git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2013 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "cipher.h"
  40 #include "conf.h"
  41 #include "connection.h"
  42 #include "crypto.h"
  43 #include "digest.h"
  44 #include "device.h"
  45 #include "ethernet.h"
  46 #include "graph.h"
  47 #include "logger.h"
  48 #include "net.h"
  49 #include "netutl.h"
  50 #include "protocol.h"
  51 #include "process.h"
  52 #include "route.h"
  53 #include "utils.h"
  54 #include "xalloc.h"
  55
  56 int keylifetime = 0;
  57 #ifdef HAVE_LZO
  58 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  59 #endif
  60
  61 static void send_udppacket(node_t *, vpn_packet_t *);
  62
  63 unsigned replaywin = 16;
  64 bool localdiscovery = false;
  65
  66 #define MAX_SEQNO 1073741824
  67
  68 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  69    mtuprobes ==    31: sleep pinginterval seconds
  70    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  71    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  72
  73    Probes are sent in batches of at least three, with random sizes between the
  74    lower and upper boundaries for the MTU thus far discovered.
  75
  76    After the initial discovery, a fourth packet is added to each batch with a
  77    size larger than the currently known PMTU, to test if the PMTU has increased.
  78
  79    In case local discovery is enabled, another packet is added to each batch,
  80    which will be broadcast to the local network.
  81
  82 */
  83
  84 static void send_mtu_probe_handler(void *data) {
  85         node_t *n = data;
  86         int timeout = 1;
  87
  88         n->mtuprobes++;
  89
  90         if(!n->status.reachable || !n->status.validkey) {
  91                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  92                 n->mtuprobes = 0;
  93                 return;
  94         }
  95
  96         if(n->mtuprobes > 32) {
  97                 if(!n->minmtu) {
  98                         n->mtuprobes = 31;
  99                         timeout = pinginterval;
 100                         goto end;
 101                 }
 102
 103                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 104                 n->status.udp_confirmed = false;
 105                 n->mtuprobes = 1;
 106                 n->minmtu = 0;
 107                 n->maxmtu = MTU;
 108         }
 109
 110         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 111                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 112                 n->mtuprobes = 31;
 113         }
 114
 115         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 116                 if(n->minmtu > n->maxmtu)
 117                         n->minmtu = n->maxmtu;
 118                 else
 119                         n->maxmtu = n->minmtu;
 120                 n->mtu = n->minmtu;
 121                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 122                 n->mtuprobes = 31;
 123         }
 124
 125         if(n->mtuprobes == 31) {
 126                 timeout = pinginterval;
 127                 goto end;
 128         } else if(n->mtuprobes == 32) {
 129                 timeout = pingtimeout;
 130         }
 131
 132         for(int i = 0; i < 4 + localdiscovery; i++) {
 133                 int len;
 134
 135                 if(i == 0) {
 136                         if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
 137                                 continue;
 138                         len = n->maxmtu + 8;
 139                 } else if(n->maxmtu <= n->minmtu) {
 140                         len = n->maxmtu;
 141                 } else {
 142                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 143                 }
 144
 145                 if(len < 64)
 146                         len = 64;
 147
 148                 vpn_packet_t packet;
 149                 memset(packet.data, 0, 14);
 150                 randomize(packet.data + 14, len - 14);
 151                 packet.len = len;
 152                 if(i >= 4 && n->mtuprobes <= 10)
 153                         packet.priority = -1;
 154                 else
 155                         packet.priority = 0;
 156
 157                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 158
 159                 send_udppacket(n, &packet);
 160         }
 161
 162         n->probe_counter = 0;
 163         gettimeofday(&n->probe_time, NULL);
 164
 165         /* Calculate the packet loss of incoming traffic by comparing the rate of
 166            packets received to the rate with which the sequence number has increased.
 167          */
 168
 169         if(n->received > n->prev_received)
 170                 n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno);
 171         else
 172                 n->packetloss = n->received_seqno <= n->prev_received_seqno;
 173
 174         n->prev_received_seqno = n->received_seqno;
 175         n->prev_received = n->received;
 176
 177 end:
 178         timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
 179 }
 180
 181 void send_mtu_probe(node_t *n) {
 182         timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
 183         send_mtu_probe_handler(n);
 184 }
 185
 186 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 187         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 188
 189         if(!packet->data[0]) {
 190                 /* It's a probe request, send back a reply */
 191
 192                 packet->data[0] = 1;
 193
 194                 /* Temporarily set udp_confirmed, so that the reply is sent
 195                    back exactly the way it came in. */
 196
 197                 bool udp_confirmed = n->status.udp_confirmed;
 198                 n->status.udp_confirmed = true;
 199                 send_udppacket(n, packet);
 200                 n->status.udp_confirmed = udp_confirmed;
 201         } else {
 202                 /* It's a valid reply: now we know bidirectional communication
 203                    is possible using the address and socket that the reply
 204                    packet used. */
 205
 206                 n->status.udp_confirmed = true;
 207
 208                 /* If we haven't established the PMTU yet, restart the discovery process. */
 209
 210                 if(n->mtuprobes > 30) {
 211                         if (len == n->maxmtu + 8) {
 212                                 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
 213                                 n->maxmtu = MTU;
 214                                 n->mtuprobes = 10;
 215                                 return;
 216                         }
 217
 218                         if(n->minmtu)
 219                                 n->mtuprobes = 30;
 220                         else
 221                                 n->mtuprobes = 1;
 222                 }
 223
 224                 /* If applicable, raise the minimum supported MTU */
 225
 226                 if(len > n->maxmtu)
 227                         len = n->maxmtu;
 228                 if(n->minmtu < len)
 229                         n->minmtu = len;
 230
 231                 /* Calculate RTT and bandwidth.
 232                    The RTT is the time between the MTU probe burst was sent and the first
 233                    reply is received. The bandwidth is measured using the time between the
 234                    arrival of the first and third probe reply.
 235                  */
 236
 237                 struct timeval now, diff;
 238                 gettimeofday(&now, NULL);
 239                 timersub(&now, &n->probe_time, &diff);
 240                 n->probe_counter++;
 241
 242                 if(n->probe_counter == 1) {
 243                         n->rtt = diff.tv_sec + diff.tv_usec * 1e-6;
 244                         n->probe_time = now;
 245                 } else if(n->probe_counter == 3) {
 246                         n->bandwidth = 2.0 * len / (diff.tv_sec + diff.tv_usec * 1e-6);
 247                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, burst bandwidth %.3f Mbit/s, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->bandwidth * 8e-6, n->packetloss * 1e2);
 248                 }
 249         }
 250 }
 251
 252 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 253         if(level == 0) {
 254                 memcpy(dest, source, len);
 255                 return len;
 256         } else if(level == 10) {
 257 #ifdef HAVE_LZO
 258                 lzo_uint lzolen = MAXSIZE;
 259                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 260                 return lzolen;
 261 #else
 262                 return -1;
 263 #endif
 264         } else if(level < 10) {
 265 #ifdef HAVE_ZLIB
 266                 unsigned long destlen = MAXSIZE;
 267                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 268                         return destlen;
 269                 else
 270 #endif
 271                         return -1;
 272         } else {
 273 #ifdef HAVE_LZO
 274                 lzo_uint lzolen = MAXSIZE;
 275                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 276                 return lzolen;
 277 #else
 278                 return -1;
 279 #endif
 280         }
 281
 282         return -1;
 283 }
 284
 285 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 286         if(level == 0) {
 287                 memcpy(dest, source, len);
 288                 return len;
 289         } else if(level > 9) {
 290 #ifdef HAVE_LZO
 291                 lzo_uint lzolen = MAXSIZE;
 292                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 293                         return lzolen;
 294                 else
 295 #endif
 296                         return -1;
 297         }
 298 #ifdef HAVE_ZLIB
 299         else {
 300                 unsigned long destlen = MAXSIZE;
 301                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 302                         return destlen;
 303                 else
 304                         return -1;
 305         }
 306 #endif
 307
 308         return -1;
 309 }
 310
 311 /* VPN packet I/O */
 312
 313 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 314         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 315                            packet->len, n->name, n->hostname);
 316
 317         n->in_packets++;
 318         n->in_bytes += packet->len;
 319
 320         route(n, packet);
 321 }
 322
 323 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 324         if(n->status.sptps)
 325                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 326
 327         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 328                 return false;
 329
 330         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 331 }
 332
 333 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 334         vpn_packet_t pkt1, pkt2;
 335         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 336         int nextpkt = 0;
 337         vpn_packet_t *outpkt = pkt[0];
 338         size_t outlen;
 339
 340         if(n->status.sptps) {
 341                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 342                 return;
 343         }
 344
 345         if(!cipher_active(&n->incipher)) {
 346                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 347                                         n->name, n->hostname);
 348                 return;
 349         }
 350
 351         /* Check packet length */
 352
 353         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 354                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 355                                         n->name, n->hostname);
 356                 return;
 357         }
 358
 359         /* Check the message authentication code */
 360
 361         if(digest_active(&n->indigest)) {
 362                 inpkt->len -= n->indigest.maclength;
 363                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 364                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 365                         return;
 366                 }
 367         }
 368         /* Decrypt the packet */
 369
 370         if(cipher_active(&n->incipher)) {
 371                 outpkt = pkt[nextpkt++];
 372                 outlen = MAXSIZE;
 373
 374                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 375                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 376                         return;
 377                 }
 378
 379                 outpkt->len = outlen;
 380                 inpkt = outpkt;
 381         }
 382
 383         /* Check the sequence number */
 384
 385         inpkt->len -= sizeof inpkt->seqno;
 386         inpkt->seqno = ntohl(inpkt->seqno);
 387
 388         if(replaywin) {
 389                 if(inpkt->seqno != n->received_seqno + 1) {
 390                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 391                                 if(n->farfuture++ < replaywin >> 2) {
 392                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 393                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 394                                         return;
 395                                 }
 396                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 397                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 398                                 memset(n->late, 0, replaywin);
 399                         } else if (inpkt->seqno <= n->received_seqno) {
 400                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 401                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 402                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 403                                         return;
 404                                 }
 405                         } else {
 406                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 407                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 408                         }
 409                 }
 410
 411                 n->farfuture = 0;
 412                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 413         }
 414
 415         if(inpkt->seqno > n->received_seqno)
 416                 n->received_seqno = inpkt->seqno;
 417
 418         n->received++;
 419
 420         if(n->received_seqno > MAX_SEQNO)
 421                 regenerate_key();
 422
 423         /* Decompress the packet */
 424
 425         length_t origlen = inpkt->len;
 426
 427         if(n->incompression) {
 428                 outpkt = pkt[nextpkt++];
 429
 430                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 431                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 432                                                  n->name, n->hostname);
 433                         return;
 434                 }
 435
 436                 inpkt = outpkt;
 437
 438                 origlen -= MTU/64 + 20;
 439         }
 440
 441         inpkt->priority = 0;
 442
 443         if(!inpkt->data[12] && !inpkt->data[13])
 444                 mtu_probe_h(n, inpkt, origlen);
 445         else
 446                 receive_packet(n, inpkt);
 447 }
 448
 449 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 450         vpn_packet_t outpkt;
 451
 452         outpkt.len = len;
 453         if(c->options & OPTION_TCPONLY)
 454                 outpkt.priority = 0;
 455         else
 456                 outpkt.priority = -1;
 457         memcpy(outpkt.data, buffer, len);
 458
 459         receive_packet(c->node, &outpkt);
 460 }
 461
 462 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 463         if(!n->status.validkey) {
 464                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 465                 if(!n->status.waitingforkey)
 466                         send_req_key(n);
 467                 else if(n->last_req_key + 10 < time(NULL)) {
 468                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 469                         sptps_stop(&n->sptps);
 470                         n->status.waitingforkey = false;
 471                         send_req_key(n);
 472                 }
 473                 return;
 474         }
 475
 476         uint8_t type = 0;
 477         int offset = 0;
 478
 479         if(!(origpkt->data[12] | origpkt->data[13])) {
 480                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 481                 return;
 482         }
 483
 484         if(routing_mode == RMODE_ROUTER)
 485                 offset = 14;
 486         else
 487                 type = PKT_MAC;
 488
 489         if(origpkt->len < offset)
 490                 return;
 491
 492         vpn_packet_t outpkt;
 493
 494         if(n->outcompression) {
 495                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 496                 if(len < 0) {
 497                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 498                 } else if(len < origpkt->len - offset) {
 499                         outpkt.len = len + offset;
 500                         origpkt = &outpkt;
 501                         type |= PKT_COMPRESSED;
 502                 }
 503         }
 504
 505         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 506         return;
 507 }
 508
 509 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 510         /* Latest guess */
 511         *sa = &n->address;
 512         *sock = n->sock;
 513
 514         /* If the UDP address is confirmed, use it. */
 515         if(n->status.udp_confirmed)
 516                 return;
 517
 518         /* Send every third packet to n->address; that could be set
 519            to the node's reflexive UDP address discovered during key
 520            exchange. */
 521
 522         static int x = 0;
 523         if(++x >= 3) {
 524                 x = 0;
 525                 return;
 526         }
 527
 528         /* Otherwise, address are found in edges to this node.
 529            So we pick a random edge and a random socket. */
 530
 531         int i = 0;
 532         int j = rand() % n->edge_tree->count;
 533         edge_t *candidate = NULL;
 534
 535         for splay_each(edge_t, e, n->edge_tree) {
 536                 if(i++ == j) {
 537                         candidate = e->reverse;
 538                         break;
 539                 }
 540         }
 541
 542         if(candidate) {
 543                 *sa = &candidate->address;
 544                 *sock = rand() % listen_sockets;
 545         }
 546
 547         /* Make sure we have a suitable socket for the chosen address */
 548         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 549                 for(int i = 0; i < listen_sockets; i++) {
 550                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 551                                 *sock = i;
 552                                 break;
 553                         }
 554                 }
 555         }
 556 }
 557
 558 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 559         static sockaddr_t broadcast_ipv4 = {
 560                 .in = {
 561                         .sin_family = AF_INET,
 562                         .sin_addr.s_addr = -1,
 563                 }
 564         };
 565
 566         static sockaddr_t broadcast_ipv6 = {
 567                 .in6 = {
 568                         .sin6_family = AF_INET6,
 569                         .sin6_addr.s6_addr[0x0] = 0xff,
 570                         .sin6_addr.s6_addr[0x1] = 0x02,
 571                         .sin6_addr.s6_addr[0xf] = 0x01,
 572                 }
 573         };
 574
 575         *sock = rand() % listen_sockets;
 576
 577         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 578                 broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 579                 broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
 580                 *sa = &broadcast_ipv6;
 581         } else {
 582                 broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 583                 *sa = &broadcast_ipv4;
 584         }
 585 }
 586
 587 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 588         vpn_packet_t pkt1, pkt2;
 589         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 590         vpn_packet_t *inpkt = origpkt;
 591         int nextpkt = 0;
 592         vpn_packet_t *outpkt;
 593         int origlen = origpkt->len;
 594         size_t outlen;
 595 #if defined(SOL_IP) && defined(IP_TOS)
 596         static int priority = 0;
 597 #endif
 598         int origpriority = origpkt->priority;
 599
 600         if(!n->status.reachable) {
 601                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 602                 return;
 603         }
 604
 605         if(n->status.sptps)
 606                 return send_sptps_packet(n, origpkt);
 607
 608         /* Make sure we have a valid key */
 609
 610         if(!n->status.validkey) {
 611                 logger(DEBUG_TRAFFIC, LOG_INFO,
 612                                    "No valid key known yet for %s (%s), forwarding via TCP",
 613                                    n->name, n->hostname);
 614
 615                 if(n->last_req_key + 10 <= now.tv_sec) {
 616                         send_req_key(n);
 617                         n->last_req_key = now.tv_sec;
 618                 }
 619
 620                 send_tcppacket(n->nexthop->connection, origpkt);
 621
 622                 return;
 623         }
 624
 625         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 626                 logger(DEBUG_TRAFFIC, LOG_INFO,
 627                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 628                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 629
 630                 if(n != n->nexthop)
 631                         send_packet(n->nexthop, origpkt);
 632                 else
 633                         send_tcppacket(n->nexthop->connection, origpkt);
 634
 635                 return;
 636         }
 637
 638         /* Compress the packet */
 639
 640         if(n->outcompression) {
 641                 outpkt = pkt[nextpkt++];
 642
 643                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 644                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 645                                    n->name, n->hostname);
 646                         return;
 647                 }
 648
 649                 inpkt = outpkt;
 650         }
 651
 652         /* Add sequence number */
 653
 654         inpkt->seqno = htonl(++(n->sent_seqno));
 655         inpkt->len += sizeof inpkt->seqno;
 656
 657         /* Encrypt the packet */
 658
 659         if(cipher_active(&n->outcipher)) {
 660                 outpkt = pkt[nextpkt++];
 661                 outlen = MAXSIZE;
 662
 663                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 664                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 665                         goto end;
 666                 }
 667
 668                 outpkt->len = outlen;
 669                 inpkt = outpkt;
 670         }
 671
 672         /* Add the message authentication code */
 673
 674         if(digest_active(&n->outdigest)) {
 675                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 676                 inpkt->len += digest_length(&n->outdigest);
 677         }
 678
 679         /* Send the packet */
 680
 681         const sockaddr_t *sa;
 682         int sock;
 683
 684         /* Overloaded use of priority field: -1 means local broadcast */
 685
 686         if(origpriority == -1 && n->prevedge)
 687                 choose_broadcast_address(n, &sa, &sock);
 688         else
 689                 choose_udp_address(n, &sa, &sock);
 690
 691 #if defined(SOL_IP) && defined(IP_TOS)
 692         if(priorityinheritance && origpriority != priority
 693            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 694                 priority = origpriority;
 695                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 696                 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 697                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 698         }
 699 #endif
 700
 701         if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 702                 if(sockmsgsize(sockerrno)) {
 703                         if(n->maxmtu >= origlen)
 704                                 n->maxmtu = origlen - 1;
 705                         if(n->mtu >= origlen)
 706                                 n->mtu = origlen - 1;
 707                 } else
 708                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 709         }
 710
 711 end:
 712         origpkt->len = origlen;
 713 }
 714
 715 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 716         node_t *to = handle;
 717
 718         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 719
 720         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 721                 char buf[len * 4 / 3 + 5];
 722                 b64encode(data, buf, len);
 723                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 724                    to ensure we get to learn the reflexive UDP address. */
 725                 if(!to->status.validkey)
 726                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 727                 else
 728                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 729         }
 730
 731         /* Otherwise, send the packet via UDP */
 732
 733         const sockaddr_t *sa;
 734         int sock;
 735
 736         choose_udp_address(to, &sa, &sock);
 737
 738         if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 739                 if(sockmsgsize(sockerrno)) {
 740                         if(to->maxmtu >= len)
 741                                 to->maxmtu = len - 1;
 742                         if(to->mtu >= len)
 743                                 to->mtu = len - 1;
 744                 } else {
 745                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 746                         return false;
 747                 }
 748         }
 749
 750         return true;
 751 }
 752
 753 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 754         node_t *from = handle;
 755
 756         if(type == SPTPS_HANDSHAKE) {
 757                 if(!from->status.validkey) {
 758                         from->status.validkey = true;
 759                         from->status.waitingforkey = false;
 760                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 761                 }
 762                 return true;
 763         }
 764
 765         if(len > MTU) {
 766                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 767                 return false;
 768         }
 769
 770         vpn_packet_t inpkt;
 771
 772         if(type == PKT_PROBE) {
 773                 inpkt.len = len;
 774                 memcpy(inpkt.data, data, len);
 775                 mtu_probe_h(from, &inpkt, len);
 776                 return true;
 777         }
 778
 779         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 780                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 781                 return false;
 782         }
 783
 784         /* Check if we have the headers we need */
 785         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 786                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 787                 return false;
 788         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 789                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 790         }
 791
 792         int offset = (type & PKT_MAC) ? 0 : 14;
 793         if(type & PKT_COMPRESSED) {
 794                 length_t ulen = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 795                 if(ulen < 0) {
 796                         return false;
 797                 } else {
 798                         inpkt.len = ulen + offset;
 799                 }
 800                 if(inpkt.len > MAXSIZE)
 801                         abort();
 802         } else {
 803                 memcpy(inpkt.data + offset, data, len);
 804                 inpkt.len = len + offset;
 805         }
 806
 807         /* Generate the Ethernet packet type if necessary */
 808         if(offset) {
 809                 switch(inpkt.data[14] >> 4) {
 810                         case 4:
 811                                 inpkt.data[12] = 0x08;
 812                                 inpkt.data[13] = 0x00;
 813                                 break;
 814                         case 6:
 815                                 inpkt.data[12] = 0x86;
 816                                 inpkt.data[13] = 0xDD;
 817                                 break;
 818                         default:
 819                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 820                                                    "Unknown IP version %d while reading packet from %s (%s)",
 821                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 822                                 return false;
 823                 }
 824         }
 825
 826         receive_packet(from, &inpkt);
 827         return true;
 828 }
 829
 830 /*
 831   send a packet to the given vpn ip.
 832 */
 833 void send_packet(node_t *n, vpn_packet_t *packet) {
 834         node_t *via;
 835
 836         if(n == myself) {
 837                 if(overwrite_mac)
 838                          memcpy(packet->data, mymac.x, ETH_ALEN);
 839                 n->out_packets++;
 840                 n->out_bytes += packet->len;
 841                 devops.write(packet);
 842                 return;
 843         }
 844
 845         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 846                            packet->len, n->name, n->hostname);
 847
 848         if(!n->status.reachable) {
 849                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 850                                    n->name, n->hostname);
 851                 return;
 852         }
 853
 854         n->out_packets++;
 855         n->out_bytes += packet->len;
 856
 857         if(n->status.sptps) {
 858                 send_sptps_packet(n, packet);
 859                 return;
 860         }
 861
 862         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 863
 864         if(via != n)
 865                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 866                            n->name, via->name, n->via->hostname);
 867
 868         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 869                 if(!send_tcppacket(via->connection, packet))
 870                         terminate_connection(via->connection, true);
 871         } else
 872                 send_udppacket(via, packet);
 873 }
 874
 875 /* Broadcast a packet using the minimum spanning tree */
 876
 877 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 878         // Always give ourself a copy of the packet.
 879         if(from != myself)
 880                 send_packet(myself, packet);
 881
 882         // In TunnelServer mode, do not forward broadcast packets.
 883         // The MST might not be valid and create loops.
 884         if(tunnelserver || broadcast_mode == BMODE_NONE)
 885                 return;
 886
 887         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 888                            packet->len, from->name, from->hostname);
 889
 890         switch(broadcast_mode) {
 891                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 892                 // This guarantees all nodes receive the broadcast packet, and
 893                 // usually distributes the sending of broadcast packets over all nodes.
 894                 case BMODE_MST:
 895                         for list_each(connection_t, c, connection_list)
 896                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 897                                         send_packet(c->node, packet);
 898                         break;
 899
 900                 // In direct mode, we send copies to each node we know of.
 901                 // However, this only reaches nodes that can be reached in a single hop.
 902                 // We don't have enough information to forward broadcast packets in this case.
 903                 case BMODE_DIRECT:
 904                         if(from != myself)
 905                                 break;
 906
 907                         for splay_each(node_t, n, node_tree)
 908                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 909                                         send_packet(n, packet);
 910                         break;
 911
 912                 default:
 913                         break;
 914         }
 915 }
 916
 917 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 918         node_t *n = NULL;
 919         bool hard = false;
 920         static time_t last_hard_try = 0;
 921
 922         for splay_each(edge_t, e, edge_weight_tree) {
 923                 if(!e->to->status.reachable || e->to == myself)
 924                         continue;
 925
 926                 if(sockaddrcmp_noport(from, &e->address)) {
 927                         if(last_hard_try == now.tv_sec)
 928                                 continue;
 929                         hard = true;
 930                 }
 931
 932                 if(!try_mac(e->to, pkt))
 933                         continue;
 934
 935                 n = e->to;
 936                 break;
 937         }
 938
 939         if(hard)
 940                 last_hard_try = now.tv_sec;
 941
 942         last_hard_try = now.tv_sec;
 943         return n;
 944 }
 945
 946 void handle_incoming_vpn_data(void *data, int flags) {
 947         listen_socket_t *ls = data;
 948         vpn_packet_t pkt;
 949         char *hostname;
 950         sockaddr_t from = {{0}};
 951         socklen_t fromlen = sizeof from;
 952         node_t *n;
 953         int len;
 954
 955         len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 956
 957         if(len <= 0 || len > MAXSIZE) {
 958                 if(!sockwouldblock(sockerrno))
 959                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 960                 return;
 961         }
 962
 963         pkt.len = len;
 964
 965         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 966
 967         n = lookup_node_udp(&from);
 968
 969         if(!n) {
 970                 n = try_harder(&from, &pkt);
 971                 if(n)
 972                         update_node_udp(n, &from);
 973                 else if(debug_level >= DEBUG_PROTOCOL) {
 974                         hostname = sockaddr2hostname(&from);
 975                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 976                         free(hostname);
 977                         return;
 978                 }
 979                 else
 980                         return;
 981         }
 982
 983         n->sock = ls - listen_socket;
 984
 985         receive_udppacket(n, &pkt);
 986 }
 987
 988 void handle_device_data(void *data, int flags) {
 989         vpn_packet_t packet;
 990
 991         packet.priority = 0;
 992
 993         if(devops.read(&packet)) {
 994                 myself->in_packets++;
 995                 myself->in_bytes += packet.len;
 996                 route(myself, &packet);
 997         }
 998 }