tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "cipher.h"
  40 #include "conf.h"
  41 #include "connection.h"
  42 #include "crypto.h"
  43 #include "digest.h"
  44 #include "device.h"
  45 #include "ethernet.h"
  46 #include "graph.h"
  47 #include "logger.h"
  48 #include "net.h"
  49 #include "netutl.h"
  50 #include "protocol.h"
  51 #include "process.h"
  52 #include "route.h"
  53 #include "utils.h"
  54 #include "xalloc.h"
  55
  56 int keylifetime = 0;
  57 #ifdef HAVE_LZO
  58 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  59 #endif
  60
  61 static void send_udppacket(node_t *, vpn_packet_t *);
  62
  63 unsigned replaywin = 16;
  64 bool localdiscovery = false;
  65
  66 #define MAX_SEQNO 1073741824
  67
  68 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  69    mtuprobes ==    31: sleep pinginterval seconds
  70    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  71    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  72
  73    Probes are sent in batches of three, with random sizes between the lower and
  74    upper boundaries for the MTU thus far discovered.
  75
  76    In case local discovery is enabled, a fourth packet is added to each batch,
  77    which will be broadcast to the local network.
  78 */
  79
  80 static void send_mtu_probe_handler(int fd, short events, void *data) {
  81         node_t *n = data;
  82         int timeout = 1;
  83
  84         n->mtuprobes++;
  85
  86         if(!n->status.reachable || !n->status.validkey) {
  87                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  88                 n->mtuprobes = 0;
  89                 return;
  90         }
  91
  92         if(n->mtuprobes > 32) {
  93                 if(!n->minmtu) {
  94                         n->mtuprobes = 31;
  95                         timeout = pinginterval;
  96                         goto end;
  97                 }
  98
  99                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 100                 n->status.udp_confirmed = false;
 101                 n->mtuprobes = 1;
 102                 n->minmtu = 0;
 103                 n->maxmtu = MTU;
 104         }
 105
 106         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 107                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 108                 n->mtuprobes = 31;
 109         }
 110
 111         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 112                 if(n->minmtu > n->maxmtu)
 113                         n->minmtu = n->maxmtu;
 114                 else
 115                         n->maxmtu = n->minmtu;
 116                 n->mtu = n->minmtu;
 117                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 118                 n->mtuprobes = 31;
 119         }
 120
 121         if(n->mtuprobes == 31) {
 122                 timeout = pinginterval;
 123                 goto end;
 124         } else if(n->mtuprobes == 32) {
 125                 timeout = pingtimeout;
 126         }
 127
 128         for(int i = 0; i < 3 + localdiscovery; i++) {
 129                 int len;
 130
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 vpn_packet_t packet;
 140                 memset(packet.data, 0, 14);
 141                 randomize(packet.data + 14, len - 14);
 142                 packet.len = len;
 143                 if(i >= 3 && n->mtuprobes <= 10)
 144                         packet.priority = -1;
 145                 else
 146                         packet.priority = 0;
 147
 148                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 149
 150                 send_udppacket(n, &packet);
 151         }
 152
 153 end:
 154         event_add(&n->mtuevent, &(struct timeval){timeout, 0});
 155 }
 156
 157 void send_mtu_probe(node_t *n) {
 158         if(!timeout_initialized(&n->mtuevent))
 159                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 160         send_mtu_probe_handler(0, 0, n);
 161 }
 162
 163 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 164         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 165
 166         if(!packet->data[0]) {
 167                 packet->data[0] = 1;
 168                 send_udppacket(n, packet);
 169         } else {
 170                 n->status.udp_confirmed = true;
 171
 172                 if(n->mtuprobes > 30) {
 173                         if(n->minmtu)
 174                                 n->mtuprobes = 30;
 175                         else
 176                                 n->mtuprobes = 1;
 177                 }
 178
 179                 if(len > n->maxmtu)
 180                         len = n->maxmtu;
 181                 if(n->minmtu < len)
 182                         n->minmtu = len;
 183         }
 184 }
 185
 186 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 187         if(level == 0) {
 188                 memcpy(dest, source, len);
 189                 return len;
 190         } else if(level == 10) {
 191 #ifdef HAVE_LZO
 192                 lzo_uint lzolen = MAXSIZE;
 193                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 194                 return lzolen;
 195 #else
 196                 return -1;
 197 #endif
 198         } else if(level < 10) {
 199 #ifdef HAVE_ZLIB
 200                 unsigned long destlen = MAXSIZE;
 201                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 202                         return destlen;
 203                 else
 204 #endif
 205                         return -1;
 206         } else {
 207 #ifdef HAVE_LZO
 208                 lzo_uint lzolen = MAXSIZE;
 209                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 210                 return lzolen;
 211 #else
 212                 return -1;
 213 #endif
 214         }
 215
 216         return -1;
 217 }
 218
 219 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 220         if(level == 0) {
 221                 memcpy(dest, source, len);
 222                 return len;
 223         } else if(level > 9) {
 224 #ifdef HAVE_LZO
 225                 lzo_uint lzolen = MAXSIZE;
 226                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 227                         return lzolen;
 228                 else
 229 #endif
 230                         return -1;
 231         }
 232 #ifdef HAVE_ZLIB
 233         else {
 234                 unsigned long destlen = MAXSIZE;
 235                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 236                         return destlen;
 237                 else
 238                         return -1;
 239         }
 240 #endif
 241
 242         return -1;
 243 }
 244
 245 /* VPN packet I/O */
 246
 247 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 248         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 249                            packet->len, n->name, n->hostname);
 250
 251         n->in_packets++;
 252         n->in_bytes += packet->len;
 253
 254         route(n, packet);
 255 }
 256
 257 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 258         if(n->status.sptps)
 259                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 260
 261         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 262                 return false;
 263
 264         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 265 }
 266
 267 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 268         vpn_packet_t pkt1, pkt2;
 269         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 270         int nextpkt = 0;
 271         vpn_packet_t *outpkt = pkt[0];
 272         size_t outlen;
 273
 274         if(n->status.sptps) {
 275                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 276                 return;
 277         }
 278
 279         if(!cipher_active(&n->incipher)) {
 280                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 281                                         n->name, n->hostname);
 282                 return;
 283         }
 284
 285         /* Check packet length */
 286
 287         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 288                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 289                                         n->name, n->hostname);
 290                 return;
 291         }
 292
 293         /* Check the message authentication code */
 294
 295         if(digest_active(&n->indigest)) {
 296                 inpkt->len -= n->indigest.maclength;
 297                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 298                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 299                         return;
 300                 }
 301         }
 302         /* Decrypt the packet */
 303
 304         if(cipher_active(&n->incipher)) {
 305                 outpkt = pkt[nextpkt++];
 306                 outlen = MAXSIZE;
 307
 308                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 309                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 310                         return;
 311                 }
 312
 313                 outpkt->len = outlen;
 314                 inpkt = outpkt;
 315         }
 316
 317         /* Check the sequence number */
 318
 319         inpkt->len -= sizeof inpkt->seqno;
 320         inpkt->seqno = ntohl(inpkt->seqno);
 321
 322         if(replaywin) {
 323                 if(inpkt->seqno != n->received_seqno + 1) {
 324                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 325                                 if(n->farfuture++ < replaywin >> 2) {
 326                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 327                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 328                                         return;
 329                                 }
 330                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 331                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 332                                 memset(n->late, 0, replaywin);
 333                         } else if (inpkt->seqno <= n->received_seqno) {
 334                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 335                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 336                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 337                                         return;
 338                                 }
 339                         } else {
 340                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 341                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 342                         }
 343                 }
 344
 345                 n->farfuture = 0;
 346                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 347         }
 348
 349         if(inpkt->seqno > n->received_seqno)
 350                 n->received_seqno = inpkt->seqno;
 351
 352         if(n->received_seqno > MAX_SEQNO)
 353                 regenerate_key();
 354
 355         /* Decompress the packet */
 356
 357         length_t origlen = inpkt->len;
 358
 359         if(n->incompression) {
 360                 outpkt = pkt[nextpkt++];
 361
 362                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 363                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 364                                                  n->name, n->hostname);
 365                         return;
 366                 }
 367
 368                 inpkt = outpkt;
 369
 370                 origlen -= MTU/64 + 20;
 371         }
 372
 373         inpkt->priority = 0;
 374
 375         if(!inpkt->data[12] && !inpkt->data[13])
 376                 mtu_probe_h(n, inpkt, origlen);
 377         else
 378                 receive_packet(n, inpkt);
 379 }
 380
 381 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 382         vpn_packet_t outpkt;
 383
 384         outpkt.len = len;
 385         if(c->options & OPTION_TCPONLY)
 386                 outpkt.priority = 0;
 387         else
 388                 outpkt.priority = -1;
 389         memcpy(outpkt.data, buffer, len);
 390
 391         receive_packet(c->node, &outpkt);
 392 }
 393
 394 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 395         if(!n->status.validkey) {
 396                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 397                 if(!n->status.waitingforkey)
 398                         send_req_key(n);
 399                 else if(n->last_req_key + 10 < time(NULL)) {
 400                         sptps_stop(&n->sptps);
 401                         n->status.waitingforkey = false;
 402                         send_req_key(n);
 403                 }
 404                 return;
 405         }
 406
 407         uint8_t type = 0;
 408         int offset = 0;
 409
 410         if(!(origpkt->data[12] | origpkt->data[13])) {
 411                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 412                 return;
 413         }
 414
 415         if(routing_mode == RMODE_ROUTER)
 416                 offset = 14;
 417         else
 418                 type = PKT_MAC;
 419
 420         if(origpkt->len < offset)
 421                 return;
 422
 423         vpn_packet_t outpkt;
 424
 425         if(n->outcompression) {
 426                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 427                 if(len < 0) {
 428                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 429                 } else if(len < origpkt->len - offset) {
 430                         outpkt.len = len + offset;
 431                         origpkt = &outpkt;
 432                         type |= PKT_COMPRESSED;
 433                 }
 434         }
 435
 436         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 437         return;
 438 }
 439
 440 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 441         vpn_packet_t pkt1, pkt2;
 442         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 443         vpn_packet_t *inpkt = origpkt;
 444         int nextpkt = 0;
 445         vpn_packet_t *outpkt;
 446         int origlen = origpkt->len;
 447         size_t outlen;
 448 #if defined(SOL_IP) && defined(IP_TOS)
 449         static int priority = 0;
 450 #endif
 451         int origpriority = origpkt->priority;
 452
 453         if(!n->status.reachable) {
 454                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 455                 return;
 456         }
 457
 458         if(n->status.sptps)
 459                 return send_sptps_packet(n, origpkt);
 460
 461         /* Make sure we have a valid key */
 462
 463         if(!n->status.validkey) {
 464                 time_t now = time(NULL);
 465
 466                 logger(DEBUG_TRAFFIC, LOG_INFO,
 467                                    "No valid key known yet for %s (%s), forwarding via TCP",
 468                                    n->name, n->hostname);
 469
 470                 if(n->last_req_key + 10 <= now) {
 471                         send_req_key(n);
 472                         n->last_req_key = now;
 473                 }
 474
 475                 send_tcppacket(n->nexthop->connection, origpkt);
 476
 477                 return;
 478         }
 479
 480         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 481                 logger(DEBUG_TRAFFIC, LOG_INFO,
 482                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 483                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 484
 485                 if(n != n->nexthop)
 486                         send_packet(n->nexthop, origpkt);
 487                 else
 488                         send_tcppacket(n->nexthop->connection, origpkt);
 489
 490                 return;
 491         }
 492
 493         /* Compress the packet */
 494
 495         if(n->outcompression) {
 496                 outpkt = pkt[nextpkt++];
 497
 498                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 499                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 500                                    n->name, n->hostname);
 501                         return;
 502                 }
 503
 504                 inpkt = outpkt;
 505         }
 506
 507         /* Add sequence number */
 508
 509         inpkt->seqno = htonl(++(n->sent_seqno));
 510         inpkt->len += sizeof inpkt->seqno;
 511
 512         /* Encrypt the packet */
 513
 514         if(cipher_active(&n->outcipher)) {
 515                 outpkt = pkt[nextpkt++];
 516                 outlen = MAXSIZE;
 517
 518                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 519                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 520                         goto end;
 521                 }
 522
 523                 outpkt->len = outlen;
 524                 inpkt = outpkt;
 525         }
 526
 527         /* Add the message authentication code */
 528
 529         if(digest_active(&n->outdigest)) {
 530                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 531                 inpkt->len += digest_length(&n->outdigest);
 532         }
 533
 534         /* Send the packet */
 535
 536         sockaddr_t *sa;
 537         int sock;
 538
 539         /* Overloaded use of priority field: -1 means local broadcast */
 540
 541         if(origpriority == -1 && n->prevedge) {
 542                 sockaddr_t broadcast;
 543                 broadcast.in.sin_family = AF_INET;
 544                 broadcast.in.sin_addr.s_addr = -1;
 545                 broadcast.in.sin_port = n->prevedge->address.in.sin_port;
 546                 sa = &broadcast;
 547                 sock = 0;
 548         } else {
 549                 if(origpriority == -1)
 550                         origpriority = 0;
 551
 552                 if(n->status.udp_confirmed) {
 553                         /* Address of this node is confirmed, so use it. */
 554                         sa = &n->address;
 555                         sock = n->sock;
 556                 } else {
 557                         /* Otherwise, go through the list of known addresses of
 558                            this node. The first address we try is always the
 559                            one in n->address; that could be set to the node's
 560                            reflexive UDP address discovered during key
 561                            exchange. The other known addresses are those found
 562                            in edges to this node. */
 563
 564                         static unsigned int i;
 565                         int j = 0;
 566                         edge_t *candidate = NULL;
 567
 568                         if(i) {
 569                                 for splay_each(edge_t, e, edge_weight_tree) {
 570                                         if(e->to != n)
 571                                                 continue;
 572                                         j++;
 573                                         if(!candidate || j == i)
 574                                                 candidate = e;
 575                                 }
 576                         }
 577
 578                         if(!candidate) {
 579                                 sa = &n->address;
 580                                 sock = n->sock;
 581                         } else {
 582                                 sa = &candidate->address;
 583                                 sock = rand() % listen_sockets;
 584                         }
 585
 586                         if(i++)
 587                                 if(i > j)
 588                                         i = 0;
 589                 }
 590         }
 591
 592         /* Determine which socket we have to use */
 593
 594         if(sa->sa.sa_family != listen_socket[sock].sa.sa.sa_family)
 595                 for(sock = 0; sock < listen_sockets; sock++)
 596                         if(sa->sa.sa_family == listen_socket[sock].sa.sa.sa_family)
 597                                 break;
 598
 599         if(sock >= listen_sockets)
 600                 sock = 0;
 601
 602         if(!n->status.udp_confirmed)
 603                 n->sock = sock;
 604
 605 #if defined(SOL_IP) && defined(IP_TOS)
 606         if(priorityinheritance && origpriority != priority
 607            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 608                 priority = origpriority;
 609                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 610                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 611                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 612         }
 613 #endif
 614
 615         socklen_t sl = SALEN(n->address.sa);
 616
 617         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 618                 if(sockmsgsize(sockerrno)) {
 619                         if(n->maxmtu >= origlen)
 620                                 n->maxmtu = origlen - 1;
 621                         if(n->mtu >= origlen)
 622                                 n->mtu = origlen - 1;
 623                 } else
 624                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 625         }
 626
 627 end:
 628         origpkt->len = origlen;
 629 }
 630
 631 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 632         node_t *to = handle;
 633
 634         if(type >= SPTPS_HANDSHAKE
 635                         || ((myself->options | to->options) & OPTION_TCPONLY)
 636                         || (type != PKT_PROBE && len > to->minmtu)) {
 637                 char buf[len * 4 / 3 + 5];
 638                 b64encode(data, buf, len);
 639                 if(!to->status.validkey)
 640                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 641                 else
 642                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, type >= SPTPS_HANDSHAKE ? REQ_SPTPS : REQ_PACKET, buf);
 643         }
 644
 645         /* Send the packet */
 646
 647         struct sockaddr *sa;
 648         socklen_t sl;
 649         int sock;
 650
 651         sa = &(to->address.sa);
 652         sl = SALEN(to->address.sa);
 653         sock = to->sock;
 654
 655         if(sendto(listen_socket[sock].udp, data, len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 656                 if(sockmsgsize(sockerrno)) {
 657                         if(to->maxmtu >= len)
 658                                 to->maxmtu = len - 1;
 659                         if(to->mtu >= len)
 660                                 to->mtu = len - 1;
 661                 } else {
 662                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 663                         return false;
 664                 }
 665         }
 666
 667         return true;
 668 }
 669
 670 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 671         node_t *from = handle;
 672
 673         if(type == SPTPS_HANDSHAKE) {
 674                 from->status.validkey = true;
 675                 from->status.waitingforkey = false;
 676                 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 677                 return true;
 678         }
 679
 680         if(len > MTU) {
 681                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 682                 return false;
 683         }
 684
 685         vpn_packet_t inpkt;
 686
 687         if(type == PKT_PROBE) {
 688                 inpkt.len = len;
 689                 memcpy(inpkt.data, data, len);
 690                 mtu_probe_h(from, &inpkt, len);
 691                 return true;
 692         }
 693
 694         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 695                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 696                 return false;
 697         }
 698
 699         /* Check if we have the headers we need */
 700         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 701                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 702                 return false;
 703         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 704                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 705         }
 706
 707         int offset = (type & PKT_MAC) ? 0 : 14;
 708         if(type & PKT_COMPRESSED) {
 709                 len = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 710                 if(len < 0) {
 711                         return false;
 712                 } else {
 713                         inpkt.len = len + offset;
 714                 }
 715                 if(inpkt.len > MAXSIZE)
 716                         abort();
 717         } else {
 718                 memcpy(inpkt.data + offset, data, len);
 719                 inpkt.len = len + offset;
 720         }
 721
 722         /* Generate the Ethernet packet type if necessary */
 723         if(offset) {
 724                 switch(inpkt.data[14] >> 4) {
 725                         case 4:
 726                                 inpkt.data[12] = 0x08;
 727                                 inpkt.data[13] = 0x00;
 728                                 break;
 729                         case 6:
 730                                 inpkt.data[12] = 0x86;
 731                                 inpkt.data[13] = 0xDD;
 732                                 break;
 733                         default:
 734                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 735                                                    "Unknown IP version %d while reading packet from %s (%s)",
 736                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 737                                 return false;
 738                 }
 739         }
 740
 741         receive_packet(from, &inpkt);
 742         return true;
 743 }
 744
 745 /*
 746   send a packet to the given vpn ip.
 747 */
 748 void send_packet(node_t *n, vpn_packet_t *packet) {
 749         node_t *via;
 750
 751         if(n == myself) {
 752                 if(overwrite_mac)
 753                          memcpy(packet->data, mymac.x, ETH_ALEN);
 754                 n->out_packets++;
 755                 n->out_bytes += packet->len;
 756                 devops.write(packet);
 757                 return;
 758         }
 759
 760         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 761                            packet->len, n->name, n->hostname);
 762
 763         if(!n->status.reachable) {
 764                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 765                                    n->name, n->hostname);
 766                 return;
 767         }
 768
 769         n->out_packets++;
 770         n->out_bytes += packet->len;
 771
 772         if(n->status.sptps) {
 773                 send_sptps_packet(n, packet);
 774                 return;
 775         }
 776
 777         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 778
 779         if(via != n)
 780                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 781                            n->name, via->name, n->via->hostname);
 782
 783         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 784                 if(!send_tcppacket(via->connection, packet))
 785                         terminate_connection(via->connection, true);
 786         } else
 787                 send_udppacket(via, packet);
 788 }
 789
 790 /* Broadcast a packet using the minimum spanning tree */
 791
 792 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 793         // Always give ourself a copy of the packet.
 794         if(from != myself)
 795                 send_packet(myself, packet);
 796
 797         // In TunnelServer mode, do not forward broadcast packets.
 798         // The MST might not be valid and create loops.
 799         if(tunnelserver || broadcast_mode == BMODE_NONE)
 800                 return;
 801
 802         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 803                            packet->len, from->name, from->hostname);
 804
 805         switch(broadcast_mode) {
 806                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 807                 // This guarantees all nodes receive the broadcast packet, and
 808                 // usually distributes the sending of broadcast packets over all nodes.
 809                 case BMODE_MST:
 810                         for list_each(connection_t, c, connection_list)
 811                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 812                                         send_packet(c->node, packet);
 813                         break;
 814
 815                 // In direct mode, we send copies to each node we know of.
 816                 // However, this only reaches nodes that can be reached in a single hop.
 817                 // We don't have enough information to forward broadcast packets in this case.
 818                 case BMODE_DIRECT:
 819                         if(from != myself)
 820                                 break;
 821
 822                         for splay_each(node_t, n, node_tree)
 823                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 824                                         send_packet(n, packet);
 825                         break;
 826
 827                 default:
 828                         break;
 829         }
 830 }
 831
 832 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 833         node_t *n = NULL;
 834         bool hard = false;
 835         static time_t last_hard_try = 0;
 836         time_t now = time(NULL);
 837
 838         for splay_each(edge_t, e, edge_weight_tree) {
 839                 if(!e->to->status.reachable || e->to == myself)
 840                         continue;
 841
 842                 if(sockaddrcmp_noport(from, &e->address)) {
 843                         if(last_hard_try == now)
 844                                 continue;
 845                         hard = true;
 846                 }
 847
 848                 if(!try_mac(e->to, pkt))
 849                         continue;
 850
 851                 n = e->to;
 852                 break;
 853         }
 854
 855         if(hard)
 856                 last_hard_try = now;
 857
 858         last_hard_try = now;
 859         return n;
 860 }
 861
 862 void handle_incoming_vpn_data(int sock, short events, void *data) {
 863         vpn_packet_t pkt;
 864         char *hostname;
 865         sockaddr_t from = {{0}};
 866         socklen_t fromlen = sizeof from;
 867         node_t *n;
 868         int len;
 869
 870         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 871
 872         if(len <= 0 || len > MAXSIZE) {
 873                 if(!sockwouldblock(sockerrno))
 874                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 875                 return;
 876         }
 877
 878         pkt.len = len;
 879
 880         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 881
 882         n = lookup_node_udp(&from);
 883
 884         if(!n) {
 885                 n = try_harder(&from, &pkt);
 886                 if(n)
 887                         update_node_udp(n, &from);
 888                 else if(debug_level >= DEBUG_PROTOCOL) {
 889                         hostname = sockaddr2hostname(&from);
 890                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 891                         free(hostname);
 892                         return;
 893                 }
 894                 else
 895                         return;
 896         }
 897
 898         n->sock = (intptr_t)data;
 899
 900         receive_udppacket(n, &pkt);
 901 }
 902
 903 void handle_device_data(int sock, short events, void *data) {
 904         vpn_packet_t packet;
 905
 906         packet.priority = 0;
 907
 908         if(devops.read(&packet)) {
 909                 myself->in_packets++;
 910                 myself->in_bytes += packet.len;
 911                 route(myself, &packet);
 912         }
 913 }