2 net_packet.c -- Handles in- and outgoing VPN packets
3 Copyright (C) 1998-2005 Ivo Timmermans,
4 2000-2014 Guus Sliepen <guus@tinc-vpn.org>
5 2010 Timothy Redaelli <timothy@redaelli.eu>
6 2010 Brandon Black <blblack@gmail.com>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License along
19 with this program; if not, write to the Free Software Foundation, Inc.,
20 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
35 #include "connection.h"
52 #define MAX(a, b) ((a) > (b) ? (a) : (b))
55 /* The minimum size of a probe is 14 bytes, but since we normally use CBC mode
56 encryption, we can add a few extra random bytes without increasing the
57 resulting packet size. */
58 #define MIN_PROBE_SIZE 18
62 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
65 static void send_udppacket(node_t *, vpn_packet_t *);
67 unsigned replaywin = 16;
68 bool localdiscovery = true;
69 bool udp_discovery = true;
70 int udp_discovery_keepalive_interval = 9;
71 int udp_discovery_interval = 2;
72 int udp_discovery_timeout = 30;
74 #define MAX_SEQNO 1073741824
76 static void try_fix_mtu(node_t *n) {
80 if(n->mtuprobes == 20 || n->minmtu >= n->maxmtu) {
81 if(n->minmtu > n->maxmtu)
82 n->minmtu = n->maxmtu;
84 n->maxmtu = n->minmtu;
86 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
91 static void udp_probe_timeout_handler(void *data) {
93 if(!n->status.udp_confirmed)
96 logger(DEBUG_TRAFFIC, LOG_INFO, "Too much time has elapsed since last UDP ping response from %s (%s), stopping UDP communication", n->name, n->hostname);
97 n->status.udp_confirmed = false;
104 static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
105 if(!DATA(packet)[0]) {
106 /* It's a probe request, send back a reply */
108 if(!n->status.sptps && !n->status.validkey) {
109 // But not if we don't have his key.
110 logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request from %s (%s) but we don't have his key yet", n->name, n->hostname);
114 logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request %d from %s (%s)", packet->len, n->name, n->hostname);
116 /* Type 2 probe replies were introduced in protocol 17.3 */
117 if ((n->options >> 24) >= 3) {
118 uint8_t *data = DATA(packet);
120 uint16_t len16 = htons(len); memcpy(data, &len16, 2); data += 2;
121 packet->len = MIN_PROBE_SIZE;
123 /* Legacy protocol: n won't understand type 2 probe replies. */
127 /* Temporarily set udp_confirmed, so that the reply is sent
128 back exactly the way it came in. */
130 bool udp_confirmed = n->status.udp_confirmed;
131 n->status.udp_confirmed = true;
132 send_udppacket(n, packet);
133 n->status.udp_confirmed = udp_confirmed;
135 length_t probelen = len;
136 if (DATA(packet)[0] == 2) {
138 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received invalid (too short) UDP probe reply from %s (%s)", n->name, n->hostname);
140 uint16_t probelen16; memcpy(&probelen16, DATA(packet) + 1, 2); probelen = ntohs(probelen16);
143 logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], probelen, n->name, n->hostname);
145 /* It's a valid reply: now we know bidirectional communication
146 is possible using the address and socket that the reply
148 n->status.udp_confirmed = true;
151 timeout_del(&n->udp_ping_timeout);
152 timeout_add(&n->udp_ping_timeout, &udp_probe_timeout_handler, n, &(struct timeval){udp_discovery_timeout, 0});
155 if(probelen > n->maxmtu) {
156 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
157 n->minmtu = probelen;
159 /* Set mtuprobes to 1 so that try_mtu() doesn't reset maxmtu */
162 } else if(n->mtuprobes < 0 && probelen == n->maxmtu) {
163 /* We got a maxmtu sized packet, confirming the PMTU is still valid. */
167 /* If applicable, raise the minimum supported MTU */
169 if(n->minmtu < probelen) {
170 n->minmtu = probelen;
176 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
178 memcpy(dest, source, len);
180 } else if(level == 10) {
182 lzo_uint lzolen = MAXSIZE;
183 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
188 } else if(level < 10) {
190 unsigned long destlen = MAXSIZE;
191 if(compress2(dest, &destlen, source, len, level) == Z_OK)
198 lzo_uint lzolen = MAXSIZE;
199 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
209 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
211 memcpy(dest, source, len);
213 } else if(level > 9) {
215 lzo_uint lzolen = MAXSIZE;
216 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
224 unsigned long destlen = MAXSIZE;
225 if(uncompress(dest, &destlen, source, len) == Z_OK)
237 static void receive_packet(node_t *n, vpn_packet_t *packet) {
238 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
239 packet->len, n->name, n->hostname);
242 n->in_bytes += packet->len;
247 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
249 return sptps_verify_datagram(&n->sptps, DATA(inpkt), inpkt->len);
251 #ifdef DISABLE_LEGACY
254 if(!digest_active(n->indigest) || inpkt->len < sizeof(seqno_t) + digest_length(n->indigest))
257 return digest_verify(n->indigest, SEQNO(inpkt), inpkt->len - digest_length(n->indigest), DATA(inpkt) + inpkt->len - digest_length(n->indigest));
261 static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
262 vpn_packet_t pkt1, pkt2;
263 vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
266 pkt1.offset = DEFAULT_PACKET_OFFSET;
267 pkt2.offset = DEFAULT_PACKET_OFFSET;
269 if(n->status.sptps) {
270 if(!n->sptps.state) {
271 if(!n->status.waitingforkey) {
272 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but we haven't exchanged keys yet", n->name, n->hostname);
275 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
279 inpkt->offset += 2 * sizeof(node_id_t);
280 if(!sptps_receive_data(&n->sptps, DATA(inpkt), inpkt->len - 2 * sizeof(node_id_t))) {
281 logger(DEBUG_TRAFFIC, LOG_ERR, "Got bad packet from %s (%s)", n->name, n->hostname);
287 #ifdef DISABLE_LEGACY
290 if(!n->status.validkey_in) {
291 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
295 /* Check packet length */
297 if(inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) {
298 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
299 n->name, n->hostname);
303 /* It's a legacy UDP packet, the data starts after the seqno */
305 inpkt->offset += sizeof(seqno_t);
307 /* Check the message authentication code */
309 if(digest_active(n->indigest)) {
310 inpkt->len -= digest_length(n->indigest);
311 if(!digest_verify(n->indigest, SEQNO(inpkt), inpkt->len, SEQNO(inpkt) + inpkt->len)) {
312 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
316 /* Decrypt the packet */
318 if(cipher_active(n->incipher)) {
319 vpn_packet_t *outpkt = pkt[nextpkt++];
322 if(!cipher_decrypt(n->incipher, SEQNO(inpkt), inpkt->len, SEQNO(outpkt), &outlen, true)) {
323 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
327 outpkt->len = outlen;
331 /* Check the sequence number */
334 memcpy(&seqno, SEQNO(inpkt), sizeof seqno);
335 seqno = ntohl(seqno);
336 inpkt->len -= sizeof seqno;
339 if(seqno != n->received_seqno + 1) {
340 if(seqno >= n->received_seqno + replaywin * 8) {
341 if(n->farfuture++ < replaywin >> 2) {
342 logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
343 n->name, n->hostname, seqno - n->received_seqno - 1, n->farfuture);
346 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
347 seqno - n->received_seqno - 1, n->name, n->hostname);
348 memset(n->late, 0, replaywin);
349 } else if (seqno <= n->received_seqno) {
350 if((n->received_seqno >= replaywin * 8 && seqno <= n->received_seqno - replaywin * 8) || !(n->late[(seqno / 8) % replaywin] & (1 << seqno % 8))) {
351 logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
352 n->name, n->hostname, seqno, n->received_seqno);
356 for(int i = n->received_seqno + 1; i < seqno; i++)
357 n->late[(i / 8) % replaywin] |= 1 << i % 8;
362 n->late[(seqno / 8) % replaywin] &= ~(1 << seqno % 8);
365 if(seqno > n->received_seqno)
366 n->received_seqno = seqno;
370 if(n->received_seqno > MAX_SEQNO)
373 /* Decompress the packet */
375 length_t origlen = inpkt->len;
377 if(n->incompression) {
378 vpn_packet_t *outpkt = pkt[nextpkt++];
380 if((outpkt->len = uncompress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->incompression)) < 0) {
381 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
382 n->name, n->hostname);
388 origlen -= MTU/64 + 20;
391 if(inpkt->len > n->maxrecentlen)
392 n->maxrecentlen = inpkt->len;
396 if(!DATA(inpkt)[12] && !DATA(inpkt)[13])
397 udp_probe_h(n, inpkt, origlen);
399 receive_packet(n, inpkt);
404 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
406 outpkt.offset = DEFAULT_PACKET_OFFSET;
408 if(len > sizeof outpkt.data - outpkt.offset)
412 if(c->options & OPTION_TCPONLY)
415 outpkt.priority = -1;
416 memcpy(DATA(&outpkt), buffer, len);
418 receive_packet(c->node, &outpkt);
421 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
422 if(!n->status.validkey && !n->connection)
428 if(!(DATA(origpkt)[12] | DATA(origpkt)[13])) {
429 sptps_send_record(&n->sptps, PKT_PROBE, (char *)DATA(origpkt), origpkt->len);
433 if(routing_mode == RMODE_ROUTER)
438 if(origpkt->len < offset)
443 if(n->outcompression) {
445 int len = compress_packet(DATA(&outpkt) + offset, DATA(origpkt) + offset, origpkt->len - offset, n->outcompression);
447 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
448 } else if(len < origpkt->len - offset) {
449 outpkt.len = len + offset;
451 type |= PKT_COMPRESSED;
455 /* If we have a direct metaconnection to n, and we can't use UDP, then
456 don't bother with SPTPS and just use a "plaintext" PACKET message.
457 We don't really care about end-to-end security since we're not
458 sending the message through any intermediate nodes. */
459 if(n->connection && origpkt->len > n->minmtu)
460 send_tcppacket(n->connection, origpkt);
462 sptps_send_record(&n->sptps, type, DATA(origpkt) + offset, origpkt->len - offset);
466 static void adapt_socket(const sockaddr_t *sa, int *sock) {
467 /* Make sure we have a suitable socket for the chosen address */
468 if(listen_socket[*sock].sa.sa.sa_family != sa->sa.sa_family) {
469 for(int i = 0; i < listen_sockets; i++) {
470 if(listen_socket[i].sa.sa.sa_family == sa->sa.sa_family) {
478 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
483 /* If the UDP address is confirmed, use it. */
484 if(n->status.udp_confirmed)
487 /* Send every third packet to n->address; that could be set
488 to the node's reflexive UDP address discovered during key
497 /* Otherwise, address are found in edges to this node.
498 So we pick a random edge and a random socket. */
501 int j = rand() % n->edge_tree->count;
502 edge_t *candidate = NULL;
504 for splay_each(edge_t, e, n->edge_tree) {
506 candidate = e->reverse;
512 *sa = &candidate->address;
513 *sock = rand() % listen_sockets;
516 adapt_socket(*sa, sock);
519 static void choose_local_address(const node_t *n, const sockaddr_t **sa, int *sock) {
522 /* Pick one of the edges from this node at random, then use its local address. */
525 int j = rand() % n->edge_tree->count;
526 edge_t *candidate = NULL;
528 for splay_each(edge_t, e, n->edge_tree) {
535 if (candidate && candidate->local_address.sa.sa_family) {
536 *sa = &candidate->local_address;
537 *sock = rand() % listen_sockets;
538 adapt_socket(*sa, sock);
542 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
543 vpn_packet_t pkt1, pkt2;
544 vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
545 vpn_packet_t *inpkt = origpkt;
547 vpn_packet_t *outpkt;
548 int origlen = origpkt->len;
550 #if defined(SOL_IP) && defined(IP_TOS)
551 static int priority = 0;
552 int origpriority = origpkt->priority;
555 pkt1.offset = DEFAULT_PACKET_OFFSET;
556 pkt2.offset = DEFAULT_PACKET_OFFSET;
558 if(!n->status.reachable) {
559 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
564 return send_sptps_packet(n, origpkt);
566 #ifdef DISABLE_LEGACY
569 /* Make sure we have a valid key */
571 if(!n->status.validkey) {
572 logger(DEBUG_TRAFFIC, LOG_INFO,
573 "No valid key known yet for %s (%s), forwarding via TCP",
574 n->name, n->hostname);
575 send_tcppacket(n->nexthop->connection, origpkt);
579 if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (DATA(inpkt)[12] | DATA(inpkt)[13])) {
580 logger(DEBUG_TRAFFIC, LOG_INFO,
581 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
582 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
585 send_packet(n->nexthop, origpkt);
587 send_tcppacket(n->nexthop->connection, origpkt);
592 /* Compress the packet */
594 if(n->outcompression) {
595 outpkt = pkt[nextpkt++];
597 if((outpkt->len = compress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->outcompression)) < 0) {
598 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
599 n->name, n->hostname);
606 /* Add sequence number */
608 seqno_t seqno = htonl(++(n->sent_seqno));
609 memcpy(SEQNO(inpkt), &seqno, sizeof seqno);
610 inpkt->len += sizeof seqno;
612 /* Encrypt the packet */
614 if(cipher_active(n->outcipher)) {
615 outpkt = pkt[nextpkt++];
618 if(!cipher_encrypt(n->outcipher, SEQNO(inpkt), inpkt->len, SEQNO(outpkt), &outlen, true)) {
619 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
623 outpkt->len = outlen;
627 /* Add the message authentication code */
629 if(digest_active(n->outdigest)) {
630 if(!digest_create(n->outdigest, SEQNO(inpkt), inpkt->len, SEQNO(inpkt) + inpkt->len)) {
631 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
635 inpkt->len += digest_length(n->outdigest);
638 /* Send the packet */
640 const sockaddr_t *sa = NULL;
643 if(n->status.send_locally)
644 choose_local_address(n, &sa, &sock);
646 choose_udp_address(n, &sa, &sock);
648 #if defined(SOL_IP) && defined(IP_TOS)
649 if(priorityinheritance && origpriority != priority
650 && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
651 priority = origpriority;
652 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
653 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
654 logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", sockstrerror(sockerrno));
658 if(sendto(listen_socket[sock].udp.fd, SEQNO(inpkt), inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
659 if(sockmsgsize(sockerrno)) {
660 if(n->maxmtu >= origlen)
661 n->maxmtu = origlen - 1;
662 if(n->mtu >= origlen)
663 n->mtu = origlen - 1;
666 logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
670 origpkt->len = origlen;
674 static bool send_sptps_data_priv(node_t *to, node_t *from, int type, const void *data, size_t len) {
675 node_t *relay = (to->via != myself && (type == PKT_PROBE || (len - SPTPS_DATAGRAM_OVERHEAD) <= to->via->minmtu)) ? to->via : to->nexthop;
676 bool direct = from == myself && to == relay;
677 bool relay_supported = (relay->options >> 24) >= 4;
678 bool tcponly = (myself->options | relay->options) & OPTION_TCPONLY;
680 /* Send it via TCP if it is a handshake packet, TCPOnly is in use, this is a relay packet that the other node cannot understand, or this packet is larger than the MTU.
681 TODO: When relaying, the original sender does not know the end-to-end PMTU (it only knows the PMTU of the first hop).
682 This can lead to scenarios where large packets are sent over UDP to relay, but then relay has no choice but fall back to TCP. */
684 if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && (len - SPTPS_DATAGRAM_OVERHEAD) > relay->minmtu)) {
685 char buf[len * 4 / 3 + 5];
686 b64encode(data, buf, len);
687 /* If no valid key is known yet, send the packets using ANS_KEY requests,
688 to ensure we get to learn the reflexive UDP address. */
689 if(from == myself && !to->status.validkey) {
690 to->incompression = myself->incompression;
691 return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, from->name, to->name, buf, to->incompression);
693 return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, from->name, to->name, REQ_SPTPS, buf);
698 if(relay_supported) overhead += sizeof to->id + sizeof from->id;
699 char buf[len + overhead]; char* buf_ptr = buf;
700 if(relay_supported) {
702 /* Inform the recipient that this packet was sent directly. */
703 node_id_t nullid = {};
704 memcpy(buf_ptr, &nullid, sizeof nullid); buf_ptr += sizeof nullid;
706 memcpy(buf_ptr, &to->id, sizeof to->id); buf_ptr += sizeof to->id;
708 memcpy(buf_ptr, &from->id, sizeof from->id); buf_ptr += sizeof from->id;
711 /* TODO: if this copy turns out to be a performance concern, change sptps_send_record() to add some "pre-padding" to the buffer and use that instead */
712 memcpy(buf_ptr, data, len); buf_ptr += len;
714 const sockaddr_t *sa = NULL;
716 if(relay->status.send_locally)
717 choose_local_address(relay, &sa, &sock);
719 choose_udp_address(relay, &sa, &sock);
720 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s)", from->name, from->hostname, to->name, to->hostname, relay->name, relay->hostname);
721 if(sendto(listen_socket[sock].udp.fd, buf, buf_ptr - buf, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
722 if(sockmsgsize(sockerrno)) {
723 // Compensate for SPTPS overhead
724 len -= SPTPS_DATAGRAM_OVERHEAD;
725 if(relay->maxmtu >= len)
726 relay->maxmtu = len - 1;
727 if(relay->mtu >= len)
728 relay->mtu = len - 1;
731 logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", relay->name, relay->hostname, sockstrerror(sockerrno));
739 bool send_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
740 return send_sptps_data_priv(handle, myself, type, data, len);
743 bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t len) {
744 node_t *from = handle;
746 if(type == SPTPS_HANDSHAKE) {
747 if(!from->status.validkey) {
748 from->status.validkey = true;
749 from->status.waitingforkey = false;
750 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
756 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
761 inpkt.offset = DEFAULT_PACKET_OFFSET;
763 if(type == PKT_PROBE) {
765 memcpy(DATA(&inpkt), data, len);
766 udp_probe_h(from, &inpkt, len);
770 if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
771 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
775 /* Check if we have the headers we need */
776 if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
777 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
779 } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
780 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
783 int offset = (type & PKT_MAC) ? 0 : 14;
784 if(type & PKT_COMPRESSED) {
785 length_t ulen = uncompress_packet(DATA(&inpkt) + offset, (const uint8_t *)data, len, from->incompression);
789 inpkt.len = ulen + offset;
791 if(inpkt.len > MAXSIZE)
794 memcpy(DATA(&inpkt) + offset, data, len);
795 inpkt.len = len + offset;
798 /* Generate the Ethernet packet type if necessary */
800 switch(DATA(&inpkt)[14] >> 4) {
802 DATA(&inpkt)[12] = 0x08;
803 DATA(&inpkt)[13] = 0x00;
806 DATA(&inpkt)[12] = 0x86;
807 DATA(&inpkt)[13] = 0xDD;
810 logger(DEBUG_TRAFFIC, LOG_ERR,
811 "Unknown IP version %d while reading packet from %s (%s)",
812 DATA(&inpkt)[14] >> 4, from->name, from->hostname);
817 receive_packet(from, &inpkt);
821 // This function tries to get SPTPS keys, if they aren't already known.
822 // This function makes no guarantees - it is up to the caller to check the node's state to figure out if the keys are available.
823 static void try_sptps(node_t *n) {
824 if(n->status.validkey)
827 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
829 if(!n->status.waitingforkey)
831 else if(n->last_req_key + 10 < now.tv_sec) {
832 logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
833 sptps_stop(&n->sptps);
834 n->status.waitingforkey = false;
841 static void send_udp_probe_packet(node_t *n, int len) {
843 packet.offset = DEFAULT_PACKET_OFFSET;
844 memset(DATA(&packet), 0, 14);
845 randomize(DATA(&packet) + 14, len - 14);
849 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending UDP probe length %d to %s (%s)", len, n->name, n->hostname);
851 send_udppacket(n, &packet);
854 // This function tries to establish a UDP tunnel to a node so that packets can be sent.
855 // If a tunnel is already established, it makes sure it stays up.
856 // This function makes no guarantees - it is up to the caller to check the node's state to figure out if UDP is usable.
857 static void try_udp(node_t* n) {
861 struct timeval ping_tx_elapsed;
862 timersub(&now, &n->udp_ping_sent, &ping_tx_elapsed);
864 int interval = n->status.udp_confirmed ? udp_discovery_keepalive_interval : udp_discovery_interval;
866 if(ping_tx_elapsed.tv_sec >= interval) {
867 send_udp_probe_packet(n, MIN_PROBE_SIZE);
868 n->udp_ping_sent = now;
870 if(localdiscovery && !n->status.udp_confirmed && n->prevedge) {
871 n->status.send_locally = true;
872 send_udp_probe_packet(n, MIN_PROBE_SIZE);
873 n->status.send_locally = false;
878 static length_t choose_initial_maxmtu(node_t *n) {
883 const sockaddr_t *sa = NULL;
885 choose_udp_address(n, &sa, &sockindex);
889 sock = socket(sa->sa.sa_family, SOCK_DGRAM, IPPROTO_UDP);
891 logger(DEBUG_TRAFFIC, LOG_ERR, "Creating MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
895 if(connect(sock, &sa->sa, SALEN(sa->sa))) {
896 logger(DEBUG_TRAFFIC, LOG_ERR, "Connecting MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
902 socklen_t ip_mtu_len = sizeof ip_mtu;
903 if(getsockopt(sock, IPPROTO_IP, IP_MTU, &ip_mtu, &ip_mtu_len)) {
904 logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
911 /* getsockopt(IP_MTU) returns the MTU of the physical interface.
912 We need to remove various overheads to get to the tinc MTU. */
913 length_t mtu = ip_mtu;
914 mtu -= (sa->sa.sa_family == AF_INET6) ? sizeof(struct ip6_hdr) : sizeof(struct ip);
916 if(n->status.sptps) {
917 mtu -= SPTPS_DATAGRAM_OVERHEAD;
918 if((n->options >> 24) >= 4)
919 mtu -= sizeof(node_id_t) + sizeof(node_id_t);
921 mtu -= digest_length(n->outdigest);
923 /* Now it's tricky. We use CBC mode, so the length of the
924 encrypted payload must be a multiple of the blocksize. The
925 sequence number is also part of the encrypted payload, so we
926 must account for it after correcting for the blocksize.
927 Furthermore, the padding in the last block must be at least
930 length_t blocksize = cipher_blocksize(n->outcipher);
942 logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) returned absurdly small value: %d", n->name, n->hostname, ip_mtu);
948 logger(DEBUG_TRAFFIC, LOG_INFO, "Using system-provided maximum tinc MTU for %s (%s): %hd", n->name, n->hostname, mtu);
958 /* This function tries to determines the MTU of a node.
959 By calling this function repeatedly, n->minmtu will be progressively
960 increased, and at some point, n->mtu will be fixed to n->minmtu. If the MTU
961 is already fixed, this function checks if it can be increased.
964 static void try_mtu(node_t *n) {
965 if(!(n->options & OPTION_PMTU_DISCOVERY))
968 if(udp_discovery && !n->status.udp_confirmed) {
976 /* mtuprobes == 0..19: initial discovery, send bursts with 1 second interval, mtuprobes++
977 mtuprobes == 20: fix MTU, and go to -1
978 mtuprobes == -1: send one maxmtu and one maxmtu+1 probe every pinginterval
979 mtuprobes ==-2..-3: send one maxmtu probe every second
980 mtuprobes == -4: maxmtu no longer valid, reset minmtu and maxmtu and go to 0 */
982 struct timeval elapsed;
983 timersub(&now, &n->mtu_ping_sent, &elapsed);
984 if(n->mtuprobes >= 0) {
985 if(n->mtuprobes != 0 && elapsed.tv_sec == 0 && elapsed.tv_usec < 333333)
988 if(n->mtuprobes < -1) {
989 if(elapsed.tv_sec < 1)
992 if(elapsed.tv_sec < pinginterval)
997 n->mtu_ping_sent = now;
1001 if(n->mtuprobes < -3) {
1002 /* We lost three MTU probes, restart discovery */
1003 logger(DEBUG_TRAFFIC, LOG_INFO, "Decrease in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
1008 if(n->mtuprobes < 0) {
1009 /* After the initial discovery, we only send one maxmtu and one
1010 maxmtu+1 probe to detect PMTU increases. */
1011 send_udp_probe_packet(n, n->maxmtu);
1012 if(n->mtuprobes == -1 && n->maxmtu + 1 < MTU)
1013 send_udp_probe_packet(n, n->maxmtu + 1);
1016 /* Before initial discovery begins, set maxmtu to the most likely value.
1017 If it's underestimated, we will correct it after initial discovery. */
1018 if(n->mtuprobes == 0)
1019 n->maxmtu = choose_initial_maxmtu(n);
1022 /* Decreasing the number of probes per cycle might make the algorithm react faster to lost packets,
1023 but it will typically increase convergence time in the no-loss case. */
1024 const length_t probes_per_cycle = 8;
1026 /* This magic value was determined using math simulations.
1027 It will result in a 1329-byte first probe, followed (if there was a reply) by a 1407-byte probe.
1028 Since 1407 is just below the range of tinc MTUs over typical networks,
1029 this fine-tuning allows tinc to cover a lot of ground very quickly.
1030 This fine-tuning is only valid for maxmtu = MTU; if maxmtu is smaller,
1031 then it's better to use a multiplier of 1. Indeed, this leads to an interesting scenario
1032 if choose_initial_maxmtu() returns the actual MTU value - it will get confirmed with one single probe. */
1033 const float multiplier = (n->maxmtu == MTU) ? 0.97 : 1;
1035 const float cycle_position = probes_per_cycle - (n->mtuprobes % probes_per_cycle) - 1;
1036 const length_t minmtu = MAX(n->minmtu, 512);
1037 const float interval = n->maxmtu - minmtu;
1039 /* The core of the discovery algorithm is this exponential.
1040 It produces very large probes early in the cycle, and then it very quickly decreases the probe size.
1041 This reflects the fact that in the most difficult cases, we don't get any feedback for probes that
1042 are too large, and therefore we need to concentrate on small offsets so that we can quickly converge
1043 on the precise MTU as we are approaching it.
1044 The last probe of the cycle is always 1 byte in size - this is to make sure we'll get at least one
1045 reply per cycle so that we can make progress. */
1046 const length_t offset = powf(interval, multiplier * cycle_position / (probes_per_cycle - 1));
1048 length_t maxmtu = n->maxmtu;
1049 send_udp_probe_packet(n, minmtu + offset);
1050 /* If maxmtu changed, it means the probe was rejected by the system because it was too large.
1051 In that case, we recalculate with the new maxmtu and try again. */
1052 if(n->mtuprobes < 0 || maxmtu == n->maxmtu)
1056 if(n->mtuprobes >= 0)
1061 /* These functions try to establish a tunnel to a node (or its relay) so that
1062 packets can be sent (e.g. exchange keys).
1063 If a tunnel is already established, it tries to improve it (e.g. by trying
1064 to establish a UDP tunnel instead of TCP). This function makes no
1065 guarantees - it is up to the caller to check the node's state to figure out
1066 if TCP and/or UDP is usable. By calling this function repeatedly, the
1067 tunnel is gradually improved until we hit the wall imposed by the underlying
1068 network environment. It is recommended to call this function every time a
1069 packet is sent (or intended to be sent) to a node, so that the tunnel keeps
1070 improving as packets flow, and then gracefully downgrades itself as it goes
1074 static void try_tx_sptps(node_t *n, bool mtu) {
1075 /* If n is a TCP-only neighbor, we'll only use "cleartext" PACKET
1076 messages anyway, so there's no need for SPTPS at all. */
1078 if(n->connection && ((myself->options | n->options) & OPTION_TCPONLY))
1081 /* Otherwise, try to do SPTPS authentication with n if necessary. */
1085 /* Do we need to relay packets? */
1087 node_t *via = (n->via == myself) ? n->nexthop : n->via;
1089 /* If the relay doesn't support SPTPS, everything goes via TCP anyway. */
1091 if((via->options >> 24) < 4)
1094 /* If we do have a relay, try everything with that one instead. */
1097 return try_tx_sptps(via, mtu);
1104 static void try_tx_legacy(node_t *n, bool mtu) {
1105 /* Does he have our key? If not, send one. */
1107 if(!n->status.validkey_in)
1110 /* Check if we already have a key, or request one. */
1112 if(!n->status.validkey) {
1113 if(n->last_req_key + 10 <= now.tv_sec) {
1115 n->last_req_key = now.tv_sec;
1125 void try_tx(node_t *n, bool mtu) {
1127 try_tx_sptps(n, mtu);
1129 try_tx_legacy(n, mtu);
1132 void send_packet(node_t *n, vpn_packet_t *packet) {
1133 // If it's for myself, write it to the tun/tap device.
1137 memcpy(DATA(packet), mymac.x, ETH_ALEN);
1139 n->out_bytes += packet->len;
1140 devops.write(packet);
1144 logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)", packet->len, n->name, n->hostname);
1146 // If the node is not reachable, drop it.
1148 if(!n->status.reachable) {
1149 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable", n->name, n->hostname);
1153 // Keep track of packet statistics.
1156 n->out_bytes += packet->len;
1158 // Check if it should be sent as an SPTPS packet.
1160 if(n->status.sptps) {
1161 send_sptps_packet(n, packet);
1162 try_tx_sptps(n, true);
1166 // Determine which node to actually send it to.
1168 node_t *via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
1171 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)", n->name, via->name, n->via->hostname);
1173 // Try to send via UDP, unless TCP is forced.
1175 if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
1176 if(!send_tcppacket(via->connection, packet))
1177 terminate_connection(via->connection, true);
1181 send_udppacket(via, packet);
1182 try_tx_legacy(via, true);
1185 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
1186 // Always give ourself a copy of the packet.
1188 send_packet(myself, packet);
1190 // In TunnelServer mode, do not forward broadcast packets.
1191 // The MST might not be valid and create loops.
1192 if(tunnelserver || broadcast_mode == BMODE_NONE)
1195 logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
1196 packet->len, from->name, from->hostname);
1198 switch(broadcast_mode) {
1199 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
1200 // This guarantees all nodes receive the broadcast packet, and
1201 // usually distributes the sending of broadcast packets over all nodes.
1203 for list_each(connection_t, c, connection_list)
1204 if(c->edge && c->status.mst && c != from->nexthop->connection)
1205 send_packet(c->node, packet);
1208 // In direct mode, we send copies to each node we know of.
1209 // However, this only reaches nodes that can be reached in a single hop.
1210 // We don't have enough information to forward broadcast packets in this case.
1215 for splay_each(node_t, n, node_tree)
1216 if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n))
1217 send_packet(n, packet);
1225 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
1228 static time_t last_hard_try = 0;
1230 for splay_each(edge_t, e, edge_weight_tree) {
1231 if(!e->to->status.reachable || e->to == myself)
1234 if(sockaddrcmp_noport(from, &e->address)) {
1235 if(last_hard_try == now.tv_sec)
1240 if(!try_mac(e->to, pkt))
1248 last_hard_try = now.tv_sec;
1250 last_hard_try = now.tv_sec;
1254 void handle_incoming_vpn_data(void *data, int flags) {
1255 listen_socket_t *ls = data;
1258 node_id_t nullid = {};
1259 sockaddr_t addr = {};
1260 socklen_t addrlen = sizeof addr;
1262 bool direct = false;
1265 int len = recvfrom(ls->udp.fd, DATA(&pkt), MAXSIZE, 0, &addr.sa, &addrlen);
1267 if(len <= 0 || len > MAXSIZE) {
1268 if(!sockwouldblock(sockerrno))
1269 logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
1275 sockaddrunmap(&addr); /* Some braindead IPv6 implementations do stupid things. */
1277 // Try to figure out who sent this packet.
1279 node_t *n = lookup_node_udp(&addr);
1282 // It might be from a 1.1 node, which might have a source ID in the packet.
1283 pkt.offset = 2 * sizeof(node_id_t);
1284 from = lookup_node_id(SRCID(&pkt));
1285 if(from && !memcmp(DSTID(&pkt), &nullid, sizeof nullid) && from->status.sptps) {
1286 if(sptps_verify_datagram(&from->sptps, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t)))
1295 n = try_harder(&addr, &pkt);
1300 if(debug_level >= DEBUG_PROTOCOL) {
1301 hostname = sockaddr2hostname(&addr);
1302 logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
1308 if(n->status.sptps) {
1309 pkt.offset = 2 * sizeof(node_id_t);
1311 if(!memcmp(DSTID(&pkt), &nullid, sizeof nullid)) {
1316 from = lookup_node_id(SRCID(&pkt));
1317 to = lookup_node_id(DSTID(&pkt));
1320 logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from %s (%s) with unknown source and/or destination ID", n->name, n->hostname);
1325 send_sptps_data_priv(to, n, 0, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t));
1334 if(!receive_udppacket(from, &pkt))
1337 n->sock = ls - listen_socket;
1338 if(direct && sockaddrcmp(&addr, &n->address))
1339 update_node_udp(n, &addr);
1342 void handle_device_data(void *data, int flags) {
1343 vpn_packet_t packet;
1344 packet.offset = DEFAULT_PACKET_OFFSET;
1345 packet.priority = 0;
1347 if(devops.read(&packet)) {
1348 myself->in_packets++;
1349 myself->in_bytes += packet.len;
1350 route(myself, &packet);