git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 2014 Guus Sliepen <guus@meshlink.io>
   4
   5     This program is free software; you can redistribute it and/or modify
   6     it under the terms of the GNU General Public License as published by
   7     the Free Software Foundation; either version 2 of the License, or
   8     (at your option) any later version.
   9
  10     This program is distributed in the hope that it will be useful,
  11     but WITHOUT ANY WARRANTY; without even the implied warranty of
  12     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13     GNU General Public License for more details.
  14
  15     You should have received a copy of the GNU General Public License along
  16     with this program; if not, write to the Free Software Foundation, Inc.,
  17     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18 */
  19
  20 #include "system.h"
  21
  22 #ifdef HAVE_ZLIB
  23 #include <zlib.h>
  24 #endif
  25
  26 #include "cipher.h"
  27 #include "conf.h"
  28 #include "connection.h"
  29 #include "crypto.h"
  30 #include "digest.h"
  31 #include "graph.h"
  32 #include "logger.h"
  33 #include "net.h"
  34 #include "netutl.h"
  35 #include "protocol.h"
  36 #include "route.h"
  37 #include "utils.h"
  38 #include "xalloc.h"
  39
  40 int keylifetime = 0;
  41
  42 static void send_udppacket(node_t *, vpn_packet_t *);
  43
  44 unsigned replaywin = 16;
  45 bool localdiscovery = false;
  46 sockaddr_t localdiscovery_address;
  47
  48 #define MAX_SEQNO 1073741824
  49
  50 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  51    mtuprobes ==    31: sleep pinginterval seconds
  52    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  53    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  54
  55    Probes are sent in batches of at least three, with random sizes between the
  56    lower and upper boundaries for the MTU thus far discovered.
  57
  58    After the initial discovery, a fourth packet is added to each batch with a
  59    size larger than the currently known PMTU, to test if the PMTU has increased.
  60
  61    In case local discovery is enabled, another packet is added to each batch,
  62    which will be broadcast to the local network.
  63
  64 */
  65
  66 static void send_mtu_probe_handler(void *data) {
  67         node_t *n = data;
  68         int timeout = 1;
  69
  70         n->mtuprobes++;
  71
  72         if(!n->status.reachable || !n->status.validkey) {
  73                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  74                 n->mtuprobes = 0;
  75                 return;
  76         }
  77
  78         if(n->mtuprobes > 32) {
  79                 if(!n->minmtu) {
  80                         n->mtuprobes = 31;
  81                         timeout = pinginterval;
  82                         goto end;
  83                 }
  84
  85                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
  86                 n->status.udp_confirmed = false;
  87                 n->mtuprobes = 1;
  88                 n->minmtu = 0;
  89                 n->maxmtu = MTU;
  90         }
  91
  92         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
  93                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
  94                 n->mtuprobes = 31;
  95         }
  96
  97         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
  98                 if(n->minmtu > n->maxmtu)
  99                         n->minmtu = n->maxmtu;
 100                 else
 101                         n->maxmtu = n->minmtu;
 102                 n->mtu = n->minmtu;
 103                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 104                 n->mtuprobes = 31;
 105         }
 106
 107         if(n->mtuprobes == 31) {
 108                 timeout = pinginterval;
 109                 goto end;
 110         } else if(n->mtuprobes == 32) {
 111                 timeout = pingtimeout;
 112         }
 113
 114         for(int i = 0; i < 4 + localdiscovery; i++) {
 115                 int len;
 116
 117                 if(i == 0) {
 118                         if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
 119                                 continue;
 120                         len = n->maxmtu + 8;
 121                 } else if(n->maxmtu <= n->minmtu) {
 122                         len = n->maxmtu;
 123                 } else {
 124                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 125                 }
 126
 127                 if(len < 64)
 128                         len = 64;
 129
 130                 vpn_packet_t packet;
 131                 memset(packet.data, 0, 14);
 132                 randomize(packet.data + 14, len - 14);
 133                 packet.len = len;
 134                 packet.priority = 0;
 135                 n->status.broadcast = i >= 4 && n->mtuprobes <= 10 && n->prevedge;
 136
 137                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 138
 139                 send_udppacket(n, &packet);
 140         }
 141
 142         n->status.broadcast = false;
 143         n->probe_counter = 0;
 144         gettimeofday(&n->probe_time, NULL);
 145
 146         /* Calculate the packet loss of incoming traffic by comparing the rate of
 147            packets received to the rate with which the sequence number has increased.
 148          */
 149
 150         if(n->received > n->prev_received)
 151                 n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno);
 152         else
 153                 n->packetloss = n->received_seqno <= n->prev_received_seqno;
 154
 155         n->prev_received_seqno = n->received_seqno;
 156         n->prev_received = n->received;
 157
 158 end:
 159         timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
 160 }
 161
 162 void send_mtu_probe(node_t *n) {
 163         timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
 164         send_mtu_probe_handler(n);
 165 }
 166
 167 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 168         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 169
 170         if(!packet->data[0]) {
 171                 /* It's a probe request, send back a reply */
 172
 173                 packet->data[0] = 1;
 174
 175                 /* Temporarily set udp_confirmed, so that the reply is sent
 176                    back exactly the way it came in. */
 177
 178                 bool udp_confirmed = n->status.udp_confirmed;
 179                 n->status.udp_confirmed = true;
 180                 send_udppacket(n, packet);
 181                 n->status.udp_confirmed = udp_confirmed;
 182         } else {
 183                 /* It's a valid reply: now we know bidirectional communication
 184                    is possible using the address and socket that the reply
 185                    packet used. */
 186
 187                 n->status.udp_confirmed = true;
 188
 189                 /* If we haven't established the PMTU yet, restart the discovery process. */
 190
 191                 if(n->mtuprobes > 30) {
 192                         if (len == n->maxmtu + 8) {
 193                                 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
 194                                 n->maxmtu = MTU;
 195                                 n->mtuprobes = 10;
 196                                 return;
 197                         }
 198
 199                         if(n->minmtu)
 200                                 n->mtuprobes = 30;
 201                         else
 202                                 n->mtuprobes = 1;
 203                 }
 204
 205                 /* If applicable, raise the minimum supported MTU */
 206
 207                 if(len > n->maxmtu)
 208                         len = n->maxmtu;
 209                 if(n->minmtu < len)
 210                         n->minmtu = len;
 211
 212                 /* Calculate RTT and bandwidth.
 213                    The RTT is the time between the MTU probe burst was sent and the first
 214                    reply is received. The bandwidth is measured using the time between the
 215                    arrival of the first and third probe reply.
 216                  */
 217
 218                 struct timeval now, diff;
 219                 gettimeofday(&now, NULL);
 220                 timersub(&now, &n->probe_time, &diff);
 221
 222                 n->probe_counter++;
 223
 224                 if(n->probe_counter == 1) {
 225                         n->rtt = diff.tv_sec + diff.tv_usec * 1e-6;
 226                         n->probe_time = now;
 227                 } else if(n->probe_counter == 3) {
 228                         n->bandwidth = 2.0 * len / (diff.tv_sec + diff.tv_usec * 1e-6);
 229                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, burst bandwidth %.3f Mbit/s, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->bandwidth * 8e-6, n->packetloss * 1e2);
 230                 }
 231         }
 232 }
 233
 234 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 235         if(level == 0) {
 236                 memcpy(dest, source, len);
 237                 return len;
 238         } else if(level == 10) {
 239                 return -1;
 240         } else if(level < 10) {
 241 #ifdef HAVE_ZLIB
 242                 unsigned long destlen = MAXSIZE;
 243                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 244                         return destlen;
 245                 else
 246 #endif
 247                         return -1;
 248         } else {
 249                 return -1;
 250         }
 251
 252         return -1;
 253 }
 254
 255 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 256         if(level == 0) {
 257                 memcpy(dest, source, len);
 258                 return len;
 259         } else if(level > 9) {
 260                         return -1;
 261         }
 262 #ifdef HAVE_ZLIB
 263         else {
 264                 unsigned long destlen = MAXSIZE;
 265                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 266                         return destlen;
 267                 else
 268                         return -1;
 269         }
 270 #endif
 271
 272         return -1;
 273 }
 274
 275 /* VPN packet I/O */
 276
 277 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 278         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 279                            packet->len, n->name, n->hostname);
 280
 281         n->in_packets++;
 282         n->in_bytes += packet->len;
 283
 284         route(n, packet);
 285 }
 286
 287 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 288         if(n->status.sptps)
 289                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 290
 291         if(!digest_active(n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest))
 292                 return false;
 293
 294         return digest_verify(n->indigest, &inpkt->seqno, inpkt->len - digest_length(n->indigest), (const char *)&inpkt->seqno + inpkt->len - digest_length(n->indigest));
 295 }
 296
 297 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 298         vpn_packet_t pkt1, pkt2;
 299         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 300         int nextpkt = 0;
 301         vpn_packet_t *outpkt = pkt[0];
 302         size_t outlen;
 303
 304         if(n->status.sptps) {
 305                 if(!n->sptps.state) {
 306                         if(!n->status.waitingforkey) {
 307                                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but we haven't exchanged keys yet", n->name, n->hostname);
 308                                 send_req_key(n);
 309                         } else {
 310                                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
 311                         }
 312                         return;
 313                 }
 314                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 315                 return;
 316         }
 317
 318         if(!cipher_active(n->incipher)) {
 319                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
 320                 return;
 321         }
 322
 323         /* Check packet length */
 324
 325         if(inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest)) {
 326                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 327                                         n->name, n->hostname);
 328                 return;
 329         }
 330
 331         /* Check the message authentication code */
 332
 333         if(digest_active(n->indigest)) {
 334                 inpkt->len -= digest_length(n->indigest);
 335                 if(!digest_verify(n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 336                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 337                         return;
 338                 }
 339         }
 340         /* Decrypt the packet */
 341
 342         if(cipher_active(n->incipher)) {
 343                 outpkt = pkt[nextpkt++];
 344                 outlen = MAXSIZE;
 345
 346                 if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 347                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 348                         return;
 349                 }
 350
 351                 outpkt->len = outlen;
 352                 inpkt = outpkt;
 353         }
 354
 355         /* Check the sequence number */
 356
 357         inpkt->len -= sizeof inpkt->seqno;
 358         inpkt->seqno = ntohl(inpkt->seqno);
 359
 360         if(replaywin) {
 361                 if(inpkt->seqno != n->received_seqno + 1) {
 362                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 363                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 364                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 365                                 memset(n->late, 0, replaywin);
 366                         } else if (inpkt->seqno <= n->received_seqno) {
 367                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 368                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 369                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 370                                         return;
 371                                 }
 372                         } else {
 373                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 374                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 375                         }
 376                 }
 377
 378                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 379         }
 380
 381         if(inpkt->seqno > n->received_seqno)
 382                 n->received_seqno = inpkt->seqno;
 383
 384         n->received++;
 385
 386         if(n->received_seqno > MAX_SEQNO)
 387                 regenerate_key();
 388
 389         /* Decompress the packet */
 390
 391         length_t origlen = inpkt->len;
 392
 393         if(n->incompression) {
 394                 outpkt = pkt[nextpkt++];
 395
 396                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 397                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 398                                                  n->name, n->hostname);
 399                         return;
 400                 }
 401
 402                 inpkt = outpkt;
 403
 404                 origlen -= MTU/64 + 20;
 405         }
 406
 407         inpkt->priority = 0;
 408
 409         if(!inpkt->data[12] && !inpkt->data[13])
 410                 mtu_probe_h(n, inpkt, origlen);
 411         else
 412                 receive_packet(n, inpkt);
 413 }
 414
 415 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 416         vpn_packet_t outpkt;
 417
 418         if(len > sizeof outpkt.data)
 419                 return;
 420
 421         outpkt.len = len;
 422         if(c->options & OPTION_TCPONLY)
 423                 outpkt.priority = 0;
 424         else
 425                 outpkt.priority = -1;
 426         memcpy(outpkt.data, buffer, len);
 427
 428         receive_packet(c->node, &outpkt);
 429 }
 430
 431 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 432         if(!n->status.validkey) {
 433                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 434                 if(!n->status.waitingforkey)
 435                         send_req_key(n);
 436                 else if(n->last_req_key + 10 < now.tv_sec) {
 437                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 438                         sptps_stop(&n->sptps);
 439                         n->status.waitingforkey = false;
 440                         send_req_key(n);
 441                 }
 442                 return;
 443         }
 444
 445         uint8_t type = 0;
 446         int offset = 0;
 447
 448         if(!(origpkt->data[12] | origpkt->data[13])) {
 449                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 450                 return;
 451         }
 452
 453         if(routing_mode == RMODE_ROUTER)
 454                 offset = 14;
 455         else
 456                 type = PKT_MAC;
 457
 458         if(origpkt->len < offset)
 459                 return;
 460
 461         vpn_packet_t outpkt;
 462
 463         if(n->outcompression) {
 464                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 465                 if(len < 0) {
 466                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 467                 } else if(len < origpkt->len - offset) {
 468                         outpkt.len = len + offset;
 469                         origpkt = &outpkt;
 470                         type |= PKT_COMPRESSED;
 471                 }
 472         }
 473
 474         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 475         return;
 476 }
 477
 478 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 479         /* Latest guess */
 480         *sa = &n->address;
 481         *sock = n->sock;
 482
 483         /* If the UDP address is confirmed, use it. */
 484         if(n->status.udp_confirmed)
 485                 return;
 486
 487         /* Send every third packet to n->address; that could be set
 488            to the node's reflexive UDP address discovered during key
 489            exchange. */
 490
 491         static int x = 0;
 492         if(++x >= 3) {
 493                 x = 0;
 494                 return;
 495         }
 496
 497         /* Otherwise, address are found in edges to this node.
 498            So we pick a random edge and a random socket. */
 499
 500         int i = 0;
 501         int j = rand() % n->edge_tree->count;
 502         edge_t *candidate = NULL;
 503
 504         for splay_each(edge_t, e, n->edge_tree) {
 505                 if(i++ == j) {
 506                         candidate = e->reverse;
 507                         break;
 508                 }
 509         }
 510
 511         if(candidate) {
 512                 *sa = &candidate->address;
 513                 *sock = rand() % listen_sockets;
 514         }
 515
 516         /* Make sure we have a suitable socket for the chosen address */
 517         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 518                 for(int i = 0; i < listen_sockets; i++) {
 519                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 520                                 *sock = i;
 521                                 break;
 522                         }
 523                 }
 524         }
 525 }
 526
 527 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 528         static sockaddr_t broadcast_ipv4 = {
 529                 .in = {
 530                         .sin_family = AF_INET,
 531                         .sin_addr.s_addr = -1,
 532                 }
 533         };
 534
 535         static sockaddr_t broadcast_ipv6 = {
 536                 .in6 = {
 537                         .sin6_family = AF_INET6,
 538                         .sin6_addr.s6_addr[0x0] = 0xff,
 539                         .sin6_addr.s6_addr[0x1] = 0x02,
 540                         .sin6_addr.s6_addr[0xf] = 0x01,
 541                 }
 542         };
 543
 544         *sock = rand() % listen_sockets;
 545
 546         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 547                 if(localdiscovery_address.sa.sa_family == AF_INET6) {
 548                         localdiscovery_address.in6.sin6_port = n->prevedge->address.in.sin_port;
 549                         *sa = &localdiscovery_address;
 550                 } else {
 551                         broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 552                         broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
 553                         *sa = &broadcast_ipv6;
 554                 }
 555         } else {
 556                 if(localdiscovery_address.sa.sa_family == AF_INET) {
 557                         localdiscovery_address.in.sin_port = n->prevedge->address.in.sin_port;
 558                         *sa = &localdiscovery_address;
 559                 } else {
 560                         broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 561                         *sa = &broadcast_ipv4;
 562                 }
 563         }
 564 }
 565
 566 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 567         vpn_packet_t pkt1, pkt2;
 568         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 569         vpn_packet_t *inpkt = origpkt;
 570         int nextpkt = 0;
 571         vpn_packet_t *outpkt;
 572         int origlen = origpkt->len;
 573         size_t outlen;
 574 #if defined(SOL_IP) && defined(IP_TOS)
 575         static int priority = 0;
 576 #endif
 577         int origpriority = origpkt->priority;
 578
 579         if(!n->status.reachable) {
 580                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 581                 return;
 582         }
 583
 584         if(n->status.sptps)
 585                 return send_sptps_packet(n, origpkt);
 586
 587         /* Make sure we have a valid key */
 588
 589         if(!n->status.validkey) {
 590                 logger(DEBUG_TRAFFIC, LOG_INFO,
 591                                    "No valid key known yet for %s (%s), forwarding via TCP",
 592                                    n->name, n->hostname);
 593
 594                 if(n->last_req_key + 10 <= now.tv_sec) {
 595                         send_req_key(n);
 596                         n->last_req_key = now.tv_sec;
 597                 }
 598
 599                 send_tcppacket(n->nexthop->connection, origpkt);
 600
 601                 return;
 602         }
 603
 604         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 605                 logger(DEBUG_TRAFFIC, LOG_INFO,
 606                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 607                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 608
 609                 if(n != n->nexthop)
 610                         send_packet(n->nexthop, origpkt);
 611                 else
 612                         send_tcppacket(n->nexthop->connection, origpkt);
 613
 614                 return;
 615         }
 616
 617         /* Compress the packet */
 618
 619         if(n->outcompression) {
 620                 outpkt = pkt[nextpkt++];
 621
 622                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 623                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 624                                    n->name, n->hostname);
 625                         return;
 626                 }
 627
 628                 inpkt = outpkt;
 629         }
 630
 631         /* Add sequence number */
 632
 633         inpkt->seqno = htonl(++(n->sent_seqno));
 634         inpkt->len += sizeof inpkt->seqno;
 635
 636         /* Encrypt the packet */
 637
 638         if(cipher_active(n->outcipher)) {
 639                 outpkt = pkt[nextpkt++];
 640                 outlen = MAXSIZE;
 641
 642                 if(!cipher_encrypt(n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 643                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 644                         goto end;
 645                 }
 646
 647                 outpkt->len = outlen;
 648                 inpkt = outpkt;
 649         }
 650
 651         /* Add the message authentication code */
 652
 653         if(digest_active(n->outdigest)) {
 654                 if(!digest_create(n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len)) {
 655                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 656                         goto end;
 657                 }
 658
 659                 inpkt->len += digest_length(n->outdigest);
 660         }
 661
 662         /* Send the packet */
 663
 664         const sockaddr_t *sa;
 665         int sock;
 666
 667         if(n->status.broadcast)
 668                 choose_broadcast_address(n, &sa, &sock);
 669         else
 670                 choose_udp_address(n, &sa, &sock);
 671
 672 #if defined(SOL_IP) && defined(IP_TOS)
 673         if(priorityinheritance && origpriority != priority
 674            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 675                 priority = origpriority;
 676                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 677                 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 678                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 679         }
 680 #endif
 681
 682         if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 683                 if(sockmsgsize(sockerrno)) {
 684                         if(n->maxmtu >= origlen)
 685                                 n->maxmtu = origlen - 1;
 686                         if(n->mtu >= origlen)
 687                                 n->mtu = origlen - 1;
 688                 } else
 689                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 690         }
 691
 692 end:
 693         origpkt->len = origlen;
 694 }
 695
 696 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 697         node_t *to = handle;
 698
 699         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 700
 701         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 702                 char buf[len * 4 / 3 + 5];
 703                 b64encode(data, buf, len);
 704                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 705                    to ensure we get to learn the reflexive UDP address. */
 706                 if(!to->status.validkey) {
 707                         to->incompression = myself->incompression;
 708                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, to->incompression);
 709                 } else {
 710                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 711                 }
 712         }
 713
 714         /* Otherwise, send the packet via UDP */
 715
 716         const sockaddr_t *sa;
 717         int sock;
 718
 719         if(to->status.broadcast)
 720                 choose_broadcast_address(to, &sa, &sock);
 721         else
 722                 choose_udp_address(to, &sa, &sock);
 723
 724         if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 725                 if(sockmsgsize(sockerrno)) {
 726                         if(to->maxmtu >= len)
 727                                 to->maxmtu = len - 1;
 728                         if(to->mtu >= len)
 729                                 to->mtu = len - 1;
 730                 } else {
 731                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 732                         return false;
 733                 }
 734         }
 735
 736         return true;
 737 }
 738
 739 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 740         node_t *from = handle;
 741
 742         if(type == SPTPS_HANDSHAKE) {
 743                 if(!from->status.validkey) {
 744                         from->status.validkey = true;
 745                         from->status.waitingforkey = false;
 746                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 747                 }
 748                 return true;
 749         }
 750
 751         if(len > MTU) {
 752                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 753                 return false;
 754         }
 755
 756         vpn_packet_t inpkt;
 757
 758         if(type == PKT_PROBE) {
 759                 inpkt.len = len;
 760                 memcpy(inpkt.data, data, len);
 761                 mtu_probe_h(from, &inpkt, len);
 762                 return true;
 763         }
 764
 765         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 766                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 767                 return false;
 768         }
 769
 770         /* Check if we have the headers we need */
 771         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 772                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 773                 return false;
 774         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 775                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 776         }
 777
 778         int offset = (type & PKT_MAC) ? 0 : 14;
 779         if(type & PKT_COMPRESSED) {
 780                 length_t ulen = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 781                 if(ulen < 0) {
 782                         return false;
 783                 } else {
 784                         inpkt.len = ulen + offset;
 785                 }
 786                 if(inpkt.len > MAXSIZE)
 787                         abort();
 788         } else {
 789                 memcpy(inpkt.data + offset, data, len);
 790                 inpkt.len = len + offset;
 791         }
 792
 793         /* Generate the Ethernet packet type if necessary */
 794         if(offset) {
 795                 switch(inpkt.data[14] >> 4) {
 796                         case 4:
 797                                 inpkt.data[12] = 0x08;
 798                                 inpkt.data[13] = 0x00;
 799                                 break;
 800                         case 6:
 801                                 inpkt.data[12] = 0x86;
 802                                 inpkt.data[13] = 0xDD;
 803                                 break;
 804                         default:
 805                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 806                                                    "Unknown IP version %d while reading packet from %s (%s)",
 807                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 808                                 return false;
 809                 }
 810         }
 811
 812         receive_packet(from, &inpkt);
 813         return true;
 814 }
 815
 816 /*
 817   send a packet to the given vpn ip.
 818 */
 819 void send_packet(node_t *n, vpn_packet_t *packet) {
 820         node_t *via;
 821
 822         if(n == myself) {
 823                 n->out_packets++;
 824                 n->out_bytes += packet->len;
 825                 // TODO: send to application
 826                 return;
 827         }
 828
 829         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 830                            packet->len, n->name, n->hostname);
 831
 832         if(!n->status.reachable) {
 833                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 834                                    n->name, n->hostname);
 835                 return;
 836         }
 837
 838         n->out_packets++;
 839         n->out_bytes += packet->len;
 840
 841         if(n->status.sptps) {
 842                 send_sptps_packet(n, packet);
 843                 return;
 844         }
 845
 846         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 847
 848         if(via != n)
 849                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 850                            n->name, via->name, n->via->hostname);
 851
 852         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 853                 if(!send_tcppacket(via->connection, packet))
 854                         terminate_connection(via->connection, true);
 855         } else
 856                 send_udppacket(via, packet);
 857 }
 858
 859 /* Broadcast a packet using the minimum spanning tree */
 860
 861 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 862         // Always give ourself a copy of the packet.
 863         if(from != myself)
 864                 send_packet(myself, packet);
 865
 866         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 867                            packet->len, from->name, from->hostname);
 868
 869         switch(broadcast_mode) {
 870                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 871                 // This guarantees all nodes receive the broadcast packet, and
 872                 // usually distributes the sending of broadcast packets over all nodes.
 873                 case BMODE_MST:
 874                         for list_each(connection_t, c, connection_list)
 875                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 876                                         send_packet(c->node, packet);
 877                         break;
 878
 879                 // In direct mode, we send copies to each node we know of.
 880                 // However, this only reaches nodes that can be reached in a single hop.
 881                 // We don't have enough information to forward broadcast packets in this case.
 882                 case BMODE_DIRECT:
 883                         if(from != myself)
 884                                 break;
 885
 886                         for splay_each(node_t, n, node_tree)
 887                                 if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n))
 888                                         send_packet(n, packet);
 889                         break;
 890
 891                 default:
 892                         break;
 893         }
 894 }
 895
 896 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 897         node_t *n = NULL;
 898         bool hard = false;
 899         static time_t last_hard_try = 0;
 900
 901         for splay_each(edge_t, e, edge_weight_tree) {
 902                 if(!e->to->status.reachable || e->to == myself)
 903                         continue;
 904
 905                 if(sockaddrcmp_noport(from, &e->address)) {
 906                         if(last_hard_try == now.tv_sec)
 907                                 continue;
 908                         hard = true;
 909                 }
 910
 911                 if(!try_mac(e->to, pkt))
 912                         continue;
 913
 914                 n = e->to;
 915                 break;
 916         }
 917
 918         if(hard)
 919                 last_hard_try = now.tv_sec;
 920
 921         last_hard_try = now.tv_sec;
 922         return n;
 923 }
 924
 925 void handle_incoming_vpn_data(void *data, int flags) {
 926         listen_socket_t *ls = data;
 927         vpn_packet_t pkt;
 928         char *hostname;
 929         sockaddr_t from = {{0}};
 930         socklen_t fromlen = sizeof from;
 931         node_t *n;
 932         int len;
 933
 934         len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 935
 936         if(len <= 0 || len > MAXSIZE) {
 937                 if(!sockwouldblock(sockerrno))
 938                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 939                 return;
 940         }
 941
 942         pkt.len = len;
 943
 944         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 945
 946         n = lookup_node_udp(&from);
 947
 948         if(!n) {
 949                 n = try_harder(&from, &pkt);
 950                 if(n)
 951                         update_node_udp(n, &from);
 952                 else if(debug_level >= DEBUG_PROTOCOL) {
 953                         hostname = sockaddr2hostname(&from);
 954                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 955                         free(hostname);
 956                         return;
 957                 }
 958                 else
 959                         return;
 960         }
 961
 962         n->sock = ls - listen_socket;
 963
 964         receive_udppacket(n, &pkt);
 965 }