git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "splay_tree.h"
  40 #include "cipher.h"
  41 #include "conf.h"
  42 #include "connection.h"
  43 #include "crypto.h"
  44 #include "digest.h"
  45 #include "device.h"
  46 #include "ethernet.h"
  47 #include "graph.h"
  48 #include "logger.h"
  49 #include "net.h"
  50 #include "netutl.h"
  51 #include "protocol.h"
  52 #include "process.h"
  53 #include "route.h"
  54 #include "utils.h"
  55 #include "xalloc.h"
  56
  57 int keylifetime = 0;
  58 #ifdef HAVE_LZO
  59 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  60 #endif
  61
  62 static void send_udppacket(node_t *, vpn_packet_t *);
  63
  64 unsigned replaywin = 16;
  65 bool localdiscovery = false;
  66
  67 #define MAX_SEQNO 1073741824
  68
  69 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  70    mtuprobes ==    31: sleep pinginterval seconds
  71    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  72    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  73
  74    Probes are sent in batches of three, with random sizes between the lower and
  75    upper boundaries for the MTU thus far discovered.
  76
  77    In case local discovery is enabled, a fourth packet is added to each batch,
  78    which will be broadcast to the local network.
  79 */
  80
  81 static void send_mtu_probe_handler(int fd, short events, void *data) {
  82         node_t *n = data;
  83         vpn_packet_t packet;
  84         int len, i;
  85         int timeout = 1;
  86
  87         n->mtuprobes++;
  88
  89         if(!n->status.reachable || !n->status.validkey) {
  90                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  91                 n->mtuprobes = 0;
  92                 return;
  93         }
  94
  95         if(n->mtuprobes > 32) {
  96                 if(!n->minmtu) {
  97                         n->mtuprobes = 31;
  98                         timeout = pinginterval;
  99                         goto end;
 100                 }
 101
 102                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 103                 n->mtuprobes = 1;
 104                 n->minmtu = 0;
 105                 n->maxmtu = MTU;
 106         }
 107
 108         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 109                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 110                 n->mtuprobes = 31;
 111         }
 112
 113         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 114                 if(n->minmtu > n->maxmtu)
 115                         n->minmtu = n->maxmtu;
 116                 else
 117                         n->maxmtu = n->minmtu;
 118                 n->mtu = n->minmtu;
 119                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 120                 n->mtuprobes = 31;
 121         }
 122
 123         if(n->mtuprobes == 31) {
 124                 timeout = pinginterval;
 125                 goto end;
 126         } else if(n->mtuprobes == 32) {
 127                 timeout = pingtimeout;
 128         }
 129
 130         for(i = 0; i < 3 + localdiscovery; i++) {
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 memset(packet.data, 0, 14);
 140                 randomize(packet.data + 14, len - 14);
 141                 packet.len = len;
 142                 if(i >= 3 && n->mtuprobes <= 10)
 143                         packet.priority = -1;
 144                 else
 145                         packet.priority = 0;
 146
 147                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 148
 149                 send_udppacket(n, &packet);
 150         }
 151
 152 end:
 153         event_add(&n->mtuevent, &(struct timeval){timeout, 0});
 154 }
 155
 156 void send_mtu_probe(node_t *n) {
 157         if(!timeout_initialized(&n->mtuevent))
 158                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 159         send_mtu_probe_handler(0, 0, n);
 160 }
 161
 162 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 163         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 164
 165         if(!packet->data[0]) {
 166                 packet->data[0] = 1;
 167                 send_udppacket(n, packet);
 168         } else {
 169                 if(n->mtuprobes > 30) {
 170                         if(n->minmtu)
 171                                 n->mtuprobes = 30;
 172                         else
 173                                 n->mtuprobes = 1;
 174                 }
 175
 176                 if(len > n->maxmtu)
 177                         len = n->maxmtu;
 178                 if(n->minmtu < len)
 179                         n->minmtu = len;
 180         }
 181 }
 182
 183 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 184         if(level == 0) {
 185                 memcpy(dest, source, len);
 186                 return len;
 187         } else if(level == 10) {
 188 #ifdef HAVE_LZO
 189                 lzo_uint lzolen = MAXSIZE;
 190                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 191                 return lzolen;
 192 #else
 193                 return -1;
 194 #endif
 195         } else if(level < 10) {
 196 #ifdef HAVE_ZLIB
 197                 unsigned long destlen = MAXSIZE;
 198                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 199                         return destlen;
 200                 else
 201 #endif
 202                         return -1;
 203         } else {
 204 #ifdef HAVE_LZO
 205                 lzo_uint lzolen = MAXSIZE;
 206                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 207                 return lzolen;
 208 #else
 209                 return -1;
 210 #endif
 211         }
 212
 213         return -1;
 214 }
 215
 216 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 217         if(level == 0) {
 218                 memcpy(dest, source, len);
 219                 return len;
 220         } else if(level > 9) {
 221 #ifdef HAVE_LZO
 222                 lzo_uint lzolen = MAXSIZE;
 223                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 224                         return lzolen;
 225                 else
 226 #endif
 227                         return -1;
 228         }
 229 #ifdef HAVE_ZLIB
 230         else {
 231                 unsigned long destlen = MAXSIZE;
 232                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 233                         return destlen;
 234                 else
 235                         return -1;
 236         }
 237 #endif
 238
 239         return -1;
 240 }
 241
 242 /* VPN packet I/O */
 243
 244 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 245         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 246                            packet->len, n->name, n->hostname);
 247
 248         n->in_packets++;
 249         n->in_bytes += packet->len;
 250
 251         route(n, packet);
 252 }
 253
 254 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 255         if(n->status.sptps)
 256                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 257
 258         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 259                 return false;
 260
 261         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 262 }
 263
 264 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 265         vpn_packet_t pkt1, pkt2;
 266         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 267         int nextpkt = 0;
 268         vpn_packet_t *outpkt = pkt[0];
 269         size_t outlen;
 270
 271         if(n->status.sptps) {
 272                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 273                 return;
 274         }
 275
 276         if(!cipher_active(&n->incipher)) {
 277                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 278                                         n->name, n->hostname);
 279                 return;
 280         }
 281
 282         /* Check packet length */
 283
 284         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 285                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 286                                         n->name, n->hostname);
 287                 return;
 288         }
 289
 290         /* Check the message authentication code */
 291
 292         if(digest_active(&n->indigest)) {
 293                 inpkt->len -= n->indigest.maclength;
 294                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 295                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 296                         return;
 297                 }
 298         }
 299         /* Decrypt the packet */
 300
 301         if(cipher_active(&n->incipher)) {
 302                 outpkt = pkt[nextpkt++];
 303                 outlen = MAXSIZE;
 304
 305                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 306                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 307                         return;
 308                 }
 309
 310                 outpkt->len = outlen;
 311                 inpkt = outpkt;
 312         }
 313
 314         /* Check the sequence number */
 315
 316         inpkt->len -= sizeof inpkt->seqno;
 317         inpkt->seqno = ntohl(inpkt->seqno);
 318
 319         if(replaywin) {
 320                 if(inpkt->seqno != n->received_seqno + 1) {
 321                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 322                                 if(n->farfuture++ < replaywin >> 2) {
 323                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 324                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 325                                         return;
 326                                 }
 327                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 328                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 329                                 memset(n->late, 0, replaywin);
 330                         } else if (inpkt->seqno <= n->received_seqno) {
 331                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 332                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 333                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 334                                         return;
 335                                 }
 336                         } else {
 337                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 338                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 339                         }
 340                 }
 341
 342                 n->farfuture = 0;
 343                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 344         }
 345
 346         if(inpkt->seqno > n->received_seqno)
 347                 n->received_seqno = inpkt->seqno;
 348
 349         if(n->received_seqno > MAX_SEQNO)
 350                 regenerate_key();
 351
 352         /* Decompress the packet */
 353
 354         length_t origlen = inpkt->len;
 355
 356         if(n->incompression) {
 357                 outpkt = pkt[nextpkt++];
 358
 359                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 360                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 361                                                  n->name, n->hostname);
 362                         return;
 363                 }
 364
 365                 inpkt = outpkt;
 366
 367                 origlen -= MTU/64 + 20;
 368         }
 369
 370         inpkt->priority = 0;
 371
 372         if(!inpkt->data[12] && !inpkt->data[13])
 373                 mtu_probe_h(n, inpkt, origlen);
 374         else
 375                 receive_packet(n, inpkt);
 376 }
 377
 378 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 379         vpn_packet_t outpkt;
 380
 381         outpkt.len = len;
 382         if(c->options & OPTION_TCPONLY)
 383                 outpkt.priority = 0;
 384         else
 385                 outpkt.priority = -1;
 386         memcpy(outpkt.data, buffer, len);
 387
 388         receive_packet(c->node, &outpkt);
 389 }
 390
 391 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 392         if(n->status.sptps) {
 393                 uint8_t type = 0;
 394                 int offset = 0;
 395
 396                 if(!(origpkt->data[12] | origpkt->data[13])) {
 397                         sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 398                         return;
 399                 }
 400
 401                 if(routing_mode == RMODE_ROUTER)
 402                         offset = 14;
 403                 else
 404                         type = PKT_MAC;
 405
 406                 if(origpkt->len < offset)
 407                         return;
 408
 409                 vpn_packet_t outpkt;
 410
 411                 if(n->outcompression) {
 412                         int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 413                         if(len < 0) {
 414                                 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 415                         } else if(len < origpkt->len - offset) {
 416                                 outpkt.len = len + offset;
 417                                 origpkt = &outpkt;
 418                                 type |= PKT_COMPRESSED;
 419                         }
 420                 }
 421
 422                 sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 423                 return;
 424         }
 425 }
 426
 427 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 428         vpn_packet_t pkt1, pkt2;
 429         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 430         vpn_packet_t *inpkt = origpkt;
 431         int nextpkt = 0;
 432         vpn_packet_t *outpkt;
 433         int origlen = origpkt->len;
 434         size_t outlen;
 435 #if defined(SOL_IP) && defined(IP_TOS)
 436         static int priority = 0;
 437 #endif
 438         int origpriority = origpkt->priority;
 439
 440         if(!n->status.reachable) {
 441                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 442                 return;
 443         }
 444
 445         if(n->status.sptps)
 446                 return send_sptps_packet(n, origpkt);
 447
 448         /* Make sure we have a valid key */
 449
 450         if(!n->status.validkey) {
 451                 time_t now = time(NULL);
 452
 453                 logger(DEBUG_TRAFFIC, LOG_INFO,
 454                                    "No valid key known yet for %s (%s), forwarding via TCP",
 455                                    n->name, n->hostname);
 456
 457                 if(n->last_req_key + 10 <= now) {
 458                         send_req_key(n);
 459                         n->last_req_key = now;
 460                 }
 461
 462                 send_tcppacket(n->nexthop->connection, origpkt);
 463
 464                 return;
 465         }
 466
 467         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 468                 logger(DEBUG_TRAFFIC, LOG_INFO,
 469                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 470                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 471
 472                 if(n != n->nexthop)
 473                         send_packet(n->nexthop, origpkt);
 474                 else
 475                         send_tcppacket(n->nexthop->connection, origpkt);
 476
 477                 return;
 478         }
 479
 480         /* Compress the packet */
 481
 482         if(n->outcompression) {
 483                 outpkt = pkt[nextpkt++];
 484
 485                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 486                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 487                                    n->name, n->hostname);
 488                         return;
 489                 }
 490
 491                 inpkt = outpkt;
 492         }
 493
 494         /* Add sequence number */
 495
 496         inpkt->seqno = htonl(++(n->sent_seqno));
 497         inpkt->len += sizeof inpkt->seqno;
 498
 499         /* Encrypt the packet */
 500
 501         if(cipher_active(&n->outcipher)) {
 502                 outpkt = pkt[nextpkt++];
 503                 outlen = MAXSIZE;
 504
 505                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 506                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 507                         goto end;
 508                 }
 509
 510                 outpkt->len = outlen;
 511                 inpkt = outpkt;
 512         }
 513
 514         /* Add the message authentication code */
 515
 516         if(digest_active(&n->outdigest)) {
 517                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 518                 inpkt->len += digest_length(&n->outdigest);
 519         }
 520
 521         /* Determine which socket we have to use */
 522
 523         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 524                 for(int sock = 0; sock < listen_sockets; sock++) {
 525                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 526                                 n->sock = sock;
 527                                 break;
 528                         }
 529                 }
 530         }
 531
 532         /* Send the packet */
 533
 534         struct sockaddr *sa;
 535         socklen_t sl;
 536         int sock;
 537
 538         /* Overloaded use of priority field: -1 means local broadcast */
 539
 540         if(origpriority == -1 && n->prevedge) {
 541                 struct sockaddr_in in;
 542                 in.sin_family = AF_INET;
 543                 in.sin_addr.s_addr = -1;
 544                 in.sin_port = n->prevedge->address.in.sin_port;
 545                 sa = (struct sockaddr *)&in;
 546                 sl = sizeof in;
 547                 sock = 0;
 548         } else {
 549                 if(origpriority == -1)
 550                         origpriority = 0;
 551
 552                 sa = &(n->address.sa);
 553                 sl = SALEN(n->address.sa);
 554                 sock = n->sock;
 555         }
 556
 557 #if defined(SOL_IP) && defined(IP_TOS)
 558         if(priorityinheritance && origpriority != priority
 559            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 560                 priority = origpriority;
 561                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 562                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 563                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 564         }
 565 #endif
 566
 567         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 568                 if(sockmsgsize(sockerrno)) {
 569                         if(n->maxmtu >= origlen)
 570                                 n->maxmtu = origlen - 1;
 571                         if(n->mtu >= origlen)
 572                                 n->mtu = origlen - 1;
 573                 } else
 574                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 575         }
 576
 577 end:
 578         origpkt->len = origlen;
 579 }
 580
 581 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 582         node_t *to = handle;
 583
 584         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY)) {
 585                 char buf[len * 4 / 3 + 5];
 586                 b64encode(data, buf, len);
 587                 if(!to->status.validkey)
 588                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 589                 else
 590                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 591         }
 592
 593         /* Send the packet */
 594
 595         struct sockaddr *sa;
 596         socklen_t sl;
 597         int sock;
 598
 599         sa = &(to->address.sa);
 600         sl = SALEN(to->address.sa);
 601         sock = to->sock;
 602
 603         if(sendto(listen_socket[sock].udp, data, len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 604                 if(sockmsgsize(sockerrno)) {
 605                         if(to->maxmtu >= len)
 606                                 to->maxmtu = len - 1;
 607                         if(to->mtu >= len)
 608                                 to->mtu = len - 1;
 609                 } else {
 610                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 611                         return false;
 612                 }
 613         }
 614
 615         return true;
 616 }
 617
 618 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 619         node_t *from = handle;
 620
 621         if(type == SPTPS_HANDSHAKE) {
 622                 from->status.validkey = true;
 623                 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 624                 return true;
 625         }
 626
 627         if(len > MTU) {
 628                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 629                 return false;
 630         }
 631
 632         vpn_packet_t inpkt;
 633
 634         if(type == PKT_PROBE) {
 635                 inpkt.len = len;
 636                 memcpy(inpkt.data, data, len);
 637                 mtu_probe_h(from, &inpkt, len);
 638                 return true;
 639         }
 640
 641         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 642                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 643                 return false;
 644         }
 645
 646         /* Check if we have the headers we need */
 647         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 648                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 649                 return false;
 650         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 651                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 652         }
 653
 654         int offset = (type & PKT_MAC) ? 0 : 14;
 655         if(type & PKT_COMPRESSED) {
 656                 len = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 657                 if(len < 0) {
 658                         return false;
 659                 } else {
 660                         inpkt.len = len + offset;
 661                 }
 662                 if(inpkt.len > MAXSIZE)
 663                         abort();
 664         } else {
 665                 memcpy(inpkt.data + offset, data, len);
 666                 inpkt.len = len + offset;
 667         }
 668
 669         /* Generate the Ethernet packet type if necessary */
 670         if(offset) {
 671                 switch(inpkt.data[14] >> 4) {
 672                         case 4:
 673                                 inpkt.data[12] = 0x08;
 674                                 inpkt.data[13] = 0x00;
 675                                 break;
 676                         case 6:
 677                                 inpkt.data[12] = 0x86;
 678                                 inpkt.data[13] = 0xDD;
 679                                 break;
 680                         default:
 681                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 682                                                    "Unknown IP version %d while reading packet from %s (%s)",
 683                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 684                                 return false;
 685                 }
 686         }
 687
 688         receive_packet(from, &inpkt);
 689         return true;
 690 }
 691
 692 /*
 693   send a packet to the given vpn ip.
 694 */
 695 void send_packet(node_t *n, vpn_packet_t *packet) {
 696         node_t *via;
 697
 698         if(n == myself) {
 699                 if(overwrite_mac)
 700                          memcpy(packet->data, mymac.x, ETH_ALEN);
 701                 n->out_packets++;
 702                 n->out_bytes += packet->len;
 703                 devops.write(packet);
 704                 return;
 705         }
 706
 707         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 708                            packet->len, n->name, n->hostname);
 709
 710         if(!n->status.reachable) {
 711                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 712                                    n->name, n->hostname);
 713                 return;
 714         }
 715
 716         n->out_packets++;
 717         n->out_bytes += packet->len;
 718
 719         if(n->status.sptps) {
 720                 send_sptps_packet(n, packet);
 721                 return;
 722         }
 723
 724         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 725
 726         if(via != n)
 727                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 728                            n->name, via->name, n->via->hostname);
 729
 730         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 731                 if(!send_tcppacket(via->connection, packet))
 732                         terminate_connection(via->connection, true);
 733         } else
 734                 send_udppacket(via, packet);
 735 }
 736
 737 /* Broadcast a packet using the minimum spanning tree */
 738
 739 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 740         splay_node_t *node;
 741         connection_t *c;
 742         node_t *n;
 743
 744         // Always give ourself a copy of the packet.
 745         if(from != myself)
 746                 send_packet(myself, packet);
 747
 748         // In TunnelServer mode, do not forward broadcast packets.
 749         // The MST might not be valid and create loops.
 750         if(tunnelserver || broadcast_mode == BMODE_NONE)
 751                 return;
 752
 753         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 754                            packet->len, from->name, from->hostname);
 755
 756         switch(broadcast_mode) {
 757                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 758                 // This guarantees all nodes receive the broadcast packet, and
 759                 // usually distributes the sending of broadcast packets over all nodes.
 760                 case BMODE_MST:
 761                         for(node = connection_tree->head; node; node = node->next) {
 762                                 c = node->data;
 763
 764                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 765                                         send_packet(c->node, packet);
 766                         }
 767                         break;
 768
 769                 // In direct mode, we send copies to each node we know of.
 770                 // However, this only reaches nodes that can be reached in a single hop.
 771                 // We don't have enough information to forward broadcast packets in this case.
 772                 case BMODE_DIRECT:
 773                         if(from != myself)
 774                                 break;
 775
 776                         for(node = node_tree->head; node; node = node->next) {
 777                                 n = node->data;
 778
 779                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 780                                         send_packet(n, packet);
 781                         }
 782                         break;
 783
 784                 default:
 785                         break;
 786         }
 787 }
 788
 789 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 790         splay_node_t *node;
 791         edge_t *e;
 792         node_t *n = NULL;
 793         bool hard = false;
 794         static time_t last_hard_try = 0;
 795         time_t now = time(NULL);
 796
 797         for(node = edge_weight_tree->head; node; node = node->next) {
 798                 e = node->data;
 799
 800                 if(!e->to->status.reachable || e->to == myself)
 801                         continue;
 802
 803                 if(sockaddrcmp_noport(from, &e->address)) {
 804                         if(last_hard_try == now)
 805                                 continue;
 806                         hard = true;
 807                 }
 808
 809                 if(!try_mac(e->to, pkt))
 810                         continue;
 811
 812                 n = e->to;
 813                 break;
 814         }
 815
 816         if(hard)
 817                 last_hard_try = now;
 818
 819         last_hard_try = now;
 820         return n;
 821 }
 822
 823 void handle_incoming_vpn_data(int sock, short events, void *data) {
 824         vpn_packet_t pkt;
 825         char *hostname;
 826         sockaddr_t from = {{0}};
 827         socklen_t fromlen = sizeof from;
 828         node_t *n;
 829         int len;
 830
 831         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 832
 833         if(len <= 0 || len > MAXSIZE) {
 834                 if(!sockwouldblock(sockerrno))
 835                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 836                 return;
 837         }
 838
 839         pkt.len = len;
 840
 841         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 842
 843         n = lookup_node_udp(&from);
 844
 845         if(!n) {
 846                 n = try_harder(&from, &pkt);
 847                 if(n)
 848                         update_node_udp(n, &from);
 849                 else if(debug_level >= DEBUG_PROTOCOL) {
 850                         hostname = sockaddr2hostname(&from);
 851                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 852                         free(hostname);
 853                         return;
 854                 }
 855                 else
 856                         return;
 857         }
 858
 859         n->sock = (intptr_t)data;
 860
 861         receive_udppacket(n, &pkt);
 862 }
 863
 864 void handle_device_data(int sock, short events, void *data) {
 865         vpn_packet_t packet;
 866
 867         packet.priority = 0;
 868
 869         if(devops.read(&packet)) {
 870                 myself->in_packets++;
 871                 myself->in_bytes += packet.len;
 872                 route(myself, &packet);
 873         }
 874 }