Use read_host_config() where appropriate.
[tinc] / src / net_packet.c
1 /*
2     net_packet.c -- Handles in- and outgoing VPN packets
3     Copyright (C) 1998-2005 Ivo Timmermans,
4                   2000-2013 Guus Sliepen <guus@tinc-vpn.org>
5                   2010      Timothy Redaelli <timothy@redaelli.eu>
6                   2010      Brandon Black <blblack@gmail.com>
7
8     This program is free software; you can redistribute it and/or modify
9     it under the terms of the GNU General Public License as published by
10     the Free Software Foundation; either version 2 of the License, or
11     (at your option) any later version.
12
13     This program is distributed in the hope that it will be useful,
14     but WITHOUT ANY WARRANTY; without even the implied warranty of
15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16     GNU General Public License for more details.
17
18     You should have received a copy of the GNU General Public License along
19     with this program; if not, write to the Free Software Foundation, Inc.,
20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
23 #include "system.h"
24
25 #ifdef HAVE_ZLIB
26 #include <zlib.h>
27 #endif
28
29 #ifdef HAVE_LZO
30 #include LZO1X_H
31 #endif
32
33 #include "cipher.h"
34 #include "conf.h"
35 #include "connection.h"
36 #include "crypto.h"
37 #include "digest.h"
38 #include "device.h"
39 #include "ethernet.h"
40 #include "graph.h"
41 #include "logger.h"
42 #include "net.h"
43 #include "netutl.h"
44 #include "protocol.h"
45 #include "process.h"
46 #include "route.h"
47 #include "utils.h"
48 #include "xalloc.h"
49
50 int keylifetime = 0;
51 #ifdef HAVE_LZO
52 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
53 #endif
54
55 static void send_udppacket(node_t *, vpn_packet_t *);
56
57 unsigned replaywin = 16;
58 bool localdiscovery = false;
59
60 #define MAX_SEQNO 1073741824
61
62 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
63    mtuprobes ==    31: sleep pinginterval seconds
64    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
65    mtuprobes ==    33: no response from other side, restart PMTU discovery process
66
67    Probes are sent in batches of at least three, with random sizes between the
68    lower and upper boundaries for the MTU thus far discovered.
69
70    After the initial discovery, a fourth packet is added to each batch with a
71    size larger than the currently known PMTU, to test if the PMTU has increased.
72
73    In case local discovery is enabled, another packet is added to each batch,
74    which will be broadcast to the local network.
75
76 */
77
78 static void send_mtu_probe_handler(void *data) {
79         node_t *n = data;
80         int timeout = 1;
81
82         n->mtuprobes++;
83
84         if(!n->status.reachable || !n->status.validkey) {
85                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
86                 n->mtuprobes = 0;
87                 return;
88         }
89
90         if(n->mtuprobes > 32) {
91                 if(!n->minmtu) {
92                         n->mtuprobes = 31;
93                         timeout = pinginterval;
94                         goto end;
95                 }
96
97                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
98                 n->status.udp_confirmed = false;
99                 n->mtuprobes = 1;
100                 n->minmtu = 0;
101                 n->maxmtu = MTU;
102         }
103
104         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
105                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
106                 n->mtuprobes = 31;
107         }
108
109         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
110                 if(n->minmtu > n->maxmtu)
111                         n->minmtu = n->maxmtu;
112                 else
113                         n->maxmtu = n->minmtu;
114                 n->mtu = n->minmtu;
115                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
116                 n->mtuprobes = 31;
117         }
118
119         if(n->mtuprobes == 31) {
120                 timeout = pinginterval;
121                 goto end;
122         } else if(n->mtuprobes == 32) {
123                 timeout = pingtimeout;
124         }
125
126         for(int i = 0; i < 4 + localdiscovery; i++) {
127                 int len;
128
129                 if(i == 0) {
130                         if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
131                                 continue;
132                         len = n->maxmtu + 8;
133                 } else if(n->maxmtu <= n->minmtu) {
134                         len = n->maxmtu;
135                 } else {
136                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
137                 }
138
139                 if(len < 64)
140                         len = 64;
141
142                 vpn_packet_t packet;
143                 memset(packet.data, 0, 14);
144                 randomize(packet.data + 14, len - 14);
145                 packet.len = len;
146                 if(i >= 4 && n->mtuprobes <= 10)
147                         packet.priority = -1;
148                 else
149                         packet.priority = 0;
150
151                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
152
153                 send_udppacket(n, &packet);
154         }
155
156         n->probe_counter = 0;
157         gettimeofday(&n->probe_time, NULL);
158
159         /* Calculate the packet loss of incoming traffic by comparing the rate of
160            packets received to the rate with which the sequence number has increased.
161          */
162
163         if(n->received > n->prev_received)
164                 n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno);
165         else
166                 n->packetloss = n->received_seqno <= n->prev_received_seqno;
167
168         n->prev_received_seqno = n->received_seqno;
169         n->prev_received = n->received;
170
171 end:
172         timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
173 }
174
175 void send_mtu_probe(node_t *n) {
176         timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
177         send_mtu_probe_handler(n);
178 }
179
180 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
181         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
182
183         if(!packet->data[0]) {
184                 /* It's a probe request, send back a reply */
185
186                 packet->data[0] = 1;
187
188                 /* Temporarily set udp_confirmed, so that the reply is sent
189                    back exactly the way it came in. */
190
191                 bool udp_confirmed = n->status.udp_confirmed;
192                 n->status.udp_confirmed = true;
193                 send_udppacket(n, packet);
194                 n->status.udp_confirmed = udp_confirmed;
195         } else {
196                 /* It's a valid reply: now we know bidirectional communication
197                    is possible using the address and socket that the reply
198                    packet used. */
199
200                 n->status.udp_confirmed = true;
201
202                 /* If we haven't established the PMTU yet, restart the discovery process. */
203
204                 if(n->mtuprobes > 30) {
205                         if (len == n->maxmtu + 8) {
206                                 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
207                                 n->maxmtu = MTU;
208                                 n->mtuprobes = 10;
209                                 return;
210                         }
211
212                         if(n->minmtu)
213                                 n->mtuprobes = 30;
214                         else
215                                 n->mtuprobes = 1;
216                 }
217
218                 /* If applicable, raise the minimum supported MTU */
219
220                 if(len > n->maxmtu)
221                         len = n->maxmtu;
222                 if(n->minmtu < len)
223                         n->minmtu = len;
224
225                 /* Calculate RTT and bandwidth.
226                    The RTT is the time between the MTU probe burst was sent and the first
227                    reply is received. The bandwidth is measured using the time between the
228                    arrival of the first and third probe reply.
229                  */
230
231                 struct timeval now, diff;
232                 gettimeofday(&now, NULL);
233                 timersub(&now, &n->probe_time, &diff);
234                 n->probe_counter++;
235
236                 if(n->probe_counter == 1) {
237                         n->rtt = diff.tv_sec + diff.tv_usec * 1e-6;
238                         n->probe_time = now;
239                 } else if(n->probe_counter == 3) {
240                         n->bandwidth = 2.0 * len / (diff.tv_sec + diff.tv_usec * 1e-6);
241                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, burst bandwidth %.3f Mbit/s, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->bandwidth * 8e-6, n->packetloss * 1e2);
242                 }
243         }
244 }
245
246 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
247         if(level == 0) {
248                 memcpy(dest, source, len);
249                 return len;
250         } else if(level == 10) {
251 #ifdef HAVE_LZO
252                 lzo_uint lzolen = MAXSIZE;
253                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
254                 return lzolen;
255 #else
256                 return -1;
257 #endif
258         } else if(level < 10) {
259 #ifdef HAVE_ZLIB
260                 unsigned long destlen = MAXSIZE;
261                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
262                         return destlen;
263                 else
264 #endif
265                         return -1;
266         } else {
267 #ifdef HAVE_LZO
268                 lzo_uint lzolen = MAXSIZE;
269                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
270                 return lzolen;
271 #else
272                 return -1;
273 #endif
274         }
275
276         return -1;
277 }
278
279 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
280         if(level == 0) {
281                 memcpy(dest, source, len);
282                 return len;
283         } else if(level > 9) {
284 #ifdef HAVE_LZO
285                 lzo_uint lzolen = MAXSIZE;
286                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
287                         return lzolen;
288                 else
289 #endif
290                         return -1;
291         }
292 #ifdef HAVE_ZLIB
293         else {
294                 unsigned long destlen = MAXSIZE;
295                 if(uncompress(dest, &destlen, source, len) == Z_OK)
296                         return destlen;
297                 else
298                         return -1;
299         }
300 #endif
301
302         return -1;
303 }
304
305 /* VPN packet I/O */
306
307 static void receive_packet(node_t *n, vpn_packet_t *packet) {
308         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
309                            packet->len, n->name, n->hostname);
310
311         n->in_packets++;
312         n->in_bytes += packet->len;
313
314         route(n, packet);
315 }
316
317 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
318         if(n->status.sptps)
319                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
320
321         if(!digest_active(n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest))
322                 return false;
323
324         return digest_verify(n->indigest, &inpkt->seqno, inpkt->len - digest_length(n->indigest), (const char *)&inpkt->seqno + inpkt->len - digest_length(n->indigest));
325 }
326
327 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
328         vpn_packet_t pkt1, pkt2;
329         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
330         int nextpkt = 0;
331         vpn_packet_t *outpkt = pkt[0];
332         size_t outlen;
333
334         if(n->status.sptps) {
335                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
336                 return;
337         }
338
339         if(!cipher_active(n->incipher)) {
340                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
341                                         n->name, n->hostname);
342                 return;
343         }
344
345         /* Check packet length */
346
347         if(inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest)) {
348                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
349                                         n->name, n->hostname);
350                 return;
351         }
352
353         /* Check the message authentication code */
354
355         if(digest_active(n->indigest)) {
356                 inpkt->len -= digest_length(n->indigest);
357                 if(!digest_verify(n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
358                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
359                         return;
360                 }
361         }
362         /* Decrypt the packet */
363
364         if(cipher_active(n->incipher)) {
365                 outpkt = pkt[nextpkt++];
366                 outlen = MAXSIZE;
367
368                 if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
369                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
370                         return;
371                 }
372
373                 outpkt->len = outlen;
374                 inpkt = outpkt;
375         }
376
377         /* Check the sequence number */
378
379         inpkt->len -= sizeof inpkt->seqno;
380         inpkt->seqno = ntohl(inpkt->seqno);
381
382         if(replaywin) {
383                 if(inpkt->seqno != n->received_seqno + 1) {
384                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
385                                 if(n->farfuture++ < replaywin >> 2) {
386                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
387                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
388                                         return;
389                                 }
390                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
391                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
392                                 memset(n->late, 0, replaywin);
393                         } else if (inpkt->seqno <= n->received_seqno) {
394                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
395                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
396                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
397                                         return;
398                                 }
399                         } else {
400                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
401                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
402                         }
403                 }
404
405                 n->farfuture = 0;
406                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
407         }
408
409         if(inpkt->seqno > n->received_seqno)
410                 n->received_seqno = inpkt->seqno;
411
412         n->received++;
413
414         if(n->received_seqno > MAX_SEQNO)
415                 regenerate_key();
416
417         /* Decompress the packet */
418
419         length_t origlen = inpkt->len;
420
421         if(n->incompression) {
422                 outpkt = pkt[nextpkt++];
423
424                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
425                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
426                                                  n->name, n->hostname);
427                         return;
428                 }
429
430                 inpkt = outpkt;
431
432                 origlen -= MTU/64 + 20;
433         }
434
435         inpkt->priority = 0;
436
437         if(!inpkt->data[12] && !inpkt->data[13])
438                 mtu_probe_h(n, inpkt, origlen);
439         else
440                 receive_packet(n, inpkt);
441 }
442
443 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
444         vpn_packet_t outpkt;
445
446         if(len > sizeof outpkt.data)
447                 return;
448
449         outpkt.len = len;
450         if(c->options & OPTION_TCPONLY)
451                 outpkt.priority = 0;
452         else
453                 outpkt.priority = -1;
454         memcpy(outpkt.data, buffer, len);
455
456         receive_packet(c->node, &outpkt);
457 }
458
459 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
460         if(!n->status.validkey) {
461                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
462                 if(!n->status.waitingforkey)
463                         send_req_key(n);
464                 else if(n->last_req_key + 10 < now.tv_sec) {
465                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
466                         sptps_stop(&n->sptps);
467                         n->status.waitingforkey = false;
468                         send_req_key(n);
469                 }
470                 return;
471         }
472
473         uint8_t type = 0;
474         int offset = 0;
475
476         if(!(origpkt->data[12] | origpkt->data[13])) {
477                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
478                 return;
479         }
480
481         if(routing_mode == RMODE_ROUTER)
482                 offset = 14;
483         else
484                 type = PKT_MAC;
485
486         if(origpkt->len < offset)
487                 return;
488
489         vpn_packet_t outpkt;
490
491         if(n->outcompression) {
492                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
493                 if(len < 0) {
494                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
495                 } else if(len < origpkt->len - offset) {
496                         outpkt.len = len + offset;
497                         origpkt = &outpkt;
498                         type |= PKT_COMPRESSED;
499                 }
500         }
501
502         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
503         return;
504 }
505
506 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
507         /* Latest guess */
508         *sa = &n->address;
509         *sock = n->sock;
510
511         /* If the UDP address is confirmed, use it. */
512         if(n->status.udp_confirmed)
513                 return;
514
515         /* Send every third packet to n->address; that could be set
516            to the node's reflexive UDP address discovered during key
517            exchange. */
518
519         static int x = 0;
520         if(++x >= 3) {
521                 x = 0;
522                 return;
523         }
524
525         /* Otherwise, address are found in edges to this node.
526            So we pick a random edge and a random socket. */
527
528         int i = 0;
529         int j = rand() % n->edge_tree->count;
530         edge_t *candidate = NULL;
531
532         for splay_each(edge_t, e, n->edge_tree) {
533                 if(i++ == j) {
534                         candidate = e->reverse;
535                         break;
536                 }
537         }
538
539         if(candidate) {
540                 *sa = &candidate->address;
541                 *sock = rand() % listen_sockets;
542         }
543
544         /* Make sure we have a suitable socket for the chosen address */
545         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
546                 for(int i = 0; i < listen_sockets; i++) {
547                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
548                                 *sock = i;
549                                 break;
550                         }
551                 }
552         }
553 }
554
555 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
556         static sockaddr_t broadcast_ipv4 = {
557                 .in = {
558                         .sin_family = AF_INET,
559                         .sin_addr.s_addr = -1,
560                 }
561         };
562
563         static sockaddr_t broadcast_ipv6 = {
564                 .in6 = {
565                         .sin6_family = AF_INET6,
566                         .sin6_addr.s6_addr[0x0] = 0xff,
567                         .sin6_addr.s6_addr[0x1] = 0x02,
568                         .sin6_addr.s6_addr[0xf] = 0x01,
569                 }
570         };
571
572         *sock = rand() % listen_sockets;
573
574         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
575                 broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
576                 broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
577                 *sa = &broadcast_ipv6;
578         } else {
579                 broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
580                 *sa = &broadcast_ipv4;
581         }
582 }
583
584 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
585         vpn_packet_t pkt1, pkt2;
586         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
587         vpn_packet_t *inpkt = origpkt;
588         int nextpkt = 0;
589         vpn_packet_t *outpkt;
590         int origlen = origpkt->len;
591         size_t outlen;
592 #if defined(SOL_IP) && defined(IP_TOS)
593         static int priority = 0;
594 #endif
595         int origpriority = origpkt->priority;
596
597         if(!n->status.reachable) {
598                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
599                 return;
600         }
601
602         if(n->status.sptps)
603                 return send_sptps_packet(n, origpkt);
604
605         /* Make sure we have a valid key */
606
607         if(!n->status.validkey) {
608                 logger(DEBUG_TRAFFIC, LOG_INFO,
609                                    "No valid key known yet for %s (%s), forwarding via TCP",
610                                    n->name, n->hostname);
611
612                 if(n->last_req_key + 10 <= now.tv_sec) {
613                         send_req_key(n);
614                         n->last_req_key = now.tv_sec;
615                 }
616
617                 send_tcppacket(n->nexthop->connection, origpkt);
618
619                 return;
620         }
621
622         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
623                 logger(DEBUG_TRAFFIC, LOG_INFO,
624                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
625                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
626
627                 if(n != n->nexthop)
628                         send_packet(n->nexthop, origpkt);
629                 else
630                         send_tcppacket(n->nexthop->connection, origpkt);
631
632                 return;
633         }
634
635         /* Compress the packet */
636
637         if(n->outcompression) {
638                 outpkt = pkt[nextpkt++];
639
640                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
641                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
642                                    n->name, n->hostname);
643                         return;
644                 }
645
646                 inpkt = outpkt;
647         }
648
649         /* Add sequence number */
650
651         inpkt->seqno = htonl(++(n->sent_seqno));
652         inpkt->len += sizeof inpkt->seqno;
653
654         /* Encrypt the packet */
655
656         if(cipher_active(n->outcipher)) {
657                 outpkt = pkt[nextpkt++];
658                 outlen = MAXSIZE;
659
660                 if(!cipher_encrypt(n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
661                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
662                         goto end;
663                 }
664
665                 outpkt->len = outlen;
666                 inpkt = outpkt;
667         }
668
669         /* Add the message authentication code */
670
671         if(digest_active(n->outdigest)) {
672                 if(!digest_create(n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len)) {
673                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
674                         goto end;
675                 }
676
677                 inpkt->len += digest_length(n->outdigest);
678         }
679
680         /* Send the packet */
681
682         const sockaddr_t *sa;
683         int sock;
684
685         /* Overloaded use of priority field: -1 means local broadcast */
686
687         if(origpriority == -1 && n->prevedge)
688                 choose_broadcast_address(n, &sa, &sock);
689         else
690                 choose_udp_address(n, &sa, &sock);
691
692 #if defined(SOL_IP) && defined(IP_TOS)
693         if(priorityinheritance && origpriority != priority
694            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
695                 priority = origpriority;
696                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
697                 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
698                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
699         }
700 #endif
701
702         if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
703                 if(sockmsgsize(sockerrno)) {
704                         if(n->maxmtu >= origlen)
705                                 n->maxmtu = origlen - 1;
706                         if(n->mtu >= origlen)
707                                 n->mtu = origlen - 1;
708                 } else
709                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
710         }
711
712 end:
713         origpkt->len = origlen;
714 }
715
716 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
717         node_t *to = handle;
718
719         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
720
721         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
722                 char buf[len * 4 / 3 + 5];
723                 b64encode(data, buf, len);
724                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
725                    to ensure we get to learn the reflexive UDP address. */
726                 if(!to->status.validkey)
727                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
728                 else
729                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
730         }
731
732         /* Otherwise, send the packet via UDP */
733
734         const sockaddr_t *sa;
735         int sock;
736
737         choose_udp_address(to, &sa, &sock);
738
739         if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
740                 if(sockmsgsize(sockerrno)) {
741                         if(to->maxmtu >= len)
742                                 to->maxmtu = len - 1;
743                         if(to->mtu >= len)
744                                 to->mtu = len - 1;
745                 } else {
746                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
747                         return false;
748                 }
749         }
750
751         return true;
752 }
753
754 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
755         node_t *from = handle;
756
757         if(type == SPTPS_HANDSHAKE) {
758                 if(!from->status.validkey) {
759                         from->status.validkey = true;
760                         from->status.waitingforkey = false;
761                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
762                 }
763                 return true;
764         }
765
766         if(len > MTU) {
767                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
768                 return false;
769         }
770
771         vpn_packet_t inpkt;
772
773         if(type == PKT_PROBE) {
774                 inpkt.len = len;
775                 memcpy(inpkt.data, data, len);
776                 mtu_probe_h(from, &inpkt, len);
777                 return true;
778         }
779
780         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
781                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
782                 return false;
783         }
784
785         /* Check if we have the headers we need */
786         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
787                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
788                 return false;
789         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
790                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
791         }
792
793         int offset = (type & PKT_MAC) ? 0 : 14;
794         if(type & PKT_COMPRESSED) {
795                 length_t ulen = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
796                 if(ulen < 0) {
797                         return false;
798                 } else {
799                         inpkt.len = ulen + offset;
800                 }
801                 if(inpkt.len > MAXSIZE)
802                         abort();
803         } else {
804                 memcpy(inpkt.data + offset, data, len);
805                 inpkt.len = len + offset;
806         }
807
808         /* Generate the Ethernet packet type if necessary */
809         if(offset) {
810                 switch(inpkt.data[14] >> 4) {
811                         case 4:
812                                 inpkt.data[12] = 0x08;
813                                 inpkt.data[13] = 0x00;
814                                 break;
815                         case 6:
816                                 inpkt.data[12] = 0x86;
817                                 inpkt.data[13] = 0xDD;
818                                 break;
819                         default:
820                                 logger(DEBUG_TRAFFIC, LOG_ERR,
821                                                    "Unknown IP version %d while reading packet from %s (%s)",
822                                                    inpkt.data[14] >> 4, from->name, from->hostname);
823                                 return false;
824                 }
825         }
826
827         receive_packet(from, &inpkt);
828         return true;
829 }
830
831 /*
832   send a packet to the given vpn ip.
833 */
834 void send_packet(node_t *n, vpn_packet_t *packet) {
835         node_t *via;
836
837         if(n == myself) {
838                 if(overwrite_mac)
839                          memcpy(packet->data, mymac.x, ETH_ALEN);
840                 n->out_packets++;
841                 n->out_bytes += packet->len;
842                 devops.write(packet);
843                 return;
844         }
845
846         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
847                            packet->len, n->name, n->hostname);
848
849         if(!n->status.reachable) {
850                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
851                                    n->name, n->hostname);
852                 return;
853         }
854
855         n->out_packets++;
856         n->out_bytes += packet->len;
857
858         if(n->status.sptps) {
859                 send_sptps_packet(n, packet);
860                 return;
861         }
862
863         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
864
865         if(via != n)
866                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
867                            n->name, via->name, n->via->hostname);
868
869         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
870                 if(!send_tcppacket(via->connection, packet))
871                         terminate_connection(via->connection, true);
872         } else
873                 send_udppacket(via, packet);
874 }
875
876 /* Broadcast a packet using the minimum spanning tree */
877
878 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
879         // Always give ourself a copy of the packet.
880         if(from != myself)
881                 send_packet(myself, packet);
882
883         // In TunnelServer mode, do not forward broadcast packets.
884         // The MST might not be valid and create loops.
885         if(tunnelserver || broadcast_mode == BMODE_NONE)
886                 return;
887
888         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
889                            packet->len, from->name, from->hostname);
890
891         switch(broadcast_mode) {
892                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
893                 // This guarantees all nodes receive the broadcast packet, and
894                 // usually distributes the sending of broadcast packets over all nodes.
895                 case BMODE_MST:
896                         for list_each(connection_t, c, connection_list)
897                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
898                                         send_packet(c->node, packet);
899                         break;
900
901                 // In direct mode, we send copies to each node we know of.
902                 // However, this only reaches nodes that can be reached in a single hop.
903                 // We don't have enough information to forward broadcast packets in this case.
904                 case BMODE_DIRECT:
905                         if(from != myself)
906                                 break;
907
908                         for splay_each(node_t, n, node_tree)
909                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
910                                         send_packet(n, packet);
911                         break;
912
913                 default:
914                         break;
915         }
916 }
917
918 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
919         node_t *n = NULL;
920         bool hard = false;
921         static time_t last_hard_try = 0;
922
923         for splay_each(edge_t, e, edge_weight_tree) {
924                 if(!e->to->status.reachable || e->to == myself)
925                         continue;
926
927                 if(sockaddrcmp_noport(from, &e->address)) {
928                         if(last_hard_try == now.tv_sec)
929                                 continue;
930                         hard = true;
931                 }
932
933                 if(!try_mac(e->to, pkt))
934                         continue;
935
936                 n = e->to;
937                 break;
938         }
939
940         if(hard)
941                 last_hard_try = now.tv_sec;
942
943         last_hard_try = now.tv_sec;
944         return n;
945 }
946
947 void handle_incoming_vpn_data(void *data, int flags) {
948         listen_socket_t *ls = data;
949         vpn_packet_t pkt;
950         char *hostname;
951         sockaddr_t from = {{0}};
952         socklen_t fromlen = sizeof from;
953         node_t *n;
954         int len;
955
956         len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
957
958         if(len <= 0 || len > MAXSIZE) {
959                 if(!sockwouldblock(sockerrno))
960                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
961                 return;
962         }
963
964         pkt.len = len;
965
966         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
967
968         n = lookup_node_udp(&from);
969
970         if(!n) {
971                 n = try_harder(&from, &pkt);
972                 if(n)
973                         update_node_udp(n, &from);
974                 else if(debug_level >= DEBUG_PROTOCOL) {
975                         hostname = sockaddr2hostname(&from);
976                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
977                         free(hostname);
978                         return;
979                 }
980                 else
981                         return;
982         }
983
984         n->sock = ls - listen_socket;
985
986         receive_udppacket(n, &pkt);
987 }
988
989 void handle_device_data(void *data, int flags) {
990         vpn_packet_t packet;
991
992         packet.priority = 0;
993
994         if(devops.read(&packet)) {
995                 myself->in_packets++;
996                 myself->in_bytes += packet.len;
997                 route(myself, &packet);
998         }
999 }