tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "cipher.h"
  40 #include "conf.h"
  41 #include "connection.h"
  42 #include "crypto.h"
  43 #include "digest.h"
  44 #include "device.h"
  45 #include "ethernet.h"
  46 #include "graph.h"
  47 #include "logger.h"
  48 #include "net.h"
  49 #include "netutl.h"
  50 #include "protocol.h"
  51 #include "process.h"
  52 #include "route.h"
  53 #include "utils.h"
  54 #include "xalloc.h"
  55
  56 int keylifetime = 0;
  57 #ifdef HAVE_LZO
  58 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  59 #endif
  60
  61 static void send_udppacket(node_t *, vpn_packet_t *);
  62
  63 unsigned replaywin = 16;
  64 bool localdiscovery = false;
  65
  66 #define MAX_SEQNO 1073741824
  67
  68 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  69    mtuprobes ==    31: sleep pinginterval seconds
  70    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  71    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  72
  73    Probes are sent in batches of three, with random sizes between the lower and
  74    upper boundaries for the MTU thus far discovered.
  75
  76    In case local discovery is enabled, a fourth packet is added to each batch,
  77    which will be broadcast to the local network.
  78 */
  79
  80 static void send_mtu_probe_handler(void *data) {
  81         node_t *n = data;
  82         int timeout = 1;
  83
  84         n->mtuprobes++;
  85
  86         if(!n->status.reachable || !n->status.validkey) {
  87                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  88                 n->mtuprobes = 0;
  89                 return;
  90         }
  91
  92         if(n->mtuprobes > 32) {
  93                 if(!n->minmtu) {
  94                         n->mtuprobes = 31;
  95                         timeout = pinginterval;
  96                         goto end;
  97                 }
  98
  99                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 100                 n->status.udp_confirmed = false;
 101                 n->mtuprobes = 1;
 102                 n->minmtu = 0;
 103                 n->maxmtu = MTU;
 104         }
 105
 106         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 107                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 108                 n->mtuprobes = 31;
 109         }
 110
 111         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 112                 if(n->minmtu > n->maxmtu)
 113                         n->minmtu = n->maxmtu;
 114                 else
 115                         n->maxmtu = n->minmtu;
 116                 n->mtu = n->minmtu;
 117                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 118                 n->mtuprobes = 31;
 119         }
 120
 121         if(n->mtuprobes == 31) {
 122                 timeout = pinginterval;
 123                 goto end;
 124         } else if(n->mtuprobes == 32) {
 125                 timeout = pingtimeout;
 126         }
 127
 128         for(int i = 0; i < 3 + localdiscovery; i++) {
 129                 int len;
 130
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 vpn_packet_t packet;
 140                 memset(packet.data, 0, 14);
 141                 randomize(packet.data + 14, len - 14);
 142                 packet.len = len;
 143                 if(i >= 3 && n->mtuprobes <= 10)
 144                         packet.priority = -1;
 145                 else
 146                         packet.priority = 0;
 147
 148                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 149
 150                 send_udppacket(n, &packet);
 151         }
 152
 153 end:
 154         timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
 155 }
 156
 157 void send_mtu_probe(node_t *n) {
 158         timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
 159         send_mtu_probe_handler(n);
 160 }
 161
 162 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 163         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 164
 165         if(!packet->data[0]) {
 166                 /* It's a probe request, send back a reply */
 167
 168                 packet->data[0] = 1;
 169
 170                 /* Temporarily set udp_confirmed, so that the reply is sent
 171                    back exactly the way it came in. */
 172
 173                 bool udp_confirmed = n->status.udp_confirmed;
 174                 n->status.udp_confirmed = true;
 175                 send_udppacket(n, packet);
 176                 n->status.udp_confirmed = udp_confirmed;
 177         } else {
 178                 /* It's a valid reply: now we know bidirectional communication
 179                    is possible using the address and socket that the reply
 180                    packet used. */
 181
 182                 n->status.udp_confirmed = true;
 183
 184                 /* If we haven't established the PMTU yet, restart the discovery process. */
 185
 186                 if(n->mtuprobes > 30) {
 187                         if(n->minmtu)
 188                                 n->mtuprobes = 30;
 189                         else
 190                                 n->mtuprobes = 1;
 191                 }
 192
 193                 /* If applicable, raise the minimum supported MTU */
 194
 195                 if(len > n->maxmtu)
 196                         len = n->maxmtu;
 197                 if(n->minmtu < len)
 198                         n->minmtu = len;
 199         }
 200 }
 201
 202 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 203         if(level == 0) {
 204                 memcpy(dest, source, len);
 205                 return len;
 206         } else if(level == 10) {
 207 #ifdef HAVE_LZO
 208                 lzo_uint lzolen = MAXSIZE;
 209                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 210                 return lzolen;
 211 #else
 212                 return -1;
 213 #endif
 214         } else if(level < 10) {
 215 #ifdef HAVE_ZLIB
 216                 unsigned long destlen = MAXSIZE;
 217                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 218                         return destlen;
 219                 else
 220 #endif
 221                         return -1;
 222         } else {
 223 #ifdef HAVE_LZO
 224                 lzo_uint lzolen = MAXSIZE;
 225                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 226                 return lzolen;
 227 #else
 228                 return -1;
 229 #endif
 230         }
 231
 232         return -1;
 233 }
 234
 235 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 236         if(level == 0) {
 237                 memcpy(dest, source, len);
 238                 return len;
 239         } else if(level > 9) {
 240 #ifdef HAVE_LZO
 241                 lzo_uint lzolen = MAXSIZE;
 242                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 243                         return lzolen;
 244                 else
 245 #endif
 246                         return -1;
 247         }
 248 #ifdef HAVE_ZLIB
 249         else {
 250                 unsigned long destlen = MAXSIZE;
 251                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 252                         return destlen;
 253                 else
 254                         return -1;
 255         }
 256 #endif
 257
 258         return -1;
 259 }
 260
 261 /* VPN packet I/O */
 262
 263 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 264         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 265                            packet->len, n->name, n->hostname);
 266
 267         n->in_packets++;
 268         n->in_bytes += packet->len;
 269
 270         route(n, packet);
 271 }
 272
 273 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 274         if(n->status.sptps)
 275                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 276
 277         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 278                 return false;
 279
 280         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 281 }
 282
 283 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 284         vpn_packet_t pkt1, pkt2;
 285         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 286         int nextpkt = 0;
 287         vpn_packet_t *outpkt = pkt[0];
 288         size_t outlen;
 289
 290         if(n->status.sptps) {
 291                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 292                 return;
 293         }
 294
 295         if(!cipher_active(&n->incipher)) {
 296                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 297                                         n->name, n->hostname);
 298                 return;
 299         }
 300
 301         /* Check packet length */
 302
 303         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 304                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 305                                         n->name, n->hostname);
 306                 return;
 307         }
 308
 309         /* Check the message authentication code */
 310
 311         if(digest_active(&n->indigest)) {
 312                 inpkt->len -= n->indigest.maclength;
 313                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 314                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 315                         return;
 316                 }
 317         }
 318         /* Decrypt the packet */
 319
 320         if(cipher_active(&n->incipher)) {
 321                 outpkt = pkt[nextpkt++];
 322                 outlen = MAXSIZE;
 323
 324                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 325                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 326                         return;
 327                 }
 328
 329                 outpkt->len = outlen;
 330                 inpkt = outpkt;
 331         }
 332
 333         /* Check the sequence number */
 334
 335         inpkt->len -= sizeof inpkt->seqno;
 336         inpkt->seqno = ntohl(inpkt->seqno);
 337
 338         if(replaywin) {
 339                 if(inpkt->seqno != n->received_seqno + 1) {
 340                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 341                                 if(n->farfuture++ < replaywin >> 2) {
 342                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 343                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 344                                         return;
 345                                 }
 346                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 347                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 348                                 memset(n->late, 0, replaywin);
 349                         } else if (inpkt->seqno <= n->received_seqno) {
 350                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 351                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 352                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 353                                         return;
 354                                 }
 355                         } else {
 356                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 357                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 358                         }
 359                 }
 360
 361                 n->farfuture = 0;
 362                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 363         }
 364
 365         if(inpkt->seqno > n->received_seqno)
 366                 n->received_seqno = inpkt->seqno;
 367
 368         if(n->received_seqno > MAX_SEQNO)
 369                 regenerate_key();
 370
 371         /* Decompress the packet */
 372
 373         length_t origlen = inpkt->len;
 374
 375         if(n->incompression) {
 376                 outpkt = pkt[nextpkt++];
 377
 378                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 379                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 380                                                  n->name, n->hostname);
 381                         return;
 382                 }
 383
 384                 inpkt = outpkt;
 385
 386                 origlen -= MTU/64 + 20;
 387         }
 388
 389         inpkt->priority = 0;
 390
 391         if(!inpkt->data[12] && !inpkt->data[13])
 392                 mtu_probe_h(n, inpkt, origlen);
 393         else
 394                 receive_packet(n, inpkt);
 395 }
 396
 397 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 398         vpn_packet_t outpkt;
 399
 400         outpkt.len = len;
 401         if(c->options & OPTION_TCPONLY)
 402                 outpkt.priority = 0;
 403         else
 404                 outpkt.priority = -1;
 405         memcpy(outpkt.data, buffer, len);
 406
 407         receive_packet(c->node, &outpkt);
 408 }
 409
 410 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 411         if(!n->status.validkey) {
 412                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 413                 if(!n->status.waitingforkey)
 414                         send_req_key(n);
 415                 else if(n->last_req_key + 10 < time(NULL)) {
 416                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 417                         sptps_stop(&n->sptps);
 418                         n->status.waitingforkey = false;
 419                         send_req_key(n);
 420                 }
 421                 return;
 422         }
 423
 424         uint8_t type = 0;
 425         int offset = 0;
 426
 427         if(!(origpkt->data[12] | origpkt->data[13])) {
 428                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 429                 return;
 430         }
 431
 432         if(routing_mode == RMODE_ROUTER)
 433                 offset = 14;
 434         else
 435                 type = PKT_MAC;
 436
 437         if(origpkt->len < offset)
 438                 return;
 439
 440         vpn_packet_t outpkt;
 441
 442         if(n->outcompression) {
 443                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 444                 if(len < 0) {
 445                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 446                 } else if(len < origpkt->len - offset) {
 447                         outpkt.len = len + offset;
 448                         origpkt = &outpkt;
 449                         type |= PKT_COMPRESSED;
 450                 }
 451         }
 452
 453         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 454         return;
 455 }
 456
 457 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 458         /* Latest guess */
 459         *sa = &n->address;
 460         *sock = n->sock;
 461
 462         /* If the UDP address is confirmed, use it. */
 463         if(n->status.udp_confirmed)
 464                 return;
 465
 466         /* Send every third packet to n->address; that could be set
 467            to the node's reflexive UDP address discovered during key
 468            exchange. */
 469
 470         static int x = 0;
 471         if(++x >= 3) {
 472                 x = 0;
 473                 return;
 474         }
 475
 476         /* Otherwise, address are found in edges to this node.
 477            So we pick a random edge and a random socket. */
 478
 479         int i = 0;
 480         int j = rand() % n->edge_tree->count;
 481         edge_t *candidate = NULL;
 482
 483         for splay_each(edge_t, e, n->edge_tree) {
 484                 if(i++ == j) {
 485                         candidate = e->reverse;
 486                         break;
 487                 }
 488         }
 489
 490         if(candidate) {
 491                 *sa = &candidate->address;
 492                 *sock = rand() % listen_sockets;
 493         }
 494
 495         /* Make sure we have a suitable socket for the chosen address */
 496         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 497                 for(int i = 0; i < listen_sockets; i++) {
 498                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 499                                 *sock = i;
 500                                 break;
 501                         }
 502                 }
 503         }
 504 }
 505
 506 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 507         static sockaddr_t broadcast_ipv4 = {
 508                 .in = {
 509                         .sin_family = AF_INET,
 510                         .sin_addr.s_addr = -1,
 511                 }
 512         };
 513
 514         static sockaddr_t broadcast_ipv6 = {
 515                 .in6 = {
 516                         .sin6_family = AF_INET6,
 517                         .sin6_addr.s6_addr[0x0] = 0xff,
 518                         .sin6_addr.s6_addr[0x1] = 0x02,
 519                         .sin6_addr.s6_addr[0xf] = 0x01,
 520                 }
 521         };
 522
 523         *sock = rand() % listen_sockets;
 524
 525         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 526                 broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 527                 broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
 528                 *sa = &broadcast_ipv6;
 529         } else {
 530                 broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 531                 *sa = &broadcast_ipv4;
 532         }
 533 }
 534
 535 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 536         vpn_packet_t pkt1, pkt2;
 537         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 538         vpn_packet_t *inpkt = origpkt;
 539         int nextpkt = 0;
 540         vpn_packet_t *outpkt;
 541         int origlen = origpkt->len;
 542         size_t outlen;
 543 #if defined(SOL_IP) && defined(IP_TOS)
 544         static int priority = 0;
 545 #endif
 546         int origpriority = origpkt->priority;
 547
 548         if(!n->status.reachable) {
 549                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 550                 return;
 551         }
 552
 553         if(n->status.sptps)
 554                 return send_sptps_packet(n, origpkt);
 555
 556         /* Make sure we have a valid key */
 557
 558         if(!n->status.validkey) {
 559                 logger(DEBUG_TRAFFIC, LOG_INFO,
 560                                    "No valid key known yet for %s (%s), forwarding via TCP",
 561                                    n->name, n->hostname);
 562
 563                 if(n->last_req_key + 10 <= now.tv_sec) {
 564                         send_req_key(n);
 565                         n->last_req_key = now.tv_sec;
 566                 }
 567
 568                 send_tcppacket(n->nexthop->connection, origpkt);
 569
 570                 return;
 571         }
 572
 573         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 574                 logger(DEBUG_TRAFFIC, LOG_INFO,
 575                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 576                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 577
 578                 if(n != n->nexthop)
 579                         send_packet(n->nexthop, origpkt);
 580                 else
 581                         send_tcppacket(n->nexthop->connection, origpkt);
 582
 583                 return;
 584         }
 585
 586         /* Compress the packet */
 587
 588         if(n->outcompression) {
 589                 outpkt = pkt[nextpkt++];
 590
 591                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 592                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 593                                    n->name, n->hostname);
 594                         return;
 595                 }
 596
 597                 inpkt = outpkt;
 598         }
 599
 600         /* Add sequence number */
 601
 602         inpkt->seqno = htonl(++(n->sent_seqno));
 603         inpkt->len += sizeof inpkt->seqno;
 604
 605         /* Encrypt the packet */
 606
 607         if(cipher_active(&n->outcipher)) {
 608                 outpkt = pkt[nextpkt++];
 609                 outlen = MAXSIZE;
 610
 611                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 612                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 613                         goto end;
 614                 }
 615
 616                 outpkt->len = outlen;
 617                 inpkt = outpkt;
 618         }
 619
 620         /* Add the message authentication code */
 621
 622         if(digest_active(&n->outdigest)) {
 623                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 624                 inpkt->len += digest_length(&n->outdigest);
 625         }
 626
 627         /* Send the packet */
 628
 629         const sockaddr_t *sa;
 630         int sock;
 631
 632         /* Overloaded use of priority field: -1 means local broadcast */
 633
 634         if(origpriority == -1 && n->prevedge)
 635                 choose_broadcast_address(n, &sa, &sock);
 636         else
 637                 choose_udp_address(n, &sa, &sock);
 638
 639 #if defined(SOL_IP) && defined(IP_TOS)
 640         if(priorityinheritance && origpriority != priority
 641            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 642                 priority = origpriority;
 643                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 644                 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 645                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 646         }
 647 #endif
 648
 649         if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 650                 if(sockmsgsize(sockerrno)) {
 651                         if(n->maxmtu >= origlen)
 652                                 n->maxmtu = origlen - 1;
 653                         if(n->mtu >= origlen)
 654                                 n->mtu = origlen - 1;
 655                 } else
 656                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 657         }
 658
 659 end:
 660         origpkt->len = origlen;
 661 }
 662
 663 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 664         node_t *to = handle;
 665
 666         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 667
 668         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 669                 char buf[len * 4 / 3 + 5];
 670                 b64encode(data, buf, len);
 671                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 672                    to ensure we get to learn the reflexive UDP address. */
 673                 if(!to->status.validkey)
 674                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 675                 else
 676                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 677         }
 678
 679         /* Otherwise, send the packet via UDP */
 680
 681         const sockaddr_t *sa;
 682         int sock;
 683
 684         choose_udp_address(to, &sa, &sock);
 685
 686         if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 687                 if(sockmsgsize(sockerrno)) {
 688                         if(to->maxmtu >= len)
 689                                 to->maxmtu = len - 1;
 690                         if(to->mtu >= len)
 691                                 to->mtu = len - 1;
 692                 } else {
 693                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 694                         return false;
 695                 }
 696         }
 697
 698         return true;
 699 }
 700
 701 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 702         node_t *from = handle;
 703
 704         if(type == SPTPS_HANDSHAKE) {
 705                 if(!from->status.validkey) {
 706                         from->status.validkey = true;
 707                         from->status.waitingforkey = false;
 708                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 709                 }
 710                 return true;
 711         }
 712
 713         if(len > MTU) {
 714                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 715                 return false;
 716         }
 717
 718         vpn_packet_t inpkt;
 719
 720         if(type == PKT_PROBE) {
 721                 inpkt.len = len;
 722                 memcpy(inpkt.data, data, len);
 723                 mtu_probe_h(from, &inpkt, len);
 724                 return true;
 725         }
 726
 727         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 728                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 729                 return false;
 730         }
 731
 732         /* Check if we have the headers we need */
 733         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 734                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 735                 return false;
 736         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 737                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 738         }
 739
 740         int offset = (type & PKT_MAC) ? 0 : 14;
 741         if(type & PKT_COMPRESSED) {
 742                 len = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 743                 if(len < 0) {
 744                         return false;
 745                 } else {
 746                         inpkt.len = len + offset;
 747                 }
 748                 if(inpkt.len > MAXSIZE)
 749                         abort();
 750         } else {
 751                 memcpy(inpkt.data + offset, data, len);
 752                 inpkt.len = len + offset;
 753         }
 754
 755         /* Generate the Ethernet packet type if necessary */
 756         if(offset) {
 757                 switch(inpkt.data[14] >> 4) {
 758                         case 4:
 759                                 inpkt.data[12] = 0x08;
 760                                 inpkt.data[13] = 0x00;
 761                                 break;
 762                         case 6:
 763                                 inpkt.data[12] = 0x86;
 764                                 inpkt.data[13] = 0xDD;
 765                                 break;
 766                         default:
 767                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 768                                                    "Unknown IP version %d while reading packet from %s (%s)",
 769                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 770                                 return false;
 771                 }
 772         }
 773
 774         receive_packet(from, &inpkt);
 775         return true;
 776 }
 777
 778 /*
 779   send a packet to the given vpn ip.
 780 */
 781 void send_packet(node_t *n, vpn_packet_t *packet) {
 782         node_t *via;
 783
 784         if(n == myself) {
 785                 if(overwrite_mac)
 786                          memcpy(packet->data, mymac.x, ETH_ALEN);
 787                 n->out_packets++;
 788                 n->out_bytes += packet->len;
 789                 devops.write(packet);
 790                 return;
 791         }
 792
 793         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 794                            packet->len, n->name, n->hostname);
 795
 796         if(!n->status.reachable) {
 797                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 798                                    n->name, n->hostname);
 799                 return;
 800         }
 801
 802         n->out_packets++;
 803         n->out_bytes += packet->len;
 804
 805         if(n->status.sptps) {
 806                 send_sptps_packet(n, packet);
 807                 return;
 808         }
 809
 810         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 811
 812         if(via != n)
 813                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 814                            n->name, via->name, n->via->hostname);
 815
 816         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 817                 if(!send_tcppacket(via->connection, packet))
 818                         terminate_connection(via->connection, true);
 819         } else
 820                 send_udppacket(via, packet);
 821 }
 822
 823 /* Broadcast a packet using the minimum spanning tree */
 824
 825 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 826         // Always give ourself a copy of the packet.
 827         if(from != myself)
 828                 send_packet(myself, packet);
 829
 830         // In TunnelServer mode, do not forward broadcast packets.
 831         // The MST might not be valid and create loops.
 832         if(tunnelserver || broadcast_mode == BMODE_NONE)
 833                 return;
 834
 835         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 836                            packet->len, from->name, from->hostname);
 837
 838         switch(broadcast_mode) {
 839                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 840                 // This guarantees all nodes receive the broadcast packet, and
 841                 // usually distributes the sending of broadcast packets over all nodes.
 842                 case BMODE_MST:
 843                         for list_each(connection_t, c, connection_list)
 844                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 845                                         send_packet(c->node, packet);
 846                         break;
 847
 848                 // In direct mode, we send copies to each node we know of.
 849                 // However, this only reaches nodes that can be reached in a single hop.
 850                 // We don't have enough information to forward broadcast packets in this case.
 851                 case BMODE_DIRECT:
 852                         if(from != myself)
 853                                 break;
 854
 855                         for splay_each(node_t, n, node_tree)
 856                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 857                                         send_packet(n, packet);
 858                         break;
 859
 860                 default:
 861                         break;
 862         }
 863 }
 864
 865 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 866         node_t *n = NULL;
 867         bool hard = false;
 868         static time_t last_hard_try = 0;
 869
 870         for splay_each(edge_t, e, edge_weight_tree) {
 871                 if(!e->to->status.reachable || e->to == myself)
 872                         continue;
 873
 874                 if(sockaddrcmp_noport(from, &e->address)) {
 875                         if(last_hard_try == now.tv_sec)
 876                                 continue;
 877                         hard = true;
 878                 }
 879
 880                 if(!try_mac(e->to, pkt))
 881                         continue;
 882
 883                 n = e->to;
 884                 break;
 885         }
 886
 887         if(hard)
 888                 last_hard_try = now.tv_sec;
 889
 890         last_hard_try = now.tv_sec;
 891         return n;
 892 }
 893
 894 void handle_incoming_vpn_data(void *data, int flags) {
 895         listen_socket_t *ls = data;
 896         vpn_packet_t pkt;
 897         char *hostname;
 898         sockaddr_t from = {{0}};
 899         socklen_t fromlen = sizeof from;
 900         node_t *n;
 901         int len;
 902
 903         len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 904
 905         if(len <= 0 || len > MAXSIZE) {
 906                 if(!sockwouldblock(sockerrno))
 907                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 908                 return;
 909         }
 910
 911         pkt.len = len;
 912
 913         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 914
 915         n = lookup_node_udp(&from);
 916
 917         if(!n) {
 918                 n = try_harder(&from, &pkt);
 919                 if(n)
 920                         update_node_udp(n, &from);
 921                 else if(debug_level >= DEBUG_PROTOCOL) {
 922                         hostname = sockaddr2hostname(&from);
 923                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 924                         free(hostname);
 925                         return;
 926                 }
 927                 else
 928                         return;
 929         }
 930
 931         n->sock = ls - listen_socket;
 932
 933         receive_udppacket(n, &pkt);
 934 }
 935
 936 void handle_device_data(void *data, int flags) {
 937         vpn_packet_t packet;
 938
 939         packet.priority = 0;
 940
 941         if(devops.read(&packet)) {
 942                 myself->in_packets++;
 943                 myself->in_bytes += packet.len;
 944                 route(myself, &packet);
 945         }
 946 }