tinc-vpn.org Git - tinc/blob - src/protocol_key.c

   1 /*
   2     protocol_key.c -- handle the meta-protocol, key exchange
   3     Copyright (C) 1999-2005 Ivo Timmermans,
   4                   2000-2017 Guus Sliepen <guus@tinc-vpn.org>
   5
   6     This program is free software; you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation; either version 2 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License along
  17     with this program; if not, write to the Free Software Foundation, Inc.,
  18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19 */
  20
  21 #include "system.h"
  22
  23 #include "cipher.h"
  24 #include "connection.h"
  25 #include "crypto.h"
  26 #include "logger.h"
  27 #include "net.h"
  28 #include "netutl.h"
  29 #include "node.h"
  30 #include "prf.h"
  31 #include "protocol.h"
  32 #include "route.h"
  33 #include "sptps.h"
  34 #include "utils.h"
  35 #include "xalloc.h"
  36
  37 #ifndef DISABLE_LEGACY
  38 static bool mykeyused = false;
  39 #endif
  40
  41 void send_key_changed(void) {
  42 #ifndef DISABLE_LEGACY
  43         send_request(everyone, "%d %x %s", KEY_CHANGED, rand(), myself->name);
  44
  45         /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */
  46
  47         for list_each(connection_t, c, connection_list) {
  48                 if(c->edge && c->node && c->node->status.reachable && !c->node->status.sptps) {
  49                         send_ans_key(c->node);
  50                 }
  51         }
  52
  53 #endif
  54
  55         /* Force key exchange for connections using SPTPS */
  56
  57         if(experimental) {
  58                 for splay_each(node_t, n, node_tree) {
  59                         if(n->status.reachable && n->status.validkey && n->status.sptps) {
  60                                 sptps_force_kex(&n->sptps);
  61                         }
  62                 }
  63         }
  64 }
  65
  66 bool key_changed_h(connection_t *c, const char *request) {
  67         char name[MAX_STRING_SIZE];
  68         node_t *n;
  69
  70         if(sscanf(request, "%*d %*x " MAX_STRING, name) != 1) {
  71                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "KEY_CHANGED",
  72                        c->name, c->hostname);
  73                 return false;
  74         }
  75
  76         if(seen_request(request)) {
  77                 return true;
  78         }
  79
  80         n = lookup_node(name);
  81
  82         if(!n) {
  83                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist",
  84                        "KEY_CHANGED", c->name, c->hostname, name);
  85                 return true;
  86         }
  87
  88         if(!n->status.sptps) {
  89                 n->status.validkey = false;
  90                 n->last_req_key = 0;
  91         }
  92
  93         /* Tell the others */
  94
  95         if(!tunnelserver) {
  96                 forward_request(c, request);
  97         }
  98
  99         return true;
 100 }
 101
 102 static bool send_sptps_data_myself(void *handle, uint8_t type, const void *data, size_t len) {
 103         return send_sptps_data(handle, myself, type, data, len);
 104 }
 105
 106 static bool send_initial_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
 107         (void)type;
 108         node_t *to = handle;
 109         to->sptps.send_data = send_sptps_data_myself;
 110         char buf[len * 4 / 3 + 5];
 111
 112         b64encode(data, buf, len);
 113
 114         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_KEY, buf);
 115 }
 116
 117 bool send_req_key(node_t *to) {
 118         if(to->status.sptps) {
 119                 if(!node_read_ecdsa_public_key(to)) {
 120                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", to->name, to->hostname);
 121                         send_request(to->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, to->name, REQ_PUBKEY);
 122                         return true;
 123                 }
 124
 125                 char label[25 + strlen(myself->name) + strlen(to->name)];
 126                 snprintf(label, sizeof(label), "tinc UDP key expansion %s %s", myself->name, to->name);
 127                 sptps_stop(&to->sptps);
 128                 to->status.validkey = false;
 129                 to->status.waitingforkey = true;
 130                 to->last_req_key = now.tv_sec;
 131                 to->incompression = myself->incompression;
 132                 return sptps_start(&to->sptps, to, true, true, myself->connection->ecdsa, to->ecdsa, label, sizeof(label), send_initial_sptps_data, receive_sptps_record);
 133         }
 134
 135         return send_request(to->nexthop->connection, "%d %s %s", REQ_KEY, myself->name, to->name);
 136 }
 137
 138 /* REQ_KEY is overloaded to allow arbitrary requests to be routed between two nodes. */
 139
 140 static bool req_key_ext_h(connection_t *c, const char *request, node_t *from, node_t *to, int reqno) {
 141         (void)c;
 142
 143         /* If this is a SPTPS packet, see if sending UDP info helps.
 144            Note that we only do this if we're the destination or the static relay;
 145            otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */
 146         if((reqno == REQ_KEY || reqno == SPTPS_PACKET) && to->via == myself) {
 147                 send_udp_info(myself, from);
 148         }
 149
 150         if(reqno == SPTPS_PACKET) {
 151                 /* This is a SPTPS data packet. */
 152
 153                 char buf[MAX_STRING_SIZE];
 154                 int len;
 155
 156                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) {
 157                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s) to %s (%s): %s", "SPTPS_PACKET", from->name, from->hostname, to->name, to->hostname, "invalid SPTPS data");
 158                         return true;
 159                 }
 160
 161                 if(to != myself) {
 162                         /* We don't just forward the request, because we want to use UDP if it's available. */
 163                         if(forwarding_mode == FMODE_INTERNAL) {
 164                                 send_sptps_data(to, from, 0, buf, len);
 165                                 try_tx(to, true);
 166                         }
 167                 } else {
 168                         /* The packet is for us */
 169                         if(!sptps_receive_data(&from->sptps, buf, len)) {
 170                                 /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 171                                    so let's restart SPTPS in case that helps. But don't do that too often
 172                                    to prevent storms. */
 173                                 if(from->last_req_key < now.tv_sec - 10) {
 174                                         logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 175                                         send_req_key(from);
 176                                 }
 177
 178                                 return true;
 179                         }
 180
 181                         send_mtu_info(myself, from, MTU);
 182                 }
 183
 184                 return true;
 185         }
 186
 187         /* Requests that are not SPTPS data packets are forwarded as-is. */
 188
 189         if(to != myself) {
 190                 return send_request(to->nexthop->connection, "%s", request);
 191         }
 192
 193         /* The request is for us */
 194
 195         switch(reqno) {
 196         case REQ_PUBKEY: {
 197                 if(!node_read_ecdsa_public_key(from)) {
 198                         /* Request their key *before* we send our key back. Otherwise the first SPTPS packet from them will get dropped. */
 199                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Preemptively requesting Ed25519 key for %s (%s)", from->name, from->hostname);
 200                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 201                 }
 202
 203                 char *pubkey = ecdsa_get_base64_public_key(myself->connection->ecdsa);
 204                 send_request(from->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, from->name, ANS_PUBKEY, pubkey);
 205                 free(pubkey);
 206                 return true;
 207         }
 208
 209         case ANS_PUBKEY: {
 210                 if(node_read_ecdsa_public_key(from)) {
 211                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got ANS_PUBKEY from %s (%s) even though we already have his pubkey", from->name, from->hostname);
 212                         return true;
 213                 }
 214
 215                 char pubkey[MAX_STRING_SIZE];
 216
 217                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, pubkey) != 1 || !(from->ecdsa = ecdsa_set_base64_public_key(pubkey))) {
 218                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_PUBKEY", from->name, from->hostname, "invalid pubkey");
 219                         return true;
 220                 }
 221
 222                 logger(DEBUG_PROTOCOL, LOG_INFO, "Learned Ed25519 public key from %s (%s)", from->name, from->hostname);
 223                 append_config_file(from->name, "Ed25519PublicKey", pubkey);
 224                 return true;
 225         }
 226
 227         case REQ_KEY: {
 228                 if(!node_read_ecdsa_public_key(from)) {
 229                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "No Ed25519 key known for %s (%s)", from->name, from->hostname);
 230                         send_request(from->nexthop->connection, "%d %s %s %d", REQ_KEY, myself->name, from->name, REQ_PUBKEY);
 231                         return true;
 232                 }
 233
 234                 if(from->sptps.label) {
 235                         logger(DEBUG_ALWAYS, LOG_DEBUG, "Got REQ_KEY from %s while we already started a SPTPS session!", from->name);
 236                 }
 237
 238                 char buf[MAX_STRING_SIZE];
 239                 size_t len;
 240
 241                 if(sscanf(request, "%*d %*s %*s %*d " MAX_STRING, buf) != 1 || !(len = b64decode(buf, buf, strlen(buf)))) {
 242                         logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_SPTPS_START", from->name, from->hostname, "invalid SPTPS data");
 243                         return true;
 244                 }
 245
 246                 char label[25 + strlen(from->name) + strlen(myself->name)];
 247                 snprintf(label, sizeof(label), "tinc UDP key expansion %s %s", from->name, myself->name);
 248                 sptps_stop(&from->sptps);
 249                 from->status.validkey = false;
 250                 from->status.waitingforkey = true;
 251                 from->last_req_key = now.tv_sec;
 252                 sptps_start(&from->sptps, from, false, true, myself->connection->ecdsa, from->ecdsa, label, sizeof(label), send_sptps_data_myself, receive_sptps_record);
 253                 sptps_receive_data(&from->sptps, buf, len);
 254                 send_mtu_info(myself, from, MTU);
 255                 return true;
 256         }
 257
 258         default:
 259                 logger(DEBUG_ALWAYS, LOG_ERR, "Unknown extended REQ_KEY request from %s (%s): %s", from->name, from->hostname, request);
 260                 return true;
 261         }
 262 }
 263
 264 bool req_key_h(connection_t *c, const char *request) {
 265         char from_name[MAX_STRING_SIZE];
 266         char to_name[MAX_STRING_SIZE];
 267         node_t *from, *to;
 268         int reqno = 0;
 269
 270         if(sscanf(request, "%*d " MAX_STRING " " MAX_STRING " %d", from_name, to_name, &reqno) < 2) {
 271                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "REQ_KEY", c->name,
 272                        c->hostname);
 273                 return false;
 274         }
 275
 276         if(!check_id(from_name) || !check_id(to_name)) {
 277                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "REQ_KEY", c->name, c->hostname, "invalid name");
 278                 return false;
 279         }
 280
 281         from = lookup_node(from_name);
 282
 283         if(!from) {
 284                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 285                        "REQ_KEY", c->name, c->hostname, from_name);
 286                 return true;
 287         }
 288
 289         to = lookup_node(to_name);
 290
 291         if(!to) {
 292                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 293                        "REQ_KEY", c->name, c->hostname, to_name);
 294                 return true;
 295         }
 296
 297         /* Check if this key request is for us */
 298
 299         if(to == myself) {                      /* Yes */
 300                 if(!from->status.reachable) {
 301                         logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which is not reachable",
 302                                "REQ_KEY", c->name, c->hostname, from_name);
 303                 }
 304
 305                 /* Is this an extended REQ_KEY message? */
 306                 if(experimental && reqno) {
 307                         return req_key_ext_h(c, request, from, to, reqno);
 308                 }
 309
 310                 /* No, just send our key back */
 311                 send_ans_key(from);
 312         } else {
 313                 if(tunnelserver) {
 314                         return true;
 315                 }
 316
 317                 if(!to->status.reachable) {
 318                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 319                                "REQ_KEY", c->name, c->hostname, to_name);
 320                         return true;
 321                 }
 322
 323                 /* Is this an extended REQ_KEY message? */
 324                 if(experimental && reqno) {
 325                         return req_key_ext_h(c, request, from, to, reqno);
 326                 }
 327
 328                 send_request(to->nexthop->connection, "%s", request);
 329         }
 330
 331         return true;
 332 }
 333
 334 bool send_ans_key(node_t *to) {
 335         if(to->status.sptps) {
 336                 abort();
 337         }
 338
 339 #ifdef DISABLE_LEGACY
 340         return false;
 341 #else
 342         size_t keylen = myself->incipher ? cipher_keylength(myself->incipher) : 1;
 343         char key[keylen * 2 + 1];
 344
 345         randomize(key, keylen);
 346
 347         cipher_close(to->incipher);
 348         digest_close(to->indigest);
 349
 350         if(myself->incipher) {
 351                 to->incipher = cipher_open_by_nid(cipher_get_nid(myself->incipher));
 352
 353                 if(!to->incipher) {
 354                         abort();
 355                 }
 356
 357                 if(!cipher_set_key(to->incipher, key, false)) {
 358                         abort();
 359                 }
 360         }
 361
 362         if(myself->indigest) {
 363                 to->indigest = digest_open_by_nid(digest_get_nid(myself->indigest), digest_length(myself->indigest));
 364
 365                 if(!to->indigest) {
 366                         abort();
 367                 }
 368
 369                 if(!digest_set_key(to->indigest, key, keylen)) {
 370                         abort();
 371                 }
 372         }
 373
 374         to->incompression = myself->incompression;
 375
 376         bin2hex(key, key, keylen);
 377
 378         // Reset sequence number and late packet window
 379         mykeyused = true;
 380         to->received_seqno = 0;
 381         to->received = 0;
 382
 383         if(replaywin) {
 384                 memset(to->late, 0, replaywin);
 385         }
 386
 387         to->status.validkey_in = true;
 388
 389         return send_request(to->nexthop->connection, "%d %s %s %s %d %d %d %d", ANS_KEY,
 390                             myself->name, to->name, key,
 391                             cipher_get_nid(to->incipher),
 392                             digest_get_nid(to->indigest),
 393                             (int)digest_length(to->indigest),
 394                             to->incompression);
 395 #endif
 396 }
 397
 398 bool ans_key_h(connection_t *c, const char *request) {
 399         char from_name[MAX_STRING_SIZE];
 400         char to_name[MAX_STRING_SIZE];
 401         char key[MAX_STRING_SIZE];
 402         char address[MAX_STRING_SIZE] = "";
 403         char port[MAX_STRING_SIZE] = "";
 404         int cipher, digest, maclength, compression;
 405         node_t *from, *to;
 406
 407         if(sscanf(request, "%*d "MAX_STRING" "MAX_STRING" "MAX_STRING" %d %d %d %d "MAX_STRING" "MAX_STRING,
 408                         from_name, to_name, key, &cipher, &digest, &maclength,
 409                         &compression, address, port) < 7) {
 410                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s)", "ANS_KEY", c->name,
 411                        c->hostname);
 412                 return false;
 413         }
 414
 415         if(!check_id(from_name) || !check_id(to_name)) {
 416                 logger(DEBUG_ALWAYS, LOG_ERR, "Got bad %s from %s (%s): %s", "ANS_KEY", c->name, c->hostname, "invalid name");
 417                 return false;
 418         }
 419
 420         from = lookup_node(from_name);
 421
 422         if(!from) {
 423                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) origin %s which does not exist in our connection list",
 424                        "ANS_KEY", c->name, c->hostname, from_name);
 425                 return true;
 426         }
 427
 428         to = lookup_node(to_name);
 429
 430         if(!to) {
 431                 logger(DEBUG_ALWAYS, LOG_ERR, "Got %s from %s (%s) destination %s which does not exist in our connection list",
 432                        "ANS_KEY", c->name, c->hostname, to_name);
 433                 return true;
 434         }
 435
 436         /* Forward it if necessary */
 437
 438         if(to != myself) {
 439                 if(tunnelserver) {
 440                         return true;
 441                 }
 442
 443                 if(!to->status.reachable) {
 444                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got %s from %s (%s) destination %s which is not reachable",
 445                                "ANS_KEY", c->name, c->hostname, to_name);
 446                         return true;
 447                 }
 448
 449                 if(!*address && from->address.sa.sa_family != AF_UNSPEC && to->minmtu) {
 450                         char *address, *port;
 451                         logger(DEBUG_PROTOCOL, LOG_DEBUG, "Appending reflexive UDP address to ANS_KEY from %s to %s", from->name, to->name);
 452                         sockaddr2str(&from->address, &address, &port);
 453                         send_request(to->nexthop->connection, "%s %s %s", request, address, port);
 454                         free(address);
 455                         free(port);
 456                         return true;
 457                 }
 458
 459                 return send_request(to->nexthop->connection, "%s", request);
 460         }
 461
 462 #ifndef DISABLE_LEGACY
 463         /* Don't use key material until every check has passed. */
 464         cipher_close(from->outcipher);
 465         digest_close(from->outdigest);
 466 #endif
 467
 468         if(!from->status.sptps) {
 469                 from->status.validkey = false;
 470         }
 471
 472         switch(compression) {
 473         case 12:
 474 #ifdef HAVE_LZ4
 475                 break;
 476 #else
 477                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 478                 logger(DEBUG_ALWAYS, LOG_ERR, "LZ4 compression is unavailable on this node.");
 479                 return true;
 480 #endif
 481
 482         case 11:
 483         case 10:
 484 #ifdef HAVE_LZO
 485                 break;
 486 #else
 487                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 488                 logger(DEBUG_ALWAYS, LOG_ERR, "LZO compression is unavailable on this node.");
 489                 return true;
 490 #endif
 491
 492         case 9:
 493         case 8:
 494         case 7:
 495         case 6:
 496         case 5:
 497         case 4:
 498         case 3:
 499         case 2:
 500         case 1:
 501 #ifdef HAVE_ZLIB
 502                 break;
 503 #else
 504                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 505                 logger(DEBUG_ALWAYS, LOG_ERR, "ZLIB compression is unavailable on this node.");
 506                 return true;
 507 #endif
 508
 509         case 0:
 510                 break;
 511
 512         default:
 513                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus compression level!", from->name, from->hostname);
 514                 logger(DEBUG_ALWAYS, LOG_ERR, "Compression level %i is unrecognized by this node.", compression);
 515                 return true;
 516         }
 517
 518         from->outcompression = compression;
 519
 520         /* SPTPS or old-style key exchange? */
 521
 522         if(from->status.sptps) {
 523                 char buf[strlen(key)];
 524                 size_t len = b64decode(key, buf, strlen(key));
 525
 526                 if(!len || !sptps_receive_data(&from->sptps, buf, len)) {
 527                         /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
 528                            so let's restart SPTPS in case that helps. But don't do that too often
 529                            to prevent storms.
 530                            Note that simply relying on handshake timeout is not enough, because
 531                            that doesn't apply to key regeneration. */
 532                         if(from->last_req_key < now.tv_sec - 10) {
 533                                 logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode handshake TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
 534                                 send_req_key(from);
 535                         }
 536
 537                         return true;
 538                 }
 539
 540                 if(from->status.validkey) {
 541                         if(*address && *port) {
 542                                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 543                                 sockaddr_t sa = str2sockaddr(address, port);
 544                                 update_node_udp(from, &sa);
 545                         }
 546                 }
 547
 548                 send_mtu_info(myself, from, MTU);
 549
 550                 return true;
 551         }
 552
 553 #ifdef DISABLE_LEGACY
 554         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses legacy protocol!", from->name, from->hostname);
 555         return false;
 556 #else
 557         /* Check and lookup cipher and digest algorithms */
 558
 559         if(cipher) {
 560                 if(!(from->outcipher = cipher_open_by_nid(cipher))) {
 561                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown cipher!", from->name, from->hostname);
 562                         return false;
 563                 }
 564         } else {
 565                 from->outcipher = NULL;
 566         }
 567
 568         if(digest) {
 569                 if(!(from->outdigest = digest_open_by_nid(digest, maclength))) {
 570                         logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses unknown digest!", from->name, from->hostname);
 571                         return false;
 572                 }
 573         } else {
 574                 from->outdigest = NULL;
 575         }
 576
 577         if((size_t)maclength != digest_length(from->outdigest)) {
 578                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses bogus MAC length!", from->name, from->hostname);
 579                 return false;
 580         }
 581
 582         /* Process key */
 583
 584         size_t keylen = hex2bin(key, key, sizeof(key));
 585
 586         if(keylen != (from->outcipher ? cipher_keylength(from->outcipher) : 1)) {
 587                 logger(DEBUG_ALWAYS, LOG_ERR, "Node %s (%s) uses wrong keylength!", from->name, from->hostname);
 588                 return true;
 589         }
 590
 591         /* Update our copy of the origin's packet key */
 592
 593         if(from->outcipher && !cipher_set_key(from->outcipher, key, true)) {
 594                 return false;
 595         }
 596
 597         if(from->outdigest && !digest_set_key(from->outdigest, key, keylen)) {
 598                 return false;
 599         }
 600
 601         from->status.validkey = true;
 602         from->sent_seqno = 0;
 603
 604         if(*address && *port) {
 605                 logger(DEBUG_PROTOCOL, LOG_DEBUG, "Using reflexive UDP address from %s: %s port %s", from->name, address, port);
 606                 sockaddr_t sa = str2sockaddr(address, port);
 607                 update_node_udp(from, &sa);
 608         }
 609
 610         return true;
 611 #endif
 612 }