2 net_packet.c -- Handles in- and outgoing VPN packets
3 Copyright (C) 1998-2005 Ivo Timmermans,
4 2000-2014 Guus Sliepen <guus@tinc-vpn.org>
5 2010 Timothy Redaelli <timothy@redaelli.eu>
6 2010 Brandon Black <blblack@gmail.com>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License along
19 with this program; if not, write to the Free Software Foundation, Inc.,
20 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
35 #include "connection.h"
52 #define MAX(a, b) ((a) > (b) ? (a) : (b))
55 /* The minimum size of a probe is 14 bytes, but since we normally use CBC mode
56 encryption, we can add a few extra random bytes without increasing the
57 resulting packet size. */
58 #define MIN_PROBE_SIZE 18
62 static char lzo_wrkmem[LZO1X_999_MEM_COMPRESS > LZO1X_1_MEM_COMPRESS ? LZO1X_999_MEM_COMPRESS : LZO1X_1_MEM_COMPRESS];
65 static void send_udppacket(node_t *, vpn_packet_t *);
67 unsigned replaywin = 16;
68 bool localdiscovery = true;
69 bool udp_discovery = true;
70 int udp_discovery_keepalive_interval = 9;
71 int udp_discovery_interval = 2;
72 int udp_discovery_timeout = 30;
74 #define MAX_SEQNO 1073741824
76 static void try_fix_mtu(node_t *n) {
80 if(n->mtuprobes == 20 || n->minmtu >= n->maxmtu) {
81 if(n->minmtu > n->maxmtu)
82 n->minmtu = n->maxmtu;
84 n->maxmtu = n->minmtu;
86 logger(DEBUG_TRAFFIC, LOG_INFO, "Fixing MTU of %s (%s) to %d after %d probes", n->name, n->hostname, n->mtu, n->mtuprobes);
91 static void udp_probe_timeout_handler(void *data) {
93 if(!n->status.udp_confirmed)
96 logger(DEBUG_TRAFFIC, LOG_INFO, "Too much time has elapsed since last UDP ping response from %s (%s), stopping UDP communication", n->name, n->hostname);
97 n->status.udp_confirmed = false;
103 static void udp_probe_h(node_t *n, vpn_packet_t *packet, length_t len) {
104 if(!DATA(packet)[0]) {
105 /* It's a probe request, send back a reply */
107 if(!n->status.sptps && !n->status.validkey) {
108 // But not if we don't have his key.
109 logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request from %s (%s) but we don't have his key yet", n->name, n->hostname);
113 logger(DEBUG_TRAFFIC, LOG_INFO, "Got UDP probe request %d from %s (%s)", packet->len, n->name, n->hostname);
115 /* Type 2 probe replies were introduced in protocol 17.3 */
116 if ((n->options >> 24) >= 3) {
117 uint8_t *data = DATA(packet);
119 uint16_t len16 = htons(len); memcpy(data, &len16, 2); data += 2;
120 packet->len = MIN_PROBE_SIZE;
122 /* Legacy protocol: n won't understand type 2 probe replies. */
126 /* Temporarily set udp_confirmed, so that the reply is sent
127 back exactly the way it came in. */
129 bool udp_confirmed = n->status.udp_confirmed;
130 n->status.udp_confirmed = true;
131 send_udppacket(n, packet);
132 n->status.udp_confirmed = udp_confirmed;
134 length_t probelen = len;
135 if (DATA(packet)[0] == 2) {
137 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received invalid (too short) UDP probe reply from %s (%s)", n->name, n->hostname);
139 uint16_t probelen16; memcpy(&probelen16, DATA(packet) + 1, 2); probelen = ntohs(probelen16);
142 logger(DEBUG_TRAFFIC, LOG_INFO, "Got type %d UDP probe reply %d from %s (%s)", DATA(packet)[0], probelen, n->name, n->hostname);
144 /* It's a valid reply: now we know bidirectional communication
145 is possible using the address and socket that the reply
147 n->status.udp_confirmed = true;
150 timeout_del(&n->udp_ping_timeout);
151 timeout_add(&n->udp_ping_timeout, &udp_probe_timeout_handler, n, &(struct timeval){udp_discovery_timeout, 0});
154 if(probelen >= n->maxmtu + 1) {
155 logger(DEBUG_TRAFFIC, LOG_INFO, "Increase in PMTU to %s (%s) detected, restarting PMTU discovery", n->name, n->hostname);
157 /* Set mtuprobes to 1 so that try_mtu() doesn't reset maxmtu */
162 /* If applicable, raise the minimum supported MTU */
164 if(probelen > n->maxmtu)
165 probelen = n->maxmtu;
166 if(n->minmtu < probelen) {
167 n->minmtu = probelen;
173 static length_t compress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
175 memcpy(dest, source, len);
177 } else if(level == 10) {
179 lzo_uint lzolen = MAXSIZE;
180 lzo1x_1_compress(source, len, dest, &lzolen, lzo_wrkmem);
185 } else if(level < 10) {
187 unsigned long destlen = MAXSIZE;
188 if(compress2(dest, &destlen, source, len, level) == Z_OK)
195 lzo_uint lzolen = MAXSIZE;
196 lzo1x_999_compress(source, len, dest, &lzolen, lzo_wrkmem);
206 static length_t uncompress_packet(uint8_t *dest, const uint8_t *source, length_t len, int level) {
208 memcpy(dest, source, len);
210 } else if(level > 9) {
212 lzo_uint lzolen = MAXSIZE;
213 if(lzo1x_decompress_safe(source, len, dest, &lzolen, NULL) == LZO_E_OK)
221 unsigned long destlen = MAXSIZE;
222 if(uncompress(dest, &destlen, source, len) == Z_OK)
234 static void receive_packet(node_t *n, vpn_packet_t *packet) {
235 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Received packet of %d bytes from %s (%s)",
236 packet->len, n->name, n->hostname);
239 n->in_bytes += packet->len;
244 static bool try_mac(node_t *n, const vpn_packet_t *inpkt) {
246 return sptps_verify_datagram(&n->sptps, DATA(inpkt), inpkt->len);
248 #ifdef DISABLE_LEGACY
251 if(!digest_active(n->indigest) || inpkt->len < sizeof(seqno_t) + digest_length(n->indigest))
254 return digest_verify(n->indigest, SEQNO(inpkt), inpkt->len - digest_length(n->indigest), DATA(inpkt) + inpkt->len - digest_length(n->indigest));
258 static bool receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
259 vpn_packet_t pkt1, pkt2;
260 vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
263 pkt1.offset = DEFAULT_PACKET_OFFSET;
264 pkt2.offset = DEFAULT_PACKET_OFFSET;
266 if(n->status.sptps) {
267 if(!n->sptps.state) {
268 if(!n->status.waitingforkey) {
269 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but we haven't exchanged keys yet", n->name, n->hostname);
272 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
276 inpkt->offset += 2 * sizeof(node_id_t);
277 if(!sptps_receive_data(&n->sptps, DATA(inpkt), inpkt->len - 2 * sizeof(node_id_t))) {
278 logger(DEBUG_TRAFFIC, LOG_ERR, "Got bad packet from %s (%s)", n->name, n->hostname);
284 #ifdef DISABLE_LEGACY
287 if(!n->status.validkey_in) {
288 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got packet from %s (%s) but he hasn't got our key yet", n->name, n->hostname);
292 /* Check packet length */
294 if(inpkt->len < sizeof(seqno_t) + digest_length(n->indigest)) {
295 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got too short packet from %s (%s)",
296 n->name, n->hostname);
300 /* It's a legacy UDP packet, the data starts after the seqno */
302 inpkt->offset += sizeof(seqno_t);
304 /* Check the message authentication code */
306 if(digest_active(n->indigest)) {
307 inpkt->len -= digest_length(n->indigest);
308 if(!digest_verify(n->indigest, SEQNO(inpkt), inpkt->len, SEQNO(inpkt) + inpkt->len)) {
309 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Got unauthenticated packet from %s (%s)", n->name, n->hostname);
313 /* Decrypt the packet */
315 if(cipher_active(n->incipher)) {
316 vpn_packet_t *outpkt = pkt[nextpkt++];
319 if(!cipher_decrypt(n->incipher, SEQNO(inpkt), inpkt->len, SEQNO(outpkt), &outlen, true)) {
320 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Error decrypting packet from %s (%s)", n->name, n->hostname);
324 outpkt->len = outlen;
328 /* Check the sequence number */
331 memcpy(&seqno, SEQNO(inpkt), sizeof seqno);
332 seqno = ntohl(seqno);
333 inpkt->len -= sizeof seqno;
336 if(seqno != n->received_seqno + 1) {
337 if(seqno >= n->received_seqno + replaywin * 8) {
338 if(n->farfuture++ < replaywin >> 2) {
339 logger(DEBUG_ALWAYS, LOG_WARNING, "Packet from %s (%s) is %d seqs in the future, dropped (%u)",
340 n->name, n->hostname, seqno - n->received_seqno - 1, n->farfuture);
343 logger(DEBUG_ALWAYS, LOG_WARNING, "Lost %d packets from %s (%s)",
344 seqno - n->received_seqno - 1, n->name, n->hostname);
345 memset(n->late, 0, replaywin);
346 } else if (seqno <= n->received_seqno) {
347 if((n->received_seqno >= replaywin * 8 && seqno <= n->received_seqno - replaywin * 8) || !(n->late[(seqno / 8) % replaywin] & (1 << seqno % 8))) {
348 logger(DEBUG_ALWAYS, LOG_WARNING, "Got late or replayed packet from %s (%s), seqno %d, last received %d",
349 n->name, n->hostname, seqno, n->received_seqno);
353 for(int i = n->received_seqno + 1; i < seqno; i++)
354 n->late[(i / 8) % replaywin] |= 1 << i % 8;
359 n->late[(seqno / 8) % replaywin] &= ~(1 << seqno % 8);
362 if(seqno > n->received_seqno)
363 n->received_seqno = seqno;
367 if(n->received_seqno > MAX_SEQNO)
370 /* Decompress the packet */
372 length_t origlen = inpkt->len;
374 if(n->incompression) {
375 vpn_packet_t *outpkt = pkt[nextpkt++];
377 if((outpkt->len = uncompress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->incompression)) < 0) {
378 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
379 n->name, n->hostname);
385 origlen -= MTU/64 + 20;
390 if(!DATA(inpkt)[12] && !DATA(inpkt)[13])
391 udp_probe_h(n, inpkt, origlen);
393 receive_packet(n, inpkt);
398 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
400 outpkt.offset = DEFAULT_PACKET_OFFSET;
402 if(len > sizeof outpkt.data - outpkt.offset)
406 if(c->options & OPTION_TCPONLY)
409 outpkt.priority = -1;
410 memcpy(DATA(&outpkt), buffer, len);
412 receive_packet(c->node, &outpkt);
415 static void send_sptps_packet(node_t *n, vpn_packet_t *origpkt) {
416 if(!n->status.validkey && !n->connection)
422 if(!(DATA(origpkt)[12] | DATA(origpkt)[13])) {
423 sptps_send_record(&n->sptps, PKT_PROBE, (char *)DATA(origpkt), origpkt->len);
427 if(routing_mode == RMODE_ROUTER)
432 if(origpkt->len < offset)
437 if(n->outcompression) {
439 int len = compress_packet(DATA(&outpkt) + offset, DATA(origpkt) + offset, origpkt->len - offset, n->outcompression);
441 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)", n->name, n->hostname);
442 } else if(len < origpkt->len - offset) {
443 outpkt.len = len + offset;
445 type |= PKT_COMPRESSED;
449 /* If we have a direct metaconnection to n, and we can't use UDP, then
450 don't bother with SPTPS and just use a "plaintext" PACKET message.
451 We don't really care about end-to-end security since we're not
452 sending the message through any intermediate nodes. */
453 if(n->connection && origpkt->len > n->minmtu)
454 send_tcppacket(n->connection, origpkt);
456 sptps_send_record(&n->sptps, type, DATA(origpkt) + offset, origpkt->len - offset);
460 static void adapt_socket(const sockaddr_t *sa, int *sock) {
461 /* Make sure we have a suitable socket for the chosen address */
462 if(listen_socket[*sock].sa.sa.sa_family != sa->sa.sa_family) {
463 for(int i = 0; i < listen_sockets; i++) {
464 if(listen_socket[i].sa.sa.sa_family == sa->sa.sa_family) {
472 static void choose_udp_address(const node_t *n, const sockaddr_t **sa, int *sock) {
477 /* If the UDP address is confirmed, use it. */
478 if(n->status.udp_confirmed)
481 /* Send every third packet to n->address; that could be set
482 to the node's reflexive UDP address discovered during key
491 /* Otherwise, address are found in edges to this node.
492 So we pick a random edge and a random socket. */
495 int j = rand() % n->edge_tree->count;
496 edge_t *candidate = NULL;
498 for splay_each(edge_t, e, n->edge_tree) {
500 candidate = e->reverse;
506 *sa = &candidate->address;
507 *sock = rand() % listen_sockets;
510 adapt_socket(*sa, sock);
513 static void choose_local_address(const node_t *n, const sockaddr_t **sa, int *sock) {
516 /* Pick one of the edges from this node at random, then use its local address. */
519 int j = rand() % n->edge_tree->count;
520 edge_t *candidate = NULL;
522 for splay_each(edge_t, e, n->edge_tree) {
529 if (candidate && candidate->local_address.sa.sa_family) {
530 *sa = &candidate->local_address;
531 *sock = rand() % listen_sockets;
532 adapt_socket(*sa, sock);
536 static void send_udppacket(node_t *n, vpn_packet_t *origpkt) {
537 vpn_packet_t pkt1, pkt2;
538 vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
539 vpn_packet_t *inpkt = origpkt;
541 vpn_packet_t *outpkt;
542 int origlen = origpkt->len;
544 #if defined(SOL_IP) && defined(IP_TOS)
545 static int priority = 0;
546 int origpriority = origpkt->priority;
549 pkt1.offset = DEFAULT_PACKET_OFFSET;
550 pkt2.offset = DEFAULT_PACKET_OFFSET;
552 if(!n->status.reachable) {
553 logger(DEBUG_TRAFFIC, LOG_INFO, "Trying to send UDP packet to unreachable node %s (%s)", n->name, n->hostname);
558 return send_sptps_packet(n, origpkt);
560 #ifdef DISABLE_LEGACY
563 /* Make sure we have a valid key */
565 if(!n->status.validkey) {
566 logger(DEBUG_TRAFFIC, LOG_INFO,
567 "No valid key known yet for %s (%s), forwarding via TCP",
568 n->name, n->hostname);
569 send_tcppacket(n->nexthop->connection, origpkt);
573 if(n->options & OPTION_PMTU_DISCOVERY && inpkt->len > n->minmtu && (DATA(inpkt)[12] | DATA(inpkt)[13])) {
574 logger(DEBUG_TRAFFIC, LOG_INFO,
575 "Packet for %s (%s) larger than minimum MTU, forwarding via %s",
576 n->name, n->hostname, n != n->nexthop ? n->nexthop->name : "TCP");
579 send_packet(n->nexthop, origpkt);
581 send_tcppacket(n->nexthop->connection, origpkt);
586 /* Compress the packet */
588 if(n->outcompression) {
589 outpkt = pkt[nextpkt++];
591 if((outpkt->len = compress_packet(DATA(outpkt), DATA(inpkt), inpkt->len, n->outcompression)) < 0) {
592 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while compressing packet to %s (%s)",
593 n->name, n->hostname);
600 /* Add sequence number */
602 seqno_t seqno = htonl(++(n->sent_seqno));
603 memcpy(SEQNO(inpkt), &seqno, sizeof seqno);
604 inpkt->len += sizeof seqno;
606 /* Encrypt the packet */
608 if(cipher_active(n->outcipher)) {
609 outpkt = pkt[nextpkt++];
612 if(!cipher_encrypt(n->outcipher, SEQNO(inpkt), inpkt->len, SEQNO(outpkt), &outlen, true)) {
613 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
617 outpkt->len = outlen;
621 /* Add the message authentication code */
623 if(digest_active(n->outdigest)) {
624 if(!digest_create(n->outdigest, SEQNO(inpkt), inpkt->len, SEQNO(inpkt) + inpkt->len)) {
625 logger(DEBUG_TRAFFIC, LOG_ERR, "Error while encrypting packet to %s (%s)", n->name, n->hostname);
629 inpkt->len += digest_length(n->outdigest);
632 /* Send the packet */
634 const sockaddr_t *sa = NULL;
637 if(n->status.send_locally)
638 choose_local_address(n, &sa, &sock);
640 choose_udp_address(n, &sa, &sock);
642 #if defined(SOL_IP) && defined(IP_TOS)
643 if(priorityinheritance && origpriority != priority
644 && listen_socket[n->sock].sa.sa.sa_family == AF_INET) {
645 priority = origpriority;
646 logger(DEBUG_TRAFFIC, LOG_DEBUG, "Setting outgoing packet priority to %d", priority);
647 if(setsockopt(listen_socket[n->sock].udp.fd, SOL_IP, IP_TOS, &priority, sizeof(priority))) /* SO_PRIORITY doesn't seem to work */
648 logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "setsockopt", sockstrerror(sockerrno));
652 if(sendto(listen_socket[sock].udp.fd, SEQNO(inpkt), inpkt->len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
653 if(sockmsgsize(sockerrno)) {
654 if(n->maxmtu >= origlen)
655 n->maxmtu = origlen - 1;
656 if(n->mtu >= origlen)
657 n->mtu = origlen - 1;
660 logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending packet to %s (%s): %s", n->name, n->hostname, sockstrerror(sockerrno));
664 origpkt->len = origlen;
668 static bool send_sptps_data_priv(node_t *to, node_t *from, int type, const void *data, size_t len) {
669 node_t *relay = (to->via != myself && (type == PKT_PROBE || (len - SPTPS_DATAGRAM_OVERHEAD) <= to->via->minmtu)) ? to->via : to->nexthop;
670 bool direct = from == myself && to == relay;
671 bool relay_supported = (relay->options >> 24) >= 4;
672 bool tcponly = (myself->options | relay->options) & OPTION_TCPONLY;
674 /* Send it via TCP if it is a handshake packet, TCPOnly is in use, this is a relay packet that the other node cannot understand, or this packet is larger than the MTU.
675 TODO: When relaying, the original sender does not know the end-to-end PMTU (it only knows the PMTU of the first hop).
676 This can lead to scenarios where large packets are sent over UDP to relay, but then relay has no choice but fall back to TCP. */
678 if(type == SPTPS_HANDSHAKE || tcponly || (!direct && !relay_supported) || (type != PKT_PROBE && (len - SPTPS_DATAGRAM_OVERHEAD) > relay->minmtu)) {
679 char buf[len * 4 / 3 + 5];
680 b64encode(data, buf, len);
681 /* If no valid key is known yet, send the packets using ANS_KEY requests,
682 to ensure we get to learn the reflexive UDP address. */
683 if(from == myself && !to->status.validkey) {
684 to->incompression = myself->incompression;
685 return send_request(to->nexthop->connection, "%d %s %s %s -1 -1 -1 %d", ANS_KEY, from->name, to->name, buf, to->incompression);
687 return send_request(to->nexthop->connection, "%d %s %s %d %s", REQ_KEY, from->name, to->name, REQ_SPTPS, buf);
692 if(relay_supported) overhead += sizeof to->id + sizeof from->id;
693 char buf[len + overhead]; char* buf_ptr = buf;
694 if(relay_supported) {
696 /* Inform the recipient that this packet was sent directly. */
697 node_id_t nullid = {};
698 memcpy(buf_ptr, &nullid, sizeof nullid); buf_ptr += sizeof nullid;
700 memcpy(buf_ptr, &to->id, sizeof to->id); buf_ptr += sizeof to->id;
702 memcpy(buf_ptr, &from->id, sizeof from->id); buf_ptr += sizeof from->id;
705 /* TODO: if this copy turns out to be a performance concern, change sptps_send_record() to add some "pre-padding" to the buffer and use that instead */
706 memcpy(buf_ptr, data, len); buf_ptr += len;
708 const sockaddr_t *sa = NULL;
710 if(relay->status.send_locally)
711 choose_local_address(relay, &sa, &sock);
713 choose_udp_address(relay, &sa, &sock);
714 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet from %s (%s) to %s (%s) via %s (%s)", from->name, from->hostname, to->name, to->hostname, relay->name, relay->hostname);
715 if(sendto(listen_socket[sock].udp.fd, buf, buf_ptr - buf, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
716 if(sockmsgsize(sockerrno)) {
717 // Compensate for SPTPS overhead
718 len -= SPTPS_DATAGRAM_OVERHEAD;
719 if(relay->maxmtu >= len)
720 relay->maxmtu = len - 1;
721 if(relay->mtu >= len)
722 relay->mtu = len - 1;
725 logger(DEBUG_TRAFFIC, LOG_WARNING, "Error sending UDP SPTPS packet to %s (%s): %s", relay->name, relay->hostname, sockstrerror(sockerrno));
733 bool send_sptps_data(void *handle, uint8_t type, const void *data, size_t len) {
734 return send_sptps_data_priv(handle, myself, type, data, len);
737 bool receive_sptps_record(void *handle, uint8_t type, const void *data, uint16_t len) {
738 node_t *from = handle;
740 if(type == SPTPS_HANDSHAKE) {
741 if(!from->status.validkey) {
742 from->status.validkey = true;
743 from->status.waitingforkey = false;
744 logger(DEBUG_META, LOG_INFO, "SPTPS key exchange with %s (%s) succesful", from->name, from->hostname);
750 logger(DEBUG_ALWAYS, LOG_ERR, "Packet from %s (%s) larger than maximum supported size (%d > %d)", from->name, from->hostname, len, MTU);
755 inpkt.offset = DEFAULT_PACKET_OFFSET;
757 if(type == PKT_PROBE) {
759 memcpy(DATA(&inpkt), data, len);
760 udp_probe_h(from, &inpkt, len);
764 if(type & ~(PKT_COMPRESSED | PKT_MAC)) {
765 logger(DEBUG_ALWAYS, LOG_ERR, "Unexpected SPTPS record type %d len %d from %s (%s)", type, len, from->name, from->hostname);
769 /* Check if we have the headers we need */
770 if(routing_mode != RMODE_ROUTER && !(type & PKT_MAC)) {
771 logger(DEBUG_TRAFFIC, LOG_ERR, "Received packet from %s (%s) without MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
773 } else if(routing_mode == RMODE_ROUTER && (type & PKT_MAC)) {
774 logger(DEBUG_TRAFFIC, LOG_WARNING, "Received packet from %s (%s) with MAC header (maybe Mode is not set correctly)", from->name, from->hostname);
777 int offset = (type & PKT_MAC) ? 0 : 14;
778 if(type & PKT_COMPRESSED) {
779 length_t ulen = uncompress_packet(DATA(&inpkt) + offset, (const uint8_t *)data, len, from->incompression);
783 inpkt.len = ulen + offset;
785 if(inpkt.len > MAXSIZE)
788 memcpy(DATA(&inpkt) + offset, data, len);
789 inpkt.len = len + offset;
792 /* Generate the Ethernet packet type if necessary */
794 switch(DATA(&inpkt)[14] >> 4) {
796 DATA(&inpkt)[12] = 0x08;
797 DATA(&inpkt)[13] = 0x00;
800 DATA(&inpkt)[12] = 0x86;
801 DATA(&inpkt)[13] = 0xDD;
804 logger(DEBUG_TRAFFIC, LOG_ERR,
805 "Unknown IP version %d while reading packet from %s (%s)",
806 DATA(&inpkt)[14] >> 4, from->name, from->hostname);
811 receive_packet(from, &inpkt);
815 // This function tries to get SPTPS keys, if they aren't already known.
816 // This function makes no guarantees - it is up to the caller to check the node's state to figure out if the keys are available.
817 static void try_sptps(node_t *n) {
818 if(n->status.validkey)
821 logger(DEBUG_TRAFFIC, LOG_INFO, "No valid key known yet for %s (%s)", n->name, n->hostname);
823 if(!n->status.waitingforkey)
825 else if(n->last_req_key + 10 < now.tv_sec) {
826 logger(DEBUG_ALWAYS, LOG_DEBUG, "No key from %s after 10 seconds, restarting SPTPS", n->name);
827 sptps_stop(&n->sptps);
828 n->status.waitingforkey = false;
835 static void send_udp_probe_packet(node_t *n, int len) {
837 packet.offset = DEFAULT_PACKET_OFFSET;
838 memset(DATA(&packet), 0, 14);
839 randomize(DATA(&packet) + 14, len - 14);
843 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending UDP probe length %d to %s (%s)", len, n->name, n->hostname);
845 send_udppacket(n, &packet);
848 // This function tries to establish a UDP tunnel to a node so that packets can be sent.
849 // If a tunnel is already established, it makes sure it stays up.
850 // This function makes no guarantees - it is up to the caller to check the node's state to figure out if UDP is usable.
851 static void try_udp(node_t* n) {
855 struct timeval ping_tx_elapsed;
856 timersub(&now, &n->udp_ping_sent, &ping_tx_elapsed);
858 int interval = n->status.udp_confirmed ? udp_discovery_keepalive_interval : udp_discovery_interval;
860 if(ping_tx_elapsed.tv_sec >= interval) {
861 send_udp_probe_packet(n, MIN_PROBE_SIZE);
862 n->udp_ping_sent = now;
864 if(localdiscovery && !n->status.udp_confirmed && n->prevedge) {
865 n->status.send_locally = true;
866 send_udp_probe_packet(n, MIN_PROBE_SIZE);
867 n->status.send_locally = false;
872 static length_t choose_initial_maxmtu(node_t *n) {
877 const sockaddr_t *sa = NULL;
879 choose_udp_address(n, &sa, &sockindex);
883 sock = socket(sa->sa.sa_family, SOCK_DGRAM, IPPROTO_UDP);
885 logger(DEBUG_TRAFFIC, LOG_ERR, "Creating MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
889 if(connect(sock, &sa->sa, SALEN(sa->sa))) {
890 logger(DEBUG_TRAFFIC, LOG_ERR, "Connecting MTU assessment socket for %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
896 socklen_t ip_mtu_len = sizeof ip_mtu;
897 if(getsockopt(sock, IPPROTO_IP, IP_MTU, &ip_mtu, &ip_mtu_len)) {
898 logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) failed: %s", n->name, n->hostname, sockstrerror(sockerrno));
905 /* getsockopt(IP_MTU) returns the MTU of the physical interface.
906 We need to remove various overheads to get to the tinc MTU. */
907 length_t mtu = ip_mtu;
908 mtu -= (sa->sa.sa_family == AF_INET6) ? sizeof(struct ip6_hdr) : sizeof(struct ip);
910 if(n->status.sptps) {
911 mtu -= SPTPS_DATAGRAM_OVERHEAD;
912 if((n->options >> 24) >= 4)
913 mtu -= sizeof(node_id_t) + sizeof(node_id_t);
915 mtu -= digest_length(n->outdigest);
917 /* Now it's tricky. We use CBC mode, so the length of the
918 encrypted payload must be a multiple of the blocksize. The
919 sequence number is also part of the encrypted payload, so we
920 must account for it after correcting for the blocksize.
921 Furthermore, the padding in the last block must be at least
924 length_t blocksize = cipher_blocksize(n->outcipher);
936 logger(DEBUG_TRAFFIC, LOG_ERR, "getsockopt(IP_MTU) on %s (%s) returned absurdly small value: %d", n->name, n->hostname, ip_mtu);
942 logger(DEBUG_TRAFFIC, LOG_INFO, "Using system-provided maximum tinc MTU for %s (%s): %hd", n->name, n->hostname, mtu);
952 /* This function tries to determines the MTU of a node.
953 By calling this function repeatedly, n->minmtu will be progressively
954 increased, and at some point, n->mtu will be fixed to n->minmtu. If the MTU
955 is already fixed, this function checks if it can be increased.
958 static void try_mtu(node_t *n) {
959 if(!(n->options & OPTION_PMTU_DISCOVERY))
962 if(udp_discovery && !n->status.udp_confirmed) {
969 /* mtuprobes == 0..19: initial discovery, send bursts with 1 second interval, mtuprobes++
970 mtuprobes == 20: fix MTU, and go to -1
971 mtuprobes == -1: send one >maxmtu probe every pinginterval */
973 struct timeval elapsed;
974 timersub(&now, &n->mtu_ping_sent, &elapsed);
975 if(n->mtuprobes >= 0) {
976 if(n->mtuprobes != 0 && elapsed.tv_sec == 0 && elapsed.tv_usec < 333333)
979 if(elapsed.tv_sec < pinginterval)
983 n->mtu_ping_sent = now;
987 if(n->mtuprobes < 0) {
988 /* After the initial discovery, we only send one maxmtu and one
989 maxmtu+1 probe to detect PMTU increases. */
990 send_udp_probe_packet(n, n->maxmtu);
991 if(n->maxmtu + 1 < MTU)
992 send_udp_probe_packet(n, n->maxmtu + 1);
994 /* Before initial discovery begins, set maxmtu to the most likely value.
995 If it's underestimated, we will correct it after initial discovery. */
996 if(n->mtuprobes == 0)
997 n->maxmtu = choose_initial_maxmtu(n);
1000 /* Decreasing the number of probes per cycle might make the algorithm react faster to lost packets,
1001 but it will typically increase convergence time in the no-loss case. */
1002 const length_t probes_per_cycle = 8;
1004 /* This magic value was determined using math simulations.
1005 It will result in a 1329-byte first probe, followed (if there was a reply) by a 1407-byte probe.
1006 Since 1407 is just below the range of tinc MTUs over typical networks,
1007 this fine-tuning allows tinc to cover a lot of ground very quickly.
1008 This fine-tuning is only valid for maxmtu = MTU; if maxmtu is smaller,
1009 then it's better to use a multiplier of 1. Indeed, this leads to an interesting scenario
1010 if choose_initial_maxmtu() returns the actual MTU value - it will get confirmed with one single probe. */
1011 const float multiplier = (n->maxmtu == MTU) ? 0.97 : 1;
1013 const float cycle_position = probes_per_cycle - (n->mtuprobes % probes_per_cycle) - 1;
1014 const length_t minmtu = MAX(n->minmtu, 512);
1015 const float interval = n->maxmtu - minmtu;
1017 /* The core of the discovery algorithm is this exponential.
1018 It produces very large probes early in the cycle, and then it very quickly decreases the probe size.
1019 This reflects the fact that in the most difficult cases, we don't get any feedback for probes that
1020 are too large, and therefore we need to concentrate on small offsets so that we can quickly converge
1021 on the precise MTU as we are approaching it.
1022 The last probe of the cycle is always 1 byte in size - this is to make sure we'll get at least one
1023 reply per cycle so that we can make progress. */
1024 const length_t offset = powf(interval, multiplier * cycle_position / (probes_per_cycle - 1));
1026 length_t maxmtu = n->maxmtu;
1027 send_udp_probe_packet(n, minmtu + offset);
1028 /* If maxmtu changed, it means the probe was rejected by the system because it was too large.
1029 In that case, we recalculate with the new maxmtu and try again. */
1030 if(n->mtuprobes < 0 || maxmtu == n->maxmtu)
1034 if(n->mtuprobes >= 0)
1039 /* These functions try to establish a tunnel to a node (or its relay) so that
1040 packets can be sent (e.g. exchange keys).
1041 If a tunnel is already established, it tries to improve it (e.g. by trying
1042 to establish a UDP tunnel instead of TCP). This function makes no
1043 guarantees - it is up to the caller to check the node's state to figure out
1044 if TCP and/or UDP is usable. By calling this function repeatedly, the
1045 tunnel is gradually improved until we hit the wall imposed by the underlying
1046 network environment. It is recommended to call this function every time a
1047 packet is sent (or intended to be sent) to a node, so that the tunnel keeps
1048 improving as packets flow, and then gracefully downgrades itself as it goes
1052 static void try_tx_sptps(node_t *n, bool mtu) {
1053 /* If n is a TCP-only neighbor, we'll only use "cleartext" PACKET
1054 messages anyway, so there's no need for SPTPS at all. */
1056 if(n->connection && ((myself->options | n->options) & OPTION_TCPONLY))
1059 /* Otherwise, try to do SPTPS authentication with n if necessary. */
1063 /* Do we need to relay packets? */
1065 node_t *via = (n->via == myself) ? n->nexthop : n->via;
1067 /* If the relay doesn't support SPTPS, everything goes via TCP anyway. */
1069 if((via->options >> 24) < 4)
1072 /* If we do have a relay, try everything with that one instead. */
1075 return try_tx_sptps(via, mtu);
1082 static void try_tx_legacy(node_t *n, bool mtu) {
1083 /* Does he have our key? If not, send one. */
1085 if(!n->status.validkey_in)
1088 /* Check if we already have a key, or request one. */
1090 if(!n->status.validkey) {
1091 if(n->last_req_key + 10 <= now.tv_sec) {
1093 n->last_req_key = now.tv_sec;
1103 void try_tx(node_t *n, bool mtu) {
1105 try_tx_sptps(n, mtu);
1107 try_tx_legacy(n, mtu);
1110 void send_packet(node_t *n, vpn_packet_t *packet) {
1111 // If it's for myself, write it to the tun/tap device.
1115 memcpy(DATA(packet), mymac.x, ETH_ALEN);
1117 n->out_bytes += packet->len;
1118 devops.write(packet);
1122 logger(DEBUG_TRAFFIC, LOG_ERR, "Sending packet of %d bytes to %s (%s)", packet->len, n->name, n->hostname);
1124 // If the node is not reachable, drop it.
1126 if(!n->status.reachable) {
1127 logger(DEBUG_TRAFFIC, LOG_INFO, "Node %s (%s) is not reachable", n->name, n->hostname);
1131 // Keep track of packet statistics.
1134 n->out_bytes += packet->len;
1136 // Check if it should be sent as an SPTPS packet.
1138 if(n->status.sptps) {
1139 send_sptps_packet(n, packet);
1140 try_tx_sptps(n, true);
1144 // Determine which node to actually send it to.
1146 node_t *via = (packet->priority == -1 || n->via == myself) ? n->nexthop : n->via;
1149 logger(DEBUG_TRAFFIC, LOG_INFO, "Sending packet to %s via %s (%s)", n->name, via->name, n->via->hostname);
1151 // Try to send via UDP, unless TCP is forced.
1153 if(packet->priority == -1 || ((myself->options | via->options) & OPTION_TCPONLY)) {
1154 if(!send_tcppacket(via->connection, packet))
1155 terminate_connection(via->connection, true);
1159 send_udppacket(via, packet);
1160 try_tx_legacy(via, true);
1163 void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
1164 // Always give ourself a copy of the packet.
1166 send_packet(myself, packet);
1168 // In TunnelServer mode, do not forward broadcast packets.
1169 // The MST might not be valid and create loops.
1170 if(tunnelserver || broadcast_mode == BMODE_NONE)
1173 logger(DEBUG_TRAFFIC, LOG_INFO, "Broadcasting packet of %d bytes from %s (%s)",
1174 packet->len, from->name, from->hostname);
1176 switch(broadcast_mode) {
1177 // In MST mode, broadcast packets travel via the Minimum Spanning Tree.
1178 // This guarantees all nodes receive the broadcast packet, and
1179 // usually distributes the sending of broadcast packets over all nodes.
1181 for list_each(connection_t, c, connection_list)
1182 if(c->edge && c->status.mst && c != from->nexthop->connection)
1183 send_packet(c->node, packet);
1186 // In direct mode, we send copies to each node we know of.
1187 // However, this only reaches nodes that can be reached in a single hop.
1188 // We don't have enough information to forward broadcast packets in this case.
1193 for splay_each(node_t, n, node_tree)
1194 if(n->status.reachable && n != myself && ((n->via == myself && n->nexthop == n) || n->via == n))
1195 send_packet(n, packet);
1203 static node_t *try_harder(const sockaddr_t *from, const vpn_packet_t *pkt) {
1206 static time_t last_hard_try = 0;
1208 for splay_each(edge_t, e, edge_weight_tree) {
1209 if(!e->to->status.reachable || e->to == myself)
1212 if(sockaddrcmp_noport(from, &e->address)) {
1213 if(last_hard_try == now.tv_sec)
1218 if(!try_mac(e->to, pkt))
1226 last_hard_try = now.tv_sec;
1228 last_hard_try = now.tv_sec;
1232 void handle_incoming_vpn_data(void *data, int flags) {
1233 listen_socket_t *ls = data;
1236 node_id_t nullid = {};
1237 sockaddr_t addr = {};
1238 socklen_t addrlen = sizeof addr;
1240 bool direct = false;
1243 int len = recvfrom(ls->udp.fd, DATA(&pkt), MAXSIZE, 0, &addr.sa, &addrlen);
1245 if(len <= 0 || len > MAXSIZE) {
1246 if(!sockwouldblock(sockerrno))
1247 logger(DEBUG_ALWAYS, LOG_ERR, "Receiving packet failed: %s", sockstrerror(sockerrno));
1253 sockaddrunmap(&addr); /* Some braindead IPv6 implementations do stupid things. */
1255 // Try to figure out who sent this packet.
1257 node_t *n = lookup_node_udp(&addr);
1260 // It might be from a 1.1 node, which might have a source ID in the packet.
1261 pkt.offset = 2 * sizeof(node_id_t);
1262 from = lookup_node_id(SRCID(&pkt));
1263 if(from && !memcmp(DSTID(&pkt), &nullid, sizeof nullid) && from->status.sptps) {
1264 if(sptps_verify_datagram(&from->sptps, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t)))
1273 n = try_harder(&addr, &pkt);
1278 if(debug_level >= DEBUG_PROTOCOL) {
1279 hostname = sockaddr2hostname(&addr);
1280 logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from unknown source %s", hostname);
1286 if(n->status.sptps) {
1287 pkt.offset = 2 * sizeof(node_id_t);
1289 if(!memcmp(DSTID(&pkt), &nullid, sizeof nullid)) {
1294 from = lookup_node_id(SRCID(&pkt));
1295 to = lookup_node_id(DSTID(&pkt));
1298 logger(DEBUG_PROTOCOL, LOG_WARNING, "Received UDP packet from %s (%s) with unknown source and/or destination ID", n->name, n->hostname);
1303 send_sptps_data_priv(to, n, 0, DATA(&pkt), pkt.len - 2 * sizeof(node_id_t));
1312 if(!receive_udppacket(from, &pkt))
1315 n->sock = ls - listen_socket;
1316 if(direct && sockaddrcmp(&addr, &n->address))
1317 update_node_udp(n, &addr);
1320 void handle_device_data(void *data, int flags) {
1321 vpn_packet_t packet;
1322 packet.offset = DEFAULT_PACKET_OFFSET;
1323 packet.priority = 0;
1325 if(devops.read(&packet)) {
1326 myself->in_packets++;
1327 myself->in_bytes += packet.len;
1328 route(myself, &packet);