tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "splay_tree.h"
  40 #include "cipher.h"
  41 #include "conf.h"
  42 #include "connection.h"
  43 #include "crypto.h"
  44 #include "digest.h"
  45 #include "device.h"
  46 #include "ethernet.h"
  47 #include "graph.h"
  48 #include "logger.h"
  49 #include "net.h"
  50 #include "netutl.h"
  51 #include "protocol.h"
  52 #include "process.h"
  53 #include "route.h"
  54 #include "utils.h"
  55 #include "xalloc.h"
  56
  57 int keylifetime = 0;
  58 #ifdef HAVE_LZO
  59 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  60 #endif
  61
  62 static void send_udppacket(node_t *, vpn_packet_t *);
  63
  64 unsigned replaywin = 16;
  65 bool localdiscovery = false;
  66
  67 #define MAX_SEQNO 1073741824
  68
  69 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  70    mtuprobes ==    31: sleep pinginterval seconds
  71    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  72    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  73
  74    Probes are sent in batches of three, with random sizes between the lower and
  75    upper boundaries for the MTU thus far discovered.
  76
  77    In case local discovery is enabled, a fourth packet is added to each batch,
  78    which will be broadcast to the local network.
  79 */
  80
  81 static void send_mtu_probe_handler(int fd, short events, void *data) {
  82         node_t *n = data;
  83         vpn_packet_t packet;
  84         int len, i;
  85         int timeout = 1;
  86
  87         n->mtuprobes++;
  88
  89         if(!n->status.reachable || !n->status.validkey) {
  90                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  91                 n->mtuprobes = 0;
  92                 return;
  93         }
  94
  95         if(n->mtuprobes > 32) {
  96                 if(!n->minmtu) {
  97                         n->mtuprobes = 31;
  98                         timeout = pinginterval;
  99                         goto end;
 100                 }
 101
 102                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 103                 n->mtuprobes = 1;
 104                 n->minmtu = 0;
 105                 n->maxmtu = MTU;
 106         }
 107
 108         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 109                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 110                 n->mtuprobes = 31;
 111         }
 112
 113         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 114                 if(n->minmtu > n->maxmtu)
 115                         n->minmtu = n->maxmtu;
 116                 else
 117                         n->maxmtu = n->minmtu;
 118                 n->mtu = n->minmtu;
 119                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 120                 n->mtuprobes = 31;
 121         }
 122
 123         if(n->mtuprobes == 31) {
 124                 timeout = pinginterval;
 125                 goto end;
 126         } else if(n->mtuprobes == 32) {
 127                 timeout = pingtimeout;
 128         }
 129
 130         for(i = 0; i < 3 + localdiscovery; i++) {
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 memset(packet.data, 0, 14);
 140                 randomize(packet.data + 14, len - 14);
 141                 packet.len = len;
 142                 if(i >= 3 && n->mtuprobes <= 10)
 143                         packet.priority = -1;
 144                 else
 145                         packet.priority = 0;
 146
 147                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 148
 149                 send_udppacket(n, &packet);
 150         }
 151
 152 end:
 153         event_add(&n->mtuevent, &(struct timeval){timeout, 0});
 154 }
 155
 156 void send_mtu_probe(node_t *n) {
 157         if(!timeout_initialized(&n->mtuevent))
 158                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 159         send_mtu_probe_handler(0, 0, n);
 160 }
 161
 162 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 163         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 164
 165         if(!packet->data[0]) {
 166                 packet->data[0] = 1;
 167                 send_udppacket(n, packet);
 168         } else {
 169                 if(n->mtuprobes > 30) {
 170                         if(n->minmtu)
 171                                 n->mtuprobes = 30;
 172                         else
 173                                 n->mtuprobes = 1;
 174                 }
 175
 176                 if(len > n->maxmtu)
 177                         len = n->maxmtu;
 178                 if(n->minmtu < len)
 179                         n->minmtu = len;
 180         }
 181 }
 182
 183 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 184         if(level == 0) {
 185                 memcpy(dest, source, len);
 186                 return len;
 187         } else if(level == 10) {
 188 #ifdef HAVE_LZO
 189                 lzo_uint lzolen = MAXSIZE;
 190                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 191                 return lzolen;
 192 #else
 193                 return -1;
 194 #endif
 195         } else if(level < 10) {
 196 #ifdef HAVE_ZLIB
 197                 unsigned long destlen = MAXSIZE;
 198                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 199                         return destlen;
 200                 else
 201 #endif
 202                         return -1;
 203         } else {
 204 #ifdef HAVE_LZO
 205                 lzo_uint lzolen = MAXSIZE;
 206                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 207                 return lzolen;
 208 #else
 209                 return -1;
 210 #endif
 211         }
 212
 213         return -1;
 214 }
 215
 216 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 217         if(level == 0) {
 218                 memcpy(dest, source, len);
 219                 return len;
 220         } else if(level > 9) {
 221 #ifdef HAVE_LZO
 222                 lzo_uint lzolen = MAXSIZE;
 223                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 224                         return lzolen;
 225                 else
 226 #endif
 227                         return -1;
 228         }
 229 #ifdef HAVE_ZLIB
 230         else {
 231                 unsigned long destlen = MAXSIZE;
 232                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 233                         return destlen;
 234                 else
 235                         return -1;
 236         }
 237 #endif
 238
 239         return -1;
 240 }
 241
 242 /* VPN packet I/O */
 243
 244 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 245         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 246                            packet->len, n->name, n->hostname);
 247
 248         n->in_packets++;
 249         n->in_bytes += packet->len;
 250
 251         route(n, packet);
 252 }
 253
 254 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 255         if(n->status.sptps)
 256                 return sptps_verify_datagram(&n->sptps, (char *)inpkt->data - 4, inpkt->len);
 257
 258         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 259                 return false;
 260
 261         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 262 }
 263
 264 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 265         vpn_packet_t pkt1, pkt2;
 266         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 267         int nextpkt = 0;
 268         vpn_packet_t *outpkt = pkt[0];
 269         size_t outlen;
 270
 271         if(n->status.sptps) {
 272                 sptps_receive_data(&n->sptps, (char *)inpkt->data - 4, inpkt->len);
 273                 return;
 274         }
 275
 276         if(!cipher_active(&n->incipher)) {
 277                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 278                                         n->name, n->hostname);
 279                 return;
 280         }
 281
 282         /* Check packet length */
 283
 284         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 285                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 286                                         n->name, n->hostname);
 287                 return;
 288         }
 289
 290         /* Check the message authentication code */
 291
 292         if(digest_active(&n->indigest)) {
 293                 inpkt->len -= n->indigest.maclength;
 294                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 295                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 296                         return;
 297                 }
 298         }
 299         /* Decrypt the packet */
 300
 301         if(cipher_active(&n->incipher)) {
 302                 outpkt = pkt[nextpkt++];
 303                 outlen = MAXSIZE;
 304
 305                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 306                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 307                         return;
 308                 }
 309
 310                 outpkt->len = outlen;
 311                 inpkt = outpkt;
 312         }
 313
 314         /* Check the sequence number */
 315
 316         inpkt->len -= sizeof inpkt->seqno;
 317         inpkt->seqno = ntohl(inpkt->seqno);
 318
 319         if(replaywin) {
 320                 if(inpkt->seqno != n->received_seqno + 1) {
 321                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 322                                 if(n->farfuture++ < replaywin >> 2) {
 323                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 324                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 325                                         return;
 326                                 }
 327                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 328                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 329                                 memset(n->late, 0, replaywin);
 330                         } else if (inpkt->seqno <= n->received_seqno) {
 331                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 332                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 333                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 334                                         return;
 335                                 }
 336                         } else {
 337                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 338                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 339                         }
 340                 }
 341
 342                 n->farfuture = 0;
 343                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 344         }
 345
 346         if(inpkt->seqno > n->received_seqno)
 347                 n->received_seqno = inpkt->seqno;
 348
 349         if(n->received_seqno > MAX_SEQNO)
 350                 regenerate_key();
 351
 352         /* Decompress the packet */
 353
 354         length_t origlen = inpkt->len;
 355
 356         if(n->incompression) {
 357                 outpkt = pkt[nextpkt++];
 358
 359                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 360                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 361                                                  n->name, n->hostname);
 362                         return;
 363                 }
 364
 365                 inpkt = outpkt;
 366
 367                 origlen -= MTU/64 + 20;
 368         }
 369
 370         inpkt->priority = 0;
 371
 372         if(!inpkt->data[12] && !inpkt->data[13])
 373                 mtu_probe_h(n, inpkt, origlen);
 374         else
 375                 receive_packet(n, inpkt);
 376 }
 377
 378 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 379         vpn_packet_t outpkt;
 380
 381         outpkt.len = len;
 382         if(c->options & OPTION_TCPONLY)
 383                 outpkt.priority = 0;
 384         else
 385                 outpkt.priority = -1;
 386         memcpy(outpkt.data, buffer, len);
 387
 388         receive_packet(c->node, &outpkt);
 389 }
 390
 391 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 392         vpn_packet_t pkt1, pkt2;
 393         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 394         vpn_packet_t *inpkt = origpkt;
 395         int nextpkt = 0;
 396         vpn_packet_t *outpkt;
 397         int origlen = origpkt->len;
 398         size_t outlen;
 399 #if defined(SOL_IP) && defined(IP_TOS)
 400         static int priority = 0;
 401 #endif
 402         int origpriority = origpkt->priority;
 403
 404         if(!n->status.reachable) {
 405                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 406                 return;
 407         }
 408
 409         /* Make sure we have a valid key */
 410
 411         if(!n->status.validkey) {
 412                 time_t now = time(NULL);
 413
 414                 logger(DEBUG_TRAFFIC, LOG_INFO,
 415                                    "No valid key known yet for %s (%s), forwarding via TCP",
 416                                    n->name, n->hostname);
 417
 418                 if(n->last_req_key + 10 <= now) {
 419                         send_req_key(n);
 420                         n->last_req_key = now;
 421                 }
 422
 423                 send_tcppacket(n->nexthop->connection, origpkt);
 424
 425                 return;
 426         }
 427
 428         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 429                 logger(DEBUG_TRAFFIC, LOG_INFO,
 430                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 431                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 432
 433                 if(n != n->nexthop)
 434                         send_packet(n->nexthop, origpkt);
 435                 else
 436                         send_tcppacket(n->nexthop->connection, origpkt);
 437
 438                 return;
 439         }
 440
 441         if(n->status.sptps) {
 442                 uint8_t type = 0;
 443                 if(!(inpkt->data[12] | inpkt->data[13]))
 444                         type = PKT_PROBE;
 445                 sptps_send_record(&n->sptps, type, (char *)inpkt->data, inpkt->len);
 446                 return;
 447         }
 448
 449         /* Compress the packet */
 450
 451         if(n->outcompression) {
 452                 outpkt = pkt[nextpkt++];
 453
 454                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 455                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 456                                    n->name, n->hostname);
 457                         return;
 458                 }
 459
 460                 inpkt = outpkt;
 461         }
 462
 463         /* Add sequence number */
 464
 465         inpkt->seqno = htonl(++(n->sent_seqno));
 466         inpkt->len += sizeof inpkt->seqno;
 467
 468         /* Encrypt the packet */
 469
 470         if(cipher_active(&n->outcipher)) {
 471                 outpkt = pkt[nextpkt++];
 472                 outlen = MAXSIZE;
 473
 474                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 475                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 476                         goto end;
 477                 }
 478
 479                 outpkt->len = outlen;
 480                 inpkt = outpkt;
 481         }
 482
 483         /* Add the message authentication code */
 484
 485         if(digest_active(&n->outdigest)) {
 486                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 487                 inpkt->len += digest_length(&n->outdigest);
 488         }
 489
 490         /* Determine which socket we have to use */
 491
 492         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 493                 for(int sock = 0; sock < listen_sockets; sock++) {
 494                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 495                                 n->sock = sock;
 496                                 break;
 497                         }
 498                 }
 499         }
 500
 501         /* Send the packet */
 502
 503         struct sockaddr *sa;
 504         socklen_t sl;
 505         int sock;
 506
 507         /* Overloaded use of priority field: -1 means local broadcast */
 508
 509         if(origpriority == -1 && n->prevedge) {
 510                 struct sockaddr_in in;
 511                 in.sin_family = AF_INET;
 512                 in.sin_addr.s_addr = -1;
 513                 in.sin_port = n->prevedge->address.in.sin_port;
 514                 sa = (struct sockaddr *)&in;
 515                 sl = sizeof in;
 516                 sock = 0;
 517         } else {
 518                 if(origpriority == -1)
 519                         origpriority = 0;
 520
 521                 sa = &(n->address.sa);
 522                 sl = SALEN(n->address.sa);
 523                 sock = n->sock;
 524         }
 525
 526 #if defined(SOL_IP) && defined(IP_TOS)
 527         if(priorityinheritance && origpriority != priority
 528            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 529                 priority = origpriority;
 530                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 531                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 532                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 533         }
 534 #endif
 535
 536         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 537                 if(sockmsgsize(sockerrno)) {
 538                         if(n->maxmtu >= origlen)
 539                                 n->maxmtu = origlen - 1;
 540                         if(n->mtu >= origlen)
 541                                 n->mtu = origlen - 1;
 542                 } else
 543                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 544         }
 545
 546 end:
 547         origpkt->len = origlen;
 548 }
 549
 550 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 551         node_t *to = handle;
 552
 553         if(type >= SPTPS_HANDSHAKE) {
 554                 char buf[len * 4 / 3 + 5];
 555                 b64encode(data, buf, len);
 556                 if(!to->status.validkey)
 557                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 -1", ANS_KEY, myself->name, to->name, buf);
 558                 else
 559                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 560         }
 561
 562         /* Send the packet */
 563
 564         struct sockaddr *sa;
 565         socklen_t sl;
 566         int sock;
 567
 568         sa = &(to->address.sa);
 569         sl = SALEN(to->address.sa);
 570         sock = to->sock;
 571
 572         if(sendto(listen_socket[sock].udp, data, len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 573                 if(sockmsgsize(sockerrno)) {
 574                         if(to->maxmtu >= len)
 575                                 to->maxmtu = len - 1;
 576                         if(to->mtu >= len)
 577                                 to->mtu = len - 1;
 578                 } else {
 579                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 580                         return false;
 581                 }
 582         }
 583
 584         return true;
 585 }
 586
 587 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 588         node_t *from = handle;
 589
 590         if(type == SPTPS_HANDSHAKE) {
 591                 from->status.validkey = true;
 592                 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 593                 return true;
 594         }
 595
 596         if(len > MTU) {
 597                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 598                 return false;
 599         }
 600
 601         vpn_packet_t inpkt;
 602         inpkt.len = len;
 603         memcpy(inpkt.data, data, len);
 604
 605         if(type == PKT_PROBE) {
 606                 mtu_probe_h(from, &inpkt, len);
 607                 return true;
 608
 609         }
 610         if(type != 0) {
 611                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 612                 return false;
 613         }
 614
 615         receive_packet(from, &inpkt);
 616         return true;
 617 }
 618
 619 /*
 620   send a packet to the given vpn ip.
 621 */
 622 void send_packet(node_t *n, vpn_packet_t *packet) {
 623         node_t *via;
 624
 625         if(n == myself) {
 626                 if(overwrite_mac)
 627                          memcpy(packet->data, mymac.x, ETH_ALEN);
 628                 n->out_packets++;
 629                 n->out_bytes += packet->len;
 630                 devops.write(packet);
 631                 return;
 632         }
 633
 634         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 635                            packet->len, n->name, n->hostname);
 636
 637         if(!n->status.reachable) {
 638                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 639                                    n->name, n->hostname);
 640                 return;
 641         }
 642
 643         n->out_packets++;
 644         n->out_bytes += packet->len;
 645
 646         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 647
 648         if(via != n)
 649                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 650                            n->name, via->name, n->via->hostname);
 651
 652         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 653                 if(!send_tcppacket(via->connection, packet))
 654                         terminate_connection(via->connection, true);
 655         } else
 656                 send_udppacket(via, packet);
 657 }
 658
 659 /* Broadcast a packet using the minimum spanning tree */
 660
 661 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 662         splay_node_t *node;
 663         connection_t *c;
 664         node_t *n;
 665
 666         // Always give ourself a copy of the packet.
 667         if(from != myself)
 668                 send_packet(myself, packet);
 669
 670         // In TunnelServer mode, do not forward broadcast packets.
 671         // The MST might not be valid and create loops.
 672         if(tunnelserver || broadcast_mode == BMODE_NONE)
 673                 return;
 674
 675         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 676                            packet->len, from->name, from->hostname);
 677
 678         switch(broadcast_mode) {
 679                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 680                 // This guarantees all nodes receive the broadcast packet, and
 681                 // usually distributes the sending of broadcast packets over all nodes.
 682                 case BMODE_MST:
 683                         for(node = connection_tree->head; node; node = node->next) {
 684                                 c = node->data;
 685
 686                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 687                                         send_packet(c->node, packet);
 688                         }
 689                         break;
 690
 691                 // In direct mode, we send copies to each node we know of.
 692                 // However, this only reaches nodes that can be reached in a single hop.
 693                 // We don't have enough information to forward broadcast packets in this case.
 694                 case BMODE_DIRECT:
 695                         if(from != myself)
 696                                 break;
 697
 698                         for(node = node_udp_tree->head; node; node = node->next) {
 699                                 n = node->data;
 700
 701                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 702                                         send_packet(n, packet);
 703                         }
 704                         break;
 705
 706                 default:
 707                         break;
 708         }
 709 }
 710
 711 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 712         splay_node_t *node;
 713         edge_t *e;
 714         node_t *n = NULL;
 715         bool hard = false;
 716         static time_t last_hard_try = 0;
 717         time_t now = time(NULL);
 718
 719         for(node = edge_weight_tree->head; node; node = node->next) {
 720                 e = node->data;
 721
 722                 if(e->to == myself)
 723                         continue;
 724
 725                 if(sockaddrcmp_noport(from, &e->address)) {
 726                         if(last_hard_try == now)
 727                                 continue;
 728                         hard = true;
 729                 }
 730
 731                 if(!try_mac(e->to, pkt))
 732                         continue;
 733
 734                 n = e->to;
 735                 break;
 736         }
 737
 738         if(hard)
 739                 last_hard_try = now;
 740
 741         last_hard_try = now;
 742         return n;
 743 }
 744
 745 void handle_incoming_vpn_data(int sock, short events, void *data) {
 746         vpn_packet_t pkt;
 747         char *hostname;
 748         sockaddr_t from;
 749         socklen_t fromlen = sizeof from;
 750         node_t *n;
 751         int len;
 752
 753         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 754
 755         if(len <= 0 || len > MAXSIZE) {
 756                 if(!sockwouldblock(sockerrno))
 757                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 758                 return;
 759         }
 760
 761         pkt.len = len;
 762
 763         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 764
 765         n = lookup_node_udp(&from);
 766
 767         if(!n) {
 768                 n = try_harder(&from, &pkt);
 769                 if(n)
 770                         update_node_udp(n, &from);
 771                 else if(debug_level >= DEBUG_PROTOCOL) {
 772                         hostname = sockaddr2hostname(&from);
 773                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 774                         free(hostname);
 775                         return;
 776                 }
 777                 else
 778                         return;
 779         }
 780
 781         n->sock = (intptr_t)data;
 782
 783         receive_udppacket(n, &pkt);
 784 }
 785
 786 void handle_device_data(int sock, short events, void *data) {
 787         vpn_packet_t packet;
 788
 789         packet.priority = 0;
 790
 791         if(devops.read(&packet)) {
 792                 myself->in_packets++;
 793                 myself->in_bytes += packet.len;
 794                 route(myself, &packet);
 795         }
 796 }