X-Git-Url: http://git.meshlink.io/?a=blobdiff_plain;f=src%2Froute.c;h=c73ac9f2e5374c9aaba874bdefd3381b7666d797;hb=36623e15a1c8685e5d8730345c1a7f9c93710fef;hp=1f91db9729588d128848cbc2951118555c8ad6c5;hpb=95a6974de173e0cb78611c6704ed09631d510dae;p=meshlink

diff --git a/src/route.c b/src/route.c
index 1f91db97..c73ac9f2 100644
--- a/src/route.c
+++ b/src/route.c
@@ -20,12 +20,14 @@
 
 #include "system.h"
 
-#include "avl_tree.h"
+#include "splay_tree.h"
 #include "connection.h"
+#include "control_common.h"
 #include "ethernet.h"
 #include "ipv4.h"
 #include "ipv6.h"
 #include "logger.h"
+#include "meta.h"
 #include "net.h"
 #include "protocol.h"
 #include "route.h"
@@ -34,10 +36,14 @@
 
 rmode_t routing_mode = RMODE_ROUTER;
 fmode_t forwarding_mode = FMODE_INTERNAL;
+bool decrement_ttl = true;
+bool directonly = false;
 bool priorityinheritance = false;
 int macexpire = 600;
 bool overwrite_mac = false;
+bool broadcast = true;
 mac_t mymac = {{0xFE, 0xFD, 0, 0, 0, 0}};
+bool pcap = false;
 
 /* Sizes of various headers */
 
@@ -49,7 +55,12 @@ static const size_t ip6_size = sizeof(struct ip6_hdr);
 static const size_t icmp6_size = sizeof(struct icmp6_hdr);
 static const size_t ns_size = sizeof(struct nd_neighbor_solicit);
 static const size_t opt_size = sizeof(struct nd_opt_hdr);
-#define max(a, b) ((a) > (b) ? (a) : (b))
+
+#ifndef MAX
+#define MAX(a, b) ((a) > (b) ? (a) : (b))
+#endif
+
+static struct event age_subnets_event;
 
 /* RFC 1071 */
 
@@ -74,15 +85,17 @@ static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
 static bool ratelimit(int frequency) {
 	static time_t lasttime = 0;
 	static int count = 0;
+	time_t now = time(NULL);
 	
 	if(lasttime == now) {
-		if(++count > frequency)
+		if(count >= frequency)
 			return true;
 	} else {
 		lasttime = now;
 		count = 0;
 	}
 
+	count++;
 	return false;
 }
 
@@ -173,9 +186,43 @@ static void swap_mac_addresses(vpn_packet_t *packet) {
 	memcpy(&packet->data[6], &tmp, sizeof tmp);
 }
 	
+static void age_subnets(int fd, short events, void *data) {
+	subnet_t *s;
+	connection_t *c;
+	splay_node_t *node, *next, *node2;
+	bool left = false;
+	time_t now = time(NULL);
+
+	for(node = myself->subnet_tree->head; node; node = next) {
+		next = node->next;
+		s = node->data;
+		if(s->expires && s->expires < now) {
+			ifdebug(TRAFFIC) {
+				char netstr[MAXNETSTR];
+				if(net2str(netstr, sizeof netstr, s))
+					logger(LOG_INFO, "Subnet %s expired", netstr);
+			}
+
+			for(node2 = connection_tree->head; node2; node2 = node2->next) {
+				c = node2->data;
+				if(c->status.active)
+					send_del_subnet(c, s);
+			}
+
+			subnet_del(myself, s);
+		} else {
+			if(s->expires)
+				left = true;
+		}
+	}
+
+	if(left)
+		event_add(&age_subnets_event, &(struct timeval){10, 0});
+}
+
 static void learn_mac(mac_t *address) {
 	subnet_t *subnet;
-	avl_node_t *node;
+	splay_node_t *node;
 	connection_t *c;
 
 	subnet = lookup_subnet_mac(myself, address);
@@ -189,7 +236,7 @@ static void learn_mac(mac_t *address) {
 
 		subnet = new_subnet();
 		subnet->type = SUBNET_MAC;
-		subnet->expires = now + macexpire;
+		subnet->expires = time(NULL) + macexpire;
 		subnet->net.mac.address = *address;
 		subnet->weight = 10;
 		subnet_add(myself, subnet);
@@ -202,36 +249,13 @@ static void learn_mac(mac_t *address) {
 			if(c->status.active)
 				send_add_subnet(c, subnet);
 		}
-	}
-
-	if(subnet->expires)
-		subnet->expires = now + macexpire;
-}
-
-void age_subnets(void) {
-	subnet_t *s;
-	connection_t *c;
-	avl_node_t *node, *next, *node2;
 
-	for(node = myself->subnet_tree->head; node; node = next) {
-		next = node->next;
-		s = node->data;
-		if(s->expires && s->expires < now) {
-			ifdebug(TRAFFIC) {
-				char netstr[MAXNETSTR];
-				if(net2str(netstr, sizeof netstr, s))
-					logger(LOG_INFO, "Subnet %s expired", netstr);
-			}
-
-			for(node2 = connection_tree->head; node2; node2 = node2->next) {
-				c = node2->data;
-				if(c->status.active)
-					send_del_subnet(c, s);
-			}
-
-			subnet_update(myself, s, false);
-			subnet_del(myself, s);
-		}
+		if(!timeout_initialized(&age_subnets_event))
+			timeout_set(&age_subnets_event, age_subnets, NULL);
+		event_add(&age_subnets_event, &(struct timeval){10, 0});
+	} else {
+		if(subnet->expires)
+			subnet->expires = time(NULL) + macexpire;
 	}
 }
 
@@ -326,7 +350,7 @@ static void fragment_ipv4_packet(node_t *dest, vpn_packet_t *packet) {
 	todo = ntohs(ip.ip_len) - ip_size;
 
 	if(ether_size + ip_size + todo != packet->len) {
-		ifdebug(TRAFFIC) logger(LOG_WARNING, "Length of packet (%d) doesn't match length in IPv4 header (%zd)", packet->len, ether_size + ip_size + todo);
+		ifdebug(TRAFFIC) logger(LOG_WARNING, "Length of packet (%d) doesn't match length in IPv4 header (%d)", packet->len, (int)(ether_size + ip_size + todo));
 		return;
 	}
 
@@ -393,11 +417,19 @@ static void route_ipv4_unicast(node_t *source, vpn_packet_t *packet) {
 		packet->priority = packet->data[15];
 
 	via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
+
+	if(via == source) {
+		ifdebug(TRAFFIC) logger(LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
+		return;
+	}
 	
-	if(via && packet->len > max(via->mtu, 590) && via != myself) {
+	if(directonly && subnet->owner != via)
+		return route_ipv4_unreachable(source, packet, ICMP_DEST_UNREACH, ICMP_NET_ANO);
+
+	if(via && packet->len > MAX(via->mtu, 590) && via != myself) {
 		ifdebug(TRAFFIC) logger(LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
 		if(packet->data[20] & 0x40) {
-			packet->len = max(via->mtu, 590);
+			packet->len = MAX(via->mtu, 590);
 			route_ipv4_unreachable(source, packet, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
 		} else {
 			fragment_ipv4_packet(via, packet);
@@ -415,11 +447,11 @@ static void route_ipv4(node_t *source, vpn_packet_t *packet) {
 	if(!checklength(source, packet, ether_size + ip_size))
 		return;
 
-	if(((packet->data[30] & 0xf0) == 0xe0) || (
+	if(broadcast && (((packet->data[30] & 0xf0) == 0xe0) || (
 			packet->data[30] == 255 &&
 			packet->data[31] == 255 &&
 			packet->data[32] == 255 &&
-			packet->data[33] == 255))
+			packet->data[33] == 255)))
 		broadcast_packet(source, packet);
 	else
 		route_ipv4_unicast(source, packet);
@@ -489,7 +521,7 @@ static void route_ipv6_unreachable(node_t *source, vpn_packet_t *packet, uint8_t
 
 	/* Generate checksum */
 	
-	checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
+	checksum = inet_checksum(&pseudo, sizeof pseudo, ~0);
 	checksum = inet_checksum(&icmp6, icmp6_size, checksum);
 	checksum = inet_checksum(packet->data + ether_size + ip6_size + icmp6_size, ntohl(pseudo.length) - icmp6_size, checksum);
 
@@ -542,9 +574,17 @@ static void route_ipv6_unicast(node_t *source, vpn_packet_t *packet) {
 
 	via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
 	
-	if(via && packet->len > max(via->mtu, 1294) && via != myself) {
+	if(via == source) {
+		ifdebug(TRAFFIC) logger(LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
+		return;
+	}
+	
+	if(directonly && subnet->owner != via)
+		return route_ipv6_unreachable(source, packet, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
+
+	if(via && packet->len > MAX(via->mtu, 1294) && via != myself) {
 		ifdebug(TRAFFIC) logger(LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
-		packet->len = max(via->mtu, 1294);
+		packet->len = MAX(via->mtu, 1294);
 		route_ipv6_unreachable(source, packet, ICMP6_PACKET_TOO_BIG, 0);
 		return;
 	}
@@ -613,7 +653,7 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) {
 
 	/* Generate checksum */
 
-	checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
+	checksum = inet_checksum(&pseudo, sizeof pseudo, ~0);
 	checksum = inet_checksum(&ns, ns_size, checksum);
 	if(has_opt) {
 		checksum = inet_checksum(&opt, opt_size, checksum);
@@ -676,7 +716,7 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) {
 
 	/* Generate checksum */
 
-	checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
+	checksum = inet_checksum(&pseudo, sizeof pseudo, ~0);
 	checksum = inet_checksum(&ns, ns_size, checksum);
 	if(has_opt) {
 		checksum = inet_checksum(&opt, opt_size, checksum);
@@ -704,7 +744,7 @@ static void route_ipv6(node_t *source, vpn_packet_t *packet) {
 		return;
 	}
 
-	if(packet->data[38] == 255)
+	if(broadcast && packet->data[38] == 255)
 		broadcast_packet(source, packet);
 	else
 		route_ipv6_unicast(source, packet);
@@ -737,7 +777,7 @@ static void route_arp(node_t *source, vpn_packet_t *packet) {
 	/* Check if this is a valid ARP request */
 
 	if(ntohs(arp.arp_hrd) != ARPHRD_ETHER || ntohs(arp.arp_pro) != ETH_P_IP ||
-	   arp.arp_hln != ETH_ALEN || arp.arp_pln != sizeof(addr) || ntohs(arp.arp_op) != ARPOP_REQUEST) {
+	   arp.arp_hln != ETH_ALEN || arp.arp_pln != sizeof addr || ntohs(arp.arp_op) != ARPOP_REQUEST) {
 		ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet: received unknown type ARP request");
 		return;
 	}
@@ -761,9 +801,9 @@ static void route_arp(node_t *source, vpn_packet_t *packet) {
 	memcpy(packet->data, packet->data + ETH_ALEN, ETH_ALEN);	/* copy destination address */
 	packet->data[ETH_ALEN * 2 - 1] ^= 0xFF;	/* mangle source address so it looks like it's not from us */
 
-	memcpy(&addr, arp.arp_tpa, sizeof(addr));	/* save protocol addr */
-	memcpy(arp.arp_tpa, arp.arp_spa, sizeof(addr));	/* swap destination and source protocol address */
-	memcpy(arp.arp_spa, &addr, sizeof(addr));	/* ... */
+	memcpy(&addr, arp.arp_tpa, sizeof addr);	/* save protocol addr */
+	memcpy(arp.arp_tpa, arp.arp_spa, sizeof addr);	/* swap destination and source protocol address */
+	memcpy(arp.arp_spa, &addr, sizeof addr);	/* ... */
 
 	memcpy(arp.arp_tha, arp.arp_sha, ETH_ALEN);	/* set target hard/proto addr */
 	memcpy(arp.arp_sha, packet->data + ETH_ALEN, ETH_ALEN);	/* add fake source hard addr */
@@ -794,7 +834,8 @@ static void route_mac(node_t *source, vpn_packet_t *packet) {
 	subnet = lookup_subnet_mac(NULL, &dest);
 
 	if(!subnet) {
-		broadcast_packet(source, packet);
+		if(broadcast)
+			broadcast_packet(source, packet);
 		return;
 	}
 
@@ -809,6 +850,9 @@ static void route_mac(node_t *source, vpn_packet_t *packet) {
 	// Handle packets larger than PMTU
 
 	node_t *via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
+
+	if(directonly && subnet->owner != via)
+		return;
 	
 	if(via && packet->len > via->mtu && via != myself) {
 		ifdebug(TRAFFIC) logger(LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
@@ -833,8 +877,70 @@ static void route_mac(node_t *source, vpn_packet_t *packet) {
 	send_packet(subnet->owner, packet);
 }
 
+static void send_pcap(vpn_packet_t *packet) {
+	pcap = false;
+	for(splay_node_t *node = connection_tree->head; node; node = node->next) {
+		connection_t *c = node->data;
+		if(!c->status.pcap)
+			continue;
+		else
+			pcap = true;
+		if(send_request(c, "%d %d %d", CONTROL, REQ_PCAP, packet->len))
+			send_meta(c, (char *)packet->data, packet->len);
+	}
+}
+
+static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) {
+	uint16_t type = packet->data[12] << 8 | packet->data[13];
+
+	switch (type) {
+		case ETH_P_IP:
+			if(!checklength(source, packet, 14 + 32))
+				return false;
+
+			if(packet->data[22] < 1) {
+				if(packet->data[25] != IPPROTO_ICMP || packet->data[46] != ICMP_TIME_EXCEEDED)
+					route_ipv4_unreachable(source, packet, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL);
+				return false;
+			}
+
+			uint16_t old = packet->data[22] << 8 | packet->data[23];
+			packet->data[22]--;
+			uint16_t new = packet->data[22] << 8 | packet->data[23];
+
+			uint32_t checksum = packet->data[24] << 8 | packet->data[25];
+			checksum += old + (~new & 0xFFFF);
+			while(checksum >> 16)
+				checksum = (checksum & 0xFFFF) + (checksum >> 16);
+			packet->data[24] = checksum >> 8;
+			packet->data[25] = checksum & 0xff;
+
+			return true;
+
+		case ETH_P_IPV6:
+			if(!checklength(source, packet, 14 + 40))
+				return false;
+
+			if(packet->data[21] < 1) {
+				if(packet->data[20] != IPPROTO_ICMPV6 || packet->data[54] != ICMP6_TIME_EXCEEDED)
+					route_ipv6_unreachable(source, packet, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT);
+				return false;
+			}
+
+			packet->data[21]--;
+
+			return true;
+
+		default:
+			return true;
+	}
+}
+
 void route(node_t *source, vpn_packet_t *packet) {
-	if(forwarding_mode == FMODE_KERNEL) {
+	if(pcap)
+		send_pcap(packet);
+
+	if(forwarding_mode == FMODE_KERNEL && source != myself) {
 		send_packet(myself, packet);
 		return;
 	}
@@ -842,6 +948,10 @@ void route(node_t *source, vpn_packet_t *packet) {
 	if(!checklength(source, packet, ether_size))
 		return;
 
+	if(decrement_ttl && source != myself)
+		if(!do_decrement_ttl(source, packet))
+			return;
+
 	switch (routing_mode) {
 		case RMODE_ROUTER:
 			{