X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fnet_packet.c;h=fc5720a2aee1fe5a1da7dfe8025a69ca7c6848e6;hp=8bf399f1fdbcd04396a826afea508880105a0d87;hb=0c7e0210d900185d4c1a9ffd969dc2a26d9523a9;hpb=0209f12d27d29f3aedc09b228bd289305851c75d diff --git a/src/net_packet.c b/src/net_packet.c index 8bf399f1..fc5720a2 100644 --- a/src/net_packet.c +++ b/src/net_packet.c @@ -52,6 +52,11 @@ #define MAX(a, b) ((a) > (b) ? (a) : (b)) #endif +/* The minimum size of a probe is 14 bytes, but since we normally use CBC mode + encryption, we can add a few extra random bytes without increasing the + resulting packet size. */ +#define MIN_PROBE_SIZE 18 + int keylifetime = 0; #ifdef HAVE_LZO static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS]; @@ -59,10 +64,10 @@ static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999 static void send_udppacket(node_t *, vpn_packet_t *); -unsigned replaywin = 16; +unsigned replaywin = 32; bool localdiscovery = true; bool udp_discovery = true; -int udp_discovery_keepalive_interval = 9; +int udp_discovery_keepalive_interval = 10; int udp_discovery_interval = 2; int udp_discovery_timeout = 30; @@ -90,101 +95,87 @@ static void udp_probe_timeout_handler(void *data) { logger(DEBUG_TRAFFIC, LOG_INFO, "Too much time has elapsed since last UDP ping response from %s (%s), stopping UDP communication", n->name, n->hostname); n->status.udp_confirmed = false; + n->maxrecentlen = 0; n->mtuprobes = 0; n->minmtu = 0; n->maxmtu = MTU; } +static void send_udp_probe_reply(node_t *n, vpn_packet_t *packet, length_t len) { + if(!n->status.sptps && !n->status.validkey) { + logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP probe reply to %s (%s) but we don't have his key yet", n->name, n->hostname); + return; + } + + /* Type 2 probe replies were introduced in protocol 17.3 */ + if ((n->options >> 24) >= 3) { + DATA(packet)[0] = 2; + uint16_t len16 = htons(len); + memcpy(DATA(packet) + 1, &len16, 2); + packet->len = MIN_PROBE_SIZE; + logger(DEBUG_TRAFFIC, LOG_INFO, "Sending type 2 probe reply length %u to %s (%s)", len, n->name, n->hostname); + + } else { + /* Legacy protocol: n won't understand type 2 probe replies. */ + DATA(packet)[0] = 1; + logger(DEBUG_TRAFFIC, LOG_INFO, "Sending type 1 probe reply length %u to %s (%s)", len, n->name, n->hostname); + } + + /* Temporarily set udp_confirmed, so that the reply is sent + back exactly the way it came in. */ + + bool udp_confirmed = n->status.udp_confirmed; + n->status.udp_confirmed = true; + send_udppacket(n, packet); + n->status.udp_confirmed = udp_confirmed; +} + static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) { if(!DATA(packet)[0]) { logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request %d from %s (%s)", packet->len, n->name, n->hostname); + return send_udp_probe_reply(n, packet, len); + } - /* It's a probe request, send back a reply */ - - /* Type 2 probe replies were introduced in protocol 17.3 */ - if ((n->options >> 24) >= 3) { - uint8_t *data = DATA(packet); - *data++ = 2; - uint16_t len16 = htons(len); memcpy(data, &len16, 2); data += 2; - struct timeval now; - gettimeofday(&now, NULL); - uint32_t sec = htonl(now.tv_sec); memcpy(data, &sec, 4); data += 4; - uint32_t usec = htonl(now.tv_usec); memcpy(data, &usec, 4); data += 4; - packet->len -= 10; - } else { - /* Legacy protocol: n won't understand type 2 probe replies. */ - DATA(packet)[0] = 1; - } - - /* Temporarily set udp_confirmed, so that the reply is sent - back exactly the way it came in. */ - - bool udp_confirmed = n->status.udp_confirmed; - n->status.udp_confirmed = true; - send_udppacket(n, packet); - n->status.udp_confirmed = udp_confirmed; - } else { - length_t probelen = len; - if (DATA(packet)[0] == 2) { - if (len < 3) - logger(DEBUG_TRAFFIC, LOG_WARNING, "Received invalid (too short) UDP probe reply from %s (%s)", n->name, n->hostname); - else { - uint16_t probelen16; memcpy(&probelen16, DATA(packet) + 1, 2); probelen = ntohs(probelen16); - } - } - logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], probelen, n->name, n->hostname); + if (DATA(packet)[0] == 2) { + // It's a type 2 probe reply, use the length field inside the packet + uint16_t len16; + memcpy(&len16, DATA(packet) + 1, 2); + len = ntohs(len16); + } - /* It's a valid reply: now we know bidirectional communication - is possible using the address and socket that the reply - packet used. */ - n->status.udp_confirmed = true; + logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], len, n->name, n->hostname); - if(udp_discovery) { - timeout_del(&n->udp_ping_timeout); - timeout_add(&n->udp_ping_timeout, &udp_probe_timeout_handler, n, &(struct timeval){udp_discovery_timeout, 0}); - } + /* It's a valid reply: now we know bidirectional communication + is possible using the address and socket that the reply + packet used. */ + n->status.udp_confirmed = true; - if(probelen >= n->maxmtu + 1) { - logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname); - n->maxmtu = MTU; - /* Set mtuprobes to 1 so that try_mtu() doesn't reset maxmtu */ - n->mtuprobes = 1; - return; - } + // Reset the UDP ping timer. + n->udp_ping_sent = now; - /* If applicable, raise the minimum supported MTU */ + if(udp_discovery) { + timeout_del(&n->udp_ping_timeout); + timeout_add(&n->udp_ping_timeout, &udp_probe_timeout_handler, n, &(struct timeval){udp_discovery_timeout, 0}); + } - if(probelen > n->maxmtu) - probelen = n->maxmtu; - if(n->minmtu < probelen) { - n->minmtu = probelen; - try_fix_mtu(n); - } + if(len > n->maxmtu) { + logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname); + n->minmtu = len; + n->maxmtu = MTU; + /* Set mtuprobes to 1 so that try_mtu() doesn't reset maxmtu */ + n->mtuprobes = 1; + return; + } else if(n->mtuprobes < 0 && len == n->maxmtu) { + /* We got a maxmtu sized packet, confirming the PMTU is still valid. */ + n->mtuprobes = -1; + n->mtu_ping_sent = now; + } - /* Calculate RTT. - The RTT is the time between the MTU probe burst was sent and the first - reply is received. - */ - - struct timeval now, diff; - gettimeofday(&now, NULL); - timersub(&now, &n->probe_time, &diff); - - struct timeval probe_timestamp = now; - if (DATA(packet)[0] == 2 && packet->len >= 11) { - uint32_t sec; memcpy(&sec, DATA(packet) + 3, 4); - uint32_t usec; memcpy(&usec, DATA(packet) + 7, 4); - probe_timestamp.tv_sec = ntohl(sec); - probe_timestamp.tv_usec = ntohl(usec); - } - - n->probe_counter++; + /* If applicable, raise the minimum supported MTU */ - if(n->probe_counter == 1) { - n->rtt = diff.tv_sec + diff.tv_usec * 1e-6; - n->probe_time = probe_timestamp; - logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->packetloss * 1e2); - } + if(n->minmtu < len) { + n->minmtu = len; + try_fix_mtu(n); } } @@ -266,10 +257,10 @@ static bool try_mac(node_t *n, const vpn_packet_t *inpkt) { #ifdef DISABLE_LEGACY return false; #else - if(!digest_active(n->indigest) || inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) + if(!n->status.validkey_in || !digest_active(n->indigest) || inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) return false; - return digest_verify(n->indigest, SEQNO(inpkt), inpkt->len - digest_length(n->indigest), DATA(inpkt) + inpkt->len - digest_length(n->indigest)); + return digest_verify(n->indigest, inpkt->data, inpkt->len - digest_length(n->indigest), inpkt->data + inpkt->len - digest_length(n->indigest)); #endif } @@ -291,9 +282,19 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { } return false; } - inpkt->offset += 2 * sizeof(node_id_t); - if(!sptps_receive_data(&n->sptps, DATA(inpkt), inpkt->len - 2 * sizeof(node_id_t))) { - logger(DEBUG_TRAFFIC, LOG_ERR, "Got bad packet from %s (%s)", n->name, n->hostname); + n->status.udppacket = true; + bool result = sptps_receive_data(&n->sptps, DATA(inpkt), inpkt->len); + n->status.udppacket = false; + + if(!result) { + /* Uh-oh. It might be that the tunnel is stuck in some corrupted state, + so let's restart SPTPS in case that helps. But don't do that too often + to prevent storms, and because that would make life a little too easy + for external attackers trying to DoS us. */ + if(n->last_req_key < now.tv_sec - 10) { + logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode raw TCP packet from %s (%s), restarting SPTPS", n->name, n->hostname); + send_req_key(n); + } return false; } return true; @@ -403,6 +404,9 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { origlen -= MTU/64 + 20; } + if(inpkt->len > n->maxrecentlen) + n->maxrecentlen = inpkt->len; + inpkt->priority = 0; if(!DATA(inpkt)[12] && !DATA(inpkt)[13]) @@ -430,6 +434,64 @@ void receive_tcppacket(connection_t *c, const char *buffer, int len) { receive_packet(c->node, &outpkt); } +bool receive_tcppacket_sptps(connection_t *c, const char *data, int len) { + if (len < sizeof(node_id_t) + sizeof(node_id_t)) { + logger(DEBUG_ALWAYS, LOG_ERR, "Got too short TCP SPTPS packet from %s (%s)", c->name, c->hostname); + return false; + } + + node_t *to = lookup_node_id((node_id_t *)data); + data += sizeof(node_id_t); len -= sizeof(node_id_t); + if(!to) { + logger(DEBUG_PROTOCOL, LOG_ERR, "Got TCP SPTPS packet from %s (%s) with unknown destination ID", c->name, c->hostname); + return true; + } + + node_t *from = lookup_node_id((node_id_t *)data); + data += sizeof(node_id_t); len -= sizeof(node_id_t); + if(!from) { + logger(DEBUG_PROTOCOL, LOG_ERR, "Got TCP SPTPS packet from %s (%s) with unknown source ID", c->name, c->hostname); + return true; + } + + if(!to->status.reachable) { + /* This can happen in the form of a race condition + if the node just became unreachable. */ + logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot relay TCP packet from %s (%s) because the destination, %s (%s), is unreachable", from->name, from->hostname, to->name, to->hostname); + return true; + } + + /* Help the sender reach us over UDP. + Note that we only do this if we're the destination or the static relay; + otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */ + if(to->via == myself) + send_udp_info(myself, from); + + /* If we're not the final recipient, relay the packet. */ + + if(to != myself) { + send_sptps_data(to, from, 0, data, len); + try_tx(to, true); + return true; + } + + /* The packet is for us */ + + if(!sptps_receive_data(&from->sptps, data, len)) { + /* Uh-oh. It might be that the tunnel is stuck in some corrupted state, + so let's restart SPTPS in case that helps. But don't do that too often + to prevent storms. */ + if(from->last_req_key < now.tv_sec - 10) { + logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode raw TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname); + send_req_key(from); + } + return true; + } + + send_mtu_info(myself, from, MTU); + return true; +} + static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) { if(!n->status.validkey && !n->connection) return; @@ -683,26 +745,34 @@ end: #endif } -static bool send_sptps_data_priv(node_t *to, node_t *from, int type, const void *data, size_t len) { +bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_t len) { node_t *relay = (to->via != myself && (type == PKT_PROBE || (len - SPTPS_DATAGRAM_OVERHEAD) <= to->via->minmtu)) ? to->via : to->nexthop; bool direct = from == myself && to == relay; bool relay_supported = (relay->options >> 24) >= 4; bool tcponly = (myself->options | relay->options) & OPTION_TCPONLY; - /* Send it via TCP if it is a handshake packet, TCPOnly is in use, this is a relay packet that the other node cannot understand, or this packet is larger than the MTU. - TODO: When relaying, the original sender does not know the end-to-end PMTU (it only knows the PMTU of the first hop). - This can lead to scenarios where large packets are sent over UDP to relay, but then relay has no choice but fall back to TCP. */ + /* Send it via TCP if it is a handshake packet, TCPOnly is in use, this is a relay packet that the other node cannot understand, or this packet is larger than the MTU. */ if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && (len - SPTPS_DATAGRAM_OVERHEAD) > relay->minmtu)) { + if(type != SPTPS_HANDSHAKE && (to->nexthop->connection->options >> 24) >= 7) { + char buf[len + sizeof to->id + sizeof from->id]; char* buf_ptr = buf; + memcpy(buf_ptr, &to->id, sizeof to->id); buf_ptr += sizeof to->id; + memcpy(buf_ptr, &from->id, sizeof from->id); buf_ptr += sizeof from->id; + memcpy(buf_ptr, data, len); buf_ptr += len; + logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s) (TCP)", from->name, from->hostname, to->name, to->hostname, to->nexthop->name, to->nexthop->hostname); + return send_sptps_tcppacket(to->nexthop->connection, buf, sizeof buf); + } + char buf[len * 4 / 3 + 5]; b64encode(data, buf, len); - /* If no valid key is known yet, send the packets using ANS_KEY requests, - to ensure we get to learn the reflexive UDP address. */ - if(from == myself && !to->status.validkey) { + /* If this is a handshake packet, use ANS_KEY instead of REQ_KEY, for two reasons: + - We don't want intermediate nodes to switch to UDP to relay these packets; + - ANS_KEY allows us to learn the reflexive UDP address. */ + if(type == SPTPS_HANDSHAKE) { to->incompression = myself->incompression; return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, from->name, to->name, buf, to->incompression); } else { - return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, from->name, to->name, REQ_SPTPS, buf); + return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, from->name, to->name, SPTPS_PACKET, buf); } } @@ -729,7 +799,7 @@ static bool send_sptps_data_priv(node_t *to, node_t *from, int type, const void choose_local_address(relay, &sa, &sock); if(!sa) choose_udp_address(relay, &sa, &sock); - logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s)", from->name, from->hostname, to->name, to->hostname, relay->name, relay->hostname); + logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s) (UDP)", from->name, from->hostname, to->name, to->hostname, relay->name, relay->hostname); if(sendto(listen_socket[sock].udp.fd, buf, buf_ptr - buf, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) { if(sockmsgsize(sockerrno)) { // Compensate for SPTPS overhead @@ -748,10 +818,6 @@ static bool send_sptps_data_priv(node_t *to, node_t *from, int type, const void return true; } -bool send_sptps_data(void *handle, uint8_t type, const void *data, size_t len) { - return send_sptps_data_priv(handle, myself, type, data, len); -} - bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t len) { node_t *from = handle; @@ -773,8 +839,14 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t inpkt.offset = DEFAULT_PACKET_OFFSET; if(type == PKT_PROBE) { + if(!from->status.udppacket) { + logger(DEBUG_ALWAYS, LOG_ERR, "Got SPTPS PROBE packet from %s (%s) via TCP", from->name, from->hostname); + return false; + } inpkt.len = len; memcpy(DATA(&inpkt), data, len); + if(inpkt.len > from->maxrecentlen) + from->maxrecentlen = inpkt.len; udp_probe_h(from, &inpkt, len); return true; } @@ -826,6 +898,9 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t } } + if(from->status.udppacket && inpkt.len > from->maxrecentlen) + from->maxrecentlen = inpkt.len; + receive_packet(from, &inpkt); return true; } @@ -870,18 +945,40 @@ static void try_udp(node_t* n) { if(!udp_discovery) return; + /* Send gratuitous probe replies to 1.1 nodes. */ + + if((n->options >> 24) >= 3 && n->status.udp_confirmed) { + struct timeval ping_tx_elapsed; + timersub(&now, &n->udp_reply_sent, &ping_tx_elapsed); + + if(ping_tx_elapsed.tv_sec >= udp_discovery_keepalive_interval - 1) { + n->udp_reply_sent = now; + if(n->maxrecentlen) { + vpn_packet_t pkt; + pkt.len = n->maxrecentlen; + pkt.offset = DEFAULT_PACKET_OFFSET; + memset(DATA(&pkt), 0, 14); + randomize(DATA(&pkt) + 14, MIN_PROBE_SIZE - 14); + send_udp_probe_reply(n, &pkt, pkt.len); + n->maxrecentlen = 0; + } + } + } + + /* Probe request */ + struct timeval ping_tx_elapsed; timersub(&now, &n->udp_ping_sent, &ping_tx_elapsed); int interval = n->status.udp_confirmed ? udp_discovery_keepalive_interval : udp_discovery_interval; if(ping_tx_elapsed.tv_sec >= interval) { - send_udp_probe_packet(n, MAX(n->minmtu, 16)); + send_udp_probe_packet(n, MIN_PROBE_SIZE); n->udp_ping_sent = now; if(localdiscovery && !n->status.udp_confirmed && n->prevedge) { n->status.send_locally = true; - send_udp_probe_packet(n, 16); + send_udp_probe_packet(n, MIN_PROBE_SIZE); n->status.send_locally = false; } } @@ -929,6 +1026,7 @@ static length_t choose_initial_maxmtu(node_t *n) { mtu -= SPTPS_DATAGRAM_OVERHEAD; if((n->options >> 24) >= 4) mtu -= sizeof(node_id_t) + sizeof(node_id_t); +#ifndef DISABLE_LEGACY } else { mtu -= digest_length(n->outdigest); @@ -948,6 +1046,7 @@ static length_t choose_initial_maxmtu(node_t *n) { } mtu -= 4; // seqno +#endif } if (mtu < 512) { @@ -978,6 +1077,7 @@ static void try_mtu(node_t *n) { return; if(udp_discovery && !n->status.udp_confirmed) { + n->maxrecentlen = 0; n->mtuprobes = 0; n->minmtu = 0; n->maxmtu = MTU; @@ -986,25 +1086,43 @@ static void try_mtu(node_t *n) { /* mtuprobes == 0..19: initial discovery, send bursts with 1 second interval, mtuprobes++ mtuprobes == 20: fix MTU, and go to -1 - mtuprobes == -1: send one >maxmtu probe every pingtimeout */ + mtuprobes == -1: send one maxmtu and one maxmtu+1 probe every pinginterval + mtuprobes ==-2..-3: send one maxmtu probe every second + mtuprobes == -4: maxmtu no longer valid, reset minmtu and maxmtu and go to 0 */ struct timeval elapsed; - timersub(&now, &n->probe_sent_time, &elapsed); + timersub(&now, &n->mtu_ping_sent, &elapsed); if(n->mtuprobes >= 0) { if(n->mtuprobes != 0 && elapsed.tv_sec == 0 && elapsed.tv_usec < 333333) return; } else { - if(elapsed.tv_sec < pingtimeout) - return; + if(n->mtuprobes < -1) { + if(elapsed.tv_sec < 1) + return; + } else { + if(elapsed.tv_sec < pinginterval) + return; + } } + n->mtu_ping_sent = now; + try_fix_mtu(n); + if(n->mtuprobes < -3) { + /* We lost three MTU probes, restart discovery */ + logger(DEBUG_TRAFFIC, LOG_INFO, "Decrease in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname); + n->mtuprobes = 0; + n->minmtu = 0; + } + if(n->mtuprobes < 0) { - /* After the initial discovery, we only send one >maxmtu probe - to detect PMTU increases. */ - if(n->maxmtu + 1 < MTU) + /* After the initial discovery, we only send one maxmtu and one + maxmtu+1 probe to detect PMTU increases. */ + send_udp_probe_packet(n, n->maxmtu); + if(n->mtuprobes == -1 && n->maxmtu + 1 < MTU) send_udp_probe_packet(n, n->maxmtu + 1); + n->mtuprobes--; } else { /* Before initial discovery begins, set maxmtu to the most likely value. If it's underestimated, we will correct it after initial discovery. */ @@ -1049,23 +1167,6 @@ static void try_mtu(node_t *n) { if(n->mtuprobes >= 0) n->mtuprobes++; } - - n->probe_counter = 0; - n->probe_sent_time = now; - n->probe_time = now; - - /* Calculate the packet loss of incoming traffic by comparing the rate of - packets received to the rate with which the sequence number has increased. - TODO: this is unrelated to PMTU discovery - it should be moved elsewhere. - */ - - if(n->received > n->prev_received) - n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno); - else - n->packetloss = n->received_seqno <= n->prev_received_seqno; - - n->prev_received_seqno = n->received_seqno; - n->prev_received = n->received; } /* These functions try to establish a tunnel to a node (or its relay) so that @@ -1081,7 +1182,7 @@ static void try_mtu(node_t *n) { idle. */ -static void try_tx_sptps(node_t *n) { +static void try_tx_sptps(node_t *n, bool mtu) { /* If n is a TCP-only neighbor, we'll only use "cleartext" PACKET messages anyway, so there's no need for SPTPS at all. */ @@ -1092,25 +1193,37 @@ static void try_tx_sptps(node_t *n) { try_sptps(n); - /* Do we need to relay packets? */ + /* Do we need to statically relay packets? */ node_t *via = (n->via == myself) ? n->nexthop : n->via; - /* If the relay doesn't support SPTPS, everything goes via TCP anyway. */ - - if((via->options >> 24) < 4) - return; + /* If we do have a static relay, try everything with that one instead, if it supports relaying. */ - /* If we do have a relay, try everything with that one instead. */ + if(via != n) { + if((via->options >> 24) < 4) + return; + return try_tx(via, mtu); + } - if(via != n) - return try_tx_sptps(via); + /* Otherwise, try to establish UDP connectivity. */ try_udp(n); - try_mtu(n); + if(mtu) + try_mtu(n); + + /* If we don't have UDP connectivity (yet), we need to use a dynamic relay (nexthop) + while we try to establish direct connectivity. */ + + if(!n->status.udp_confirmed && n != n->nexthop && (n->nexthop->options >> 24) >= 4) + try_tx(n->nexthop, mtu); } -static void try_tx_legacy(node_t *n) { +static void try_tx_legacy(node_t *n, bool mtu) { + /* Does he have our key? If not, send one. */ + + if(!n->status.validkey_in) + send_ans_key(n); + /* Check if we already have a key, or request one. */ if(!n->status.validkey) { @@ -1122,7 +1235,17 @@ static void try_tx_legacy(node_t *n) { } try_udp(n); - try_mtu(n); + if(mtu) + try_mtu(n); +} + +void try_tx(node_t *n, bool mtu) { + if(!n->status.reachable) + return; + if(n->status.sptps) + try_tx_sptps(n, mtu); + else + try_tx_legacy(n, mtu); } void send_packet(node_t *n, vpn_packet_t *packet) { @@ -1155,7 +1278,7 @@ void send_packet(node_t *n, vpn_packet_t *packet) { if(n->status.sptps) { send_sptps_packet(n, packet); - try_tx_sptps(n); + try_tx(n, true); return; } @@ -1175,7 +1298,7 @@ void send_packet(node_t *n, vpn_packet_t *packet) { } send_udppacket(via, packet); - try_tx_legacy(via); + try_tx(via, true); } void broadcast_packet(const node_t *from, vpn_packet_t *packet) { @@ -1218,33 +1341,52 @@ void broadcast_packet(const node_t *from, vpn_packet_t *packet) { } } +/* We got a packet from some IP address, but we don't know who sent it. Try to + verify the message authentication code against all active session keys. + Since this is actually an expensive operation, we only do a full check once + a minute, the rest of the time we only check against nodes for which we know + an IP address that matches the one from the packet. */ + static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) { - node_t *n = NULL; + node_t *match = NULL; bool hard = false; static time_t last_hard_try = 0; - for splay_each(edge_t, e, edge_weight_tree) { - if(!e->to->status.reachable || e->to == myself) + for splay_each(node_t, n, node_tree) { + if(!n->status.reachable || n == myself) + continue; + + if(!n->status.validkey_in && !(n->status.sptps && n->sptps.instate)) continue; - if(sockaddrcmp_noport(from, &e->address)) { + bool soft = false; + + for splay_each(edge_t, e, n->edge_tree) { + if(!e->reverse) + continue; + if(!sockaddrcmp_noport(from, &e->reverse->address)) { + soft = true; + break; + } + } + + if(!soft) { if(last_hard_try == now.tv_sec) continue; hard = true; } - if(!try_mac(e->to, pkt)) + if(!try_mac(n, pkt)) continue; - n = e->to; + match = n; break; } if(hard) last_hard_try = now.tv_sec; - last_hard_try = now.tv_sec; - return n; + return match; } void handle_incoming_vpn_data(void *data, int flags) { @@ -1274,6 +1416,9 @@ void handle_incoming_vpn_data(void *data, int flags) { node_t *n = lookup_node_udp(&addr); + if(n && !n->status.udp_confirmed) + n = NULL; // Don't believe it if we don't have confirmation yet. + if(!n) { // It might be from a 1.1 node, which might have a source ID in the packet. pkt.offset = 2 * sizeof(node_id_t); @@ -1301,10 +1446,16 @@ skip_harder: return; } + pkt.offset = 0; + if(n->status.sptps) { - pkt.offset = 2 * sizeof(node_id_t); + bool relay_enabled = (n->options >> 24) >= 4; + if (relay_enabled) { + pkt.offset = 2 * sizeof(node_id_t); + pkt.len -= pkt.offset; + } - if(!memcmp(DSTID(&pkt), &nullid, sizeof nullid)) { + if(!memcmp(DSTID(&pkt), &nullid, sizeof nullid) || !relay_enabled) { direct = true; from = n; to = myself; @@ -1317,8 +1468,27 @@ skip_harder: return; } + if(!to->status.reachable) { + /* This can happen in the form of a race condition + if the node just became unreachable. */ + logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot relay packet from %s (%s) because the destination, %s (%s), is unreachable", from->name, from->hostname, to->name, to->hostname); + return; + } + + /* The packet is supposed to come from the originator or its static relay + (i.e. with no dynamic relays in between). + If it did not, "help" the static relay by sending it UDP info. + Note that we only do this if we're the destination or the static relay; + otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */ + + if(n != from->via && to->via == myself) + send_udp_info(myself, from); + + /* If we're not the final recipient, relay the packet. */ + if(to != myself) { - send_sptps_data_priv(to, n, 0, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t)); + send_sptps_data(to, from, 0, DATA(&pkt), pkt.len); + try_tx(to, true); return; } } else { @@ -1326,13 +1496,18 @@ skip_harder: from = n; } - pkt.offset = 0; if(!receive_udppacket(from, &pkt)) return; n->sock = ls - listen_socket; if(direct && sockaddrcmp(&addr, &n->address)) update_node_udp(n, &addr); + + /* If the packet went through a relay, help the sender find the appropriate MTU + through the relay path. */ + + if(!direct) + send_mtu_info(myself, n, MTU); } void handle_device_data(void *data, int flags) {