tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "splay_tree.h"
  40 #include "cipher.h"
  41 #include "conf.h"
  42 #include "connection.h"
  43 #include "crypto.h"
  44 #include "digest.h"
  45 #include "device.h"
  46 #include "ethernet.h"
  47 #include "graph.h"
  48 #include "logger.h"
  49 #include "net.h"
  50 #include "netutl.h"
  51 #include "protocol.h"
  52 #include "process.h"
  53 #include "route.h"
  54 #include "utils.h"
  55 #include "xalloc.h"
  56
  57 int keylifetime = 0;
  58 #ifdef HAVE_LZO
  59 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  60 #endif
  61
  62 static void send_udppacket(node_t *, vpn_packet_t *);
  63
  64 unsigned replaywin = 16;
  65 bool localdiscovery = false;
  66
  67 #define MAX_SEQNO 1073741824
  68
  69 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  70    mtuprobes ==    31: sleep pinginterval seconds
  71    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  72    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  73
  74    Probes are sent in batches of three, with random sizes between the lower and
  75    upper boundaries for the MTU thus far discovered.
  76
  77    In case local discovery is enabled, a fourth packet is added to each batch,
  78    which will be broadcast to the local network.
  79 */
  80
  81 static void send_mtu_probe_handler(int fd, short events, void *data) {
  82         node_t *n = data;
  83         vpn_packet_t packet;
  84         int len, i;
  85         int timeout = 1;
  86
  87         n->mtuprobes++;
  88
  89         if(!n->status.reachable || !n->status.validkey) {
  90                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  91                 n->mtuprobes = 0;
  92                 return;
  93         }
  94
  95         if(n->mtuprobes > 32) {
  96                 if(!n->minmtu) {
  97                         n->mtuprobes = 31;
  98                         timeout = pinginterval;
  99                         goto end;
 100                 }
 101
 102                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 103                 n->mtuprobes = 1;
 104                 n->minmtu = 0;
 105                 n->maxmtu = MTU;
 106         }
 107
 108         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 109                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 110                 n->mtuprobes = 31;
 111         }
 112
 113         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 114                 if(n->minmtu > n->maxmtu)
 115                         n->minmtu = n->maxmtu;
 116                 else
 117                         n->maxmtu = n->minmtu;
 118                 n->mtu = n->minmtu;
 119                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 120                 n->mtuprobes = 31;
 121         }
 122
 123         if(n->mtuprobes == 31) {
 124                 timeout = pinginterval;
 125                 goto end;
 126         } else if(n->mtuprobes == 32) {
 127                 timeout = pingtimeout;
 128         }
 129
 130         for(i = 0; i < 3 + localdiscovery; i++) {
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 memset(packet.data, 0, 14);
 140                 randomize(packet.data + 14, len - 14);
 141                 packet.len = len;
 142                 if(i >= 3 && n->mtuprobes <= 10)
 143                         packet.priority = -1;
 144                 else
 145                         packet.priority = 0;
 146
 147                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 148
 149                 send_udppacket(n, &packet);
 150         }
 151
 152 end:
 153         event_add(&n->mtuevent, &(struct timeval){timeout, 0});
 154 }
 155
 156 void send_mtu_probe(node_t *n) {
 157         if(!timeout_initialized(&n->mtuevent))
 158                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 159         send_mtu_probe_handler(0, 0, n);
 160 }
 161
 162 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 163         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 164
 165         if(!packet->data[0]) {
 166                 packet->data[0] = 1;
 167                 send_udppacket(n, packet);
 168         } else {
 169                 if(n->mtuprobes > 30) {
 170                         if(n->minmtu)
 171                                 n->mtuprobes = 30;
 172                         else
 173                                 n->mtuprobes = 1;
 174                 }
 175
 176                 if(len > n->maxmtu)
 177                         len = n->maxmtu;
 178                 if(n->minmtu < len)
 179                         n->minmtu = len;
 180         }
 181 }
 182
 183 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 184         if(level == 0) {
 185                 memcpy(dest, source, len);
 186                 return len;
 187         } else if(level == 10) {
 188 #ifdef HAVE_LZO
 189                 lzo_uint lzolen = MAXSIZE;
 190                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 191                 return lzolen;
 192 #else
 193                 return -1;
 194 #endif
 195         } else if(level < 10) {
 196 #ifdef HAVE_ZLIB
 197                 unsigned long destlen = MAXSIZE;
 198                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 199                         return destlen;
 200                 else
 201 #endif
 202                         return -1;
 203         } else {
 204 #ifdef HAVE_LZO
 205                 lzo_uint lzolen = MAXSIZE;
 206                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 207                 return lzolen;
 208 #else
 209                 return -1;
 210 #endif
 211         }
 212
 213         return -1;
 214 }
 215
 216 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 217         if(level == 0) {
 218                 memcpy(dest, source, len);
 219                 return len;
 220         } else if(level > 9) {
 221 #ifdef HAVE_LZO
 222                 lzo_uint lzolen = MAXSIZE;
 223                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 224                         return lzolen;
 225                 else
 226 #endif
 227                         return -1;
 228         }
 229 #ifdef HAVE_ZLIB
 230         else {
 231                 unsigned long destlen = MAXSIZE;
 232                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 233                         return destlen;
 234                 else
 235                         return -1;
 236         }
 237 #endif
 238
 239         return -1;
 240 }
 241
 242 /* VPN packet I/O */
 243
 244 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 245         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 246                            packet->len, n->name, n->hostname);
 247
 248         n->in_packets++;
 249         n->in_bytes += packet->len;
 250
 251         route(n, packet);
 252 }
 253
 254 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 255         if(n->status.sptps)
 256                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 257
 258         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 259                 return false;
 260
 261         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 262 }
 263
 264 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 265         vpn_packet_t pkt1, pkt2;
 266         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 267         int nextpkt = 0;
 268         vpn_packet_t *outpkt = pkt[0];
 269         size_t outlen;
 270
 271         if(n->status.sptps) {
 272                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 273                 return;
 274         }
 275
 276         if(!cipher_active(&n->incipher)) {
 277                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 278                                         n->name, n->hostname);
 279                 return;
 280         }
 281
 282         /* Check packet length */
 283
 284         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 285                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 286                                         n->name, n->hostname);
 287                 return;
 288         }
 289
 290         /* Check the message authentication code */
 291
 292         if(digest_active(&n->indigest)) {
 293                 inpkt->len -= n->indigest.maclength;
 294                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 295                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 296                         return;
 297                 }
 298         }
 299         /* Decrypt the packet */
 300
 301         if(cipher_active(&n->incipher)) {
 302                 outpkt = pkt[nextpkt++];
 303                 outlen = MAXSIZE;
 304
 305                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 306                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 307                         return;
 308                 }
 309
 310                 outpkt->len = outlen;
 311                 inpkt = outpkt;
 312         }
 313
 314         /* Check the sequence number */
 315
 316         inpkt->len -= sizeof inpkt->seqno;
 317         inpkt->seqno = ntohl(inpkt->seqno);
 318
 319         if(replaywin) {
 320                 if(inpkt->seqno != n->received_seqno + 1) {
 321                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 322                                 if(n->farfuture++ < replaywin >> 2) {
 323                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 324                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 325                                         return;
 326                                 }
 327                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 328                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 329                                 memset(n->late, 0, replaywin);
 330                         } else if (inpkt->seqno <= n->received_seqno) {
 331                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 332                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 333                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 334                                         return;
 335                                 }
 336                         } else {
 337                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 338                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 339                         }
 340                 }
 341
 342                 n->farfuture = 0;
 343                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 344         }
 345
 346         if(inpkt->seqno > n->received_seqno)
 347                 n->received_seqno = inpkt->seqno;
 348
 349         if(n->received_seqno > MAX_SEQNO)
 350                 regenerate_key();
 351
 352         /* Decompress the packet */
 353
 354         length_t origlen = inpkt->len;
 355
 356         if(n->incompression) {
 357                 outpkt = pkt[nextpkt++];
 358
 359                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 360                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 361                                                  n->name, n->hostname);
 362                         return;
 363                 }
 364
 365                 inpkt = outpkt;
 366
 367                 origlen -= MTU/64 + 20;
 368         }
 369
 370         inpkt->priority = 0;
 371
 372         if(!inpkt->data[12] && !inpkt->data[13])
 373                 mtu_probe_h(n, inpkt, origlen);
 374         else
 375                 receive_packet(n, inpkt);
 376 }
 377
 378 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 379         vpn_packet_t outpkt;
 380
 381         outpkt.len = len;
 382         if(c->options & OPTION_TCPONLY)
 383                 outpkt.priority = 0;
 384         else
 385                 outpkt.priority = -1;
 386         memcpy(outpkt.data, buffer, len);
 387
 388         receive_packet(c->node, &outpkt);
 389 }
 390
 391 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 392         if(!n->status.validkey) {
 393                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 394                 if(!n->status.waitingforkey)
 395                         send_req_key(n);
 396                 else if(n->last_req_key + 10 < time(NULL)) {
 397                         sptps_stop(&n->sptps);
 398                         n->status.waitingforkey = false;
 399                         send_req_key(n);
 400                 }
 401                 return;
 402         }
 403
 404         uint8_t type = 0;
 405         int offset = 0;
 406
 407         if(!(origpkt->data[12] | origpkt->data[13])) {
 408                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 409                 return;
 410         }
 411
 412         if(routing_mode == RMODE_ROUTER)
 413                 offset = 14;
 414         else
 415                 type = PKT_MAC;
 416
 417         if(origpkt->len < offset)
 418                 return;
 419
 420         vpn_packet_t outpkt;
 421
 422         if(n->outcompression) {
 423                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 424                 if(len < 0) {
 425                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 426                 } else if(len < origpkt->len - offset) {
 427                         outpkt.len = len + offset;
 428                         origpkt = &outpkt;
 429                         type |= PKT_COMPRESSED;
 430                 }
 431         }
 432
 433         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 434         return;
 435 }
 436
 437 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 438         vpn_packet_t pkt1, pkt2;
 439         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 440         vpn_packet_t *inpkt = origpkt;
 441         int nextpkt = 0;
 442         vpn_packet_t *outpkt;
 443         int origlen = origpkt->len;
 444         size_t outlen;
 445 #if defined(SOL_IP) && defined(IP_TOS)
 446         static int priority = 0;
 447 #endif
 448         int origpriority = origpkt->priority;
 449
 450         if(!n->status.reachable) {
 451                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 452                 return;
 453         }
 454
 455         if(n->status.sptps)
 456                 return send_sptps_packet(n, origpkt);
 457
 458         /* Make sure we have a valid key */
 459
 460         if(!n->status.validkey) {
 461                 time_t now = time(NULL);
 462
 463                 logger(DEBUG_TRAFFIC, LOG_INFO,
 464                                    "No valid key known yet for %s (%s), forwarding via TCP",
 465                                    n->name, n->hostname);
 466
 467                 if(n->last_req_key + 10 <= now) {
 468                         send_req_key(n);
 469                         n->last_req_key = now;
 470                 }
 471
 472                 send_tcppacket(n->nexthop->connection, origpkt);
 473
 474                 return;
 475         }
 476
 477         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 478                 logger(DEBUG_TRAFFIC, LOG_INFO,
 479                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 480                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 481
 482                 if(n != n->nexthop)
 483                         send_packet(n->nexthop, origpkt);
 484                 else
 485                         send_tcppacket(n->nexthop->connection, origpkt);
 486
 487                 return;
 488         }
 489
 490         /* Compress the packet */
 491
 492         if(n->outcompression) {
 493                 outpkt = pkt[nextpkt++];
 494
 495                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 496                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 497                                    n->name, n->hostname);
 498                         return;
 499                 }
 500
 501                 inpkt = outpkt;
 502         }
 503
 504         /* Add sequence number */
 505
 506         inpkt->seqno = htonl(++(n->sent_seqno));
 507         inpkt->len += sizeof inpkt->seqno;
 508
 509         /* Encrypt the packet */
 510
 511         if(cipher_active(&n->outcipher)) {
 512                 outpkt = pkt[nextpkt++];
 513                 outlen = MAXSIZE;
 514
 515                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 516                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 517                         goto end;
 518                 }
 519
 520                 outpkt->len = outlen;
 521                 inpkt = outpkt;
 522         }
 523
 524         /* Add the message authentication code */
 525
 526         if(digest_active(&n->outdigest)) {
 527                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 528                 inpkt->len += digest_length(&n->outdigest);
 529         }
 530
 531         /* Determine which socket we have to use */
 532
 533         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 534                 for(int sock = 0; sock < listen_sockets; sock++) {
 535                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 536                                 n->sock = sock;
 537                                 break;
 538                         }
 539                 }
 540         }
 541
 542         /* Send the packet */
 543
 544         struct sockaddr *sa;
 545         socklen_t sl;
 546         int sock;
 547
 548         /* Overloaded use of priority field: -1 means local broadcast */
 549
 550         if(origpriority == -1 && n->prevedge) {
 551                 struct sockaddr_in in;
 552                 in.sin_family = AF_INET;
 553                 in.sin_addr.s_addr = -1;
 554                 in.sin_port = n->prevedge->address.in.sin_port;
 555                 sa = (struct sockaddr *)&in;
 556                 sl = sizeof in;
 557                 sock = 0;
 558         } else {
 559                 if(origpriority == -1)
 560                         origpriority = 0;
 561
 562                 sa = &(n->address.sa);
 563                 sl = SALEN(n->address.sa);
 564                 sock = n->sock;
 565         }
 566
 567 #if defined(SOL_IP) && defined(IP_TOS)
 568         if(priorityinheritance && origpriority != priority
 569            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 570                 priority = origpriority;
 571                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 572                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 573                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 574         }
 575 #endif
 576
 577         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 578                 if(sockmsgsize(sockerrno)) {
 579                         if(n->maxmtu >= origlen)
 580                                 n->maxmtu = origlen - 1;
 581                         if(n->mtu >= origlen)
 582                                 n->mtu = origlen - 1;
 583                 } else
 584                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 585         }
 586
 587 end:
 588         origpkt->len = origlen;
 589 }
 590
 591 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 592         node_t *to = handle;
 593
 594         if(type >= SPTPS_HANDSHAKE
 595                         || ((myself->options | to->options) & OPTION_TCPONLY)
 596                         || (type != PKT_PROBE && len > to->minmtu)) {
 597                 char buf[len * 4 / 3 + 5];
 598                 b64encode(data, buf, len);
 599                 if(!to->status.validkey)
 600                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 601                 else
 602                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, type >= SPTPS_HANDSHAKE ? REQ_SPTPS : REQ_PACKET, buf);
 603         }
 604
 605         /* Send the packet */
 606
 607         struct sockaddr *sa;
 608         socklen_t sl;
 609         int sock;
 610
 611         sa = &(to->address.sa);
 612         sl = SALEN(to->address.sa);
 613         sock = to->sock;
 614
 615         if(sendto(listen_socket[sock].udp, data, len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 616                 if(sockmsgsize(sockerrno)) {
 617                         if(to->maxmtu >= len)
 618                                 to->maxmtu = len - 1;
 619                         if(to->mtu >= len)
 620                                 to->mtu = len - 1;
 621                 } else {
 622                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 623                         return false;
 624                 }
 625         }
 626
 627         return true;
 628 }
 629
 630 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 631         node_t *from = handle;
 632
 633         if(type == SPTPS_HANDSHAKE) {
 634                 from->status.validkey = true;
 635                 from->status.waitingforkey = false;
 636                 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 637                 return true;
 638         }
 639
 640         if(len > MTU) {
 641                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 642                 return false;
 643         }
 644
 645         vpn_packet_t inpkt;
 646
 647         if(type == PKT_PROBE) {
 648                 inpkt.len = len;
 649                 memcpy(inpkt.data, data, len);
 650                 mtu_probe_h(from, &inpkt, len);
 651                 return true;
 652         }
 653
 654         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 655                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 656                 return false;
 657         }
 658
 659         /* Check if we have the headers we need */
 660         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 661                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 662                 return false;
 663         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 664                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 665         }
 666
 667         int offset = (type & PKT_MAC) ? 0 : 14;
 668         if(type & PKT_COMPRESSED) {
 669                 len = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 670                 if(len < 0) {
 671                         return false;
 672                 } else {
 673                         inpkt.len = len + offset;
 674                 }
 675                 if(inpkt.len > MAXSIZE)
 676                         abort();
 677         } else {
 678                 memcpy(inpkt.data + offset, data, len);
 679                 inpkt.len = len + offset;
 680         }
 681
 682         /* Generate the Ethernet packet type if necessary */
 683         if(offset) {
 684                 switch(inpkt.data[14] >> 4) {
 685                         case 4:
 686                                 inpkt.data[12] = 0x08;
 687                                 inpkt.data[13] = 0x00;
 688                                 break;
 689                         case 6:
 690                                 inpkt.data[12] = 0x86;
 691                                 inpkt.data[13] = 0xDD;
 692                                 break;
 693                         default:
 694                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 695                                                    "Unknown IP version %d while reading packet from %s (%s)",
 696                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 697                                 return false;
 698                 }
 699         }
 700
 701         receive_packet(from, &inpkt);
 702         return true;
 703 }
 704
 705 /*
 706   send a packet to the given vpn ip.
 707 */
 708 void send_packet(node_t *n, vpn_packet_t *packet) {
 709         node_t *via;
 710
 711         if(n == myself) {
 712                 if(overwrite_mac)
 713                          memcpy(packet->data, mymac.x, ETH_ALEN);
 714                 n->out_packets++;
 715                 n->out_bytes += packet->len;
 716                 devops.write(packet);
 717                 return;
 718         }
 719
 720         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 721                            packet->len, n->name, n->hostname);
 722
 723         if(!n->status.reachable) {
 724                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 725                                    n->name, n->hostname);
 726                 return;
 727         }
 728
 729         n->out_packets++;
 730         n->out_bytes += packet->len;
 731
 732         if(n->status.sptps) {
 733                 send_sptps_packet(n, packet);
 734                 return;
 735         }
 736
 737         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 738
 739         if(via != n)
 740                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 741                            n->name, via->name, n->via->hostname);
 742
 743         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 744                 if(!send_tcppacket(via->connection, packet))
 745                         terminate_connection(via->connection, true);
 746         } else
 747                 send_udppacket(via, packet);
 748 }
 749
 750 /* Broadcast a packet using the minimum spanning tree */
 751
 752 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 753         splay_node_t *node;
 754         connection_t *c;
 755         node_t *n;
 756
 757         // Always give ourself a copy of the packet.
 758         if(from != myself)
 759                 send_packet(myself, packet);
 760
 761         // In TunnelServer mode, do not forward broadcast packets.
 762         // The MST might not be valid and create loops.
 763         if(tunnelserver || broadcast_mode == BMODE_NONE)
 764                 return;
 765
 766         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 767                            packet->len, from->name, from->hostname);
 768
 769         switch(broadcast_mode) {
 770                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 771                 // This guarantees all nodes receive the broadcast packet, and
 772                 // usually distributes the sending of broadcast packets over all nodes.
 773                 case BMODE_MST:
 774                         for(node = connection_tree->head; node; node = node->next) {
 775                                 c = node->data;
 776
 777                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 778                                         send_packet(c->node, packet);
 779                         }
 780                         break;
 781
 782                 // In direct mode, we send copies to each node we know of.
 783                 // However, this only reaches nodes that can be reached in a single hop.
 784                 // We don't have enough information to forward broadcast packets in this case.
 785                 case BMODE_DIRECT:
 786                         if(from != myself)
 787                                 break;
 788
 789                         for(node = node_tree->head; node; node = node->next) {
 790                                 n = node->data;
 791
 792                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 793                                         send_packet(n, packet);
 794                         }
 795                         break;
 796
 797                 default:
 798                         break;
 799         }
 800 }
 801
 802 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 803         splay_node_t *node;
 804         edge_t *e;
 805         node_t *n = NULL;
 806         bool hard = false;
 807         static time_t last_hard_try = 0;
 808         time_t now = time(NULL);
 809
 810         for(node = edge_weight_tree->head; node; node = node->next) {
 811                 e = node->data;
 812
 813                 if(!e->to->status.reachable || e->to == myself)
 814                         continue;
 815
 816                 if(sockaddrcmp_noport(from, &e->address)) {
 817                         if(last_hard_try == now)
 818                                 continue;
 819                         hard = true;
 820                 }
 821
 822                 if(!try_mac(e->to, pkt))
 823                         continue;
 824
 825                 n = e->to;
 826                 break;
 827         }
 828
 829         if(hard)
 830                 last_hard_try = now;
 831
 832         last_hard_try = now;
 833         return n;
 834 }
 835
 836 void handle_incoming_vpn_data(int sock, short events, void *data) {
 837         vpn_packet_t pkt;
 838         char *hostname;
 839         sockaddr_t from = {{0}};
 840         socklen_t fromlen = sizeof from;
 841         node_t *n;
 842         int len;
 843
 844         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 845
 846         if(len <= 0 || len > MAXSIZE) {
 847                 if(!sockwouldblock(sockerrno))
 848                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 849                 return;
 850         }
 851
 852         pkt.len = len;
 853
 854         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 855
 856         n = lookup_node_udp(&from);
 857
 858         if(!n) {
 859                 n = try_harder(&from, &pkt);
 860                 if(n)
 861                         update_node_udp(n, &from);
 862                 else if(debug_level >= DEBUG_PROTOCOL) {
 863                         hostname = sockaddr2hostname(&from);
 864                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 865                         free(hostname);
 866                         return;
 867                 }
 868                 else
 869                         return;
 870         }
 871
 872         n->sock = (intptr_t)data;
 873
 874         receive_udppacket(n, &pkt);
 875 }
 876
 877 void handle_device_data(int sock, short events, void *data) {
 878         vpn_packet_t packet;
 879
 880         packet.priority = 0;
 881
 882         if(devops.read(&packet)) {
 883                 myself->in_packets++;
 884                 myself->in_bytes += packet.len;
 885                 route(myself, &packet);
 886         }
 887 }