X-Git-Url: https://www.tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Froute.c;h=d748db163d1999db9a7b938eb93c821d010004a4;hp=742fbc28dcf1bf29929414c83cca6417839e55e3;hb=9915f2abbedb7f1aa2b9e2f81d52ddcfca60e82d;hpb=de032054dee67bcc406b4a15fb9e957a766d016a diff --git a/src/route.c b/src/route.c index 742fbc28..d748db16 100644 --- a/src/route.c +++ b/src/route.c @@ -1,7 +1,7 @@ /* route.c -- routing Copyright (C) 2000-2005 Ivo Timmermans, - 2000-2006 Guus Sliepen + 2000-2009 Guus Sliepen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -94,6 +94,13 @@ static bool checklength(node_t *source, vpn_packet_t *packet, length_t length) { } else return true; } + +static void swap_mac_addresses(vpn_packet_t *packet) { + mac_t tmp; + memcpy(&tmp, &packet->data[0], sizeof tmp); + memcpy(&packet->data[0], &packet->data[6], sizeof tmp); + memcpy(&packet->data[6], &tmp, sizeof tmp); +} static void learn_mac(mac_t *address) { @@ -160,40 +167,6 @@ void age_subnets(void) } } -static void route_mac(node_t *source, vpn_packet_t *packet) -{ - subnet_t *subnet; - mac_t dest; - - cp(); - - - /* Learn source address */ - - if(source == myself) { - mac_t src; - memcpy(&src, &packet->data[6], sizeof src); - learn_mac(&src); - } - - /* Lookup destination address */ - - memcpy(&dest, &packet->data[0], sizeof dest); - subnet = lookup_subnet_mac(&dest); - - if(!subnet) { - broadcast_packet(source, packet); - return; - } - - if(subnet->owner == source) { - ifdebug(TRAFFIC) logger(LOG_WARNING, _("Packet looping back to %s (%s)!"), source->name, source->hostname); - return; - } - - send_packet(subnet->owner, packet); -} - /* RFC 792 */ static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, uint8_t type, uint8_t code) @@ -210,6 +183,10 @@ static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, uint8_t cp(); + /* Swap Ethernet source and destination addresses */ + + swap_mac_addresses(packet); + /* Copy headers from packet into properly aligned structs on the stack */ memcpy(&ip, packet->data + ether_size, ip_size); @@ -376,11 +353,11 @@ static void route_ipv4(node_t *source, vpn_packet_t *packet) if(!checklength(source, packet, ether_size + ip_size)) return; - if(packet->data[30] & 0xf0 == 0xe0 || + if(((packet->data[30] & 0xf0) == 0xe0) || ( packet->data[30] == 255 && packet->data[31] == 255 && packet->data[32] == 255 && - packet->data[33] == 255) + packet->data[33] == 255)) broadcast_packet(source, packet); else route_ipv4_unicast(source, packet); @@ -406,6 +383,10 @@ static void route_ipv6_unreachable(node_t *source, vpn_packet_t *packet, uint8_t cp(); + /* Swap Ethernet source and destination addresses */ + + swap_mac_addresses(packet); + /* Copy headers from packet to structs on the stack */ memcpy(&ip6, packet->data + ether_size, ip6_size); @@ -521,6 +502,7 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) struct nd_opt_hdr opt; subnet_t *subnet; uint16_t checksum; + bool has_opt; struct { struct in6_addr ip6_src; /* source address */ @@ -531,9 +513,11 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) cp(); - if(!checklength(source, packet, ether_size + ip6_size + ns_size + opt_size + ETH_ALEN)) + if(!checklength(source, packet, ether_size + ip6_size + ns_size)) return; + has_opt = packet->len >= ether_size + ip6_size + ns_size + opt_size + ETH_ALEN; + if(source != myself) { ifdebug(TRAFFIC) logger(LOG_WARNING, _("Got neighbor solicitation request from %s (%s) while in router mode!"), source->name, source->hostname); return; @@ -543,7 +527,8 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) memcpy(&ip6, packet->data + ether_size, ip6_size); memcpy(&ns, packet->data + ether_size + ip6_size, ns_size); - memcpy(&opt, packet->data + ether_size + ip6_size + ns_size, opt_size); + if(has_opt) + memcpy(&opt, packet->data + ether_size + ip6_size + ns_size, opt_size); /* First, snatch the source address from the neighbor solicitation packet */ @@ -553,7 +538,7 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) /* Check if this is a valid neighbor solicitation request */ if(ns.nd_ns_hdr.icmp6_type != ND_NEIGHBOR_SOLICIT || - opt.nd_opt_type != ND_OPT_SOURCE_LINKADDR) { + (has_opt && opt.nd_opt_type != ND_OPT_SOURCE_LINKADDR)) { ifdebug(TRAFFIC) logger(LOG_WARNING, _("Cannot route packet: received unknown type neighbor solicitation request")); return; } @@ -562,15 +547,20 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) pseudo.ip6_src = ip6.ip6_src; pseudo.ip6_dst = ip6.ip6_dst; - pseudo.length = htonl(ns_size + opt_size + ETH_ALEN); + if(has_opt) + pseudo.length = htonl(ns_size + opt_size + ETH_ALEN); + else + pseudo.length = htonl(ns_size); pseudo.next = htonl(IPPROTO_ICMPV6); /* Generate checksum */ checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0); checksum = inet_checksum(&ns, ns_size, checksum); - checksum = inet_checksum(&opt, opt_size, checksum); - checksum = inet_checksum(packet->data + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum); + if(has_opt) { + checksum = inet_checksum(&opt, opt_size, checksum); + checksum = inet_checksum(packet->data + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum); + } if(checksum) { ifdebug(TRAFFIC) logger(LOG_WARNING, _("Cannot route packet: checksum error for neighbor solicitation request")); @@ -608,7 +598,8 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) ip6.ip6_dst = ip6.ip6_src; /* swap destination and source protocoll address */ ip6.ip6_src = ns.nd_ns_target; - memcpy(packet->data + ether_size + ip6_size + ns_size + opt_size, packet->data + ETH_ALEN, ETH_ALEN); /* add fake source hard addr */ + if(has_opt) + memcpy(packet->data + ether_size + ip6_size + ns_size + opt_size, packet->data + ETH_ALEN, ETH_ALEN); /* add fake source hard addr */ ns.nd_ns_cksum = 0; ns.nd_ns_type = ND_NEIGHBOR_ADVERT; @@ -619,15 +610,20 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) pseudo.ip6_src = ip6.ip6_src; pseudo.ip6_dst = ip6.ip6_dst; - pseudo.length = htonl(ns_size + opt_size + ETH_ALEN); + if(has_opt) + pseudo.length = htonl(ns_size + opt_size + ETH_ALEN); + else + pseudo.length = htonl(ns_size); pseudo.next = htonl(IPPROTO_ICMPV6); /* Generate checksum */ checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0); checksum = inet_checksum(&ns, ns_size, checksum); - checksum = inet_checksum(&opt, opt_size, checksum); - checksum = inet_checksum(packet->data + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum); + if(has_opt) { + checksum = inet_checksum(&opt, opt_size, checksum); + checksum = inet_checksum(packet->data + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum); + } ns.nd_ns_hdr.icmp6_cksum = checksum; @@ -635,7 +631,8 @@ static void route_neighborsol(node_t *source, vpn_packet_t *packet) memcpy(packet->data + ether_size, &ip6, ip6_size); memcpy(packet->data + ether_size + ip6_size, &ns, ns_size); - memcpy(packet->data + ether_size + ip6_size + ns_size, &opt, opt_size); + if(has_opt) + memcpy(packet->data + ether_size + ip6_size + ns_size, &opt, opt_size); send_packet(source, packet); } @@ -727,6 +724,64 @@ static void route_arp(node_t *source, vpn_packet_t *packet) send_packet(source, packet); } +static void route_mac(node_t *source, vpn_packet_t *packet) +{ + subnet_t *subnet; + mac_t dest; + + cp(); + + + /* Learn source address */ + + if(source == myself) { + mac_t src; + memcpy(&src, &packet->data[6], sizeof src); + learn_mac(&src); + } + + /* Lookup destination address */ + + memcpy(&dest, &packet->data[0], sizeof dest); + subnet = lookup_subnet_mac(&dest); + + if(!subnet) { + broadcast_packet(source, packet); + return; + } + + if(subnet->owner == source) { + ifdebug(TRAFFIC) logger(LOG_WARNING, _("Packet looping back to %s (%s)!"), source->name, source->hostname); + return; + } + + // Handle packets larger than PMTU + + node_t *via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via; + + if(via && packet->len > via->mtu && via != myself) { + ifdebug(TRAFFIC) logger(LOG_INFO, _("Packet for %s (%s) length %d larger than MTU %d"), subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu); + uint16_t type = packet->data[12] << 8 | packet->data[13]; + if(type == ETH_P_IP) { + if(packet->data[20] & 0x40) { + packet->len = via->mtu; + route_ipv4_unreachable(source, packet, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED); + } else { + fragment_ipv4_packet(via, packet); + } + } else if(type == ETH_P_IPV6) { + packet->len = via->mtu; + route_ipv6_unreachable(source, packet, ICMP6_PACKET_TOO_BIG, 0); + } else + ifdebug(TRAFFIC) logger(LOG_INFO, _("Large packet of unhandled type %hx dropped"), type); + + return; + } + + send_packet(subnet->owner, packet); +} + + void route(node_t *source, vpn_packet_t *packet) { cp(); @@ -737,9 +792,8 @@ void route(node_t *source, vpn_packet_t *packet) switch (routing_mode) { case RMODE_ROUTER: { - uint16_t type; + uint16_t type = packet->data[12] << 8 | packet->data[13]; - type = ntohs(*((uint16_t *)(&packet->data[12]))); switch (type) { case ETH_P_ARP: route_arp(source, packet);