2 net_packet.c -- Handles in- and outgoing VPN packets
3 Copyright (C) 1998-2005 Ivo Timmermans,
4 2000-2013 Guus Sliepen <guus@tinc-vpn.org>
5 2010 Timothy Redaelli <timothy@redaelli.eu>
6 2010 Brandon Black <blblack@gmail.com>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License along
19 with this program; if not, write to the Free Software Foundation, Inc.,
20 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
35 #include "connection.h"
51 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
54 static void send_udppacket(node_t *, vpn_packet_t *);
56 unsigned replaywin = 16;
57 bool localdiscovery = true;
59 #define MAX_SEQNO 1073741824
61 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
62 mtuprobes == 31: sleep pinginterval seconds
63 mtuprobes == 32: send 1 burst, sleep pingtimeout second
64 mtuprobes == 33: no response from other side, restart PMTU discovery process
66 Probes are sent in batches of at least three, with random sizes between the
67 lower and upper boundaries for the MTU thus far discovered.
69 After the initial discovery, a fourth packet is added to each batch with a
70 size larger than the currently known PMTU, to test if the PMTU has increased.
72 In case local discovery is enabled, another packet is added to each batch,
73 which will be broadcast to the local network.
77 static void send_mtu_probe_handler(void *data) {
83 if(!n->status.reachable || !n->status.validkey) {
84 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
89 if(n->mtuprobes > 32) {
92 timeout = pinginterval;
96 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
97 n->status.udp_confirmed = false;
103 if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
104 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
108 if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
109 if(n->minmtu > n->maxmtu)
110 n->minmtu = n->maxmtu;
112 n->maxmtu = n->minmtu;
114 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
118 if(n->mtuprobes == 31) {
119 timeout = pinginterval;
121 } else if(n->mtuprobes == 32) {
122 timeout = pingtimeout;
125 for(int i = 0; i < 4 + localdiscovery; i++) {
129 if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
132 } else if(n->maxmtu <= n->minmtu) {
135 len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
142 memset(packet.data, 0, 14);
143 randomize(packet.data + 14, len - 14);
146 n->status.send_locally = i >= 4 && n->mtuprobes <= 10 && n->prevedge;
148 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
150 send_udppacket(n, &packet);
153 n->status.send_locally = false;
154 n->probe_counter = 0;
155 gettimeofday(&n->probe_time, NULL);
157 /* Calculate the packet loss of incoming traffic by comparing the rate of
158 packets received to the rate with which the sequence number has increased.
161 if(n->received > n->prev_received)
162 n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno);
164 n->packetloss = n->received_seqno <= n->prev_received_seqno;
166 n->prev_received_seqno = n->received_seqno;
167 n->prev_received = n->received;
170 timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
173 void send_mtu_probe(node_t *n) {
174 timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
175 send_mtu_probe_handler(n);
178 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
179 if(!packet->data[0]) {
180 logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe request %d from %s (%s)", packet->len, n->name, n->hostname);
182 /* It's a probe request, send back a reply */
184 /* Type 2 probe replies were introduced in protocol 17.3 */
185 if ((n->options >> 24) == 3) {
186 uint8_t* data = packet->data;
188 uint16_t len16 = htons(len); memcpy(data, &len16, 2); data += 2;
190 gettimeofday(&now, NULL);
191 uint32_t sec = htonl(now.tv_sec); memcpy(data, &sec, 4); data += 4;
192 uint32_t usec = htonl(now.tv_usec); memcpy(data, &usec, 4); data += 4;
193 packet->len = data - packet->data;
195 /* Legacy protocol: n won't understand type 2 probe replies. */
199 /* Temporarily set udp_confirmed, so that the reply is sent
200 back exactly the way it came in. */
202 bool udp_confirmed = n->status.udp_confirmed;
203 n->status.udp_confirmed = true;
204 send_udppacket(n, packet);
205 n->status.udp_confirmed = udp_confirmed;
207 length_t probelen = len;
208 if (packet->data[0] == 2) {
210 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received invalid (too short) MTU probe reply from %s (%s)", n->name, n->hostname);
212 uint16_t probelen16; memcpy(&probelen16, packet->data + 1, 2); probelen = ntohs(probelen16);
215 logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d MTU probe reply %d from %s (%s)", packet->data[0], probelen, n->name, n->hostname);
217 /* It's a valid reply: now we know bidirectional communication
218 is possible using the address and socket that the reply
221 n->status.udp_confirmed = true;
223 /* If we haven't established the PMTU yet, restart the discovery process. */
225 if(n->mtuprobes > 30) {
226 if (probelen == n->maxmtu + 8) {
227 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
239 /* If applicable, raise the minimum supported MTU */
241 if(probelen > n->maxmtu)
242 probelen = n->maxmtu;
243 if(n->minmtu < probelen)
244 n->minmtu = probelen;
246 /* Calculate RTT and bandwidth.
247 The RTT is the time between the MTU probe burst was sent and the first
248 reply is received. The bandwidth is measured using the time between the
249 arrival of the first and third probe reply (or type 2 probe requests).
252 struct timeval now, diff;
253 gettimeofday(&now, NULL);
254 timersub(&now, &n->probe_time, &diff);
256 struct timeval probe_timestamp = now;
257 if (packet->data[0] == 2 && packet->len >= 11) {
258 uint32_t sec; memcpy(&sec, packet->data + 3, 4);
259 uint32_t usec; memcpy(&usec, packet->data + 7, 4);
260 probe_timestamp.tv_sec = ntohl(sec);
261 probe_timestamp.tv_usec = ntohl(usec);
266 if(n->probe_counter == 1) {
267 n->rtt = diff.tv_sec + diff.tv_usec * 1e-6;
268 n->probe_time = probe_timestamp;
269 } else if(n->probe_counter == 3) {
270 struct timeval probe_timestamp_diff;
271 timersub(&probe_timestamp, &n->probe_time, &probe_timestamp_diff);
272 n->bandwidth = 2.0 * probelen / (probe_timestamp_diff.tv_sec + probe_timestamp_diff.tv_usec * 1e-6);
273 logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, burst bandwidth %.3f Mbit/s, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->bandwidth * 8e-6, n->packetloss * 1e2);
278 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
280 memcpy(dest, source, len);
282 } else if(level == 10) {
284 lzo_uint lzolen = MAXSIZE;
285 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
290 } else if(level < 10) {
292 unsigned long destlen = MAXSIZE;
293 if(compress2(dest, &destlen, source, len, level) == Z_OK)
300 lzo_uint lzolen = MAXSIZE;
301 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
311 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
313 memcpy(dest, source, len);
315 } else if(level > 9) {
317 lzo_uint lzolen = MAXSIZE;
318 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
326 unsigned long destlen = MAXSIZE;
327 if(uncompress(dest, &destlen, source, len) == Z_OK)
339 static void receive_packet(node_t *n, vpn_packet_t *packet) {
340 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
341 packet->len, n->name, n->hostname);
344 n->in_bytes += packet->len;
349 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
351 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
353 if(!digest_active(n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest))
356 return digest_verify(n->indigest, &inpkt->seqno, inpkt->len - digest_length(n->indigest), (const char *)&inpkt->seqno + inpkt->len - digest_length(n->indigest));
359 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
360 vpn_packet_t pkt1, pkt2;
361 vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
363 vpn_packet_t *outpkt = pkt[0];
366 if(n->status.sptps) {
367 if(!n->sptps.state) {
368 if(!n->status.waitingforkey) {
369 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but we haven't exchanged keys yet", n->name, n->hostname);
372 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
376 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
380 if(!n->status.validkey) {
381 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
385 /* Check packet length */
387 if(inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest)) {
388 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
389 n->name, n->hostname);
393 /* Check the message authentication code */
395 if(digest_active(n->indigest)) {
396 inpkt->len -= digest_length(n->indigest);
397 if(!digest_verify(n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
398 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
402 /* Decrypt the packet */
404 if(cipher_active(n->incipher)) {
405 outpkt = pkt[nextpkt++];
408 if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
409 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
413 outpkt->len = outlen;
417 /* Check the sequence number */
419 inpkt->len -= sizeof inpkt->seqno;
420 inpkt->seqno = ntohl(inpkt->seqno);
423 if(inpkt->seqno != n->received_seqno + 1) {
424 if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
425 if(n->farfuture++ < replaywin >> 2) {
426 logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
427 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
430 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
431 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
432 memset(n->late, 0, replaywin);
433 } else if (inpkt->seqno <= n->received_seqno) {
434 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
435 logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
436 n->name, n->hostname, inpkt->seqno, n->received_seqno);
440 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
441 n->late[(i / 8) % replaywin] |= 1 << i % 8;
446 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
449 if(inpkt->seqno > n->received_seqno)
450 n->received_seqno = inpkt->seqno;
454 if(n->received_seqno > MAX_SEQNO)
457 /* Decompress the packet */
459 length_t origlen = inpkt->len;
461 if(n->incompression) {
462 outpkt = pkt[nextpkt++];
464 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
465 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
466 n->name, n->hostname);
472 origlen -= MTU/64 + 20;
477 if(!inpkt->data[12] && !inpkt->data[13])
478 mtu_probe_h(n, inpkt, origlen);
480 receive_packet(n, inpkt);
483 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
486 if(len > sizeof outpkt.data)
490 if(c->options & OPTION_TCPONLY)
493 outpkt.priority = -1;
494 memcpy(outpkt.data, buffer, len);
496 receive_packet(c->node, &outpkt);
499 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
500 if(!n->status.validkey) {
501 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
502 if(!n->status.waitingforkey)
504 else if(n->last_req_key + 10 < now.tv_sec) {
505 logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
506 sptps_stop(&n->sptps);
507 n->status.waitingforkey = false;
516 if(!(origpkt->data[12] | origpkt->data[13])) {
517 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
521 if(routing_mode == RMODE_ROUTER)
526 if(origpkt->len < offset)
531 if(n->outcompression) {
532 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
534 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
535 } else if(len < origpkt->len - offset) {
536 outpkt.len = len + offset;
538 type |= PKT_COMPRESSED;
542 sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
546 static void adapt_socket(const sockaddr_t *sa, int *sock) {
547 /* Make sure we have a suitable socket for the chosen address */
548 if(listen_socket[*sock].sa.sa.sa_family != sa->sa.sa_family) {
549 for(int i = 0; i < listen_sockets; i++) {
550 if(listen_socket[i].sa.sa.sa_family == sa->sa.sa_family) {
558 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
563 /* If the UDP address is confirmed, use it. */
564 if(n->status.udp_confirmed)
567 /* Send every third packet to n->address; that could be set
568 to the node's reflexive UDP address discovered during key
577 /* Otherwise, address are found in edges to this node.
578 So we pick a random edge and a random socket. */
581 int j = rand() % n->edge_tree->count;
582 edge_t *candidate = NULL;
584 for splay_each(edge_t, e, n->edge_tree) {
586 candidate = e->reverse;
592 *sa = &candidate->address;
593 *sock = rand() % listen_sockets;
596 adapt_socket(*sa, sock);
599 static void choose_local_address(const node_t *n, const sockaddr_t **sa, int *sock) {
602 /* Pick one of the edges from this node at random, then use its local address. */
605 int j = rand() % n->edge_tree->count;
606 edge_t *candidate = NULL;
608 for splay_each(edge_t, e, n->edge_tree) {
615 if (candidate && candidate->local_address.sa.sa_family) {
616 *sa = &candidate->local_address;
617 *sock = rand() % listen_sockets;
618 adapt_socket(*sa, sock);
622 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
623 vpn_packet_t pkt1, pkt2;
624 vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
625 vpn_packet_t *inpkt = origpkt;
627 vpn_packet_t *outpkt;
628 int origlen = origpkt->len;
630 #if defined(SOL_IP) && defined(IP_TOS)
631 static int priority = 0;
633 int origpriority = origpkt->priority;
635 if(!n->status.reachable) {
636 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
641 return send_sptps_packet(n, origpkt);
643 /* Make sure we have a valid key */
645 if(!n->status.validkey) {
646 logger(DEBUG_TRAFFIC, LOG_INFO,
647 "No valid key known yet for %s (%s), forwarding via TCP",
648 n->name, n->hostname);
650 if(n->last_req_key + 10 <= now.tv_sec) {
652 n->last_req_key = now.tv_sec;
655 send_tcppacket(n->nexthop->connection, origpkt);
660 if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
661 logger(DEBUG_TRAFFIC, LOG_INFO,
662 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
663 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
666 send_packet(n->nexthop, origpkt);
668 send_tcppacket(n->nexthop->connection, origpkt);
673 /* Compress the packet */
675 if(n->outcompression) {
676 outpkt = pkt[nextpkt++];
678 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
679 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
680 n->name, n->hostname);
687 /* Add sequence number */
689 inpkt->seqno = htonl(++(n->sent_seqno));
690 inpkt->len += sizeof inpkt->seqno;
692 /* Encrypt the packet */
694 if(cipher_active(n->outcipher)) {
695 outpkt = pkt[nextpkt++];
698 if(!cipher_encrypt(n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
699 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
703 outpkt->len = outlen;
707 /* Add the message authentication code */
709 if(digest_active(n->outdigest)) {
710 if(!digest_create(n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len)) {
711 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
715 inpkt->len += digest_length(n->outdigest);
718 /* Send the packet */
720 const sockaddr_t *sa = NULL;
723 if(n->status.send_locally)
724 choose_local_address(n, &sa, &sock);
726 choose_udp_address(n, &sa, &sock);
728 #if defined(SOL_IP) && defined(IP_TOS)
729 if(priorityinheritance && origpriority != priority
730 && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
731 priority = origpriority;
732 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
733 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
734 logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", sockstrerror(sockerrno));
738 if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
739 if(sockmsgsize(sockerrno)) {
740 if(n->maxmtu >= origlen)
741 n->maxmtu = origlen - 1;
742 if(n->mtu >= origlen)
743 n->mtu = origlen - 1;
745 logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
749 origpkt->len = origlen;
752 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
755 /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
757 if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && (len - SPTPS_DATAGRAM_OVERHEAD) > to->minmtu)) {
758 char buf[len * 4 / 3 + 5];
759 b64encode(data, buf, len);
760 /* If no valid key is known yet, send the packets using ANS_KEY requests,
761 to ensure we get to learn the reflexive UDP address. */
762 if(!to->status.validkey) {
763 to->incompression = myself->incompression;
764 return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, to->incompression);
766 return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
770 /* Otherwise, send the packet via UDP */
772 const sockaddr_t *sa;
775 if(to->status.send_locally)
776 choose_local_address(to, &sa, &sock);
778 choose_udp_address(to, &sa, &sock);
780 if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
781 if(sockmsgsize(sockerrno)) {
782 // Compensate for SPTPS overhead
783 len -= SPTPS_DATAGRAM_OVERHEAD;
784 if(to->maxmtu >= len)
785 to->maxmtu = len - 1;
789 logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
797 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
798 node_t *from = handle;
800 if(type == SPTPS_HANDSHAKE) {
801 if(!from->status.validkey) {
802 from->status.validkey = true;
803 from->status.waitingforkey = false;
804 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
810 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
816 if(type == PKT_PROBE) {
818 memcpy(inpkt.data, data, len);
819 mtu_probe_h(from, &inpkt, len);
823 if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
824 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
828 /* Check if we have the headers we need */
829 if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
830 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
832 } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
833 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
836 int offset = (type & PKT_MAC) ? 0 : 14;
837 if(type & PKT_COMPRESSED) {
838 length_t ulen = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
842 inpkt.len = ulen + offset;
844 if(inpkt.len > MAXSIZE)
847 memcpy(inpkt.data + offset, data, len);
848 inpkt.len = len + offset;
851 /* Generate the Ethernet packet type if necessary */
853 switch(inpkt.data[14] >> 4) {
855 inpkt.data[12] = 0x08;
856 inpkt.data[13] = 0x00;
859 inpkt.data[12] = 0x86;
860 inpkt.data[13] = 0xDD;
863 logger(DEBUG_TRAFFIC, LOG_ERR,
864 "Unknown IP version %d while reading packet from %s (%s)",
865 inpkt.data[14] >> 4, from->name, from->hostname);
870 receive_packet(from, &inpkt);
875 send a packet to the given vpn ip.
877 void send_packet(node_t *n, vpn_packet_t *packet) {
882 memcpy(packet->data, mymac.x, ETH_ALEN);
884 n->out_bytes += packet->len;
885 devops.write(packet);
889 logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
890 packet->len, n->name, n->hostname);
892 if(!n->status.reachable) {
893 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
894 n->name, n->hostname);
899 n->out_bytes += packet->len;
901 if(n->status.sptps) {
902 send_sptps_packet(n, packet);
906 via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
909 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
910 n->name, via->name, n->via->hostname);
912 if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
913 if(!send_tcppacket(via->connection, packet))
914 terminate_connection(via->connection, true);
916 send_udppacket(via, packet);
919 /* Broadcast a packet using the minimum spanning tree */
921 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
922 // Always give ourself a copy of the packet.
924 send_packet(myself, packet);
926 // In TunnelServer mode, do not forward broadcast packets.
927 // The MST might not be valid and create loops.
928 if(tunnelserver || broadcast_mode == BMODE_NONE)
931 logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
932 packet->len, from->name, from->hostname);
934 switch(broadcast_mode) {
935 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
936 // This guarantees all nodes receive the broadcast packet, and
937 // usually distributes the sending of broadcast packets over all nodes.
939 for list_each(connection_t, c, connection_list)
940 if(c->status.active && c->status.mst && c != from->nexthop->connection)
941 send_packet(c->node, packet);
944 // In direct mode, we send copies to each node we know of.
945 // However, this only reaches nodes that can be reached in a single hop.
946 // We don't have enough information to forward broadcast packets in this case.
951 for splay_each(node_t, n, node_tree)
952 if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n))
953 send_packet(n, packet);
961 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
964 static time_t last_hard_try = 0;
966 for splay_each(edge_t, e, edge_weight_tree) {
967 if(!e->to->status.reachable || e->to == myself)
970 if(sockaddrcmp_noport(from, &e->address)) {
971 if(last_hard_try == now.tv_sec)
976 if(!try_mac(e->to, pkt))
984 last_hard_try = now.tv_sec;
986 last_hard_try = now.tv_sec;
990 void handle_incoming_vpn_data(void *data, int flags) {
991 listen_socket_t *ls = data;
994 sockaddr_t from = {{0}};
995 socklen_t fromlen = sizeof from;
999 len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
1001 if(len <= 0 || len > MAXSIZE) {
1002 if(!sockwouldblock(sockerrno))
1003 logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
1009 sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
1011 n = lookup_node_udp(&from);
1014 n = try_harder(&from, &pkt);
1016 update_node_udp(n, &from);
1017 else if(debug_level >= DEBUG_PROTOCOL) {
1018 hostname = sockaddr2hostname(&from);
1019 logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
1027 n->sock = ls - listen_socket;
1029 receive_udppacket(n, &pkt);
1032 void handle_device_data(void *data, int flags) {
1033 vpn_packet_t packet;
1035 packet.priority = 0;
1037 if(devops.read(&packet)) {
1038 myself->in_packets++;
1039 myself->in_bytes += packet.len;
1040 route(myself, &packet);