git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "cipher.h"
  40 #include "conf.h"
  41 #include "connection.h"
  42 #include "crypto.h"
  43 #include "digest.h"
  44 #include "device.h"
  45 #include "ethernet.h"
  46 #include "graph.h"
  47 #include "logger.h"
  48 #include "net.h"
  49 #include "netutl.h"
  50 #include "protocol.h"
  51 #include "process.h"
  52 #include "route.h"
  53 #include "utils.h"
  54 #include "xalloc.h"
  55
  56 int keylifetime = 0;
  57 #ifdef HAVE_LZO
  58 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  59 #endif
  60
  61 static void send_udppacket(node_t *, vpn_packet_t *);
  62
  63 unsigned replaywin = 16;
  64 bool localdiscovery = false;
  65
  66 #define MAX_SEQNO 1073741824
  67
  68 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  69    mtuprobes ==    31: sleep pinginterval seconds
  70    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  71    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  72
  73    Probes are sent in batches of three, with random sizes between the lower and
  74    upper boundaries for the MTU thus far discovered.
  75
  76    In case local discovery is enabled, a fourth packet is added to each batch,
  77    which will be broadcast to the local network.
  78 */
  79
  80 static void send_mtu_probe_handler(int fd, short events, void *data) {
  81         node_t *n = data;
  82         int timeout = 1;
  83
  84         n->mtuprobes++;
  85
  86         if(!n->status.reachable || !n->status.validkey) {
  87                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  88                 n->mtuprobes = 0;
  89                 return;
  90         }
  91
  92         if(n->mtuprobes > 32) {
  93                 if(!n->minmtu) {
  94                         n->mtuprobes = 31;
  95                         timeout = pinginterval;
  96                         goto end;
  97                 }
  98
  99                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 100                 n->status.udp_confirmed = false;
 101                 n->mtuprobes = 1;
 102                 n->minmtu = 0;
 103                 n->maxmtu = MTU;
 104         }
 105
 106         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 107                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 108                 n->mtuprobes = 31;
 109         }
 110
 111         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 112                 if(n->minmtu > n->maxmtu)
 113                         n->minmtu = n->maxmtu;
 114                 else
 115                         n->maxmtu = n->minmtu;
 116                 n->mtu = n->minmtu;
 117                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 118                 n->mtuprobes = 31;
 119         }
 120
 121         if(n->mtuprobes == 31) {
 122                 timeout = pinginterval;
 123                 goto end;
 124         } else if(n->mtuprobes == 32) {
 125                 timeout = pingtimeout;
 126         }
 127
 128         for(int i = 0; i < 3 + localdiscovery; i++) {
 129                 int len;
 130
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 vpn_packet_t packet;
 140                 memset(packet.data, 0, 14);
 141                 randomize(packet.data + 14, len - 14);
 142                 packet.len = len;
 143                 if(i >= 3 && n->mtuprobes <= 10)
 144                         packet.priority = -1;
 145                 else
 146                         packet.priority = 0;
 147
 148                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 149
 150                 send_udppacket(n, &packet);
 151         }
 152
 153 end:
 154         event_add(&n->mtuevent, &(struct timeval){timeout, rand() % 100000});
 155 }
 156
 157 void send_mtu_probe(node_t *n) {
 158         if(!timeout_initialized(&n->mtuevent))
 159                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 160         send_mtu_probe_handler(0, 0, n);
 161 }
 162
 163 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 164         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 165
 166         if(!packet->data[0]) {
 167                 packet->data[0] = 1;
 168                 send_udppacket(n, packet);
 169         } else {
 170                 n->status.udp_confirmed = true;
 171
 172                 if(n->mtuprobes > 30) {
 173                         if(n->minmtu)
 174                                 n->mtuprobes = 30;
 175                         else
 176                                 n->mtuprobes = 1;
 177                 }
 178
 179                 if(len > n->maxmtu)
 180                         len = n->maxmtu;
 181                 if(n->minmtu < len)
 182                         n->minmtu = len;
 183         }
 184 }
 185
 186 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 187         if(level == 0) {
 188                 memcpy(dest, source, len);
 189                 return len;
 190         } else if(level == 10) {
 191 #ifdef HAVE_LZO
 192                 lzo_uint lzolen = MAXSIZE;
 193                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 194                 return lzolen;
 195 #else
 196                 return -1;
 197 #endif
 198         } else if(level < 10) {
 199 #ifdef HAVE_ZLIB
 200                 unsigned long destlen = MAXSIZE;
 201                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 202                         return destlen;
 203                 else
 204 #endif
 205                         return -1;
 206         } else {
 207 #ifdef HAVE_LZO
 208                 lzo_uint lzolen = MAXSIZE;
 209                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 210                 return lzolen;
 211 #else
 212                 return -1;
 213 #endif
 214         }
 215
 216         return -1;
 217 }
 218
 219 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 220         if(level == 0) {
 221                 memcpy(dest, source, len);
 222                 return len;
 223         } else if(level > 9) {
 224 #ifdef HAVE_LZO
 225                 lzo_uint lzolen = MAXSIZE;
 226                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 227                         return lzolen;
 228                 else
 229 #endif
 230                         return -1;
 231         }
 232 #ifdef HAVE_ZLIB
 233         else {
 234                 unsigned long destlen = MAXSIZE;
 235                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 236                         return destlen;
 237                 else
 238                         return -1;
 239         }
 240 #endif
 241
 242         return -1;
 243 }
 244
 245 /* VPN packet I/O */
 246
 247 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 248         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 249                            packet->len, n->name, n->hostname);
 250
 251         n->in_packets++;
 252         n->in_bytes += packet->len;
 253
 254         route(n, packet);
 255 }
 256
 257 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 258         if(n->status.sptps)
 259                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 260
 261         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 262                 return false;
 263
 264         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 265 }
 266
 267 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 268         vpn_packet_t pkt1, pkt2;
 269         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 270         int nextpkt = 0;
 271         vpn_packet_t *outpkt = pkt[0];
 272         size_t outlen;
 273
 274         if(n->status.sptps) {
 275                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 276                 return;
 277         }
 278
 279         if(!cipher_active(&n->incipher)) {
 280                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 281                                         n->name, n->hostname);
 282                 return;
 283         }
 284
 285         /* Check packet length */
 286
 287         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 288                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 289                                         n->name, n->hostname);
 290                 return;
 291         }
 292
 293         /* Check the message authentication code */
 294
 295         if(digest_active(&n->indigest)) {
 296                 inpkt->len -= n->indigest.maclength;
 297                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 298                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 299                         return;
 300                 }
 301         }
 302         /* Decrypt the packet */
 303
 304         if(cipher_active(&n->incipher)) {
 305                 outpkt = pkt[nextpkt++];
 306                 outlen = MAXSIZE;
 307
 308                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 309                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 310                         return;
 311                 }
 312
 313                 outpkt->len = outlen;
 314                 inpkt = outpkt;
 315         }
 316
 317         /* Check the sequence number */
 318
 319         inpkt->len -= sizeof inpkt->seqno;
 320         inpkt->seqno = ntohl(inpkt->seqno);
 321
 322         if(replaywin) {
 323                 if(inpkt->seqno != n->received_seqno + 1) {
 324                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 325                                 if(n->farfuture++ < replaywin >> 2) {
 326                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 327                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 328                                         return;
 329                                 }
 330                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 331                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 332                                 memset(n->late, 0, replaywin);
 333                         } else if (inpkt->seqno <= n->received_seqno) {
 334                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 335                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 336                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 337                                         return;
 338                                 }
 339                         } else {
 340                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 341                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 342                         }
 343                 }
 344
 345                 n->farfuture = 0;
 346                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 347         }
 348
 349         if(inpkt->seqno > n->received_seqno)
 350                 n->received_seqno = inpkt->seqno;
 351
 352         if(n->received_seqno > MAX_SEQNO)
 353                 regenerate_key();
 354
 355         /* Decompress the packet */
 356
 357         length_t origlen = inpkt->len;
 358
 359         if(n->incompression) {
 360                 outpkt = pkt[nextpkt++];
 361
 362                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 363                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 364                                                  n->name, n->hostname);
 365                         return;
 366                 }
 367
 368                 inpkt = outpkt;
 369
 370                 origlen -= MTU/64 + 20;
 371         }
 372
 373         inpkt->priority = 0;
 374
 375         if(!inpkt->data[12] && !inpkt->data[13])
 376                 mtu_probe_h(n, inpkt, origlen);
 377         else
 378                 receive_packet(n, inpkt);
 379 }
 380
 381 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 382         vpn_packet_t outpkt;
 383
 384         outpkt.len = len;
 385         if(c->options & OPTION_TCPONLY)
 386                 outpkt.priority = 0;
 387         else
 388                 outpkt.priority = -1;
 389         memcpy(outpkt.data, buffer, len);
 390
 391         receive_packet(c->node, &outpkt);
 392 }
 393
 394 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 395         if(!n->status.validkey) {
 396                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 397                 if(!n->status.waitingforkey)
 398                         send_req_key(n);
 399                 else if(n->last_req_key + 10 < time(NULL)) {
 400                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 401                         sptps_stop(&n->sptps);
 402                         n->status.waitingforkey = false;
 403                         send_req_key(n);
 404                 }
 405                 return;
 406         }
 407
 408         uint8_t type = 0;
 409         int offset = 0;
 410
 411         if(!(origpkt->data[12] | origpkt->data[13])) {
 412                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 413                 return;
 414         }
 415
 416         if(routing_mode == RMODE_ROUTER)
 417                 offset = 14;
 418         else
 419                 type = PKT_MAC;
 420
 421         if(origpkt->len < offset)
 422                 return;
 423
 424         vpn_packet_t outpkt;
 425
 426         if(n->outcompression) {
 427                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 428                 if(len < 0) {
 429                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 430                 } else if(len < origpkt->len - offset) {
 431                         outpkt.len = len + offset;
 432                         origpkt = &outpkt;
 433                         type |= PKT_COMPRESSED;
 434                 }
 435         }
 436
 437         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 438         return;
 439 }
 440
 441 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 442         /* Latest guess */
 443         *sa = &n->address;
 444         *sock = n->sock;
 445
 446         /* If the UDP address is confirmed, use it. */
 447         if(n->status.udp_confirmed)
 448                 return;
 449
 450         /* Send every third packet to n->address; that could be set
 451            to the node's reflexive UDP address discovered during key
 452            exchange. */
 453
 454         static int x = 0;
 455         if(++x >= 3) {
 456                 x = 0;
 457                 return;
 458         }
 459
 460         /* Otherwise, address are found in edges to this node.
 461            So we pick a random edge and a random socket. */
 462
 463         int i = 0;
 464         int j = rand() % n->edge_tree->count;
 465         edge_t *candidate = NULL;
 466
 467         for splay_each(edge_t, e, n->edge_tree) {
 468                 if(i++ == j) {
 469                         candidate = e->reverse;
 470                         break;
 471                 }
 472         }
 473
 474         if(candidate) {
 475                 *sa = &candidate->address;
 476                 *sock = rand() % listen_sockets;
 477         }
 478
 479         /* Make sure we have a suitable socket for the chosen address */
 480         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 481                 for(int i = 0; i < listen_sockets; i++) {
 482                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 483                                 *sock = i;
 484                                 break;
 485                         }
 486                 }
 487         }
 488 }
 489
 490 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 491         static sockaddr_t broadcast_ipv4 = {
 492                 .in = {
 493                         .sin_family = AF_INET,
 494                         .sin_addr.s_addr = -1,
 495                 }
 496         };
 497
 498         static sockaddr_t broadcast_ipv6 = {
 499                 .in6 = {
 500                         .sin6_family = AF_INET6,
 501                         .sin6_addr.s6_addr[0x0] = 0xff,
 502                         .sin6_addr.s6_addr[0x1] = 0x02,
 503                         .sin6_addr.s6_addr[0xf] = 0x01,
 504                 }
 505         };
 506
 507         *sock = rand() % listen_sockets;
 508
 509         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 510                 broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 511                 broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
 512                 *sa = &broadcast_ipv6;
 513         } else {
 514                 broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 515                 *sa = &broadcast_ipv4;
 516         }
 517 }
 518
 519 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 520         vpn_packet_t pkt1, pkt2;
 521         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 522         vpn_packet_t *inpkt = origpkt;
 523         int nextpkt = 0;
 524         vpn_packet_t *outpkt;
 525         int origlen = origpkt->len;
 526         size_t outlen;
 527 #if defined(SOL_IP) && defined(IP_TOS)
 528         static int priority = 0;
 529 #endif
 530         int origpriority = origpkt->priority;
 531
 532         if(!n->status.reachable) {
 533                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 534                 return;
 535         }
 536
 537         if(n->status.sptps)
 538                 return send_sptps_packet(n, origpkt);
 539
 540         /* Make sure we have a valid key */
 541
 542         if(!n->status.validkey) {
 543                 time_t now = time(NULL);
 544
 545                 logger(DEBUG_TRAFFIC, LOG_INFO,
 546                                    "No valid key known yet for %s (%s), forwarding via TCP",
 547                                    n->name, n->hostname);
 548
 549                 if(n->last_req_key + 10 <= now) {
 550                         send_req_key(n);
 551                         n->last_req_key = now;
 552                 }
 553
 554                 send_tcppacket(n->nexthop->connection, origpkt);
 555
 556                 return;
 557         }
 558
 559         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 560                 logger(DEBUG_TRAFFIC, LOG_INFO,
 561                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 562                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 563
 564                 if(n != n->nexthop)
 565                         send_packet(n->nexthop, origpkt);
 566                 else
 567                         send_tcppacket(n->nexthop->connection, origpkt);
 568
 569                 return;
 570         }
 571
 572         /* Compress the packet */
 573
 574         if(n->outcompression) {
 575                 outpkt = pkt[nextpkt++];
 576
 577                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 578                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 579                                    n->name, n->hostname);
 580                         return;
 581                 }
 582
 583                 inpkt = outpkt;
 584         }
 585
 586         /* Add sequence number */
 587
 588         inpkt->seqno = htonl(++(n->sent_seqno));
 589         inpkt->len += sizeof inpkt->seqno;
 590
 591         /* Encrypt the packet */
 592
 593         if(cipher_active(&n->outcipher)) {
 594                 outpkt = pkt[nextpkt++];
 595                 outlen = MAXSIZE;
 596
 597                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 598                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 599                         goto end;
 600                 }
 601
 602                 outpkt->len = outlen;
 603                 inpkt = outpkt;
 604         }
 605
 606         /* Add the message authentication code */
 607
 608         if(digest_active(&n->outdigest)) {
 609                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 610                 inpkt->len += digest_length(&n->outdigest);
 611         }
 612
 613         /* Send the packet */
 614
 615         const sockaddr_t *sa;
 616         int sock;
 617
 618         /* Overloaded use of priority field: -1 means local broadcast */
 619
 620         if(origpriority == -1 && n->prevedge)
 621                 choose_broadcast_address(n, &sa, &sock);
 622         else
 623                 choose_udp_address(n, &sa, &sock);
 624
 625 #if defined(SOL_IP) && defined(IP_TOS)
 626         if(priorityinheritance && origpriority != priority
 627            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 628                 priority = origpriority;
 629                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 630                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 631                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 632         }
 633 #endif
 634
 635         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 636                 if(sockmsgsize(sockerrno)) {
 637                         if(n->maxmtu >= origlen)
 638                                 n->maxmtu = origlen - 1;
 639                         if(n->mtu >= origlen)
 640                                 n->mtu = origlen - 1;
 641                 } else
 642                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 643         }
 644
 645 end:
 646         origpkt->len = origlen;
 647 }
 648
 649 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 650         node_t *to = handle;
 651
 652         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 653
 654         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 655                 char buf[len * 4 / 3 + 5];
 656                 b64encode(data, buf, len);
 657                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 658                    to ensure we get to learn the reflexive UDP address. */
 659                 if(!to->status.validkey)
 660                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 661                 else
 662                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 663         }
 664
 665         /* Otherwise, send the packet via UDP */
 666
 667         const sockaddr_t *sa;
 668         int sock;
 669
 670         choose_udp_address(to, &sa, &sock);
 671
 672         if(sendto(listen_socket[sock].udp, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 673                 if(sockmsgsize(sockerrno)) {
 674                         if(to->maxmtu >= len)
 675                                 to->maxmtu = len - 1;
 676                         if(to->mtu >= len)
 677                                 to->mtu = len - 1;
 678                 } else {
 679                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 680                         return false;
 681                 }
 682         }
 683
 684         return true;
 685 }
 686
 687 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 688         node_t *from = handle;
 689
 690         if(type == SPTPS_HANDSHAKE) {
 691                 if(!from->status.validkey) {
 692                         from->status.validkey = true;
 693                         from->status.waitingforkey = false;
 694                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 695                 }
 696                 return true;
 697         }
 698
 699         if(len > MTU) {
 700                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 701                 return false;
 702         }
 703
 704         vpn_packet_t inpkt;
 705
 706         if(type == PKT_PROBE) {
 707                 inpkt.len = len;
 708                 memcpy(inpkt.data, data, len);
 709                 mtu_probe_h(from, &inpkt, len);
 710                 return true;
 711         }
 712
 713         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 714                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 715                 return false;
 716         }
 717
 718         /* Check if we have the headers we need */
 719         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 720                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 721                 return false;
 722         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 723                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 724         }
 725
 726         int offset = (type & PKT_MAC) ? 0 : 14;
 727         if(type & PKT_COMPRESSED) {
 728                 len = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 729                 if(len < 0) {
 730                         return false;
 731                 } else {
 732                         inpkt.len = len + offset;
 733                 }
 734                 if(inpkt.len > MAXSIZE)
 735                         abort();
 736         } else {
 737                 memcpy(inpkt.data + offset, data, len);
 738                 inpkt.len = len + offset;
 739         }
 740
 741         /* Generate the Ethernet packet type if necessary */
 742         if(offset) {
 743                 switch(inpkt.data[14] >> 4) {
 744                         case 4:
 745                                 inpkt.data[12] = 0x08;
 746                                 inpkt.data[13] = 0x00;
 747                                 break;
 748                         case 6:
 749                                 inpkt.data[12] = 0x86;
 750                                 inpkt.data[13] = 0xDD;
 751                                 break;
 752                         default:
 753                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 754                                                    "Unknown IP version %d while reading packet from %s (%s)",
 755                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 756                                 return false;
 757                 }
 758         }
 759
 760         receive_packet(from, &inpkt);
 761         return true;
 762 }
 763
 764 /*
 765   send a packet to the given vpn ip.
 766 */
 767 void send_packet(node_t *n, vpn_packet_t *packet) {
 768         node_t *via;
 769
 770         if(n == myself) {
 771                 if(overwrite_mac)
 772                          memcpy(packet->data, mymac.x, ETH_ALEN);
 773                 n->out_packets++;
 774                 n->out_bytes += packet->len;
 775                 devops.write(packet);
 776                 return;
 777         }
 778
 779         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 780                            packet->len, n->name, n->hostname);
 781
 782         if(!n->status.reachable) {
 783                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 784                                    n->name, n->hostname);
 785                 return;
 786         }
 787
 788         n->out_packets++;
 789         n->out_bytes += packet->len;
 790
 791         if(n->status.sptps) {
 792                 send_sptps_packet(n, packet);
 793                 return;
 794         }
 795
 796         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 797
 798         if(via != n)
 799                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 800                            n->name, via->name, n->via->hostname);
 801
 802         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 803                 if(!send_tcppacket(via->connection, packet))
 804                         terminate_connection(via->connection, true);
 805         } else
 806                 send_udppacket(via, packet);
 807 }
 808
 809 /* Broadcast a packet using the minimum spanning tree */
 810
 811 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 812         // Always give ourself a copy of the packet.
 813         if(from != myself)
 814                 send_packet(myself, packet);
 815
 816         // In TunnelServer mode, do not forward broadcast packets.
 817         // The MST might not be valid and create loops.
 818         if(tunnelserver || broadcast_mode == BMODE_NONE)
 819                 return;
 820
 821         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 822                            packet->len, from->name, from->hostname);
 823
 824         switch(broadcast_mode) {
 825                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 826                 // This guarantees all nodes receive the broadcast packet, and
 827                 // usually distributes the sending of broadcast packets over all nodes.
 828                 case BMODE_MST:
 829                         for list_each(connection_t, c, connection_list)
 830                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 831                                         send_packet(c->node, packet);
 832                         break;
 833
 834                 // In direct mode, we send copies to each node we know of.
 835                 // However, this only reaches nodes that can be reached in a single hop.
 836                 // We don't have enough information to forward broadcast packets in this case.
 837                 case BMODE_DIRECT:
 838                         if(from != myself)
 839                                 break;
 840
 841                         for splay_each(node_t, n, node_tree)
 842                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 843                                         send_packet(n, packet);
 844                         break;
 845
 846                 default:
 847                         break;
 848         }
 849 }
 850
 851 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 852         node_t *n = NULL;
 853         bool hard = false;
 854         static time_t last_hard_try = 0;
 855         time_t now = time(NULL);
 856
 857         for splay_each(edge_t, e, edge_weight_tree) {
 858                 if(!e->to->status.reachable || e->to == myself)
 859                         continue;
 860
 861                 if(sockaddrcmp_noport(from, &e->address)) {
 862                         if(last_hard_try == now)
 863                                 continue;
 864                         hard = true;
 865                 }
 866
 867                 if(!try_mac(e->to, pkt))
 868                         continue;
 869
 870                 n = e->to;
 871                 break;
 872         }
 873
 874         if(hard)
 875                 last_hard_try = now;
 876
 877         last_hard_try = now;
 878         return n;
 879 }
 880
 881 void handle_incoming_vpn_data(int sock, short events, void *data) {
 882         vpn_packet_t pkt;
 883         char *hostname;
 884         sockaddr_t from = {{0}};
 885         socklen_t fromlen = sizeof from;
 886         node_t *n;
 887         int len;
 888
 889         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 890
 891         if(len <= 0 || len > MAXSIZE) {
 892                 if(!sockwouldblock(sockerrno))
 893                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 894                 return;
 895         }
 896
 897         pkt.len = len;
 898
 899         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 900
 901         n = lookup_node_udp(&from);
 902
 903         if(!n) {
 904                 n = try_harder(&from, &pkt);
 905                 if(n)
 906                         update_node_udp(n, &from);
 907                 else if(debug_level >= DEBUG_PROTOCOL) {
 908                         hostname = sockaddr2hostname(&from);
 909                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 910                         free(hostname);
 911                         return;
 912                 }
 913                 else
 914                         return;
 915         }
 916
 917         n->sock = (intptr_t)data;
 918
 919         receive_udppacket(n, &pkt);
 920 }
 921
 922 void handle_device_data(int sock, short events, void *data) {
 923         vpn_packet_t packet;
 924
 925         packet.priority = 0;
 926
 927         if(devops.read(&packet)) {
 928                 myself->in_packets++;
 929                 myself->in_bytes += packet.len;
 930                 route(myself, &packet);
 931         }
 932 }