git.meshlink.io Git - meshlink/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 2014 Guus Sliepen <guus@meshlink.io>
   4
   5     This program is free software; you can redistribute it and/or modify
   6     it under the terms of the GNU General Public License as published by
   7     the Free Software Foundation; either version 2 of the License, or
   8     (at your option) any later version.
   9
  10     This program is distributed in the hope that it will be useful,
  11     but WITHOUT ANY WARRANTY; without even the implied warranty of
  12     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13     GNU General Public License for more details.
  14
  15     You should have received a copy of the GNU General Public License along
  16     with this program; if not, write to the Free Software Foundation, Inc.,
  17     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18 */
  19
  20 #include "system.h"
  21
  22 #ifdef HAVE_ZLIB
  23 #include <zlib.h>
  24 #endif
  25
  26 #include "conf.h"
  27 #include "connection.h"
  28 #include "crypto.h"
  29 #include "graph.h"
  30 #include "logger.h"
  31 #include "meshlink_internal.h"
  32 #include "net.h"
  33 #include "netutl.h"
  34 #include "protocol.h"
  35 #include "route.h"
  36 #include "utils.h"
  37 #include "xalloc.h"
  38
  39 int keylifetime = 0;
  40
  41 static void send_udppacket(meshlink_handle_t *mesh, node_t *, vpn_packet_t *);
  42
  43 #define MAX_SEQNO 1073741824
  44
  45 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  46    mtuprobes ==    31: sleep pinginterval seconds
  47    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  48    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  49
  50    Probes are sent in batches of at least three, with random sizes between the
  51    lower and upper boundaries for the MTU thus far discovered.
  52
  53    After the initial discovery, a fourth packet is added to each batch with a
  54    size larger than the currently known PMTU, to test if the PMTU has increased.
  55
  56    In case local discovery is enabled, another packet is added to each batch,
  57    which will be broadcast to the local network.
  58
  59 */
  60
  61 static void send_mtu_probe_handler(event_loop_t *loop, void *data) {
  62         meshlink_handle_t *mesh = loop->data;
  63         node_t *n = data;
  64         int timeout = 1;
  65
  66         n->mtuprobes++;
  67
  68         if(!n->status.reachable || !n->status.validkey) {
  69                 logger(mesh, MESHLINK_INFO, "Trying to send MTU probe to unreachable or rekeying node %s", n->name);
  70                 n->mtuprobes = 0;
  71                 return;
  72         }
  73
  74         if(n->mtuprobes > 32) {
  75                 if(!n->minmtu) {
  76                         n->mtuprobes = 31;
  77                         timeout = mesh->pinginterval;
  78                         goto end;
  79                 }
  80
  81                 logger(mesh, MESHLINK_INFO, "%s did not respond to UDP ping, restarting PMTU discovery", n->name);
  82                 n->status.udp_confirmed = false;
  83                 n->mtuprobes = 1;
  84                 n->minmtu = 0;
  85                 n->maxmtu = MTU;
  86         }
  87
  88         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
  89                 logger(mesh, MESHLINK_INFO, "No response to MTU probes from %s", n->name);
  90                 n->mtuprobes = 31;
  91         }
  92
  93         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
  94                 if(n->minmtu > n->maxmtu)
  95                         n->minmtu = n->maxmtu;
  96                 else
  97                         n->maxmtu = n->minmtu;
  98                 n->mtu = n->minmtu;
  99                 logger(mesh, MESHLINK_INFO, "Fixing MTU of %s to %d after %d probes", n->name, n->mtu, n->mtuprobes);
 100                 n->mtuprobes = 31;
 101         }
 102
 103         if(n->mtuprobes == 31) {
 104                 timeout = mesh->pinginterval;
 105                 goto end;
 106         } else if(n->mtuprobes == 32)
 107                 timeout = mesh->pingtimeout;
 108
 109         for(int i = 0; i < 4 + mesh->localdiscovery; i++) {
 110                 int len;
 111
 112                 if(i == 0) {
 113                         if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
 114                                 continue;
 115                         len = n->maxmtu + 8;
 116                 } else if(n->maxmtu <= n->minmtu)
 117                         len = n->maxmtu;
 118                 else
 119                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 120
 121                 if(len < 64)
 122                         len = 64;
 123
 124                 vpn_packet_t packet;
 125                 packet.probe = true;
 126                 memset(packet.data, 0, 14);
 127                 randomize(packet.data + 14, len - 14);
 128                 packet.len = len;
 129                 n->status.broadcast = i >= 4 && n->mtuprobes <= 10 && n->prevedge;
 130
 131                 logger(mesh, MESHLINK_DEBUG, "Sending MTU probe length %d to %s", len, n->name);
 132
 133                 send_udppacket(mesh, n, &packet);
 134         }
 135
 136         n->status.broadcast = false;
 137
 138 end:
 139         timeout_set(&mesh->loop, &n->mtutimeout, &(struct timeval) {
 140                 timeout, rand() % 100000
 141         });
 142 }
 143
 144 void send_mtu_probe(meshlink_handle_t *mesh, node_t *n) {
 145         timeout_add(&mesh->loop, &n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval) {
 146                 1, 0
 147         });
 148         send_mtu_probe_handler(&mesh->loop, n);
 149 }
 150
 151 static void mtu_probe_h(meshlink_handle_t *mesh, node_t *n, vpn_packet_t *packet, uint16_t len) {
 152         logger(mesh, MESHLINK_DEBUG, "Got MTU probe length %d from %s", packet->len, n->name);
 153
 154         if(!packet->data[0]) {
 155                 /* It's a probe request, send back a reply */
 156
 157                 packet->data[0] = 1;
 158
 159                 /* Temporarily set udp_confirmed, so that the reply is sent
 160                    back exactly the way it came in. */
 161
 162                 bool udp_confirmed = n->status.udp_confirmed;
 163                 n->status.udp_confirmed = true;
 164                 send_udppacket(mesh, n, packet);
 165                 n->status.udp_confirmed = udp_confirmed;
 166         } else {
 167                 /* It's a valid reply: now we know bidirectional communication
 168                    is possible using the address and socket that the reply
 169                    packet used. */
 170
 171                 n->status.udp_confirmed = true;
 172
 173                 /* If we haven't established the PMTU yet, restart the discovery process. */
 174
 175                 if(n->mtuprobes > 30) {
 176                         if(len == n->maxmtu + 8) {
 177                                 logger(mesh, MESHLINK_INFO, "Increase in PMTU to %s detected, restarting PMTU discovery", n->name);
 178                                 n->maxmtu = MTU;
 179                                 n->mtuprobes = 10;
 180                                 return;
 181                         }
 182
 183                         if(n->minmtu)
 184                                 n->mtuprobes = 30;
 185                         else
 186                                 n->mtuprobes = 1;
 187                 }
 188
 189                 /* If applicable, raise the minimum supported MTU */
 190
 191                 if(len > n->maxmtu)
 192                         len = n->maxmtu;
 193                 if(n->minmtu < len)
 194                         n->minmtu = len;
 195         }
 196 }
 197
 198 static uint16_t compress_packet(uint8_t *dest, const uint8_t *source, uint16_t len, int level) {
 199         abort();
 200 }
 201
 202 static uint16_t uncompress_packet(uint8_t *dest, const uint8_t *source, uint16_t len, int level) {
 203         abort();
 204 }
 205
 206 /* VPN packet I/O */
 207
 208 static void receive_packet(meshlink_handle_t *mesh, node_t *n, vpn_packet_t *packet) {
 209         logger(mesh, MESHLINK_DEBUG, "Received packet of %d bytes from %s", packet->len, n->name);
 210
 211         if(n->status.blacklisted)
 212                 logger(mesh, MESHLINK_WARNING, "Dropping packet from blacklisted node %s", n->name);
 213         else {
 214                 n->in_packets++;
 215                 n->in_bytes += packet->len;
 216
 217                 route(mesh, n, packet);
 218         }
 219 }
 220
 221 static bool try_mac(meshlink_handle_t *mesh, node_t *n, const vpn_packet_t *inpkt) {
 222         return sptps_verify_datagram(&n->sptps, inpkt->data, inpkt->len);
 223 }
 224
 225 static void receive_udppacket(meshlink_handle_t *mesh, node_t *n, vpn_packet_t *inpkt) {
 226         if(!n->sptps.state) {
 227                 if(!n->status.waitingforkey) {
 228                         logger(mesh, MESHLINK_DEBUG, "Got packet from %s but we haven't exchanged keys yet", n->name);
 229                         send_req_key(mesh, n);
 230                 } else
 231                         logger(mesh, MESHLINK_DEBUG, "Got packet from %s but he hasn't got our key yet", n->name);
 232                 return;
 233         }
 234         sptps_receive_data(&n->sptps, inpkt->data, inpkt->len);
 235 }
 236
 237 void receive_tcppacket(meshlink_handle_t *mesh, connection_t *c, const char *buffer, int len) {
 238         vpn_packet_t outpkt;
 239
 240         if(len > sizeof(outpkt).data)
 241                 return;
 242
 243         outpkt.len = len;
 244         outpkt.tcp = true;
 245         memcpy(outpkt.data, buffer, len);
 246
 247         receive_packet(mesh, c->node, &outpkt);
 248 }
 249
 250 static void send_sptps_packet(meshlink_handle_t *mesh, node_t *n, vpn_packet_t *origpkt) {
 251         if(!n->status.validkey) {
 252                 logger(mesh, MESHLINK_INFO, "No valid key known yet for %s", n->name);
 253                 if(!n->status.waitingforkey)
 254                         send_req_key(mesh, n);
 255                 else if(n->last_req_key + 10 < mesh->loop.now.tv_sec) {
 256                         logger(mesh, MESHLINK_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 257                         sptps_stop(&n->sptps);
 258                         n->status.waitingforkey = false;
 259                         send_req_key(mesh, n);
 260                 }
 261                 return;
 262         }
 263
 264         uint8_t type = 0;
 265
 266         // If it's a probe, send it immediately without trying to compress it.
 267         if(origpkt->probe) {
 268                 sptps_send_record(&n->sptps, PKT_PROBE, origpkt->data, origpkt->len);
 269                 return;
 270         }
 271
 272         vpn_packet_t outpkt;
 273
 274         if(n->outcompression) {
 275                 int len = compress_packet(outpkt.data, origpkt->data, origpkt->len, n->outcompression);
 276                 if(len < 0)
 277                         logger(mesh, MESHLINK_ERROR, "Error while compressing packet to %s", n->name);
 278                 else if(len < origpkt->len) {
 279                         outpkt.len = len;
 280                         origpkt = &outpkt;
 281                         type |= PKT_COMPRESSED;
 282                 }
 283         }
 284
 285         sptps_send_record(&n->sptps, type, origpkt->data, origpkt->len);
 286         return;
 287 }
 288
 289 static void choose_udp_address(meshlink_handle_t *mesh, const node_t *n, const sockaddr_t **sa, int *sock) {
 290         /* Latest guess */
 291         *sa = &n->address;
 292         *sock = n->sock;
 293
 294         /* If the UDP address is confirmed, use it. */
 295         if(n->status.udp_confirmed)
 296                 return;
 297
 298         /* Send every third packet to n->address; that could be set
 299            to the node's reflexive UDP address discovered during key
 300            exchange. */
 301
 302         static int x = 0;
 303         if(++x >= 3) {
 304                 x = 0;
 305                 return;
 306         }
 307
 308         /* Otherwise, address are found in edges to this node.
 309            So we pick a random edge and a random socket. */
 310
 311         int i = 0;
 312         int j = rand() % n->edge_tree->count;
 313         edge_t *candidate = NULL;
 314
 315         for splay_each(edge_t, e, n->edge_tree) {
 316                 if(i++ == j) {
 317                         candidate = e->reverse;
 318                         break;
 319                 }
 320         }
 321
 322         if(candidate) {
 323                 *sa = &candidate->address;
 324                 *sock = rand() % mesh->listen_sockets;
 325         }
 326
 327         /* Make sure we have a suitable socket for the chosen address */
 328         if(mesh->listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 329                 for(int i = 0; i < mesh->listen_sockets; i++) {
 330                         if(mesh->listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 331                                 *sock = i;
 332                                 break;
 333                         }
 334                 }
 335         }
 336 }
 337
 338 static void choose_broadcast_address(meshlink_handle_t *mesh, const node_t *n, const sockaddr_t **sa, int *sock) {
 339         static sockaddr_t broadcast_ipv4 = {
 340                 .in = {
 341                         .sin_family = AF_INET,
 342                         .sin_addr.s_addr = -1,
 343                 }
 344         };
 345
 346         static sockaddr_t broadcast_ipv6 = {
 347                 .in6 = {
 348                         .sin6_family = AF_INET6,
 349                         .sin6_addr.s6_addr[0x0] = 0xff,
 350                         .sin6_addr.s6_addr[0x1] = 0x02,
 351                         .sin6_addr.s6_addr[0xf] = 0x01,
 352                 }
 353         };
 354
 355         *sock = rand() % mesh->listen_sockets;
 356
 357         if(mesh->listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 358                 if(mesh->localdiscovery_address.sa.sa_family == AF_INET6) {
 359                         mesh->localdiscovery_address.in6.sin6_port = n->prevedge->address.in.sin_port;
 360                         *sa = &mesh->localdiscovery_address;
 361                 } else {
 362                         broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 363                         broadcast_ipv6.in6.sin6_scope_id = mesh->listen_socket[*sock].sa.in6.sin6_scope_id;
 364                         *sa = &broadcast_ipv6;
 365                 }
 366         } else {
 367                 if(mesh->localdiscovery_address.sa.sa_family == AF_INET) {
 368                         mesh->localdiscovery_address.in.sin_port = n->prevedge->address.in.sin_port;
 369                         *sa = &mesh->localdiscovery_address;
 370                 } else {
 371                         broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 372                         *sa = &broadcast_ipv4;
 373                 }
 374         }
 375 }
 376
 377 static void send_udppacket(meshlink_handle_t *mesh, node_t *n, vpn_packet_t *origpkt) {
 378         if(!n->status.reachable) {
 379                 logger(mesh, MESHLINK_INFO, "Trying to send UDP packet to unreachable node %s", n->name);
 380                 return;
 381         }
 382
 383         return send_sptps_packet(mesh, n, origpkt);
 384 }
 385
 386 bool send_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
 387         node_t *to = handle;
 388         meshlink_handle_t *mesh = to->mesh;
 389
 390         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 391
 392         if(type >= SPTPS_HANDSHAKE || ((mesh->self->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 393                 char buf[len * 4 / 3 + 5];
 394                 b64encode(data, buf, len);
 395                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 396                    to ensure we get to learn the reflexive UDP address. */
 397                 if(!to->status.validkey) {
 398                         to->incompression = mesh->self->incompression;
 399                         return send_request(mesh, to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, mesh->self->name, to->name, buf, to->incompression);
 400                 } else
 401                         return send_request(mesh, to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, mesh->self->name, to->name, REQ_SPTPS, buf);
 402         }
 403
 404         /* Otherwise, send the packet via UDP */
 405
 406         const sockaddr_t *sa;
 407         int sock;
 408
 409         if(to->status.broadcast)
 410                 choose_broadcast_address(mesh, to, &sa, &sock);
 411         else
 412                 choose_udp_address(mesh, to, &sa, &sock);
 413
 414         if(sendto(mesh->listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 415                 if(sockmsgsize(sockerrno)) {
 416                         if(to->maxmtu >= len)
 417                                 to->maxmtu = len - 1;
 418                         if(to->mtu >= len)
 419                                 to->mtu = len - 1;
 420                 } else {
 421                         logger(mesh, MESHLINK_WARNING, "Error sending UDP SPTPS packet to %s: %s", to->name, sockstrerror(sockerrno));
 422                         return false;
 423                 }
 424         }
 425
 426         return true;
 427 }
 428
 429 bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t len) {
 430         node_t *from = handle;
 431         meshlink_handle_t *mesh = from->mesh;
 432
 433         if(type == SPTPS_HANDSHAKE) {
 434                 if(!from->status.validkey) {
 435                         logger(mesh, MESHLINK_INFO, "SPTPS key exchange with %s succesful", from->name);
 436                         from->status.validkey = true;
 437                         from->status.waitingforkey = false;
 438                         if(from->utcp)
 439                                 utcp_reset_timers(from->utcp);
 440                 }
 441                 return true;
 442         }
 443
 444         if(len > MTU) {
 445                 logger(mesh, MESHLINK_ERROR, "Packet from %s larger than maximum supported size (%d > %d)", from->name, len, MTU);
 446                 return false;
 447         }
 448
 449         vpn_packet_t inpkt;
 450
 451         if(type == PKT_PROBE) {
 452                 inpkt.len = len;
 453                 inpkt.probe = true;
 454                 memcpy(inpkt.data, data, len);
 455                 mtu_probe_h(mesh, from, &inpkt, len);
 456                 return true;
 457         } else
 458                 inpkt.probe = false;
 459
 460         if(type & ~(PKT_COMPRESSED)) {
 461                 logger(mesh, MESHLINK_ERROR, "Unexpected SPTPS record type %d len %d from %s", type, len, from->name);
 462                 return false;
 463         }
 464
 465         if(type & PKT_COMPRESSED) {
 466                 uint16_t ulen = uncompress_packet(inpkt.data, (const uint8_t *)data, len, from->incompression);
 467                 if(ulen < 0)
 468                         return false;
 469                 else
 470                         inpkt.len = ulen;
 471                 if(inpkt.len > MAXSIZE)
 472                         abort();
 473         } else {
 474                 memcpy(inpkt.data, data, len);
 475                 inpkt.len = len;
 476         }
 477
 478         receive_packet(mesh, from, &inpkt);
 479         return true;
 480 }
 481
 482 /*
 483   send a packet to the given vpn ip.
 484 */
 485 void send_packet(meshlink_handle_t *mesh, node_t *n, vpn_packet_t *packet) {
 486         if(n == mesh->self) {
 487                 n->out_packets++;
 488                 n->out_bytes += packet->len;
 489                 // TODO: send to application
 490                 return;
 491         }
 492
 493         logger(mesh, MESHLINK_DEBUG, "Sending packet of %d bytes to %s", packet->len, n->name);
 494
 495         if(!n->status.reachable) {
 496                 logger(mesh, MESHLINK_WARNING, "Node %s is not reachable", n->name);
 497                 return;
 498         }
 499
 500         n->out_packets++;
 501         n->out_bytes += packet->len;
 502
 503         send_sptps_packet(mesh, n, packet);
 504         return;
 505 }
 506
 507 /* Broadcast a packet using the minimum spanning tree */
 508
 509 void broadcast_packet(meshlink_handle_t *mesh, const node_t *from, vpn_packet_t *packet) {
 510         // Always give ourself a copy of the packet.
 511         if(from != mesh->self)
 512                 send_packet(mesh, mesh->self, packet);
 513
 514         logger(mesh, MESHLINK_INFO, "Broadcasting packet of %d bytes from %s", packet->len, from->name);
 515
 516         for list_each(connection_t, c, mesh->connections)
 517                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 518                         send_packet(mesh, c->node, packet);
 519 }
 520
 521 static node_t *try_harder(meshlink_handle_t *mesh, const sockaddr_t *from, const vpn_packet_t *pkt) {
 522         node_t *n = NULL;
 523         bool hard = false;
 524         static time_t last_hard_try = 0;
 525
 526         for splay_each(edge_t, e, mesh->edges) {
 527                 if(!e->to->status.reachable || e->to == mesh->self)
 528                         continue;
 529
 530                 if(sockaddrcmp_noport(from, &e->address)) {
 531                         if(last_hard_try == mesh->loop.now.tv_sec)
 532                                 continue;
 533                         hard = true;
 534                 }
 535
 536                 if(!try_mac(mesh, e->to, pkt))
 537                         continue;
 538
 539                 n = e->to;
 540                 break;
 541         }
 542
 543         if(hard)
 544                 last_hard_try = mesh->loop.now.tv_sec;
 545
 546         last_hard_try = mesh->loop.now.tv_sec;
 547         return n;
 548 }
 549
 550 void handle_incoming_vpn_data(event_loop_t *loop, void *data, int flags) {
 551         meshlink_handle_t *mesh = loop->data;
 552         listen_socket_t *ls = data;
 553         vpn_packet_t pkt;
 554         char *hostname;
 555         sockaddr_t from = {{0}};
 556         socklen_t fromlen = sizeof(from);
 557         node_t *n;
 558         int len;
 559
 560         len = recvfrom(ls->udp.fd, pkt.data, MAXSIZE, 0, &from.sa, &fromlen);
 561
 562         if(len <= 0 || len > MAXSIZE) {
 563                 if(!sockwouldblock(sockerrno))
 564                         logger(mesh, MESHLINK_ERROR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 565                 return;
 566         }
 567
 568         pkt.len = len;
 569
 570         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 571
 572         n = lookup_node_udp(mesh, &from);
 573
 574         if(!n) {
 575                 n = try_harder(mesh, &from, &pkt);
 576                 if(n)
 577                         update_node_udp(mesh, n, &from);
 578                 else if(mesh->log_level >= MESHLINK_WARNING) {
 579                         hostname = sockaddr2hostname(&from);
 580                         logger(mesh, MESHLINK_WARNING, "Received UDP packet from unknown source %s", hostname);
 581                         free(hostname);
 582                         return;
 583                 } else
 584                         return;
 585         }
 586
 587         if(n->status.blacklisted) {
 588                 logger(mesh, MESHLINK_WARNING, "Dropping packet from blacklisted node %s", n->name);
 589                 return;
 590         }
 591         n->sock = ls - mesh->listen_socket;
 592
 593         receive_udppacket(mesh, n, &pkt);
 594 }