tinc-vpn.org Git - tinc/blob - src/protocol_key.c

   1 /*
   2     protocol_key.c -- handle the meta-protocol, key exchange
   3     Copyright (C) 1999-2005 Ivo Timmermans,
   4                   2000-2017 Guus Sliepen <guus@tinc-vpn.org>
   5
   6     This program is free software; you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation; either version 2 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License along
  17     with this program; if not, write to the Free Software Foundation, Inc.,
  18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19 */
  20
  21 #include "system.h"
  22
  23 #include "cipher.h"
  24 #include "connection.h"
  25 #include "crypto.h"
  26 #include "logger.h"
  27 #include "net.h"
  28 #include "netutl.h"
  29 #include "node.h"
  30 #include "prf.h"
  31 #include "protocol.h"
  32 #include "route.h"
  33 #include "sptps.h"
  34 #include "utils.h"
  35 #include "xalloc.h"
  36
  37 #ifndef DISABLE_LEGACY
  38 static bool mykeyused = false;
  39 #endif
  40
  41 void send_key_changed(void) {
  42 #ifndef DISABLE_LEGACY
  43         send_request(everyone, "%d %x %s", KEY_CHANGED, rand(), myself->name);
  44
  45         /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */
  46
  47         for list_each(connection_t, c, connection_list) {
  48                 if(c->edge && c->node && c->node->status.reachable && !c->node->status.sptps) {
  49                         send_ans_key(c->node);
  50                 }
  51         }
  52
  53 #endif
  54
  55         /* Force key exchange for connections using SPTPS */
  56
  57         if(experimental) {
  58                 for splay_each(node_t, n, node_tree) {
  59                         if(n->status.reachable && n->status.validkey && n->status.sptps) {
  60                                 sptps_force_kex(&n->sptps);
  61                         }
  62                 }
  63         }
  64 }
  65
  66 bool key_changed_h(connection_t *c, const char *request) {
  67         char name[MAX_STRING_SIZE];
  68         node_t *n;
  69
  70         if(sscanf(request, "%*d %*x " MAX_STRING, name) != 1) {
  71                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "KEY_CHANGED",
  72                        c->name, c->hostname);
  73                 return false;
  74         }
  75
  76         if(seen_request(request)) {
  77                 return true;
  78         }
  79
  80         n = lookup_node(name);
  81
  82         if(!n) {
  83                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist",
  84                        "KEY_CHANGED", c->name, c->hostname, name);
  85                 return true;
  86         }
  87
  88         if(!n->status.sptps) {
  89                 n->status.validkey = false;
  90                 n->last_req_key = 0;
  91         }
  92
  93         /* Tell the others */
  94
  95         if(!tunnelserver) {
  96                 forward_request(c, request);
  97         }
  98
  99         return true;
 100 }
 101
 102 static bool send_sptps_data_myself(void *handle, uint8_t type, const void *data, size_t len) {
 103         return send_sptps_data(handle, myself, type, data, len);
 104 }
 105
 106 static bool send_initial_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
 107         (void)type;
 108         node_t *to = handle;
 109         to->sptps.send_data = send_sptps_data_myself;
 110         char buf[len * 4 / 3 + 5];
 111
 112         b64encode(data, buf, len);
 113
 114         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_KEY, buf);
 115 }
 116
 117 bool send_req_key(node_t *to) {
 118         if(to->status.sptps) {
 119                 if(!node_read_ecdsa_public_key(to)) {
 120                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", to->name, to->hostname);
 121                         send_request(to->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, to->name, REQ_PUBKEY);
 122                         return true;
 123                 }
 124
 125                 char label[25 + strlen(myself->name) + strlen(to->name)];
 126                 snprintf(label, sizeof(label), "tinc UDP key expansion %s %s", myself->name, to->name);
 127                 sptps_stop(&to->sptps);
 128                 to->status.validkey = false;
 129                 to->status.waitingforkey = true;
 130                 to->last_req_key = now.tv_sec;
 131                 to->incompression = myself->incompression;
 132                 return sptps_start(&to->sptps, to, true, true, myself->connection->ecdsa, to->ecdsa, label, sizeof(label), send_initial_sptps_data, receive_sptps_record);
 133         }
 134
 135         return send_request(to->nexthop->connection, "%d %s %s", REQ_KEY, myself->name, to->name);
 136 }
 137
 138 /* REQ_KEY is overloaded to allow arbitrary requests to be routed between two nodes. */
 139
 140 static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, node_t *to, int reqno) {
 141         (void)c;
 142
 143         /* If this is a SPTPS packet, see if sending UDP info helps.
 144            Note that we only do this if we're the destination or the static relay;
 145            otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */
 146         if((reqno == REQ_KEY || reqno == SPTPS_PACKET) && to->via == myself) {
 147                 send_udp_info(myself, from);
 148         }
 149
 150         if(reqno == SPTPS_PACKET) {
 151                 /* This is a SPTPS data packet. */
 152
 153                 char buf[MAX_STRING_SIZE];
 154                 int len;
 155
 156                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) {
 157                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s) to %s (%s): %s", "SPTPS_PACKET", from->name, from->hostname, to->name, to->hostname, "invalid SPTPS data");
 158                         return true;
 159                 }
 160
 161                 if(to != myself) {
 162                         /* We don't just forward the request, because we want to use UDP if it's available. */
 163                         if(forwarding_mode == FMODE_INTERNAL) {
 164                                 send_sptps_data(to, from, 0, buf, len);
 165                                 try_tx(to, true);
 166                         }
 167                 } else {
 168                         /* The packet is for us */
 169                         if(!sptps_receive_data(&from->sptps, buf, len)) {
 170                                 /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 171                                    so let's restart SPTPS in case that helps. But don't do that too often
 172                                    to prevent storms. */
 173                                 if(from->last_req_key < now.tv_sec - 10) {
 174                                         logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 175                                         send_req_key(from);
 176                                 }
 177
 178                                 return true;
 179                         }
 180
 181                         send_mtu_info(myself, from, MTU);
 182                 }
 183
 184                 return true;
 185         }
 186
 187         /* Requests that are not SPTPS data packets are forwarded as-is. */
 188
 189         if(to != myself) {
 190                 return send_request(to->nexthop->connection, "%s", request);
 191         }
 192
 193         /* The request is for us */
 194
 195         switch(reqno) {
 196         case REQ_PUBKEY: {
 197                 if(!node_read_ecdsa_public_key(from)) {
 198                         /* Request their key *before* we send our key back. Otherwise the first SPTPS packet from them will get dropped. */
 199                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Preemptively requesting Ed25519 key for %s (%s)", from->name, from->hostname);
 200                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 201                 }
 202
 203                 char *pubkey = ecdsa_get_base64_public_key(myself->connection->ecdsa);
 204                 send_request(from->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, from->name, ANS_PUBKEY, pubkey);
 205                 free(pubkey);
 206                 return true;
 207         }
 208
 209         case ANS_PUBKEY: {
 210                 if(node_read_ecdsa_public_key(from)) {
 211                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got ANS_PUBKEY from %s (%s) even though we already have his pubkey", from->name, from->hostname);
 212                         return true;
 213                 }
 214
 215                 char pubkey[MAX_STRING_SIZE];
 216
 217                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, pubkey) != 1 || !(from->ecdsa = ecdsa_set_base64_public_key(pubkey))) {
 218                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_PUBKEY", from->name, from->hostname, "invalid pubkey");
 219                         return true;
 220                 }
 221
 222                 logger(DEBUG_PROTOCOL, LOG_INFO, "Learned Ed25519 public key from %s (%s)", from->name, from->hostname);
 223                 append_config_file(from->name, "Ed25519PublicKey", pubkey);
 224                 return true;
 225         }
 226
 227         case REQ_KEY: {
 228                 if(!node_read_ecdsa_public_key(from)) {
 229                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", from->name, from->hostname);
 230                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 231                         return true;
 232                 }
 233
 234                 if(from->sptps.label) {
 235                         logger(DEBUG_ALWAYS, LOG_DEBUG, "Got REQ_KEY from %s while we already started a SPTPS session!", from->name);
 236                 }
 237
 238                 char buf[MAX_STRING_SIZE];
 239                 size_t len;
 240
 241                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) {
 242                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_SPTPS_START", from->name, from->hostname, "invalid SPTPS data");
 243                         return true;
 244                 }
 245
 246                 char label[25 + strlen(from->name) + strlen(myself->name)];
 247                 snprintf(label, sizeof(label), "tinc UDP key expansion %s %s", from->name, myself->name);
 248                 sptps_stop(&from->sptps);
 249                 from->status.validkey = false;
 250                 from->status.waitingforkey = true;
 251                 from->last_req_key = now.tv_sec;
 252                 sptps_start(&from->sptps, from, false, true, myself->connection->ecdsa, from->ecdsa, label, sizeof(label), send_sptps_data_myself, receive_sptps_record);
 253                 sptps_receive_data(&from->sptps, buf, len);
 254                 send_mtu_info(myself, from, MTU);
 255                 return true;
 256         }
 257
 258         default:
 259                 logger(DEBUG_ALWAYS, LOG_ERR, "Unknown extended REQ_KEY request from %s (%s): %s", from->name, from->hostname, request);
 260                 return true;
 261         }
 262 }
 263
 264 bool req_key_h(connection_t *c, const char *request) {
 265         char from_name[MAX_STRING_SIZE];
 266         char to_name[MAX_STRING_SIZE];
 267         node_t *from, *to;
 268         int reqno = 0;
 269
 270         if(sscanf(request, "%*d " MAX_STRING " " MAX_STRING " %d", from_name, to_name, &reqno) < 2) {
 271                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "REQ_KEY", c->name,
 272                        c->hostname);
 273                 return false;
 274         }
 275
 276         if(!check_id(from_name) || !check_id(to_name)) {
 277                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_KEY", c->name, c->hostname, "invalid name");
 278                 return false;
 279         }
 280
 281         from = lookup_node(from_name);
 282
 283         if(!from) {
 284                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 285                        "REQ_KEY", c->name, c->hostname, from_name);
 286                 return true;
 287         }
 288
 289         to = lookup_node(to_name);
 290
 291         if(!to) {
 292                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 293                        "REQ_KEY", c->name, c->hostname, to_name);
 294                 return true;
 295         }
 296
 297         /* Check if this key request is for us */
 298
 299         if(to == myself) {                      /* Yes */
 300                 if(!from->status.reachable) {
 301                         logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which is not reachable",
 302                                "REQ_KEY", c->name, c->hostname, from_name);
 303                         return true;
 304                 }
 305
 306                 /* Is this an extended REQ_KEY message? */
 307                 if(experimental && reqno) {
 308                         return req_key_ext_h(c, request, from, to, reqno);
 309                 }
 310
 311                 /* No, just send our key back */
 312                 send_ans_key(from);
 313         } else {
 314                 if(tunnelserver) {
 315                         return true;
 316                 }
 317
 318                 if(!to->status.reachable) {
 319                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 320                                "REQ_KEY", c->name, c->hostname, to_name);
 321                         return true;
 322                 }
 323
 324                 /* Is this an extended REQ_KEY message? */
 325                 if(experimental && reqno) {
 326                         return req_key_ext_h(c, request, from, to, reqno);
 327                 }
 328
 329                 send_request(to->nexthop->connection, "%s", request);
 330         }
 331
 332         return true;
 333 }
 334
 335 bool send_ans_key(node_t *to) {
 336         if(to->status.sptps) {
 337                 abort();
 338         }
 339
 340 #ifdef DISABLE_LEGACY
 341         return false;
 342 #else
 343         size_t keylen = myself->incipher ? cipher_keylength(myself->incipher) : 1;
 344         char key[keylen * 2 + 1];
 345
 346         randomize(key, keylen);
 347
 348         cipher_close(to->incipher);
 349         digest_close(to->indigest);
 350
 351         if(myself->incipher) {
 352                 to->incipher = cipher_open_by_nid(cipher_get_nid(myself->incipher));
 353
 354                 if(!to->incipher) {
 355                         abort();
 356                 }
 357
 358                 if(!cipher_set_key(to->incipher, key, false)) {
 359                         abort();
 360                 }
 361         }
 362
 363         if(myself->indigest) {
 364                 to->indigest = digest_open_by_nid(digest_get_nid(myself->indigest), digest_length(myself->indigest));
 365
 366                 if(!to->indigest) {
 367                         abort();
 368                 }
 369
 370                 if(!digest_set_key(to->indigest, key, keylen)) {
 371                         abort();
 372                 }
 373         }
 374
 375         to->incompression = myself->incompression;
 376
 377         bin2hex(key, key, keylen);
 378
 379         // Reset sequence number and late packet window
 380         mykeyused = true;
 381         to->received_seqno = 0;
 382         to->received = 0;
 383
 384         if(replaywin) {
 385                 memset(to->late, 0, replaywin);
 386         }
 387
 388         to->status.validkey_in = true;
 389
 390         return send_request(to->nexthop->connection, "%d %s %s %s %d %d %d %d", ANS_KEY,
 391                             myself->name, to->name, key,
 392                             cipher_get_nid(to->incipher),
 393                             digest_get_nid(to->indigest),
 394                             (int)digest_length(to->indigest),
 395                             to->incompression);
 396 #endif
 397 }
 398
 399 bool ans_key_h(connection_t *c, const char *request) {
 400         char from_name[MAX_STRING_SIZE];
 401         char to_name[MAX_STRING_SIZE];
 402         char key[MAX_STRING_SIZE];
 403         char address[MAX_STRING_SIZE] = "";
 404         char port[MAX_STRING_SIZE] = "";
 405         int cipher, digest, maclength, compression;
 406         node_t *from, *to;
 407
 408         if(sscanf(request, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d %d %d "MAX_STRING" "MAX_STRING,
 409                         from_name, to_name, key, &cipher, &digest, &maclength,
 410                         &compression, address, port) < 7) {
 411                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "ANS_KEY", c->name,
 412                        c->hostname);
 413                 return false;
 414         }
 415
 416         if(!check_id(from_name) || !check_id(to_name)) {
 417                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_KEY", c->name, c->hostname, "invalid name");
 418                 return false;
 419         }
 420
 421         from = lookup_node(from_name);
 422
 423         if(!from) {
 424                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 425                        "ANS_KEY", c->name, c->hostname, from_name);
 426                 return true;
 427         }
 428
 429         to = lookup_node(to_name);
 430
 431         if(!to) {
 432                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 433                        "ANS_KEY", c->name, c->hostname, to_name);
 434                 return true;
 435         }
 436
 437         /* Forward it if necessary */
 438
 439         if(to != myself) {
 440                 if(tunnelserver) {
 441                         return true;
 442                 }
 443
 444                 if(!to->status.reachable) {
 445                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 446                                "ANS_KEY", c->name, c->hostname, to_name);
 447                         return true;
 448                 }
 449
 450                 if(!*address && from->address.sa.sa_family != AF_UNSPEC && to->minmtu) {
 451                         char *address, *port;
 452                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Appending reflexive UDP address to ANS_KEY from %s to %s", from->name, to->name);
 453                         sockaddr2str(&from->address, &address, &port);
 454                         send_request(to->nexthop->connection, "%s %s %s", request, address, port);
 455                         free(address);
 456                         free(port);
 457                         return true;
 458                 }
 459
 460                 return send_request(to->nexthop->connection, "%s", request);
 461         }
 462
 463 #ifndef DISABLE_LEGACY
 464         /* Don't use key material until every check has passed. */
 465         cipher_close(from->outcipher);
 466         digest_close(from->outdigest);
 467 #endif
 468
 469         if(!from->status.sptps) {
 470                 from->status.validkey = false;
 471         }
 472
 473         switch(compression) {
 474         case 12:
 475 #ifdef HAVE_LZ4
 476                 break;
 477 #else
 478                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 479                 logger(DEBUG_ALWAYS, LOG_ERR, "LZ4 compression is unavailable on this node.");
 480                 return true;
 481 #endif
 482
 483         case 11:
 484         case 10:
 485 #ifdef HAVE_LZO
 486                 break;
 487 #else
 488                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 489                 logger(DEBUG_ALWAYS, LOG_ERR, "LZO compression is unavailable on this node.");
 490                 return true;
 491 #endif
 492
 493         case 9:
 494         case 8:
 495         case 7:
 496         case 6:
 497         case 5:
 498         case 4:
 499         case 3:
 500         case 2:
 501         case 1:
 502 #ifdef HAVE_ZLIB
 503                 break;
 504 #else
 505                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 506                 logger(DEBUG_ALWAYS, LOG_ERR, "ZLIB compression is unavailable on this node.");
 507                 return true;
 508 #endif
 509
 510         case 0:
 511                 break;
 512
 513         default:
 514                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 515                 logger(DEBUG_ALWAYS, LOG_ERR, "Compression level %i is unrecognized by this node.", compression);
 516                 return true;
 517         }
 518
 519         from->outcompression = compression;
 520
 521         /* SPTPS or old-style key exchange? */
 522
 523         if(from->status.sptps) {
 524                 char buf[strlen(key)];
 525                 size_t len = b64decode(key, buf, strlen(key));
 526
 527                 if(!len || !sptps_receive_data(&from->sptps, buf, len)) {
 528                         /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 529                            so let's restart SPTPS in case that helps. But don't do that too often
 530                            to prevent storms.
 531                            Note that simply relying on handshake timeout is not enough, because
 532                            that doesn't apply to key regeneration. */
 533                         if(from->last_req_key < now.tv_sec - 10) {
 534                                 logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode handshake TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 535                                 send_req_key(from);
 536                         }
 537
 538                         return true;
 539                 }
 540
 541                 if(from->status.validkey) {
 542                         if(*address && *port) {
 543                                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 544                                 sockaddr_t sa = str2sockaddr(address, port);
 545                                 update_node_udp(from, &sa);
 546                         }
 547                 }
 548
 549                 send_mtu_info(myself, from, MTU);
 550
 551                 return true;
 552         }
 553
 554 #ifdef DISABLE_LEGACY
 555         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses legacy protocol!", from->name, from->hostname);
 556         return false;
 557 #else
 558         /* Check and lookup cipher and digest algorithms */
 559
 560         if(cipher) {
 561                 if(!(from->outcipher = cipher_open_by_nid(cipher))) {
 562                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown cipher!", from->name, from->hostname);
 563                         return false;
 564                 }
 565         } else {
 566                 from->outcipher = NULL;
 567         }
 568
 569         if(digest) {
 570                 if(!(from->outdigest = digest_open_by_nid(digest, maclength))) {
 571                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown digest!", from->name, from->hostname);
 572                         return false;
 573                 }
 574         } else {
 575                 from->outdigest = NULL;
 576         }
 577
 578         if((size_t)maclength != digest_length(from->outdigest)) {
 579                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus MAC length!", from->name, from->hostname);
 580                 return false;
 581         }
 582
 583         /* Process key */
 584
 585         size_t keylen = hex2bin(key, key, sizeof(key));
 586
 587         if(keylen != (from->outcipher ? cipher_keylength(from->outcipher) : 1)) {
 588                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses wrong keylength!", from->name, from->hostname);
 589                 return true;
 590         }
 591
 592         /* Update our copy of the origin's packet key */
 593
 594         if(from->outcipher && !cipher_set_key(from->outcipher, key, true)) {
 595                 return false;
 596         }
 597
 598         if(from->outdigest && !digest_set_key(from->outdigest, key, keylen)) {
 599                 return false;
 600         }
 601
 602         from->status.validkey = true;
 603         from->sent_seqno = 0;
 604
 605         if(*address && *port) {
 606                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 607                 sockaddr_t sa = str2sockaddr(address, port);
 608                 update_node_udp(from, &sa);
 609         }
 610
 611         return true;
 612 #endif
 613 }