www.tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2012 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #include <openssl/rand.h>
  26 #include <openssl/err.h>
  27 #include <openssl/evp.h>
  28 #include <openssl/pem.h>
  29 #include <openssl/hmac.h>
  30
  31 #ifdef HAVE_ZLIB
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef HAVE_LZO
  36 #include LZO1X_H
  37 #endif
  38
  39 #include "avl_tree.h"
  40 #include "conf.h"
  41 #include "connection.h"
  42 #include "device.h"
  43 #include "ethernet.h"
  44 #include "event.h"
  45 #include "graph.h"
  46 #include "logger.h"
  47 #include "net.h"
  48 #include "netutl.h"
  49 #include "protocol.h"
  50 #include "process.h"
  51 #include "route.h"
  52 #include "utils.h"
  53 #include "xalloc.h"
  54
  55 int keylifetime = 0;
  56 int keyexpires = 0;
  57 #ifdef HAVE_LZO
  58 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  59 #endif
  60
  61 static void send_udppacket(node_t *, vpn_packet_t *);
  62
  63 unsigned replaywin = 16;
  64 bool localdiscovery = false;
  65
  66 #define MAX_SEQNO 1073741824
  67
  68 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  69    mtuprobes ==    31: sleep pinginterval seconds
  70    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  71    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  72
  73    Probes are sent in batches of three, with random sizes between the lower and
  74    upper boundaries for the MTU thus far discovered.
  75
  76    In case local discovery is enabled, a fourth packet is added to each batch,
  77    which will be broadcast to the local network.
  78 */
  79
  80 void send_mtu_probe(node_t *n) {
  81         vpn_packet_t packet;
  82         int len, i;
  83         int timeout = 1;
  84
  85         n->mtuprobes++;
  86         n->mtuevent = NULL;
  87
  88         if(!n->status.reachable || !n->status.validkey) {
  89                 ifdebug(TRAFFIC) logger(LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  90                 n->mtuprobes = 0;
  91                 return;
  92         }
  93
  94         if(n->mtuprobes > 32) {
  95                 if(!n->minmtu) {
  96                         n->mtuprobes = 31;
  97                         timeout = pinginterval;
  98                         goto end;
  99                 }
 100
 101                 ifdebug(TRAFFIC) logger(LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
 102                 n->mtuprobes = 1;
 103                 n->minmtu = 0;
 104                 n->maxmtu = MTU;
 105         }
 106
 107         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 108                 ifdebug(TRAFFIC) logger(LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 109                 n->mtuprobes = 31;
 110         }
 111
 112         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 113                 if(n->minmtu > n->maxmtu)
 114                         n->minmtu = n->maxmtu;
 115                 else
 116                         n->maxmtu = n->minmtu;
 117                 n->mtu = n->minmtu;
 118                 ifdebug(TRAFFIC) logger(LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 119                 n->mtuprobes = 31;
 120         }
 121
 122         if(n->mtuprobes == 31) {
 123                 timeout = pinginterval;
 124                 goto end;
 125         } else if(n->mtuprobes == 32) {
 126                 timeout = pingtimeout;
 127         }
 128
 129         for(i = 0; i < 3 + localdiscovery; i++) {
 130                 if(n->maxmtu <= n->minmtu)
 131                         len = n->maxmtu;
 132                 else
 133                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 134
 135                 if(len < 64)
 136                         len = 64;
 137
 138                 memset(packet.data, 0, 14);
 139                 RAND_pseudo_bytes(packet.data + 14, len - 14);
 140                 packet.len = len;
 141                 if(i >= 3 && n->mtuprobes <= 10)
 142                         packet.priority = -1;
 143                 else
 144                         packet.priority = 0;
 145
 146                 ifdebug(TRAFFIC) logger(LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 147
 148                 send_udppacket(n, &packet);
 149         }
 150
 151 end:
 152         n->mtuevent = new_event();
 153         n->mtuevent->handler = (event_handler_t)send_mtu_probe;
 154         n->mtuevent->data = n;
 155         n->mtuevent->time = now + timeout;
 156         event_add(n->mtuevent);
 157 }
 158
 159 void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 160         ifdebug(TRAFFIC) logger(LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 161
 162         if(!packet->data[0]) {
 163                 packet->data[0] = 1;
 164                 send_udppacket(n, packet);
 165         } else {
 166                 if(n->mtuprobes > 30) {
 167                         if(n->minmtu)
 168                                 n->mtuprobes = 30;
 169                         else
 170                                 n->mtuprobes = 1;
 171                 }
 172
 173                 if(len > n->maxmtu)
 174                         len = n->maxmtu;
 175                 if(n->minmtu < len)
 176                         n->minmtu = len;
 177         }
 178 }
 179
 180 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 181         if(level == 0) {
 182                 memcpy(dest, source, len);
 183                 return len;
 184         } else if(level == 10) {
 185 #ifdef HAVE_LZO
 186                 lzo_uint lzolen = MAXSIZE;
 187                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 188                 return lzolen;
 189 #else
 190                 return -1;
 191 #endif
 192         } else if(level < 10) {
 193 #ifdef HAVE_ZLIB
 194                 unsigned long destlen = MAXSIZE;
 195                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 196                         return destlen;
 197                 else
 198 #endif
 199                         return -1;
 200         } else {
 201 #ifdef HAVE_LZO
 202                 lzo_uint lzolen = MAXSIZE;
 203                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 204                 return lzolen;
 205 #else
 206                 return -1;
 207 #endif
 208         }
 209
 210         return -1;
 211 }
 212
 213 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 214         if(level == 0) {
 215                 memcpy(dest, source, len);
 216                 return len;
 217         } else if(level > 9) {
 218 #ifdef HAVE_LZO
 219                 lzo_uint lzolen = MAXSIZE;
 220                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 221                         return lzolen;
 222                 else
 223 #endif
 224                         return -1;
 225         }
 226 #ifdef HAVE_ZLIB
 227         else {
 228                 unsigned long destlen = MAXSIZE;
 229                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 230                         return destlen;
 231                 else
 232                         return -1;
 233         }
 234 #endif
 235
 236         return -1;
 237 }
 238
 239 /* VPN packet I/O */
 240
 241 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 242         ifdebug(TRAFFIC) logger(LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 243                            packet->len, n->name, n->hostname);
 244
 245         route(n, packet);
 246 }
 247
 248 static bool try_mac(const node_t *n, const vpn_packet_t *inpkt) {
 249         unsigned char hmac[EVP_MAX_MD_SIZE];
 250
 251         if(!n->indigest || !n->inmaclength || !n->inkey || inpkt->len < sizeof inpkt->seqno + n->inmaclength)
 252                 return false;
 253
 254         HMAC(n->indigest, n->inkey, n->inkeylength, (unsigned char *) &inpkt->seqno, inpkt->len - n->inmaclength, (unsigned char *)hmac, NULL);
 255
 256         return !memcmp(hmac, (char *) &inpkt->seqno + inpkt->len - n->inmaclength, n->inmaclength);
 257 }
 258
 259 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 260         vpn_packet_t pkt1, pkt2;
 261         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 262         int nextpkt = 0;
 263         vpn_packet_t *outpkt = pkt[0];
 264         int outlen, outpad;
 265         unsigned char hmac[EVP_MAX_MD_SIZE];
 266         int i;
 267
 268         if(!n->inkey) {
 269                 ifdebug(TRAFFIC) logger(LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 270                                         n->name, n->hostname);
 271                 return;
 272         }
 273
 274         /* Check packet length */
 275
 276         if(inpkt->len < sizeof(inpkt->seqno) + n->inmaclength) {
 277                 ifdebug(TRAFFIC) logger(LOG_DEBUG, "Got too short packet from %s (%s)",
 278                                         n->name, n->hostname);
 279                 return;
 280         }
 281
 282         /* Check the message authentication code */
 283
 284         if(n->indigest && n->inmaclength) {
 285                 inpkt->len -= n->inmaclength;
 286                 HMAC(n->indigest, n->inkey, n->inkeylength,
 287                          (unsigned char *) &inpkt->seqno, inpkt->len, (unsigned char *)hmac, NULL);
 288
 289                 if(memcmp(hmac, (char *) &inpkt->seqno + inpkt->len, n->inmaclength)) {
 290                         ifdebug(TRAFFIC) logger(LOG_DEBUG, "Got unauthenticated packet from %s (%s)",
 291                                            n->name, n->hostname);
 292                         return;
 293                 }
 294         }
 295
 296         /* Decrypt the packet */
 297
 298         if(n->incipher) {
 299                 outpkt = pkt[nextpkt++];
 300
 301                 if(!EVP_DecryptInit_ex(&n->inctx, NULL, NULL, NULL, NULL)
 302                                 || !EVP_DecryptUpdate(&n->inctx, (unsigned char *) &outpkt->seqno, &outlen,
 303                                         (unsigned char *) &inpkt->seqno, inpkt->len)
 304                                 || !EVP_DecryptFinal_ex(&n->inctx, (unsigned char *) &outpkt->seqno + outlen, &outpad)) {
 305                         ifdebug(TRAFFIC) logger(LOG_DEBUG, "Error decrypting packet from %s (%s): %s",
 306                                                 n->name, n->hostname, ERR_error_string(ERR_get_error(), NULL));
 307                         return;
 308                 }
 309
 310                 outpkt->len = outlen + outpad;
 311                 inpkt = outpkt;
 312         }
 313
 314         /* Check the sequence number */
 315
 316         inpkt->len -= sizeof(inpkt->seqno);
 317         inpkt->seqno = ntohl(inpkt->seqno);
 318
 319         if(replaywin) {
 320                 if(inpkt->seqno != n->received_seqno + 1) {
 321                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 322                                 if(n->farfuture++ < replaywin >> 2) {
 323                                         logger(LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 324                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 325                                         return;
 326                                 }
 327                                 logger(LOG_WARNING, "Lost %d packets from %s (%s)",
 328                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 329                                 memset(n->late, 0, replaywin);
 330                         } else if (inpkt->seqno <= n->received_seqno) {
 331                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 332                                         logger(LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 333                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 334                                         return;
 335                                 }
 336                         } else {
 337                                 for(i = n->received_seqno + 1; i < inpkt->seqno; i++)
 338                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 339                         }
 340                 }
 341
 342                 n->farfuture = 0;
 343                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 344         }
 345
 346         if(inpkt->seqno > n->received_seqno)
 347                 n->received_seqno = inpkt->seqno;
 348
 349         if(n->received_seqno > MAX_SEQNO)
 350                 keyexpires = 0;
 351
 352         /* Decompress the packet */
 353
 354         length_t origlen = inpkt->len;
 355
 356         if(n->incompression) {
 357                 outpkt = pkt[nextpkt++];
 358
 359                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 360                         ifdebug(TRAFFIC) logger(LOG_ERR, "Error while uncompressing packet from %s (%s)",
 361                                                  n->name, n->hostname);
 362                         return;
 363                 }
 364
 365                 inpkt = outpkt;
 366
 367                 origlen -= MTU/64 + 20;
 368         }
 369
 370         inpkt->priority = 0;
 371
 372         if(!inpkt->data[12] && !inpkt->data[13])
 373                 mtu_probe_h(n, inpkt, origlen);
 374         else
 375                 receive_packet(n, inpkt);
 376 }
 377
 378 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 379         vpn_packet_t outpkt;
 380
 381         outpkt.len = len;
 382         if(c->options & OPTION_TCPONLY)
 383                 outpkt.priority = 0;
 384         else
 385                 outpkt.priority = -1;
 386         memcpy(outpkt.data, buffer, len);
 387
 388         receive_packet(c->node, &outpkt);
 389 }
 390
 391 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 392         vpn_packet_t pkt1, pkt2;
 393         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 394         vpn_packet_t *inpkt = origpkt;
 395         int nextpkt = 0;
 396         vpn_packet_t *outpkt;
 397         int origlen;
 398         int outlen, outpad;
 399 #if defined(SOL_IP) && defined(IP_TOS)
 400         static int priority = 0;
 401 #endif
 402         int origpriority;
 403
 404         if(!n->status.reachable) {
 405                 ifdebug(TRAFFIC) logger(LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 406                 return;
 407         }
 408
 409         /* Make sure we have a valid key */
 410
 411         if(!n->status.validkey) {
 412                 ifdebug(TRAFFIC) logger(LOG_INFO,
 413                                    "No valid key known yet for %s (%s), forwarding via TCP",
 414                                    n->name, n->hostname);
 415
 416                 if(n->last_req_key + 10 <= now) {
 417                         send_req_key(n);
 418                         n->last_req_key = now;
 419                 }
 420
 421                 send_tcppacket(n->nexthop->connection, origpkt);
 422
 423                 return;
 424         }
 425
 426         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 427                 ifdebug(TRAFFIC) logger(LOG_INFO,
 428                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 429                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 430
 431                 if(n != n->nexthop)
 432                         send_packet(n->nexthop, origpkt);
 433                 else
 434                         send_tcppacket(n->nexthop->connection, origpkt);
 435
 436                 return;
 437         }
 438
 439         origlen = inpkt->len;
 440         origpriority = inpkt->priority;
 441
 442         /* Compress the packet */
 443
 444         if(n->outcompression) {
 445                 outpkt = pkt[nextpkt++];
 446
 447                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 448                         ifdebug(TRAFFIC) logger(LOG_ERR, "Error while compressing packet to %s (%s)",
 449                                    n->name, n->hostname);
 450                         return;
 451                 }
 452
 453                 inpkt = outpkt;
 454         }
 455
 456         /* Add sequence number */
 457
 458         inpkt->seqno = htonl(++(n->sent_seqno));
 459         inpkt->len += sizeof(inpkt->seqno);
 460
 461         /* Encrypt the packet */
 462
 463         if(n->outcipher) {
 464                 outpkt = pkt[nextpkt++];
 465
 466                 if(!EVP_EncryptInit_ex(&n->outctx, NULL, NULL, NULL, NULL)
 467                                 || !EVP_EncryptUpdate(&n->outctx, (unsigned char *) &outpkt->seqno, &outlen,
 468                                         (unsigned char *) &inpkt->seqno, inpkt->len)
 469                                 || !EVP_EncryptFinal_ex(&n->outctx, (unsigned char *) &outpkt->seqno + outlen, &outpad)) {
 470                         ifdebug(TRAFFIC) logger(LOG_ERR, "Error while encrypting packet to %s (%s): %s",
 471                                                 n->name, n->hostname, ERR_error_string(ERR_get_error(), NULL));
 472                         goto end;
 473                 }
 474
 475                 outpkt->len = outlen + outpad;
 476                 inpkt = outpkt;
 477         }
 478
 479         /* Add the message authentication code */
 480
 481         if(n->outdigest && n->outmaclength) {
 482                 HMAC(n->outdigest, n->outkey, n->outkeylength, (unsigned char *) &inpkt->seqno,
 483                          inpkt->len, (unsigned char *) &inpkt->seqno + inpkt->len, NULL);
 484                 inpkt->len += n->outmaclength;
 485         }
 486
 487         /* Determine which socket we have to use */
 488
 489         if(n->address.sa.sa_family != listen_socket[n->sock].sa.sa.sa_family) {
 490                 for(int sock = 0; sock < listen_sockets; sock++) {
 491                         if(n->address.sa.sa_family == listen_socket[sock].sa.sa.sa_family) {
 492                                 n->sock = sock;
 493                                 break;
 494                         }
 495                 }
 496         }
 497
 498         /* Send the packet */
 499
 500         struct sockaddr *sa;
 501         socklen_t sl;
 502         int sock;
 503
 504         /* Overloaded use of priority field: -1 means local broadcast */
 505
 506         if(origpriority == -1 && n->prevedge) {
 507                 struct sockaddr_in in;
 508                 in.sin_family = AF_INET;
 509                 in.sin_addr.s_addr = -1;
 510                 in.sin_port = n->prevedge->address.in.sin_port;
 511                 sa = (struct sockaddr *)&in;
 512                 sl = sizeof in;
 513                 sock = 0;
 514         } else {
 515                 if(origpriority == -1)
 516                         origpriority = 0;
 517
 518                 sa = &(n->address.sa);
 519                 sl = SALEN(n->address.sa);
 520                 sock = n->sock;
 521         }
 522
 523 #if defined(SOL_IP) && defined(IP_TOS)
 524         if(priorityinheritance && origpriority != priority
 525            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 526                 priority = origpriority;
 527                 ifdebug(TRAFFIC) logger(LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 528                 if(setsockopt(listen_socket[n->sock].udp, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 529                         logger(LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 530         }
 531 #endif
 532
 533         if(sendto(listen_socket[sock].udp, (char *) &inpkt->seqno, inpkt->len, 0, sa, sl) < 0 && !sockwouldblock(sockerrno)) {
 534                 if(sockmsgsize(sockerrno)) {
 535                         if(n->maxmtu >= origlen)
 536                                 n->maxmtu = origlen - 1;
 537                         if(n->mtu >= origlen)
 538                                 n->mtu = origlen - 1;
 539                 } else
 540                         ifdebug(TRAFFIC) logger(LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 541         }
 542
 543 end:
 544         origpkt->len = origlen;
 545 }
 546
 547 /*
 548   send a packet to the given vpn ip.
 549 */
 550 void send_packet(const node_t *n, vpn_packet_t *packet) {
 551         node_t *via;
 552
 553         if(n == myself) {
 554                 if(overwrite_mac)
 555                          memcpy(packet->data, mymac.x, ETH_ALEN);
 556                 devops.write(packet);
 557                 return;
 558         }
 559
 560         ifdebug(TRAFFIC) logger(LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 561                            packet->len, n->name, n->hostname);
 562
 563         if(!n->status.reachable) {
 564                 ifdebug(TRAFFIC) logger(LOG_INFO, "Node %s (%s) is not reachable",
 565                                    n->name, n->hostname);
 566                 return;
 567         }
 568
 569         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 570
 571         if(via != n)
 572                 ifdebug(TRAFFIC) logger(LOG_INFO, "Sending packet to %s via %s (%s)",
 573                            n->name, via->name, n->via->hostname);
 574
 575         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 576                 if(!send_tcppacket(via->connection, packet))
 577                         terminate_connection(via->connection, true);
 578         } else
 579                 send_udppacket(via, packet);
 580 }
 581
 582 /* Broadcast a packet using the minimum spanning tree */
 583
 584 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 585         avl_node_t *node;
 586         connection_t *c;
 587         node_t *n;
 588
 589         // Always give ourself a copy of the packet.
 590         if(from != myself)
 591                 send_packet(myself, packet);
 592
 593         // In TunnelServer mode, do not forward broadcast packets.
 594         // The MST might not be valid and create loops.
 595         if(tunnelserver || broadcast_mode == BMODE_NONE)
 596                 return;
 597
 598         ifdebug(TRAFFIC) logger(LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 599                            packet->len, from->name, from->hostname);
 600
 601         switch(broadcast_mode) {
 602                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 603                 // This guarantees all nodes receive the broadcast packet, and
 604                 // usually distributes the sending of broadcast packets over all nodes.
 605                 case BMODE_MST:
 606                         for(node = connection_tree->head; node; node = node->next) {
 607                                 c = node->data;
 608
 609                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 610                                         send_packet(c->node, packet);
 611                         }
 612                         break;
 613
 614                 // In direct mode, we send copies to each node we know of.
 615                 // However, this only reaches nodes that can be reached in a single hop.
 616                 // We don't have enough information to forward broadcast packets in this case.
 617                 case BMODE_DIRECT:
 618                         if(from != myself)
 619                                 break;
 620
 621                         for(node = node_udp_tree->head; node; node = node->next) {
 622                                 n = node->data;
 623
 624                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 625                                         send_packet(c->node, packet);
 626                         }
 627                         break;
 628
 629                 default:
 630                         break;
 631         }
 632 }
 633
 634 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 635         avl_node_t *node;
 636         edge_t *e;
 637         node_t *n = NULL;
 638         bool hard = false;
 639         static time_t last_hard_try = 0;
 640
 641         for(node = edge_weight_tree->head; node; node = node->next) {
 642                 e = node->data;
 643
 644                 if(e->to == myself)
 645                         continue;
 646
 647                 if(sockaddrcmp_noport(from, &e->address)) {
 648                         if(last_hard_try == now)
 649                                 continue;
 650                         hard = true;
 651                 }
 652
 653                 if(!try_mac(e->to, pkt))
 654                         continue;
 655
 656                 n = e->to;
 657                 break;
 658         }
 659
 660         if(hard)
 661                 last_hard_try = now;
 662
 663         last_hard_try = now;
 664         return n;
 665 }
 666
 667 void handle_incoming_vpn_data(int sock) {
 668         vpn_packet_t pkt;
 669         char *hostname;
 670         sockaddr_t from;
 671         socklen_t fromlen = sizeof(from);
 672         node_t *n;
 673
 674         pkt.len = recvfrom(listen_socket[sock].udp, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 675
 676         if(pkt.len < 0) {
 677                 if(!sockwouldblock(sockerrno))
 678                         logger(LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 679                 return;
 680         }
 681
 682         sockaddrunmap(&from);           /* Some braindead IPv6 implementations do stupid things. */
 683
 684         n = lookup_node_udp(&from);
 685
 686         if(!n) {
 687                 n = try_harder(&from, &pkt);
 688                 if(n)
 689                         update_node_udp(n, &from);
 690                 else ifdebug(PROTOCOL) {
 691                         hostname = sockaddr2hostname(&from);
 692                         logger(LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 693                         free(hostname);
 694                         return;
 695                 }
 696                 else
 697                         return;
 698         }
 699
 700         n->sock = sock;
 701
 702         receive_udppacket(n, &pkt);
 703 }