7ae49607a331dcd1c5fa7c5bfad302c6806c2d07
[tinc] / src / route.c
1 /*
2     route.c -- routing
3     Copyright (C) 2000-2005 Ivo Timmermans,
4                   2000-2013 Guus Sliepen <guus@tinc-vpn.org>
5
6     This program is free software; you can redistribute it and/or modify
7     it under the terms of the GNU General Public License as published by
8     the Free Software Foundation; either version 2 of the License, or
9     (at your option) any later version.
10
11     This program is distributed in the hope that it will be useful,
12     but WITHOUT ANY WARRANTY; without even the implied warranty of
13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14     GNU General Public License for more details.
15
16     You should have received a copy of the GNU General Public License along
17     with this program; if not, write to the Free Software Foundation, Inc.,
18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19 */
20
21 #include "system.h"
22
23 #include "connection.h"
24 #include "control_common.h"
25 #include "ethernet.h"
26 #include "ipv4.h"
27 #include "ipv6.h"
28 #include "logger.h"
29 #include "meta.h"
30 #include "net.h"
31 #include "protocol.h"
32 #include "route.h"
33 #include "subnet.h"
34 #include "utils.h"
35
36 rmode_t routing_mode = RMODE_ROUTER;
37 fmode_t forwarding_mode = FMODE_INTERNAL;
38 bmode_t broadcast_mode = BMODE_MST;
39 bool decrement_ttl = false;
40 bool directonly = false;
41 bool priorityinheritance = false;
42 int macexpire = 600;
43 bool overwrite_mac = false;
44 mac_t mymac = {{0xFE, 0xFD, 0, 0, 0, 0}};
45 bool pcap = false;
46
47 /* Sizes of various headers */
48
49 static const size_t ether_size = sizeof(struct ether_header);
50 static const size_t arp_size = sizeof(struct ether_arp);
51 static const size_t ip_size = sizeof(struct ip);
52 static const size_t icmp_size = sizeof(struct icmp) - sizeof(struct ip);
53 static const size_t ip6_size = sizeof(struct ip6_hdr);
54 static const size_t icmp6_size = sizeof(struct icmp6_hdr);
55 static const size_t ns_size = sizeof(struct nd_neighbor_solicit);
56 static const size_t opt_size = sizeof(struct nd_opt_hdr);
57
58 #ifndef MAX
59 #define MAX(a, b) ((a) > (b) ? (a) : (b))
60 #endif
61
62 static timeout_t age_subnets_timeout;
63
64 /* RFC 1071 */
65
66 static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
67         uint16_t *p = data;
68         uint32_t checksum = prevsum ^ 0xFFFF;
69
70         while(len >= 2) {
71                 checksum += *p++;
72                 len -= 2;
73         }
74
75         if(len)
76                 checksum += *(uint8_t *)p;
77
78         while(checksum >> 16)
79                 checksum = (checksum & 0xFFFF) + (checksum >> 16);
80
81         return ~checksum;
82 }
83
84 static bool ratelimit(int frequency) {
85         static time_t lasttime = 0;
86         static int count = 0;
87
88         if(lasttime == now.tv_sec) {
89                 if(count >= frequency)
90                         return true;
91         } else {
92                 lasttime = now.tv_sec;
93                 count = 0;
94         }
95
96         count++;
97         return false;
98 }
99
100 static bool checklength(node_t *source, vpn_packet_t *packet, length_t length) {
101         if(packet->len < length) {
102                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Got too short packet from %s (%s)", source->name, source->hostname);
103                 return false;
104         } else
105                 return true;
106 }
107
108 static void swap_mac_addresses(vpn_packet_t *packet) {
109         mac_t tmp;
110         memcpy(&tmp, &DATA(packet)[0], sizeof tmp);
111         memcpy(&DATA(packet)[0], &DATA(packet)[6], sizeof tmp);
112         memcpy(&DATA(packet)[6], &tmp, sizeof tmp);
113 }
114
115 /* RFC 792 */
116
117 static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
118         struct ip ip = {0};
119         struct icmp icmp = {0};
120
121         struct in_addr ip_src;
122         struct in_addr ip_dst;
123         uint32_t oldlen;
124
125         if(ratelimit(3))
126                 return;
127
128         /* Swap Ethernet source and destination addresses */
129
130         swap_mac_addresses(packet);
131
132         /* Copy headers from packet into properly aligned structs on the stack */
133
134         memcpy(&ip, DATA(packet) + ether_size, ip_size);
135
136         /* Remember original source and destination */
137
138         ip_src = ip.ip_src;
139         ip_dst = ip.ip_dst;
140
141         /* Try to reply with an IP address assigned to the local machine */
142
143         if (type == ICMP_TIME_EXCEEDED && code == ICMP_EXC_TTL) {
144                 int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
145                 if (sockfd != -1) {
146                         struct sockaddr_in addr;
147                         memset(&addr, 0, sizeof(addr));
148                         addr.sin_family = AF_INET;
149                         addr.sin_addr = ip.ip_src;
150                         if (!connect(sockfd, (const struct sockaddr*) &addr, sizeof(addr))) {
151                                 memset(&addr, 0, sizeof(addr));
152                                 addr.sin_family = AF_INET;
153                                 socklen_t addrlen = sizeof(addr);
154                                 if (!getsockname(sockfd, (struct sockaddr*) &addr, &addrlen) && addrlen <= sizeof(addr)) {
155                                         ip_dst = addr.sin_addr;
156                                 }
157                         }
158                         close(sockfd);
159                 }
160         }
161
162         oldlen = packet->len - ether_size;
163
164         if(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
165                 icmp.icmp_nextmtu = htons(packet->len - ether_size);
166
167         if(oldlen >= IP_MSS - ip_size - icmp_size)
168                 oldlen = IP_MSS - ip_size - icmp_size;
169
170         /* Copy first part of original contents to ICMP message */
171
172         memmove(DATA(packet) + ether_size + ip_size + icmp_size, DATA(packet) + ether_size, oldlen);
173
174         /* Fill in IPv4 header */
175
176         ip.ip_v = 4;
177         ip.ip_hl = ip_size / 4;
178         ip.ip_tos = 0;
179         ip.ip_len = htons(ip_size + icmp_size + oldlen);
180         ip.ip_id = 0;
181         ip.ip_off = 0;
182         ip.ip_ttl = 255;
183         ip.ip_p = IPPROTO_ICMP;
184         ip.ip_sum = 0;
185         ip.ip_src = ip_dst;
186         ip.ip_dst = ip_src;
187
188         ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
189
190         /* Fill in ICMP header */
191
192         icmp.icmp_type = type;
193         icmp.icmp_code = code;
194         icmp.icmp_cksum = 0;
195
196         icmp.icmp_cksum = inet_checksum(&icmp, icmp_size, ~0);
197         icmp.icmp_cksum = inet_checksum(DATA(packet) + ether_size + ip_size + icmp_size, oldlen, icmp.icmp_cksum);
198
199         /* Copy structs on stack back to packet */
200
201         memcpy(DATA(packet) + ether_size, &ip, ip_size);
202         memcpy(DATA(packet) + ether_size + ip_size, &icmp, icmp_size);
203
204         packet->len = ether_size + ip_size + icmp_size + oldlen;
205
206         send_packet(source, packet);
207 }
208
209 /* RFC 2463 */
210
211 static void route_ipv6_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
212         struct ip6_hdr ip6;
213         struct icmp6_hdr icmp6 = {0};
214         uint16_t checksum;
215
216         struct {
217                 struct in6_addr ip6_src;        /* source address */
218                 struct in6_addr ip6_dst;        /* destination address */
219                 uint32_t length;
220                 uint32_t next;
221         } pseudo;
222
223         if(ratelimit(3))
224                 return;
225
226         /* Swap Ethernet source and destination addresses */
227
228         swap_mac_addresses(packet);
229
230         /* Copy headers from packet to structs on the stack */
231
232         memcpy(&ip6, DATA(packet) + ether_size, ip6_size);
233
234         /* Remember original source and destination */
235
236         pseudo.ip6_src = ip6.ip6_dst;
237         pseudo.ip6_dst = ip6.ip6_src;
238
239         /* Try to reply with an IP address assigned to the local machine */
240
241         if (type == ICMP6_TIME_EXCEEDED && code == ICMP6_TIME_EXCEED_TRANSIT) {
242                 int sockfd = socket(AF_INET6, SOCK_DGRAM, 0);
243                 if (sockfd != -1) {
244                         struct sockaddr_in6 addr;
245                         memset(&addr, 0, sizeof(addr));
246                         addr.sin6_family = AF_INET6;
247                         addr.sin6_addr = ip6.ip6_src;
248                         if (!connect(sockfd, (const struct sockaddr*) &addr, sizeof(addr))) {
249                                 memset(&addr, 0, sizeof(addr));
250                                 addr.sin6_family = AF_INET6;
251                                 socklen_t addrlen = sizeof(addr);
252                                 if (!getsockname(sockfd, (struct sockaddr*) &addr, &addrlen) && addrlen <= sizeof(addr)) {
253                                         pseudo.ip6_src = addr.sin6_addr;
254                                 }
255                         }
256                         close(sockfd);
257                 }
258         }
259
260         pseudo.length = packet->len - ether_size;
261
262         if(type == ICMP6_PACKET_TOO_BIG)
263                 icmp6.icmp6_mtu = htonl(pseudo.length);
264
265         if(pseudo.length >= IP_MSS - ip6_size - icmp6_size)
266                 pseudo.length = IP_MSS - ip6_size - icmp6_size;
267
268         /* Copy first part of original contents to ICMP message */
269
270         memmove(DATA(packet) + ether_size + ip6_size + icmp6_size, DATA(packet) + ether_size, pseudo.length);
271
272         /* Fill in IPv6 header */
273
274         ip6.ip6_flow = htonl(0x60000000UL);
275         ip6.ip6_plen = htons(icmp6_size + pseudo.length);
276         ip6.ip6_nxt = IPPROTO_ICMPV6;
277         ip6.ip6_hlim = 255;
278         ip6.ip6_src = pseudo.ip6_src;
279         ip6.ip6_dst = pseudo.ip6_dst;
280
281         /* Fill in ICMP header */
282
283         icmp6.icmp6_type = type;
284         icmp6.icmp6_code = code;
285         icmp6.icmp6_cksum = 0;
286
287         /* Create pseudo header */
288
289         pseudo.length = htonl(icmp6_size + pseudo.length);
290         pseudo.next = htonl(IPPROTO_ICMPV6);
291
292         /* Generate checksum */
293
294         checksum = inet_checksum(&pseudo, sizeof pseudo, ~0);
295         checksum = inet_checksum(&icmp6, icmp6_size, checksum);
296         checksum = inet_checksum(DATA(packet) + ether_size + ip6_size + icmp6_size, ntohl(pseudo.length) - icmp6_size, checksum);
297
298         icmp6.icmp6_cksum = checksum;
299
300         /* Copy structs on stack back to packet */
301
302         memcpy(DATA(packet) + ether_size, &ip6, ip6_size);
303         memcpy(DATA(packet) + ether_size + ip6_size, &icmp6, icmp6_size);
304
305         packet->len = ether_size + ip6_size + ntohl(pseudo.length);
306
307         send_packet(source, packet);
308 }
309
310 static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) {
311         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
312         length_t ethlen = ether_size;
313
314         if(type == ETH_P_8021Q) {
315                 type = DATA(packet)[16] << 8 | DATA(packet)[17];
316                 ethlen += 4;
317         }
318
319         switch (type) {
320                 case ETH_P_IP:
321                         if(!checklength(source, packet, ethlen + ip_size))
322                                 return false;
323
324                         if(DATA(packet)[ethlen + 8] <= 1) {
325                                 if(DATA(packet)[ethlen + 11] != IPPROTO_ICMP || DATA(packet)[ethlen + 32] != ICMP_TIME_EXCEEDED)
326                                         route_ipv4_unreachable(source, packet, ethlen, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL);
327                                 return false;
328                         }
329
330                         uint16_t old = DATA(packet)[ethlen + 8] << 8 | DATA(packet)[ethlen + 9];
331                         DATA(packet)[ethlen + 8]--;
332                         uint16_t new = DATA(packet)[ethlen + 8] << 8 | DATA(packet)[ethlen + 9];
333
334                         uint32_t checksum = DATA(packet)[ethlen + 10] << 8 | DATA(packet)[ethlen + 11];
335                         checksum += old + (~new & 0xFFFF);
336                         while(checksum >> 16)
337                                 checksum = (checksum & 0xFFFF) + (checksum >> 16);
338                         DATA(packet)[ethlen + 10] = checksum >> 8;
339                         DATA(packet)[ethlen + 11] = checksum & 0xff;
340
341                         return true;
342
343                 case ETH_P_IPV6:
344                         if(!checklength(source, packet, ethlen + ip6_size))
345                                 return false;
346
347                         if(DATA(packet)[ethlen + 7] <= 1) {
348                                 if(DATA(packet)[ethlen + 6] != IPPROTO_ICMPV6 || DATA(packet)[ethlen + 40] != ICMP6_TIME_EXCEEDED)
349                                         route_ipv6_unreachable(source, packet, ethlen, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT);
350                                 return false;
351                         }
352
353                         DATA(packet)[ethlen + 7]--;
354
355                         return true;
356
357                 default:
358                         return true;
359         }
360 }
361
362 static void clamp_mss(const node_t *source, const node_t *via, vpn_packet_t *packet) {
363         if(!source || !via || !(via->options & OPTION_CLAMP_MSS))
364                 return;
365
366         uint16_t mtu = source->mtu;
367         if(via != myself && via->mtu < mtu)
368                 mtu = via->mtu;
369
370         /* Find TCP header */
371         int start = ether_size;
372         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
373
374         if(type == ETH_P_8021Q) {
375                 start += 4;
376                 type = DATA(packet)[16] << 8 | DATA(packet)[17];
377         }
378
379         if(type == ETH_P_IP && DATA(packet)[start + 9] == 6)
380                 start += (DATA(packet)[start] & 0xf) * 4;
381         else if(type == ETH_P_IPV6 && DATA(packet)[start + 6] == 6)
382                 start += 40;
383         else
384                 return;
385
386         if(packet->len <= start + 20)
387                 return;
388
389         /* Use data offset field to calculate length of options field */
390         int len = ((DATA(packet)[start + 12] >> 4) - 5) * 4;
391
392         if(packet->len < start + 20 + len)
393                 return;
394
395         /* Search for MSS option header */
396         for(int i = 0; i < len;) {
397                 if(DATA(packet)[start + 20 + i] == 0)
398                         break;
399
400                 if(DATA(packet)[start + 20 + i] == 1) {
401                         i++;
402                         continue;
403                 }
404
405                 if(i > len - 2 || i > len - DATA(packet)[start + 21 + i])
406                         break;
407
408                 if(DATA(packet)[start + 20 + i] != 2) {
409                         if(DATA(packet)[start + 21 + i] < 2)
410                                 break;
411                         i += DATA(packet)[start + 21 + i];
412                         continue;
413                 }
414
415                 if(DATA(packet)[start + 21] != 4)
416                         break;
417
418                 /* Found it */
419                 uint16_t oldmss = DATA(packet)[start + 22 + i] << 8 | DATA(packet)[start + 23 + i];
420                 uint16_t newmss = mtu - start - 20;
421                 uint32_t csum = DATA(packet)[start + 16] << 8 | DATA(packet)[start + 17];
422
423                 if(oldmss <= newmss)
424                         break;
425
426                 logger(DEBUG_TRAFFIC, LOG_INFO, "Clamping MSS of packet from %s to %s to %d", source->name, via->name, newmss);
427
428                 /* Update the MSS value and the checksum */
429                 DATA(packet)[start + 22 + i] = newmss >> 8;
430                 DATA(packet)[start + 23 + i] = newmss & 0xff;
431                 csum ^= 0xffff;
432                 csum += oldmss ^ 0xffff;
433                 csum += newmss;
434                 csum = (csum & 0xffff) + (csum >> 16);
435                 csum += csum >> 16;
436                 csum ^= 0xffff;
437                 DATA(packet)[start + 16] = csum >> 8;
438                 DATA(packet)[start + 17] = csum;
439                 break;
440         }
441 }
442
443 static void age_subnets(void *data) {
444         bool left = false;
445
446         for splay_each(subnet_t, s, myself->subnet_tree) {
447                 if(s->expires && s->expires < now.tv_sec) {
448                         if(debug_level >= DEBUG_TRAFFIC) {
449                                 char netstr[MAXNETSTR];
450                                 if(net2str(netstr, sizeof netstr, s))
451                                         logger(DEBUG_TRAFFIC, LOG_INFO, "Subnet %s expired", netstr);
452                         }
453
454                         for list_each(connection_t, c, connection_list)
455                                 if(c->edge)
456                                         send_del_subnet(c, s);
457
458                         subnet_del(myself, s);
459                 } else {
460                         if(s->expires)
461                                 left = true;
462                 }
463         }
464
465         if(left)
466                 timeout_set(&age_subnets_timeout, &(struct timeval){10, rand() % 100000});
467 }
468
469 static void learn_mac(mac_t *address) {
470         subnet_t *subnet = lookup_subnet_mac(myself, address);
471
472         /* If we don't know this MAC address yet, store it */
473
474         if(!subnet) {
475                 logger(DEBUG_TRAFFIC, LOG_INFO, "Learned new MAC address %x:%x:%x:%x:%x:%x",
476                                    address->x[0], address->x[1], address->x[2], address->x[3],
477                                    address->x[4], address->x[5]);
478
479                 subnet = new_subnet();
480                 subnet->type = SUBNET_MAC;
481                 subnet->expires = now.tv_sec + macexpire;
482                 subnet->net.mac.address = *address;
483                 subnet->weight = 10;
484                 subnet_add(myself, subnet);
485                 subnet_update(myself, subnet, true);
486
487                 /* And tell all other tinc daemons it's our MAC */
488
489                 for list_each(connection_t, c, connection_list)
490                         if(c->edge)
491                                 send_add_subnet(c, subnet);
492
493                 timeout_add(&age_subnets_timeout, age_subnets, NULL, &(struct timeval){10, rand() % 100000});
494         } else {
495                 if(subnet->expires)
496                         subnet->expires = now.tv_sec + macexpire;
497         }
498 }
499
500 static void route_broadcast(node_t *source, vpn_packet_t *packet) {
501         if(decrement_ttl && source != myself)
502                 if(!do_decrement_ttl(source, packet))
503                         return;
504
505         broadcast_packet(source, packet);
506 }
507
508 /* RFC 791 */
509
510 static void fragment_ipv4_packet(node_t *dest, vpn_packet_t *packet, length_t ether_size) {
511         struct ip ip;
512         vpn_packet_t fragment;
513         int maxlen, todo;
514         uint8_t *offset;
515         uint16_t ip_off, origf;
516
517         memcpy(&ip, DATA(packet) + ether_size, ip_size);
518         fragment.priority = packet->priority;
519         fragment.offset = DEFAULT_PACKET_OFFSET;
520
521         if(ip.ip_hl != ip_size / 4)
522                 return;
523
524         todo = ntohs(ip.ip_len) - ip_size;
525
526         if(ether_size + ip_size + todo != packet->len) {
527                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Length of packet (%d) doesn't match length in IPv4 header (%d)", packet->len, (int)(ether_size + ip_size + todo));
528                 return;
529         }
530
531         logger(DEBUG_TRAFFIC, LOG_INFO, "Fragmenting packet of %d bytes to %s (%s)", packet->len, dest->name, dest->hostname);
532
533         offset = DATA(packet) + ether_size + ip_size;
534         maxlen = (dest->mtu - ether_size - ip_size) & ~0x7;
535         ip_off = ntohs(ip.ip_off);
536         origf = ip_off & ~IP_OFFMASK;
537         ip_off &= IP_OFFMASK;
538
539         while(todo) {
540                 int len = todo > maxlen ? maxlen : todo;
541                 memcpy(DATA(&fragment) + ether_size + ip_size, offset, len);
542                 todo -= len;
543                 offset += len;
544
545                 ip.ip_len = htons(ip_size + len);
546                 ip.ip_off = htons(ip_off | origf | (todo ? IP_MF : 0));
547                 ip.ip_sum = 0;
548                 ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
549                 memcpy(DATA(&fragment), DATA(packet), ether_size);
550                 memcpy(DATA(&fragment) + ether_size, &ip, ip_size);
551                 fragment.len = ether_size + ip_size + len;
552
553                 send_packet(dest, &fragment);
554
555                 ip_off += len / 8;
556         }
557 }
558
559 static void route_ipv4(node_t *source, vpn_packet_t *packet) {
560         if(!checklength(source, packet, ether_size + ip_size))
561                 return;
562
563         subnet_t *subnet;
564         node_t *via;
565         ipv4_t dest;
566
567         memcpy(&dest, &DATA(packet)[30], sizeof dest);
568         subnet = lookup_subnet_ipv4(&dest);
569
570         if(!subnet) {
571                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet from %s (%s): unknown IPv4 destination address %d.%d.%d.%d",
572                                 source->name, source->hostname,
573                                 dest.x[0],
574                                 dest.x[1],
575                                 dest.x[2],
576                                 dest.x[3]);
577
578                 route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNKNOWN);
579                 return;
580         }
581
582         if (!subnet->owner) {
583                 route_broadcast(source, packet);
584                 return;
585         }
586
587         if(subnet->owner == source) {
588                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
589                 return;
590         }
591
592         if(!subnet->owner->status.reachable)
593                 return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNREACH);
594
595         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself)
596                 return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
597
598         if(decrement_ttl && source != myself && subnet->owner != myself)
599                 if(!do_decrement_ttl(source, packet))
600                         return;
601
602         if(priorityinheritance)
603                 packet->priority = DATA(packet)[15];
604
605         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
606
607         if(via == source) {
608                 logger(DEBUG_TRAFFIC, LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
609                 return;
610         }
611
612         if(directonly && subnet->owner != via)
613                 return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
614
615         if(via && packet->len > MAX(via->mtu, 590) && via != myself) {
616                 logger(DEBUG_TRAFFIC, LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
617                 if(DATA(packet)[20] & 0x40) {
618                         packet->len = MAX(via->mtu, 590);
619                         route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
620                 } else {
621                         fragment_ipv4_packet(via, packet, ether_size);
622                 }
623
624                 return;
625         }
626
627         clamp_mss(source, via, packet);
628
629         send_packet(subnet->owner, packet);
630 }
631
632 static void route_neighborsol(node_t *source, vpn_packet_t *packet);
633
634 static void route_ipv6(node_t *source, vpn_packet_t *packet) {
635         if(!checklength(source, packet, ether_size + ip6_size))
636                 return;
637
638         if(DATA(packet)[20] == IPPROTO_ICMPV6 && checklength(source, packet, ether_size + ip6_size + icmp6_size) && DATA(packet)[54] == ND_NEIGHBOR_SOLICIT) {
639                 route_neighborsol(source, packet);
640                 return;
641         }
642
643         subnet_t *subnet;
644         node_t *via;
645         ipv6_t dest;
646
647         memcpy(&dest, &DATA(packet)[38], sizeof dest);
648         subnet = lookup_subnet_ipv6(&dest);
649
650         if(!subnet) {
651                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet from %s (%s): unknown IPv6 destination address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
652                                 source->name, source->hostname,
653                                 ntohs(dest.x[0]),
654                                 ntohs(dest.x[1]),
655                                 ntohs(dest.x[2]),
656                                 ntohs(dest.x[3]),
657                                 ntohs(dest.x[4]),
658                                 ntohs(dest.x[5]),
659                                 ntohs(dest.x[6]),
660                                 ntohs(dest.x[7]));
661
662                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR);
663                 return;
664         }
665
666         if (!subnet->owner) {
667                 route_broadcast(source, packet);
668                 return;
669         }
670
671         if(subnet->owner == source) {
672                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
673                 return;
674         }
675
676         if(!subnet->owner->status.reachable)
677                 return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE);
678
679         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself)
680                 return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
681
682         if(decrement_ttl && source != myself && subnet->owner != myself)
683                 if(!do_decrement_ttl(source, packet))
684                         return;
685
686         if(priorityinheritance)
687                 packet->priority = ((DATA(packet)[14] & 0x0f) << 4) | (DATA(packet)[15] >> 4);
688
689         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
690
691         if(via == source) {
692                 logger(DEBUG_TRAFFIC, LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
693                 return;
694         }
695
696         if(directonly && subnet->owner != via)
697                 return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
698
699         if(via && packet->len > MAX(via->mtu, 1294) && via != myself) {
700                 logger(DEBUG_TRAFFIC, LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
701                 packet->len = MAX(via->mtu, 1294);
702                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_PACKET_TOO_BIG, 0);
703                 return;
704         }
705
706         clamp_mss(source, via, packet);
707
708         send_packet(subnet->owner, packet);
709 }
710
711 /* RFC 2461 */
712
713 static void route_neighborsol(node_t *source, vpn_packet_t *packet) {
714         struct ip6_hdr ip6;
715         struct nd_neighbor_solicit ns;
716         struct nd_opt_hdr opt;
717         subnet_t *subnet;
718         uint16_t checksum;
719         bool has_opt;
720
721         struct {
722                 struct in6_addr ip6_src;
723                 struct in6_addr ip6_dst;
724                 uint32_t length;
725                 uint32_t next;
726         } pseudo;
727
728         if(!checklength(source, packet, ether_size + ip6_size + ns_size))
729                 return;
730
731         has_opt = packet->len >= ether_size + ip6_size + ns_size + opt_size + ETH_ALEN;
732
733         if(source != myself) {
734                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Got neighbor solicitation request from %s (%s) while in router mode!", source->name, source->hostname);
735                 return;
736         }
737
738         /* Copy headers from packet to structs on the stack */
739
740         memcpy(&ip6, DATA(packet) + ether_size, ip6_size);
741         memcpy(&ns, DATA(packet) + ether_size + ip6_size, ns_size);
742         if(has_opt)
743                 memcpy(&opt, DATA(packet) + ether_size + ip6_size + ns_size, opt_size);
744
745         /* First, snatch the source address from the neighbor solicitation packet */
746
747         if(overwrite_mac)
748                 memcpy(mymac.x, DATA(packet) + ETH_ALEN, ETH_ALEN);
749
750         /* Check if this is a valid neighbor solicitation request */
751
752         if(ns.nd_ns_hdr.icmp6_type != ND_NEIGHBOR_SOLICIT ||
753            (has_opt && opt.nd_opt_type != ND_OPT_SOURCE_LINKADDR)) {
754                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: received unknown type neighbor solicitation request");
755                 return;
756         }
757
758         /* Create pseudo header */
759
760         pseudo.ip6_src = ip6.ip6_src;
761         pseudo.ip6_dst = ip6.ip6_dst;
762         if(has_opt)
763                 pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
764         else
765                 pseudo.length = htonl(ns_size);
766         pseudo.next = htonl(IPPROTO_ICMPV6);
767
768         /* Generate checksum */
769
770         checksum = inet_checksum(&pseudo, sizeof pseudo, ~0);
771         checksum = inet_checksum(&ns, ns_size, checksum);
772         if(has_opt) {
773                 checksum = inet_checksum(&opt, opt_size, checksum);
774                 checksum = inet_checksum(DATA(packet) + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
775         }
776
777         if(checksum) {
778                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: checksum error for neighbor solicitation request");
779                 return;
780         }
781
782         /* Check if the IPv6 address exists on the VPN */
783
784         subnet = lookup_subnet_ipv6((ipv6_t *) &ns.nd_ns_target);
785
786         if(!subnet) {
787                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: neighbor solicitation request for unknown address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
788                                    ntohs(((uint16_t *) &ns.nd_ns_target)[0]),
789                                    ntohs(((uint16_t *) &ns.nd_ns_target)[1]),
790                                    ntohs(((uint16_t *) &ns.nd_ns_target)[2]),
791                                    ntohs(((uint16_t *) &ns.nd_ns_target)[3]),
792                                    ntohs(((uint16_t *) &ns.nd_ns_target)[4]),
793                                    ntohs(((uint16_t *) &ns.nd_ns_target)[5]),
794                                    ntohs(((uint16_t *) &ns.nd_ns_target)[6]),
795                                    ntohs(((uint16_t *) &ns.nd_ns_target)[7]));
796
797                 return;
798         }
799
800         /* Check if it is for our own subnet */
801
802         if(subnet->owner == myself)
803                 return;                                          /* silently ignore */
804
805         if(decrement_ttl)
806                 if(!do_decrement_ttl(source, packet))
807                         return;
808
809         /* Create neighbor advertation reply */
810
811         memcpy(DATA(packet), DATA(packet) + ETH_ALEN, ETH_ALEN); /* copy destination address */
812         DATA(packet)[ETH_ALEN * 2 - 1] ^= 0xFF;                  /* mangle source address so it looks like it's not from us */
813
814         ip6.ip6_dst = ip6.ip6_src;                               /* swap destination and source protocoll address */
815         ip6.ip6_src = ns.nd_ns_target;
816
817         if(has_opt)
818                 memcpy(DATA(packet) + ether_size + ip6_size + ns_size + opt_size, DATA(packet) + ETH_ALEN, ETH_ALEN);   /* add fake source hard addr */
819
820         ns.nd_ns_cksum = 0;
821         ns.nd_ns_type = ND_NEIGHBOR_ADVERT;
822         ns.nd_ns_reserved = htonl(0x40000000UL);                 /* Set solicited flag */
823         opt.nd_opt_type = ND_OPT_TARGET_LINKADDR;
824
825         /* Create pseudo header */
826
827         pseudo.ip6_src = ip6.ip6_src;
828         pseudo.ip6_dst = ip6.ip6_dst;
829         if(has_opt)
830                 pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
831         else
832                 pseudo.length = htonl(ns_size);
833         pseudo.next = htonl(IPPROTO_ICMPV6);
834
835         /* Generate checksum */
836
837         checksum = inet_checksum(&pseudo, sizeof pseudo, ~0);
838         checksum = inet_checksum(&ns, ns_size, checksum);
839         if(has_opt) {
840                 checksum = inet_checksum(&opt, opt_size, checksum);
841                 checksum = inet_checksum(DATA(packet) + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
842         }
843
844         ns.nd_ns_hdr.icmp6_cksum = checksum;
845
846         /* Copy structs on stack back to packet */
847
848         memcpy(DATA(packet) + ether_size, &ip6, ip6_size);
849         memcpy(DATA(packet) + ether_size + ip6_size, &ns, ns_size);
850         if(has_opt)
851                 memcpy(DATA(packet) + ether_size + ip6_size + ns_size, &opt, opt_size);
852
853         send_packet(source, packet);
854 }
855
856 /* RFC 826 */
857
858 static void route_arp(node_t *source, vpn_packet_t *packet) {
859         struct ether_arp arp;
860         subnet_t *subnet;
861         struct in_addr addr;
862
863         if(!checklength(source, packet, ether_size + arp_size))
864                 return;
865
866         if(source != myself) {
867                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Got ARP request from %s (%s) while in router mode!", source->name, source->hostname);
868                 return;
869         }
870
871         /* First, snatch the source address from the ARP packet */
872
873         if(overwrite_mac)
874                 memcpy(mymac.x, DATA(packet) + ETH_ALEN, ETH_ALEN);
875
876         /* Copy headers from packet to structs on the stack */
877
878         memcpy(&arp, DATA(packet) + ether_size, arp_size);
879
880         /* Check if this is a valid ARP request */
881
882         if(ntohs(arp.arp_hrd) != ARPHRD_ETHER || ntohs(arp.arp_pro) != ETH_P_IP ||
883            arp.arp_hln != ETH_ALEN || arp.arp_pln != sizeof addr || ntohs(arp.arp_op) != ARPOP_REQUEST) {
884                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: received unknown type ARP request");
885                 return;
886         }
887
888         /* Check if the IPv4 address exists on the VPN */
889
890         subnet = lookup_subnet_ipv4((ipv4_t *) &arp.arp_tpa);
891
892         if(!subnet) {
893                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: ARP request for unknown address %d.%d.%d.%d",
894                                    arp.arp_tpa[0], arp.arp_tpa[1], arp.arp_tpa[2],
895                                    arp.arp_tpa[3]);
896                 return;
897         }
898
899         /* Check if it is for our own subnet */
900
901         if(subnet->owner == myself)
902                 return;                                          /* silently ignore */
903
904         if(decrement_ttl)
905                 if(!do_decrement_ttl(source, packet))
906                         return;
907
908         memcpy(&addr, arp.arp_tpa, sizeof addr);                 /* save protocol addr */
909         memcpy(arp.arp_tpa, arp.arp_spa, sizeof addr);           /* swap destination and source protocol address */
910         memcpy(arp.arp_spa, &addr, sizeof addr);                 /* ... */
911
912         memcpy(arp.arp_tha, arp.arp_sha, ETH_ALEN);              /* set target hard/proto addr */
913         memcpy(arp.arp_sha, DATA(packet) + ETH_ALEN, ETH_ALEN);  /* set source hard/proto addr */
914         arp.arp_sha[ETH_ALEN - 1] ^= 0xFF;                       /* for consistency with route_packet() */
915         arp.arp_op = htons(ARPOP_REPLY);
916
917         /* Copy structs on stack back to packet */
918
919         memcpy(DATA(packet) + ether_size, &arp, arp_size);
920
921         send_packet(source, packet);
922 }
923
924 static void route_mac(node_t *source, vpn_packet_t *packet) {
925         subnet_t *subnet;
926         mac_t dest;
927
928         /* Learn source address */
929
930         if(source == myself) {
931                 mac_t src;
932                 memcpy(&src, &DATA(packet)[6], sizeof src);
933                 learn_mac(&src);
934         }
935
936         /* Lookup destination address */
937
938         memcpy(&dest, &DATA(packet)[0], sizeof dest);
939         subnet = lookup_subnet_mac(NULL, &dest);
940
941         if(!subnet || !subnet->owner) {
942                 route_broadcast(source, packet);
943                 return;
944         }
945
946         if(subnet->owner == source) {
947                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
948                 return;
949         }
950
951         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself)
952                 return;
953
954         if(decrement_ttl && source != myself && subnet->owner != myself)
955                 if(!do_decrement_ttl(source, packet))
956                         return;
957
958         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
959
960         if(priorityinheritance) {
961                 if(type == ETH_P_IP && packet->len >= ether_size + ip_size)
962                         packet->priority = DATA(packet)[15];
963                 else if(type == ETH_P_IPV6 && packet->len >= ether_size + ip6_size)
964                         packet->priority = ((DATA(packet)[14] & 0x0f) << 4) | (DATA(packet)[15] >> 4);
965         }
966
967         // Handle packets larger than PMTU
968
969         node_t *via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
970
971         if(directonly && subnet->owner != via)
972                 return;
973
974         if(via && packet->len > via->mtu && via != myself) {
975                 logger(DEBUG_TRAFFIC, LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
976                 length_t ethlen = 14;
977
978                 if(type == ETH_P_8021Q) {
979                         type = DATA(packet)[16] << 8 | DATA(packet)[17];
980                         ethlen += 4;
981                 }
982
983                 if(type == ETH_P_IP && packet->len > 576 + ethlen) {
984                         if(DATA(packet)[6 + ethlen] & 0x40) {
985                                 packet->len = via->mtu;
986                                 route_ipv4_unreachable(source, packet, ethlen, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
987                         } else {
988                                 fragment_ipv4_packet(via, packet, ethlen);
989                         }
990                         return;
991                 } else if(type == ETH_P_IPV6 && packet->len > 1280 + ethlen) {
992                         packet->len = via->mtu;
993                         route_ipv6_unreachable(source, packet, ethlen, ICMP6_PACKET_TOO_BIG, 0);
994                         return;
995                 }
996         }
997
998         clamp_mss(source, via, packet);
999
1000         send_packet(subnet->owner, packet);
1001 }
1002
1003 static void send_pcap(vpn_packet_t *packet) {
1004         pcap = false;
1005
1006         for list_each(connection_t, c, connection_list) {
1007                 if(!c->status.pcap)
1008                         continue;
1009
1010                 pcap = true;
1011                 int len = packet->len;
1012                 if(c->outmaclength && c->outmaclength < len)
1013                         len = c->outmaclength;
1014
1015                 if(send_request(c, "%d %d %d", CONTROL, REQ_PCAP, len))
1016                         send_meta(c, (char *)DATA(packet), len);
1017         }
1018 }
1019
1020 void route(node_t *source, vpn_packet_t *packet) {
1021         if(pcap)
1022                 send_pcap(packet);
1023
1024         if(forwarding_mode == FMODE_KERNEL && source != myself) {
1025                 send_packet(myself, packet);
1026                 return;
1027         }
1028
1029         if(!checklength(source, packet, ether_size))
1030                 return;
1031
1032         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
1033
1034         switch (routing_mode) {
1035                 case RMODE_ROUTER:
1036                         switch (type) {
1037                                 case ETH_P_ARP:
1038                                         route_arp(source, packet);
1039                                         break;
1040
1041                                 case ETH_P_IP:
1042                                         route_ipv4(source, packet);
1043                                         break;
1044
1045                                 case ETH_P_IPV6:
1046                                         route_ipv6(source, packet);
1047                                         break;
1048
1049                                 default:
1050                                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet from %s (%s): unknown type %hx", source->name, source->hostname, type);
1051                                         break;
1052                         }
1053                         break;
1054
1055                 case RMODE_SWITCH:
1056                         route_mac(source, packet);
1057                         break;
1058
1059                 case RMODE_HUB:
1060                         route_broadcast(source, packet);
1061                         break;
1062         }
1063 }