tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "splay_tree.h"
  40 #include "cipher.h"
  41 #include "conf.h"
  42 #include "connection.h"
  43 #include "crypto.h"
  44 #include "digest.h"
  45 #include "device.h"
  46 #include "ethernet.h"
  47 #include "graph.h"
  48 #include "logger.h"
  49 #include "net.h"
  50 #include "netutl.h"
  51 #include "protocol.h"
  52 #include "process.h"
  53 #include "route.h"
  54 #include "utils.h"
  55 #include "xalloc.h"
  56
  57 int keylifetime = 0;
  58 #ifdef HAVE_LZO
  59 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  60 #endif
  61
  62 static void send_udppacket(node_t *, vpn_packet_t *);
  63
  64 unsigned replaywin = 16;
  65 bool localdiscovery = false;
  66
  67 #define MAX_SEQNO 1073741824
  68
  69 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  70    mtuprobes ==    31: sleep pinginterval seconds
  71    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  72    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  73
  74    Probes are sent in batches of three, with random sizes between the lower and
  75    upper boundaries for the MTU thus far discovered.
  76
  77    In case local discovery is enabled, a fourth packet is added to each batch,
  78    which will be broadcast to the local network.
  79 */
  80
  81 static void send_mtu_probe_handler(int fd, short events, void *data) {
  82         node_t *n = data;
  83         vpn_packet_t packet;
  84         int len, i;
  85         int timeout = 1;
  86
  87         n->mtuprobes++;
  88
  89         if(!n->status.reachable || !n->status.validkey) {
  90                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  91                 n->mtuprobes = 0;
  92                 return;
  93         }
  94
  95         if(n->mtuprobes > 32) {
  96                 if(!n->minmtu) {
  97                         n->mtuprobes = 31;
  98                         timeout = pinginterval;
  99                         goto end;
 100                 }
 101
 102                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 103                 n->mtuprobes = 1;
 104                 n->minmtu = 0;
 105                 n->maxmtu = MTU;
 106         }
 107
 108         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 109                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 110                 n->mtuprobes = 31;
 111         }
 112
 113         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 114                 if(n->minmtu > n->maxmtu)
 115                         n->minmtu = n->maxmtu;
 116                 else
 117                         n->maxmtu = n->minmtu;
 118                 n->mtu = n->minmtu;
 119                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 120                 n->mtuprobes = 31;
 121         }
 122
 123         if(n->mtuprobes == 31) {
 124                 timeout = pinginterval;
 125                 goto end;
 126         } else if(n->mtuprobes == 32) {
 127                 timeout = pingtimeout;
 128         }
 129
 130         for(i = 0; i < 3 + localdiscovery; i++) {
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 memset(packet.data, 0, 14);
 140                 randomize(packet.data + 14, len - 14);
 141                 packet.len = len;
 142                 if(i >= 3 && n->mtuprobes <= 10)
 143                         packet.priority = -1;
 144                 else
 145                         packet.priority = 0;
 146
 147                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 148
 149                 send_udppacket(n, &packet);
 150         }
 151
 152 end:
 153         event_add(&n->mtuevent, &(struct timeval){timeout, 0});
 154 }
 155
 156 void send_mtu_probe(node_t *n) {
 157         if(!timeout_initialized(&n->mtuevent))
 158                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 159         send_mtu_probe_handler(0, 0, n);
 160 }
 161
 162 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 163         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 164
 165         if(!packet->data[0]) {
 166                 packet->data[0] = 1;
 167                 send_udppacket(n, packet);
 168         } else {
 169                 if(n->mtuprobes > 30) {
 170                         if(n->minmtu)
 171                                 n->mtuprobes = 30;
 172                         else
 173                                 n->mtuprobes = 1;
 174                 }
 175
 176                 if(len > n->maxmtu)
 177                         len = n->maxmtu;
 178                 if(n->minmtu < len)
 179                         n->minmtu = len;
 180         }
 181 }
 182
 183 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 184         if(level == 0) {
 185                 memcpy(dest, source, len);
 186                 return len;
 187         } else if(level == 10) {
 188 #ifdef HAVE_LZO
 189                 lzo_uint lzolen = MAXSIZE;
 190                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 191                 return lzolen;
 192 #else
 193                 return -1;
 194 #endif
 195         } else if(level < 10) {
 196 #ifdef HAVE_ZLIB
 197                 unsigned long destlen = MAXSIZE;
 198                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 199                         return destlen;
 200                 else
 201 #endif
 202                         return -1;
 203         } else {
 204 #ifdef HAVE_LZO
 205                 lzo_uint lzolen = MAXSIZE;
 206                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 207                 return lzolen;
 208 #else
 209                 return -1;
 210 #endif
 211         }
 212
 213         return -1;
 214 }
 215
 216 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 217         if(level == 0) {
 218                 memcpy(dest, source, len);
 219                 return len;
 220         } else if(level > 9) {
 221 #ifdef HAVE_LZO
 222                 lzo_uint lzolen = MAXSIZE;
 223                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 224                         return lzolen;
 225                 else
 226 #endif
 227                         return -1;
 228         }
 229 #ifdef HAVE_ZLIB
 230         else {
 231                 unsigned long destlen = MAXSIZE;
 232                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 233                         return destlen;
 234                 else
 235                         return -1;
 236         }
 237 #endif
 238
 239         return -1;
 240 }
 241
 242 /* VPN packet I/O */
 243
 244 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 245         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 246                            packet->len, n->name, n->hostname);
 247
 248         n->in_packets++;
 249         n->in_bytes += packet->len;
 250
 251         route(n, packet);
 252 }
 253
 254 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 255         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 256                 return false;
 257
 258         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 259 }
 260
 261 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 262         vpn_packet_t pkt1, pkt2;
 263         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 264         int nextpkt = 0;
 265         vpn_packet_t *outpkt = pkt[0];
 266         size_t outlen;
 267
 268         if(experimental && OPTION_VERSION(n->options) >= 2) {
 269                 sptps_receive_data(&n->sptps, (char *)inpkt->data - 4, inpkt->len);
 270                 return;
 271         }
 272
 273         if(!cipher_active(&n->incipher)) {
 274                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 275                                         n->name, n->hostname);
 276                 return;
 277         }
 278
 279         /* Check packet length */
 280
 281         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 282                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 283                                         n->name, n->hostname);
 284                 return;
 285         }
 286
 287         /* Check the message authentication code */
 288
 289         if(digest_active(&n->indigest)) {
 290                 inpkt->len -= n->indigest.maclength;
 291                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 292                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 293                         return;
 294                 }
 295         }
 296         /* Decrypt the packet */
 297
 298         if(cipher_active(&n->incipher)) {
 299                 outpkt = pkt[nextpkt++];
 300                 outlen = MAXSIZE;
 301
 302                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 303                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 304                         return;
 305                 }
 306
 307                 outpkt->len = outlen;
 308                 inpkt = outpkt;
 309         }
 310
 311         /* Check the sequence number */
 312
 313         inpkt->len -= sizeof inpkt->seqno;
 314         inpkt->seqno = ntohl(inpkt->seqno);
 315
 316         if(replaywin) {
 317                 if(inpkt->seqno != n->received_seqno + 1) {
 318                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 319                                 if(n->farfuture++ < replaywin >> 2) {
 320                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 321                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 322                                         return;
 323                                 }
 324                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 325                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 326                                 memset(n->late, 0, replaywin);
 327                         } else if (inpkt->seqno <= n->received_seqno) {
 328                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 329                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 330                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 331                                         return;
 332                                 }
 333                         } else {
 334                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 335                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 336                         }
 337                 }
 338
 339                 n->farfuture = 0;
 340                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 341         }
 342
 343         if(inpkt->seqno > n->received_seqno)
 344                 n->received_seqno = inpkt->seqno;
 345
 346         if(n->received_seqno > MAX_SEQNO)
 347                 regenerate_key();
 348
 349         /* Decompress the packet */
 350
 351         length_t origlen = inpkt->len;
 352
 353         if(n->incompression) {
 354                 outpkt = pkt[nextpkt++];
 355
 356                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 357                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 358                                                  n->name, n->hostname);
 359                         return;
 360                 }
 361
 362                 inpkt = outpkt;
 363
 364                 origlen -= MTU/64 + 20;
 365         }
 366
 367         inpkt->priority = 0;
 368
 369         if(!inpkt->data[12] && !inpkt->data[13])
 370                 mtu_probe_h(n, inpkt, origlen);
 371         else
 372                 receive_packet(n, inpkt);
 373 }
 374
 375 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 376         vpn_packet_t outpkt;
 377
 378         outpkt.len = len;
 379         if(c->options & OPTION_TCPONLY)
 380                 outpkt.priority = 0;
 381         else
 382                 outpkt.priority = -1;
 383         memcpy(outpkt.data, buffer, len);
 384
 385         receive_packet(c->node, &outpkt);
 386 }
 387
 388 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 389         vpn_packet_t pkt1, pkt2;
 390         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 391         vpn_packet_t *inpkt = origpkt;
 392         int nextpkt = 0;
 393         vpn_packet_t *outpkt;
 394         int origlen = origpkt->len;
 395         size_t outlen;
 396 #if defined(SOL_IP) && defined(IP_TOS)
 397         static int priority = 0;
 398 #endif
 399         int origpriority = origpkt->priority;
 400
 401         if(!n->status.reachable) {
 402                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 403                 return;
 404         }
 405
 406         /* Make sure we have a valid key */
 407
 408         if(!n->status.validkey) {
 409                 time_t now = time(NULL);
 410
 411                 logger(DEBUG_TRAFFIC, LOG_INFO,
 412                                    "No valid key known yet for %s (%s), forwarding via TCP",
 413                                    n->name, n->hostname);
 414
 415                 if(n->last_req_key + 10 <= now) {
 416                         send_req_key(n);
 417                         n->last_req_key = now;
 418                 }
 419
 420                 send_tcppacket(n->nexthop->connection, origpkt);
 421
 422                 return;
 423         }
 424
 425         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 426                 logger(DEBUG_TRAFFIC, LOG_INFO,
 427                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 428                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 429
 430                 if(n != n->nexthop)
 431                         send_packet(n->nexthop, origpkt);
 432                 else
 433                         send_tcppacket(n->nexthop->connection, origpkt);
 434
 435                 return;
 436         }
 437
 438         if(experimental && OPTION_VERSION(n->options) >= 2) {
 439                 uint8_t type = 0;
 440                 if(!(inpkt->data[12] | inpkt->data[13]))
 441                         type = PKT_PROBE;
 442                 sptps_send_record(&n->sptps, type, (char *)inpkt->data, inpkt->len);
 443                 return;
 444         }
 445
 446         /* Compress the packet */
 447
 448         if(n->outcompression) {
 449                 outpkt = pkt[nextpkt++];
 450
 451                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 452                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 453                                    n->name, n->hostname);
 454                         return;
 455                 }
 456
 457                 inpkt = outpkt;
 458         }
 459
 460         /* Add sequence number */
 461
 462         inpkt->seqno = htonl(++(n->sent_seqno));
 463         inpkt->len += sizeof inpkt->seqno;
 464
 465         /* Encrypt the packet */
 466
 467         if(cipher_active(&n->outcipher)) {
 468                 outpkt = pkt[nextpkt++];
 469                 outlen = MAXSIZE;
 470
 471                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 472                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 473                         goto end;
 474                 }
 475
 476                 outpkt->len = outlen;
 477                 inpkt = outpkt;
 478         }
 479
 480         /* Add the message authentication code */
 481
 482         if(digest_active(&n->outdigest)) {
 483                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 484                 inpkt->len += digest_length(&n->outdigest);
 485         }
 486
 487         /* Determine which socket we have to use */
 488
 489         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 490                 for(int sock = 0; sock < listen_sockets; sock++) {
 491                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 492                                 n->sock = sock;
 493                                 break;
 494                         }
 495                 }
 496         }
 497
 498         /* Send the packet */
 499
 500         struct sockaddr *sa;
 501         socklen_t sl;
 502         int sock;
 503
 504         /* Overloaded use of priority field: -1 means local broadcast */
 505
 506         if(origpriority == -1 && n->prevedge) {
 507                 struct sockaddr_in in;
 508                 in.sin_family = AF_INET;
 509                 in.sin_addr.s_addr = -1;
 510                 in.sin_port = n->prevedge->address.in.sin_port;
 511                 sa = (struct sockaddr *)&in;
 512                 sl = sizeof in;
 513                 sock = 0;
 514         } else {
 515                 if(origpriority == -1)
 516                         origpriority = 0;
 517
 518                 sa = &(n->address.sa);
 519                 sl = SALEN(n->address.sa);
 520                 sock = n->sock;
 521         }
 522
 523 #if defined(SOL_IP) && defined(IP_TOS)
 524         if(priorityinheritance && origpriority != priority
 525            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 526                 priority = origpriority;
 527                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 528                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 529                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 530         }
 531 #endif
 532
 533         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 534                 if(sockmsgsize(sockerrno)) {
 535                         if(n->maxmtu >= origlen)
 536                                 n->maxmtu = origlen - 1;
 537                         if(n->mtu >= origlen)
 538                                 n->mtu = origlen - 1;
 539                 } else
 540                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 541         }
 542
 543 end:
 544         origpkt->len = origlen;
 545 }
 546
 547 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 548         node_t *to = handle;
 549
 550         if(type >= SPTPS_HANDSHAKE) {
 551                 char buf[len * 4 / 3 + 5];
 552                 b64encode(data, buf, len);
 553                 if(!to->status.validkey)
 554                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 -1", ANS_KEY, myself->name, to->name, buf);
 555                 else
 556                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 557         }
 558
 559         /* Send the packet */
 560
 561         struct sockaddr *sa;
 562         socklen_t sl;
 563         int sock;
 564
 565         sa = &(to->address.sa);
 566         sl = SALEN(to->address.sa);
 567         sock = to->sock;
 568
 569         if(sendto(listen_socket[sock].udp, data, len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 570                 if(sockmsgsize(sockerrno)) {
 571                         if(to->maxmtu >= len)
 572                                 to->maxmtu = len - 1;
 573                         if(to->mtu >= len)
 574                                 to->mtu = len - 1;
 575                 } else {
 576                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 577                         return false;
 578                 }
 579         }
 580
 581         return true;
 582 }
 583
 584 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 585         node_t *from = handle;
 586
 587         if(type == SPTPS_HANDSHAKE) {
 588                 from->status.validkey = true;
 589                 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 590                 return true;
 591         }
 592
 593         if(len > MTU) {
 594                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 595                 return false;
 596         }
 597
 598         vpn_packet_t inpkt;
 599         inpkt.len = len;
 600         memcpy(inpkt.data, data, len);
 601
 602         if(type == PKT_PROBE) {
 603                 mtu_probe_h(from, &inpkt, len);
 604                 return true;
 605
 606         }
 607         if(type != 0) {
 608                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 609                 return false;
 610         }
 611
 612         receive_packet(from, &inpkt);
 613         return true;
 614 }
 615
 616 /*
 617   send a packet to the given vpn ip.
 618 */
 619 void send_packet(node_t *n, vpn_packet_t *packet) {
 620         node_t *via;
 621
 622         if(n == myself) {
 623                 if(overwrite_mac)
 624                          memcpy(packet->data, mymac.x, ETH_ALEN);
 625                 n->out_packets++;
 626                 n->out_bytes += packet->len;
 627                 devops.write(packet);
 628                 return;
 629         }
 630
 631         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 632                            packet->len, n->name, n->hostname);
 633
 634         if(!n->status.reachable) {
 635                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 636                                    n->name, n->hostname);
 637                 return;
 638         }
 639
 640         n->out_packets++;
 641         n->out_bytes += packet->len;
 642
 643         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 644
 645         if(via != n)
 646                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 647                            n->name, via->name, n->via->hostname);
 648
 649         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 650                 if(!send_tcppacket(via->connection, packet))
 651                         terminate_connection(via->connection, true);
 652         } else
 653                 send_udppacket(via, packet);
 654 }
 655
 656 /* Broadcast a packet using the minimum spanning tree */
 657
 658 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 659         splay_node_t *node;
 660         connection_t *c;
 661         node_t *n;
 662
 663         // Always give ourself a copy of the packet.
 664         if(from != myself)
 665                 send_packet(myself, packet);
 666
 667         // In TunnelServer mode, do not forward broadcast packets.
 668         // The MST might not be valid and create loops.
 669         if(tunnelserver || broadcast_mode == BMODE_NONE)
 670                 return;
 671
 672         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 673                            packet->len, from->name, from->hostname);
 674
 675         switch(broadcast_mode) {
 676                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 677                 // This guarantees all nodes receive the broadcast packet, and
 678                 // usually distributes the sending of broadcast packets over all nodes.
 679                 case BMODE_MST:
 680                         for(node = connection_tree->head; node; node = node->next) {
 681                                 c = node->data;
 682
 683                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 684                                         send_packet(c->node, packet);
 685                         }
 686                         break;
 687
 688                 // In direct mode, we send copies to each node we know of.
 689                 // However, this only reaches nodes that can be reached in a single hop.
 690                 // We don't have enough information to forward broadcast packets in this case.
 691                 case BMODE_DIRECT:
 692                         if(from != myself)
 693                                 break;
 694
 695                         for(node = node_udp_tree->head; node; node = node->next) {
 696                                 n = node->data;
 697
 698                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 699                                         send_packet(n, packet);
 700                         }
 701                         break;
 702
 703                 default:
 704                         break;
 705         }
 706 }
 707
 708 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 709         splay_node_t *node;
 710         edge_t *e;
 711         node_t *n = NULL;
 712         bool hard = false;
 713         static time_t last_hard_try = 0;
 714         time_t now = time(NULL);
 715
 716         for(node = edge_weight_tree->head; node; node = node->next) {
 717                 e = node->data;
 718
 719                 if(e->to == myself)
 720                         continue;
 721
 722                 if(sockaddrcmp_noport(from, &e->address)) {
 723                         if(last_hard_try == now)
 724                                 continue;
 725                         hard = true;
 726                 }
 727
 728                 if(!try_mac(e->to, pkt))
 729                         continue;
 730
 731                 n = e->to;
 732                 break;
 733         }
 734
 735         if(hard)
 736                 last_hard_try = now;
 737
 738         last_hard_try = now;
 739         return n;
 740 }
 741
 742 void handle_incoming_vpn_data(int sock, short events, void *data) {
 743         vpn_packet_t pkt;
 744         char *hostname;
 745         sockaddr_t from;
 746         socklen_t fromlen = sizeof from;
 747         node_t *n;
 748         int len;
 749
 750         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 751
 752         if(len <= 0 || len > MAXSIZE) {
 753                 if(!sockwouldblock(sockerrno))
 754                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 755                 return;
 756         }
 757
 758         pkt.len = len;
 759
 760         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 761
 762         n = lookup_node_udp(&from);
 763
 764         if(!n) {
 765                 n = try_harder(&from, &pkt);
 766                 if(n)
 767                         update_node_udp(n, &from);
 768                 else if(debug_level >= DEBUG_PROTOCOL) {
 769                         hostname = sockaddr2hostname(&from);
 770                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 771                         free(hostname);
 772                         return;
 773                 }
 774                 else
 775                         return;
 776         }
 777
 778         n->sock = (intptr_t)data;
 779
 780         receive_udppacket(n, &pkt);
 781 }
 782
 783 void handle_device_data(int sock, short events, void *data) {
 784         vpn_packet_t packet;
 785
 786         packet.priority = 0;
 787
 788         if(devops.read(&packet)) {
 789                 myself->in_packets++;
 790                 myself->in_bytes += packet.len;
 791                 route(myself, &packet);
 792         }
 793 }