git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "splay_tree.h"
  40 #include "cipher.h"
  41 #include "conf.h"
  42 #include "connection.h"
  43 #include "crypto.h"
  44 #include "digest.h"
  45 #include "device.h"
  46 #include "ethernet.h"
  47 #include "graph.h"
  48 #include "logger.h"
  49 #include "net.h"
  50 #include "netutl.h"
  51 #include "protocol.h"
  52 #include "process.h"
  53 #include "route.h"
  54 #include "utils.h"
  55 #include "xalloc.h"
  56
  57 int keylifetime = 0;
  58 #ifdef HAVE_LZO
  59 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  60 #endif
  61
  62 static void send_udppacket(node_t *, vpn_packet_t *);
  63
  64 unsigned replaywin = 16;
  65 bool localdiscovery = false;
  66
  67 #define MAX_SEQNO 1073741824
  68
  69 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  70    mtuprobes ==    31: sleep pinginterval seconds
  71    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  72    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  73
  74    Probes are sent in batches of three, with random sizes between the lower and
  75    upper boundaries for the MTU thus far discovered.
  76
  77    In case local discovery is enabled, a fourth packet is added to each batch,
  78    which will be broadcast to the local network.
  79 */
  80
  81 static void send_mtu_probe_handler(int fd, short events, void *data) {
  82         node_t *n = data;
  83         vpn_packet_t packet;
  84         int len, i;
  85         int timeout = 1;
  86
  87         n->mtuprobes++;
  88
  89         if(!n->status.reachable || !n->status.validkey) {
  90                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  91                 n->mtuprobes = 0;
  92                 return;
  93         }
  94
  95         if(n->mtuprobes > 32) {
  96                 if(!n->minmtu) {
  97                         n->mtuprobes = 31;
  98                         timeout = pinginterval;
  99                         goto end;
 100                 }
 101
 102                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 103                 n->mtuprobes = 1;
 104                 n->minmtu = 0;
 105                 n->maxmtu = MTU;
 106         }
 107
 108         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 109                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 110                 n->mtuprobes = 31;
 111         }
 112
 113         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 114                 if(n->minmtu > n->maxmtu)
 115                         n->minmtu = n->maxmtu;
 116                 else
 117                         n->maxmtu = n->minmtu;
 118                 n->mtu = n->minmtu;
 119                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 120                 n->mtuprobes = 31;
 121         }
 122
 123         if(n->mtuprobes == 31) {
 124                 timeout = pinginterval;
 125                 goto end;
 126         } else if(n->mtuprobes == 32) {
 127                 timeout = pingtimeout;
 128         }
 129
 130         for(i = 0; i < 3 + localdiscovery; i++) {
 131                 if(n->maxmtu <= n->minmtu)
 132                         len = n->maxmtu;
 133                 else
 134                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 135
 136                 if(len < 64)
 137                         len = 64;
 138
 139                 memset(packet.data, 0, 14);
 140                 randomize(packet.data + 14, len - 14);
 141                 packet.len = len;
 142                 if(i >= 3 && n->mtuprobes <= 10)
 143                         packet.priority = -1;
 144                 else
 145                         packet.priority = 0;
 146
 147                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 148
 149                 send_udppacket(n, &packet);
 150         }
 151
 152 end:
 153         event_add(&n->mtuevent, &(struct timeval){timeout, 0});
 154 }
 155
 156 void send_mtu_probe(node_t *n) {
 157         if(!timeout_initialized(&n->mtuevent))
 158                 timeout_set(&n->mtuevent, send_mtu_probe_handler, n);
 159         send_mtu_probe_handler(0, 0, n);
 160 }
 161
 162 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 163         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 164
 165         if(!packet->data[0]) {
 166                 packet->data[0] = 1;
 167                 send_udppacket(n, packet);
 168         } else {
 169                 if(n->mtuprobes > 30) {
 170                         if(n->minmtu)
 171                                 n->mtuprobes = 30;
 172                         else
 173                                 n->mtuprobes = 1;
 174                 }
 175
 176                 if(len > n->maxmtu)
 177                         len = n->maxmtu;
 178                 if(n->minmtu < len)
 179                         n->minmtu = len;
 180         }
 181 }
 182
 183 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 184         if(level == 0) {
 185                 memcpy(dest, source, len);
 186                 return len;
 187         } else if(level == 10) {
 188 #ifdef HAVE_LZO
 189                 lzo_uint lzolen = MAXSIZE;
 190                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 191                 return lzolen;
 192 #else
 193                 return -1;
 194 #endif
 195         } else if(level < 10) {
 196 #ifdef HAVE_ZLIB
 197                 unsigned long destlen = MAXSIZE;
 198                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 199                         return destlen;
 200                 else
 201 #endif
 202                         return -1;
 203         } else {
 204 #ifdef HAVE_LZO
 205                 lzo_uint lzolen = MAXSIZE;
 206                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 207                 return lzolen;
 208 #else
 209                 return -1;
 210 #endif
 211         }
 212
 213         return -1;
 214 }
 215
 216 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 217         if(level == 0) {
 218                 memcpy(dest, source, len);
 219                 return len;
 220         } else if(level > 9) {
 221 #ifdef HAVE_LZO
 222                 lzo_uint lzolen = MAXSIZE;
 223                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 224                         return lzolen;
 225                 else
 226 #endif
 227                         return -1;
 228         }
 229 #ifdef HAVE_ZLIB
 230         else {
 231                 unsigned long destlen = MAXSIZE;
 232                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 233                         return destlen;
 234                 else
 235                         return -1;
 236         }
 237 #endif
 238
 239         return -1;
 240 }
 241
 242 /* VPN packet I/O */
 243
 244 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 245         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 246                            packet->len, n->name, n->hostname);
 247
 248         n->in_packets++;
 249         n->in_bytes += packet->len;
 250
 251         route(n, packet);
 252 }
 253
 254 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 255         if(n->status.sptps)
 256                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 257
 258         if(!digest_active(&n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest))
 259                 return false;
 260
 261         return digest_verify(&n->indigest, &inpkt->seqno, inpkt->len - n->indigest.maclength, (const char *)&inpkt->seqno + inpkt->len - n->indigest.maclength);
 262 }
 263
 264 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 265         vpn_packet_t pkt1, pkt2;
 266         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 267         int nextpkt = 0;
 268         vpn_packet_t *outpkt = pkt[0];
 269         size_t outlen;
 270
 271         if(n->status.sptps) {
 272                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 273                 return;
 274         }
 275
 276         if(!cipher_active(&n->incipher)) {
 277                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 278                                         n->name, n->hostname);
 279                 return;
 280         }
 281
 282         /* Check packet length */
 283
 284         if(inpkt->len < sizeof inpkt->seqno + digest_length(&n->indigest)) {
 285                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 286                                         n->name, n->hostname);
 287                 return;
 288         }
 289
 290         /* Check the message authentication code */
 291
 292         if(digest_active(&n->indigest)) {
 293                 inpkt->len -= n->indigest.maclength;
 294                 if(!digest_verify(&n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 295                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 296                         return;
 297                 }
 298         }
 299         /* Decrypt the packet */
 300
 301         if(cipher_active(&n->incipher)) {
 302                 outpkt = pkt[nextpkt++];
 303                 outlen = MAXSIZE;
 304
 305                 if(!cipher_decrypt(&n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 306                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 307                         return;
 308                 }
 309
 310                 outpkt->len = outlen;
 311                 inpkt = outpkt;
 312         }
 313
 314         /* Check the sequence number */
 315
 316         inpkt->len -= sizeof inpkt->seqno;
 317         inpkt->seqno = ntohl(inpkt->seqno);
 318
 319         if(replaywin) {
 320                 if(inpkt->seqno != n->received_seqno + 1) {
 321                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 322                                 if(n->farfuture++ < replaywin >> 2) {
 323                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 324                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 325                                         return;
 326                                 }
 327                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 328                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 329                                 memset(n->late, 0, replaywin);
 330                         } else if (inpkt->seqno <= n->received_seqno) {
 331                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 332                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 333                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 334                                         return;
 335                                 }
 336                         } else {
 337                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 338                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 339                         }
 340                 }
 341
 342                 n->farfuture = 0;
 343                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 344         }
 345
 346         if(inpkt->seqno > n->received_seqno)
 347                 n->received_seqno = inpkt->seqno;
 348
 349         if(n->received_seqno > MAX_SEQNO)
 350                 regenerate_key();
 351
 352         /* Decompress the packet */
 353
 354         length_t origlen = inpkt->len;
 355
 356         if(n->incompression) {
 357                 outpkt = pkt[nextpkt++];
 358
 359                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 360                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 361                                                  n->name, n->hostname);
 362                         return;
 363                 }
 364
 365                 inpkt = outpkt;
 366
 367                 origlen -= MTU/64 + 20;
 368         }
 369
 370         inpkt->priority = 0;
 371
 372         if(!inpkt->data[12] && !inpkt->data[13])
 373                 mtu_probe_h(n, inpkt, origlen);
 374         else
 375                 receive_packet(n, inpkt);
 376 }
 377
 378 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 379         vpn_packet_t outpkt;
 380
 381         outpkt.len = len;
 382         if(c->options & OPTION_TCPONLY)
 383                 outpkt.priority = 0;
 384         else
 385                 outpkt.priority = -1;
 386         memcpy(outpkt.data, buffer, len);
 387
 388         receive_packet(c->node, &outpkt);
 389 }
 390
 391 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 392         if(!n->status.validkey) {
 393                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 394                 if(!n->status.waitingforkey)
 395                         send_req_key(n);
 396                 else if(n->last_req_key + 10 < time(NULL)) {
 397                         sptps_stop(&n->sptps);
 398                         n->status.waitingforkey = false;
 399                         send_req_key(n);
 400                 }
 401         }
 402
 403         uint8_t type = 0;
 404         int offset = 0;
 405
 406         if(!(origpkt->data[12] | origpkt->data[13])) {
 407                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 408                 return;
 409         }
 410
 411         if(routing_mode == RMODE_ROUTER)
 412                 offset = 14;
 413         else
 414                 type = PKT_MAC;
 415
 416         if(origpkt->len < offset)
 417                 return;
 418
 419         vpn_packet_t outpkt;
 420
 421         if(n->outcompression) {
 422                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 423                 if(len < 0) {
 424                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 425                 } else if(len < origpkt->len - offset) {
 426                         outpkt.len = len + offset;
 427                         origpkt = &outpkt;
 428                         type |= PKT_COMPRESSED;
 429                 }
 430         }
 431
 432         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 433         return;
 434 }
 435
 436 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 437         vpn_packet_t pkt1, pkt2;
 438         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 439         vpn_packet_t *inpkt = origpkt;
 440         int nextpkt = 0;
 441         vpn_packet_t *outpkt;
 442         int origlen = origpkt->len;
 443         size_t outlen;
 444 #if defined(SOL_IP) && defined(IP_TOS)
 445         static int priority = 0;
 446 #endif
 447         int origpriority = origpkt->priority;
 448
 449         if(!n->status.reachable) {
 450                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 451                 return;
 452         }
 453
 454         if(n->status.sptps)
 455                 return send_sptps_packet(n, origpkt);
 456
 457         /* Make sure we have a valid key */
 458
 459         if(!n->status.validkey) {
 460                 time_t now = time(NULL);
 461
 462                 logger(DEBUG_TRAFFIC, LOG_INFO,
 463                                    "No valid key known yet for %s (%s), forwarding via TCP",
 464                                    n->name, n->hostname);
 465
 466                 if(n->last_req_key + 10 <= now) {
 467                         send_req_key(n);
 468                         n->last_req_key = now;
 469                 }
 470
 471                 send_tcppacket(n->nexthop->connection, origpkt);
 472
 473                 return;
 474         }
 475
 476         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 477                 logger(DEBUG_TRAFFIC, LOG_INFO,
 478                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 479                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 480
 481                 if(n != n->nexthop)
 482                         send_packet(n->nexthop, origpkt);
 483                 else
 484                         send_tcppacket(n->nexthop->connection, origpkt);
 485
 486                 return;
 487         }
 488
 489         /* Compress the packet */
 490
 491         if(n->outcompression) {
 492                 outpkt = pkt[nextpkt++];
 493
 494                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 495                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 496                                    n->name, n->hostname);
 497                         return;
 498                 }
 499
 500                 inpkt = outpkt;
 501         }
 502
 503         /* Add sequence number */
 504
 505         inpkt->seqno = htonl(++(n->sent_seqno));
 506         inpkt->len += sizeof inpkt->seqno;
 507
 508         /* Encrypt the packet */
 509
 510         if(cipher_active(&n->outcipher)) {
 511                 outpkt = pkt[nextpkt++];
 512                 outlen = MAXSIZE;
 513
 514                 if(!cipher_encrypt(&n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 515                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 516                         goto end;
 517                 }
 518
 519                 outpkt->len = outlen;
 520                 inpkt = outpkt;
 521         }
 522
 523         /* Add the message authentication code */
 524
 525         if(digest_active(&n->outdigest)) {
 526                 digest_create(&n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 527                 inpkt->len += digest_length(&n->outdigest);
 528         }
 529
 530         /* Determine which socket we have to use */
 531
 532         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 533                 for(int sock = 0; sock < listen_sockets; sock++) {
 534                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 535                                 n->sock = sock;
 536                                 break;
 537                         }
 538                 }
 539         }
 540
 541         /* Send the packet */
 542
 543         struct sockaddr *sa;
 544         socklen_t sl;
 545         int sock;
 546
 547         /* Overloaded use of priority field: -1 means local broadcast */
 548
 549         if(origpriority == -1 && n->prevedge) {
 550                 struct sockaddr_in in;
 551                 in.sin_family = AF_INET;
 552                 in.sin_addr.s_addr = -1;
 553                 in.sin_port = n->prevedge->address.in.sin_port;
 554                 sa = (struct sockaddr *)&in;
 555                 sl = sizeof in;
 556                 sock = 0;
 557         } else {
 558                 if(origpriority == -1)
 559                         origpriority = 0;
 560
 561                 sa = &(n->address.sa);
 562                 sl = SALEN(n->address.sa);
 563                 sock = n->sock;
 564         }
 565
 566 #if defined(SOL_IP) && defined(IP_TOS)
 567         if(priorityinheritance && origpriority != priority
 568            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 569                 priority = origpriority;
 570                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 571                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 572                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 573         }
 574 #endif
 575
 576         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 577                 if(sockmsgsize(sockerrno)) {
 578                         if(n->maxmtu >= origlen)
 579                                 n->maxmtu = origlen - 1;
 580                         if(n->mtu >= origlen)
 581                                 n->mtu = origlen - 1;
 582                 } else
 583                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 584         }
 585
 586 end:
 587         origpkt->len = origlen;
 588 }
 589
 590 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 591         node_t *to = handle;
 592
 593         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY)) {
 594                 char buf[len * 4 / 3 + 5];
 595                 b64encode(data, buf, len);
 596                 if(!to->status.validkey)
 597                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 598                 else
 599                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 600         }
 601
 602         /* Send the packet */
 603
 604         struct sockaddr *sa;
 605         socklen_t sl;
 606         int sock;
 607
 608         sa = &(to->address.sa);
 609         sl = SALEN(to->address.sa);
 610         sock = to->sock;
 611
 612         if(sendto(listen_socket[sock].udp, data, len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 613                 if(sockmsgsize(sockerrno)) {
 614                         if(to->maxmtu >= len)
 615                                 to->maxmtu = len - 1;
 616                         if(to->mtu >= len)
 617                                 to->mtu = len - 1;
 618                 } else {
 619                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 620                         return false;
 621                 }
 622         }
 623
 624         return true;
 625 }
 626
 627 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 628         node_t *from = handle;
 629
 630         if(type == SPTPS_HANDSHAKE) {
 631                 from->status.validkey = true;
 632                 from->status.waitingforkey = false;
 633                 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 634                 return true;
 635         }
 636
 637         if(len > MTU) {
 638                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 639                 return false;
 640         }
 641
 642         vpn_packet_t inpkt;
 643
 644         if(type == PKT_PROBE) {
 645                 inpkt.len = len;
 646                 memcpy(inpkt.data, data, len);
 647                 mtu_probe_h(from, &inpkt, len);
 648                 return true;
 649         }
 650
 651         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 652                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 653                 return false;
 654         }
 655
 656         /* Check if we have the headers we need */
 657         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 658                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 659                 return false;
 660         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 661                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 662         }
 663
 664         int offset = (type & PKT_MAC) ? 0 : 14;
 665         if(type & PKT_COMPRESSED) {
 666                 len = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 667                 if(len < 0) {
 668                         return false;
 669                 } else {
 670                         inpkt.len = len + offset;
 671                 }
 672                 if(inpkt.len > MAXSIZE)
 673                         abort();
 674         } else {
 675                 memcpy(inpkt.data + offset, data, len);
 676                 inpkt.len = len + offset;
 677         }
 678
 679         /* Generate the Ethernet packet type if necessary */
 680         if(offset) {
 681                 switch(inpkt.data[14] >> 4) {
 682                         case 4:
 683                                 inpkt.data[12] = 0x08;
 684                                 inpkt.data[13] = 0x00;
 685                                 break;
 686                         case 6:
 687                                 inpkt.data[12] = 0x86;
 688                                 inpkt.data[13] = 0xDD;
 689                                 break;
 690                         default:
 691                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 692                                                    "Unknown IP version %d while reading packet from %s (%s)",
 693                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 694                                 return false;
 695                 }
 696         }
 697
 698         receive_packet(from, &inpkt);
 699         return true;
 700 }
 701
 702 /*
 703   send a packet to the given vpn ip.
 704 */
 705 void send_packet(node_t *n, vpn_packet_t *packet) {
 706         node_t *via;
 707
 708         if(n == myself) {
 709                 if(overwrite_mac)
 710                          memcpy(packet->data, mymac.x, ETH_ALEN);
 711                 n->out_packets++;
 712                 n->out_bytes += packet->len;
 713                 devops.write(packet);
 714                 return;
 715         }
 716
 717         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 718                            packet->len, n->name, n->hostname);
 719
 720         if(!n->status.reachable) {
 721                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 722                                    n->name, n->hostname);
 723                 return;
 724         }
 725
 726         n->out_packets++;
 727         n->out_bytes += packet->len;
 728
 729         if(n->status.sptps) {
 730                 send_sptps_packet(n, packet);
 731                 return;
 732         }
 733
 734         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 735
 736         if(via != n)
 737                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 738                            n->name, via->name, n->via->hostname);
 739
 740         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 741                 if(!send_tcppacket(via->connection, packet))
 742                         terminate_connection(via->connection, true);
 743         } else
 744                 send_udppacket(via, packet);
 745 }
 746
 747 /* Broadcast a packet using the minimum spanning tree */
 748
 749 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 750         splay_node_t *node;
 751         connection_t *c;
 752         node_t *n;
 753
 754         // Always give ourself a copy of the packet.
 755         if(from != myself)
 756                 send_packet(myself, packet);
 757
 758         // In TunnelServer mode, do not forward broadcast packets.
 759         // The MST might not be valid and create loops.
 760         if(tunnelserver || broadcast_mode == BMODE_NONE)
 761                 return;
 762
 763         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 764                            packet->len, from->name, from->hostname);
 765
 766         switch(broadcast_mode) {
 767                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 768                 // This guarantees all nodes receive the broadcast packet, and
 769                 // usually distributes the sending of broadcast packets over all nodes.
 770                 case BMODE_MST:
 771                         for(node = connection_tree->head; node; node = node->next) {
 772                                 c = node->data;
 773
 774                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 775                                         send_packet(c->node, packet);
 776                         }
 777                         break;
 778
 779                 // In direct mode, we send copies to each node we know of.
 780                 // However, this only reaches nodes that can be reached in a single hop.
 781                 // We don't have enough information to forward broadcast packets in this case.
 782                 case BMODE_DIRECT:
 783                         if(from != myself)
 784                                 break;
 785
 786                         for(node = node_tree->head; node; node = node->next) {
 787                                 n = node->data;
 788
 789                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 790                                         send_packet(n, packet);
 791                         }
 792                         break;
 793
 794                 default:
 795                         break;
 796         }
 797 }
 798
 799 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 800         splay_node_t *node;
 801         edge_t *e;
 802         node_t *n = NULL;
 803         bool hard = false;
 804         static time_t last_hard_try = 0;
 805         time_t now = time(NULL);
 806
 807         for(node = edge_weight_tree->head; node; node = node->next) {
 808                 e = node->data;
 809
 810                 if(!e->to->status.reachable || e->to == myself)
 811                         continue;
 812
 813                 if(sockaddrcmp_noport(from, &e->address)) {
 814                         if(last_hard_try == now)
 815                                 continue;
 816                         hard = true;
 817                 }
 818
 819                 if(!try_mac(e->to, pkt))
 820                         continue;
 821
 822                 n = e->to;
 823                 break;
 824         }
 825
 826         if(hard)
 827                 last_hard_try = now;
 828
 829         last_hard_try = now;
 830         return n;
 831 }
 832
 833 void handle_incoming_vpn_data(int sock, short events, void *data) {
 834         vpn_packet_t pkt;
 835         char *hostname;
 836         sockaddr_t from = {{0}};
 837         socklen_t fromlen = sizeof from;
 838         node_t *n;
 839         int len;
 840
 841         len = recvfrom(sock, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 842
 843         if(len <= 0 || len > MAXSIZE) {
 844                 if(!sockwouldblock(sockerrno))
 845                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 846                 return;
 847         }
 848
 849         pkt.len = len;
 850
 851         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 852
 853         n = lookup_node_udp(&from);
 854
 855         if(!n) {
 856                 n = try_harder(&from, &pkt);
 857                 if(n)
 858                         update_node_udp(n, &from);
 859                 else if(debug_level >= DEBUG_PROTOCOL) {
 860                         hostname = sockaddr2hostname(&from);
 861                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 862                         free(hostname);
 863                         return;
 864                 }
 865                 else
 866                         return;
 867         }
 868
 869         n->sock = (intptr_t)data;
 870
 871         receive_udppacket(n, &pkt);
 872 }
 873
 874 void handle_device_data(int sock, short events, void *data) {
 875         vpn_packet_t packet;
 876
 877         packet.priority = 0;
 878
 879         if(devops.read(&packet)) {
 880                 myself->in_packets++;
 881                 myself->in_bytes += packet.len;
 882                 route(myself, &packet);
 883         }
 884 }