GitHub CI: update list of container images
[tinc] / src / net_packet.c
index 1fdc0fe..0b95a93 100644 (file)
@@ -1,7 +1,7 @@
 /*
     net_packet.c -- Handles in- and outgoing VPN packets
     Copyright (C) 1998-2005 Ivo Timmermans,
-                  2000-2014 Guus Sliepen <guus@tinc-vpn.org>
+                  2000-2022 Guus Sliepen <guus@tinc-vpn.org>
                   2010      Timothy Redaelli <timothy@redaelli.eu>
                   2010      Brandon Black <blblack@gmail.com>
 
 #include "system.h"
 
 #ifdef HAVE_ZLIB
+#define ZLIB_CONST
 #include <zlib.h>
+
 #endif
 
 #ifdef HAVE_LZO
 #include LZO1X_H
 #endif
 
+#ifdef HAVE_LZ4
+#include <lz4.h>
+#endif
+
+#include "address_cache.h"
 #include "cipher.h"
 #include "conf.h"
 #include "connection.h"
+#include "compression.h"
 #include "crypto.h"
 #include "digest.h"
 #include "device.h"
 #include "ethernet.h"
 #include "ipv4.h"
 #include "ipv6.h"
-#include "graph.h"
 #include "logger.h"
 #include "net.h"
 #include "netutl.h"
 #include "protocol.h"
 #include "route.h"
 #include "utils.h"
-#include "xalloc.h"
-
-#ifndef MAX
-#define MAX(a, b) ((a) > (b) ? (a) : (b))
-#endif
+#include "random.h"
 
 /* The minimum size of a probe is 14 bytes, but since we normally use CBC mode
    encryption, we can add a few extra random bytes without increasing the
@@ -62,6 +65,16 @@ int keylifetime = 0;
 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
 #endif
 
+#ifdef HAVE_LZ4
+
+#ifdef HAVE_LZ4_BUILTIN
+static LZ4_stream_t lz4_stream;
+#else
+static void *lz4_state = NULL;
+#endif // HAVE_LZ4_BUILTIN
+
+#endif // HAVE_LZ4
+
 static void send_udppacket(node_t *, vpn_packet_t *);
 
 unsigned replaywin = 32;
@@ -74,27 +87,49 @@ int udp_discovery_timeout = 30;
 #define MAX_SEQNO 1073741824
 
 static void try_fix_mtu(node_t *n) {
-       if(n->mtuprobes < 0)
+       if(n->mtuprobes < 0) {
                return;
+       }
 
        if(n->mtuprobes == 20 || n->minmtu >= n->maxmtu) {
-               if(n->minmtu > n->maxmtu)
+               if(n->minmtu > n->maxmtu) {
                        n->minmtu = n->maxmtu;
-               else
+               } else {
                        n->maxmtu = n->minmtu;
+               }
+
                n->mtu = n->minmtu;
                logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
                n->mtuprobes = -1;
        }
 }
 
+static void reduce_mtu(node_t *n, int mtu) {
+       if(mtu < MINMTU) {
+               mtu = MINMTU;
+       }
+
+       if(n->maxmtu > mtu) {
+               n->maxmtu = mtu;
+       }
+
+       if(n->mtu > mtu) {
+               n->mtu = mtu;
+       }
+
+       try_fix_mtu(n);
+}
+
 static void udp_probe_timeout_handler(void *data) {
        node_t *n = data;
-       if(!n->status.udp_confirmed)
+
+       if(!n->status.udp_confirmed) {
                return;
+       }
 
        logger(DEBUG_TRAFFIC, LOG_INFO, "Too much time has elapsed since last UDP ping response from %s (%s), stopping UDP communication", n->name, n->hostname);
        n->status.udp_confirmed = false;
+       n->udp_ping_rtt = -1;
        n->maxrecentlen = 0;
        n->mtuprobes = 0;
        n->minmtu = 0;
@@ -108,7 +143,7 @@ static void send_udp_probe_reply(node_t *n, vpn_packet_t *packet, length_t len)
        }
 
        /* Type 2 probe replies were introduced in protocol 17.3 */
-       if ((n->options >> 24) >= 3) {
+       if((n->options >> 24) >= 3) {
                DATA(packet)[0] = 2;
                uint16_t len16 = htons(len);
                memcpy(DATA(packet) + 1, &len16, 2);
@@ -133,29 +168,51 @@ static void send_udp_probe_reply(node_t *n, vpn_packet_t *packet, length_t len)
 static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
        if(!DATA(packet)[0]) {
                logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request %d from %s (%s)", packet->len, n->name, n->hostname);
-               return send_udp_probe_reply(n, packet, len);
+               send_udp_probe_reply(n, packet, len);
+               return;
        }
 
-       if (DATA(packet)[0] == 2) {
+       if(DATA(packet)[0] == 2) {
                // It's a type 2 probe reply, use the length field inside the packet
                uint16_t len16;
                memcpy(&len16, DATA(packet) + 1, 2);
                len = ntohs(len16);
        }
 
-       logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], len, n->name, n->hostname);
+       if(n->status.ping_sent) {  // a probe in flight
+               gettimeofday(&now, NULL);
+               struct timeval rtt;
+               timersub(&now, &n->udp_ping_sent, &rtt);
+               n->udp_ping_rtt = (int)(rtt.tv_sec * 1000000 + rtt.tv_usec);
+               n->status.ping_sent = false;
+               logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s) rtt=%d.%03d", DATA(packet)[0], len, n->name, n->hostname, n->udp_ping_rtt / 1000, n->udp_ping_rtt % 1000);
+       } else {
+               logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], len, n->name, n->hostname);
+       }
 
        /* It's a valid reply: now we know bidirectional communication
           is possible using the address and socket that the reply
           packet used. */
-       n->status.udp_confirmed = true;
+       if(!n->status.udp_confirmed) {
+               n->status.udp_confirmed = true;
+
+               if(!n->address_cache) {
+                       n->address_cache = open_address_cache(n);
+               }
+
+               if(n->connection && n->connection->edge) {
+                       reset_address_cache(n->address_cache);
+                       add_recent_address(n->address_cache, &n->connection->edge->address);
+               }
+       }
 
        // Reset the UDP ping timer.
-       n->udp_ping_sent = now;
 
        if(udp_discovery) {
                timeout_del(&n->udp_ping_timeout);
-               timeout_add(&n->udp_ping_timeout, &udp_probe_timeout_handler, n, &(struct timeval){udp_discovery_timeout, 0});
+               timeout_add(&n->udp_ping_timeout, &udp_probe_timeout_handler, n, &(struct timeval) {
+                       udp_discovery_timeout, 0
+               });
        }
 
        if(len > n->maxmtu) {
@@ -179,70 +236,162 @@ static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
        }
 }
 
-static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
-       if(level == 0) {
-               memcpy(dest, source, len);
-               return len;
-       } else if(level == 10) {
+#ifdef HAVE_LZ4
+static length_t compress_packet_lz4(uint8_t *dest, const uint8_t *source, length_t len) {
+#ifdef HAVE_LZ4_BUILTIN
+       return LZ4_compress_fast_extState(&lz4_stream, (const char *) source, (char *) dest, len, MAXSIZE, 0);
+#else
+
+       /* @FIXME: Put this in a better place, and free() it too. */
+       if(lz4_state == NULL) {
+               lz4_state = malloc(LZ4_sizeofState());
+       }
+
+       if(lz4_state == NULL) {
+               logger(DEBUG_ALWAYS, LOG_ERR, "Failed to allocate lz4_state, error: %i", errno);
+               return 0;
+       }
+
+       return LZ4_compress_fast_extState(lz4_state, (const char *) source, (char *) dest, len, MAXSIZE, 0);
+#endif /* HAVE_LZ4_BUILTIN */
+}
+#endif /* HAVE_LZ4 */
+
 #ifdef HAVE_LZO
-               lzo_uint lzolen = MAXSIZE;
-               lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
+static length_t compress_packet_lzo(uint8_t *dest, const uint8_t *source, length_t len, compression_level_t level) {
+       lzo_uint lzolen = MAXSIZE;
+       int result;
+
+       if(level == COMPRESS_LZO_HI) {
+               result = lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
+       } else { // level == COMPRESS_LZO_LO
+               result = lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
+       }
+
+       if(result == LZO_E_OK) {
                return lzolen;
-#else
-               return -1;
+       } else {
+               return 0;
+       }
+}
 #endif
-       } else if(level < 10) {
-#ifdef HAVE_ZLIB
-               unsigned long destlen = MAXSIZE;
-               if(compress2(dest, &destlen, source, len, level) == Z_OK)
-                       return destlen;
-               else
+
+static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, compression_level_t level) {
+       switch(level) {
+#ifdef HAVE_LZ4
+
+       case COMPRESS_LZ4:
+               return compress_packet_lz4(dest, source, len);
 #endif
-                       return -1;
-       } else {
+
 #ifdef HAVE_LZO
-               lzo_uint lzolen = MAXSIZE;
-               lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
-               return lzolen;
-#else
-               return -1;
+
+       case COMPRESS_LZO_HI:
+       case COMPRESS_LZO_LO:
+               return compress_packet_lzo(dest, source, len, level);
 #endif
+#ifdef HAVE_ZLIB
+
+       case COMPRESS_ZLIB_9:
+       case COMPRESS_ZLIB_8:
+       case COMPRESS_ZLIB_7:
+       case COMPRESS_ZLIB_6:
+       case COMPRESS_ZLIB_5:
+       case COMPRESS_ZLIB_4:
+       case COMPRESS_ZLIB_3:
+       case COMPRESS_ZLIB_2:
+       case COMPRESS_ZLIB_1: {
+               unsigned long dest_len = MAXSIZE;
+
+               if(compress2(dest, &dest_len, source, len, level) == Z_OK) {
+                       return dest_len;
+               } else {
+                       return 0;
+               }
        }
 
-       return -1;
-}
+#endif
 
-static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
-       if(level == 0) {
+       case COMPRESS_NONE:
                memcpy(dest, source, len);
                return len;
-       } else if(level > 9) {
-#ifdef HAVE_LZO
-               lzo_uint lzolen = MAXSIZE;
-               if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
-                       return lzolen;
-               else
+
+       default:
+               return 0;
+       }
+}
+
+static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, compression_level_t level) {
+       switch(level) {
+#ifdef HAVE_LZ4
+
+       case COMPRESS_LZ4:
+               return LZ4_decompress_safe((char *)source, (char *) dest, len, MAXSIZE);
+
 #endif
-                       return -1;
+#ifdef HAVE_LZO
+
+       case COMPRESS_LZO_HI:
+       case COMPRESS_LZO_LO: {
+               lzo_uint dst_len = MAXSIZE;
+
+               if(lzo1x_decompress_safe(source, len, dest, &dst_len, NULL) == LZO_E_OK) {
+                       return dst_len;
+               } else {
+                       return 0;
+               }
        }
+
+#endif
 #ifdef HAVE_ZLIB
-       else {
+
+       case COMPRESS_ZLIB_9:
+       case COMPRESS_ZLIB_8:
+       case COMPRESS_ZLIB_7:
+       case COMPRESS_ZLIB_6:
+       case COMPRESS_ZLIB_5:
+       case COMPRESS_ZLIB_4:
+       case COMPRESS_ZLIB_3:
+       case COMPRESS_ZLIB_2:
+       case COMPRESS_ZLIB_1: {
                unsigned long destlen = MAXSIZE;
-               if(uncompress(dest, &destlen, source, len) == Z_OK)
-                       return destlen;
-               else
-                       return -1;
+               static z_stream stream;
+
+               if(stream.next_in) {
+                       inflateReset(&stream);
+               } else {
+                       inflateInit(&stream);
+               }
+
+               stream.next_in = source;
+               stream.avail_in = len;
+               stream.next_out = dest;
+               stream.avail_out = destlen;
+               stream.total_out = 0;
+
+               if(inflate(&stream, Z_FINISH) == Z_STREAM_END) {
+                       return stream.total_out;
+               } else {
+                       return 0;
+               }
        }
+
 #endif
 
-       return -1;
+       case COMPRESS_NONE:
+               memcpy(dest, source, len);
+               return len;
+
+       default:
+               return 0;
+       }
 }
 
 /* VPN packet I/O */
 
 static void receive_packet(node_t *n, vpn_packet_t *packet) {
        logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
-                          packet->len, n->name, n->hostname);
+              packet->len, n->name, n->hostname);
 
        n->in_packets++;
        n->in_bytes += packet->len;
@@ -251,27 +400,23 @@ static void receive_packet(node_t *n, vpn_packet_t *packet) {
 }
 
 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
-       if(n->status.sptps)
+       if(n->status.sptps) {
                return sptps_verify_datagram(&n->sptps, DATA(inpkt), inpkt->len);
+       }
 
 #ifdef DISABLE_LEGACY
        return false;
 #else
-       if(!n->status.validkey_in || !digest_active(n->indigest) || inpkt->len < sizeof(seqno_t) + digest_length(n->indigest))
+
+       if(!n->status.validkey_in || !digest_active(n->indigest) || (size_t)inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) {
                return false;
+       }
 
-       return digest_verify(n->indigest, SEQNO(inpkt), inpkt->len - digest_length(n->indigest), DATA(inpkt) + inpkt->len - digest_length(n->indigest));
+       return digest_verify(n->indigest, inpkt->data, inpkt->len - digest_length(n->indigest), inpkt->data + inpkt->len - digest_length(n->indigest));
 #endif
 }
 
 static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
-       vpn_packet_t pkt1, pkt2;
-       vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
-       int nextpkt = 0;
-       size_t outlen;
-       pkt1.offset = DEFAULT_PACKET_OFFSET;
-       pkt2.offset = DEFAULT_PACKET_OFFSET;
-
        if(n->status.sptps) {
                if(!n->sptps.state) {
                        if(!n->status.waitingforkey) {
@@ -280,23 +425,40 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
                        } else {
                                logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
                        }
+
                        return false;
                }
-               inpkt->offset += 2 * sizeof(node_id_t);
+
                n->status.udppacket = true;
-               bool result = sptps_receive_data(&n->sptps, DATA(inpkt), inpkt->len - 2 * sizeof(node_id_t));
+               bool result = sptps_receive_data(&n->sptps, DATA(inpkt), inpkt->len);
                n->status.udppacket = false;
 
                if(!result) {
-                       logger(DEBUG_TRAFFIC, LOG_ERR, "Got bad packet from %s (%s)", n->name, n->hostname);
+                       /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
+                          so let's restart SPTPS in case that helps. But don't do that too often
+                          to prevent storms, and because that would make life a little too easy
+                          for external attackers trying to DoS us. */
+                       if(n->last_req_key < now.tv_sec - 10) {
+                               logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode raw TCP packet from %s (%s), restarting SPTPS", n->name, n->hostname);
+                               send_req_key(n);
+                       }
+
                        return false;
                }
+
                return true;
        }
 
 #ifdef DISABLE_LEGACY
        return false;
 #else
+       vpn_packet_t pkt1, pkt2;
+       vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
+       int nextpkt = 0;
+       size_t outlen;
+       pkt1.offset = DEFAULT_PACKET_OFFSET;
+       pkt2.offset = DEFAULT_PACKET_OFFSET;
+
        if(!n->status.validkey_in) {
                logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
                return false;
@@ -304,9 +466,9 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 
        /* Check packet length */
 
-       if(inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) {
+       if((size_t)inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) {
                logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
-                                       n->name, n->hostname);
+                      n->name, n->hostname);
                return false;
        }
 
@@ -318,11 +480,13 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 
        if(digest_active(n->indigest)) {
                inpkt->len -= digest_length(n->indigest);
+
                if(!digest_verify(n->indigest, SEQNO(inpkt), inpkt->len, SEQNO(inpkt) + inpkt->len)) {
                        logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
                        return false;
                }
        }
+
        /* Decrypt the packet */
 
        if(cipher_active(n->incipher)) {
@@ -341,30 +505,32 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        /* Check the sequence number */
 
        seqno_t seqno;
-       memcpy(&seqno, SEQNO(inpkt), sizeof seqno);
+       memcpy(&seqno, SEQNO(inpkt), sizeof(seqno));
        seqno = ntohl(seqno);
-       inpkt->len -= sizeof seqno;
+       inpkt->len -= sizeof(seqno);
 
        if(replaywin) {
                if(seqno != n->received_seqno + 1) {
                        if(seqno >= n->received_seqno + replaywin * 8) {
                                if(n->farfuture++ < replaywin >> 2) {
-                                       logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
-                                               n->name, n->hostname, seqno - n->received_seqno - 1, n->farfuture);
+                                       logger(DEBUG_TRAFFIC, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
+                                              n->name, n->hostname, seqno - n->received_seqno - 1, n->farfuture);
                                        return false;
                                }
-                               logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
-                                               seqno - n->received_seqno - 1, n->name, n->hostname);
+
+                               logger(DEBUG_TRAFFIC, LOG_WARNING, "Lost %d packets from %s (%s)",
+                                      seqno - n->received_seqno - 1, n->name, n->hostname);
                                memset(n->late, 0, replaywin);
-                       } else if (seqno <= n->received_seqno) {
+                       } else if(seqno <= n->received_seqno) {
                                if((n->received_seqno >= replaywin * 8 && seqno <= n->received_seqno - replaywin * 8) || !(n->late[(seqno / 8) % replaywin] & (1 << seqno % 8))) {
-                                       logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
-                                               n->name, n->hostname, seqno, n->received_seqno);
+                                       logger(DEBUG_TRAFFIC, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
+                                              n->name, n->hostname, seqno, n->received_seqno);
                                        return false;
                                }
                        } else {
-                               for(int i = n->received_seqno + 1; i < seqno; i++)
+                               for(seqno_t i = n->received_seqno + 1; i < seqno; i++) {
                                        n->late[(i / 8) % replaywin] |= 1 << i % 8;
+                               }
                        }
                }
 
@@ -372,133 +538,172 @@ static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
                n->late[(seqno / 8) % replaywin] &= ~(1 << seqno % 8);
        }
 
-       if(seqno > n->received_seqno)
+       if(seqno > n->received_seqno) {
                n->received_seqno = seqno;
+       }
 
        n->received++;
 
-       if(n->received_seqno > MAX_SEQNO)
+       if(n->received_seqno > MAX_SEQNO) {
                regenerate_key();
+       }
 
        /* Decompress the packet */
 
        length_t origlen = inpkt->len;
 
-       if(n->incompression) {
+       if(n->incompression != COMPRESS_NONE) {
                vpn_packet_t *outpkt = pkt[nextpkt++];
 
-               if((outpkt->len = uncompress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->incompression)) < 0) {
+               if(!(outpkt->len = uncompress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->incompression))) {
                        logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
-                                                n->name, n->hostname);
+                              n->name, n->hostname);
                        return false;
                }
 
                inpkt = outpkt;
 
-               origlen -= MTU/64 + 20;
+               if(origlen > MTU / 64 + 20) {
+                       origlen -= MTU / 64 + 20;
+               } else {
+                       origlen = 0;
+               }
        }
 
-       if(inpkt->len > n->maxrecentlen)
+       if(inpkt->len > n->maxrecentlen) {
                n->maxrecentlen = inpkt->len;
+       }
 
        inpkt->priority = 0;
 
-       if(!DATA(inpkt)[12] && !DATA(inpkt)[13])
+       if(!DATA(inpkt)[12] && !DATA(inpkt)[13]) {
                udp_probe_h(n, inpkt, origlen);
-       else
+       } else {
                receive_packet(n, inpkt);
+       }
+
        return true;
 #endif
 }
 
-void receive_tcppacket(connection_t *c, const char *buffer, int len) {
+void receive_tcppacket(connection_t *c, const char *buffer, size_t len) {
        vpn_packet_t outpkt;
        outpkt.offset = DEFAULT_PACKET_OFFSET;
 
-       if(len > sizeof outpkt.data - outpkt.offset)
+       if(len > sizeof(outpkt.data) - outpkt.offset) {
                return;
+       }
 
        outpkt.len = len;
-       if(c->options & OPTION_TCPONLY)
+
+       if(c->options & OPTION_TCPONLY) {
                outpkt.priority = 0;
-       else
+       } else {
                outpkt.priority = -1;
+       }
+
        memcpy(DATA(&outpkt), buffer, len);
 
        receive_packet(c->node, &outpkt);
 }
 
-bool receive_tcppacket_sptps(connection_t *c, const char *data, int len) {
-       if (len < sizeof(node_id_t) + sizeof(node_id_t)) {
-               logger(DEBUG_ALWAYS, LOG_ERR, "Got too short TCP SPTPS packet from %s (%s)", c->name, c->hostname);
+bool receive_tcppacket_sptps(connection_t *c, const char *data, size_t len) {
+       if(len < sizeof(node_id_t) + sizeof(node_id_t)) {
+               logger(DEBUG_PROTOCOL, LOG_ERR, "Got too short TCP SPTPS packet from %s (%s)", c->name, c->hostname);
                return false;
        }
 
        node_t *to = lookup_node_id((node_id_t *)data);
-       data += sizeof(node_id_t); len -= sizeof(node_id_t);
+       data += sizeof(node_id_t);
+       len -= sizeof(node_id_t);
+
        if(!to) {
                logger(DEBUG_PROTOCOL, LOG_ERR, "Got TCP SPTPS packet from %s (%s) with unknown destination ID", c->name, c->hostname);
                return true;
        }
 
        node_t *from = lookup_node_id((node_id_t *)data);
-       data += sizeof(node_id_t); len -= sizeof(node_id_t);
+       data += sizeof(node_id_t);
+       len -= sizeof(node_id_t);
+
        if(!from) {
                logger(DEBUG_PROTOCOL, LOG_ERR, "Got TCP SPTPS packet from %s (%s) with unknown source ID", c->name, c->hostname);
                return true;
        }
 
+       if(!to->status.reachable) {
+               /* This can happen in the form of a race condition
+                  if the node just became unreachable. */
+               logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot relay TCP packet from %s (%s) because the destination, %s (%s), is unreachable", from->name, from->hostname, to->name, to->hostname);
+               return true;
+       }
+
        /* Help the sender reach us over UDP.
           Note that we only do this if we're the destination or the static relay;
           otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */
-       if(to->via == myself)
+       if(to->via == myself) {
                send_udp_info(myself, from);
+       }
 
        /* If we're not the final recipient, relay the packet. */
 
        if(to != myself) {
-               send_sptps_data(to, from, 0, data, len);
+               if(to->status.validkey) {
+                       send_sptps_data(to, from, 0, data, len);
+               }
+
                try_tx(to, true);
                return true;
        }
 
        /* The packet is for us */
 
-       if(!from->status.validkey) {
-               logger(DEBUG_PROTOCOL, LOG_ERR, "Got SPTPS packet from %s (%s) but we don't have a valid key yet", from->name, from->hostname);
+       if(!sptps_receive_data(&from->sptps, data, len)) {
+               /* Uh-oh. It might be that the tunnel is stuck in some corrupted state,
+                  so let's restart SPTPS in case that helps. But don't do that too often
+                  to prevent storms. */
+               if(from->last_req_key < now.tv_sec - 10) {
+                       logger(DEBUG_PROTOCOL, LOG_ERR, "Failed to decode raw TCP packet from %s (%s), restarting SPTPS", from->name, from->hostname);
+                       send_req_key(from);
+               }
+
                return true;
        }
-       sptps_receive_data(&from->sptps, data, len);
+
        send_mtu_info(myself, from, MTU);
        return true;
 }
 
 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
-       if(!n->status.validkey && !n->connection)
+       if(!n->status.validkey && !n->connection) {
                return;
+       }
 
        uint8_t type = 0;
        int offset = 0;
 
-       if(!(DATA(origpkt)[12] | DATA(origpkt)[13])) {
-               sptps_send_record(&n->sptps, PKT_PROBE, (char *)DATA(origpkt), origpkt->len);
+       if((!(DATA(origpkt)[12] | DATA(origpkt)[13])) && (n->sptps.outstate))  {
+               sptps_send_record(&n->sptps, PKT_PROBE, DATA(origpkt), origpkt->len);
                return;
        }
 
-       if(routing_mode == RMODE_ROUTER)
+       if(routing_mode == RMODE_ROUTER) {
                offset = 14;
-       else
+       } else {
                type = PKT_MAC;
+       }
 
-       if(origpkt->len < offset)
+       if(origpkt->len < offset) {
                return;
+       }
 
        vpn_packet_t outpkt;
 
-       if(n->outcompression) {
+       if(n->outcompression != COMPRESS_NONE) {
                outpkt.offset = 0;
-               int len = compress_packet(DATA(&outpkt) + offset, DATA(origpkt) + offset, origpkt->len - offset, n->outcompression);
-               if(len < 0) {
+               length_t len = compress_packet(DATA(&outpkt) + offset, DATA(origpkt) + offset, origpkt->len - offset, n->outcompression);
+
+               if(!len) {
                        logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
                } else if(len < origpkt->len - offset) {
                        outpkt.len = len + offset;
@@ -511,14 +716,14 @@ static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
           don't bother with SPTPS and just use a "plaintext" PACKET message.
           We don't really care about end-to-end security since we're not
           sending the message through any intermediate nodes. */
-       if(n->connection && origpkt->len > n->minmtu)
+       if(n->connection && origpkt->len > n->minmtu) {
                send_tcppacket(n->connection, origpkt);
-       else
+       } else {
                sptps_send_record(&n->sptps, type, DATA(origpkt) + offset, origpkt->len - offset);
-       return;
+       }
 }
 
-static void adapt_socket(const sockaddr_t *sa, int *sock) {
+static void adapt_socket(const sockaddr_t *sa, size_t *sock) {
        /* Make sure we have a suitable socket for the chosen address */
        if(listen_socket[*sock].sa.sa.sa_family != sa->sa.sa_family) {
                for(int i = 0; i < listen_sockets; i++) {
@@ -530,20 +735,22 @@ static void adapt_socket(const sockaddr_t *sa, int *sock) {
        }
 }
 
-static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
+static void choose_udp_address(const node_t *n, const sockaddr_t **sa, size_t *sock) {
        /* Latest guess */
        *sa = &n->address;
        *sock = n->sock;
 
        /* If the UDP address is confirmed, use it. */
-       if(n->status.udp_confirmed)
+       if(n->status.udp_confirmed) {
                return;
+       }
 
        /* Send every third packet to n->address; that could be set
           to the node's reflexive UDP address discovered during key
           exchange. */
 
        static int x = 0;
+
        if(++x >= 3) {
                x = 0;
                return;
@@ -552,11 +759,11 @@ static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock
        /* Otherwise, address are found in edges to this node.
           So we pick a random edge and a random socket. */
 
-       int i = 0;
-       int j = rand() % n->edge_tree->count;
+       unsigned int i = 0;
+       unsigned int j = prng(n->edge_tree.count);
        edge_t *candidate = NULL;
 
-       for splay_each(edge_t, e, n->edge_tree) {
+       for splay_each(edge_t, e, &n->edge_tree) {
                if(i++ == j) {
                        candidate = e->reverse;
                        break;
@@ -565,36 +772,49 @@ static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock
 
        if(candidate) {
                *sa = &candidate->address;
-               *sock = rand() % listen_sockets;
+               *sock = prng(listen_sockets);
        }
 
        adapt_socket(*sa, sock);
 }
 
-static void choose_local_address(const node_t *n, const sockaddr_t **sa, int *sock) {
+static void choose_local_address(const node_t *n, const sockaddr_t **sa, size_t *sock) {
        *sa = NULL;
 
        /* Pick one of the edges from this node at random, then use its local address. */
 
-       int i = 0;
-       int j = rand() % n->edge_tree->count;
+       unsigned int i = 0;
+       unsigned int j = prng(n->edge_tree.count);
        edge_t *candidate = NULL;
 
-       for splay_each(edge_t, e, n->edge_tree) {
+       for splay_each(edge_t, e, &n->edge_tree) {
                if(i++ == j) {
                        candidate = e;
                        break;
                }
        }
 
-       if (candidate && candidate->local_address.sa.sa_family) {
+       if(candidate && candidate->local_address.sa.sa_family) {
                *sa = &candidate->local_address;
-               *sock = rand() % listen_sockets;
+               *sock = prng(listen_sockets);
                adapt_socket(*sa, sock);
        }
 }
 
 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
+       if(!n->status.reachable) {
+               logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
+               return;
+       }
+
+       if(n->status.sptps) {
+               send_sptps_packet(n, origpkt);
+               return;
+       }
+
+#ifdef DISABLE_LEGACY
+       return;
+#else
        vpn_packet_t pkt1, pkt2;
        vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
        vpn_packet_t *inpkt = origpkt;
@@ -602,56 +822,43 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
        vpn_packet_t *outpkt;
        int origlen = origpkt->len;
        size_t outlen;
-#if defined(SOL_IP) && defined(IP_TOS)
-       static int priority = 0;
        int origpriority = origpkt->priority;
-#endif
 
        pkt1.offset = DEFAULT_PACKET_OFFSET;
        pkt2.offset = DEFAULT_PACKET_OFFSET;
 
-       if(!n->status.reachable) {
-               logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
-               return;
-       }
-
-       if(n->status.sptps)
-               return send_sptps_packet(n, origpkt);
-
-#ifdef DISABLE_LEGACY
-       return;
-#else
        /* Make sure we have a valid key */
 
        if(!n->status.validkey) {
                logger(DEBUG_TRAFFIC, LOG_INFO,
-                                  "No valid key known yet for %s (%s), forwarding via TCP",
-                                  n->name, n->hostname);
+                      "No valid key known yet for %s (%s), forwarding via TCP",
+                      n->name, n->hostname);
                send_tcppacket(n->nexthop->connection, origpkt);
                return;
        }
 
        if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (DATA(inpkt)[12] | DATA(inpkt)[13])) {
                logger(DEBUG_TRAFFIC, LOG_INFO,
-                               "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
-                               n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
+                      "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
+                      n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
 
-               if(n != n->nexthop)
+               if(n != n->nexthop) {
                        send_packet(n->nexthop, origpkt);
-               else
+               } else {
                        send_tcppacket(n->nexthop->connection, origpkt);
+               }
 
                return;
        }
 
        /* Compress the packet */
 
-       if(n->outcompression) {
+       if(n->outcompression != COMPRESS_NONE) {
                outpkt = pkt[nextpkt++];
 
-               if((outpkt->len = compress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->outcompression)) < 0) {
+               if(!(outpkt->len = compress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->outcompression))) {
                        logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
-                                  n->name, n->hostname);
+                              n->name, n->hostname);
                        return;
                }
 
@@ -661,8 +868,8 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
        /* Add sequence number */
 
        seqno_t seqno = htonl(++(n->sent_seqno));
-       memcpy(SEQNO(inpkt), &seqno, sizeof seqno);
-       inpkt->len += sizeof seqno;
+       memcpy(SEQNO(inpkt), &seqno, sizeof(seqno));
+       inpkt->len += sizeof(seqno);
 
        /* Encrypt the packet */
 
@@ -693,32 +900,54 @@ static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
        /* Send the packet */
 
        const sockaddr_t *sa = NULL;
-       int sock;
+       size_t sock;
 
-       if(n->status.send_locally)
+       if(n->status.send_locally) {
                choose_local_address(n, &sa, &sock);
-       if(!sa)
-               choose_udp_address(n, &sa, &sock);
+       }
 
-#if defined(SOL_IP) && defined(IP_TOS)
-       if(priorityinheritance && origpriority != priority
-          && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
-               priority = origpriority;
-               logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
-               if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
-                       logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", sockstrerror(sockerrno));
+       if(!sa) {
+               choose_udp_address(n, &sa, &sock);
        }
+
+       if(priorityinheritance && origpriority != listen_socket[sock].priority) {
+               listen_socket[sock].priority = origpriority;
+
+               switch(sa->sa.sa_family) {
+#if defined(IP_TOS)
+
+               case AF_INET:
+                       logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting IPv4 outgoing packet priority to %d", origpriority);
+
+                       if(setsockopt(listen_socket[sock].udp.fd, IPPROTO_IP, IP_TOS, (void *)&origpriority, sizeof(origpriority))) { /* SO_PRIORITY doesn't seem to work */
+                               logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", sockstrerror(sockerrno));
+                       }
+
+                       break;
+#endif
+#if defined(IPV6_TCLASS)
+
+               case AF_INET6:
+                       logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting IPv6 outgoing packet priority to %d", origpriority);
+
+                       if(setsockopt(listen_socket[sock].udp.fd, IPPROTO_IPV6, IPV6_TCLASS, (void *)&origpriority, sizeof(origpriority))) { /* SO_PRIORITY doesn't seem to work */
+                               logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", sockstrerror(sockerrno));
+                       }
+
+                       break;
 #endif
 
-       if(sendto(listen_socket[sock].udp.fd, SEQNO(inpkt), inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
+               default:
+                       break;
+               }
+       }
+
+       if(sendto(listen_socket[sock].udp.fd, (void *)SEQNO(inpkt), inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
                if(sockmsgsize(sockerrno)) {
-                       if(n->maxmtu >= origlen)
-                               n->maxmtu = origlen - 1;
-                       if(n->mtu >= origlen)
-                               n->mtu = origlen - 1;
-                       try_fix_mtu(n);
-               } else
+                       reduce_mtu(n, origlen - 1);
+               } else {
                        logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
+               }
        }
 
 end:
@@ -727,28 +956,35 @@ end:
 }
 
 bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_t len) {
-       node_t *relay = (to->via != myself && (type == PKT_PROBE || (len - SPTPS_DATAGRAM_OVERHEAD) <= to->via->minmtu)) ? to->via : to->nexthop;
+       size_t origlen = len - SPTPS_DATAGRAM_OVERHEAD;
+       node_t *relay = (to->via != myself && (type == PKT_PROBE || origlen <= to->via->minmtu)) ? to->via : to->nexthop;
        bool direct = from == myself && to == relay;
        bool relay_supported = (relay->options >> 24) >= 4;
        bool tcponly = (myself->options | relay->options) & OPTION_TCPONLY;
 
        /* Send it via TCP if it is a handshake packet, TCPOnly is in use, this is a relay packet that the other node cannot understand, or this packet is larger than the MTU. */
 
-       if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && (len - SPTPS_DATAGRAM_OVERHEAD) > relay->minmtu)) {
-               if((from != myself || to->status.validkey) && (to->nexthop->connection->options >> 24) >= 7) {
-                       char buf[len + sizeof to->id + sizeof from->id]; char* buf_ptr = buf;
-                       memcpy(buf_ptr, &to->id, sizeof to->id); buf_ptr += sizeof to->id;
-                       memcpy(buf_ptr, &from->id, sizeof from->id); buf_ptr += sizeof from->id;
-                       memcpy(buf_ptr, data, len); buf_ptr += len;
+       if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && origlen > relay->minmtu)) {
+               if(type != SPTPS_HANDSHAKE && (to->nexthop->connection->options >> 24) >= 7) {
+                       const size_t buflen = len + sizeof(to->id) + sizeof(from->id);
+                       uint8_t *buf = alloca(buflen);
+                       uint8_t *buf_ptr = buf;
+                       memcpy(buf_ptr, &to->id, sizeof(to->id));
+                       buf_ptr += sizeof(to->id);
+                       memcpy(buf_ptr, &from->id, sizeof(from->id));
+                       buf_ptr += sizeof(from->id);
+                       memcpy(buf_ptr, data, len);
                        logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s) (TCP)", from->name, from->hostname, to->name, to->hostname, to->nexthop->name, to->nexthop->hostname);
-                       return send_sptps_tcppacket(to->nexthop->connection, buf, sizeof buf);
+                       return send_sptps_tcppacket(to->nexthop->connection, buf, buflen);
                }
 
-               char buf[len * 4 / 3 + 5];
-               b64encode(data, buf, len);
-               /* If no valid key is known yet, send the packets using ANS_KEY requests,
-                  to ensure we get to learn the reflexive UDP address. */
-               if(from == myself && !to->status.validkey) {
+               char *buf = alloca(B64_SIZE(len));
+               b64encode_tinc(data, buf, len);
+
+               /* If this is a handshake packet, use ANS_KEY instead of REQ_KEY, for two reasons:
+                   - We don't want intermediate nodes to switch to UDP to relay these packets;
+                   - ANS_KEY allows us to learn the reflexive UDP address. */
+               if(type == SPTPS_HANDSHAKE) {
                        to->incompression = myself->incompression;
                        return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, from->name, to->name, buf, to->incompression);
                } else {
@@ -757,38 +993,50 @@ bool send_sptps_data(node_t *to, node_t *from, int type, const void *data, size_
        }
 
        size_t overhead = 0;
-       if(relay_supported) overhead += sizeof to->id + sizeof from->id;
-       char buf[len + overhead]; char* buf_ptr = buf;
+
+       if(relay_supported) {
+               overhead += sizeof(to->id) + sizeof(from->id);
+       }
+
+       char *buf = alloca(len + overhead);
+       char *buf_ptr = buf;
+
        if(relay_supported) {
                if(direct) {
                        /* Inform the recipient that this packet was sent directly. */
-                       node_id_t nullid = {};
-                       memcpy(buf_ptr, &nullid, sizeof nullid); buf_ptr += sizeof nullid;
+                       node_id_t nullid = {0};
+                       memcpy(buf_ptr, &nullid, sizeof(nullid));
+                       buf_ptr += sizeof(nullid);
                } else {
-                       memcpy(buf_ptr, &to->id, sizeof to->id); buf_ptr += sizeof to->id;
+                       memcpy(buf_ptr, &to->id, sizeof(to->id));
+                       buf_ptr += sizeof(to->id);
                }
-               memcpy(buf_ptr, &from->id, sizeof from->id); buf_ptr += sizeof from->id;
+
+               memcpy(buf_ptr, &from->id, sizeof(from->id));
+               buf_ptr += sizeof(from->id);
 
        }
+
        /* TODO: if this copy turns out to be a performance concern, change sptps_send_record() to add some "pre-padding" to the buffer and use that instead */
-       memcpy(buf_ptr, data, len); buf_ptr += len;
+       memcpy(buf_ptr, data, len);
+       buf_ptr += len;
 
        const sockaddr_t *sa = NULL;
-       int sock;
-       if(relay->status.send_locally)
+       size_t sock;
+
+       if(relay->status.send_locally) {
                choose_local_address(relay, &sa, &sock);
-       if(!sa)
+       }
+
+       if(!sa) {
                choose_udp_address(relay, &sa, &sock);
+       }
+
        logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s) (UDP)", from->name, from->hostname, to->name, to->hostname, relay->name, relay->hostname);
+
        if(sendto(listen_socket[sock].udp.fd, buf, buf_ptr - buf, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
                if(sockmsgsize(sockerrno)) {
-                       // Compensate for SPTPS overhead
-                       len -= SPTPS_DATAGRAM_OVERHEAD;
-                       if(relay->maxmtu >= len)
-                               relay->maxmtu = len - 1;
-                       if(relay->mtu >= len)
-                               relay->mtu = len - 1;
-                       try_fix_mtu(relay);
+                       reduce_mtu(relay, (int)origlen - 1);
                } else {
                        logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", relay->name, relay->hostname, sockstrerror(sockerrno));
                        return false;
@@ -805,8 +1053,9 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t
                if(!from->status.validkey) {
                        from->status.validkey = true;
                        from->status.waitingforkey = false;
-                       logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
+                       logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) successful", from->name, from->hostname);
                }
+
                return true;
        }
 
@@ -817,16 +1066,21 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t
 
        vpn_packet_t inpkt;
        inpkt.offset = DEFAULT_PACKET_OFFSET;
+       inpkt.priority = 0;
 
        if(type == PKT_PROBE) {
                if(!from->status.udppacket) {
                        logger(DEBUG_ALWAYS, LOG_ERR, "Got SPTPS PROBE packet from %s (%s) via TCP", from->name, from->hostname);
                        return false;
                }
+
                inpkt.len = len;
                memcpy(DATA(&inpkt), data, len);
-               if(inpkt.len > from->maxrecentlen)
+
+               if(inpkt.len > from->maxrecentlen) {
                        from->maxrecentlen = inpkt.len;
+               }
+
                udp_probe_h(from, &inpkt, len);
                return true;
        }
@@ -845,15 +1099,19 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t
        }
 
        int offset = (type & PKT_MAC) ? 0 : 14;
+
        if(type & PKT_COMPRESSED) {
                length_t ulen = uncompress_packet(DATA(&inpkt) + offset, (const uint8_t *)data, len, from->incompression);
-               if(ulen < 0) {
+
+               if(!ulen) {
                        return false;
                } else {
                        inpkt.len = ulen + offset;
                }
-               if(inpkt.len > MAXSIZE)
+
+               if(inpkt.len > MAXSIZE) {
                        abort();
+               }
        } else {
                memcpy(DATA(&inpkt) + offset, data, len);
                inpkt.len = len + offset;
@@ -862,24 +1120,27 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t
        /* Generate the Ethernet packet type if necessary */
        if(offset) {
                switch(DATA(&inpkt)[14] >> 4) {
-                       case 4:
-                               DATA(&inpkt)[12] = 0x08;
-                               DATA(&inpkt)[13] = 0x00;
-                               break;
-                       case 6:
-                               DATA(&inpkt)[12] = 0x86;
-                               DATA(&inpkt)[13] = 0xDD;
-                               break;
-                       default:
-                               logger(DEBUG_TRAFFIC, LOG_ERR,
-                                                  "Unknown IP version %d while reading packet from %s (%s)",
-                                                  DATA(&inpkt)[14] >> 4, from->name, from->hostname);
-                               return false;
+               case 4:
+                       DATA(&inpkt)[12] = 0x08;
+                       DATA(&inpkt)[13] = 0x00;
+                       break;
+
+               case 6:
+                       DATA(&inpkt)[12] = 0x86;
+                       DATA(&inpkt)[13] = 0xDD;
+                       break;
+
+               default:
+                       logger(DEBUG_TRAFFIC, LOG_ERR,
+                              "Unknown IP version %d while reading packet from %s (%s)",
+                              DATA(&inpkt)[14] >> 4, from->name, from->hostname);
+                       return false;
                }
        }
 
-       if(from->status.udppacket && inpkt.len > from->maxrecentlen)
+       if(from->status.udppacket && inpkt.len > from->maxrecentlen) {
                from->maxrecentlen = inpkt.len;
+       }
 
        receive_packet(from, &inpkt);
        return true;
@@ -888,14 +1149,15 @@ bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t
 // This function tries to get SPTPS keys, if they aren't already known.
 // This function makes no guarantees - it is up to the caller to check the node's state to figure out if the keys are available.
 static void try_sptps(node_t *n) {
-       if(n->status.validkey)
+       if(n->status.validkey) {
                return;
+       }
 
        logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
 
-       if(!n->status.waitingforkey)
+       if(!n->status.waitingforkey) {
                send_req_key(n);
-       else if(n->last_req_key + 10 < now.tv_sec) {
+       else if(n->last_req_key + 10 < now.tv_sec) {
                logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
                sptps_stop(&n->sptps);
                n->status.waitingforkey = false;
@@ -905,15 +1167,22 @@ static void try_sptps(node_t *n) {
        return;
 }
 
-static void send_udp_probe_packet(node_t *n, int len) {
+static void send_udp_probe_packet(node_t *n, size_t len) {
        vpn_packet_t packet;
+
+       if(len > sizeof(packet.data)) {
+               logger(DEBUG_TRAFFIC, LOG_INFO, "Truncating probe length %lu to %s (%s)", (unsigned long)len, n->name, n->hostname);
+               len = sizeof(packet.data);
+       }
+
+       len = MAX(len, MIN_PROBE_SIZE);
        packet.offset = DEFAULT_PACKET_OFFSET;
        memset(DATA(&packet), 0, 14);
        randomize(DATA(&packet) + 14, len - 14);
        packet.len = len;
        packet.priority = 0;
 
-       logger(DEBUG_TRAFFIC, LOG_INFO, "Sending UDP probe length %d to %s (%s)", len, n->name, n->hostname);
+       logger(DEBUG_TRAFFIC, LOG_INFO, "Sending UDP probe length %lu to %s (%s)", (unsigned long)len, n->name, n->hostname);
 
        send_udppacket(n, &packet);
 }
@@ -921,9 +1190,10 @@ static void send_udp_probe_packet(node_t *n, int len) {
 // This function tries to establish a UDP tunnel to a node so that packets can be sent.
 // If a tunnel is already established, it makes sure it stays up.
 // This function makes no guarantees - it is up to the caller to check the node's state to figure out if UDP is usable.
-static void try_udp(node_tn) {
-       if(!udp_discovery)
+static void try_udp(node_t *n) {
+       if(!udp_discovery) {
                return;
+       }
 
        /* Send gratuitous probe replies to 1.1 nodes. */
 
@@ -933,6 +1203,7 @@ static void try_udp(node_t* n) {
 
                if(ping_tx_elapsed.tv_sec >= udp_discovery_keepalive_interval - 1) {
                        n->udp_reply_sent = now;
+
                        if(n->maxrecentlen) {
                                vpn_packet_t pkt;
                                pkt.len = n->maxrecentlen;
@@ -950,11 +1221,15 @@ static void try_udp(node_t* n) {
        struct timeval ping_tx_elapsed;
        timersub(&now, &n->udp_ping_sent, &ping_tx_elapsed);
 
-       int interval = n->status.udp_confirmed ? udp_discovery_keepalive_interval : udp_discovery_interval;
+       int interval = n->status.udp_confirmed
+                      ? udp_discovery_keepalive_interval
+                      : udp_discovery_interval;
 
        if(ping_tx_elapsed.tv_sec >= interval) {
+               gettimeofday(&now, NULL);
+               n->udp_ping_sent = now; // a probe in flight
+               n->status.ping_sent = true;
                send_udp_probe_packet(n, MIN_PROBE_SIZE);
-               n->udp_ping_sent = now;
 
                if(localdiscovery && !n->status.udp_confirmed && n->prevedge) {
                        n->status.send_locally = true;
@@ -970,12 +1245,15 @@ static length_t choose_initial_maxmtu(node_t *n) {
        int sock = -1;
 
        const sockaddr_t *sa = NULL;
-       int sockindex;
+       size_t sockindex;
        choose_udp_address(n, &sa, &sockindex);
-       if(!sa)
+
+       if(!sa) {
                return MTU;
+       }
 
        sock = socket(sa->sa.sa_family, SOCK_DGRAM, IPPROTO_UDP);
+
        if(sock < 0) {
                logger(DEBUG_TRAFFIC, LOG_ERR, "Creating MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
                return MTU;
@@ -983,29 +1261,39 @@ static length_t choose_initial_maxmtu(node_t *n) {
 
        if(connect(sock, &sa->sa, SALEN(sa->sa))) {
                logger(DEBUG_TRAFFIC, LOG_ERR, "Connecting MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
-               close(sock);
+               closesocket(sock);
                return MTU;
        }
 
        int ip_mtu;
-       socklen_t ip_mtu_len = sizeof ip_mtu;
-       if(getsockopt(sock, IPPROTO_IP, IP_MTU, &ip_mtu, &ip_mtu_len)) {
+       socklen_t ip_mtu_len = sizeof(ip_mtu);
+
+       if(getsockopt(sock, IPPROTO_IP, IP_MTU, (void *)&ip_mtu, &ip_mtu_len)) {
                logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
-               close(sock);
+               closesocket(sock);
                return MTU;
        }
 
-       close(sock);
+       closesocket(sock);
+
+       if(ip_mtu < MINMTU) {
+               logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) returned absurdly small value: %d", n->name, n->hostname, ip_mtu);
+               return MTU;
+       }
 
        /* getsockopt(IP_MTU) returns the MTU of the physical interface.
           We need to remove various overheads to get to the tinc MTU. */
        length_t mtu = ip_mtu;
        mtu -= (sa->sa.sa_family == AF_INET6) ? sizeof(struct ip6_hdr) : sizeof(struct ip);
        mtu -= 8; /* UDP */
+
        if(n->status.sptps) {
                mtu -= SPTPS_DATAGRAM_OVERHEAD;
-               if((n->options >> 24) >= 4)
+
+               if((n->options >> 24) >= 4) {
                        mtu -= sizeof(node_id_t) + sizeof(node_id_t);
+               }
+
 #ifndef DISABLE_LEGACY
        } else {
                mtu -= digest_length(n->outdigest);
@@ -1029,20 +1317,16 @@ static length_t choose_initial_maxmtu(node_t *n) {
 #endif
        }
 
-       if (mtu < 512) {
-               logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) returned absurdly small value: %d", n->name, n->hostname, ip_mtu);
+       if(mtu > MTU) {
                return MTU;
        }
-       if (mtu > MTU)
-               return MTU;
 
        logger(DEBUG_TRAFFIC, LOG_INFO, "Using system-provided maximum tinc MTU for %s (%s): %hd", n->name, n->hostname, mtu);
        return mtu;
 
 #else
-
+       (void)n;
        return MTU;
-
 #endif
 }
 
@@ -1053,8 +1337,9 @@ static length_t choose_initial_maxmtu(node_t *n) {
 */
 
 static void try_mtu(node_t *n) {
-       if(!(n->options & OPTION_PMTU_DISCOVERY))
+       if(!(n->options & OPTION_PMTU_DISCOVERY)) {
                return;
+       }
 
        if(udp_discovery && !n->status.udp_confirmed) {
                n->maxrecentlen = 0;
@@ -1072,16 +1357,20 @@ static void try_mtu(node_t *n) {
 
        struct timeval elapsed;
        timersub(&now, &n->mtu_ping_sent, &elapsed);
+
        if(n->mtuprobes >= 0) {
-               if(n->mtuprobes != 0 && elapsed.tv_sec == 0 && elapsed.tv_usec < 333333)
+               if(n->mtuprobes != 0 && elapsed.tv_sec == 0 && elapsed.tv_usec < 333333) {
                        return;
+               }
        } else {
                if(n->mtuprobes < -1) {
-                       if(elapsed.tv_sec < 1)
+                       if(elapsed.tv_sec < 1) {
                                return;
+                       }
                } else {
-                       if(elapsed.tv_sec < pinginterval)
+                       if(elapsed.tv_sec < pinginterval) {
                                return;
+                       }
                }
        }
 
@@ -1100,16 +1389,20 @@ static void try_mtu(node_t *n) {
                /* After the initial discovery, we only send one maxmtu and one
                   maxmtu+1 probe to detect PMTU increases. */
                send_udp_probe_packet(n, n->maxmtu);
-               if(n->mtuprobes == -1 && n->maxmtu + 1 < MTU)
+
+               if(n->mtuprobes == -1 && n->maxmtu + 1 < MTU) {
                        send_udp_probe_packet(n, n->maxmtu + 1);
+               }
+
                n->mtuprobes--;
        } else {
                /* Before initial discovery begins, set maxmtu to the most likely value.
                   If it's underestimated, we will correct it after initial discovery. */
-               if(n->mtuprobes == 0)
+               if(n->mtuprobes == 0) {
                        n->maxmtu = choose_initial_maxmtu(n);
+               }
 
-               for (;;) {
+               for(;;) {
                        /* Decreasing the number of probes per cycle might make the algorithm react faster to lost packets,
                           but it will typically increase convergence time in the no-loss case. */
                        const length_t probes_per_cycle = 8;
@@ -1121,31 +1414,39 @@ static void try_mtu(node_t *n) {
                           This fine-tuning is only valid for maxmtu = MTU; if maxmtu is smaller,
                           then it's better to use a multiplier of 1. Indeed, this leads to an interesting scenario
                           if choose_initial_maxmtu() returns the actual MTU value - it will get confirmed with one single probe. */
-                       const float multiplier = (n->maxmtu == MTU) ? 0.97 : 1;
-
-                       const float cycle_position = probes_per_cycle - (n->mtuprobes % probes_per_cycle) - 1;
-                       const length_t minmtu = MAX(n->minmtu, 512);
-                       const float interval = n->maxmtu - minmtu;
-
-                       /* The core of the discovery algorithm is this exponential.
-                          It produces very large probes early in the cycle, and then it very quickly decreases the probe size.
-                          This reflects the fact that in the most difficult cases, we don't get any feedback for probes that
-                          are too large, and therefore we need to concentrate on small offsets so that we can quickly converge
-                          on the precise MTU as we are approaching it.
-                          The last probe of the cycle is always 1 byte in size - this is to make sure we'll get at least one
-                          reply per cycle so that we can make progress. */
-                       const length_t offset = powf(interval, multiplier * cycle_position / (probes_per_cycle - 1));
+                       const float multiplier = (n->maxmtu == MTU) ? 0.97f : 1.0f;
+
+                       const float cycle_position = (float) probes_per_cycle - (float)(n->mtuprobes % probes_per_cycle) - 1.0f;
+                       const length_t minmtu = MAX(n->minmtu, MINMTU);
+                       const float interval = (float)(n->maxmtu - minmtu);
+
+                       length_t offset = 0;
+
+                       /* powf can be underflowed if n->maxmtu is less than 512 due to the minmtu MAX bound */
+                       if(interval > 0) {
+                               /* The core of the discovery algorithm is this exponential.
+                                       It produces very large probes early in the cycle, and then it very quickly decreases the probe size.
+                                       This reflects the fact that in the most difficult cases, we don't get any feedback for probes that
+                                       are too large, and therefore we need to concentrate on small offsets so that we can quickly converge
+                                       on the precise MTU as we are approaching it.
+                                       The last probe of the cycle is always 1 byte in size - this is to make sure we'll get at least one
+                                       reply per cycle so that we can make progress. */
+                               offset = lrintf(powf(interval, multiplier * cycle_position / (float)(probes_per_cycle - 1)));
+                       }
 
                        length_t maxmtu = n->maxmtu;
                        send_udp_probe_packet(n, minmtu + offset);
+
                        /* If maxmtu changed, it means the probe was rejected by the system because it was too large.
                           In that case, we recalculate with the new maxmtu and try again. */
-                       if(n->mtuprobes < 0 || maxmtu == n->maxmtu)
+                       if(n->mtuprobes < 0 || maxmtu == n->maxmtu) {
                                break;
+                       }
                }
 
-               if(n->mtuprobes >= 0)
+               if(n->mtuprobes >= 0) {
                        n->mtuprobes++;
+               }
        }
 }
 
@@ -1166,8 +1467,9 @@ static void try_tx_sptps(node_t *n, bool mtu) {
        /* If n is a TCP-only neighbor, we'll only use "cleartext" PACKET
           messages anyway, so there's no need for SPTPS at all. */
 
-       if(n->connection && ((myself->options | n->options) & OPTION_TCPONLY))
+       if(n->connection && ((myself->options | n->options) & OPTION_TCPONLY)) {
                return;
+       }
 
        /* Otherwise, try to do SPTPS authentication with n if necessary. */
 
@@ -1177,34 +1479,39 @@ static void try_tx_sptps(node_t *n, bool mtu) {
 
        node_t *via = (n->via == myself) ? n->nexthop : n->via;
 
-       /* If the static relay doesn't support SPTPS, everything goes via TCP anyway. */
+       /* If we do have a static relay, try everything with that one instead, if it supports relaying. */
 
-       if((via->options >> 24) < 4)
-               return;
-
-       /* If we do have a static relay, try everything with that one instead. */
+       if(via != n) {
+               if((via->options >> 24) < 4) {
+                       return;
+               }
 
-       if(via != n)
-               return try_tx_sptps(via, mtu);
+               try_tx(via, mtu);
+               return;
+       }
 
        /* Otherwise, try to establish UDP connectivity. */
 
        try_udp(n);
-       if(mtu)
+
+       if(mtu) {
                try_mtu(n);
+       }
 
        /* If we don't have UDP connectivity (yet), we need to use a dynamic relay (nexthop)
           while we try to establish direct connectivity. */
 
-       if(!n->status.udp_confirmed && n != n->nexthop && (n->nexthop->options >> 24) >= 4)
-               try_tx_sptps(n->nexthop, mtu);
+       if(!n->status.udp_confirmed && n != n->nexthop && (n->nexthop->options >> 24) >= 4) {
+               try_tx(n->nexthop, mtu);
+       }
 }
 
 static void try_tx_legacy(node_t *n, bool mtu) {
        /* Does he have our key? If not, send one. */
 
-       if(!n->status.validkey_in)
+       if(!n->status.validkey_in) {
                send_ans_key(n);
+       }
 
        /* Check if we already have a key, or request one. */
 
@@ -1213,27 +1520,40 @@ static void try_tx_legacy(node_t *n, bool mtu) {
                        send_req_key(n);
                        n->last_req_key = now.tv_sec;
                }
+
                return;
        }
 
        try_udp(n);
-       if(mtu)
+
+       if(mtu) {
                try_mtu(n);
+       }
 }
 
 void try_tx(node_t *n, bool mtu) {
-       if(n->status.sptps)
+       if(!n->status.reachable) {
+               return;
+       }
+
+       if(n->status.sptps) {
                try_tx_sptps(n, mtu);
-       else
+       } else {
                try_tx_legacy(n, mtu);
+       }
 }
 
 void send_packet(node_t *n, vpn_packet_t *packet) {
        // If it's for myself, write it to the tun/tap device.
 
        if(n == myself) {
-               if(overwrite_mac)
-                        memcpy(DATA(packet), mymac.x, ETH_ALEN);
+               if(overwrite_mac) {
+                       memcpy(DATA(packet), mymac.x, ETH_ALEN);
+                       // Use an arbitrary fake source address.
+                       memcpy(DATA(packet) + ETH_ALEN, DATA(packet), ETH_ALEN);
+                       DATA(packet)[ETH_ALEN * 2 - 1] ^= 0xFF;
+               }
+
                n->out_packets++;
                n->out_bytes += packet->len;
                devops.write(packet);
@@ -1258,7 +1578,7 @@ void send_packet(node_t *n, vpn_packet_t *packet) {
 
        if(n->status.sptps) {
                send_sptps_packet(n, packet);
-               try_tx_sptps(n, true);
+               try_tx(n, true);
                return;
        }
 
@@ -1266,58 +1586,69 @@ void send_packet(node_t *n, vpn_packet_t *packet) {
 
        node_t *via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
 
-       if(via != n)
+       if(via != n) {
                logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)", n->name, via->name, n->via->hostname);
+       }
 
        // Try to send via UDP, unless TCP is forced.
 
        if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
-               if(!send_tcppacket(via->connection, packet))
+               if(!send_tcppacket(via->connection, packet)) {
                        terminate_connection(via->connection, true);
+               }
+
                return;
        }
 
        send_udppacket(via, packet);
-       try_tx_legacy(via, true);
+       try_tx(via, true);
 }
 
 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
        // Always give ourself a copy of the packet.
-       if(from != myself)
+       if(from != myself) {
                send_packet(myself, packet);
+       }
 
        // In TunnelServer mode, do not forward broadcast packets.
        // The MST might not be valid and create loops.
-       if(tunnelserver || broadcast_mode == BMODE_NONE)
+       if(tunnelserver || broadcast_mode == BMODE_NONE) {
                return;
+       }
 
        logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
-                          packet->len, from->name, from->hostname);
+              packet->len, from->name, from->hostname);
 
        switch(broadcast_mode) {
-               // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
-               // This guarantees all nodes receive the broadcast packet, and
-               // usually distributes the sending of broadcast packets over all nodes.
-               case BMODE_MST:
-                       for list_each(connection_t, c, connection_list)
-                               if(c->edge && c->status.mst && c != from->nexthop->connection)
-                                       send_packet(c->node, packet);
-                       break;
+       // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
+       // This guarantees all nodes receive the broadcast packet, and
+       // usually distributes the sending of broadcast packets over all nodes.
+       case BMODE_MST:
+               for list_each(connection_t, c, &connection_list)
+                       if(c->edge && c->status.mst && c != from->nexthop->connection) {
+                               send_packet(c->node, packet);
+                       }
 
-               // In direct mode, we send copies to each node we know of.
-               // However, this only reaches nodes that can be reached in a single hop.
-               // We don't have enough information to forward broadcast packets in this case.
-               case BMODE_DIRECT:
-                       if(from != myself)
-                               break;
+               break;
 
-                       for splay_each(node_t, n, node_tree)
-                               if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n))
-                                       send_packet(n, packet);
+       // In direct mode, we send copies to each node we know of.
+       // However, this only reaches nodes that can be reached in a single hop.
+       // We don't have enough information to forward broadcast packets in this case.
+       case BMODE_DIRECT:
+               if(from != myself) {
                        break;
+               }
 
-               default:
-                       break;
+               for splay_each(node_t, n, &node_tree)
+                       if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n)) {
+                               send_packet(n, packet);
+                       }
+
+               break;
+
+       case BMODE_NONE:
+       default:
+               break;
        }
 }
 
@@ -1332,18 +1663,22 @@ static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
        bool hard = false;
        static time_t last_hard_try = 0;
 
-       for splay_each(node_t, n, node_tree) {
-               if(!n->status.reachable || n == myself)
+       for splay_each(node_t, n, &node_tree) {
+               if(!n->status.reachable || n == myself) {
                        continue;
+               }
 
-               if((n->status.sptps && !n->sptps.instate) || !n->status.validkey_in)
+               if(!n->status.validkey_in && !(n->status.sptps && n->sptps.instate)) {
                        continue;
+               }
 
                bool soft = false;
 
-               for splay_each(edge_t, e, n->edge_tree) {
-                       if(!e->reverse)
+               for splay_each(edge_t, e, &n->edge_tree) {
+                       if(!e->reverse) {
                                continue;
+                       }
+
                        if(!sockaddrcmp_noport(from, &e->reverse->address)) {
                                soft = true;
                                break;
@@ -1351,111 +1686,121 @@ static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
                }
 
                if(!soft) {
-                       if(last_hard_try == now.tv_sec)
+                       if(last_hard_try == now.tv_sec) {
                                continue;
+                       }
+
                        hard = true;
                }
 
-               if(!try_mac(n, pkt))
+               if(!try_mac(n, pkt)) {
                        continue;
+               }
 
                match = n;
                break;
        }
 
-       if(hard)
+       if(hard) {
                last_hard_try = now.tv_sec;
+       }
 
        return match;
 }
 
-void handle_incoming_vpn_data(void *data, int flags) {
-       listen_socket_t *ls = data;
-       vpn_packet_t pkt;
+static void handle_incoming_vpn_packet(listen_socket_t *ls, vpn_packet_t *pkt, sockaddr_t *addr) {
        char *hostname;
-       node_id_t nullid = {};
-       sockaddr_t addr = {};
-       socklen_t addrlen = sizeof addr;
+       node_id_t nullid = {0};
        node_t *from, *to;
        bool direct = false;
 
-       pkt.offset = 0;
-       int len = recvfrom(ls->udp.fd, DATA(&pkt), MAXSIZE, 0, &addr.sa, &addrlen);
-
-       if(len <= 0 || len > MAXSIZE) {
-               if(!sockwouldblock(sockerrno))
-                       logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
-               return;
-       }
-
-       pkt.len = len;
-
-       sockaddrunmap(&addr); /* Some braindead IPv6 implementations do stupid things. */
+       sockaddrunmap(addr); /* Some braindead IPv6 implementations do stupid things. */
 
        // Try to figure out who sent this packet.
 
-       node_t *n = lookup_node_udp(&addr);
+       node_t *n = lookup_node_udp(addr);
 
-       if(n && !n->status.udp_confirmed)
-               n = NULL; // Don't believe it if we don't have confirmation yet.
+       if(n && !n->status.udp_confirmed) {
+               n = NULL;        // Don't believe it if we don't have confirmation yet.
+       }
 
        if(!n) {
                // It might be from a 1.1 node, which might have a source ID in the packet.
-               pkt.offset = 2 * sizeof(node_id_t);
-               from = lookup_node_id(SRCID(&pkt));
-               if(from && !memcmp(DSTID(&pkt), &nullid, sizeof nullid) && from->status.sptps) {
-                       if(sptps_verify_datagram(&from->sptps, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t)))
+               pkt->offset = 2 * sizeof(node_id_t);
+               from = lookup_node_id(SRCID(pkt));
+
+               if(from && from->status.sptps && !memcmp(DSTID(pkt), &nullid, sizeof(nullid))) {
+                       if(sptps_verify_datagram(&from->sptps, DATA(pkt), pkt->len - 2 * sizeof(node_id_t))) {
                                n = from;
-                       else
+                       } else {
                                goto skip_harder;
+                       }
                }
        }
 
        if(!n) {
-               pkt.offset = 0;
-               n = try_harder(&addr, &pkt);
+               pkt->offset = 0;
+               n = try_harder(addr, pkt);
        }
 
 skip_harder:
+
        if(!n) {
                if(debug_level >= DEBUG_PROTOCOL) {
-                       hostname = sockaddr2hostname(&addr);
+                       hostname = sockaddr2hostname(addr);
                        logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
                        free(hostname);
                }
+
                return;
        }
 
+       pkt->offset = 0;
+
        if(n->status.sptps) {
-               pkt.offset = 2 * sizeof(node_id_t);
+               bool relay_enabled = (n->options >> 24) >= 4;
+
+               if(relay_enabled) {
+                       pkt->offset = 2 * sizeof(node_id_t);
+                       pkt->len -= pkt->offset;
+               }
 
-               if(!memcmp(DSTID(&pkt), &nullid, sizeof nullid)) {
+               if(!relay_enabled || !memcmp(DSTID(pkt), &nullid, sizeof(nullid))) {
                        direct = true;
                        from = n;
                        to = myself;
                } else {
-                       from = lookup_node_id(SRCID(&pkt));
-                       to = lookup_node_id(DSTID(&pkt));
+                       from = lookup_node_id(SRCID(pkt));
+                       to = lookup_node_id(DSTID(pkt));
                }
+
                if(!from || !to) {
                        logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from %s (%s) with unknown source and/or destination ID", n->name, n->hostname);
                        return;
                }
 
+               if(!to->status.reachable) {
+                       /* This can happen in the form of a race condition
+                          if the node just became unreachable. */
+                       logger(DEBUG_TRAFFIC, LOG_WARNING, "Cannot relay packet from %s (%s) because the destination, %s (%s), is unreachable", from->name, from->hostname, to->name, to->hostname);
+                       return;
+               }
+
                /* The packet is supposed to come from the originator or its static relay
                   (i.e. with no dynamic relays in between).
                   If it did not, "help" the static relay by sending it UDP info.
                   Note that we only do this if we're the destination or the static relay;
                   otherwise every hop would initiate its own UDP info message, resulting in elevated chatter. */
 
-               if(n != from->via && to->via == myself)
+               if(n != from->via && to->via == myself) {
                        send_udp_info(myself, from);
+               }
 
                /* If we're not the final recipient, relay the packet. */
 
                if(to != myself) {
-                       send_sptps_data(to, from, 0, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t));
-                       try_tx_sptps(to, true);
+                       send_sptps_data(to, from, 0, DATA(pkt), pkt->len);
+                       try_tx(to, true);
                        return;
                }
        } else {
@@ -1463,29 +1808,115 @@ skip_harder:
                from = n;
        }
 
-       pkt.offset = 0;
-       if(!receive_udppacket(from, &pkt))
+       if(!receive_udppacket(from, pkt)) {
                return;
+       }
 
        n->sock = ls - listen_socket;
-       if(direct && sockaddrcmp(&addr, &n->address))
-               update_node_udp(n, &addr);
+
+       if(direct && sockaddrcmp(addr, &n->address)) {
+               update_node_udp(n, addr);
+       }
 
        /* If the packet went through a relay, help the sender find the appropriate MTU
           through the relay path. */
 
-       if(!direct)
+       if(!direct) {
                send_mtu_info(myself, n, MTU);
+       }
+}
+
+void handle_incoming_vpn_data(void *data, int flags) {
+       (void)data;
+       (void)flags;
+       listen_socket_t *ls = data;
+
+#ifdef HAVE_RECVMMSG
+#define MAX_MSG 64
+       static ssize_t num = MAX_MSG;
+       static vpn_packet_t pkt[MAX_MSG];
+       static sockaddr_t addr[MAX_MSG];
+       static struct mmsghdr msg[MAX_MSG];
+       static struct iovec iov[MAX_MSG];
+
+       for(int i = 0; i < num; i++) {
+               pkt[i].offset = 0;
+
+               iov[i] = (struct iovec) {
+                       .iov_base = DATA(&pkt[i]),
+                       .iov_len = MAXSIZE,
+               };
+
+               msg[i].msg_hdr = (struct msghdr) {
+                       .msg_name = &addr[i].sa,
+                       .msg_namelen = sizeof(addr)[i],
+                       .msg_iov = &iov[i],
+                       .msg_iovlen = 1,
+               };
+       }
+
+       num = recvmmsg(ls->udp.fd, msg, MAX_MSG, MSG_DONTWAIT, NULL);
+
+       if(num < 0) {
+               if(!sockwouldblock(sockerrno)) {
+                       logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
+               }
+
+               return;
+       }
+
+       for(int i = 0; i < num; i++) {
+               pkt[i].len = msg[i].msg_len;
+
+               if(pkt[i].len <= 0 || pkt[i].len > MAXSIZE) {
+                       continue;
+               }
+
+               handle_incoming_vpn_packet(ls, &pkt[i], &addr[i]);
+       }
+
+#else
+       vpn_packet_t pkt;
+       sockaddr_t addr = {0};
+       socklen_t addrlen = sizeof(addr);
+
+       pkt.offset = 0;
+       ssize_t len = recvfrom(ls->udp.fd, (void *)DATA(&pkt), MAXSIZE, 0, &addr.sa, &addrlen);
+
+       if(len <= 0 || (size_t)len > MAXSIZE) {
+               if(!sockwouldblock(sockerrno)) {
+                       logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
+               }
+
+               return;
+       }
+
+       pkt.len = len;
+
+       handle_incoming_vpn_packet(ls, &pkt, &addr);
+#endif
 }
 
 void handle_device_data(void *data, int flags) {
+       (void)data;
+       (void)flags;
        vpn_packet_t packet;
        packet.offset = DEFAULT_PACKET_OFFSET;
        packet.priority = 0;
+       static int errors = 0;
 
        if(devops.read(&packet)) {
+               errors = 0;
                myself->in_packets++;
                myself->in_bytes += packet.len;
                route(myself, &packet);
+       } else {
+               sleep_millis(errors * 50);
+               errors++;
+
+               if(errors > 10) {
+                       logger(DEBUG_ALWAYS, LOG_ERR, "Too many errors from %s, exiting!", device);
+                       event_exit();
+               }
        }
 }