www.tinc-vpn.org Git - tinc/blob - src/net_packet.c

   1 /*
   2     net_packet.c -- Handles in- and outgoing VPN packets
   3     Copyright (C) 1998-2005 Ivo Timmermans,
   4                   2000-2013 Guus Sliepen <guus@tinc-vpn.org>
   5                   2010      Timothy Redaelli <timothy@redaelli.eu>
   6                   2010      Brandon Black <blblack@gmail.com>
   7
   8     This program is free software; you can redistribute it and/or modify
   9     it under the terms of the GNU General Public License as published by
  10     the Free Software Foundation; either version 2 of the License, or
  11     (at your option) any later version.
  12
  13     This program is distributed in the hope that it will be useful,
  14     but WITHOUT ANY WARRANTY; without even the implied warranty of
  15     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16     GNU General Public License for more details.
  17
  18     You should have received a copy of the GNU General Public License along
  19     with this program; if not, write to the Free Software Foundation, Inc.,
  20     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21 */
  22
  23 #include "system.h"
  24
  25 #ifdef HAVE_ZLIB
  26 #include <zlib.h>
  27 #endif
  28
  29 #ifdef HAVE_LZO
  30 #include LZO1X_H
  31 #endif
  32
  33 #include "cipher.h"
  34 #include "conf.h"
  35 #include "connection.h"
  36 #include "crypto.h"
  37 #include "digest.h"
  38 #include "device.h"
  39 #include "ethernet.h"
  40 #include "graph.h"
  41 #include "logger.h"
  42 #include "net.h"
  43 #include "netutl.h"
  44 #include "protocol.h"
  45 #include "process.h"
  46 #include "route.h"
  47 #include "utils.h"
  48 #include "xalloc.h"
  49
  50 int keylifetime = 0;
  51 #ifdef HAVE_LZO
  52 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
  53 #endif
  54
  55 static void send_udppacket(node_t *, vpn_packet_t *);
  56
  57 unsigned replaywin = 16;
  58 bool localdiscovery = false;
  59
  60 #define MAX_SEQNO 1073741824
  61
  62 /* mtuprobes == 1..30: initial discovery, send bursts with 1 second interval
  63    mtuprobes ==    31: sleep pinginterval seconds
  64    mtuprobes ==    32: send 1 burst, sleep pingtimeout second
  65    mtuprobes ==    33: no response from other side, restart PMTU discovery process
  66
  67    Probes are sent in batches of at least three, with random sizes between the
  68    lower and upper boundaries for the MTU thus far discovered.
  69
  70    After the initial discovery, a fourth packet is added to each batch with a
  71    size larger than the currently known PMTU, to test if the PMTU has increased.
  72
  73    In case local discovery is enabled, another packet is added to each batch,
  74    which will be broadcast to the local network.
  75
  76 */
  77
  78 static void send_mtu_probe_handler(void *data) {
  79         node_t *n = data;
  80         int timeout = 1;
  81
  82         n->mtuprobes++;
  83
  84         if(!n->status.reachable || !n->status.validkey) {
  85                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send MTU probe to unreachable or rekeying node %s (%s)", n->name, n->hostname);
  86                 n->mtuprobes = 0;
  87                 return;
  88         }
  89
  90         if(n->mtuprobes > 32) {
  91                 if(!n->minmtu) {
  92                         n->mtuprobes = 31;
  93                         timeout = pinginterval;
  94                         goto end;
  95                 }
  96
  97                 logger(DEBUG_TRAFFIC, LOG_INFO, "%s (%s) did not respond to UDP ping, restarting PMTU discovery", n->name, n->hostname);
  98                 n->status.udp_confirmed = false;
  99                 n->mtuprobes = 1;
 100                 n->minmtu = 0;
 101                 n->maxmtu = MTU;
 102         }
 103
 104         if(n->mtuprobes >= 10 && n->mtuprobes < 32 && !n->minmtu) {
 105                 logger(DEBUG_TRAFFIC, LOG_INFO, "No response to MTU probes from %s (%s)", n->name, n->hostname);
 106                 n->mtuprobes = 31;
 107         }
 108
 109         if(n->mtuprobes == 30 || (n->mtuprobes < 30 && n->minmtu >= n->maxmtu)) {
 110                 if(n->minmtu > n->maxmtu)
 111                         n->minmtu = n->maxmtu;
 112                 else
 113                         n->maxmtu = n->minmtu;
 114                 n->mtu = n->minmtu;
 115                 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
 116                 n->mtuprobes = 31;
 117         }
 118
 119         if(n->mtuprobes == 31) {
 120                 timeout = pinginterval;
 121                 goto end;
 122         } else if(n->mtuprobes == 32) {
 123                 timeout = pingtimeout;
 124         }
 125
 126         for(int i = 0; i < 4 + localdiscovery; i++) {
 127                 int len;
 128
 129                 if(i == 0) {
 130                         if(n->mtuprobes < 30 || n->maxmtu + 8 >= MTU)
 131                                 continue;
 132                         len = n->maxmtu + 8;
 133                 } else if(n->maxmtu <= n->minmtu) {
 134                         len = n->maxmtu;
 135                 } else {
 136                         len = n->minmtu + 1 + rand() % (n->maxmtu - n->minmtu);
 137                 }
 138
 139                 if(len < 64)
 140                         len = 64;
 141
 142                 vpn_packet_t packet;
 143                 memset(packet.data, 0, 14);
 144                 randomize(packet.data + 14, len - 14);
 145                 packet.len = len;
 146                 if(i >= 4 && n->mtuprobes <= 10)
 147                         packet.priority = -1;
 148                 else
 149                         packet.priority = 0;
 150
 151                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending MTU probe length %d to %s (%s)", len, n->name, n->hostname);
 152
 153                 send_udppacket(n, &packet);
 154         }
 155
 156         n->probe_counter = 0;
 157         gettimeofday(&n->probe_time, NULL);
 158
 159         /* Calculate the packet loss of incoming traffic by comparing the rate of
 160            packets received to the rate with which the sequence number has increased.
 161          */
 162
 163         if(n->received > n->prev_received)
 164                 n->packetloss = 1.0 - (n->received - n->prev_received) / (float)(n->received_seqno - n->prev_received_seqno);
 165         else
 166                 n->packetloss = n->received_seqno <= n->prev_received_seqno;
 167
 168         n->prev_received_seqno = n->received_seqno;
 169         n->prev_received = n->received;
 170
 171 end:
 172         timeout_set(&n->mtutimeout, &(struct timeval){timeout, rand() % 100000});
 173 }
 174
 175 void send_mtu_probe(node_t *n) {
 176         timeout_add(&n->mtutimeout, send_mtu_probe_handler, n, &(struct timeval){1, 0});
 177         send_mtu_probe_handler(n);
 178 }
 179
 180 static void mtu_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
 181         logger(DEBUG_TRAFFIC, LOG_INFO, "Got MTU probe length %d from %s (%s)", packet->len, n->name, n->hostname);
 182
 183         if(!packet->data[0]) {
 184                 /* It's a probe request, send back a reply */
 185
 186                 packet->data[0] = 1;
 187
 188                 /* Temporarily set udp_confirmed, so that the reply is sent
 189                    back exactly the way it came in. */
 190
 191                 bool udp_confirmed = n->status.udp_confirmed;
 192                 n->status.udp_confirmed = true;
 193                 send_udppacket(n, packet);
 194                 n->status.udp_confirmed = udp_confirmed;
 195         } else {
 196                 /* It's a valid reply: now we know bidirectional communication
 197                    is possible using the address and socket that the reply
 198                    packet used. */
 199
 200                 n->status.udp_confirmed = true;
 201
 202                 /* If we haven't established the PMTU yet, restart the discovery process. */
 203
 204                 if(n->mtuprobes > 30) {
 205                         if (len == n->maxmtu + 8) {
 206                                 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
 207                                 n->maxmtu = MTU;
 208                                 n->mtuprobes = 10;
 209                                 return;
 210                         }
 211
 212                         if(n->minmtu)
 213                                 n->mtuprobes = 30;
 214                         else
 215                                 n->mtuprobes = 1;
 216                 }
 217
 218                 /* If applicable, raise the minimum supported MTU */
 219
 220                 if(len > n->maxmtu)
 221                         len = n->maxmtu;
 222                 if(n->minmtu < len)
 223                         n->minmtu = len;
 224
 225                 /* Calculate RTT and bandwidth.
 226                    The RTT is the time between the MTU probe burst was sent and the first
 227                    reply is received. The bandwidth is measured using the time between the
 228                    arrival of the first and third probe reply.
 229                  */
 230
 231                 struct timeval now, diff;
 232                 gettimeofday(&now, NULL);
 233                 timersub(&now, &n->probe_time, &diff);
 234                 n->probe_counter++;
 235
 236                 if(n->probe_counter == 1) {
 237                         n->rtt = diff.tv_sec + diff.tv_usec * 1e-6;
 238                         n->probe_time = now;
 239                 } else if(n->probe_counter == 3) {
 240                         n->bandwidth = 2.0 * len / (diff.tv_sec + diff.tv_usec * 1e-6);
 241                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "%s (%s) RTT %.2f ms, burst bandwidth %.3f Mbit/s, rx packet loss %.2f %%", n->name, n->hostname, n->rtt * 1e3, n->bandwidth * 8e-6, n->packetloss * 1e2);
 242                 }
 243         }
 244 }
 245
 246 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 247         if(level == 0) {
 248                 memcpy(dest, source, len);
 249                 return len;
 250         } else if(level == 10) {
 251 #ifdef HAVE_LZO
 252                 lzo_uint lzolen = MAXSIZE;
 253                 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
 254                 return lzolen;
 255 #else
 256                 return -1;
 257 #endif
 258         } else if(level < 10) {
 259 #ifdef HAVE_ZLIB
 260                 unsigned long destlen = MAXSIZE;
 261                 if(compress2(dest, &destlen, source, len, level) == Z_OK)
 262                         return destlen;
 263                 else
 264 #endif
 265                         return -1;
 266         } else {
 267 #ifdef HAVE_LZO
 268                 lzo_uint lzolen = MAXSIZE;
 269                 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
 270                 return lzolen;
 271 #else
 272                 return -1;
 273 #endif
 274         }
 275
 276         return -1;
 277 }
 278
 279 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
 280         if(level == 0) {
 281                 memcpy(dest, source, len);
 282                 return len;
 283         } else if(level > 9) {
 284 #ifdef HAVE_LZO
 285                 lzo_uint lzolen = MAXSIZE;
 286                 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
 287                         return lzolen;
 288                 else
 289 #endif
 290                         return -1;
 291         }
 292 #ifdef HAVE_ZLIB
 293         else {
 294                 unsigned long destlen = MAXSIZE;
 295                 if(uncompress(dest, &destlen, source, len) == Z_OK)
 296                         return destlen;
 297                 else
 298                         return -1;
 299         }
 300 #endif
 301
 302         return -1;
 303 }
 304
 305 /* VPN packet I/O */
 306
 307 static void receive_packet(node_t *n, vpn_packet_t *packet) {
 308         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
 309                            packet->len, n->name, n->hostname);
 310
 311         n->in_packets++;
 312         n->in_bytes += packet->len;
 313
 314         route(n, packet);
 315 }
 316
 317 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
 318         if(n->status.sptps)
 319                 return sptps_verify_datagram(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 320
 321         if(!digest_active(n->indigest) || inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest))
 322                 return false;
 323
 324         return digest_verify(n->indigest, &inpkt->seqno, inpkt->len - digest_length(n->indigest), (const char *)&inpkt->seqno + inpkt->len - digest_length(n->indigest));
 325 }
 326
 327 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 328         vpn_packet_t pkt1, pkt2;
 329         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 330         int nextpkt = 0;
 331         vpn_packet_t *outpkt = pkt[0];
 332         size_t outlen;
 333
 334         if(n->status.sptps) {
 335                 sptps_receive_data(&n->sptps, (char *)&inpkt->seqno, inpkt->len);
 336                 return;
 337         }
 338
 339         if(!cipher_active(n->incipher)) {
 340                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet",
 341                                         n->name, n->hostname);
 342                 return;
 343         }
 344
 345         /* Check packet length */
 346
 347         if(inpkt->len < sizeof inpkt->seqno + digest_length(n->indigest)) {
 348                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
 349                                         n->name, n->hostname);
 350                 return;
 351         }
 352
 353         /* Check the message authentication code */
 354
 355         if(digest_active(n->indigest)) {
 356                 inpkt->len -= digest_length(n->indigest);
 357                 if(!digest_verify(n->indigest, &inpkt->seqno, inpkt->len, (const char *)&inpkt->seqno + inpkt->len)) {
 358                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
 359                         return;
 360                 }
 361         }
 362         /* Decrypt the packet */
 363
 364         if(cipher_active(n->incipher)) {
 365                 outpkt = pkt[nextpkt++];
 366                 outlen = MAXSIZE;
 367
 368                 if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 369                         logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
 370                         return;
 371                 }
 372
 373                 outpkt->len = outlen;
 374                 inpkt = outpkt;
 375         }
 376
 377         /* Check the sequence number */
 378
 379         inpkt->len -= sizeof inpkt->seqno;
 380         inpkt->seqno = ntohl(inpkt->seqno);
 381
 382         if(replaywin) {
 383                 if(inpkt->seqno != n->received_seqno + 1) {
 384                         if(inpkt->seqno >= n->received_seqno + replaywin * 8) {
 385                                 if(n->farfuture++ < replaywin >> 2) {
 386                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
 387                                                 n->name, n->hostname, inpkt->seqno - n->received_seqno - 1, n->farfuture);
 388                                         return;
 389                                 }
 390                                 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
 391                                                 inpkt->seqno - n->received_seqno - 1, n->name, n->hostname);
 392                                 memset(n->late, 0, replaywin);
 393                         } else if (inpkt->seqno <= n->received_seqno) {
 394                                 if((n->received_seqno >= replaywin * 8 && inpkt->seqno <= n->received_seqno - replaywin * 8) || !(n->late[(inpkt->seqno / 8) % replaywin] & (1 << inpkt->seqno % 8))) {
 395                                         logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
 396                                                 n->name, n->hostname, inpkt->seqno, n->received_seqno);
 397                                         return;
 398                                 }
 399                         } else {
 400                                 for(int i = n->received_seqno + 1; i < inpkt->seqno; i++)
 401                                         n->late[(i / 8) % replaywin] |= 1 << i % 8;
 402                         }
 403                 }
 404
 405                 n->farfuture = 0;
 406                 n->late[(inpkt->seqno / 8) % replaywin] &= ~(1 << inpkt->seqno % 8);
 407         }
 408
 409         if(inpkt->seqno > n->received_seqno)
 410                 n->received_seqno = inpkt->seqno;
 411
 412         n->received++;
 413
 414         if(n->received_seqno > MAX_SEQNO)
 415                 regenerate_key();
 416
 417         /* Decompress the packet */
 418
 419         length_t origlen = inpkt->len;
 420
 421         if(n->incompression) {
 422                 outpkt = pkt[nextpkt++];
 423
 424                 if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
 425                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
 426                                                  n->name, n->hostname);
 427                         return;
 428                 }
 429
 430                 inpkt = outpkt;
 431
 432                 origlen -= MTU/64 + 20;
 433         }
 434
 435         inpkt->priority = 0;
 436
 437         if(!inpkt->data[12] && !inpkt->data[13])
 438                 mtu_probe_h(n, inpkt, origlen);
 439         else
 440                 receive_packet(n, inpkt);
 441 }
 442
 443 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 444         vpn_packet_t outpkt;
 445
 446         if(len > sizeof outpkt.data)
 447                 return;
 448
 449         outpkt.len = len;
 450         if(c->options & OPTION_TCPONLY)
 451                 outpkt.priority = 0;
 452         else
 453                 outpkt.priority = -1;
 454         memcpy(outpkt.data, buffer, len);
 455
 456         receive_packet(c->node, &outpkt);
 457 }
 458
 459 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
 460         if(!n->status.validkey) {
 461                 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 462                 if(!n->status.waitingforkey)
 463                         send_req_key(n);
 464                 else if(n->last_req_key + 10 < now.tv_sec) {
 465                         logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
 466                         sptps_stop(&n->sptps);
 467                         n->status.waitingforkey = false;
 468                         send_req_key(n);
 469                 }
 470                 return;
 471         }
 472
 473         uint8_t type = 0;
 474         int offset = 0;
 475
 476         if(!(origpkt->data[12] | origpkt->data[13])) {
 477                 sptps_send_record(&n->sptps, PKT_PROBE, (char *)origpkt->data, origpkt->len);
 478                 return;
 479         }
 480
 481         if(routing_mode == RMODE_ROUTER)
 482                 offset = 14;
 483         else
 484                 type = PKT_MAC;
 485
 486         if(origpkt->len < offset)
 487                 return;
 488
 489         vpn_packet_t outpkt;
 490
 491         if(n->outcompression) {
 492                 int len = compress_packet(outpkt.data + offset, origpkt->data + offset, origpkt->len - offset, n->outcompression);
 493                 if(len < 0) {
 494                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
 495                 } else if(len < origpkt->len - offset) {
 496                         outpkt.len = len + offset;
 497                         origpkt = &outpkt;
 498                         type |= PKT_COMPRESSED;
 499                 }
 500         }
 501
 502         sptps_send_record(&n->sptps, type, (char *)origpkt->data + offset, origpkt->len - offset);
 503         return;
 504 }
 505
 506 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 507         /* Latest guess */
 508         *sa = &n->address;
 509         *sock = n->sock;
 510
 511         /* If the UDP address is confirmed, use it. */
 512         if(n->status.udp_confirmed)
 513                 return;
 514
 515         /* Send every third packet to n->address; that could be set
 516            to the node's reflexive UDP address discovered during key
 517            exchange. */
 518
 519         static int x = 0;
 520         if(++x >= 3) {
 521                 x = 0;
 522                 return;
 523         }
 524
 525         /* Otherwise, address are found in edges to this node.
 526            So we pick a random edge and a random socket. */
 527
 528         int i = 0;
 529         int j = rand() % n->edge_tree->count;
 530         edge_t *candidate = NULL;
 531
 532         for splay_each(edge_t, e, n->edge_tree) {
 533                 if(i++ == j) {
 534                         candidate = e->reverse;
 535                         break;
 536                 }
 537         }
 538
 539         if(candidate) {
 540                 *sa = &candidate->address;
 541                 *sock = rand() % listen_sockets;
 542         }
 543
 544         /* Make sure we have a suitable socket for the chosen address */
 545         if(listen_socket[*sock].sa.sa.sa_family != (*sa)->sa.sa_family) {
 546                 for(int i = 0; i < listen_sockets; i++) {
 547                         if(listen_socket[i].sa.sa.sa_family == (*sa)->sa.sa_family) {
 548                                 *sock = i;
 549                                 break;
 550                         }
 551                 }
 552         }
 553 }
 554
 555 static void choose_broadcast_address(const node_t *n, const sockaddr_t **sa, int *sock) {
 556         static sockaddr_t broadcast_ipv4 = {
 557                 .in = {
 558                         .sin_family = AF_INET,
 559                         .sin_addr.s_addr = -1,
 560                 }
 561         };
 562
 563         static sockaddr_t broadcast_ipv6 = {
 564                 .in6 = {
 565                         .sin6_family = AF_INET6,
 566                         .sin6_addr.s6_addr[0x0] = 0xff,
 567                         .sin6_addr.s6_addr[0x1] = 0x02,
 568                         .sin6_addr.s6_addr[0xf] = 0x01,
 569                 }
 570         };
 571
 572         *sock = rand() % listen_sockets;
 573
 574         if(listen_socket[*sock].sa.sa.sa_family == AF_INET6) {
 575                 broadcast_ipv6.in6.sin6_port = n->prevedge->address.in.sin_port;
 576                 broadcast_ipv6.in6.sin6_scope_id = listen_socket[*sock].sa.in6.sin6_scope_id;
 577                 *sa = &broadcast_ipv6;
 578         } else {
 579                 broadcast_ipv4.in.sin_port = n->prevedge->address.in.sin_port;
 580                 *sa = &broadcast_ipv4;
 581         }
 582 }
 583
 584 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
 585         vpn_packet_t pkt1, pkt2;
 586         vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
 587         vpn_packet_t *inpkt = origpkt;
 588         int nextpkt = 0;
 589         vpn_packet_t *outpkt;
 590         int origlen = origpkt->len;
 591         size_t outlen;
 592 #if defined(SOL_IP) && defined(IP_TOS)
 593         static int priority = 0;
 594 #endif
 595         int origpriority = origpkt->priority;
 596
 597         if(!n->status.reachable) {
 598                 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
 599                 return;
 600         }
 601
 602         if(n->status.sptps)
 603                 return send_sptps_packet(n, origpkt);
 604
 605         /* Make sure we have a valid key */
 606
 607         if(!n->status.validkey) {
 608                 logger(DEBUG_TRAFFIC, LOG_INFO,
 609                                    "No valid key known yet for %s (%s), forwarding via TCP",
 610                                    n->name, n->hostname);
 611
 612                 if(n->last_req_key + 10 <= now.tv_sec) {
 613                         send_req_key(n);
 614                         n->last_req_key = now.tv_sec;
 615                 }
 616
 617                 send_tcppacket(n->nexthop->connection, origpkt);
 618
 619                 return;
 620         }
 621
 622         if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (inpkt->data[12] | inpkt->data[13])) {
 623                 logger(DEBUG_TRAFFIC, LOG_INFO,
 624                                 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
 625                                 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 626
 627                 if(n != n->nexthop)
 628                         send_packet(n->nexthop, origpkt);
 629                 else
 630                         send_tcppacket(n->nexthop->connection, origpkt);
 631
 632                 return;
 633         }
 634
 635         /* Compress the packet */
 636
 637         if(n->outcompression) {
 638                 outpkt = pkt[nextpkt++];
 639
 640                 if((outpkt->len = compress_packet(outpkt->data, inpkt->data, inpkt->len, n->outcompression)) < 0) {
 641                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
 642                                    n->name, n->hostname);
 643                         return;
 644                 }
 645
 646                 inpkt = outpkt;
 647         }
 648
 649         /* Add sequence number */
 650
 651         inpkt->seqno = htonl(++(n->sent_seqno));
 652         inpkt->len += sizeof inpkt->seqno;
 653
 654         /* Encrypt the packet */
 655
 656         if(cipher_active(n->outcipher)) {
 657                 outpkt = pkt[nextpkt++];
 658                 outlen = MAXSIZE;
 659
 660                 if(!cipher_encrypt(n->outcipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
 661                         logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
 662                         goto end;
 663                 }
 664
 665                 outpkt->len = outlen;
 666                 inpkt = outpkt;
 667         }
 668
 669         /* Add the message authentication code */
 670
 671         if(digest_active(n->outdigest)) {
 672                 digest_create(n->outdigest, &inpkt->seqno, inpkt->len, (char *)&inpkt->seqno + inpkt->len);
 673                 inpkt->len += digest_length(n->outdigest);
 674         }
 675
 676         /* Send the packet */
 677
 678         const sockaddr_t *sa;
 679         int sock;
 680
 681         /* Overloaded use of priority field: -1 means local broadcast */
 682
 683         if(origpriority == -1 && n->prevedge)
 684                 choose_broadcast_address(n, &sa, &sock);
 685         else
 686                 choose_udp_address(n, &sa, &sock);
 687
 688 #if defined(SOL_IP) && defined(IP_TOS)
 689         if(priorityinheritance && origpriority != priority
 690            && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
 691                 priority = origpriority;
 692                 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
 693                 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
 694                         logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", strerror(errno));
 695         }
 696 #endif
 697
 698         if(sendto(listen_socket[sock].udp.fd, (char *) &inpkt->seqno, inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 699                 if(sockmsgsize(sockerrno)) {
 700                         if(n->maxmtu >= origlen)
 701                                 n->maxmtu = origlen - 1;
 702                         if(n->mtu >= origlen)
 703                                 n->mtu = origlen - 1;
 704                 } else
 705                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
 706         }
 707
 708 end:
 709         origpkt->len = origlen;
 710 }
 711
 712 bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 713         node_t *to = handle;
 714
 715         /* Send it via TCP if it is a handshake packet, TCPOnly is in use, or this packet is larger than the MTU. */
 716
 717         if(type >= SPTPS_HANDSHAKE || ((myself->options | to->options) & OPTION_TCPONLY) || (type != PKT_PROBE && len > to->minmtu)) {
 718                 char buf[len * 4 / 3 + 5];
 719                 b64encode(data, buf, len);
 720                 /* If no valid key is known yet, send the packets using ANS_KEY requests,
 721                    to ensure we get to learn the reflexive UDP address. */
 722                 if(!to->status.validkey)
 723                         return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, myself->name, to->name, buf, myself->incompression);
 724                 else
 725                         return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, myself->name, to->name, REQ_SPTPS, buf);
 726         }
 727
 728         /* Otherwise, send the packet via UDP */
 729
 730         const sockaddr_t *sa;
 731         int sock;
 732
 733         choose_udp_address(to, &sa, &sock);
 734
 735         if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
 736                 if(sockmsgsize(sockerrno)) {
 737                         if(to->maxmtu >= len)
 738                                 to->maxmtu = len - 1;
 739                         if(to->mtu >= len)
 740                                 to->mtu = len - 1;
 741                 } else {
 742                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", to->name, to->hostname, sockstrerror(sockerrno));
 743                         return false;
 744                 }
 745         }
 746
 747         return true;
 748 }
 749
 750 bool receive_sptps_record(void *handle, uint8_t type, const char *data, uint16_t len) {
 751         node_t *from = handle;
 752
 753         if(type == SPTPS_HANDSHAKE) {
 754                 if(!from->status.validkey) {
 755                         from->status.validkey = true;
 756                         from->status.waitingforkey = false;
 757                         logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
 758                 }
 759                 return true;
 760         }
 761
 762         if(len > MTU) {
 763                 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
 764                 return false;
 765         }
 766
 767         vpn_packet_t inpkt;
 768
 769         if(type == PKT_PROBE) {
 770                 inpkt.len = len;
 771                 memcpy(inpkt.data, data, len);
 772                 mtu_probe_h(from, &inpkt, len);
 773                 return true;
 774         }
 775
 776         if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
 777                 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
 778                 return false;
 779         }
 780
 781         /* Check if we have the headers we need */
 782         if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
 783                 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 784                 return false;
 785         } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
 786                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
 787         }
 788
 789         int offset = (type & PKT_MAC) ? 0 : 14;
 790         if(type & PKT_COMPRESSED) {
 791                 length_t ulen = uncompress_packet(inpkt.data + offset, (const uint8_t *)data, len, from->incompression);
 792                 if(ulen < 0) {
 793                         return false;
 794                 } else {
 795                         inpkt.len = ulen + offset;
 796                 }
 797                 if(inpkt.len > MAXSIZE)
 798                         abort();
 799         } else {
 800                 memcpy(inpkt.data + offset, data, len);
 801                 inpkt.len = len + offset;
 802         }
 803
 804         /* Generate the Ethernet packet type if necessary */
 805         if(offset) {
 806                 switch(inpkt.data[14] >> 4) {
 807                         case 4:
 808                                 inpkt.data[12] = 0x08;
 809                                 inpkt.data[13] = 0x00;
 810                                 break;
 811                         case 6:
 812                                 inpkt.data[12] = 0x86;
 813                                 inpkt.data[13] = 0xDD;
 814                                 break;
 815                         default:
 816                                 logger(DEBUG_TRAFFIC, LOG_ERR,
 817                                                    "Unknown IP version %d while reading packet from %s (%s)",
 818                                                    inpkt.data[14] >> 4, from->name, from->hostname);
 819                                 return false;
 820                 }
 821         }
 822
 823         receive_packet(from, &inpkt);
 824         return true;
 825 }
 826
 827 /*
 828   send a packet to the given vpn ip.
 829 */
 830 void send_packet(node_t *n, vpn_packet_t *packet) {
 831         node_t *via;
 832
 833         if(n == myself) {
 834                 if(overwrite_mac)
 835                          memcpy(packet->data, mymac.x, ETH_ALEN);
 836                 n->out_packets++;
 837                 n->out_bytes += packet->len;
 838                 devops.write(packet);
 839                 return;
 840         }
 841
 842         logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)",
 843                            packet->len, n->name, n->hostname);
 844
 845         if(!n->status.reachable) {
 846                 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable",
 847                                    n->name, n->hostname);
 848                 return;
 849         }
 850
 851         n->out_packets++;
 852         n->out_bytes += packet->len;
 853
 854         if(n->status.sptps) {
 855                 send_sptps_packet(n, packet);
 856                 return;
 857         }
 858
 859         via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 860
 861         if(via != n)
 862                 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)",
 863                            n->name, via->name, n->via->hostname);
 864
 865         if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
 866                 if(!send_tcppacket(via->connection, packet))
 867                         terminate_connection(via->connection, true);
 868         } else
 869                 send_udppacket(via, packet);
 870 }
 871
 872 /* Broadcast a packet using the minimum spanning tree */
 873
 874 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
 875         // Always give ourself a copy of the packet.
 876         if(from != myself)
 877                 send_packet(myself, packet);
 878
 879         // In TunnelServer mode, do not forward broadcast packets.
 880         // The MST might not be valid and create loops.
 881         if(tunnelserver || broadcast_mode == BMODE_NONE)
 882                 return;
 883
 884         logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
 885                            packet->len, from->name, from->hostname);
 886
 887         switch(broadcast_mode) {
 888                 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
 889                 // This guarantees all nodes receive the broadcast packet, and
 890                 // usually distributes the sending of broadcast packets over all nodes.
 891                 case BMODE_MST:
 892                         for list_each(connection_t, c, connection_list)
 893                                 if(c->status.active && c->status.mst && c != from->nexthop->connection)
 894                                         send_packet(c->node, packet);
 895                         break;
 896
 897                 // In direct mode, we send copies to each node we know of.
 898                 // However, this only reaches nodes that can be reached in a single hop.
 899                 // We don't have enough information to forward broadcast packets in this case.
 900                 case BMODE_DIRECT:
 901                         if(from != myself)
 902                                 break;
 903
 904                         for splay_each(node_t, n, node_tree)
 905                                 if(n->status.reachable && ((n->via == myself && n->nexthop == n) || n->via == n))
 906                                         send_packet(n, packet);
 907                         break;
 908
 909                 default:
 910                         break;
 911         }
 912 }
 913
 914 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
 915         node_t *n = NULL;
 916         bool hard = false;
 917         static time_t last_hard_try = 0;
 918
 919         for splay_each(edge_t, e, edge_weight_tree) {
 920                 if(!e->to->status.reachable || e->to == myself)
 921                         continue;
 922
 923                 if(sockaddrcmp_noport(from, &e->address)) {
 924                         if(last_hard_try == now.tv_sec)
 925                                 continue;
 926                         hard = true;
 927                 }
 928
 929                 if(!try_mac(e->to, pkt))
 930                         continue;
 931
 932                 n = e->to;
 933                 break;
 934         }
 935
 936         if(hard)
 937                 last_hard_try = now.tv_sec;
 938
 939         last_hard_try = now.tv_sec;
 940         return n;
 941 }
 942
 943 void handle_incoming_vpn_data(void *data, int flags) {
 944         listen_socket_t *ls = data;
 945         vpn_packet_t pkt;
 946         char *hostname;
 947         sockaddr_t from = {{0}};
 948         socklen_t fromlen = sizeof from;
 949         node_t *n;
 950         int len;
 951
 952         len = recvfrom(ls->udp.fd, (char *) &pkt.seqno, MAXSIZE, 0, &from.sa, &fromlen);
 953
 954         if(len <= 0 || len > MAXSIZE) {
 955                 if(!sockwouldblock(sockerrno))
 956                         logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
 957                 return;
 958         }
 959
 960         pkt.len = len;
 961
 962         sockaddrunmap(&from); /* Some braindead IPv6 implementations do stupid things. */
 963
 964         n = lookup_node_udp(&from);
 965
 966         if(!n) {
 967                 n = try_harder(&from, &pkt);
 968                 if(n)
 969                         update_node_udp(n, &from);
 970                 else if(debug_level >= DEBUG_PROTOCOL) {
 971                         hostname = sockaddr2hostname(&from);
 972                         logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
 973                         free(hostname);
 974                         return;
 975                 }
 976                 else
 977                         return;
 978         }
 979
 980         n->sock = ls - listen_socket;
 981
 982         receive_udppacket(n, &pkt);
 983 }
 984
 985 void handle_device_data(void *data, int flags) {
 986         vpn_packet_t packet;
 987
 988         packet.priority = 0;
 989
 990         if(devops.read(&packet)) {
 991                 myself->in_packets++;
 992                 myself->in_bytes += packet.len;
 993                 route(myself, &packet);
 994         }
 995 }