git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2013 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #ifdef HAVE_ZLIB
  26 #include <zlib.h>
  27 #endif
  28
  29 #ifdef HAVE_LZO
  30 #include LZO1X_H
  31 #endif
  32
  33 #include "cipher.h"
  34 #include "conf.h"
  35 #include "connection.h"
  36 #include "crypto.h"
  37 #include "digest.h"
  38 #include "ethernet.h"
  39 #include "graph.h"
  40 #include "logger.h"
  41 #include "net.h"
  42 #include "netutl.h"
  43 #include "protocol.h"
  44 #include "route.h"
  45 #include "utils.h"
  46 #include "xalloc.h"
  47
  48 int keylifetime = 0;
  49 #ifdef HAVE_LZO
  50 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  51 #endif
  52
  53 static void send_udppacket(node_t *, vpn_packet_t *);
  54
  55 unsigned replaywin = 16;
  56 bool localdiscovery = false;
  57 sockaddr_t localdiscovery_address;
  58
  59 #define MAX_SEQNO 1073741824
  60
  61 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  62    mtuprobes ==    31: sleep pinginterval seconds
  63    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  64    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  65
  66    Probes are sent in batches of at least three, with random sizes between the
  67    lower and upper boundaries for the MTU thus far discovered.
  68
  69    After the initial discovery, a fourth packet is added to each batch with a
  70    size larger than the currently known PMTU, to test if the PMTU has increased.
  71
  72    In case local discovery is enabled, another packet is added to each batch,
  73    which will be broadcast to the local network.
  74
  75 */
  76
  77 static void send_mtu_probe_handler(void *data) {
  78         node_t *n = data;
  79         int timeout = 1;
  80
  81         n->mtuprobes++;
  82
  83         if(!n->status.reachable || !n->status.validkey) {
  84                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  85                 n->mtuprobes = 0;
  86                 return;
  87         }
  88
  89         if(n->mtuprobes > 32) {
  90                 if(!n->minmtu) {
  91                         n->mtuprobes = 31;
  92                         timeout = pinginterval;
  93                         goto end;
  94                 }
  95
  96                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
  97                 n->status.udp_confirmed = false;
  98                 n->mtuprobes = 1;
  99                 n->minmtu = 0;
 100                 n->maxmtu = MTU;
 101         }
 102
 103         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 104                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 105                 n->mtuprobes = 31;
 106         }
 107
 108         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 109                 if(n->minmtu > n->maxmtu)
 110                         n->minmtu = n->maxmtu;
 111                 else
 112                         n->maxmtu = n->minmtu;
 113                 n->mtu = n->minmtu;
 114                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 115                 n->mtuprobes = 31;
 116         }
 117
 118         if(n->mtuprobes == 31) {
 119                 timeout = pinginterval;
 120                 goto end;
 121         } else if(n->mtuprobes == 32) {
 122                 timeout = pingtimeout;
 123         }
 124
 125         for(int i = 0; i < 4 + localdiscovery; i++) {
 126                 int len;
 127
 128                 if(i == 0) {
 129                         if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
 130                                 continue;
 131                         len = n->maxmtu + 8;
 132                 } else if(n->maxmtu <= n->minmtu) {
 133                         len = n->maxmtu;
 134                 } else {
 135                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 136                 }
 137
 138                 if(len < 64)
 139                         len = 64;
 140
 141                 vpn_packet_t packet;
 142                 memset(packet.data, 0, 14);
 143                 randomize(packet.data + 14, len - 14);
 144                 packet.len = len;
 145                 packet.priority = 0;
 146                 n->status.broadcast = i >= 4 && n->mtuprobes <= 10 && n->prevedge;
 147
 148                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 149
 150                 send_udppacket(n, &packet);
 151         }
 152
 153         n->status.broadcast = false;
 154         n->probe_counter = 0;
 155         gettimeofday(&n->probe_time, NULL);
 156
 157         /* Calculate the packet loss of incoming traffic by comparing the rate of
 158            packets received to the rate with which the sequence number has increased.
 159          */
 160
 161         if(n->received > n->prev_received)
 162                 n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno);
 163         else
 164                 n->packetloss = n->received_seqno <= n->prev_received_seqno;
 165
 166         n->prev_received_seqno = n->received_seqno;
 167         n->prev_received = n->received;
 168
 169 end:
 170         timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
 171 }
 172
 173 void send_mtu_probe(node_t *n) {
 174         timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
 175         send_mtu_probe_handler(n);
 176 }
 177
 178 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 179         if(!packet->data[0]) {
 180                 logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe request %d from %s (%s)", packet->len, n->name, n->hostname);
 181
 182                 /* It's a probe request, send back a reply */
 183
 184                 /* Type 2 probe replies were introduced in protocol 17.3 */
 185                 if ((n->options >> 24) == 3) {
 186                         uint8_t* data = packet->data;
 187                         *data++ = 2;
 188                         uint16_t len16 = htons(len); memcpy(data, &len16, 2); data += 2;
 189                         struct timeval now;
 190                         gettimeofday(&now, NULL);
 191                         uint32_t sec = htonl(now.tv_sec); memcpy(data, &sec, 4); data += 4;
 192                         uint32_t usec = htonl(now.tv_usec); memcpy(data, &usec, 4); data += 4;
 193                         packet->len = data - packet->data;
 194                 } else {
 195                         /* Legacy protocol: n won't understand type 2 probe replies. */
 196                         packet->data[0] = 1;
 197                 }
 198
 199                 /* Temporarily set udp_confirmed, so that the reply is sent
 200                    back exactly the way it came in. */
 201
 202                 bool udp_confirmed = n->status.udp_confirmed;
 203                 n->status.udp_confirmed = true;
 204                 send_udppacket(n, packet);
 205                 n->status.udp_confirmed = udp_confirmed;
 206         } else {
 207                 length_t probelen = len;
 208                 if (packet->data[0] == 2) {
 209                         if (len < 3)
 210                                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received invalid (too short) MTU probe reply from %s (%s)", n->name, n->hostname);
 211                         else {
 212                                 uint16_t probelen16; memcpy(&probelen16, packet->data + 1, 2); probelen = ntohs(probelen16);
 213                         }
 214                 }
 215                 logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d MTU probe reply %d from %s (%s)", packet->data[0], probelen, n->name, n->hostname);
 216
 217                 /* It's a valid reply: now we know bidirectional communication
 218                    is possible using the address and socket that the reply
 219                    packet used. */
 220
 221                 n->status.udp_confirmed = true;
 222
 223                 /* If we haven't established the PMTU yet, restart the discovery process. */
 224
 225                 if(n->mtuprobes > 30) {
 226                         if (probelen == n->maxmtu + 8) {
 227                                 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
 228                                 n->maxmtu = MTU;
 229                                 n->mtuprobes = 10;
 230                                 return;
 231                         }
 232
 233                         if(n->minmtu)
 234                                 n->mtuprobes = 30;
 235                         else
 236                                 n->mtuprobes = 1;
 237                 }
 238
 239                 /* If applicable, raise the minimum supported MTU */
 240
 241                 if(probelen > n->maxmtu)
 242                         probelen = n->maxmtu;
 243                 if(n->minmtu < probelen)
 244                         n->minmtu = probelen;
 245
 246                 /* Calculate RTT and bandwidth.
 247                    The RTT is the time between the MTU probe burst was sent and the first
 248                    reply is received. The bandwidth is measured using the time between the
 249                    arrival of the first and third probe reply (or type 2 probe requests).
 250                  */
 251
 252                 struct timeval now, diff;
 253                 gettimeofday(&now, NULL);
 254                 timersub(&now, &n->probe_time, &diff);
 255
 256                 struct timeval probe_timestamp = now;
 257                 if (packet->data[0] == 2 && packet->len >= 11) {
 258                         uint32_t sec; memcpy(&sec, packet->data + 3, 4);
 259                         uint32_t usec; memcpy(&usec, packet->data + 7, 4);
 260                         probe_timestamp.tv_sec = ntohl(sec);
 261                         probe_timestamp.tv_usec = ntohl(usec);
 262                 }
 263
 264                 n->probe_counter++;
 265
 266                 if(n->probe_counter == 1) {
 267                         n->rtt = diff.tv_sec + diff.tv_usec * 1e-6;
 268                         n->probe_time = probe_timestamp;
 269                 } else if(n->probe_counter == 3) {
 270                         struct timeval probe_timestamp_diff;
 271                         timersub(&probe_timestamp, &n->probe_time, &probe_timestamp_diff);
 272                         n->bandwidth = 2.0 * probelen / (probe_timestamp_diff.tv_sec + probe_timestamp_diff.tv_usec * 1e-6);
 273                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, burst bandwidth %.3f Mbit/s, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->bandwidth * 8e-6, n->packetloss * 1e2);
 274                 }
 275         }
 276 }
 277
 278 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 279         if(level == 0) {
 280                 memcpy(dest, source, len);
 281                 return len;
 282         } else if(level == 10) {
 283 #ifdef HAVE_LZO
 284                 lzo_uint lzolen = MAXSIZE;
 285                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 286                 return lzolen;
 287 #else
 288                 return -1;
 289 #endif
 290         } else if(level < 10) {
 291 #ifdef HAVE_ZLIB
 292                 unsigned long destlen = MAXSIZE;
 293                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 294                         return destlen;
 295                 else
 296 #endif
 297                         return -1;
 298         } else {
 299 #ifdef HAVE_LZO
 300                 lzo_uint lzolen = MAXSIZE;
 301                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 302                 return lzolen;
 303 #else
 304                 return -1;
 305 #endif
 306         }
 307
 308         return -1;
 309 }
 310
 311 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 312         if(level == 0) {
 313                 memcpy(dest, source, len);
 314                 return len;
 315         } else if(level > 9) {
 316 #ifdef HAVE_LZO
 317                 lzo_uint lzolen = MAXSIZE;
 318                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 319                         return lzolen;
 320                 else
 321 #endif
 322                         return -1;
 323         }
 324 #ifdef HAVE_ZLIB
 325         else {
 326                 unsigned long destlen = MAXSIZE;
 327                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 328                         return destlen;
 329                 else
 330                         return -1;
 331         }
 332 #endif
 333
 334         return -1;
 335 }
 336
 337 /* VPN packet I/O */
 338
 339 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 340         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 341                            packet->len, n->name, n->hostname);
 342
 343         n->in_packets++;
 344         n->in_bytes += packet->len;
 345
 346         route(n, packet);
 347 }
 348
 349 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 350         if(n->status.sptps)
 351                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 352
 353         if(!digest_active(n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest))
 354                 return false;
 355
 356         return digest_verify(n->indigest, &inpkt->seqno, inpkt->len - digest_length(n->indigest), (const char *)&inpkt->seqno + inpkt->len - digest_length(n->indigest));
 357 }
 358
 359 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 360         vpn_packet_t pkt1, pkt2;
 361         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 362         int nextpkt = 0;
 363         vpn_packet_t *outpkt = pkt[0];
 364         size_t outlen;
 365
 366         if(n->status.sptps) {
 367                 if(!n->sptps.state) {
 368                         if(!n->status.waitingforkey) {
 369                                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but we haven't exchanged keys yet", n->name, n->hostname);
 370                                 send_req_key(n);
 371                         } else {
 372                                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
 373                         }
 374                         return;
 375                 }
 376                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 377                 return;
 378         }
 379
 380         if(!cipher_active(n->incipher)) {
 381                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
 382                 return;
 383         }
 384
 385         /* Check packet length */
 386
 387         if(inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest)) {
 388                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 389                                         n->name, n->hostname);
 390                 return;
 391         }
 392
 393         /* Check the message authentication code */
 394
 395         if(digest_active(n->indigest)) {
 396                 inpkt->len -= digest_length(n->indigest);
 397                 if(!digest_verify(n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 398                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 399                         return;
 400                 }
 401         }
 402         /* Decrypt the packet */
 403
 404         if(cipher_active(n->incipher)) {
 405                 outpkt = pkt[nextpkt++];
 406                 outlen = MAXSIZE;
 407
 408                 if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 409                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 410                         return;
 411                 }
 412
 413                 outpkt->len = outlen;
 414                 inpkt = outpkt;
 415         }
 416
 417         /* Check the sequence number */
 418
 419         inpkt->len -= sizeof inpkt->seqno;
 420         inpkt->seqno = ntohl(inpkt->seqno);
 421
 422         if(replaywin) {
 423                 if(inpkt->seqno != n->received_seqno + 1) {
 424                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 425                                 if(n->farfuture++ < replaywin >> 2) {
 426                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 427                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 428                                         return;
 429                                 }
 430                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 431                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 432                                 memset(n->late, 0, replaywin);
 433                         } else if (inpkt->seqno <= n->received_seqno) {
 434                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 435                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 436                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 437                                         return;
 438                                 }
 439                         } else {
 440                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 441                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 442                         }
 443                 }
 444
 445                 n->farfuture = 0;
 446                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 447         }
 448
 449         if(inpkt->seqno > n->received_seqno)
 450                 n->received_seqno = inpkt->seqno;
 451
 452         n->received++;
 453
 454         if(n->received_seqno > MAX_SEQNO)
 455                 regenerate_key();
 456
 457         /* Decompress the packet */
 458
 459         length_t origlen = inpkt->len;
 460
 461         if(n->incompression) {
 462                 outpkt = pkt[nextpkt++];
 463
 464                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 465                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 466                                                  n->name, n->hostname);
 467                         return;
 468                 }
 469
 470                 inpkt = outpkt;
 471
 472                 origlen -= MTU/64 + 20;
 473         }
 474
 475         inpkt->priority = 0;
 476
 477         if(!inpkt->data[12] && !inpkt->data[13])
 478                 mtu_probe_h(n, inpkt, origlen);
 479         else
 480                 receive_packet(n, inpkt);
 481 }
 482
 483 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 484         vpn_packet_t outpkt;
 485
 486         if(len > sizeof outpkt.data)
 487                 return;
 488
 489         outpkt.len = len;
 490         if(c->options & OPTION_TCPONLY)
 491                 outpkt.priority = 0;
 492         else
 493                 outpkt.priority = -1;
 494         memcpy(outpkt.data, buffer, len);
 495
 496         receive_packet(c->node, &outpkt);
 497 }
 498
 499 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 500         if(!n->status.validkey) {
 501                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 502                 if(!n->status.waitingforkey)
 503                         send_req_key(n);
 504                 else if(n->last_req_key + 10 < now.tv_sec) {
 505                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 506                         sptps_stop(&n->sptps);
 507                         n->status.waitingforkey = false;
 508                         send_req_key(n);
 509                 }
 510                 return;
 511         }
 512
 513         uint8_t type = 0;
 514         int offset = 0;
 515
 516         if(!(origpkt->data[12] | origpkt->data[13])) {
 517                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 518                 return;
 519         }
 520
 521         if(routing_mode == RMODE_ROUTER)
 522                 offset = 14;
 523         else
 524                 type = PKT_MAC;
 525
 526         if(origpkt->len < offset)
 527                 return;
 528
 529         vpn_packet_t outpkt;
 530
 531         if(n->outcompression) {
 532                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 533                 if(len < 0) {
 534                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 535                 } else if(len < origpkt->len - offset) {
 536                         outpkt.len = len + offset;
 537                         origpkt = &outpkt;
 538                         type |= PKT_COMPRESSED;
 539                 }
 540         }
 541
 542         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 543         return;
 544 }
 545
 546 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 547         /* Latest guess */
 548         *sa = &n->address;
 549         *sock = n->sock;
 550
 551         /* If the UDP address is confirmed, use it. */
 552         if(n->status.udp_confirmed)
 553                 return;
 554
 555         /* Send every third packet to n->address; that could be set
 556            to the node's reflexive UDP address discovered during key
 557            exchange. */
 558
 559         static int x = 0;
 560         if(++x >= 3) {
 561                 x = 0;
 562                 return;
 563         }
 564
 565         /* Otherwise, address are found in edges to this node.
 566            So we pick a random edge and a random socket. */
 567
 568         int i = 0;
 569         int j = rand() % n->edge_tree->count;
 570         edge_t *candidate = NULL;
 571
 572         for splay_each(edge_t, e, n->edge_tree) {
 573                 if(i++ == j) {
 574                         candidate = e->reverse;
 575                         break;
 576                 }
 577         }
 578
 579         if(candidate) {
 580                 *sa = &candidate->address;
 581                 *sock = rand() % listen_sockets;
 582         }
 583
 584         /* Make sure we have a suitable socket for the chosen address */
 585         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 586                 for(int i = 0; i < listen_sockets; i++) {
 587                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 588                                 *sock = i;
 589                                 break;
 590                         }
 591                 }
 592         }
 593 }
 594
 595 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 596         static sockaddr_t broadcast_ipv4 = {
 597                 .in = {
 598                         .sin_family = AF_INET,
 599                         .sin_addr.s_addr = -1,
 600                 }
 601         };
 602
 603         static sockaddr_t broadcast_ipv6 = {
 604                 .in6 = {
 605                         .sin6_family = AF_INET6,
 606                         .sin6_addr.s6_addr[0x0] = 0xff,
 607                         .sin6_addr.s6_addr[0x1] = 0x02,
 608                         .sin6_addr.s6_addr[0xf] = 0x01,
 609                 }
 610         };
 611
 612         *sock = rand() % listen_sockets;
 613
 614         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 615                 if(localdiscovery_address.sa.sa_family == AF_INET6) {
 616                         localdiscovery_address.in6.sin6_port = n->prevedge->address.in.sin_port;
 617                         *sa = &localdiscovery_address;
 618                 } else {
 619                         broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 620                         broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
 621                         *sa = &broadcast_ipv6;
 622                 }
 623         } else {
 624                 if(localdiscovery_address.sa.sa_family == AF_INET) {
 625                         localdiscovery_address.in.sin_port = n->prevedge->address.in.sin_port;
 626                         *sa = &localdiscovery_address;
 627                 } else {
 628                         broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 629                         *sa = &broadcast_ipv4;
 630                 }
 631         }
 632 }
 633
 634 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 635         vpn_packet_t pkt1, pkt2;
 636         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 637         vpn_packet_t *inpkt = origpkt;
 638         int nextpkt = 0;
 639         vpn_packet_t *outpkt;
 640         int origlen = origpkt->len;
 641         size_t outlen;
 642 #if defined(SOL_IP) && defined(IP_TOS)
 643         static int priority = 0;
 644 #endif
 645         int origpriority = origpkt->priority;
 646
 647         if(!n->status.reachable) {
 648                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 649                 return;
 650         }
 651
 652         if(n->status.sptps)
 653                 return send_sptps_packet(n, origpkt);
 654
 655         /* Make sure we have a valid key */
 656
 657         if(!n->status.validkey) {
 658                 logger(DEBUG_TRAFFIC, LOG_INFO,
 659                                    "No valid key known yet for %s (%s), forwarding via TCP",
 660                                    n->name, n->hostname);
 661
 662                 if(n->last_req_key + 10 <= now.tv_sec) {
 663                         send_req_key(n);
 664                         n->last_req_key = now.tv_sec;
 665                 }
 666
 667                 send_tcppacket(n->nexthop->connection, origpkt);
 668
 669                 return;
 670         }
 671
 672         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 673                 logger(DEBUG_TRAFFIC, LOG_INFO,
 674                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 675                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 676
 677                 if(n != n->nexthop)
 678                         send_packet(n->nexthop, origpkt);
 679                 else
 680                         send_tcppacket(n->nexthop->connection, origpkt);
 681
 682                 return;
 683         }
 684
 685         /* Compress the packet */
 686
 687         if(n->outcompression) {
 688                 outpkt = pkt[nextpkt++];
 689
 690                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 691                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 692                                    n->name, n->hostname);
 693                         return;
 694                 }
 695
 696                 inpkt = outpkt;
 697         }
 698
 699         /* Add sequence number */
 700
 701         inpkt->seqno = htonl(++(n->sent_seqno));
 702         inpkt->len += sizeof inpkt->seqno;
 703
 704         /* Encrypt the packet */
 705
 706         if(cipher_active(n->outcipher)) {
 707                 outpkt = pkt[nextpkt++];
 708                 outlen = MAXSIZE;
 709
 710                 if(!cipher_encrypt(n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 711                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 712                         goto end;
 713                 }
 714
 715                 outpkt->len = outlen;
 716                 inpkt = outpkt;
 717         }
 718
 719         /* Add the message authentication code */
 720
 721         if(digest_active(n->outdigest)) {
 722                 if(!digest_create(n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len)) {
 723                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 724                         goto end;
 725                 }
 726
 727                 inpkt->len += digest_length(n->outdigest);
 728         }
 729
 730         /* Send the packet */
 731
 732         const sockaddr_t *sa;
 733         int sock;
 734
 735         if(n->status.broadcast)
 736                 choose_broadcast_address(n, &sa, &sock);
 737         else
 738                 choose_udp_address(n, &sa, &sock);
 739
 740 #if defined(SOL_IP) && defined(IP_TOS)
 741         if(priorityinheritance && origpriority != priority
 742            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 743                 priority = origpriority;
 744                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 745                 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 746                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 747         }
 748 #endif
 749
 750         if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 751                 if(sockmsgsize(sockerrno)) {
 752                         if(n->maxmtu >= origlen)
 753                                 n->maxmtu = origlen - 1;
 754                         if(n->mtu >= origlen)
 755                                 n->mtu = origlen - 1;
 756                 } else
 757                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 758         }
 759
 760 end:
 761         origpkt->len = origlen;
 762 }
 763
 764 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 765         node_t *to = handle;
 766
 767         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 768
 769         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 770                 char buf[len * 4 / 3 + 5];
 771                 b64encode(data, buf, len);
 772                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 773                    to ensure we get to learn the reflexive UDP address. */
 774                 if(!to->status.validkey) {
 775                         to->incompression = myself->incompression;
 776                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, to->incompression);
 777                 } else {
 778                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 779                 }
 780         }
 781
 782         /* Otherwise, send the packet via UDP */
 783
 784         const sockaddr_t *sa;
 785         int sock;
 786
 787         if(to->status.broadcast)
 788                 choose_broadcast_address(to, &sa, &sock);
 789         else
 790                 choose_udp_address(to, &sa, &sock);
 791
 792         if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 793                 if(sockmsgsize(sockerrno)) {
 794                         if(to->maxmtu >= len)
 795                                 to->maxmtu = len - 1;
 796                         if(to->mtu >= len)
 797                                 to->mtu = len - 1;
 798                 } else {
 799                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 800                         return false;
 801                 }
 802         }
 803
 804         return true;
 805 }
 806
 807 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 808         node_t *from = handle;
 809
 810         if(type == SPTPS_HANDSHAKE) {
 811                 if(!from->status.validkey) {
 812                         from->status.validkey = true;
 813                         from->status.waitingforkey = false;
 814                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 815                 }
 816                 return true;
 817         }
 818
 819         if(len > MTU) {
 820                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 821                 return false;
 822         }
 823
 824         vpn_packet_t inpkt;
 825
 826         if(type == PKT_PROBE) {
 827                 inpkt.len = len;
 828                 memcpy(inpkt.data, data, len);
 829                 mtu_probe_h(from, &inpkt, len);
 830                 return true;
 831         }
 832
 833         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 834                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 835                 return false;
 836         }
 837
 838         /* Check if we have the headers we need */
 839         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 840                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 841                 return false;
 842         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 843                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 844         }
 845
 846         int offset = (type & PKT_MAC) ? 0 : 14;
 847         if(type & PKT_COMPRESSED) {
 848                 length_t ulen = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 849                 if(ulen < 0) {
 850                         return false;
 851                 } else {
 852                         inpkt.len = ulen + offset;
 853                 }
 854                 if(inpkt.len > MAXSIZE)
 855                         abort();
 856         } else {
 857                 memcpy(inpkt.data + offset, data, len);
 858                 inpkt.len = len + offset;
 859         }
 860
 861         /* Generate the Ethernet packet type if necessary */
 862         if(offset) {
 863                 switch(inpkt.data[14] >> 4) {
 864                         case 4:
 865                                 inpkt.data[12] = 0x08;
 866                                 inpkt.data[13] = 0x00;
 867                                 break;
 868                         case 6:
 869                                 inpkt.data[12] = 0x86;
 870                                 inpkt.data[13] = 0xDD;
 871                                 break;
 872                         default:
 873                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 874                                                    "Unknown IP version %d while reading packet from %s (%s)",
 875                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 876                                 return false;
 877                 }
 878         }
 879
 880         receive_packet(from, &inpkt);
 881         return true;
 882 }
 883
 884 /*
 885   send a packet to the given vpn ip.
 886 */
 887 void send_packet(node_t *n, vpn_packet_t *packet) {
 888         node_t *via;
 889
 890         if(n == myself) {
 891                 if(overwrite_mac)
 892                          memcpy(packet->data, mymac.x, ETH_ALEN);
 893                 n->out_packets++;
 894                 n->out_bytes += packet->len;
 895                 // TODO: send to application
 896                 return;
 897         }
 898
 899         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 900                            packet->len, n->name, n->hostname);
 901
 902         if(!n->status.reachable) {
 903                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 904                                    n->name, n->hostname);
 905                 return;
 906         }
 907
 908         n->out_packets++;
 909         n->out_bytes += packet->len;
 910
 911         if(n->status.sptps) {
 912                 send_sptps_packet(n, packet);
 913                 return;
 914         }
 915
 916         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 917
 918         if(via != n)
 919                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 920                            n->name, via->name, n->via->hostname);
 921
 922         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 923                 if(!send_tcppacket(via->connection, packet))
 924                         terminate_connection(via->connection, true);
 925         } else
 926                 send_udppacket(via, packet);
 927 }
 928
 929 /* Broadcast a packet using the minimum spanning tree */
 930
 931 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 932         // Always give ourself a copy of the packet.
 933         if(from != myself)
 934                 send_packet(myself, packet);
 935
 936         // In TunnelServer mode, do not forward broadcast packets.
 937         // The MST might not be valid and create loops.
 938         if(tunnelserver || broadcast_mode == BMODE_NONE)
 939                 return;
 940
 941         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 942                            packet->len, from->name, from->hostname);
 943
 944         switch(broadcast_mode) {
 945                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 946                 // This guarantees all nodes receive the broadcast packet, and
 947                 // usually distributes the sending of broadcast packets over all nodes.
 948                 case BMODE_MST:
 949                         for list_each(connection_t, c, connection_list)
 950                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 951                                         send_packet(c->node, packet);
 952                         break;
 953
 954                 // In direct mode, we send copies to each node we know of.
 955                 // However, this only reaches nodes that can be reached in a single hop.
 956                 // We don't have enough information to forward broadcast packets in this case.
 957                 case BMODE_DIRECT:
 958                         if(from != myself)
 959                                 break;
 960
 961                         for splay_each(node_t, n, node_tree)
 962                                 if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n))
 963                                         send_packet(n, packet);
 964                         break;
 965
 966                 default:
 967                         break;
 968         }
 969 }
 970
 971 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 972         node_t *n = NULL;
 973         bool hard = false;
 974         static time_t last_hard_try = 0;
 975
 976         for splay_each(edge_t, e, edge_weight_tree) {
 977                 if(!e->to->status.reachable || e->to == myself)
 978                         continue;
 979
 980                 if(sockaddrcmp_noport(from, &e->address)) {
 981                         if(last_hard_try == now.tv_sec)
 982                                 continue;
 983                         hard = true;
 984                 }
 985
 986                 if(!try_mac(e->to, pkt))
 987                         continue;
 988
 989                 n = e->to;
 990                 break;
 991         }
 992
 993         if(hard)
 994                 last_hard_try = now.tv_sec;
 995
 996         last_hard_try = now.tv_sec;
 997         return n;
 998 }
 999
1000 void handle_incoming_vpn_data(void *data, int flags) {
1001         listen_socket_t *ls = data;
1002         vpn_packet_t pkt;
1003         char *hostname;
1004         sockaddr_t from = {{0}};
1005         socklen_t fromlen = sizeof from;
1006         node_t *n;
1007         int len;
1008
1009         len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
1010
1011         if(len <= 0 || len > MAXSIZE) {
1012                 if(!sockwouldblock(sockerrno))
1013                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
1014                 return;
1015         }
1016
1017         pkt.len = len;
1018
1019         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
1020
1021         n = lookup_node_udp(&from);
1022
1023         if(!n) {
1024                 n = try_harder(&from, &pkt);
1025                 if(n)
1026                         update_node_udp(n, &from);
1027                 else if(debug_level >= DEBUG_PROTOCOL) {
1028                         hostname = sockaddr2hostname(&from);
1029                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
1030                         free(hostname);
1031                         return;
1032                 }
1033                 else
1034                         return;
1035         }
1036
1037         n->sock = ls - listen_socket;
1038
1039         receive_udppacket(n, &pkt);
1040 }