tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "avl_tree.h"
  40 #include "conf.h"
  41 #include "connection.h"
  42 #include "device.h"
  43 #include "ethernet.h"
  44 #include "event.h"
  45 #include "graph.h"
  46 #include "logger.h"
  47 #include "net.h"
  48 #include "netutl.h"
  49 #include "protocol.h"
  50 #include "process.h"
  51 #include "route.h"
  52 #include "utils.h"
  53 #include "xalloc.h"
  54
  55 int keylifetime = 0;
  56 int keyexpires = 0;
  57 #ifdef HAVE_LZO
  58 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  59 #endif
  60
  61 static void send_udppacket(node_t *, vpn_packet_t *);
  62
  63 unsigned replaywin = 16;
  64 bool localdiscovery = false;
  65
  66 #define MAX_SEQNO 1073741824
  67
  68 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  69    mtuprobes ==    31: sleep pinginterval seconds
  70    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  71    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  72
  73    Probes are sent in batches of three, with random sizes between the lower and
  74    upper boundaries for the MTU thus far discovered.
  75
  76    In case local discovery is enabled, a fourth packet is added to each batch,
  77    which will be broadcast to the local network.
  78 */
  79
  80 void send_mtu_probe(node_t *n) {
  81         vpn_packet_t packet;
  82         int len, i;
  83         int timeout = 1;
  84
  85         n->mtuprobes++;
  86         n->mtuevent = NULL;
  87
  88         if(!n->status.reachable || !n->status.validkey) {
  89                 ifdebug(TRAFFIC) logger(LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  90                 n->mtuprobes = 0;
  91                 return;
  92         }
  93
  94         if(n->mtuprobes > 32) {
  95                 if(!n->minmtu) {
  96                         n->mtuprobes = 31;
  97                         timeout = pinginterval;
  98                         goto end;
  99                 }
 100
 101                 ifdebug(TRAFFIC) logger(LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 102                 n->mtuprobes = 1;
 103                 n->minmtu = 0;
 104                 n->maxmtu = MTU;
 105         }
 106
 107         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 108                 ifdebug(TRAFFIC) logger(LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 109                 n->mtuprobes = 31;
 110         }
 111
 112         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 113                 if(n->minmtu > n->maxmtu)
 114                         n->minmtu = n->maxmtu;
 115                 else
 116                         n->maxmtu = n->minmtu;
 117                 n->mtu = n->minmtu;
 118                 ifdebug(TRAFFIC) logger(LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 119                 n->mtuprobes = 31;
 120         }
 121
 122         if(n->mtuprobes == 31) {
 123                 timeout = pinginterval;
 124                 goto end;
 125         } else if(n->mtuprobes == 32) {
 126                 timeout = pingtimeout;
 127         }
 128
 129         for(i = 0; i < 3 + localdiscovery; i++) {
 130                 if(n->maxmtu <= n->minmtu)
 131                         len = n->maxmtu;
 132                 else
 133                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 134
 135                 if(len < 64)
 136                         len = 64;
 137
 138                 memset(packet.data, 0, 14);
 139                 RAND_pseudo_bytes(packet.data + 14, len - 14);
 140                 packet.len = len;
 141                 if(i >= 3 && n->mtuprobes <= 10)
 142                         packet.priority = -1;
 143                 else
 144                         packet.priority = 0;
 145
 146                 ifdebug(TRAFFIC) logger(LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 147
 148                 send_udppacket(n, &packet);
 149         }
 150
 151 end:
 152         n->mtuevent = new_event();
 153         n->mtuevent->handler = (event_handler_t)send_mtu_probe;
 154         n->mtuevent->data = n;
 155         n->mtuevent->time = now + timeout;
 156         event_add(n->mtuevent);
 157 }
 158
 159 void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 160         ifdebug(TRAFFIC) logger(LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 161
 162         if(!packet->data[0]) {
 163                 packet->data[0] = 1;
 164                 send_udppacket(n, packet);
 165         } else {
 166                 if(n->mtuprobes > 30) {
 167                         if(n->minmtu)
 168                                 n->mtuprobes = 30;
 169                         else
 170                                 n->mtuprobes = 1;
 171                 }
 172
 173                 if(len > n->maxmtu)
 174                         len = n->maxmtu;
 175                 if(n->minmtu < len)
 176                         n->minmtu = len;
 177         }
 178 }
 179
 180 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 181         if(level == 0) {
 182                 memcpy(dest, source, len);
 183                 return len;
 184         } else if(level == 10) {
 185 #ifdef HAVE_LZO
 186                 lzo_uint lzolen = MAXSIZE;
 187                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 188                 return lzolen;
 189 #else
 190                 return -1;
 191 #endif
 192         } else if(level < 10) {
 193 #ifdef HAVE_ZLIB
 194                 unsigned long destlen = MAXSIZE;
 195                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 196                         return destlen;
 197                 else
 198 #endif
 199                         return -1;
 200         } else {
 201 #ifdef HAVE_LZO
 202                 lzo_uint lzolen = MAXSIZE;
 203                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 204                 return lzolen;
 205 #else
 206                 return -1;
 207 #endif
 208         }
 209
 210         return -1;
 211 }
 212
 213 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 214         if(level == 0) {
 215                 memcpy(dest, source, len);
 216                 return len;
 217         } else if(level > 9) {
 218 #ifdef HAVE_LZO
 219                 lzo_uint lzolen = MAXSIZE;
 220                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 221                         return lzolen;
 222                 else
 223 #endif
 224                         return -1;
 225         }
 226 #ifdef HAVE_ZLIB
 227         else {
 228                 unsigned long destlen = MAXSIZE;
 229                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 230                         return destlen;
 231                 else
 232                         return -1;
 233         }
 234 #endif
 235
 236         return -1;
 237 }
 238
 239 /* VPN packet I/O */
 240
 241 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 242         ifdebug(TRAFFIC) logger(LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 243                            packet->len, n->name, n->hostname);
 244
 245         route(n, packet);
 246 }
 247
 248 static bool try_mac(const node_t *n, const vpn_packet_t *inpkt) {
 249         unsigned char hmac[EVP_MAX_MD_SIZE];
 250
 251         if(!n->indigest || !n->inmaclength || !n->inkey || inpkt->len < sizeof inpkt->seqno + n->inmaclength)
 252                 return false;
 253
 254         HMAC(n->indigest, n->inkey, n->inkeylength, (unsigned char *) &inpkt->seqno, inpkt->len - n->inmaclength, (unsigned char *)hmac, NULL);
 255
 256         return !memcmp(hmac, (char *) &inpkt->seqno + inpkt->len - n->inmaclength, n->inmaclength);
 257 }
 258
 259 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 260         vpn_packet_t pkt1, pkt2;
 261         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 262         int nextpkt = 0;
 263         vpn_packet_t *outpkt = pkt[0];
 264         int outlen, outpad;
 265         unsigned char hmac[EVP_MAX_MD_SIZE];
 266         int i;
 267
 268         if(!n->inkey) {
 269                 ifdebug(TRAFFIC) logger(LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 270                                         n->name, n->hostname);
 271                 return;
 272         }
 273
 274         /* Check packet length */
 275
 276         if(inpkt->len < sizeof(inpkt->seqno) + n->inmaclength) {
 277                 ifdebug(TRAFFIC) logger(LOG_DEBUG, "Got too short packet from %s (%s)",
 278                                         n->name, n->hostname);
 279                 return;
 280         }
 281
 282         /* Check the message authentication code */
 283
 284         if(n->indigest && n->inmaclength) {
 285                 inpkt->len -= n->inmaclength;
 286                 HMAC(n->indigest, n->inkey, n->inkeylength,
 287                          (unsigned char *) &inpkt->seqno, inpkt->len, (unsigned char *)hmac, NULL);
 288
 289                 if(memcmp(hmac, (char *) &inpkt->seqno + inpkt->len, n->inmaclength)) {
 290                         ifdebug(TRAFFIC) logger(LOG_DEBUG, "Got unauthenticated packet from %s (%s)",
 291                                            n->name, n->hostname);
 292                         return;
 293                 }
 294         }
 295
 296         /* Decrypt the packet */
 297
 298         if(n->incipher) {
 299                 outpkt = pkt[nextpkt++];
 300
 301                 if(!EVP_DecryptInit_ex(&n->inctx, NULL, NULL, NULL, NULL)
 302                                 || !EVP_DecryptUpdate(&n->inctx, (unsigned char *) &outpkt->seqno, &outlen,
 303                                         (unsigned char *) &inpkt->seqno, inpkt->len)
 304                                 || !EVP_DecryptFinal_ex(&n->inctx, (unsigned char *) &outpkt->seqno + outlen, &outpad)) {
 305                         ifdebug(TRAFFIC) logger(LOG_DEBUG, "Error decrypting packet from %s (%s): %s",
 306                                                 n->name, n->hostname, ERR_error_string(ERR_get_error(), NULL));
 307                         return;
 308                 }
 309
 310                 outpkt->len = outlen + outpad;
 311                 inpkt = outpkt;
 312         }
 313
 314         /* Check the sequence number */
 315
 316         inpkt->len -= sizeof(inpkt->seqno);
 317         inpkt->seqno = ntohl(inpkt->seqno);
 318
 319         if(replaywin) {
 320                 if(inpkt->seqno != n->received_seqno + 1) {
 321                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 322                                 if(n->farfuture++ < replaywin >> 2) {
 323                                         logger(LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 324                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 325                                         return;
 326                                 }
 327                                 logger(LOG_WARNING, "Lost %d packets from %s (%s)",
 328                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 329                                 memset(n->late, 0, replaywin);
 330                         } else if (inpkt->seqno <= n->received_seqno) {
 331                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 332                                         logger(LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 333                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 334                                         return;
 335                                 }
 336                         } else {
 337                                 for(i = n->received_seqno + 1; i < inpkt->seqno; i++)
 338                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 339                         }
 340                 }
 341
 342                 n->farfuture = 0;
 343                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 344         }
 345
 346         if(inpkt->seqno > n->received_seqno)
 347                 n->received_seqno = inpkt->seqno;
 348
 349         if(n->received_seqno > MAX_SEQNO)
 350                 keyexpires = 0;
 351
 352         /* Decompress the packet */
 353
 354         length_t origlen = inpkt->len;
 355
 356         if(n->incompression) {
 357                 outpkt = pkt[nextpkt++];
 358
 359                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 360                         ifdebug(TRAFFIC) logger(LOG_ERR, "Error while uncompressing packet from %s (%s)",
 361                                                  n->name, n->hostname);
 362                         return;
 363                 }
 364
 365                 inpkt = outpkt;
 366
 367                 origlen -= MTU/64 + 20;
 368         }
 369
 370         inpkt->priority = 0;
 371
 372         if(!inpkt->data[12] && !inpkt->data[13])
 373                 mtu_probe_h(n, inpkt, origlen);
 374         else
 375                 receive_packet(n, inpkt);
 376 }
 377
 378 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 379         vpn_packet_t outpkt;
 380
 381         outpkt.len = len;
 382         if(c->options & OPTION_TCPONLY)
 383                 outpkt.priority = 0;
 384         else
 385                 outpkt.priority = -1;
 386         memcpy(outpkt.data, buffer, len);
 387
 388         receive_packet(c->node, &outpkt);
 389 }
 390
 391 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 392         vpn_packet_t pkt1, pkt2;
 393         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 394         vpn_packet_t *inpkt = origpkt;
 395         int nextpkt = 0;
 396         vpn_packet_t *outpkt;
 397         int origlen;
 398         int outlen, outpad;
 399 #if defined(SOL_IP) && defined(IP_TOS)
 400         static int priority = 0;
 401 #endif
 402         int origpriority;
 403
 404         if(!n->status.reachable) {
 405                 ifdebug(TRAFFIC) logger(LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 406                 return;
 407         }
 408
 409         /* Make sure we have a valid key */
 410
 411         if(!n->status.validkey) {
 412                 ifdebug(TRAFFIC) logger(LOG_INFO,
 413                                    "No valid key known yet for %s (%s), forwarding via TCP",
 414                                    n->name, n->hostname);
 415
 416                 if(n->last_req_key + 10 <= now) {
 417                         send_req_key(n);
 418                         n->last_req_key = now;
 419                 }
 420
 421                 send_tcppacket(n->nexthop->connection, origpkt);
 422
 423                 return;
 424         }
 425
 426         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 427                 ifdebug(TRAFFIC) logger(LOG_INFO,
 428                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 429                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 430
 431                 if(n != n->nexthop)
 432                         send_packet(n->nexthop, origpkt);
 433                 else
 434                         send_tcppacket(n->nexthop->connection, origpkt);
 435
 436                 return;
 437         }
 438
 439         origlen = inpkt->len;
 440         origpriority = inpkt->priority;
 441
 442         /* Compress the packet */
 443
 444         if(n->outcompression) {
 445                 outpkt = pkt[nextpkt++];
 446
 447                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 448                         ifdebug(TRAFFIC) logger(LOG_ERR, "Error while compressing packet to %s (%s)",
 449                                    n->name, n->hostname);
 450                         return;
 451                 }
 452
 453                 inpkt = outpkt;
 454         }
 455
 456         /* Add sequence number */
 457
 458         inpkt->seqno = htonl(++(n->sent_seqno));
 459         inpkt->len += sizeof(inpkt->seqno);
 460
 461         /* Encrypt the packet */
 462
 463         if(n->outcipher) {
 464                 outpkt = pkt[nextpkt++];
 465
 466                 if(!EVP_EncryptInit_ex(&n->outctx, NULL, NULL, NULL, NULL)
 467                                 || !EVP_EncryptUpdate(&n->outctx, (unsigned char *) &outpkt->seqno, &outlen,
 468                                         (unsigned char *) &inpkt->seqno, inpkt->len)
 469                                 || !EVP_EncryptFinal_ex(&n->outctx, (unsigned char *) &outpkt->seqno + outlen, &outpad)) {
 470                         ifdebug(TRAFFIC) logger(LOG_ERR, "Error while encrypting packet to %s (%s): %s",
 471                                                 n->name, n->hostname, ERR_error_string(ERR_get_error(), NULL));
 472                         goto end;
 473                 }
 474
 475                 outpkt->len = outlen + outpad;
 476                 inpkt = outpkt;
 477         }
 478
 479         /* Add the message authentication code */
 480
 481         if(n->outdigest && n->outmaclength) {
 482                 HMAC(n->outdigest, n->outkey, n->outkeylength, (unsigned char *) &inpkt->seqno,
 483                          inpkt->len, (unsigned char *) &inpkt->seqno + inpkt->len, NULL);
 484                 inpkt->len += n->outmaclength;
 485         }
 486
 487         /* Determine which socket we have to use */
 488
 489         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 490                 for(int sock = 0; sock < listen_sockets; sock++) {
 491                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 492                                 n->sock = sock;
 493                                 break;
 494                         }
 495                 }
 496         }
 497
 498         /* Send the packet */
 499
 500         struct sockaddr *sa;
 501         socklen_t sl;
 502         int sock;
 503         sockaddr_t broadcast;
 504
 505         /* Overloaded use of priority field: -1 means local broadcast */
 506
 507         if(origpriority == -1 && n->prevedge) {
 508                 sock = rand() % listen_sockets;
 509                 memset(&broadcast, 0, sizeof broadcast);
 510                 if(listen_socket[sock].sa.sa.sa_family == AF_INET6) {
 511                         broadcast.in6.sin6_family = AF_INET6;
 512                         broadcast.in6.sin6_addr.s6_addr[0x0] = 0xff;
 513                         broadcast.in6.sin6_addr.s6_addr[0x1] = 0x02;
 514                         broadcast.in6.sin6_addr.s6_addr[0xf] = 0x01;
 515                         broadcast.in6.sin6_port = n->prevedge->address.in.sin_port;
 516                         broadcast.in6.sin6_scope_id = listen_socket[sock].sa.in6.sin6_scope_id;
 517                 } else {
 518                         broadcast.in.sin_family = AF_INET;
 519                         broadcast.in.sin_addr.s_addr = -1;
 520                         broadcast.in.sin_port = n->prevedge->address.in.sin_port;
 521                 }
 522                 sa = &broadcast.sa;
 523                 sl = SALEN(broadcast.sa);
 524         } else {
 525                 if(origpriority == -1)
 526                         origpriority = 0;
 527
 528                 sa = &(n->address.sa);
 529                 sl = SALEN(n->address.sa);
 530                 sock = n->sock;
 531         }
 532
 533 #if defined(SOL_IP) && defined(IP_TOS)
 534         if(priorityinheritance && origpriority != priority
 535            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 536                 priority = origpriority;
 537                 ifdebug(TRAFFIC) logger(LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 538                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 539                         logger(LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 540         }
 541 #endif
 542
 543         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 544                 if(sockmsgsize(sockerrno)) {
 545                         if(n->maxmtu >= origlen)
 546                                 n->maxmtu = origlen - 1;
 547                         if(n->mtu >= origlen)
 548                                 n->mtu = origlen - 1;
 549                 } else
 550                         ifdebug(TRAFFIC) logger(LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 551         }
 552
 553 end:
 554         origpkt->len = origlen;
 555 }
 556
 557 /*
 558   send a packet to the given vpn ip.
 559 */
 560 void send_packet(const node_t *n, vpn_packet_t *packet) {
 561         node_t *via;
 562
 563         if(n == myself) {
 564                 if(overwrite_mac)
 565                          memcpy(packet->data, mymac.x, ETH_ALEN);
 566                 devops.write(packet);
 567                 return;
 568         }
 569
 570         ifdebug(TRAFFIC) logger(LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 571                            packet->len, n->name, n->hostname);
 572
 573         if(!n->status.reachable) {
 574                 ifdebug(TRAFFIC) logger(LOG_INFO, "Node %s (%s) is not reachable",
 575                                    n->name, n->hostname);
 576                 return;
 577         }
 578
 579         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 580
 581         if(via != n)
 582                 ifdebug(TRAFFIC) logger(LOG_INFO, "Sending packet to %s via %s (%s)",
 583                            n->name, via->name, n->via->hostname);
 584
 585         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 586                 if(!send_tcppacket(via->connection, packet))
 587                         terminate_connection(via->connection, true);
 588         } else
 589                 send_udppacket(via, packet);
 590 }
 591
 592 /* Broadcast a packet using the minimum spanning tree */
 593
 594 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 595         avl_node_t *node;
 596         connection_t *c;
 597         node_t *n;
 598
 599         // Always give ourself a copy of the packet.
 600         if(from != myself)
 601                 send_packet(myself, packet);
 602
 603         // In TunnelServer mode, do not forward broadcast packets.
 604         // The MST might not be valid and create loops.
 605         if(tunnelserver || broadcast_mode == BMODE_NONE)
 606                 return;
 607
 608         ifdebug(TRAFFIC) logger(LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 609                            packet->len, from->name, from->hostname);
 610
 611         switch(broadcast_mode) {
 612                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 613                 // This guarantees all nodes receive the broadcast packet, and
 614                 // usually distributes the sending of broadcast packets over all nodes.
 615                 case BMODE_MST:
 616                         for(node = connection_tree->head; node; node = node->next) {
 617                                 c = node->data;
 618
 619                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 620                                         send_packet(c->node, packet);
 621                         }
 622                         break;
 623
 624                 // In direct mode, we send copies to each node we know of.
 625                 // However, this only reaches nodes that can be reached in a single hop.
 626                 // We don't have enough information to forward broadcast packets in this case.
 627                 case BMODE_DIRECT:
 628                         if(from != myself)
 629                                 break;
 630
 631                         for(node = node_udp_tree->head; node; node = node->next) {
 632                                 n = node->data;
 633
 634                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 635                                         send_packet(n, packet);
 636                         }
 637                         break;
 638
 639                 default:
 640                         break;
 641         }
 642 }
 643
 644 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 645         avl_node_t *node;
 646         edge_t *e;
 647         node_t *n = NULL;
 648         bool hard = false;
 649         static time_t last_hard_try = 0;
 650
 651         for(node = edge_weight_tree->head; node; node = node->next) {
 652                 e = node->data;
 653
 654                 if(e->to == myself)
 655                         continue;
 656
 657                 if(sockaddrcmp_noport(from, &e->address)) {
 658                         if(last_hard_try == now)
 659                                 continue;
 660                         hard = true;
 661                 }
 662
 663                 if(!try_mac(e->to, pkt))
 664                         continue;
 665
 666                 n = e->to;
 667                 break;
 668         }
 669
 670         if(hard)
 671                 last_hard_try = now;
 672
 673         last_hard_try = now;
 674         return n;
 675 }
 676
 677 void handle_incoming_vpn_data(int sock) {
 678         vpn_packet_t pkt;
 679         char *hostname;
 680         sockaddr_t from;
 681         socklen_t fromlen = sizeof(from);
 682         node_t *n;
 683
 684         pkt.len = recvfrom(listen_socket[sock].udp, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 685
 686         if(pkt.len < 0) {
 687                 if(!sockwouldblock(sockerrno))
 688                         logger(LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 689                 return;
 690         }
 691
 692         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 693
 694         n = lookup_node_udp(&from);
 695
 696         if(!n) {
 697                 n = try_harder(&from, &pkt);
 698                 if(n)
 699                         update_node_udp(n, &from);
 700                 else ifdebug(PROTOCOL) {
 701                         hostname = sockaddr2hostname(&from);
 702                         logger(LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 703                         free(hostname);
 704                         return;
 705                 }
 706                 else
 707                         return;
 708         }
 709
 710         n->sock = sock;
 711
 712         receive_udppacket(n, &pkt);
 713 }