Fix tinc-up generation on windows
[tinc] / src / route.c
1 /*
2     route.c -- routing
3     Copyright (C) 2000-2005 Ivo Timmermans,
4                   2000-2013 Guus Sliepen <guus@tinc-vpn.org>
5
6     This program is free software; you can redistribute it and/or modify
7     it under the terms of the GNU General Public License as published by
8     the Free Software Foundation; either version 2 of the License, or
9     (at your option) any later version.
10
11     This program is distributed in the hope that it will be useful,
12     but WITHOUT ANY WARRANTY; without even the implied warranty of
13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14     GNU General Public License for more details.
15
16     You should have received a copy of the GNU General Public License along
17     with this program; if not, write to the Free Software Foundation, Inc.,
18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19 */
20
21 #include "system.h"
22
23 #include "connection.h"
24 #include "control_common.h"
25 #include "ethernet.h"
26 #include "ipv4.h"
27 #include "ipv6.h"
28 #include "logger.h"
29 #include "meta.h"
30 #include "net.h"
31 #include "protocol.h"
32 #include "route.h"
33 #include "subnet.h"
34 #include "utils.h"
35
36 rmode_t routing_mode = RMODE_ROUTER;
37 fmode_t forwarding_mode = FMODE_INTERNAL;
38 bmode_t broadcast_mode = BMODE_MST;
39 bool decrement_ttl = false;
40 bool directonly = false;
41 bool priorityinheritance = false;
42 int macexpire = 600;
43 bool overwrite_mac = false;
44 mac_t mymac = {{0xFE, 0xFD, 0, 0, 0, 0}};
45 bool pcap = false;
46
47 /* Sizes of various headers */
48
49 static const size_t ether_size = sizeof(struct ether_header);
50 static const size_t arp_size = sizeof(struct ether_arp);
51 static const size_t ip_size = sizeof(struct ip);
52 static const size_t icmp_size = sizeof(struct icmp) - sizeof(struct ip);
53 static const size_t ip6_size = sizeof(struct ip6_hdr);
54 static const size_t icmp6_size = sizeof(struct icmp6_hdr);
55 static const size_t ns_size = sizeof(struct nd_neighbor_solicit);
56 static const size_t opt_size = sizeof(struct nd_opt_hdr);
57
58 #ifndef MAX
59 #define MAX(a, b) ((a) > (b) ? (a) : (b))
60 #endif
61
62 volatile int dummy;
63 static timeout_t age_subnets_timeout;
64
65 /* RFC 1071 */
66
67 static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
68         uint16_t *p = data;
69         uint32_t checksum = prevsum ^ 0xFFFF;
70
71         while(len >= 2) {
72                 checksum += *p++;
73                 len -= 2;
74         }
75
76         if(len) {
77                 checksum += *(uint8_t *)p;
78         }
79
80         while(checksum >> 16) {
81                 checksum = (checksum & 0xFFFF) + (checksum >> 16);
82         }
83
84         // Work around a compiler optimization bug.
85         if(checksum) {
86                 dummy = 1;
87         }
88
89         return ~checksum;
90 }
91
92 static bool ratelimit(int frequency) {
93         static time_t lasttime = 0;
94         static int count = 0;
95
96         if(lasttime == now.tv_sec) {
97                 if(count >= frequency) {
98                         return true;
99                 }
100         } else {
101                 lasttime = now.tv_sec;
102                 count = 0;
103         }
104
105         count++;
106         return false;
107 }
108
109 static bool checklength(node_t *source, vpn_packet_t *packet, length_t length) {
110         if(packet->len < length) {
111                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Got too short packet from %s (%s)", source->name, source->hostname);
112                 return false;
113         } else {
114                 return true;
115         }
116 }
117
118 static void swap_mac_addresses(vpn_packet_t *packet) {
119         mac_t tmp;
120         memcpy(&tmp, &DATA(packet)[0], sizeof(tmp));
121         memcpy(&DATA(packet)[0], &DATA(packet)[6], sizeof(tmp));
122         memcpy(&DATA(packet)[6], &tmp, sizeof(tmp));
123 }
124
125 /* RFC 792 */
126
127 static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
128         struct ip ip = {0};
129         struct icmp icmp = {0};
130
131         struct in_addr ip_src;
132         struct in_addr ip_dst;
133         uint32_t oldlen;
134
135         if(ratelimit(3)) {
136                 return;
137         }
138
139         /* Swap Ethernet source and destination addresses */
140
141         swap_mac_addresses(packet);
142
143         /* Copy headers from packet into properly aligned structs on the stack */
144
145         memcpy(&ip, DATA(packet) + ether_size, ip_size);
146
147         /* Remember original source and destination */
148
149         ip_src = ip.ip_src;
150         ip_dst = ip.ip_dst;
151
152         /* Try to reply with an IP address assigned to the local machine */
153
154         if(type == ICMP_TIME_EXCEEDED && code == ICMP_EXC_TTL) {
155                 int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
156
157                 if(sockfd != -1) {
158                         struct sockaddr_in addr;
159                         memset(&addr, 0, sizeof(addr));
160                         addr.sin_family = AF_INET;
161                         addr.sin_addr = ip.ip_src;
162
163                         if(!connect(sockfd, (const struct sockaddr *) &addr, sizeof(addr))) {
164                                 memset(&addr, 0, sizeof(addr));
165                                 addr.sin_family = AF_INET;
166                                 socklen_t addrlen = sizeof(addr);
167
168                                 if(!getsockname(sockfd, (struct sockaddr *) &addr, &addrlen) && addrlen <= sizeof(addr)) {
169                                         ip_dst = addr.sin_addr;
170                                 }
171                         }
172
173                         close(sockfd);
174                 }
175         }
176
177         oldlen = packet->len - ether_size;
178
179         if(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
180                 icmp.icmp_nextmtu = htons(packet->len - ether_size);
181         }
182
183         if(oldlen >= IP_MSS - ip_size - icmp_size) {
184                 oldlen = IP_MSS - ip_size - icmp_size;
185         }
186
187         /* Copy first part of original contents to ICMP message */
188
189         memmove(DATA(packet) + ether_size + ip_size + icmp_size, DATA(packet) + ether_size, oldlen);
190
191         /* Fill in IPv4 header */
192
193         ip.ip_v = 4;
194         ip.ip_hl = ip_size / 4;
195         ip.ip_tos = 0;
196         ip.ip_len = htons(ip_size + icmp_size + oldlen);
197         ip.ip_id = 0;
198         ip.ip_off = 0;
199         ip.ip_ttl = 255;
200         ip.ip_p = IPPROTO_ICMP;
201         ip.ip_sum = 0;
202         ip.ip_src = ip_dst;
203         ip.ip_dst = ip_src;
204
205         ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
206
207         /* Fill in ICMP header */
208
209         icmp.icmp_type = type;
210         icmp.icmp_code = code;
211         icmp.icmp_cksum = 0;
212
213         icmp.icmp_cksum = inet_checksum(&icmp, icmp_size, ~0);
214         icmp.icmp_cksum = inet_checksum(DATA(packet) + ether_size + ip_size + icmp_size, oldlen, icmp.icmp_cksum);
215
216         /* Copy structs on stack back to packet */
217
218         memcpy(DATA(packet) + ether_size, &ip, ip_size);
219         memcpy(DATA(packet) + ether_size + ip_size, &icmp, icmp_size);
220
221         packet->len = ether_size + ip_size + icmp_size + oldlen;
222
223         send_packet(source, packet);
224 }
225
226 /* RFC 2463 */
227
228 static void route_ipv6_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
229         struct ip6_hdr ip6;
230         struct icmp6_hdr icmp6 = {0};
231         uint16_t checksum;
232
233         struct {
234                 struct in6_addr ip6_src;        /* source address */
235                 struct in6_addr ip6_dst;        /* destination address */
236                 uint32_t length;
237                 uint32_t next;
238         } pseudo;
239
240         if(ratelimit(3)) {
241                 return;
242         }
243
244         /* Swap Ethernet source and destination addresses */
245
246         swap_mac_addresses(packet);
247
248         /* Copy headers from packet to structs on the stack */
249
250         memcpy(&ip6, DATA(packet) + ether_size, ip6_size);
251
252         /* Remember original source and destination */
253
254         pseudo.ip6_src = ip6.ip6_dst;
255         pseudo.ip6_dst = ip6.ip6_src;
256
257         /* Try to reply with an IP address assigned to the local machine */
258
259         if(type == ICMP6_TIME_EXCEEDED && code == ICMP6_TIME_EXCEED_TRANSIT) {
260                 int sockfd = socket(AF_INET6, SOCK_DGRAM, 0);
261
262                 if(sockfd != -1) {
263                         struct sockaddr_in6 addr;
264                         memset(&addr, 0, sizeof(addr));
265                         addr.sin6_family = AF_INET6;
266                         addr.sin6_addr = ip6.ip6_src;
267
268                         if(!connect(sockfd, (const struct sockaddr *) &addr, sizeof(addr))) {
269                                 memset(&addr, 0, sizeof(addr));
270                                 addr.sin6_family = AF_INET6;
271                                 socklen_t addrlen = sizeof(addr);
272
273                                 if(!getsockname(sockfd, (struct sockaddr *) &addr, &addrlen) && addrlen <= sizeof(addr)) {
274                                         pseudo.ip6_src = addr.sin6_addr;
275                                 }
276                         }
277
278                         close(sockfd);
279                 }
280         }
281
282         pseudo.length = packet->len - ether_size;
283
284         if(type == ICMP6_PACKET_TOO_BIG) {
285                 icmp6.icmp6_mtu = htonl(pseudo.length);
286         }
287
288         if(pseudo.length >= IP_MSS - ip6_size - icmp6_size) {
289                 pseudo.length = IP_MSS - ip6_size - icmp6_size;
290         }
291
292         /* Copy first part of original contents to ICMP message */
293
294         memmove(DATA(packet) + ether_size + ip6_size + icmp6_size, DATA(packet) + ether_size, pseudo.length);
295
296         /* Fill in IPv6 header */
297
298         ip6.ip6_flow = htonl(0x60000000UL);
299         ip6.ip6_plen = htons(icmp6_size + pseudo.length);
300         ip6.ip6_nxt = IPPROTO_ICMPV6;
301         ip6.ip6_hlim = 255;
302         ip6.ip6_src = pseudo.ip6_src;
303         ip6.ip6_dst = pseudo.ip6_dst;
304
305         /* Fill in ICMP header */
306
307         icmp6.icmp6_type = type;
308         icmp6.icmp6_code = code;
309         icmp6.icmp6_cksum = 0;
310
311         /* Create pseudo header */
312
313         pseudo.length = htonl(icmp6_size + pseudo.length);
314         pseudo.next = htonl(IPPROTO_ICMPV6);
315
316         /* Generate checksum */
317
318         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
319         checksum = inet_checksum(&icmp6, icmp6_size, checksum);
320         checksum = inet_checksum(DATA(packet) + ether_size + ip6_size + icmp6_size, ntohl(pseudo.length) - icmp6_size, checksum);
321
322         icmp6.icmp6_cksum = checksum;
323
324         /* Copy structs on stack back to packet */
325
326         memcpy(DATA(packet) + ether_size, &ip6, ip6_size);
327         memcpy(DATA(packet) + ether_size + ip6_size, &icmp6, icmp6_size);
328
329         packet->len = ether_size + ip6_size + ntohl(pseudo.length);
330
331         send_packet(source, packet);
332 }
333
334 static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) {
335         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
336         length_t ethlen = ether_size;
337
338         if(type == ETH_P_8021Q) {
339                 type = DATA(packet)[16] << 8 | DATA(packet)[17];
340                 ethlen += 4;
341         }
342
343         switch(type) {
344         case ETH_P_IP:
345                 if(!checklength(source, packet, ethlen + ip_size)) {
346                         return false;
347                 }
348
349                 if(DATA(packet)[ethlen + 8] <= 1) {
350                         if(DATA(packet)[ethlen + 11] != IPPROTO_ICMP || DATA(packet)[ethlen + 32] != ICMP_TIME_EXCEEDED) {
351                                 route_ipv4_unreachable(source, packet, ethlen, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL);
352                         }
353
354                         return false;
355                 }
356
357                 uint16_t old = DATA(packet)[ethlen + 8] << 8 | DATA(packet)[ethlen + 9];
358                 DATA(packet)[ethlen + 8]--;
359                 uint16_t new = DATA(packet)[ethlen + 8] << 8 | DATA(packet)[ethlen + 9];
360
361                 uint32_t checksum = DATA(packet)[ethlen + 10] << 8 | DATA(packet)[ethlen + 11];
362                 checksum += old + (~new & 0xFFFF);
363
364                 while(checksum >> 16) {
365                         checksum = (checksum & 0xFFFF) + (checksum >> 16);
366                 }
367
368                 DATA(packet)[ethlen + 10] = checksum >> 8;
369                 DATA(packet)[ethlen + 11] = checksum & 0xff;
370
371                 return true;
372
373         case ETH_P_IPV6:
374                 if(!checklength(source, packet, ethlen + ip6_size)) {
375                         return false;
376                 }
377
378                 if(DATA(packet)[ethlen + 7] <= 1) {
379                         if(DATA(packet)[ethlen + 6] != IPPROTO_ICMPV6 || DATA(packet)[ethlen + 40] != ICMP6_TIME_EXCEEDED) {
380                                 route_ipv6_unreachable(source, packet, ethlen, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT);
381                         }
382
383                         return false;
384                 }
385
386                 DATA(packet)[ethlen + 7]--;
387
388                 return true;
389
390         default:
391                 return true;
392         }
393 }
394
395 static void clamp_mss(const node_t *source, const node_t *via, vpn_packet_t *packet) {
396         if(!source || !via || !(via->options & OPTION_CLAMP_MSS)) {
397                 return;
398         }
399
400         uint16_t mtu = source->mtu;
401
402         if(via != myself && via->mtu < mtu) {
403                 mtu = via->mtu;
404         }
405
406         /* Find TCP header */
407         int start = ether_size;
408         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
409
410         if(type == ETH_P_8021Q) {
411                 start += 4;
412                 type = DATA(packet)[16] << 8 | DATA(packet)[17];
413         }
414
415         /* IP in IP (RFC 2003) packet */
416         if(type == ETH_P_IP && DATA(packet)[start + 9] == 4) {
417                 start += 20;
418         }
419
420         if(packet->len <= start + 20) {
421                 return;
422         }
423
424         if(type == ETH_P_IP && DATA(packet)[start + 9] == 6) {
425                 start += (DATA(packet)[start] & 0xf) * 4;
426         } else if(type == ETH_P_IPV6 && DATA(packet)[start + 6] == 6) {
427                 start += 40;
428         } else {
429                 return;
430         }
431
432         if(packet->len <= start + 20) {
433                 return;
434         }
435
436         /* Use data offset field to calculate length of options field */
437         int len = ((DATA(packet)[start + 12] >> 4) - 5) * 4;
438
439         if(packet->len < start + 20 + len) {
440                 return;
441         }
442
443         /* Search for MSS option header */
444         for(int i = 0; i < len;) {
445                 if(DATA(packet)[start + 20 + i] == 0) {
446                         break;
447                 }
448
449                 if(DATA(packet)[start + 20 + i] == 1) {
450                         i++;
451                         continue;
452                 }
453
454                 if(i > len - 2 || i > len - DATA(packet)[start + 21 + i]) {
455                         break;
456                 }
457
458                 if(DATA(packet)[start + 20 + i] != 2) {
459                         if(DATA(packet)[start + 21 + i] < 2) {
460                                 break;
461                         }
462
463                         i += DATA(packet)[start + 21 + i];
464                         continue;
465                 }
466
467                 if(DATA(packet)[start + 21] != 4) {
468                         break;
469                 }
470
471                 /* Found it */
472                 uint16_t oldmss = DATA(packet)[start + 22 + i] << 8 | DATA(packet)[start + 23 + i];
473                 uint16_t newmss = mtu - start - 20;
474                 uint32_t csum = DATA(packet)[start + 16] << 8 | DATA(packet)[start + 17];
475
476                 if(oldmss <= newmss) {
477                         break;
478                 }
479
480                 logger(DEBUG_TRAFFIC, LOG_INFO, "Clamping MSS of packet from %s to %s to %d", source->name, via->name, newmss);
481
482                 /* Update the MSS value and the checksum */
483                 DATA(packet)[start + 22 + i] = newmss >> 8;
484                 DATA(packet)[start + 23 + i] = newmss & 0xff;
485                 csum ^= 0xffff;
486                 csum += oldmss ^ 0xffff;
487                 csum += newmss;
488                 csum = (csum & 0xffff) + (csum >> 16);
489                 csum += csum >> 16;
490                 csum ^= 0xffff;
491                 DATA(packet)[start + 16] = csum >> 8;
492                 DATA(packet)[start + 17] = csum;
493                 break;
494         }
495 }
496
497 static void age_subnets(void *data) {
498         (void)data;
499         bool left = false;
500
501         for splay_each(subnet_t, s, myself->subnet_tree) {
502                 if(s->expires && s->expires < now.tv_sec) {
503                         if(debug_level >= DEBUG_TRAFFIC) {
504                                 char netstr[MAXNETSTR];
505
506                                 if(net2str(netstr, sizeof(netstr), s)) {
507                                         logger(DEBUG_TRAFFIC, LOG_INFO, "Subnet %s expired", netstr);
508                                 }
509                         }
510
511                         for list_each(connection_t, c, connection_list)
512                                 if(c->edge) {
513                                         send_del_subnet(c, s);
514                                 }
515
516                         subnet_del(myself, s);
517                 } else {
518                         if(s->expires) {
519                                 left = true;
520                         }
521                 }
522         }
523
524         if(left)
525                 timeout_set(&age_subnets_timeout, &(struct timeval) {
526                 10, rand() % 100000
527         });
528 }
529
530 static void learn_mac(mac_t *address) {
531         subnet_t *subnet = lookup_subnet_mac(myself, address);
532
533         /* If we don't know this MAC address yet, store it */
534
535         if(!subnet) {
536                 logger(DEBUG_TRAFFIC, LOG_INFO, "Learned new MAC address %x:%x:%x:%x:%x:%x",
537                        address->x[0], address->x[1], address->x[2], address->x[3],
538                        address->x[4], address->x[5]);
539
540                 subnet = new_subnet();
541                 subnet->type = SUBNET_MAC;
542                 subnet->expires = now.tv_sec + macexpire;
543                 subnet->net.mac.address = *address;
544                 subnet->weight = 10;
545                 subnet_add(myself, subnet);
546                 subnet_update(myself, subnet, true);
547
548                 /* And tell all other tinc daemons it's our MAC */
549
550                 for list_each(connection_t, c, connection_list)
551                         if(c->edge) {
552                                 send_add_subnet(c, subnet);
553                         }
554
555                 timeout_add(&age_subnets_timeout, age_subnets, NULL, &(struct timeval) {
556                         10, rand() % 100000
557                 });
558         } else {
559                 if(subnet->expires) {
560                         subnet->expires = now.tv_sec + macexpire;
561                 }
562         }
563 }
564
565 static void route_broadcast(node_t *source, vpn_packet_t *packet) {
566         if(decrement_ttl && source != myself)
567                 if(!do_decrement_ttl(source, packet)) {
568                         return;
569                 }
570
571         broadcast_packet(source, packet);
572 }
573
574 /* RFC 791 */
575
576 static void fragment_ipv4_packet(node_t *dest, vpn_packet_t *packet, length_t ether_size) {
577         struct ip ip;
578         vpn_packet_t fragment;
579         int maxlen, todo;
580         uint8_t *offset;
581         uint16_t ip_off, origf;
582
583         memcpy(&ip, DATA(packet) + ether_size, ip_size);
584         fragment.priority = packet->priority;
585         fragment.offset = DEFAULT_PACKET_OFFSET;
586
587         if(ip.ip_hl != ip_size / 4) {
588                 return;
589         }
590
591         todo = ntohs(ip.ip_len) - ip_size;
592
593         if(ether_size + ip_size + todo != packet->len) {
594                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Length of packet (%d) doesn't match length in IPv4 header (%d)", packet->len, (int)(ether_size + ip_size + todo));
595                 return;
596         }
597
598         logger(DEBUG_TRAFFIC, LOG_INFO, "Fragmenting packet of %d bytes to %s (%s)", packet->len, dest->name, dest->hostname);
599
600         offset = DATA(packet) + ether_size + ip_size;
601         maxlen = (dest->mtu - ether_size - ip_size) & ~0x7;
602         ip_off = ntohs(ip.ip_off);
603         origf = ip_off & ~IP_OFFMASK;
604         ip_off &= IP_OFFMASK;
605
606         while(todo) {
607                 int len = todo > maxlen ? maxlen : todo;
608                 memcpy(DATA(&fragment) + ether_size + ip_size, offset, len);
609                 todo -= len;
610                 offset += len;
611
612                 ip.ip_len = htons(ip_size + len);
613                 ip.ip_off = htons(ip_off | origf | (todo ? IP_MF : 0));
614                 ip.ip_sum = 0;
615                 ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
616                 memcpy(DATA(&fragment), DATA(packet), ether_size);
617                 memcpy(DATA(&fragment) + ether_size, &ip, ip_size);
618                 fragment.len = ether_size + ip_size + len;
619
620                 send_packet(dest, &fragment);
621
622                 ip_off += len / 8;
623         }
624 }
625
626 static void route_ipv4(node_t *source, vpn_packet_t *packet) {
627         if(!checklength(source, packet, ether_size + ip_size)) {
628                 return;
629         }
630
631         subnet_t *subnet;
632         node_t *via;
633         ipv4_t dest;
634
635         memcpy(&dest, &DATA(packet)[30], sizeof(dest));
636         subnet = lookup_subnet_ipv4(&dest);
637
638         if(!subnet) {
639                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet from %s (%s): unknown IPv4 destination address %d.%d.%d.%d",
640                        source->name, source->hostname,
641                        dest.x[0],
642                        dest.x[1],
643                        dest.x[2],
644                        dest.x[3]);
645
646                 route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNKNOWN);
647                 return;
648         }
649
650         if(!subnet->owner) {
651                 route_broadcast(source, packet);
652                 return;
653         }
654
655         if(subnet->owner == source) {
656                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
657                 return;
658         }
659
660         if(!subnet->owner->status.reachable) {
661                 route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNREACH);
662                 return;
663         }
664
665         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself) {
666                 route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
667                 return;
668         }
669
670         if(decrement_ttl && source != myself && subnet->owner != myself)
671                 if(!do_decrement_ttl(source, packet)) {
672                         return;
673                 }
674
675         if(priorityinheritance) {
676                 packet->priority = DATA(packet)[15];
677         }
678
679         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
680
681         if(via == source) {
682                 logger(DEBUG_TRAFFIC, LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
683                 return;
684         }
685
686         if(directonly && subnet->owner != via) {
687                 route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
688                 return;
689         }
690
691         if(via && packet->len > MAX(via->mtu, 590) && via != myself) {
692                 logger(DEBUG_TRAFFIC, LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
693
694                 if(DATA(packet)[20] & 0x40) {
695                         packet->len = MAX(via->mtu, 590);
696                         route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
697                 } else {
698                         fragment_ipv4_packet(via, packet, ether_size);
699                 }
700
701                 return;
702         }
703
704         clamp_mss(source, via, packet);
705
706         send_packet(subnet->owner, packet);
707 }
708
709 static void route_neighborsol(node_t *source, vpn_packet_t *packet);
710
711 static void route_ipv6(node_t *source, vpn_packet_t *packet) {
712         if(!checklength(source, packet, ether_size + ip6_size)) {
713                 return;
714         }
715
716         if(DATA(packet)[20] == IPPROTO_ICMPV6 && checklength(source, packet, ether_size + ip6_size + icmp6_size) && DATA(packet)[54] == ND_NEIGHBOR_SOLICIT) {
717                 route_neighborsol(source, packet);
718                 return;
719         }
720
721         subnet_t *subnet;
722         node_t *via;
723         ipv6_t dest;
724
725         memcpy(&dest, &DATA(packet)[38], sizeof(dest));
726         subnet = lookup_subnet_ipv6(&dest);
727
728         if(!subnet) {
729                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet from %s (%s): unknown IPv6 destination address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
730                        source->name, source->hostname,
731                        ntohs(dest.x[0]),
732                        ntohs(dest.x[1]),
733                        ntohs(dest.x[2]),
734                        ntohs(dest.x[3]),
735                        ntohs(dest.x[4]),
736                        ntohs(dest.x[5]),
737                        ntohs(dest.x[6]),
738                        ntohs(dest.x[7]));
739
740                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR);
741                 return;
742         }
743
744         if(!subnet->owner) {
745                 route_broadcast(source, packet);
746                 return;
747         }
748
749         if(subnet->owner == source) {
750                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
751                 return;
752         }
753
754         if(!subnet->owner->status.reachable) {
755                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE);
756                 return;
757         }
758
759         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself) {
760                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
761                 return;
762         }
763
764         if(decrement_ttl && source != myself && subnet->owner != myself)
765                 if(!do_decrement_ttl(source, packet)) {
766                         return;
767                 }
768
769         if(priorityinheritance) {
770                 packet->priority = ((DATA(packet)[14] & 0x0f) << 4) | (DATA(packet)[15] >> 4);
771         }
772
773         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
774
775         if(via == source) {
776                 logger(DEBUG_TRAFFIC, LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
777                 return;
778         }
779
780         if(directonly && subnet->owner != via) {
781                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
782                 return;
783         }
784
785         if(via && packet->len > MAX(via->mtu, 1294) && via != myself) {
786                 logger(DEBUG_TRAFFIC, LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
787                 packet->len = MAX(via->mtu, 1294);
788                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_PACKET_TOO_BIG, 0);
789                 return;
790         }
791
792         clamp_mss(source, via, packet);
793
794         send_packet(subnet->owner, packet);
795 }
796
797 /* RFC 2461 */
798
799 static void route_neighborsol(node_t *source, vpn_packet_t *packet) {
800         struct ip6_hdr ip6;
801         struct nd_neighbor_solicit ns;
802         struct nd_opt_hdr opt;
803         subnet_t *subnet;
804         uint16_t checksum;
805         bool has_opt;
806
807         struct {
808                 struct in6_addr ip6_src;
809                 struct in6_addr ip6_dst;
810                 uint32_t length;
811                 uint32_t next;
812         } pseudo;
813
814         if(!checklength(source, packet, ether_size + ip6_size + ns_size)) {
815                 return;
816         }
817
818         has_opt = packet->len >= ether_size + ip6_size + ns_size + opt_size + ETH_ALEN;
819
820         if(source != myself) {
821                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Got neighbor solicitation request from %s (%s) while in router mode!", source->name, source->hostname);
822                 return;
823         }
824
825         /* Copy headers from packet to structs on the stack */
826
827         memcpy(&ip6, DATA(packet) + ether_size, ip6_size);
828         memcpy(&ns, DATA(packet) + ether_size + ip6_size, ns_size);
829
830         if(has_opt) {
831                 memcpy(&opt, DATA(packet) + ether_size + ip6_size + ns_size, opt_size);
832         }
833
834         /* First, snatch the source address from the neighbor solicitation packet */
835
836         if(overwrite_mac) {
837                 memcpy(mymac.x, DATA(packet) + ETH_ALEN, ETH_ALEN);
838         }
839
840         /* Check if this is a valid neighbor solicitation request */
841
842         if(ns.nd_ns_hdr.icmp6_type != ND_NEIGHBOR_SOLICIT ||
843                         (has_opt && opt.nd_opt_type != ND_OPT_SOURCE_LINKADDR)) {
844                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: received unknown type neighbor solicitation request");
845                 return;
846         }
847
848         /* Create pseudo header */
849
850         pseudo.ip6_src = ip6.ip6_src;
851         pseudo.ip6_dst = ip6.ip6_dst;
852
853         if(has_opt) {
854                 pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
855         } else {
856                 pseudo.length = htonl(ns_size);
857         }
858
859         pseudo.next = htonl(IPPROTO_ICMPV6);
860
861         /* Generate checksum */
862
863         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
864         checksum = inet_checksum(&ns, ns_size, checksum);
865
866         if(has_opt) {
867                 checksum = inet_checksum(&opt, opt_size, checksum);
868                 checksum = inet_checksum(DATA(packet) + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
869         }
870
871         if(checksum) {
872                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: checksum error for neighbor solicitation request");
873                 return;
874         }
875
876         /* Check if the IPv6 address exists on the VPN */
877
878         subnet = lookup_subnet_ipv6((ipv6_t *) &ns.nd_ns_target);
879
880         if(!subnet) {
881                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: neighbor solicitation request for unknown address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
882                        ntohs(((uint16_t *) &ns.nd_ns_target)[0]),
883                        ntohs(((uint16_t *) &ns.nd_ns_target)[1]),
884                        ntohs(((uint16_t *) &ns.nd_ns_target)[2]),
885                        ntohs(((uint16_t *) &ns.nd_ns_target)[3]),
886                        ntohs(((uint16_t *) &ns.nd_ns_target)[4]),
887                        ntohs(((uint16_t *) &ns.nd_ns_target)[5]),
888                        ntohs(((uint16_t *) &ns.nd_ns_target)[6]),
889                        ntohs(((uint16_t *) &ns.nd_ns_target)[7]));
890
891                 return;
892         }
893
894         /* Check if it is for our own subnet */
895
896         if(subnet->owner == myself) {
897                 return;        /* silently ignore */
898         }
899
900         if(decrement_ttl)
901                 if(!do_decrement_ttl(source, packet)) {
902                         return;
903                 }
904
905         /* Create neighbor advertation reply */
906
907         memcpy(DATA(packet), DATA(packet) + ETH_ALEN, ETH_ALEN); /* copy destination address */
908         DATA(packet)[ETH_ALEN * 2 - 1] ^= 0xFF;                  /* mangle source address so it looks like it's not from us */
909
910         ip6.ip6_dst = ip6.ip6_src;                               /* swap destination and source protocol address */
911         ip6.ip6_src = ns.nd_ns_target;
912
913         if(has_opt) {
914                 memcpy(DATA(packet) + ether_size + ip6_size + ns_size + opt_size, DATA(packet) + ETH_ALEN, ETH_ALEN);        /* add fake source hard addr */
915         }
916
917         ns.nd_ns_cksum = 0;
918         ns.nd_ns_type = ND_NEIGHBOR_ADVERT;
919         ns.nd_ns_reserved = htonl(0x40000000UL);                 /* Set solicited flag */
920         opt.nd_opt_type = ND_OPT_TARGET_LINKADDR;
921
922         /* Create pseudo header */
923
924         pseudo.ip6_src = ip6.ip6_src;
925         pseudo.ip6_dst = ip6.ip6_dst;
926
927         if(has_opt) {
928                 pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
929         } else {
930                 pseudo.length = htonl(ns_size);
931         }
932
933         pseudo.next = htonl(IPPROTO_ICMPV6);
934
935         /* Generate checksum */
936
937         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
938         checksum = inet_checksum(&ns, ns_size, checksum);
939
940         if(has_opt) {
941                 checksum = inet_checksum(&opt, opt_size, checksum);
942                 checksum = inet_checksum(DATA(packet) + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
943         }
944
945         ns.nd_ns_hdr.icmp6_cksum = checksum;
946
947         /* Copy structs on stack back to packet */
948
949         memcpy(DATA(packet) + ether_size, &ip6, ip6_size);
950         memcpy(DATA(packet) + ether_size + ip6_size, &ns, ns_size);
951
952         if(has_opt) {
953                 memcpy(DATA(packet) + ether_size + ip6_size + ns_size, &opt, opt_size);
954         }
955
956         send_packet(source, packet);
957 }
958
959 /* RFC 826 */
960
961 static void route_arp(node_t *source, vpn_packet_t *packet) {
962         struct ether_arp arp;
963         subnet_t *subnet;
964         struct in_addr addr;
965
966         if(!checklength(source, packet, ether_size + arp_size)) {
967                 return;
968         }
969
970         if(source != myself) {
971                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Got ARP request from %s (%s) while in router mode!", source->name, source->hostname);
972                 return;
973         }
974
975         /* First, snatch the source address from the ARP packet */
976
977         if(overwrite_mac) {
978                 memcpy(mymac.x, DATA(packet) + ETH_ALEN, ETH_ALEN);
979         }
980
981         /* Copy headers from packet to structs on the stack */
982
983         memcpy(&arp, DATA(packet) + ether_size, arp_size);
984
985         /* Check if this is a valid ARP request */
986
987         if(ntohs(arp.arp_hrd) != ARPHRD_ETHER || ntohs(arp.arp_pro) != ETH_P_IP ||
988                         arp.arp_hln != ETH_ALEN || arp.arp_pln != sizeof(addr) || ntohs(arp.arp_op) != ARPOP_REQUEST) {
989                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: received unknown type ARP request");
990                 return;
991         }
992
993         /* Check if the IPv4 address exists on the VPN */
994
995         subnet = lookup_subnet_ipv4((ipv4_t *) &arp.arp_tpa);
996
997         if(!subnet) {
998                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet: ARP request for unknown address %d.%d.%d.%d",
999                        arp.arp_tpa[0], arp.arp_tpa[1], arp.arp_tpa[2],
1000                        arp.arp_tpa[3]);
1001                 return;
1002         }
1003
1004         /* Check if it is for our own subnet */
1005
1006         if(subnet->owner == myself) {
1007                 return;        /* silently ignore */
1008         }
1009
1010         if(decrement_ttl)
1011                 if(!do_decrement_ttl(source, packet)) {
1012                         return;
1013                 }
1014
1015         memcpy(&addr, arp.arp_tpa, sizeof(addr));                 /* save protocol addr */
1016         memcpy(arp.arp_tpa, arp.arp_spa, sizeof(addr));           /* swap destination and source protocol address */
1017         memcpy(arp.arp_spa, &addr, sizeof(addr));                 /* ... */
1018
1019         memcpy(arp.arp_tha, arp.arp_sha, ETH_ALEN);              /* set target hard/proto addr */
1020         memcpy(arp.arp_sha, DATA(packet) + ETH_ALEN, ETH_ALEN);  /* set source hard/proto addr */
1021         arp.arp_sha[ETH_ALEN - 1] ^= 0xFF;                       /* for consistency with route_packet() */
1022         arp.arp_op = htons(ARPOP_REPLY);
1023
1024         /* Copy structs on stack back to packet */
1025
1026         memcpy(DATA(packet) + ether_size, &arp, arp_size);
1027
1028         send_packet(source, packet);
1029 }
1030
1031 static void route_mac(node_t *source, vpn_packet_t *packet) {
1032         subnet_t *subnet;
1033         mac_t dest;
1034
1035         /* Learn source address */
1036
1037         if(source == myself) {
1038                 mac_t src;
1039                 memcpy(&src, &DATA(packet)[6], sizeof(src));
1040                 learn_mac(&src);
1041         }
1042
1043         /* Lookup destination address */
1044
1045         memcpy(&dest, &DATA(packet)[0], sizeof(dest));
1046         subnet = lookup_subnet_mac(NULL, &dest);
1047
1048         if(!subnet || !subnet->owner) {
1049                 route_broadcast(source, packet);
1050                 return;
1051         }
1052
1053         if(subnet->owner == source) {
1054                 logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
1055                 return;
1056         }
1057
1058         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself) {
1059                 return;
1060         }
1061
1062         if(decrement_ttl && source != myself && subnet->owner != myself)
1063                 if(!do_decrement_ttl(source, packet)) {
1064                         return;
1065                 }
1066
1067         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
1068
1069         if(priorityinheritance) {
1070                 if(type == ETH_P_IP && packet->len >= ether_size + ip_size) {
1071                         packet->priority = DATA(packet)[15];
1072                 } else if(type == ETH_P_IPV6 && packet->len >= ether_size + ip6_size) {
1073                         packet->priority = ((DATA(packet)[14] & 0x0f) << 4) | (DATA(packet)[15] >> 4);
1074                 }
1075         }
1076
1077         // Handle packets larger than PMTU
1078
1079         node_t *via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
1080
1081         if(directonly && subnet->owner != via) {
1082                 return;
1083         }
1084
1085         if(via && packet->len > via->mtu && via != myself) {
1086                 logger(DEBUG_TRAFFIC, LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
1087                 length_t ethlen = 14;
1088
1089                 if(type == ETH_P_8021Q) {
1090                         type = DATA(packet)[16] << 8 | DATA(packet)[17];
1091                         ethlen += 4;
1092                 }
1093
1094                 if(type == ETH_P_IP && packet->len > 576 + ethlen) {
1095                         if(DATA(packet)[6 + ethlen] & 0x40) {
1096                                 packet->len = via->mtu;
1097                                 route_ipv4_unreachable(source, packet, ethlen, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
1098                         } else {
1099                                 fragment_ipv4_packet(via, packet, ethlen);
1100                         }
1101
1102                         return;
1103                 } else if(type == ETH_P_IPV6 && packet->len > 1280 + ethlen) {
1104                         packet->len = via->mtu;
1105                         route_ipv6_unreachable(source, packet, ethlen, ICMP6_PACKET_TOO_BIG, 0);
1106                         return;
1107                 }
1108         }
1109
1110         clamp_mss(source, via, packet);
1111
1112         send_packet(subnet->owner, packet);
1113 }
1114
1115 static void send_pcap(vpn_packet_t *packet) {
1116         pcap = false;
1117
1118         for list_each(connection_t, c, connection_list) {
1119                 if(!c->status.pcap) {
1120                         continue;
1121                 }
1122
1123                 pcap = true;
1124                 int len = packet->len;
1125
1126                 if(c->outmaclength && c->outmaclength < len) {
1127                         len = c->outmaclength;
1128                 }
1129
1130                 if(send_request(c, "%d %d %d", CONTROL, REQ_PCAP, len)) {
1131                         send_meta(c, (char *)DATA(packet), len);
1132                 }
1133         }
1134 }
1135
1136 void route(node_t *source, vpn_packet_t *packet) {
1137         if(pcap) {
1138                 send_pcap(packet);
1139         }
1140
1141         if(forwarding_mode == FMODE_KERNEL && source != myself) {
1142                 send_packet(myself, packet);
1143                 return;
1144         }
1145
1146         if(!checklength(source, packet, ether_size)) {
1147                 return;
1148         }
1149
1150         uint16_t type = DATA(packet)[12] << 8 | DATA(packet)[13];
1151
1152         switch(routing_mode) {
1153         case RMODE_ROUTER:
1154                 switch(type) {
1155                 case ETH_P_ARP:
1156                         route_arp(source, packet);
1157                         break;
1158
1159                 case ETH_P_IP:
1160                         route_ipv4(source, packet);
1161                         break;
1162
1163                 case ETH_P_IPV6:
1164                         route_ipv6(source, packet);
1165                         break;
1166
1167                 default:
1168                         logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot route packet from %s (%s): unknown type %hx", source->name, source->hostname, type);
1169                         break;
1170                 }
1171
1172                 break;
1173
1174         case RMODE_SWITCH:
1175                 route_mac(source, packet);
1176                 break;
1177
1178         case RMODE_HUB:
1179                 route_broadcast(source, packet);
1180                 break;
1181         }
1182 }