tinc-vpn.org Git - tinc/blob - src/route.c

   1 /*
   2     route.c -- routing
   3     Copyright (C) 2000-2004 Ivo Timmermans <ivo@tinc-vpn.org>,
   4                   2000-2004 Guus Sliepen <guus@tinc-vpn.org>
   5
   6     This program is free software; you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation; either version 2 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License
  17     along with this program; if not, write to the Free Software
  18     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19
  20     $Id$
  21 */
  22
  23 #include "system.h"
  24
  25 #ifdef HAVE_NET_ETHERNET_H
  26 #include <net/ethernet.h>
  27 #endif
  28 #ifdef HAVE_NET_IF_ARP_H
  29 #include <net/if_arp.h>
  30 #endif
  31 #ifdef HAVE_NETINET_IP_ICMP_H
  32 #include <netinet/ip_icmp.h>
  33 #endif
  34 #ifdef HAVE_NETINET_ICMP6_H
  35 #include <netinet/icmp6.h>
  36 #endif
  37 #ifdef HAVE_NETINET_IF_ETHER_H
  38 #include <netinet/if_ether.h>
  39 #endif
  40
  41 #include "logger/logger.h"
  42 #include "rt/rt.h"
  43 #include "rt/subnet.h"
  44 #include "support/avl.h"
  45 #include "support/ethernet.h"
  46 #include "support/ipv4.h"
  47 #include "support/ipv6.h"
  48
  49 static mac_t mymac = {{0xFE, 0xFD, 0, 0, 0, 0}};
  50
  51 /* Sizes of various headers */
  52
  53 static const size_t ether_size = sizeof(struct ether_header);
  54 static const size_t arp_size = sizeof(struct ether_arp);
  55 static const size_t ip_size = sizeof(struct ip);
  56 static const size_t icmp_size = sizeof(struct icmp) - sizeof(struct ip);
  57 static const size_t ip6_size = sizeof(struct ip6_hdr);
  58 static const size_t icmp6_size = sizeof(struct icmp6_hdr);
  59 static const size_t ns_size = sizeof(struct nd_neighbor_solicit);
  60 static const size_t opt_size = sizeof(struct nd_opt_hdr);
  61
  62 static struct timeval expires(int seconds) {
  63         struct timeval tv;
  64
  65         gettimeofday(&tv, NULL);
  66         tv.tv_sec += seconds;
  67
  68         return tv;
  69 }
  70
  71 /* RFC 1071 */
  72
  73 static __inline__ uint16_t inet_checksum(const void *data, int len, uint16_t prevsum) {
  74         const uint16_t *p = data;
  75         uint32_t checksum = prevsum ^ 0xFFFF;
  76
  77         while(len >= 2) {
  78                 checksum += *p++;
  79                 len -= 2;
  80         }
  81
  82         if(len)
  83                 checksum += *(uint8_t *)p;
  84
  85         while(checksum >> 16)
  86                 checksum = (checksum & 0xFFFF) + (checksum >> 16);
  87
  88         return ~checksum;
  89 }
  90
  91 static __inline__ bool ratelimit(int frequency) {
  92         static time_t lasttime = 0;
  93         static int count = 0;
  94         time_t now = time(NULL);
  95
  96         if(lasttime == now) {
  97                 if(++count > frequency)
  98                         return true;
  99         } else {
 100                 lasttime = now;
 101                 count = 0;
 102         }
 103
 104         return false;
 105 }
 106
 107 static __inline__ bool checklength(node_t *source, int len, int minlen) {
 108         if(len < minlen) {
 109                 logger(LOG_WARNING, _("Got too short packet from %s"), source->name);
 110                 return false;
 111         } else
 112                 return true;
 113 }
 114
 115 static __inline__ void learn_mac(mac_t *address) {
 116         subnet_t *subnet;
 117         avl_node_t *node;
 118
 119         subnet = subnet_get_mac(address);
 120
 121         /* If we don't know this MAC address yet, store it */
 122
 123         if(!subnet) {
 124                 logger(LOG_INFO, _("Learned new MAC address %hx:%hx:%hx:%hx:%hx:%hx"),
 125                                    address->x[0], address->x[1], address->x[2], address->x[3],
 126                                    address->x[4], address->x[5]);
 127
 128                 subnet = subnet_new();
 129                 subnet->type = SUBNET_TYPE_MAC;
 130                 subnet->expires = expires(rt_macexpire);
 131                 subnet->net.mac.address = *address;
 132                 subnet->owner = myself;
 133                 subnet_add(subnet);
 134
 135                 /* And tell all other tinc daemons it's our MAC */
 136
 137 #if 0
 138                 for(node = connection_tree->head; node; node = node->next) {
 139                         c = node->data;
 140                         if(c->status.active)
 141                                 send_add_subnet(c, subnet);
 142                 }
 143 #endif
 144         }
 145
 146         if(timerisset(&subnet->expires))
 147                 subnet->expires = expires(rt_macexpire);
 148 }
 149
 150 void age_subnets(void) {
 151         subnet_t *s;
 152
 153 #if 0
 154         for(node = myself->subnet_tree->head; node; node = next) {
 155                 next = node->next;
 156                 s = node->data;
 157                 if(s->expires && s->expires < now) {
 158                         {
 159                                 char netstr[MAXNETSTR];
 160                                 if(net2str(netstr, sizeof netstr, s))
 161                                         logger(LOG_INFO, _("Subnet %s expired"), netstr);
 162                         }
 163
 164                         for(node2 = connection_tree->head; node2; node2 = node2->next) {
 165                                 c = node2->data;
 166                                 if(c->status.active)
 167                                         send_del_subnet(c, s);
 168                         }
 169
 170                         subnet_del(myself, s);
 171                 }
 172         }
 173 #endif
 174 }
 175
 176 static void send_packet(node_t *dest, const uint8_t *packet, int len) {
 177         if(dest == myself) {
 178                 rt_vnd->send(rt_vnd, packet, len);
 179         } else if (dest->tnl) {
 180                 dest->tnl->send_packet(dest->tnl, packet, len);
 181         } else {
 182                 logger(LOG_ERR, _("No tunnel for packet destination %s!"), dest->name);
 183         }
 184 }
 185
 186 static void broadcast_packet(node_t *source, const uint8_t *packet, int len) {
 187         tnl_t *tnl;
 188         edge_t *edge;
 189
 190         if(source != myself)
 191                 send_packet(myself, packet, len);
 192
 193         avl_foreach(rt_tnls, tnl, {
 194                 edge = tnl->data;
 195                 if(edge && edge->status.mst && edge->to != source)
 196                         send_packet(edge->to, packet, len);
 197         });
 198 }
 199
 200 static __inline__ void route_mac(node_t *source, const uint8_t *packet, int len) {
 201         subnet_t *subnet;
 202
 203         /* Learn source address */
 204
 205         if(source == myself)
 206                 learn_mac((mac_t *)(packet + 6));
 207
 208         /* Lookup destination address */
 209
 210         subnet = subnet_get_mac((mac_t *)(packet));
 211
 212         if(!subnet) {
 213                 broadcast_packet(source, packet, len);
 214                 return;
 215         }
 216
 217         if(subnet->owner == source) {
 218                 logger(LOG_WARNING, _("Packet looping back to %s!"), source->name);
 219                 return;
 220         }
 221
 222         send_packet(subnet->owner, packet, len);
 223 }
 224
 225 /* RFC 792 */
 226
 227 static void route_ipv4_unreachable(node_t *source, const uint8_t *packet, int len, uint8_t type, uint8_t code) {
 228         uint8_t reply[ether_size + IP_MSS];
 229
 230         struct ip ip = {0};
 231         struct icmp icmp = {0};
 232
 233         struct in_addr ip_src;
 234         struct in_addr ip_dst;
 235         uint32_t oldlen;
 236
 237         if(ratelimit(3))
 238                 return;
 239
 240         /* Copy headers from packet into properly aligned structs on the stack */
 241
 242         memcpy(&ip, packet + ether_size, ip_size);
 243
 244         /* Remember original source and destination */
 245
 246         ip_src = ip.ip_src;
 247         ip_dst = ip.ip_dst;
 248
 249         oldlen = len - ether_size;
 250
 251         if(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
 252                 icmp.icmp_nextmtu = htons(len - ether_size);
 253
 254         if(oldlen >= IP_MSS - ip_size - icmp_size)
 255                 oldlen = IP_MSS - ip_size - icmp_size;
 256
 257         /* Copy first part of original contents to ICMP message */
 258
 259         memmove(reply + ether_size + ip_size + icmp_size, packet + ether_size, oldlen);
 260
 261         /* Fill in IPv4 header */
 262
 263         ip.ip_v = 4;
 264         ip.ip_hl = ip_size / 4;
 265         ip.ip_tos = 0;
 266         ip.ip_len = htons(ip_size + icmp_size + oldlen);
 267         ip.ip_id = 0;
 268         ip.ip_off = 0;
 269         ip.ip_ttl = 255;
 270         ip.ip_p = IPPROTO_ICMP;
 271         ip.ip_sum = 0;
 272         ip.ip_src = ip_dst;
 273         ip.ip_dst = ip_src;
 274
 275         ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
 276
 277         /* Fill in ICMP header */
 278
 279         icmp.icmp_type = type;
 280         icmp.icmp_code = code;
 281         icmp.icmp_cksum = 0;
 282
 283         icmp.icmp_cksum = inet_checksum(&icmp, icmp_size, ~0);
 284         icmp.icmp_cksum = inet_checksum(packet + ether_size + ip_size + icmp_size, oldlen, icmp.icmp_cksum);
 285
 286         /* Copy structs on stack back to packet */
 287
 288         memcpy(reply + ether_size, &ip, ip_size);
 289         memcpy(reply + ether_size + ip_size, &icmp, icmp_size);
 290
 291         send_packet(source, reply, ether_size + ip_size + icmp_size + oldlen);
 292 }
 293
 294 /* RFC 791 */
 295
 296 static __inline__ void fragment_ipv4_packet(node_t *dest, const uint8_t *packet, int len) {
 297         struct ip ip;
 298         char fragment[dest->tnl->mtu];
 299         int fraglen, maxlen, todo;
 300         const uint8_t *offset;
 301         uint16_t ip_off, origf;
 302
 303         memcpy(&ip, packet + ether_size, ip_size);
 304
 305         if(ip.ip_hl != ip_size / 4)
 306                 return;
 307
 308         todo = ntohs(ip.ip_len) - ip_size;
 309
 310         if(ether_size + ip_size + todo != len) {
 311                 logger(LOG_WARNING, _("Length of packet (%d) doesn't match length in IPv4 header (%d)"), len, ether_size + ip_size + todo);
 312                 return;
 313         }
 314
 315         logger(LOG_INFO, _("Fragmenting packet of %d bytes to %s"), len, dest->name);
 316
 317         offset = packet + ether_size + ip_size;
 318         maxlen = (dest->tnl->mtu - ether_size - ip_size) & ~0x7;
 319         ip_off = ntohs(ip.ip_off);
 320         origf = ip_off & ~IP_OFFMASK;
 321         ip_off &= IP_OFFMASK;
 322
 323         while(todo) {
 324                 fraglen = todo > maxlen ? maxlen : todo;
 325                 memcpy(fragment + ether_size + ip_size, offset, fraglen);
 326                 todo -= fraglen;
 327                 offset += fraglen;
 328
 329                 ip.ip_len = htons(ip_size + fraglen);
 330                 ip.ip_off = htons(ip_off | origf | (todo ? IP_MF : 0));
 331                 ip.ip_sum = 0;
 332                 ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
 333                 memcpy(fragment, packet, ether_size);
 334                 memcpy(fragment + ether_size, &ip, ip_size);
 335
 336                 send_packet(dest, fragment, ether_size + ip_size + fraglen);
 337
 338                 ip_off += fraglen / 8;
 339         }
 340 }
 341
 342 static __inline__ void route_ipv4_unicast(node_t *source, const uint8_t *packet, int len) {
 343         subnet_t *subnet;
 344         node_t *via;
 345
 346         subnet = subnet_get_ipv4((ipv4_t *)(packet + 30));
 347
 348         if(!subnet) {
 349                 logger(LOG_WARNING, _("Cannot route packet from %s: unknown IPv4 destination address %d.%d.%d.%d"),
 350                                 source->name,
 351                                 packet[30],
 352                                 packet[31],
 353                                 packet[32],
 354                                 packet[33]);
 355
 356                 route_ipv4_unreachable(source, packet, len, ICMP_DEST_UNREACH, ICMP_NET_UNKNOWN);
 357                 return;
 358         }
 359
 360         if(subnet->owner == source) {
 361                 logger(LOG_WARNING, _("Packet looping back to %s!"), source->name);
 362                 return;
 363         }
 364
 365         if(!subnet->owner->status.reachable)
 366                 route_ipv4_unreachable(source, packet, len, ICMP_DEST_UNREACH, ICMP_NET_UNREACH);
 367
 368         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
 369
 370         if(len > via->tnl->mtu && via != myself) {
 371                 logger(LOG_INFO, _("Packet for %s length %d larger than MTU %d"), subnet->owner->name, len, via->tnl->mtu);
 372                 if(packet[20] & 0x40) {
 373                         len = via->tnl->mtu;
 374                         route_ipv4_unreachable(source, packet, len, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
 375                 } else {
 376                         fragment_ipv4_packet(via, packet, len);
 377                 }
 378
 379                 return;
 380         }
 381
 382         send_packet(subnet->owner, packet, len);
 383 }
 384
 385 static __inline__ void route_ipv4(node_t *source, const uint8_t *packet, int len) {
 386         if(!checklength(source, len, ether_size + ip_size))
 387                 return;
 388
 389         route_ipv4_unicast(source, packet, len);
 390 }
 391
 392 /* RFC 2463 */
 393
 394 static void route_ipv6_unreachable(node_t *source, const uint8_t *packet, int len, uint8_t type, uint8_t code) {
 395         uint8_t reply[ether_size + IP_MSS];
 396         struct ip6_hdr ip6;
 397         struct icmp6_hdr icmp6 = {0};
 398         uint16_t checksum;
 399
 400         struct {
 401                 struct in6_addr ip6_src;        /* source address */
 402                 struct in6_addr ip6_dst;        /* destination address */
 403                 uint32_t length;
 404                 uint32_t next;
 405         } pseudo;
 406
 407         if(ratelimit(3))
 408                 return;
 409
 410         /* Copy headers from packet to structs on the stack */
 411
 412         memcpy(&ip6, packet + ether_size, ip6_size);
 413
 414         /* Remember original source and destination */
 415
 416         pseudo.ip6_src = ip6.ip6_dst;
 417         pseudo.ip6_dst = ip6.ip6_src;
 418
 419         pseudo.length = len - ether_size;
 420
 421         if(type == ICMP6_PACKET_TOO_BIG)
 422                 icmp6.icmp6_mtu = htonl(pseudo.length);
 423
 424         if(pseudo.length >= IP_MSS - ip6_size - icmp6_size)
 425                 pseudo.length = IP_MSS - ip6_size - icmp6_size;
 426
 427         /* Copy first part of original contents to ICMP message */
 428
 429         memcpy(reply + ether_size + ip6_size + icmp6_size, packet + ether_size, pseudo.length);
 430
 431         /* Fill in IPv6 header */
 432
 433         ip6.ip6_flow = htonl(0x60000000UL);
 434         ip6.ip6_plen = htons(icmp6_size + pseudo.length);
 435         ip6.ip6_nxt = IPPROTO_ICMPV6;
 436         ip6.ip6_hlim = 255;
 437         ip6.ip6_src = pseudo.ip6_src;
 438         ip6.ip6_dst = pseudo.ip6_dst;
 439
 440         /* Fill in ICMP header */
 441
 442         icmp6.icmp6_type = type;
 443         icmp6.icmp6_code = code;
 444         icmp6.icmp6_cksum = 0;
 445
 446         /* Create pseudo header */
 447
 448         pseudo.length = htonl(icmp6_size + pseudo.length);
 449         pseudo.next = htonl(IPPROTO_ICMPV6);
 450
 451         /* Generate checksum */
 452
 453         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
 454         checksum = inet_checksum(&icmp6, icmp6_size, checksum);
 455         checksum = inet_checksum(reply + ether_size + ip6_size + icmp6_size, ntohl(pseudo.length) - icmp6_size, checksum);
 456
 457         icmp6.icmp6_cksum = checksum;
 458
 459         /* Copy structs on stack back to packet */
 460
 461         memcpy(reply + ether_size, &ip6, ip6_size);
 462         memcpy(reply + ether_size + ip6_size, &icmp6, icmp6_size);
 463
 464         send_packet(source, reply, ether_size + ip6_size + ntohl(pseudo.length));
 465 }
 466
 467 static __inline__ void route_ipv6_unicast(node_t *source, const uint8_t *packet, int len) {
 468         subnet_t *subnet;
 469         node_t *via;
 470
 471         subnet = subnet_get_ipv6((ipv6_t *)(packet + 38));
 472
 473         if(!subnet) {
 474                 logger(LOG_WARNING, _("Cannot route packet from %s: unknown IPv6 destination address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx"),
 475                                 source->name,
 476                                 ntohs(*(uint16_t *)(packet + 38)),
 477                                 ntohs(*(uint16_t *)(packet + 40)),
 478                                 ntohs(*(uint16_t *)(packet + 42)),
 479                                 ntohs(*(uint16_t *)(packet + 44)),
 480                                 ntohs(*(uint16_t *)(packet + 46)),
 481                                 ntohs(*(uint16_t *)(packet + 48)),
 482                                 ntohs(*(uint16_t *)(packet + 50)),
 483                                 ntohs(*(uint16_t *)(packet + 52)));
 484
 485                 route_ipv6_unreachable(source, packet, len, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR);
 486                 return;
 487         }
 488
 489         if(subnet->owner == source) {
 490                 logger(LOG_WARNING, _("Packet looping back to %s!"), source->name);
 491                 return;
 492         }
 493
 494         if(!subnet->owner->status.reachable)
 495                 route_ipv6_unreachable(source, packet, len, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE);
 496
 497         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
 498
 499         if(len > via->tnl->mtu && via != myself) {
 500                 logger(LOG_INFO, _("Packet for %s length %d larger than MTU %d"), subnet->owner->name, len, via->tnl->mtu);
 501                 len = via->tnl->mtu;
 502                 route_ipv6_unreachable(source, packet, len, ICMP6_PACKET_TOO_BIG, 0);
 503                 return;
 504         }
 505
 506         send_packet(subnet->owner, packet, len);
 507 }
 508
 509 /* RFC 2461 */
 510
 511 static void route_neighborsol(node_t *source, const uint8_t *packet, int len) {
 512         uint8_t reply[len];
 513         struct ip6_hdr ip6;
 514         struct nd_neighbor_solicit ns;
 515         struct nd_opt_hdr opt;
 516         subnet_t *subnet;
 517         uint16_t checksum;
 518
 519         struct {
 520                 struct in6_addr ip6_src;        /* source address */
 521                 struct in6_addr ip6_dst;        /* destination address */
 522                 uint32_t length;
 523                 uint32_t next;
 524         } pseudo;
 525
 526         if(!checklength(source, len, ether_size + ip6_size + ns_size + opt_size + ETH_ALEN))
 527                 return;
 528
 529         if(source != myself) {
 530                 logger(LOG_WARNING, _("Got neighbor solicitation request from %s while in router mode!"), source->name);
 531                 return;
 532         }
 533
 534         /* Copy headers from packet to structs on the stack */
 535
 536         memcpy(&ip6, packet + ether_size, ip6_size);
 537         memcpy(&ns, packet + ether_size + ip6_size, ns_size);
 538         memcpy(&opt, packet + ether_size + ip6_size + ns_size, opt_size);
 539
 540         /* First, snatch the source address from the neighbor solicitation packet */
 541
 542         if(rt_overwrite_mac)
 543                 memcpy(mymac.x, packet + ETH_ALEN, ETH_ALEN);
 544
 545         /* Check if this is a valid neighbor solicitation request */
 546
 547         if(ns.nd_ns_hdr.icmp6_type != ND_NEIGHBOR_SOLICIT ||
 548            opt.nd_opt_type != ND_OPT_SOURCE_LINKADDR) {
 549                 logger(LOG_WARNING, _("Cannot route packet: received unknown type neighbor solicitation request"));
 550                 return;
 551         }
 552
 553         /* Create pseudo header */
 554
 555         pseudo.ip6_src = ip6.ip6_src;
 556         pseudo.ip6_dst = ip6.ip6_dst;
 557         pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
 558         pseudo.next = htonl(IPPROTO_ICMPV6);
 559
 560         /* Generate checksum */
 561
 562         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
 563         checksum = inet_checksum(&ns, ns_size, checksum);
 564         checksum = inet_checksum(&opt, opt_size, checksum);
 565         checksum = inet_checksum(packet + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
 566
 567         if(checksum) {
 568                 logger(LOG_WARNING, _("Cannot route packet: checksum error for neighbor solicitation request"));
 569                 return;
 570         }
 571
 572         /* Check if the IPv6 address exists on the VPN */
 573
 574         subnet = subnet_get_ipv6((ipv6_t *) &ns.nd_ns_target);
 575
 576         if(!subnet) {
 577                 logger(LOG_WARNING, _("Cannot route packet: neighbor solicitation request for unknown address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx"),
 578                                    ntohs(((uint16_t *) &ns.nd_ns_target)[0]),
 579                                    ntohs(((uint16_t *) &ns.nd_ns_target)[1]),
 580                                    ntohs(((uint16_t *) &ns.nd_ns_target)[2]),
 581                                    ntohs(((uint16_t *) &ns.nd_ns_target)[3]),
 582                                    ntohs(((uint16_t *) &ns.nd_ns_target)[4]),
 583                                    ntohs(((uint16_t *) &ns.nd_ns_target)[5]),
 584                                    ntohs(((uint16_t *) &ns.nd_ns_target)[6]),
 585                                    ntohs(((uint16_t *) &ns.nd_ns_target)[7]));
 586
 587                 return;
 588         }
 589
 590         /* Check if it is for our own subnet */
 591
 592         if(subnet->owner == myself)
 593                 return;                                 /* silently ignore */
 594
 595         /* Create neighbor advertation reply */
 596
 597         memcpy(reply, packet + ETH_ALEN, ETH_ALEN);     /* copy destination address */
 598         memcpy(reply + ETH_ALEN, packet + ETH_ALEN, ETH_ALEN);  /* copy destination address */
 599         reply[ETH_ALEN * 2 - 1] ^= 0xFF;        /* mangle source address so it looks like it's not from us */
 600
 601         ip6.ip6_dst = ip6.ip6_src;                      /* swap destination and source protocoll address */
 602         ip6.ip6_src = ns.nd_ns_target;
 603
 604         memcpy(reply + ether_size + ip6_size + ns_size + opt_size, reply + ETH_ALEN, ETH_ALEN); /* add fake source hard addr */
 605
 606         ns.nd_ns_cksum = 0;
 607         ns.nd_ns_type = ND_NEIGHBOR_ADVERT;
 608         ns.nd_ns_reserved = htonl(0x40000000UL);        /* Set solicited flag */
 609         opt.nd_opt_type = ND_OPT_TARGET_LINKADDR;
 610
 611         /* Create pseudo header */
 612
 613         pseudo.ip6_src = ip6.ip6_src;
 614         pseudo.ip6_dst = ip6.ip6_dst;
 615         pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
 616         pseudo.next = htonl(IPPROTO_ICMPV6);
 617
 618         /* Generate checksum */
 619
 620         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
 621         checksum = inet_checksum(&ns, ns_size, checksum);
 622         checksum = inet_checksum(&opt, opt_size, checksum);
 623         checksum = inet_checksum(packet + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
 624
 625         ns.nd_ns_hdr.icmp6_cksum = checksum;
 626
 627         /* Copy structs on stack back to packet */
 628
 629         memcpy(reply + ether_size, &ip6, ip6_size);
 630         memcpy(reply + ether_size + ip6_size, &ns, ns_size);
 631         memcpy(reply + ether_size + ip6_size + ns_size, &opt, opt_size);
 632
 633         send_packet(source, reply, len);
 634 }
 635
 636 static __inline__ void route_ipv6(node_t *source, const uint8_t *packet, int len) {
 637         if(!checklength(source, len, ether_size + ip6_size))
 638                 return;
 639
 640         if(packet[20] == IPPROTO_ICMPV6 && checklength(source, len, ether_size + ip6_size + icmp6_size) && packet[54] == ND_NEIGHBOR_SOLICIT) {
 641                 route_neighborsol(source, packet, len);
 642                 return;
 643         }
 644
 645         route_ipv6_unicast(source, packet, len);
 646 }
 647
 648 /* RFC 826 */
 649
 650 static void route_arp(node_t *source, const uint8_t *packet, int len) {
 651         uint8_t reply[len];
 652         struct ether_arp arp;
 653         subnet_t *subnet;
 654         struct in_addr addr;
 655
 656         if(!checklength(source, len, ether_size + arp_size))
 657                 return;
 658
 659         if(source != myself) {
 660                 logger(LOG_WARNING, _("Got ARP request from %s while in router mode!"), source->name);
 661                 return;
 662         }
 663
 664         /* First, snatch the source address from the ARP packet */
 665
 666         if(rt_overwrite_mac)
 667                 memcpy(mymac.x, packet + ETH_ALEN, ETH_ALEN);
 668
 669         /* Copy headers from packet to structs on the stack */
 670
 671         memcpy(&arp, packet + ether_size, arp_size);
 672
 673         /* Check if this is a valid ARP request */
 674
 675         if(ntohs(arp.arp_hrd) != ARPHRD_ETHER || ntohs(arp.arp_pro) != ETH_P_IP ||
 676            arp.arp_hln != ETH_ALEN || arp.arp_pln != sizeof(addr) || ntohs(arp.arp_op) != ARPOP_REQUEST) {
 677                 logger(LOG_WARNING, _("Cannot route packet: received unknown type ARP request"));
 678                 return;
 679         }
 680
 681         /* Check if the IPv4 address exists on the VPN */
 682
 683         subnet = subnet_get_ipv4((ipv4_t *) &arp.arp_tpa);
 684
 685         if(!subnet) {
 686                 logger(LOG_WARNING, _("Cannot route packet: ARP request for unknown address %d.%d.%d.%d"),
 687                                    arp.arp_tpa[0], arp.arp_tpa[1], arp.arp_tpa[2],
 688                                    arp.arp_tpa[3]);
 689                 return;
 690         }
 691
 692         /* Check if it is for our own subnet */
 693
 694         if(subnet->owner == myself)
 695                 return;                                 /* silently ignore */
 696
 697         memcpy(reply, packet + ETH_ALEN, ETH_ALEN);     /* copy destination address */
 698         memcpy(reply + ETH_ALEN, packet + ETH_ALEN, ETH_ALEN);  /* copy destination address */
 699         reply[ETH_ALEN * 2 - 1] ^= 0xFF;        /* mangle source address so it looks like it's not from us */
 700
 701         memcpy(&addr, arp.arp_tpa, sizeof(addr));       /* save protocol addr */
 702         memcpy(arp.arp_tpa, arp.arp_spa, sizeof(addr)); /* swap destination and source protocol address */
 703         memcpy(arp.arp_spa, &addr, sizeof(addr));       /* ... */
 704
 705         memcpy(arp.arp_tha, arp.arp_sha, ETH_ALEN);     /* set target hard/proto addr */
 706         memcpy(arp.arp_sha, reply + ETH_ALEN, ETH_ALEN);        /* add fake source hard addr */
 707         arp.arp_op = htons(ARPOP_REPLY);
 708
 709         /* Copy structs on stack back to packet */
 710
 711         memcpy(reply + ether_size, &arp, arp_size);
 712
 713         send_packet(source, reply, len);
 714 }
 715
 716 void route(node_t *source, const uint8_t *packet, int len) {
 717         if(!checklength(source, len, ether_size))
 718                 return;
 719
 720         switch (rt_mode) {
 721                 case RT_MODE_ROUTER:
 722                         {
 723                                 uint16_t type;
 724
 725                                 type = ntohs(*((uint16_t *)(packet + 12)));
 726                                 switch (type) {
 727                                         case ETH_P_ARP:
 728                                                 route_arp(source, packet, len);
 729                                                 break;
 730
 731                                         case ETH_P_IP:
 732                                                 route_ipv4(source, packet, len);
 733                                                 break;
 734
 735                                         case ETH_P_IPV6:
 736                                                 route_ipv6(source, packet, len);
 737                                                 break;
 738
 739                                         default:
 740                                                 logger(LOG_WARNING, _("Cannot route packet from %s: unknown type %hx"), source->name, type);
 741                                                 break;
 742                                 }
 743                         }
 744                         break;
 745
 746                 case RT_MODE_SWITCH:
 747                         route_mac(source, packet, len);
 748                         break;
 749
 750                 case RT_MODE_HUB:
 751                         broadcast_packet(source, packet, len);
 752                         break;
 753         }
 754 }