X-Git-Url: https://www.tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fnet_packet.c;h=31c66d3248126fb7a913a973ecf09873d538edd7;hb=refs%2Fheads%2F1.1;hp=ce2361cb08cbc4757cd72dd1e5226b2de0ac376f;hpb=0b2361a9399944cd57def87226f2be7f92646aa5;p=tinc diff --git a/src/net_packet.c b/src/net_packet.c index ce2361cb..0b95a939 100644 --- a/src/net_packet.c +++ b/src/net_packet.c @@ -1,7 +1,7 @@ /* net_packet.c -- Handles in- and outgoing VPN packets Copyright (C) 1998-2005 Ivo Timmermans, - 2000-2017 Guus Sliepen + 2000-2022 Guus Sliepen 2010 Timothy Redaelli 2010 Brandon Black @@ -23,34 +23,37 @@ #include "system.h" #ifdef HAVE_ZLIB +#define ZLIB_CONST #include + #endif #ifdef HAVE_LZO #include LZO1X_H #endif +#ifdef HAVE_LZ4 +#include +#endif + +#include "address_cache.h" #include "cipher.h" #include "conf.h" #include "connection.h" +#include "compression.h" #include "crypto.h" #include "digest.h" #include "device.h" #include "ethernet.h" #include "ipv4.h" #include "ipv6.h" -#include "graph.h" #include "logger.h" #include "net.h" #include "netutl.h" #include "protocol.h" #include "route.h" #include "utils.h" -#include "xalloc.h" - -#ifndef MAX -#define MAX(a, b) ((a) > (b) ? (a) : (b)) -#endif +#include "random.h" /* The minimum size of a probe is 14 bytes, but since we normally use CBC mode encryption, we can add a few extra random bytes without increasing the @@ -62,6 +65,16 @@ int keylifetime = 0; static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS]; #endif +#ifdef HAVE_LZ4 + +#ifdef HAVE_LZ4_BUILTIN +static LZ4_stream_t lz4_stream; +#else +static void *lz4_state = NULL; +#endif // HAVE_LZ4_BUILTIN + +#endif // HAVE_LZ4 + static void send_udppacket(node_t *, vpn_packet_t *); unsigned replaywin = 32; @@ -91,6 +104,22 @@ static void try_fix_mtu(node_t *n) { } } +static void reduce_mtu(node_t *n, int mtu) { + if(mtu < MINMTU) { + mtu = MINMTU; + } + + if(n->maxmtu > mtu) { + n->maxmtu = mtu; + } + + if(n->mtu > mtu) { + n->mtu = mtu; + } + + try_fix_mtu(n); +} + static void udp_probe_timeout_handler(void *data) { node_t *n = data; @@ -100,6 +129,7 @@ static void udp_probe_timeout_handler(void *data) { logger(DEBUG_TRAFFIC, LOG_INFO, "Too much time has elapsed since last UDP ping response from %s (%s), stopping UDP communication", n->name, n->hostname); n->status.udp_confirmed = false; + n->udp_ping_rtt = -1; n->maxrecentlen = 0; n->mtuprobes = 0; n->minmtu = 0; @@ -138,7 +168,8 @@ static void send_udp_probe_reply(node_t *n, vpn_packet_t *packet, length_t len) static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) { if(!DATA(packet)[0]) { logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request %d from %s (%s)", packet->len, n->name, n->hostname); - return send_udp_probe_reply(n, packet, len); + send_udp_probe_reply(n, packet, len); + return; } if(DATA(packet)[0] == 2) { @@ -148,15 +179,34 @@ static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) { len = ntohs(len16); } - logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], len, n->name, n->hostname); + if(n->status.ping_sent) { // a probe in flight + gettimeofday(&now, NULL); + struct timeval rtt; + timersub(&now, &n->udp_ping_sent, &rtt); + n->udp_ping_rtt = (int)(rtt.tv_sec * 1000000 + rtt.tv_usec); + n->status.ping_sent = false; + logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s) rtt=%d.%03d", DATA(packet)[0], len, n->name, n->hostname, n->udp_ping_rtt / 1000, n->udp_ping_rtt % 1000); + } else { + logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], len, n->name, n->hostname); + } /* It's a valid reply: now we know bidirectional communication is possible using the address and socket that the reply packet used. */ - n->status.udp_confirmed = true; + if(!n->status.udp_confirmed) { + n->status.udp_confirmed = true; + + if(!n->address_cache) { + n->address_cache = open_address_cache(n); + } + + if(n->connection && n->connection->edge) { + reset_address_cache(n->address_cache); + add_recent_address(n->address_cache, &n->connection->edge->address); + } + } // Reset the UDP ping timer. - n->udp_ping_sent = now; if(udp_discovery) { timeout_del(&n->udp_ping_timeout); @@ -186,69 +236,155 @@ static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) { } } -static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) { - if(level == 0) { - memcpy(dest, source, len); - return len; - } else if(level == 10) { +#ifdef HAVE_LZ4 +static length_t compress_packet_lz4(uint8_t *dest, const uint8_t *source, length_t len) { +#ifdef HAVE_LZ4_BUILTIN + return LZ4_compress_fast_extState(&lz4_stream, (const char *) source, (char *) dest, len, MAXSIZE, 0); +#else + + /* @FIXME: Put this in a better place, and free() it too. */ + if(lz4_state == NULL) { + lz4_state = malloc(LZ4_sizeofState()); + } + + if(lz4_state == NULL) { + logger(DEBUG_ALWAYS, LOG_ERR, "Failed to allocate lz4_state, error: %i", errno); + return 0; + } + + return LZ4_compress_fast_extState(lz4_state, (const char *) source, (char *) dest, len, MAXSIZE, 0); +#endif /* HAVE_LZ4_BUILTIN */ +} +#endif /* HAVE_LZ4 */ + #ifdef HAVE_LZO - lzo_uint lzolen = MAXSIZE; - lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem); +static length_t compress_packet_lzo(uint8_t *dest, const uint8_t *source, length_t len, compression_level_t level) { + lzo_uint lzolen = MAXSIZE; + int result; + + if(level == COMPRESS_LZO_HI) { + result = lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem); + } else { // level == COMPRESS_LZO_LO + result = lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem); + } + + if(result == LZO_E_OK) { return lzolen; -#else - return -1; + } else { + return 0; + } +} #endif - } else if(level < 10) { -#ifdef HAVE_ZLIB - unsigned long destlen = MAXSIZE; - if(compress2(dest, &destlen, source, len, level) == Z_OK) { - return destlen; - } else +static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, compression_level_t level) { + switch(level) { +#ifdef HAVE_LZ4 + + case COMPRESS_LZ4: + return compress_packet_lz4(dest, source, len); #endif - return -1; - } else { + #ifdef HAVE_LZO - lzo_uint lzolen = MAXSIZE; - lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem); - return lzolen; -#else - return -1; + + case COMPRESS_LZO_HI: + case COMPRESS_LZO_LO: + return compress_packet_lzo(dest, source, len, level); #endif +#ifdef HAVE_ZLIB + + case COMPRESS_ZLIB_9: + case COMPRESS_ZLIB_8: + case COMPRESS_ZLIB_7: + case COMPRESS_ZLIB_6: + case COMPRESS_ZLIB_5: + case COMPRESS_ZLIB_4: + case COMPRESS_ZLIB_3: + case COMPRESS_ZLIB_2: + case COMPRESS_ZLIB_1: { + unsigned long dest_len = MAXSIZE; + + if(compress2(dest, &dest_len, source, len, level) == Z_OK) { + return dest_len; + } else { + return 0; + } } - return -1; -} +#endif -static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) { - if(level == 0) { + case COMPRESS_NONE: memcpy(dest, source, len); return len; - } else if(level > 9) { -#ifdef HAVE_LZO - lzo_uint lzolen = MAXSIZE; - if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK) { - return lzolen; - } else + default: + return 0; + } +} + +static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, compression_level_t level) { + switch(level) { +#ifdef HAVE_LZ4 + + case COMPRESS_LZ4: + return LZ4_decompress_safe((char *)source, (char *) dest, len, MAXSIZE); + #endif - return -1; +#ifdef HAVE_LZO + + case COMPRESS_LZO_HI: + case COMPRESS_LZO_LO: { + lzo_uint dst_len = MAXSIZE; + + if(lzo1x_decompress_safe(source, len, dest, &dst_len, NULL) == LZO_E_OK) { + return dst_len; + } else { + return 0; + } } +#endif #ifdef HAVE_ZLIB - else { + + case COMPRESS_ZLIB_9: + case COMPRESS_ZLIB_8: + case COMPRESS_ZLIB_7: + case COMPRESS_ZLIB_6: + case COMPRESS_ZLIB_5: + case COMPRESS_ZLIB_4: + case COMPRESS_ZLIB_3: + case COMPRESS_ZLIB_2: + case COMPRESS_ZLIB_1: { unsigned long destlen = MAXSIZE; + static z_stream stream; + + if(stream.next_in) { + inflateReset(&stream); + } else { + inflateInit(&stream); + } + + stream.next_in = source; + stream.avail_in = len; + stream.next_out = dest; + stream.avail_out = destlen; + stream.total_out = 0; - if(uncompress(dest, &destlen, source, len) == Z_OK) { - return destlen; + if(inflate(&stream, Z_FINISH) == Z_STREAM_END) { + return stream.total_out; } else { - return -1; + return 0; } } #endif - return -1; + case COMPRESS_NONE: + memcpy(dest, source, len); + return len; + + default: + return 0; + } } /* VPN packet I/O */ @@ -272,7 +408,7 @@ static bool try_mac(node_t *n, const vpn_packet_t *inpkt) { return false; #else - if(!n->status.validkey_in || !digest_active(n->indigest) || inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) { + if(!n->status.validkey_in || !digest_active(n->indigest) || (size_t)inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) { return false; } @@ -281,13 +417,6 @@ static bool try_mac(node_t *n, const vpn_packet_t *inpkt) { } static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { - vpn_packet_t pkt1, pkt2; - vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 }; - int nextpkt = 0; - size_t outlen; - pkt1.offset = DEFAULT_PACKET_OFFSET; - pkt2.offset = DEFAULT_PACKET_OFFSET; - if(n->status.sptps) { if(!n->sptps.state) { if(!n->status.waitingforkey) { @@ -323,6 +452,12 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { #ifdef DISABLE_LEGACY return false; #else + vpn_packet_t pkt1, pkt2; + vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 }; + int nextpkt = 0; + size_t outlen; + pkt1.offset = DEFAULT_PACKET_OFFSET; + pkt2.offset = DEFAULT_PACKET_OFFSET; if(!n->status.validkey_in) { logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname); @@ -331,7 +466,7 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { /* Check packet length */ - if(inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) { + if((size_t)inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) { logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)", n->name, n->hostname); return false; @@ -393,7 +528,7 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { return false; } } else { - for(int i = n->received_seqno + 1; i < seqno; i++) { + for(seqno_t i = n->received_seqno + 1; i < seqno; i++) { n->late[(i / 8) % replaywin] |= 1 << i % 8; } } @@ -417,10 +552,10 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { length_t origlen = inpkt->len; - if(n->incompression) { + if(n->incompression != COMPRESS_NONE) { vpn_packet_t *outpkt = pkt[nextpkt++]; - if((outpkt->len = uncompress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->incompression)) < 0) { + if(!(outpkt->len = uncompress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->incompression))) { logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)", n->name, n->hostname); return false; @@ -428,7 +563,11 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { inpkt = outpkt; - origlen -= MTU / 64 + 20; + if(origlen > MTU / 64 + 20) { + origlen -= MTU / 64 + 20; + } else { + origlen = 0; + } } if(inpkt->len > n->maxrecentlen) { @@ -447,7 +586,7 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) { #endif } -void receive_tcppacket(connection_t *c, const char *buffer, int len) { +void receive_tcppacket(connection_t *c, const char *buffer, size_t len) { vpn_packet_t outpkt; outpkt.offset = DEFAULT_PACKET_OFFSET; @@ -468,7 +607,7 @@ void receive_tcppacket(connection_t *c, const char *buffer, int len) { receive_packet(c->node, &outpkt); } -bool receive_tcppacket_sptps(connection_t *c, const char *data, int len) { +bool receive_tcppacket_sptps(connection_t *c, const char *data, size_t len) { if(len < sizeof(node_id_t) + sizeof(node_id_t)) { logger(DEBUG_PROTOCOL, LOG_ERR, "Got too short TCP SPTPS packet from %s (%s)", c->name, c->hostname); return false; @@ -509,7 +648,10 @@ bool receive_tcppacket_sptps(connection_t *c, const char *data, int len) { /* If we're not the final recipient, relay the packet. */ if(to != myself) { - send_sptps_data(to, from, 0, data, len); + if(to->status.validkey) { + send_sptps_data(to, from, 0, data, len); + } + try_tx(to, true); return true; } @@ -541,7 +683,7 @@ static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) { int offset = 0; if((!(DATA(origpkt)[12] | DATA(origpkt)[13])) && (n->sptps.outstate)) { - sptps_send_record(&n->sptps, PKT_PROBE, (char *)DATA(origpkt), origpkt->len); + sptps_send_record(&n->sptps, PKT_PROBE, DATA(origpkt), origpkt->len); return; } @@ -557,11 +699,11 @@ static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) { vpn_packet_t outpkt; - if(n->outcompression) { + if(n->outcompression != COMPRESS_NONE) { outpkt.offset = 0; - int len = compress_packet(DATA(&outpkt) + offset, DATA(origpkt) + offset, origpkt->len - offset, n->outcompression); + length_t len = compress_packet(DATA(&outpkt) + offset, DATA(origpkt) + offset, origpkt->len - offset, n->outcompression); - if(len < 0) { + if(!len) { logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname); } else if(len < origpkt->len - offset) { outpkt.len = len + offset; @@ -579,11 +721,9 @@ static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) { } else { sptps_send_record(&n->sptps, type, DATA(origpkt) + offset, origpkt->len - offset); } - - return; } -static void adapt_socket(const sockaddr_t *sa, int *sock) { +static void adapt_socket(const sockaddr_t *sa, size_t *sock) { /* Make sure we have a suitable socket for the chosen address */ if(listen_socket[*sock].sa.sa.sa_family != sa->sa.sa_family) { for(int i = 0; i < listen_sockets; i++) { @@ -595,7 +735,7 @@ static void adapt_socket(const sockaddr_t *sa, int *sock) { } } -static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) { +static void choose_udp_address(const node_t *n, const sockaddr_t **sa, size_t *sock) { /* Latest guess */ *sa = &n->address; *sock = n->sock; @@ -619,11 +759,11 @@ static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock /* Otherwise, address are found in edges to this node. So we pick a random edge and a random socket. */ - int i = 0; - int j = rand() % n->edge_tree->count; + unsigned int i = 0; + unsigned int j = prng(n->edge_tree.count); edge_t *candidate = NULL; - for splay_each(edge_t, e, n->edge_tree) { + for splay_each(edge_t, e, &n->edge_tree) { if(i++ == j) { candidate = e->reverse; break; @@ -632,22 +772,22 @@ static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock if(candidate) { *sa = &candidate->address; - *sock = rand() % listen_sockets; + *sock = prng(listen_sockets); } adapt_socket(*sa, sock); } -static void choose_local_address(const node_t *n, const sockaddr_t **sa, int *sock) { +static void choose_local_address(const node_t *n, const sockaddr_t **sa, size_t *sock) { *sa = NULL; /* Pick one of the edges from this node at random, then use its local address. */ - int i = 0; - int j = rand() % n->edge_tree->count; + unsigned int i = 0; + unsigned int j = prng(n->edge_tree.count); edge_t *candidate = NULL; - for splay_each(edge_t, e, n->edge_tree) { + for splay_each(edge_t, e, &n->edge_tree) { if(i++ == j) { candidate = e; break; @@ -656,12 +796,25 @@ static void choose_local_address(const node_t *n, const sockaddr_t **sa, int *so if(candidate && candidate->local_address.sa.sa_family) { *sa = &candidate->local_address; - *sock = rand() % listen_sockets; + *sock = prng(listen_sockets); adapt_socket(*sa, sock); } } static void send_udppacket(node_t *n, vpn_packet_t *origpkt) { + if(!n->status.reachable) { + logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname); + return; + } + + if(n->status.sptps) { + send_sptps_packet(n, origpkt); + return; + } + +#ifdef DISABLE_LEGACY + return; +#else vpn_packet_t pkt1, pkt2; vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 }; vpn_packet_t *inpkt = origpkt; @@ -674,18 +827,6 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) { pkt1.offset = DEFAULT_PACKET_OFFSET; pkt2.offset = DEFAULT_PACKET_OFFSET; - if(!n->status.reachable) { - logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname); - return; - } - - if(n->status.sptps) { - return send_sptps_packet(n, origpkt); - } - -#ifdef DISABLE_LEGACY - return; -#else /* Make sure we have a valid key */ if(!n->status.validkey) { @@ -712,10 +853,10 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) { /* Compress the packet */ - if(n->outcompression) { + if(n->outcompression != COMPRESS_NONE) { outpkt = pkt[nextpkt++]; - if((outpkt->len = compress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->outcompression)) < 0) { + if(!(outpkt->len = compress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->outcompression))) { logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname); return; @@ -759,7 +900,7 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) { /* Send the packet */ const sockaddr_t *sa = NULL; - int sock; + size_t sock; if(n->status.send_locally) { choose_local_address(n, &sa, &sock); @@ -803,15 +944,7 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) { if(sendto(listen_socket[sock].udp.fd, (void *)SEQNO(inpkt), inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) { if(sockmsgsize(sockerrno)) { - if(n->maxmtu >= origlen) { - n->maxmtu = origlen - 1; - } - - if(n->mtu >= origlen) { - n->mtu = origlen - 1; - } - - try_fix_mtu(n); + reduce_mtu(n, origlen - 1); } else { logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno)); } @@ -823,28 +956,30 @@ end: } bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_t len) { - node_t *relay = (to->via != myself && (type == PKT_PROBE || (len - SPTPS_DATAGRAM_OVERHEAD) <= to->via->minmtu)) ? to->via : to->nexthop; + size_t origlen = len - SPTPS_DATAGRAM_OVERHEAD; + node_t *relay = (to->via != myself && (type == PKT_PROBE || origlen <= to->via->minmtu)) ? to->via : to->nexthop; bool direct = from == myself && to == relay; bool relay_supported = (relay->options >> 24) >= 4; bool tcponly = (myself->options | relay->options) & OPTION_TCPONLY; /* Send it via TCP if it is a handshake packet, TCPOnly is in use, this is a relay packet that the other node cannot understand, or this packet is larger than the MTU. */ - if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && (len - SPTPS_DATAGRAM_OVERHEAD) > relay->minmtu)) { + if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && origlen > relay->minmtu)) { if(type != SPTPS_HANDSHAKE && (to->nexthop->connection->options >> 24) >= 7) { - char buf[len + sizeof(to->id) + sizeof(from->id)]; - char *buf_ptr = buf; + const size_t buflen = len + sizeof(to->id) + sizeof(from->id); + uint8_t *buf = alloca(buflen); + uint8_t *buf_ptr = buf; memcpy(buf_ptr, &to->id, sizeof(to->id)); buf_ptr += sizeof(to->id); memcpy(buf_ptr, &from->id, sizeof(from->id)); buf_ptr += sizeof(from->id); memcpy(buf_ptr, data, len); logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s) (TCP)", from->name, from->hostname, to->name, to->hostname, to->nexthop->name, to->nexthop->hostname); - return send_sptps_tcppacket(to->nexthop->connection, buf, sizeof(buf)); + return send_sptps_tcppacket(to->nexthop->connection, buf, buflen); } - char buf[len * 4 / 3 + 5]; - b64encode(data, buf, len); + char *buf = alloca(B64_SIZE(len)); + b64encode_tinc(data, buf, len); /* If this is a handshake packet, use ANS_KEY instead of REQ_KEY, for two reasons: - We don't want intermediate nodes to switch to UDP to relay these packets; @@ -863,13 +998,13 @@ bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_ overhead += sizeof(to->id) + sizeof(from->id); } - char buf[len + overhead]; + char *buf = alloca(len + overhead); char *buf_ptr = buf; if(relay_supported) { if(direct) { /* Inform the recipient that this packet was sent directly. */ - node_id_t nullid = {}; + node_id_t nullid = {0}; memcpy(buf_ptr, &nullid, sizeof(nullid)); buf_ptr += sizeof(nullid); } else { @@ -887,7 +1022,7 @@ bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_ buf_ptr += len; const sockaddr_t *sa = NULL; - int sock; + size_t sock; if(relay->status.send_locally) { choose_local_address(relay, &sa, &sock); @@ -901,18 +1036,7 @@ bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_ if(sendto(listen_socket[sock].udp.fd, buf, buf_ptr - buf, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) { if(sockmsgsize(sockerrno)) { - // Compensate for SPTPS overhead - len -= SPTPS_DATAGRAM_OVERHEAD; - - if(relay->maxmtu >= len) { - relay->maxmtu = len - 1; - } - - if(relay->mtu >= len) { - relay->mtu = len - 1; - } - - try_fix_mtu(relay); + reduce_mtu(relay, (int)origlen - 1); } else { logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", relay->name, relay->hostname, sockstrerror(sockerrno)); return false; @@ -929,7 +1053,7 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t if(!from->status.validkey) { from->status.validkey = true; from->status.waitingforkey = false; - logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname); + logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) successful", from->name, from->hostname); } return true; @@ -979,7 +1103,7 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t if(type & PKT_COMPRESSED) { length_t ulen = uncompress_packet(DATA(&inpkt) + offset, (const uint8_t *)data, len, from->incompression); - if(ulen < 0) { + if(!ulen) { return false; } else { inpkt.len = ulen + offset; @@ -1043,15 +1167,22 @@ static void try_sptps(node_t *n) { return; } -static void send_udp_probe_packet(node_t *n, int len) { +static void send_udp_probe_packet(node_t *n, size_t len) { vpn_packet_t packet; + + if(len > sizeof(packet.data)) { + logger(DEBUG_TRAFFIC, LOG_INFO, "Truncating probe length %lu to %s (%s)", (unsigned long)len, n->name, n->hostname); + len = sizeof(packet.data); + } + + len = MAX(len, MIN_PROBE_SIZE); packet.offset = DEFAULT_PACKET_OFFSET; memset(DATA(&packet), 0, 14); randomize(DATA(&packet) + 14, len - 14); packet.len = len; packet.priority = 0; - logger(DEBUG_TRAFFIC, LOG_INFO, "Sending UDP probe length %d to %s (%s)", len, n->name, n->hostname); + logger(DEBUG_TRAFFIC, LOG_INFO, "Sending UDP probe length %lu to %s (%s)", (unsigned long)len, n->name, n->hostname); send_udppacket(n, &packet); } @@ -1090,11 +1221,15 @@ static void try_udp(node_t *n) { struct timeval ping_tx_elapsed; timersub(&now, &n->udp_ping_sent, &ping_tx_elapsed); - int interval = n->status.udp_confirmed ? udp_discovery_keepalive_interval : udp_discovery_interval; + int interval = n->status.udp_confirmed + ? udp_discovery_keepalive_interval + : udp_discovery_interval; if(ping_tx_elapsed.tv_sec >= interval) { + gettimeofday(&now, NULL); + n->udp_ping_sent = now; // a probe in flight + n->status.ping_sent = true; send_udp_probe_packet(n, MIN_PROBE_SIZE); - n->udp_ping_sent = now; if(localdiscovery && !n->status.udp_confirmed && n->prevedge) { n->status.send_locally = true; @@ -1110,7 +1245,7 @@ static length_t choose_initial_maxmtu(node_t *n) { int sock = -1; const sockaddr_t *sa = NULL; - int sockindex; + size_t sockindex; choose_udp_address(n, &sa, &sockindex); if(!sa) { @@ -1126,20 +1261,25 @@ static length_t choose_initial_maxmtu(node_t *n) { if(connect(sock, &sa->sa, SALEN(sa->sa))) { logger(DEBUG_TRAFFIC, LOG_ERR, "Connecting MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno)); - close(sock); + closesocket(sock); return MTU; } int ip_mtu; socklen_t ip_mtu_len = sizeof(ip_mtu); - if(getsockopt(sock, IPPROTO_IP, IP_MTU, &ip_mtu, &ip_mtu_len)) { + if(getsockopt(sock, IPPROTO_IP, IP_MTU, (void *)&ip_mtu, &ip_mtu_len)) { logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno)); - close(sock); + closesocket(sock); return MTU; } - close(sock); + closesocket(sock); + + if(ip_mtu < MINMTU) { + logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) returned absurdly small value: %d", n->name, n->hostname, ip_mtu); + return MTU; + } /* getsockopt(IP_MTU) returns the MTU of the physical interface. We need to remove various overheads to get to the tinc MTU. */ @@ -1177,11 +1317,6 @@ static length_t choose_initial_maxmtu(node_t *n) { #endif } - if(mtu < 512) { - logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) returned absurdly small value: %d", n->name, n->hostname, ip_mtu); - return MTU; - } - if(mtu > MTU) { return MTU; } @@ -1190,9 +1325,8 @@ static length_t choose_initial_maxmtu(node_t *n) { return mtu; #else - + (void)n; return MTU; - #endif } @@ -1280,20 +1414,25 @@ static void try_mtu(node_t *n) { This fine-tuning is only valid for maxmtu = MTU; if maxmtu is smaller, then it's better to use a multiplier of 1. Indeed, this leads to an interesting scenario if choose_initial_maxmtu() returns the actual MTU value - it will get confirmed with one single probe. */ - const float multiplier = (n->maxmtu == MTU) ? 0.97 : 1; - - const float cycle_position = probes_per_cycle - (n->mtuprobes % probes_per_cycle) - 1; - const length_t minmtu = MAX(n->minmtu, 512); - const float interval = n->maxmtu - minmtu; - - /* The core of the discovery algorithm is this exponential. - It produces very large probes early in the cycle, and then it very quickly decreases the probe size. - This reflects the fact that in the most difficult cases, we don't get any feedback for probes that - are too large, and therefore we need to concentrate on small offsets so that we can quickly converge - on the precise MTU as we are approaching it. - The last probe of the cycle is always 1 byte in size - this is to make sure we'll get at least one - reply per cycle so that we can make progress. */ - const length_t offset = powf(interval, multiplier * cycle_position / (probes_per_cycle - 1)); + const float multiplier = (n->maxmtu == MTU) ? 0.97f : 1.0f; + + const float cycle_position = (float) probes_per_cycle - (float)(n->mtuprobes % probes_per_cycle) - 1.0f; + const length_t minmtu = MAX(n->minmtu, MINMTU); + const float interval = (float)(n->maxmtu - minmtu); + + length_t offset = 0; + + /* powf can be underflowed if n->maxmtu is less than 512 due to the minmtu MAX bound */ + if(interval > 0) { + /* The core of the discovery algorithm is this exponential. + It produces very large probes early in the cycle, and then it very quickly decreases the probe size. + This reflects the fact that in the most difficult cases, we don't get any feedback for probes that + are too large, and therefore we need to concentrate on small offsets so that we can quickly converge + on the precise MTU as we are approaching it. + The last probe of the cycle is always 1 byte in size - this is to make sure we'll get at least one + reply per cycle so that we can make progress. */ + offset = lrintf(powf(interval, multiplier * cycle_position / (float)(probes_per_cycle - 1))); + } length_t maxmtu = n->maxmtu; send_udp_probe_packet(n, minmtu + offset); @@ -1347,7 +1486,8 @@ static void try_tx_sptps(node_t *n, bool mtu) { return; } - return try_tx(via, mtu); + try_tx(via, mtu); + return; } /* Otherwise, try to establish UDP connectivity. */ @@ -1484,7 +1624,7 @@ void broadcast_packet(const node_t *from, vpn_packet_t *packet) { // This guarantees all nodes receive the broadcast packet, and // usually distributes the sending of broadcast packets over all nodes. case BMODE_MST: - for list_each(connection_t, c, connection_list) + for list_each(connection_t, c, &connection_list) if(c->edge && c->status.mst && c != from->nexthop->connection) { send_packet(c->node, packet); } @@ -1499,13 +1639,14 @@ void broadcast_packet(const node_t *from, vpn_packet_t *packet) { break; } - for splay_each(node_t, n, node_tree) + for splay_each(node_t, n, &node_tree) if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n)) { send_packet(n, packet); } break; + case BMODE_NONE: default: break; } @@ -1522,7 +1663,7 @@ static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) { bool hard = false; static time_t last_hard_try = 0; - for splay_each(node_t, n, node_tree) { + for splay_each(node_t, n, &node_tree) { if(!n->status.reachable || n == myself) { continue; } @@ -1533,7 +1674,7 @@ static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) { bool soft = false; - for splay_each(edge_t, e, n->edge_tree) { + for splay_each(edge_t, e, &n->edge_tree) { if(!e->reverse) { continue; } @@ -1569,7 +1710,7 @@ static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) { static void handle_incoming_vpn_packet(listen_socket_t *ls, vpn_packet_t *pkt, sockaddr_t *addr) { char *hostname; - node_id_t nullid = {}; + node_id_t nullid = {0}; node_t *from, *to; bool direct = false; @@ -1588,7 +1729,7 @@ static void handle_incoming_vpn_packet(listen_socket_t *ls, vpn_packet_t *pkt, s pkt->offset = 2 * sizeof(node_id_t); from = lookup_node_id(SRCID(pkt)); - if(from && !memcmp(DSTID(pkt), &nullid, sizeof(nullid)) && from->status.sptps) { + if(from && from->status.sptps && !memcmp(DSTID(pkt), &nullid, sizeof(nullid))) { if(sptps_verify_datagram(&from->sptps, DATA(pkt), pkt->len - 2 * sizeof(node_id_t))) { n = from; } else { @@ -1624,7 +1765,7 @@ skip_harder: pkt->len -= pkt->offset; } - if(!memcmp(DSTID(pkt), &nullid, sizeof(nullid)) || !relay_enabled) { + if(!relay_enabled || !memcmp(DSTID(pkt), &nullid, sizeof(nullid))) { direct = true; from = n; to = myself; @@ -1686,11 +1827,13 @@ skip_harder: } void handle_incoming_vpn_data(void *data, int flags) { + (void)data; + (void)flags; listen_socket_t *ls = data; #ifdef HAVE_RECVMMSG #define MAX_MSG 64 - static int num = MAX_MSG; + static ssize_t num = MAX_MSG; static vpn_packet_t pkt[MAX_MSG]; static sockaddr_t addr[MAX_MSG]; static struct mmsghdr msg[MAX_MSG]; @@ -1701,14 +1844,14 @@ void handle_incoming_vpn_data(void *data, int flags) { iov[i] = (struct iovec) { .iov_base = DATA(&pkt[i]), - .iov_len = MAXSIZE, + .iov_len = MAXSIZE, }; msg[i].msg_hdr = (struct msghdr) { .msg_name = &addr[i].sa, - .msg_namelen = sizeof(addr)[i], - .msg_iov = &iov[i], - .msg_iovlen = 1, + .msg_namelen = sizeof(addr)[i], + .msg_iov = &iov[i], + .msg_iovlen = 1, }; } @@ -1734,13 +1877,13 @@ void handle_incoming_vpn_data(void *data, int flags) { #else vpn_packet_t pkt; - sockaddr_t addr = {}; + sockaddr_t addr = {0}; socklen_t addrlen = sizeof(addr); pkt.offset = 0; - int len = recvfrom(ls->udp.fd, (void *)DATA(&pkt), MAXSIZE, 0, &addr.sa, &addrlen); + ssize_t len = recvfrom(ls->udp.fd, (void *)DATA(&pkt), MAXSIZE, 0, &addr.sa, &addrlen); - if(len <= 0 || len > MAXSIZE) { + if(len <= 0 || (size_t)len > MAXSIZE) { if(!sockwouldblock(sockerrno)) { logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno)); } @@ -1755,6 +1898,8 @@ void handle_incoming_vpn_data(void *data, int flags) { } void handle_device_data(void *data, int flags) { + (void)data; + (void)flags; vpn_packet_t packet; packet.offset = DEFAULT_PACKET_OFFSET; packet.priority = 0; @@ -1766,7 +1911,7 @@ void handle_device_data(void *data, int flags) { myself->in_bytes += packet.len; route(myself, &packet); } else { - usleep(errors * 50000); + sleep_millis(errors * 50); errors++; if(errors > 10) {