//	Password (must be the same on proxy and client for authentication to succeed)
					password_digest[kMD5_digest_size],		//	MD5 digest of password
					*pcap_device			= 0;			//	Device to capture packets from

//	Some buffer constants
const int			tcp_receive_buf_len		= kDefault_buf_size,
					icmp_receive_buf_len	= kDefault_buf_size + kIP_header_size + kICMP_header_size + sizeof(ping_tunnel_pkt_t),
					pcap_buf_size			= (kDefault_buf_size + kIP_header_size + kICMP_header_size + sizeof(ping_tunnel_pkt_t)+64)*64;
char				pcap_filter_program[]	= "icmp"; // && (icmp[icmptype] = icmp-echo || icmp[icmptype] = icmp-echoreply)";

//	The chain of client/proxy connections
proxy_desc_t		*chain					= 0;
const char			*state_name[kNum_proto_types]	= { "start", "ack", "data", "close", "authenticate" };

//	Let the fun begin!
int		main(int argc, char *argv[]) {
	int				i, opt;
	md5_state_t		state;
	struct hostent	*host_ent;
#ifndef WIN32
	struct passwd	*pwnam;
	struct group	*grnam;
	pid_t			pid;
#endif
#ifdef WIN32
	WORD wVersionRequested;
	WSADATA wsaData;
	int err;

	wVersionRequested = MAKEWORD( 2, 2 );

	err = WSAStartup( wVersionRequested, &wsaData );
	if ( err != 0 ) {
		return -1;
	}

	if ( LOBYTE( wsaData.wVersion ) != 2 ||
		HIBYTE( wsaData.wVersion ) != 2 ) {
		WSACleanup();
		return -1;
	}
#endif /* WIN32 */

	
	//	Seed random generator; it'll be used in combination with a timestamp
	//	when generating authentication challenges.
	srand(time(0));
	memset(password_digest, 0, kMD5_digest_size);
	
	/*	The seq_expiry_tbl is used to prevent the remote ends from prematurely
		re-using a sequence number.
	*/
	seq_expiry_tbl	= calloc(65536, sizeof(uint32_t));
	
	log_file		= stdout;
	
	//	Parse options
	opt				= kOpt_undefined;
	mode			= kMode_proxy;
	for (i=1;i<argc;i++) {
		if (strcmp(argv[i], "-p") == 0) {
			mode	= kMode_forward;
			opt		= kOpt_set_proxy_addr;
		}
		else if (strcmp(argv[i], "-x") == 0)
			opt	= kOpt_set_password;
		else if (strcmp(argv[i], "-lp") == 0)
			opt	= kOpt_set_tcp_port;
		else if (strcmp(argv[i], "-da") == 0)
			opt	= kOpt_set_tcp_dest_addr;
		else if (strcmp(argv[i], "-dp") == 0)
			opt	= kOpt_set_tcp_dest_port;
		else if (strcmp(argv[i], "-v") == 0)
			opt	= kOpt_set_verbosity;
		else if (strcmp(argv[i], "-m") == 0)
			opt = kOpt_set_max_tunnels;
		else if (strcmp(argv[i], "-u") == 0)
			unprivileged	= !unprivileged;
		else if (strcmp(argv[i], "-c") == 0)
			opt	= kOpt_set_pcap_device;
		else if (strcmp(argv[i], "-f") == 0)
			opt = kOpt_set_log_file;
		else if (strcmp(argv[i], "-s") == 0)
			print_stats		= !print_stats;
		#ifndef WIN32
		else if (strcmp(argv[i], "-syslog") == 0)
			use_syslog		= !use_syslog;
		else if (strcmp(argv[i], "-setuid") == 0)
			opt	= kOpt_set_unpriv_user;
		else if (strcmp(argv[i], "-setgid") == 0)
			opt	= kOpt_set_unpriv_group;
		else if (strcmp(argv[i], "-chroot") == 0)
			opt	= kOpt_set_root_dir;
		else if (strcmp(argv[i], "-setcon") == 0)
			opt	= kOpt_set_selinux_context;
		else if (strcmp(argv[i], "-daemon") == 0)
			opt	= kOpt_daemonize;
		#endif /* !WIN32 */
		else if (strcmp(argv[i], "-udp") == 0)
			use_udp			= 1;
		else {
			switch (opt) {
				case kOpt_set_proxy_addr:
					if (NULL == (host_ent = gethostbyname(argv[i]))) {
						pt_log(kLog_error, "Failed to look up %s as proxy address\n", argv[i]);
						return 1;
					}
					given_proxy_ip = *(uint32_t*)host_ent->h_addr_list[0];
					break;
				case kOpt_set_password:
					password				= argv[i];
					pt_log(kLog_debug, "Password set - unauthenicated connections will be refused.\n");
					//	Compute the password digest
					md5_init(&state);
					md5_append(&state, (md5_byte_t*)password, strlen(password));
					md5_finish(&state, (md5_byte_t*)password_digest);
					//	Hide the password in process listing
					memset(argv[i], ' ', strlen(argv[i]));
					break;
				case kOpt_set_tcp_port:
					tcp_listen_port			= atoi(argv[i]);
					break;
				case kOpt_set_tcp_dest_addr:
					if (NULL == (host_ent = gethostbyname(argv[i]))) {
						pt_log(kLog_error, "Failed to look up %s as destination address\n", argv[i]);
						return 1;
					}
					given_dst_ip = *(uint32_t*)host_ent->h_addr_list[0];
					break;
				case kOpt_set_tcp_dest_port:
					tcp_port				= atoi(argv[i]);
					break;
				case kOpt_set_max_tunnels:
					max_tunnels	= atoi(argv[i]);
					if (max_tunnels <= 0)
						max_tunnels	= kMax_tunnels;
					break;
				case kOpt_set_verbosity:
					log_level		= atoi(argv[i]);
					break;
				case kOpt_set_pcap_device:
					pcap_device		= argv[i];
					pcap			= 1;
					break;
				case kOpt_set_log_file:
					log_file		= fopen(argv[i], "a");
					if (!log_file) {
						log_file	= stdout;
						pt_log(kLog_error, "Failed to open log file: '%s'. Cause: %s\n", argv[i], strerror(errno));
						pt_log(kLog_error, "Reverting log to standard out.\n");
					}
					break;
				#ifndef WIN32
				case kOpt_set_unpriv_user:
					errno = 0;
					if (NULL == (pwnam = getpwnam(argv[i]))) {
						pt_log(kLog_error, "%s: %s\n", argv[i], errno ? strerror(errno) : "unknown user");
						exit(1);
					}
					uid = pwnam->pw_uid;
					if (!gid)
						gid = pwnam->pw_gid;
					break;
				case kOpt_set_unpriv_group:
					errno = 0;
					if (NULL == (grnam = getgrnam(argv[i]))) {
						pt_log(kLog_error, "%s: %s\n", argv[i], errno ? strerror(errno) : "unknown group");
						exit(1);
					}
					gid = grnam->gr_gid;
					break;
				case kOpt_set_root_dir:
					root_dir = strdup(argv[i]);
					break;
				case kOpt_set_selinux_context:
				#ifdef HAVE_SELINUX
					selinux_context = strdup(argv[i]);
				#else
					pt_log(kLog_error, "Sorry: SELinux support missing, please recompile with libselinux.\n");
					return 1;
				#endif
					break;
				case kOpt_daemonize:
					daemonize = true;
					if (NULL == (pid_file = fopen(argv[i], "w")))
						pt_log(kLog_error, "%s: %s\n", argv[i], strerror(errno));
					break;
				#endif /* !WIN32 */
				case kOpt_undefined:
					usage(argv[0]);
					return 1;
			}
			opt	= kOpt_undefined;
		}
	}
	if (opt != kOpt_undefined) {
		usage(argv[0]);
		exit(1);
	}
	if (pcap && use_udp) {
		pt_log(kLog_error, "Packet capture is not supported (or needed) when using UDP for transport.\n");
		pcap	= 0;
	}
	pt_log(kLog_info, "Starting ptunnel v %d.%.2d.\n", kMajor_version, kMinor_version);
	pt_log(kLog_info, "(c) 2004-2011 Daniel Stoedle, <daniels@cs.uit.no>\n");
	#ifdef WIN32
	pt_log(kLog_info, "Windows version by Mike Miller, <mike@mikeage.net>\n");
	#else
	pt_log(kLog_info, "Security features by Sebastien Raveau, <sebastien.raveau@epita.fr>\n");
	#endif
	pt_log(kLog_info, "%s.\n", (mode == kMode_forward ? "Relaying packets from incoming TCP streams" : "Forwarding incoming ping packets over TCP"));
	if (use_udp)
		pt_log(kLog_info, "UDP transport enabled.\n");
	
#ifndef WIN32
  	signal(SIGPIPE, SIG_IGN);
	if (use_syslog) {
		if (log_file != stdout) {
			pt_log(kLog_error, "Logging using syslog overrides the use of a specified logfile (using -f).\n");
			fclose(log_file);
			log_file	= stdout;
		}		
		openlog("ptunnel", LOG_PID, LOG_USER);
	}
	if (NULL != root_dir) {
		pt_log(kLog_info, "Restricting file access to %s\n", root_dir);
		if (-1 == chdir(root_dir) || -1 == chroot(root_dir)) {
			pt_log(kLog_error, "%s: %s\n", root_dir, strerror(errno));
			exit(1);
		}
	}
	if (daemonize) {
		pt_log(kLog_info, "Going to the background.\n");
		if (0 < (pid = fork()))
			exit(0);
		if (0 > pid)
			pt_log(kLog_error, "fork: %s\n", strerror(errno));
		else
			if (-1 == setsid())
				pt_log(kLog_error, "setsid: %s\n", strerror(errno));
			else {
				if (0 < (pid = fork()))
					exit(0);
				if (0 > pid)
					pt_log(kLog_error, "fork: %s\n", strerror(errno));
				else {
					if (NULL != pid_file) {
						fprintf(pid_file, "%d\n", getpid());
						fclose(pid_file);
					}
					freopen("/dev/null", "r", stdin);
					freopen("/dev/null", "w", stdout);
					freopen("/dev/null", "w", stderr);
				}
			}
	}
#endif /* !WIN32 */

#ifdef WIN32
	WORD wVersionRequested;
	WSADATA wsaData;
	int err;

	wVersionRequested = MAKEWORD( 2, 2 );

	err = WSAStartup( wVersionRequested, &wsaData );
	if ( err != 0 ) {
		return -1;
	}

	if ( LOBYTE( wsaData.wVersion ) != 2 ||
		HIBYTE( wsaData.wVersion ) != 2 ) {
		WSACleanup();
		return -1;
	}
#endif /* WIN32 */
  	pthread_mutex_init(&chain_lock, 0);
  	pthread_mutex_init(&num_threads_lock, 0);
	
	//	Check mode, validate arguments and start either client or proxy.
	if (mode == kMode_forward) {
		if (!given_proxy_ip || !given_dst_ip || !tcp_port || !tcp_listen_port) {
			printf("One of the options are missing or invalid.\n");
			usage(argv[0]);
			return -1;
		}
		pt_forwarder();
	}
	else
		pt_proxy(0);
	
	//	Clean up
	if (log_file != stdout)
		fclose(log_file);

#ifdef WIN32
	WSACleanup();
#else
	if (NULL != root_dir)
		free(root_dir);
	#ifdef HAVE_SELINUX
	if (NULL != selinux_context)
		free(selinux_context);
	#endif
#endif /* WIN32 */

	pt_log(kLog_info, "ptunnel is exiting.\n");
	return 0;
}


void		usage(char *exec_name) {
	printf("ptunnel v %d.%.2d.\n", kMajor_version, kMinor_version);
	printf("Usage:   %s -p <addr> -lp <port> -da <dest_addr> -dp <dest_port> [-m max_tunnels] [-v verbosity] [-f logfile]\n", exec_name);
	printf("         %s [-m max_threads] [-v verbosity] [-c <device>]\n", exec_name);
	printf("     -p: Set address of peer running packet forwarder. This causes\n");
	printf("         ptunnel to operate in forwarding mode - the absence of this\n");
	printf("         option causes ptunnel to operate in proxy mode.\n");
	printf("    -lp: Set TCP listening port (only used when operating in forward mode)\n");
	printf("    -da: Set remote proxy destination address if client\n");
	printf("         Restrict to only this destination address if server\n");
	printf("    -dp: Set remote proxy destionation port if client\n");
	printf("         Restrict to only this destination port if server\n");
	printf("     -m: Set maximum number of concurrent tunnels\n");
	printf("     -v: Verbosity level (-1 to 4, where -1 is no output, and 4 is all output)\n");
	printf("     -c: Enable libpcap on the given device.\n");
	printf("     -f: Specify a file to log to, rather than printing to standard out.\n");
	printf("     -s: Client only. Enables continuous output of statistics (packet loss, etc.)\n");
	#ifndef WIN32
	printf("-daemon: Run in background, the PID will be written in the file supplied as argument\n");
	printf("-syslog: Output debug to syslog instead of standard out.\n");
	#endif /* !WIN32 */
	printf("   -udp: Toggle use of UDP instead of ICMP. Proxy will listen on port 53 (must be root).\n\n");

	printf("Security features:  [-x password] [-u] [-setuid user] [-setgid group] [-chroot dir]\n");
	printf("     -x: Set password (must be same on client and proxy)\n");
	printf("     -u: Run proxy in unprivileged mode. This causes the proxy to forward\n");
	printf("         packets using standard echo requests, instead of crafting custom echo replies.\n");
	printf("         Unprivileged mode will only work on some systems, and is in general less reliable\n");
	printf("         than running in privileged mode.\n");
	#ifndef WIN32
	printf("         Please consider combining the following three options instead:\n");
	printf("-setuid: When started in privileged mode, drop down to user's rights as soon as possible\n");
	printf("-setgid: When started in privileged mode, drop down to group's rights as soon as possible\n");
	printf("-chroot: When started in privileged mode, restrict file access to the specified directory\n");
	printf("-setcon: Set SELinux context when all there is left to do are network I/O operations\n");
	printf("         To combine with -chroot you will have to `mount --bind /proc /chrootdir/proc`\n");
	#endif /* !WIN32 */

	printf("\nStarting the proxy (needs to run as root):\n");
	printf(" [root #] %s\n", exec_name);
	printf("Starting a client (also needs root):\n");
	printf(" [root #] %s -p proxy.pingtunnel.com -lp 8000 -da login.domain.com -dp 22 -c eth0\n", exec_name);
	printf("And then using the tunnel to ssh to login.domain.com:\n");
	printf(" [user $] ssh -p 8000 localhost\n");
	printf("And that's it. Enjoy your tunnel!\n\n");
}


/*	pt_forwarder:
	Sets up a listening TCP socket, and forwards incoming connections
	over ping packets.
*/
void		pt_forwarder(void) {
	int					server_sock, new_sock, sock, yes = 1;
	fd_set				set;
	struct timeval		time;
	struct sockaddr_in	addr, dest_addr;
	socklen_t			addr_len;
	pthread_t			pid;
	uint16_t			rand_id;
	
	pt_log(kLog_debug, "Starting forwarder..\n");
	//	Open our listening socket
	sock					= socket(AF_INET, SOCK_STREAM, 0);
	if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const void *) &yes, sizeof(int)) == -1) {
		pt_log(kLog_error, "Failed to set SO_REUSEADDR option on listening socket: %s\n", strerror(errno));
		close(sock);
		return;
	}
	addr.sin_family			= AF_INET;
	addr.sin_port			= htons(tcp_listen_port);
	addr.sin_addr.s_addr	= INADDR_ANY;
	memset(&(addr.sin_zero), 0, 8);
	if (bind(sock, (struct sockaddr*)&addr, sizeof(struct sockaddr)) == -1) {
		pt_log(kLog_error, "Failed to bind listening socket: %s\n", strerror(errno));
		close(sock);
		return;
	}
	server_sock		= sock;
	//	Fill out address structure
	memset(&dest_addr, 0, sizeof(struct sockaddr_in));
	dest_addr.sin_family			= AF_INET;
	if (use_udp)
		dest_addr.sin_port			= htons(kDNS_port /* dns port.. */);
	else
		dest_addr.sin_port			= 0;
	dest_addr.sin_addr.s_addr		= given_proxy_ip;
	pt_log(kLog_verbose, "Proxy IP address: %s\n", inet_ntoa(*((struct in_addr*)&given_proxy_ip)));
	
	listen(server_sock, 10);
	while (1) {
		FD_ZERO(&set);
		FD_SET(server_sock, &set);
		time.tv_sec		= 1;
		time.tv_usec	= 0;
		if (select(server_sock+1, &set, 0, 0, &time) > 0) {
			pt_log(kLog_info, "Incoming connection.\n");
			addr_len	= sizeof(struct sockaddr_in);
			new_sock	= accept(server_sock, (struct sockaddr*)&addr, &addr_len);
			if (new_sock < 0) {
				pt_log(kLog_error, "Accepting incoming connection failed.\n");
				continue;
			}
			pthread_mutex_lock(&num_threads_lock);
			if (num_threads <= 0) {
				pt_log(kLog_event, "No running proxy thread - starting it.\n");
#ifndef WIN32
				if (pthread_create(&pid, 0, pt_proxy, 0) != 0)
#else
				if (0 == (pid = _beginthreadex(0, 0, (unsigned int (__stdcall *)(void *))pt_proxy, 0, 0, 0)))
#endif
				{
					pt_log(kLog_error, "Couldn't create thread! Dropping incoming connection.\n");
					close(new_sock);
					pthread_mutex_unlock(&num_threads_lock);
					continue;
				}
			}
			addr	= dest_addr;
			rand_id	= (uint16_t)rand();
			create_and_insert_proxy_desc(rand_id, rand_id, new_sock, &addr, given_dst_ip, tcp_port, kProxy_start, kUser_flag);
			pthread_mutex_unlock(&num_threads_lock);
		}
	}
}


int			pt_create_udp_socket(int port) {
	struct sockaddr_in	addr; 
	int					sock, yes = 1;
	
	sock = socket(AF_INET, SOCK_DGRAM, 0); 
	if (sock < 0) {
		pt_log(kLog_error, "Failed to set create UDP socket..\n");
		return 0; 
	}
	if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (const void*)&yes, sizeof(int)) < 0) {
		pt_log(kLog_error, "Failed to set UDP REUSEADDR socket option. (Not fatal, hopefully.)\n");
		close(sock);
		return 0;
	}
	#ifdef SO_REUSEPORT
	yes = 1;
	if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT, (const void*)&yes, sizeof(int)) < 0)
		pt_log(kLog_error, "Failed to set UDP REUSEPORT socket option. (Not fatal, hopefully.)\n");
	#endif //SO_REUSEPORT
	
	memset(&addr, 0, sizeof(struct sockaddr_in));
	addr.sin_family			= AF_INET;
	addr.sin_addr.s_addr	= htonl(INADDR_ANY);
	addr.sin_port			= htons(port);
	if (bind(sock, (struct sockaddr*) &addr, sizeof(struct sockaddr_in)) < 0) {
		pt_log(kLog_error, "Failed to bind UDP socket to port %d (try running as root).\n", port);
		close(sock);
		return 0;
	}
	return sock;
}

#define	kPT_add_iphdr	0

/*	pt_proxy: This function does all the client and proxy stuff.
*/
void*		pt_proxy(void *args) {
	fd_set				set;
	struct timeval		timeout;
	int					bytes;
	struct sockaddr_in	addr;
	socklen_t			addr_len;
	int					fwd_sock	= 0,
						max_sock	= 0,
						idx;
	char				*buf;
	double				now, last_status_update = 0.0;
	proxy_desc_t		*cur, *prev, *tmp;
	pcap_info_t			pc;
	xfer_stats_t		xfer;
	
	//	Start the thread, initialize protocol and ring states.
	pt_log(kLog_debug, "Starting ping proxy..\n");
	if (use_udp) {
		pt_log(kLog_debug, "Creating UDP socket..\n");
		if (mode == kMode_proxy)
			fwd_sock	= pt_create_udp_socket(kDNS_port);
		else
			fwd_sock	= pt_create_udp_socket(0);
		if (!fwd_sock) {
			pt_log(kLog_error, "Failed to create UDP socket.\n");
			return 0;
		}
	}
	else {
		if (unprivileged) {
			pt_log(kLog_debug, "Attempting to create unprivileged ICMP datagram socket..\n");
			fwd_sock		= socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
		}
		else {
			#if kPT_add_iphdr
			int		opt = 1;
			#endif
			pt_log(kLog_debug, "Attempting to create privileged ICMP raw socket..\n");
			#if kPT_add_iphdr
			//	experimental
			fwd_sock		= socket(AF_INET, SOCK_RAW, IPPROTO_IP);
			printf("Set ip-hdr-inc; result = %d\n", setsockopt(fwd_sock, IPPROTO_IP, IP_HDRINCL, &opt, sizeof(opt)));
			#else
			fwd_sock		= socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
			#endif
		}
		if (fwd_sock < 0) {
			pt_log(kLog_error, "Couldn't create %s socket: %s\n", (unprivileged ? "unprivileged datagram" : "privileged raw"), strerror(errno));
			return 0;
		}
	}
	max_sock			= fwd_sock+1;
	if (pcap) {
		if (use_udp) {
			pt_log(kLog_error, "Packet capture is not useful with UDP [should not get here!]!\n");
			close(fwd_sock);
			return 0;
		}
		if (!unprivileged) {
			pt_log(kLog_info, "Initializing pcap.\n");
			pc.pcap_err_buf		= malloc(PCAP_ERRBUF_SIZE);
			pc.pcap_data_buf	= malloc(pcap_buf_size);
			pc.pcap_desc		= pcap_open_live(pcap_device, pcap_buf_size, 0 /* promiscous */, 50 /* ms */, pc.pcap_err_buf);
			if (pc.pcap_desc) {
				if (pcap_lookupnet(pcap_device, &pc.netp, &pc.netmask, pc.pcap_err_buf) == -1) {
					
					pt_log(kLog_error, "pcap error: %s\n", pc.pcap_err_buf);
					pcap	= 0;
				}
				pt_log(kLog_verbose, "Network: %s\n", inet_ntoa(*(struct in_addr*)&pc.netp));
				pt_log(kLog_verbose, "Netmask: %s\n", inet_ntoa(*(struct in_addr*)&pc.netmask));
				if (pcap_compile(pc.pcap_desc, &pc.fp, pcap_filter_program, 0, pc.netp) == -1) {
					pt_log(kLog_error, "Failed to compile pcap filter program.\n");
					pcap_close(pc.pcap_desc);
					pcap	= 0;
				}
				else if (pcap_setfilter(pc.pcap_desc, &pc.fp) == -1) {
					pt_log(kLog_error, "Failed to set pcap filter program.\n");
					pcap_close(pc.pcap_desc);
					pcap	= 0;
				}
			}
			else {
				pt_log(kLog_error, "pcap error: %s\n", pc.pcap_err_buf);
				pcap	= 0;
			}
			pc.pkt_q.head	= 0;
			pc.pkt_q.tail	= 0;
			pc.pkt_q.elems	= 0;
			//	Check if we have succeeded, and free stuff if not
			if (!pcap) {
				pt_log(kLog_error, "There were errors enabling pcap - pcap has been disabled.\n");
				free(pc.pcap_err_buf);
				free(pc.pcap_data_buf);
				return 0;
			}
		}
		else
			pt_log(kLog_info, "pcap disabled since we're running in unprivileged mode.\n");
	}
	
	pthread_mutex_lock(&num_threads_lock);
	num_threads++;
	pthread_mutex_unlock(&num_threads_lock);
	
	//	Allocate icmp receive buffer
	buf					= malloc(icmp_receive_buf_len);
	
	//	Start forwarding :)
	pt_log(kLog_info, "Ping proxy is listening in %s mode.\n", (unprivileged ? "unprivileged" : "privileged"));

	#ifndef WIN32
	#ifdef HAVE_SELINUX
	if (uid || gid || selinux_context)
	#else
	if (uid || gid)
	#endif
		pt_log(kLog_info, "Dropping privileges now.\n");
	if (gid && -1 == setgid(gid))
		pt_log(kLog_error, "setgid(%d): %s\n", gid, strerror(errno));
	if (uid && -1 == setuid(uid))
		pt_log(kLog_error, "setuid(%d): %s\n", uid, strerror(errno));
	#ifdef HAVE_SELINUX
	if (NULL != selinux_context && -1 == setcon(selinux_context))
		pt_log(kLog_error, "setcon(%s) failed: %s\n", selinux_context, strerror(errno));
	#endif
	#endif

	while (1) {
		FD_ZERO(&set);
		FD_SET(fwd_sock, &set);
		max_sock		= fwd_sock+1;
		pthread_mutex_lock(&chain_lock);
		for (cur=chain;cur;cur=cur->next) {
			if (cur->sock) {
				FD_SET(cur->sock, &set);
				if (cur->sock >= max_sock)
					max_sock	= cur->sock+1;
			}
		}
		pthread_mutex_unlock(&chain_lock);
		timeout.tv_sec		= 0;
		timeout.tv_usec		= 10000;
		select(max_sock, &set, 0, 0, &timeout);	//	Don't care about return val, since we need to check for new states anyway..
		
		pthread_mutex_lock(&chain_lock);
		for (prev=0,cur=chain;cur && cur->sock;cur=tmp) {
			//	Client: If we're starting up, send a message to the remote end saying so,
			//	causing him to connect to our desired endpoint.
			if (cur->state == kProxy_start) {
				pt_log(kLog_verbose, "Sending proxy request.\n");
				cur->last_ack	= time_as_double();
				queue_packet(fwd_sock, cur->pkt_type, 0, 0, cur->id_no, cur->id_no, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, cur->dst_ip, cur->dst_port, cur->state | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
				cur->xfer.icmp_out++;
				cur->state		= kProto_data;
			}
			if (cur->should_remove) {
				pt_log(kLog_info, "\nSession statistics:\n");
				print_statistics(&cur->xfer, 0);
				pt_log(kLog_info, "\n");
				tmp	= cur->next;
				remove_proxy_desc(cur, prev);
				continue;
			}
			//	Only handle traffic if there is traffic on the socket, we have
			//	room in our send window AND we either don't use a password, or
			//	have been authenticated.
			if (FD_ISSET(cur->sock, &set) && cur->send_wait_ack < kPing_window_size && (!password || cur->authenticated)) {
				bytes		= recv(cur->sock, cur->buf, tcp_receive_buf_len, 0);
				if (bytes <= 0) {
					pt_log(kLog_info, "Connection closed or lost.\n");
					tmp	= cur->next;
					send_termination_msg(cur, fwd_sock);
					pt_log(kLog_info, "Session statistics:\n");
					print_statistics(&cur->xfer, 0);
					remove_proxy_desc(cur, prev);
					//	No need to update prev
					continue;
				}
				cur->xfer.bytes_out	+= bytes;
				cur->xfer.icmp_out++;
				queue_packet(fwd_sock, cur->pkt_type, cur->buf, bytes, cur->id_no, cur->icmp_id, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, 0, 0, cur->state | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
			}
			prev	= cur;
			tmp		= cur->next;
		}
		pthread_mutex_unlock(&chain_lock);
		
		if (FD_ISSET(fwd_sock, &set)) {
			//	Handle ping traffic
			addr_len	= sizeof(struct sockaddr);
			bytes		= recvfrom(fwd_sock, buf, icmp_receive_buf_len, 0, (struct sockaddr*)&addr, &addr_len);
			if (bytes < 0) {
				pt_log(kLog_error, "Error receiving packet on ICMP socket: %s\n", strerror(errno));
				break;
			}
			handle_packet(buf, bytes, 0, &addr, fwd_sock);
		}
		
		//	Check for packets needing resend, and figure out if any connections
		//	should be closed down due to inactivity.
		pthread_mutex_lock(&chain_lock);
		now		= time_as_double();
		for (cur=chain;cur;cur=cur->next) {
			if (cur->last_activity + kAutomatic_close_timeout < now) {
				pt_log(kLog_info, "Dropping tunnel to %s:%d due to inactivity.\n", inet_ntoa(*(struct in_addr*)&cur->dst_ip), cur->dst_port, cur->id_no);
				cur->should_remove	= 1;
				continue;
			}
			if (cur->recv_wait_send && cur->sock)
				cur->xfer.bytes_in	+= send_packets(cur->recv_ring, &cur->recv_xfer_idx, &cur->recv_wait_send, &cur->sock);
			
			//	Check for any icmp packets requiring resend, and resend _only_ the first packet.
			idx	= cur->send_first_ack;
			if (cur->send_ring[idx].pkt && cur->send_ring[idx].last_resend+kResend_interval < now) {
				pt_log(kLog_debug, "Resending packet with seq-no %d.\n", cur->send_ring[idx].seq_no);
				cur->send_ring[idx].last_resend		= now;
				cur->send_ring[idx].pkt->seq		= htons(cur->ping_seq);
				cur->ping_seq++;
				cur->send_ring[idx].pkt->checksum	= 0;
				cur->send_ring[idx].pkt->checksum	= htons(calc_icmp_checksum((uint16_t*)cur->send_ring[idx].pkt, cur->send_ring[idx].pkt_len));
				//printf("ID: %d\n", htons(cur->send_ring[idx].pkt->identifier));
				sendto(fwd_sock, (const void*)cur->send_ring[idx].pkt, cur->send_ring[idx].pkt_len, 0, (struct sockaddr*)&cur->dest_addr, sizeof(struct sockaddr));
				cur->xfer.icmp_resent++;
			}
			//	Figure out if it's time to send an explicit acknowledgement
			if (cur->last_ack+1.0 < now && cur->send_wait_ack < kPing_window_size && cur->remote_ack_val+1 != cur->next_remote_seq) {
				cur->last_ack	= now;
				queue_packet(fwd_sock, cur->pkt_type, 0, 0, cur->id_no, cur->icmp_id, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, cur->dst_ip, cur->dst_port, kProto_ack | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
				cur->xfer.icmp_ack_out++;
			}
		}
		pthread_mutex_unlock(&chain_lock);
		if (pcap) {
			if (pcap_dispatch(pc.pcap_desc, 32, pcap_packet_handler, (u_char*)&pc.pkt_q) > 0) {
				pqueue_elem_t	*cur;
				//pt_log(kLog_verbose, "pcap captured %d packets - handling them..\n", pc.pkt_q.elems);
				while (pc.pkt_q.head) {
					cur						= pc.pkt_q.head;
					memset(&addr, sizeof(struct sockaddr), 0);
					addr.sin_family			= AF_INET;
					addr.sin_addr.s_addr	= *(in_addr_t*)&(((ip_packet_t*)(cur->data))->src_ip);
					handle_packet(cur->data, cur->bytes, 1, &addr, fwd_sock);
					pc.pkt_q.head			= cur->next;
					free(cur);
					pc.pkt_q.elems--;
				}
				pc.pkt_q.tail		= 0;
				pc.pkt_q.head		= 0;
			}
		}
		//	Update running statistics, if requested (only once every second)
		if (print_stats && mode == kMode_forward && now > last_status_update+1) {
			pthread_mutex_lock(&chain_lock);
			memset(&xfer, 0, sizeof(xfer_stats_t));
			for (cur=chain;cur;cur=cur->next) {
				xfer.bytes_in		+= cur->xfer.bytes_in;
				xfer.bytes_out		+= cur->xfer.bytes_out;
				xfer.icmp_in		+= cur->xfer.icmp_in;
				xfer.icmp_out		+= cur->xfer.icmp_out;
				xfer.icmp_resent	+= cur->xfer.icmp_resent;
			}
			pthread_mutex_unlock(&chain_lock);
			print_statistics(&xfer, 1);
			last_status_update		= now;
		}
	}
	pt_log(kLog_debug, "Proxy exiting..\n");
	if (fwd_sock)
		close(fwd_sock);
	//	TODO: Clean up the other descs. Not really a priority since there's no
	//	real way to quit ptunnel in the first place..
	free(buf);
	pt_log(kLog_debug, "Ping proxy done\n");
	return 0;
}


/*	print_statistics: Prints transfer statistics for the given xfer block. The
	is_continuous variable controls the output mode, either printing a new line
	or overwriting the old line.
*/
void		print_statistics(xfer_stats_t *xfer, int is_continuous) {
	const double	mb		= 1024.0*1024.0;
	double			loss	= 0.0;
	
	if (xfer->icmp_out > 0)
		loss	= (double)xfer->icmp_resent/(double)xfer->icmp_out;
	
	if (is_continuous)
		printf("\r");
	
	printf("[inf]: I/O: %6.2f/%6.2f mb ICMP I/O/R: %8d/%8d/%8d Loss: %4.1f%%",
			xfer->bytes_in/mb, xfer->bytes_out/mb, xfer->icmp_in, xfer->icmp_out, xfer->icmp_resent, loss);
	
	if (!is_continuous)
		printf("\n");
	else
		fflush(stdout);
}


/*	pcap_packet_handler:
	This is our callback function handling captured packets. We already know that the packets
	are ICMP echo or echo-reply messages, so all we need to do is strip off the ethernet header
	and append it to the queue descriptor (the refcon argument).
	
	Ok, the above isn't entirely correct (we can get other ICMP types as well). This function
	also has problems when it captures packets on the loopback interface. The moral of the
	story: Don't do ping forwarding over the loopback interface.
	
	Also, we currently don't support anything else than ethernet when in pcap mode. The reason
	is that I haven't read up on yet on how to remove the frame header from the packet..
*/
void		pcap_packet_handler(u_char *refcon, const struct pcap_pkthdr *hdr, const u_char* pkt) {
	pqueue_t		*q;
	pqueue_elem_t	*elem;
	ip_packet_t		*ip;
	
	//pt_log(kLog_verbose, "Packet handler: %d =? %d\n", hdr->caplen, hdr->len);
	q		= (pqueue_t*)refcon;
	elem	= malloc(sizeof(pqueue_elem_t)+hdr->caplen-sizeof(struct ether_header));
	memcpy(elem->data, pkt+sizeof(struct ether_header), hdr->caplen-sizeof(struct ether_header));
	ip		= (ip_packet_t*)elem->data;
	//	TODO: Add fragment support
	elem->bytes	= ntohs(ip->pkt_len);
	if (elem->bytes > hdr->caplen-sizeof(struct ether_header)) {
		pt_log(kLog_error, "Received fragmented packet - unable to reconstruct!\n");
		pt_log(kLog_error, "This error usually occurs because pcap is used on devices that are not wlan or ethernet.\n");
		free(elem);
		return;
	}
	//elem->bytes	= hdr->caplen-sizeof(struct ether_header);
	elem->next	= 0;
	if (q->tail) {
		q->tail->next	= elem;
		q->tail			= elem;
	}
	else {
		q->head	= elem;
		q->tail	= elem;
	}
	q->elems++;
}



/*	handle_proxy_packet:
	Processes incoming ICMP packets for the proxy. The packet can come either from the
	packet capture lib, or from the actual socket or both.
	Input:	A buffer pointing at the start of an IP header, the buffer length and the proxy
			descriptor chain.
*/
void		handle_packet(char *buf, int bytes, int is_pcap, struct sockaddr_in *addr, int icmp_sock) {
	ip_packet_t			*ip_pkt;
	icmp_echo_packet_t	*pkt;
	ping_tunnel_pkt_t	*pt_pkt;
	proxy_desc_t		*cur;
	uint32_t			type_flag, pkt_flag, init_state;
	challenge_t			*challenge;
	struct timeval		tt;
	
	if (bytes < sizeof(icmp_echo_packet_t)+sizeof(ping_tunnel_pkt_t))
		pt_log(kLog_verbose, "Skipping this packet - too short. Expect: %d+%d = %d ; Got: %d\n", sizeof(icmp_echo_packet_t), sizeof(ping_tunnel_pkt_t), sizeof(icmp_echo_packet_t)+sizeof(ping_tunnel_pkt_t), bytes);
	else {
		if (use_udp) {
			ip_pkt		= 0;
			pkt			= (icmp_echo_packet_t*)buf;
			pt_pkt		= (ping_tunnel_pkt_t*)pkt->data;
		}
		else {
			ip_pkt		= (ip_packet_t*)buf;
			pkt			= (icmp_echo_packet_t*)ip_pkt->data;
			pt_pkt		= (ping_tunnel_pkt_t*)pkt->data;
		}
		if (ntohl(pt_pkt->magic) == kPing_tunnel_magic) {
			pt_pkt->state		= ntohl(pt_pkt->state);
			pkt->identifier		= ntohs(pkt->identifier);
			pt_pkt->id_no		= ntohs(pt_pkt->id_no);
			pt_pkt->seq_no		= ntohs(pt_pkt->seq_no);
			//	Find the relevant connection, if it exists
			pthread_mutex_lock(&chain_lock);
			for (cur=chain;cur;cur=cur->next) {
				if (cur->id_no == pt_pkt->id_no)
					break;
			}
			pthread_mutex_unlock(&chain_lock);
			
			/*	Handle the packet if it comes from "the other end." This is a bit tricky
				to get right, since we receive both our own and the other end's packets.
				Basically, a proxy will accept any packet from a user, regardless if it
				has a valid connection or not. A user will only accept the packet if there
				exists a connection to handle it.
			*/
			if (cur) {
				type_flag			= cur->type_flag;
				if (type_flag == kProxy_flag)
					cur->icmp_id	= pkt->identifier;
				
				if (!is_pcap)
					cur->xfer.icmp_in++;
			}
			else
				type_flag			= kProxy_flag;
			
			pkt_flag		= pt_pkt->state & kFlag_mask;
			pt_pkt->state	&= ~kFlag_mask;
			pt_log(kLog_sendrecv, "Recv: %d [%d] bytes [seq = %d] [type = %s] [ack = %d] [icmp = %d] [user = %s] [pcap = %d]\n",
								bytes, ntohl(pt_pkt->data_len), pt_pkt->seq_no, state_name[pt_pkt->state & (~kFlag_mask)],
								ntohl(pt_pkt->ack), pkt->type, (pkt_flag == kUser_flag ? "yes" : "no"), is_pcap);
			
			//	This test essentially verifies that the packet comes from someone who isn't us.
			if ((pkt_flag == kUser_flag && type_flag == kProxy_flag) || (pkt_flag == kProxy_flag && type_flag == kUser_flag)) {
				pt_pkt->data_len	= ntohl(pt_pkt->data_len);
				pt_pkt->ack			= ntohl(pt_pkt->ack);
				if (pt_pkt->state == kProxy_start) {
					if (!cur && type_flag == kProxy_flag) {
						pt_log(kLog_info, "Incoming tunnel request from %s.\n", inet_ntoa(*(struct in_addr*)&addr->sin_addr));
						gettimeofday(&tt, 0);
						if (tt.tv_sec < seq_expiry_tbl[pt_pkt->id_no]) {
							pt_log(kLog_verbose, "Dropping request: ID was recently in use.\n");
							return;
						}
						pt_log(kLog_info, "Starting new session to %s:%d with ID %d\n", inet_ntoa(*(struct in_addr*)&pt_pkt->dst_ip), ntohl(pt_pkt->dst_port), pt_pkt->id_no);
						if ((given_dst_ip && given_dst_ip != pt_pkt->dst_ip) || (-1 != tcp_port && tcp_port != ntohl(pt_pkt->dst_port))) {
							pt_log(kLog_info, "Destination administratively prohibited!\n");
							return;
						}
						if (password)
							init_state	= kProto_authenticate;
						else
							init_state	= kProto_data;
						cur			= create_and_insert_proxy_desc(pt_pkt->id_no, pkt->identifier, 0, addr, pt_pkt->dst_ip, ntohl(pt_pkt->dst_port), init_state, kProxy_flag);
						if (init_state == kProto_authenticate) {
							pt_log(kLog_debug, "Sending authentication challenge..\n");
							//	Send challenge
							cur->challenge	= generate_challenge();
							memcpy(cur->buf, cur->challenge, sizeof(challenge_t));
							queue_packet(icmp_sock, cur->pkt_type, cur->buf, sizeof(challenge_t), cur->id_no, cur->icmp_id, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, 0, 0, kProto_authenticate | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
						}
					}
					else if (type_flag == kUser_flag) {
						pt_log(kLog_error, "Dropping proxy session request - we are not a proxy!\n");
						return;
					}
					else
						pt_log(kLog_error, "Dropping duplicate proxy session request.\n");
				}
				else if (cur && pt_pkt->state == kProto_authenticate) {
					//	Sanity check packet length, and make sure it matches what we expect
					if (pt_pkt->data_len != sizeof(challenge_t)) {
						pt_log(kLog_error, "Received challenge packet, but data length is not as expected.\n");
						pt_log(kLog_debug, "Data length: %d  Expected: %d\n", pt_pkt->data_len, sizeof(challenge_t));
						cur->should_remove				= 1;
						return;
					}
					//	Prevent packet data from being forwarded over TCP!
					pt_pkt->data_len	= 0;
					challenge			= (challenge_t*)pt_pkt->data;
					//	If client: Compute response to challenge
					if (type_flag == kUser_flag) {
						if (!password) {
							pt_log(kLog_error, "This proxy requires a password! Please supply one using the -x switch.\n");
							send_termination_msg(cur, icmp_sock);
							cur->should_remove	= 1;
							return;
						}
						pt_log(kLog_debug, "Got authentication challenge - sending response\n");
						generate_response(challenge);
						queue_packet(icmp_sock, cur->pkt_type, (char*)challenge, sizeof(challenge_t), cur->id_no, cur->icmp_id, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, 0, 0, kProto_authenticate | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
						//	We have authenticated locally. It's up to the proxy now if it accepts our response or not..
						cur->authenticated	= 1;
						handle_data(pkt, bytes, cur->recv_ring, &cur->recv_wait_send, &cur->recv_idx, &cur->next_remote_seq);
						return;
					}
					//	If proxy: Handle client's response to challenge
					else if (type_flag == kProxy_flag) {
						pt_log(kLog_debug, "Received remote challenge response.\n");
						if (validate_challenge(cur->challenge, challenge) || cur->authenticated) {
							pt_log(kLog_verbose, "Remote end authenticated successfully.\n");
							//	Authentication has succeeded, so now we can proceed to handle incoming TCP data.
							cur->authenticated	= 1;
							cur->state			= kProto_data;
							//	Insert the packet into the receive ring, to avoid confusing the	reliability mechanism.
							handle_data(pkt, bytes, cur->recv_ring, &cur->recv_wait_send, &cur->recv_idx, &cur->next_remote_seq);
						}
						else {
							pt_log(kLog_info, "Remote end failed authentication.\n");
							send_termination_msg(cur, icmp_sock);
							cur->should_remove				= 1;
						}
						return;
					}
				}
				//	Handle close-messages for connections we know about
				if (cur && pt_pkt->state == kProto_close) {
					pt_log(kLog_info, "Received session close from remote peer.\n");
					cur->should_remove	= 1;
					return;
				}
				//	The proxy will ignore any other packets from the client
				//	until it has been authenticated. The packet resend mechanism
				//	insures that this isn't problematic.
				if (type_flag == kProxy_flag && password && cur && !cur->authenticated) {
					pt_log(kLog_debug, "Ignoring packet with seq-no %d - not authenticated yet.\n", pt_pkt->seq_no);
					return;
				}
				
				if (cur && cur->sock) {
					if (pt_pkt->state == kProto_data || pt_pkt->state == kProxy_start || pt_pkt->state == kProto_ack)
						handle_data(pkt, bytes, cur->recv_ring, &cur->recv_wait_send, &cur->recv_idx, &cur->next_remote_seq);
					handle_ack((uint16_t)pt_pkt->ack, cur->send_ring, &cur->send_wait_ack, 0, cur->send_idx, &cur->send_first_ack, &cur->remote_ack_val, is_pcap);
					cur->last_activity		= time_as_double();
				}
			}
		}
		else
			pt_log(kLog_verbose, "Ignored incoming packet.\n");
	}
}



/*	create_and_insert_proxy_desc: Creates a new proxy descriptor, linking it into
	the descriptor chain. If the sock argument is 0, the function will establish
	a TCP connection to the ip and port given by dst_ip, dst_port.
*/
proxy_desc_t*		create_and_insert_proxy_desc(uint16_t id_no, uint16_t icmp_id, int sock, struct sockaddr_in *addr, uint32_t dst_ip, uint32_t dst_port, uint32_t init_state, uint32_t type) {
	proxy_desc_t	*cur;
	
	pthread_mutex_lock(&chain_lock);
	if (num_tunnels >= max_tunnels) {
		pt_log(kLog_info, "Discarding incoming connection - too many tunnels! Maximum count is %d (adjust with the -m switch).\n", max_tunnels);
		if (sock)
			close(sock);
		pthread_mutex_unlock(&chain_lock);
		return 0;
	}
	num_tunnels++;
	pthread_mutex_unlock(&chain_lock);
	
	pt_log(kLog_debug, "Adding proxy desc to run loop. Type is %s. Will create socket: %s\n", (type == kUser_flag ? "user" : "proxy"), (sock ? "No" : "Yes"));
	cur						= calloc(1, sizeof(proxy_desc_t));
	cur->id_no				= id_no;
	cur->dest_addr			= *addr;
	cur->dst_ip				= dst_ip;
	cur->dst_port			= dst_port;
	cur->icmp_id			= icmp_id;
	if (!sock) {
		cur->sock				= socket(AF_INET, SOCK_STREAM, 0);
		memset(addr, 0, sizeof(struct sockaddr_in));
		addr->sin_port			= htons((uint16_t)dst_port);
		addr->sin_addr.s_addr	= dst_ip;
		addr->sin_family		= AF_INET;
		//	Let's just assume success, shall we?
		if (connect(cur->sock, (struct sockaddr*)addr, sizeof(struct sockaddr_in)) < 0) {
			pt_log(kLog_error, "Connect to %s:%d failed: %s\n", inet_ntoa(*(struct in_addr*)&addr->sin_addr.s_addr), ntohs(addr->sin_port), strerror(errno));
		}
	}
	else
		cur->sock			= sock;
	cur->state				= init_state;
	cur->type_flag			= type;
	if (cur->type_flag == kUser_flag)
		cur->pkt_type		= kICMP_echo_request;
	else
		cur->pkt_type		= (unprivileged ? kICMP_echo_request : kICMP_echo_reply);
	cur->buf				= malloc(icmp_receive_buf_len);
	cur->last_activity		= time_as_double();
	cur->authenticated		= 0;
	
	pthread_mutex_lock(&chain_lock);
	cur->next				= chain;
	chain					= cur;
	pthread_mutex_unlock(&chain_lock);
	cur->xfer.bytes_in		= 0.0;
	cur->xfer.bytes_out		= 0.0;
	return cur;
}


/*	remove_proxy_desc: Removes the given proxy desc, freeing its resources.
	Assumes that we hold the chain_lock.
*/
void		remove_proxy_desc(proxy_desc_t *cur, proxy_desc_t *prev) {
	int				i;
	struct timeval	tt;
	
	pt_log(kLog_debug, "Removing proxy descriptor.\n");
	//	Get a timestamp, for making an entry in the seq_expiry_tbl
	gettimeofday(&tt, 0);
	seq_expiry_tbl[cur->id_no]	= tt.tv_sec+(2*kAutomatic_close_timeout);
	
	//	Free resources associated with connection
	if (cur->buf)
		free(cur->buf);
	cur->buf	= 0;
	for (i=0;i<kPing_window_size;i++) {
		if (cur->send_ring[i].pkt)
			free(cur->send_ring[i].pkt);
		cur->send_ring[i].pkt	= 0;
		if (cur->recv_ring[i])
			free(cur->recv_ring[i]);
		cur->recv_ring[i]		= 0;
	}
	close(cur->sock);
	cur->sock	= 0;
	
	//	Keep list up-to-date
	if (prev)
		prev->next	= cur->next;
	else
		chain		= cur->next;
	if (cur->challenge)
		free(cur->challenge);
	free(cur);
	num_tunnels--;
}

#if kPT_add_iphdr
static int ip_id_counter	= 1;
#endif

/*	queue_packet:
	Creates an ICMP packet descriptor, and sends it. The packet descriptor is added
	to the given send ring, for potential resends later on.
*/
int			queue_packet(int icmp_sock, uint8_t type, char *buf, int num_bytes, uint16_t id_no, uint16_t icmp_id, uint16_t *seq, icmp_desc_t ring[], int *insert_idx, int *await_send, uint32_t ip, uint32_t port, uint32_t state, struct sockaddr_in *dest_addr, uint16_t next_expected_seq, int *first_ack, uint16_t *ping_seq) {
	#if kPT_add_iphdr
	ip_packet_t			*ip_pkt	= 0;
	int					pkt_len	= sizeof(ip_packet_t)+sizeof(icmp_echo_packet_t)+sizeof(ping_tunnel_pkt_t)+num_bytes,
	#else
	int					pkt_len	= sizeof(icmp_echo_packet_t)+sizeof(ping_tunnel_pkt_t)+num_bytes,
	#endif
						err		= 0;
	icmp_echo_packet_t	*pkt	= 0;
	ping_tunnel_pkt_t	*pt_pkt	= 0;
	uint16_t			ack_val	= next_expected_seq-1;
	
	
	if (pkt_len % 2)
		pkt_len++;
	
	#if kPT_add_iphdr
	printf("add header\n");
	ip_pkt						= malloc(pkt_len);
	pkt							= (icmp_echo_packet_t*)ip_pkt->data;
	memset(ip_pkt, 0, sizeof(ip_packet_t));
	ip_pkt->vers_ihl			= 0x45;//|(pkt_len>>2);//5;//(IPVERSION << 4) | (sizeof(ip_packet_t) >> 2);
	ip_pkt->tos					= IPTOS_LOWDELAY;
	ip_pkt->pkt_len				= pkt_len;
	ip_pkt->id					= 0;	//kernel sets proper value htons(ip_id_counter);
	ip_pkt->flags_frag_offset	= 0;
	ip_pkt->ttl					= IPDEFTTL;	//	default time to live (64)
	ip_pkt->proto				= 1;	//	ICMP
	ip_pkt->checksum			= 0;	//	maybe the kernel helps us out..?
	ip_pkt->src_ip				= htonl(0x0);	//	insert source IP address here
	ip_pkt->dst_ip				= dest_addr->sin_addr.s_addr;//htonl(0x7f000001);	//	localhost..
	#else
	pkt						= malloc(pkt_len);
	#endif
	
	pkt->type				= type;		//	ICMP Echo request or reply
	pkt->code				= 0;		//	Must be zero (non-zero requires root)
	pkt->identifier			= htons(icmp_id);
	pkt->seq				= htons(*ping_seq);
	pkt->checksum			= 0;
	(*ping_seq)++;
	//	Add our information
	pt_pkt					= (ping_tunnel_pkt_t*)pkt->data;
	pt_pkt->magic			= htonl(kPing_tunnel_magic);
	pt_pkt->dst_ip			= ip;
	pt_pkt->dst_port		= htonl(port);
	pt_pkt->ack				= htonl(ack_val);
	pt_pkt->data_len		= htonl(num_bytes);
	pt_pkt->state			= htonl(state);
	pt_pkt->seq_no			= htons(*seq);
	pt_pkt->id_no			= htons(id_no);
	//	Copy user data
	if (buf && num_bytes > 0)
		memcpy(pt_pkt->data, buf, num_bytes);
	#if kPT_add_iphdr
	pkt->checksum			= htons(calc_icmp_checksum((uint16_t*)pkt, pkt_len-sizeof(ip_packet_t)));
	ip_pkt->checksum		= htons(calc_icmp_checksum((uint16_t*)ip_pkt, sizeof(ip_packet_t)));
	#else
	pkt->checksum			= htons(calc_icmp_checksum((uint16_t*)pkt, pkt_len));
	#endif
	
	//	Send it!
	pt_log(kLog_sendrecv, "Send: %d [%d] bytes [seq = %d] [type = %s] [ack = %d] [icmp = %d] [user = %s]\n",
			pkt_len, num_bytes, *seq, state_name[state & (~kFlag_mask)], ack_val, type, ((state & kUser_flag) == kUser_flag ? "yes" : "no"));
	#if kPT_add_iphdr
	err						= sendto(icmp_sock, (const void*)ip_pkt, pkt_len, 0, (struct sockaddr*)dest_addr, sizeof(struct sockaddr));
	#else
	err						= sendto(icmp_sock, (const void*)pkt, pkt_len, 0, (struct sockaddr*)dest_addr, sizeof(struct sockaddr));
	#endif
	if (err < 0) {
		pt_log(kLog_error, "Failed to send ICMP packet: %s\n", strerror(errno));
		return -1;
	}
	else if (err != pkt_len)
		pt_log(kLog_error, "WARNING WARNING, didn't send entire packet\n");
	
	//	Update sequence no's and so on
	#if kPT_add_iphdr
	//	NOTE: Retry mechanism needs update for PT_add_ip_hdr
	ring[*insert_idx].pkt			= ip_pkt;
	#else
	ring[*insert_idx].pkt			= pkt;
	#endif
	ring[*insert_idx].pkt_len		= pkt_len;
	ring[*insert_idx].last_resend	= time_as_double();
	ring[*insert_idx].seq_no		= *seq;
	ring[*insert_idx].icmp_id		= icmp_id;
	(*seq)++;
	if (!ring[*first_ack].pkt)
		*first_ack					= *insert_idx;
	(*await_send)++;
	(*insert_idx)++;
	if (*insert_idx >= kPing_window_size)
		*insert_idx	= 0;
	return 0;
}


/*	send_packets:
	Examines the passed-in ring, and forwards data in it over TCP.
*/
uint32_t	send_packets(forward_desc_t *ring[], int *xfer_idx, int *await_send, int *sock) {
	forward_desc_t		*fwd_desc;
	int					bytes, total = 0;
	
	while (*await_send > 0) {
		fwd_desc	= ring[*xfer_idx];
		if (!fwd_desc)	//	We haven't got this packet yet..
			break;
		if (fwd_desc->length > 0) {
			bytes		= send(*sock, &fwd_desc->data[fwd_desc->length - fwd_desc->remaining], fwd_desc->remaining, 0);
			if (bytes < 0) {
				printf("Weirdness.\n");
				//	TODO: send close stuff
				close(*sock);
				*sock	= 0;
				break;
			}
			fwd_desc->remaining	-= bytes;
			total				+= bytes;
		}
		if (!fwd_desc->remaining) {
			ring[*xfer_idx]	= 0;
			free(fwd_desc);
			(*xfer_idx)++;
			(*await_send)--;
			if (*xfer_idx >= kPing_window_size)
				*xfer_idx	= 0;
		}
		else
			break;
	}
	return total;
}


/*	handle_data:
	Utility function for handling kProto_data packets, and place the data it contains
	onto the passed-in receive ring.
*/
void		handle_data(icmp_echo_packet_t *pkt, int total_len, forward_desc_t *ring[], int *await_send, int *insert_idx,  uint16_t *next_expected_seq) {
	ping_tunnel_pkt_t	*pt_pkt			= (ping_tunnel_pkt_t*)pkt->data;
	int					expected_len	= sizeof(ip_packet_t) + sizeof(icmp_echo_packet_t) + sizeof(ping_tunnel_pkt_t); // 20+8+28
	
	/*	Place packet in the receive ring, in its proper place.
		This works as follows:
		-1. Packet == ack packet? Perform ack, and continue.
		0. seq_no < next_remote_seq, and absolute difference is bigger than w size => discard
		1. If seq_no == next_remote_seq, we have no problems; just put it in the ring.
		2. If seq_no > next_remote_seq + remaining window size, discard packet. Send resend request for missing packets.
		3. Else, put packet in the proper place in the ring (don't overwrite if one is already there), but don't increment next_remote_seq_no
		4. If packed was not discarded, process ack info in packet.
	*/
	expected_len	+= pt_pkt->data_len;
	expected_len	+= expected_len % 2;
	if (use_udp)
		expected_len	-= sizeof(ip_packet_t);
	if (total_len < expected_len) {
		pt_log(kLog_error, "Packet not completely received: %d Should be: %d. For some reason, this error is fatal.\n", total_len, expected_len);
		pt_log(kLog_debug, "Data length: %d Total length: %d\n", pt_pkt->data_len, total_len);
		//	TODO: This error isn't fatal, so it should definitely be handled in some way. We could simply discard it.
		exit(0);
	}
	if (pt_pkt->seq_no == *next_expected_seq) {
		//	hmm, what happens if this test is true?
		if (!ring[*insert_idx]) {	//  && pt_pkt->state == kProto_data
		//	pt_log(kLog_debug, "Queing data packet: %d\n", pt_pkt->seq_no);
			ring[*insert_idx]	= create_fwd_desc(pt_pkt->seq_no, pt_pkt->data_len, pt_pkt->data);
			(*await_send)++;
			(*insert_idx)++;
		}
		else if (ring[*insert_idx])
			pt_log(kLog_debug, "Dup packet?\n");
		
		(*next_expected_seq)++;
		if (*insert_idx >= kPing_window_size)
			*insert_idx	= 0;
		//	Check if we have already received some of the next packets
		while (ring[*insert_idx]) {
			if (ring[*insert_idx]->seq_no == *next_expected_seq) {
				(*next_expected_seq)++;
				(*insert_idx)++;
				if (*insert_idx >= kPing_window_size)
					*insert_idx	= 0;
			}
			else
				break;
		}
	}
	else {
		int	r, s, d, pos;
		pos	= -1;		//	If pos ends up staying -1, packet is discarded.
		r	= *next_expected_seq;
		s	= pt_pkt->seq_no;
		d	= s - r;
		if (d < 0) {	//	This packet _may_ be old, or seq_no may have wrapped around
			d	= (s+0xFFFF) - r;
			if (d < kPing_window_size) {
				//	Counter has wrapped, so we should add this packet to the recv ring
				pos	= ((*insert_idx)+d) % kPing_window_size;
			}
		}
		else if (d < kPing_window_size)
			pos	= ((*insert_idx)+d) % kPing_window_size;
		
		if (pos != -1) {
			if (!ring[pos]) {
				pt_log(kLog_verbose, "Out of order. Expected: %d  Got: %d  Inserted: %d (cur = %d)\n", *next_expected_seq, pt_pkt->seq_no, pos, (*insert_idx));
				ring[pos]	= create_fwd_desc(pt_pkt->seq_no, pt_pkt->data_len, pt_pkt->data);
				(*await_send)++;
			}
		}
		//else
		//	pt_log(kLog_debug, "Packet discarded - outside receive window.\n");
	}
}


void		handle_ack(uint16_t seq_no, icmp_desc_t ring[], int *packets_awaiting_ack, int one_ack_only, int insert_idx, int *first_ack, uint16_t *remote_ack, int is_pcap) {
	int		i, j, k;
	ping_tunnel_pkt_t	*pt_pkt;
	
	if (*packets_awaiting_ack > 0) {
		if (one_ack_only) {
			for (i=0;i<kPing_window_size;i++) {
				if (ring[i].pkt && ring[i].seq_no == seq_no && !is_pcap) {
					pt_log(kLog_debug, "Received ack for only seq %d\n", seq_no);
					pt_pkt	= (ping_tunnel_pkt_t*)ring[i].pkt->data;
					*remote_ack	= (uint16_t)ntohl(pt_pkt->ack);	//	WARNING: We make the dangerous assumption here that packets arrive in order!
					free(ring[i].pkt);
					ring[i].pkt	= 0;
					(*packets_awaiting_ack)--;
					if (i == *first_ack) {
						for (j=1;j<kPing_window_size;j++) {
							k	= (i+j)%kPing_window_size;
							if (ring[k].pkt) {
								*first_ack	= k;
								break;
							}
							if (k == i)	//	we have looped through everything
								*first_ack	= insert_idx;
							j++;
						}
					}
					return;
				}
			}
		}
		else {
			int	i, can_ack = 0, count = 0;
			i	= insert_idx-1;
			if (i < 0)
				i	= kPing_window_size - 1;
			
			pt_log(kLog_debug, "Received ack-series starting at seq %d\n", seq_no);
			while (count < kPing_window_size) {
				if (!ring[i].pkt)
					break;
				
				if (ring[i].seq_no == seq_no)
					can_ack	= 1;
				else if (!can_ack)
					*first_ack	= i;
				
				if (can_ack) {
					free(ring[i].pkt);
					ring[i].pkt	= 0;
					(*packets_awaiting_ack)--;
				}
				i--;
				if (i < 0)
					i	= kPing_window_size - 1;
				count++;
			}
		}
	}
//	else
//		pt_log(kLog_verbose, "Dropping superfluous acknowledgement (no outstanding packets needing ack.)\n");
}



forward_desc_t*	create_fwd_desc(uint16_t seq_no, uint32_t data_len, char *data) {
	forward_desc_t	*fwd_desc;
	fwd_desc			= malloc(sizeof(forward_desc_t)+data_len);
	fwd_desc->seq_no	= seq_no;
	fwd_desc->length	= data_len;
	fwd_desc->remaining	= data_len;
	if (data_len > 0)
		memcpy(fwd_desc->data, data, data_len);
	return fwd_desc;
}


uint16_t	calc_icmp_checksum(uint16_t *data, int bytes) {
	uint32_t		sum;
	int				i;
	
	sum	= 0;
	for (i=0;i<bytes/2;i++) {
		//	WARNING; this might be a bug, but might explain why I occasionally
		//	see buggy checksums.. (added htons, that might be the correct behaviour)
		sum	+= data[i];
	}
	sum	= (sum & 0xFFFF) + (sum >> 16);
	sum	= htons(0xFFFF - sum);
	return sum;
}


/*	generate_challenge: Generates a random challenge, incorporating the current
	local timestamp to avoid replay attacks.
*/
challenge_t*	generate_challenge(void) {
	struct timeval	tt;
	challenge_t		*c;
	int				i;
	
	c	= calloc(1, sizeof(challenge_t));
	gettimeofday(&tt, 0);
	c->sec		= tt.tv_sec;
	c->usec_rnd	= tt.tv_usec + rand();
	for (i=0;i<6;i++)
		c->random[i]	= rand();
	
	return c;
}


/*	generate_response: Generates a response to the given challenge. The response
	is generated by combining the concatenating the challenge data with the
	md5 digest of the password, and then calculating the MD5 digest of the
	entire buffer. The result is stored in the passed-in challenge, overwriting
	the challenge data.
*/
void			generate_response(challenge_t *challenge) {
	md5_byte_t	*buf;
	md5_state_t	state;
	
	buf	= malloc(sizeof(challenge_t)+kMD5_digest_size);
	memcpy(buf, challenge, sizeof(challenge_t));
	memcpy(&buf[sizeof(challenge_t)], password_digest, kMD5_digest_size);
	memset(challenge, 0, sizeof(challenge_t));
	md5_init(&state);
	md5_append(&state, buf, sizeof(challenge_t)+kMD5_digest_size);
	md5_finish(&state, (md5_byte_t*)challenge);
}


/*	validate_challenge: Checks whether a given response matches the expected
	response, returning 1 if validation succeeded, and 0 otherwise. Note that
	overwriting the local challenge with the challenge result is not a problem,
	as the data will not be used again anyway (authentication either succeeds,
	or the connection is closed down).
*/
int				validate_challenge(challenge_t *local, challenge_t *remote) {
	generate_response(local);
	if (memcmp(local, remote, sizeof(challenge_t)) == 0)
		return 1;
	return 0;
}


/*	send_termination_msg: Sends two packets to the remote end, informing it that
	the tunnel is being closed down.
*/
void		send_termination_msg(proxy_desc_t *cur, int icmp_sock) {
	//	Send packet twice, hoping at least one of them makes it through..
	queue_packet(icmp_sock, cur->pkt_type, 0, 0, cur->id_no, cur->icmp_id, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, 0, 0, kProto_close | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
	queue_packet(icmp_sock, cur->pkt_type, 0, 0, cur->id_no, cur->icmp_id, &cur->my_seq, cur->send_ring, &cur->send_idx, &cur->send_wait_ack, 0, 0, kProto_close | cur->type_flag, &cur->dest_addr, cur->next_remote_seq, &cur->send_first_ack, &cur->ping_seq);
	cur->xfer.icmp_out	+= 2;
}


void	pt_log(int level, char *fmt, ...) {
	va_list	args;
	const char *header[]	= { "[err]: ",
								"[inf]: ",
								"[evt]: ",
								"[vbs]: ",
								"[dbg]: ",
								"[xfr]: " };
#ifndef WIN32
	int syslog_levels[] = {LOG_ERR, LOG_NOTICE, LOG_NOTICE, LOG_INFO, LOG_DEBUG, LOG_DEBUG};
#endif /* !WIN32 */

	if (level <= log_level) {
		va_start(args, fmt);
#ifndef WIN32
		if (use_syslog) {
			char log[255];
			int header_len;
			header_len = snprintf(log,sizeof(log),"%s",header[level]);
			vsnprintf(log+header_len,sizeof(log)-header_len,fmt,args);
			syslog(syslog_levels[level], "%s", log);
		}
		else
#endif /* !WIN32 */
			fprintf(log_file, "%s", header[level]), vfprintf(log_file, fmt, args);
		va_end(args);
#ifndef WIN32
		if (log_file != stdout && !use_syslog)
#else
		if (log_file != stdout)
#endif
			fflush(log_file);
	}
}


double			time_as_double(void) {
	double			result;
	struct timeval	tt;
	
	gettimeofday(&tt, 0);
	result		= (double)tt.tv_sec + ((double)tt.tv_usec / (double)10e5);
	return result;
}