Remove forward declaration for do_decrement_ttl.
[oweals/tinc.git] / src / route.c
1 /*
2     route.c -- routing
3     Copyright (C) 2000-2005 Ivo Timmermans,
4                   2000-2014 Guus Sliepen <guus@tinc-vpn.org>
5
6     This program is free software; you can redistribute it and/or modify
7     it under the terms of the GNU General Public License as published by
8     the Free Software Foundation; either version 2 of the License, or
9     (at your option) any later version.
10
11     This program is distributed in the hope that it will be useful,
12     but WITHOUT ANY WARRANTY; without even the implied warranty of
13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14     GNU General Public License for more details.
15
16     You should have received a copy of the GNU General Public License along
17     with this program; if not, write to the Free Software Foundation, Inc.,
18     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19 */
20
21 #include "system.h"
22
23 #include "avl_tree.h"
24 #include "connection.h"
25 #include "ethernet.h"
26 #include "ipv4.h"
27 #include "ipv6.h"
28 #include "logger.h"
29 #include "net.h"
30 #include "protocol.h"
31 #include "route.h"
32 #include "subnet.h"
33 #include "utils.h"
34
35 rmode_t routing_mode = RMODE_ROUTER;
36 fmode_t forwarding_mode = FMODE_INTERNAL;
37 bmode_t broadcast_mode = BMODE_MST;
38 bool decrement_ttl = false;
39 bool directonly = false;
40 bool priorityinheritance = false;
41 int macexpire = 600;
42 bool overwrite_mac = false;
43 mac_t mymac = {{0xFE, 0xFD, 0, 0, 0, 0}};
44
45 /* Sizes of various headers */
46
47 static const size_t ether_size = sizeof(struct ether_header);
48 static const size_t arp_size = sizeof(struct ether_arp);
49 static const size_t ip_size = sizeof(struct ip);
50 static const size_t icmp_size = sizeof(struct icmp) - sizeof(struct ip);
51 static const size_t ip6_size = sizeof(struct ip6_hdr);
52 static const size_t icmp6_size = sizeof(struct icmp6_hdr);
53 static const size_t ns_size = sizeof(struct nd_neighbor_solicit);
54 static const size_t opt_size = sizeof(struct nd_opt_hdr);
55
56 #ifndef MAX
57 #define MAX(a, b) ((a) > (b) ? (a) : (b))
58 #endif
59
60 /* RFC 1071 */
61
62 static uint16_t inet_checksum(void *data, int len, uint16_t prevsum) {
63         uint16_t *p = data;
64         uint32_t checksum = prevsum ^ 0xFFFF;
65
66         while(len >= 2) {
67                 checksum += *p++;
68                 len -= 2;
69         }
70         
71         if(len)
72                 checksum += *(uint8_t *)p;
73
74         while(checksum >> 16)
75                 checksum = (checksum & 0xFFFF) + (checksum >> 16);
76
77         return ~checksum;
78 }
79
80 static bool ratelimit(int frequency) {
81         static time_t lasttime = 0;
82         static int count = 0;
83         
84         if(lasttime == now) {
85                 if(count >= frequency)
86                         return true;
87         } else {
88                 lasttime = now;
89                 count = 0;
90         }
91
92         count++;
93         return false;
94 }
95
96 static bool checklength(node_t *source, vpn_packet_t *packet, length_t length) {
97         if(packet->len < length) {
98                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Got too short packet from %s (%s)", source->name, source->hostname);
99                 return false;
100         } else
101                 return true;
102 }
103
104 static void swap_mac_addresses(vpn_packet_t *packet) {
105         mac_t tmp;
106         memcpy(&tmp, &packet->data[0], sizeof tmp);
107         memcpy(&packet->data[0], &packet->data[6], sizeof tmp);
108         memcpy(&packet->data[6], &tmp, sizeof tmp);
109 }
110
111 /* RFC 792 */
112
113 static void route_ipv4_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
114         struct ip ip = {0};
115         struct icmp icmp = {0};
116         
117         struct in_addr ip_src;
118         struct in_addr ip_dst;
119         uint32_t oldlen;
120
121         if(ratelimit(3))
122                 return;
123         
124         /* Swap Ethernet source and destination addresses */
125
126         swap_mac_addresses(packet);
127
128         /* Copy headers from packet into properly aligned structs on the stack */
129
130         memcpy(&ip, packet->data + ether_size, ip_size);
131
132         /* Remember original source and destination */
133         
134         ip_src = ip.ip_src;
135         ip_dst = ip.ip_dst;
136
137         /* Try to reply with an IP address assigned to the local machine */
138
139         if (type == ICMP_TIME_EXCEEDED && code == ICMP_EXC_TTL) {
140                 int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
141                 if (sockfd != -1) {
142                         struct sockaddr_in addr;
143                         memset(&addr, 0, sizeof(addr));
144                         addr.sin_family = AF_INET;
145                         addr.sin_addr = ip.ip_src;
146                         if (!connect(sockfd, (const struct sockaddr*) &addr, sizeof(addr))) {
147                                 memset(&addr, 0, sizeof(addr));
148                                 addr.sin_family = AF_INET;
149                                 socklen_t addrlen = sizeof(addr);
150                                 if (!getsockname(sockfd, (struct sockaddr*) &addr, &addrlen) && addrlen <= sizeof(addr)) {
151                                         ip_dst = addr.sin_addr;
152                                 }
153                         }
154                         close(sockfd);
155                 }
156         }
157
158         oldlen = packet->len - ether_size;
159
160         if(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
161                 icmp.icmp_nextmtu = htons(packet->len - ether_size);
162
163         if(oldlen >= IP_MSS - ip_size - icmp_size)
164                 oldlen = IP_MSS - ip_size - icmp_size;
165         
166         /* Copy first part of original contents to ICMP message */
167         
168         memmove(packet->data + ether_size + ip_size + icmp_size, packet->data + ether_size, oldlen);
169
170         /* Fill in IPv4 header */
171         
172         ip.ip_v = 4;
173         ip.ip_hl = ip_size / 4;
174         ip.ip_tos = 0;
175         ip.ip_len = htons(ip_size + icmp_size + oldlen);
176         ip.ip_id = 0;
177         ip.ip_off = 0;
178         ip.ip_ttl = 255;
179         ip.ip_p = IPPROTO_ICMP;
180         ip.ip_sum = 0;
181         ip.ip_src = ip_dst;
182         ip.ip_dst = ip_src;
183
184         ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
185         
186         /* Fill in ICMP header */
187         
188         icmp.icmp_type = type;
189         icmp.icmp_code = code;
190         icmp.icmp_cksum = 0;
191         
192         icmp.icmp_cksum = inet_checksum(&icmp, icmp_size, ~0);
193         icmp.icmp_cksum = inet_checksum(packet->data + ether_size + ip_size + icmp_size, oldlen, icmp.icmp_cksum);
194
195         /* Copy structs on stack back to packet */
196
197         memcpy(packet->data + ether_size, &ip, ip_size);
198         memcpy(packet->data + ether_size + ip_size, &icmp, icmp_size);
199         
200         packet->len = ether_size + ip_size + icmp_size + oldlen;
201
202         send_packet(source, packet);
203 }
204
205 /* RFC 2463 */
206
207 static void route_ipv6_unreachable(node_t *source, vpn_packet_t *packet, length_t ether_size, uint8_t type, uint8_t code) {
208         struct ip6_hdr ip6;
209         struct icmp6_hdr icmp6 = {0};
210         uint16_t checksum;      
211
212         struct {
213                 struct in6_addr ip6_src;        /* source address */
214                 struct in6_addr ip6_dst;        /* destination address */
215                 uint32_t length;
216                 uint32_t next;
217         } pseudo;
218
219         if(ratelimit(3))
220                 return;
221         
222         /* Swap Ethernet source and destination addresses */
223
224         swap_mac_addresses(packet);
225
226         /* Copy headers from packet to structs on the stack */
227
228         memcpy(&ip6, packet->data + ether_size, ip6_size);
229
230         /* Remember original source and destination */
231         
232         pseudo.ip6_src = ip6.ip6_dst;
233         pseudo.ip6_dst = ip6.ip6_src;
234
235         /* Try to reply with an IP address assigned to the local machine */
236
237         if (type == ICMP6_TIME_EXCEEDED && code == ICMP6_TIME_EXCEED_TRANSIT) {
238                 int sockfd = socket(AF_INET6, SOCK_DGRAM, 0);
239                 if (sockfd != -1) {
240                         struct sockaddr_in6 addr;
241                         memset(&addr, 0, sizeof(addr));
242                         addr.sin6_family = AF_INET6;
243                         addr.sin6_addr = ip6.ip6_src;
244                         if (!connect(sockfd, (const struct sockaddr*) &addr, sizeof(addr))) {
245                                 memset(&addr, 0, sizeof(addr));
246                                 addr.sin6_family = AF_INET6;
247                                 socklen_t addrlen = sizeof(addr);
248                                 if (!getsockname(sockfd, (struct sockaddr*) &addr, &addrlen) && addrlen <= sizeof(addr)) {
249                                         pseudo.ip6_src = addr.sin6_addr;
250                                 }
251                         }
252                         close(sockfd);
253                 }
254         }
255
256         pseudo.length = packet->len - ether_size;
257
258         if(type == ICMP6_PACKET_TOO_BIG)
259                 icmp6.icmp6_mtu = htonl(pseudo.length);
260         
261         if(pseudo.length >= IP_MSS - ip6_size - icmp6_size)
262                 pseudo.length = IP_MSS - ip6_size - icmp6_size;
263         
264         /* Copy first part of original contents to ICMP message */
265         
266         memmove(packet->data + ether_size + ip6_size + icmp6_size, packet->data + ether_size, pseudo.length);
267
268         /* Fill in IPv6 header */
269         
270         ip6.ip6_flow = htonl(0x60000000UL);
271         ip6.ip6_plen = htons(icmp6_size + pseudo.length);
272         ip6.ip6_nxt = IPPROTO_ICMPV6;
273         ip6.ip6_hlim = 255;
274         ip6.ip6_src = pseudo.ip6_src;
275         ip6.ip6_dst = pseudo.ip6_dst;
276
277         /* Fill in ICMP header */
278         
279         icmp6.icmp6_type = type;
280         icmp6.icmp6_code = code;
281         icmp6.icmp6_cksum = 0;
282
283         /* Create pseudo header */
284                 
285         pseudo.length = htonl(icmp6_size + pseudo.length);
286         pseudo.next = htonl(IPPROTO_ICMPV6);
287
288         /* Generate checksum */
289         
290         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
291         checksum = inet_checksum(&icmp6, icmp6_size, checksum);
292         checksum = inet_checksum(packet->data + ether_size + ip6_size + icmp6_size, ntohl(pseudo.length) - icmp6_size, checksum);
293
294         icmp6.icmp6_cksum = checksum;
295
296         /* Copy structs on stack back to packet */
297
298         memcpy(packet->data + ether_size, &ip6, ip6_size);
299         memcpy(packet->data + ether_size + ip6_size, &icmp6, icmp6_size);
300         
301         packet->len = ether_size + ip6_size + ntohl(pseudo.length);
302         
303         send_packet(source, packet);
304 }
305
306 static bool do_decrement_ttl(node_t *source, vpn_packet_t *packet) {
307         uint16_t type = packet->data[12] << 8 | packet->data[13];
308         length_t ethlen = ether_size;
309
310         if(type == ETH_P_8021Q) {
311                 type = packet->data[16] << 8 | packet->data[17];
312                 ethlen += 4;
313         }
314
315         switch (type) {
316                 case ETH_P_IP:
317                         if(!checklength(source, packet, ethlen + ip_size))
318                                 return false;
319
320                         if(packet->data[ethlen + 8] <= 1) {
321                                 if(packet->data[ethlen + 11] != IPPROTO_ICMP || packet->data[ethlen + 32] != ICMP_TIME_EXCEEDED)
322                                         route_ipv4_unreachable(source, packet, ethlen, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL);
323                                 return false;
324                         }
325
326                         uint16_t old = packet->data[ethlen + 8] << 8 | packet->data[ethlen + 9];
327                         packet->data[ethlen + 8]--;
328                         uint16_t new = packet->data[ethlen + 8] << 8 | packet->data[ethlen + 9];
329
330                         uint32_t checksum = packet->data[ethlen + 10] << 8 | packet->data[ethlen + 11];
331                         checksum += old + (~new & 0xFFFF);
332                         while(checksum >> 16)
333                                 checksum = (checksum & 0xFFFF) + (checksum >> 16);
334                         packet->data[ethlen + 10] = checksum >> 8;
335                         packet->data[ethlen + 11] = checksum & 0xff;
336
337                         return true;
338
339                 case ETH_P_IPV6:
340                         if(!checklength(source, packet, ethlen + ip6_size))
341                                 return false;
342
343                         if(packet->data[ethlen + 7] <= 1) {
344                                 if(packet->data[ethlen + 6] != IPPROTO_ICMPV6 || packet->data[ethlen + 40] != ICMP6_TIME_EXCEEDED)
345                                         route_ipv6_unreachable(source, packet, ethlen, ICMP6_TIME_EXCEEDED, ICMP6_TIME_EXCEED_TRANSIT);
346                                 return false;
347                         }
348
349                         packet->data[ethlen + 7]--;
350
351                         return true;
352
353                 default:
354                         return true;
355         }
356 }
357
358 static void clamp_mss(const node_t *source, const node_t *via, vpn_packet_t *packet) {
359         if(!source || !via || !(via->options & OPTION_CLAMP_MSS))
360                 return;
361
362         uint16_t mtu = source->mtu;
363         if(via != myself && via->mtu < mtu)
364                 mtu = via->mtu;
365
366         /* Find TCP header */
367         int start = ether_size;
368         uint16_t type = packet->data[12] << 8 | packet->data[13];
369
370         if(type == ETH_P_8021Q) {
371                 start += 4;
372                 type = packet->data[16] << 8 | packet->data[17];
373         }
374
375         if(type == ETH_P_IP && packet->data[start + 9] == 6)
376                 start += (packet->data[start] & 0xf) * 4;
377         else if(type == ETH_P_IPV6 && packet->data[start + 6] == 6)
378                 start += 40;
379         else
380                 return;
381
382         if(packet->len <= start + 20)
383                 return;
384
385         /* Use data offset field to calculate length of options field */
386         int len = ((packet->data[start + 12] >> 4) - 5) * 4;
387
388         if(packet->len < start + 20 + len)
389                 return;
390
391         /* Search for MSS option header */
392         for(int i = 0; i < len;) {
393                 if(packet->data[start + 20 + i] == 0)
394                         break;
395
396                 if(packet->data[start + 20 + i] == 1) {
397                         i++;
398                         continue;
399                 }
400
401                 if(i > len - 2 || i > len - packet->data[start + 21 + i])
402                         break;
403
404                 if(packet->data[start + 20 + i] != 2) {
405                         if(packet->data[start + 21 + i] < 2)
406                                 break;
407                         i += packet->data[start + 21 + i];
408                         continue;
409                 }
410
411                 if(packet->data[start + 21] != 4)
412                         break;
413
414                 /* Found it */
415                 uint16_t oldmss = packet->data[start + 22 + i] << 8 | packet->data[start + 23 + i];
416                 uint16_t newmss = mtu - start - 20;
417                 uint32_t csum = packet->data[start + 16] << 8 | packet->data[start + 17];
418
419                 if(oldmss <= newmss)
420                         break;
421                 
422                 ifdebug(TRAFFIC) logger(LOG_INFO, "Clamping MSS of packet from %s to %s to %d", source->name, via->name, newmss);
423
424                 /* Update the MSS value and the checksum */
425                 packet->data[start + 22 + i] = newmss >> 8;
426                 packet->data[start + 23 + i] = newmss & 0xff;
427                 csum ^= 0xffff;
428                 csum += oldmss ^ 0xffff;
429                 csum += newmss;
430                 csum = (csum & 0xffff) + (csum >> 16);
431                 csum += csum >> 16;
432                 csum ^= 0xffff;
433                 packet->data[start + 16] = csum >> 8;
434                 packet->data[start + 17] = csum;
435                 break;
436         }
437 }
438         
439 static void learn_mac(mac_t *address) {
440         subnet_t *subnet;
441         avl_node_t *node;
442         connection_t *c;
443
444         subnet = lookup_subnet_mac(myself, address);
445
446         /* If we don't know this MAC address yet, store it */
447
448         if(!subnet) {
449                 ifdebug(TRAFFIC) logger(LOG_INFO, "Learned new MAC address %x:%x:%x:%x:%x:%x",
450                                    address->x[0], address->x[1], address->x[2], address->x[3],
451                                    address->x[4], address->x[5]);
452
453                 subnet = new_subnet();
454                 subnet->type = SUBNET_MAC;
455                 subnet->expires = now + macexpire;
456                 subnet->net.mac.address = *address;
457                 subnet->weight = 10;
458                 subnet_add(myself, subnet);
459                 subnet_update(myself, subnet, true);
460
461                 /* And tell all other tinc daemons it's our MAC */
462
463                 for(node = connection_tree->head; node; node = node->next) {
464                         c = node->data;
465                         if(c->status.active)
466                                 send_add_subnet(c, subnet);
467                 }
468         }
469
470         if(subnet->expires)
471                 subnet->expires = now + macexpire;
472 }
473
474 void age_subnets(void) {
475         subnet_t *s;
476         connection_t *c;
477         avl_node_t *node, *next, *node2;
478
479         for(node = myself->subnet_tree->head; node; node = next) {
480                 next = node->next;
481                 s = node->data;
482                 if(s->expires && s->expires <= now) {
483                         ifdebug(TRAFFIC) {
484                                 char netstr[MAXNETSTR];
485                                 if(net2str(netstr, sizeof netstr, s))
486                                         logger(LOG_INFO, "Subnet %s expired", netstr);
487                         }
488
489                         for(node2 = connection_tree->head; node2; node2 = node2->next) {
490                                 c = node2->data;
491                                 if(c->status.active)
492                                         send_del_subnet(c, s);
493                         }
494
495                         subnet_update(myself, s, false);
496                         subnet_del(myself, s);
497                 }
498         }
499 }
500
501 static void route_broadcast(node_t *source, vpn_packet_t *packet) {
502         if(decrement_ttl && source != myself)
503                 if(!do_decrement_ttl(source, packet))
504                         return;
505
506         broadcast_packet(source, packet);
507 }
508
509 /* RFC 791 */
510
511 static void fragment_ipv4_packet(node_t *dest, vpn_packet_t *packet, length_t ether_size) {
512         struct ip ip;
513         vpn_packet_t fragment;
514         int len, maxlen, todo;
515         uint8_t *offset;
516         uint16_t ip_off, origf;
517         
518         memcpy(&ip, packet->data + ether_size, ip_size);
519         fragment.priority = packet->priority;
520
521         if(ip.ip_hl != ip_size / 4)
522                 return;
523         
524         todo = ntohs(ip.ip_len) - ip_size;
525
526         if(ether_size + ip_size + todo != packet->len) {
527                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Length of packet (%d) doesn't match length in IPv4 header (%d)", packet->len, (int)(ether_size + ip_size + todo));
528                 return;
529         }
530
531         ifdebug(TRAFFIC) logger(LOG_INFO, "Fragmenting packet of %d bytes to %s (%s)", packet->len, dest->name, dest->hostname);
532
533         offset = packet->data + ether_size + ip_size;
534         maxlen = (dest->mtu - ether_size - ip_size) & ~0x7;
535         ip_off = ntohs(ip.ip_off);
536         origf = ip_off & ~IP_OFFMASK;
537         ip_off &= IP_OFFMASK;
538         
539         while(todo) {
540                 len = todo > maxlen ? maxlen : todo;
541                 memcpy(fragment.data + ether_size + ip_size, offset, len);
542                 todo -= len;
543                 offset += len;
544
545                 ip.ip_len = htons(ip_size + len);
546                 ip.ip_off = htons(ip_off | origf | (todo ? IP_MF : 0));
547                 ip.ip_sum = 0;
548                 ip.ip_sum = inet_checksum(&ip, ip_size, ~0);
549                 memcpy(fragment.data, packet->data, ether_size);
550                 memcpy(fragment.data + ether_size, &ip, ip_size);
551                 fragment.len = ether_size + ip_size + len;
552
553                 send_packet(dest, &fragment);
554
555                 ip_off += len / 8;
556         }       
557 }
558
559 static void route_ipv4_unicast(node_t *source, vpn_packet_t *packet) {
560         subnet_t *subnet;
561         node_t *via;
562         ipv4_t dest;
563
564         memcpy(&dest, &packet->data[30], sizeof dest);
565         subnet = lookup_subnet_ipv4(&dest);
566
567         if(!subnet) {
568                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet from %s (%s): unknown IPv4 destination address %d.%d.%d.%d",
569                                 source->name, source->hostname,
570                                 dest.x[0],
571                                 dest.x[1],
572                                 dest.x[2],
573                                 dest.x[3]);
574
575                 route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNKNOWN);
576                 return;
577         }
578         
579         if(subnet->owner == source) {
580                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
581                 return;
582         }
583
584         if(!subnet->owner->status.reachable)
585                 return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_UNREACH);
586
587         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself)
588                 return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
589
590         if(decrement_ttl && source != myself && subnet->owner != myself)
591                 if(!do_decrement_ttl(source, packet))
592                         return;
593
594         if(priorityinheritance)
595                 packet->priority = packet->data[15];
596
597         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
598
599         if(via == source) {
600                 ifdebug(TRAFFIC) logger(LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
601                 return;
602         }
603         
604         if(directonly && subnet->owner != via)
605                 return route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_NET_ANO);
606
607         if(via && packet->len > MAX(via->mtu, 590) && via != myself) {
608                 ifdebug(TRAFFIC) logger(LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
609                 if(packet->data[20] & 0x40) {
610                         packet->len = MAX(via->mtu, 590);
611                         route_ipv4_unreachable(source, packet, ether_size, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
612                 } else {
613                         fragment_ipv4_packet(via, packet, ether_size);
614                 }
615
616                 return;
617         }
618
619         clamp_mss(source, via, packet);
620  
621         send_packet(subnet->owner, packet);
622 }
623
624 static void route_ipv4(node_t *source, vpn_packet_t *packet) {
625         if(!checklength(source, packet, ether_size + ip_size))
626                 return;
627
628         if(broadcast_mode && (((packet->data[30] & 0xf0) == 0xe0) || (
629                         packet->data[30] == 255 &&
630                         packet->data[31] == 255 &&
631                         packet->data[32] == 255 &&
632                         packet->data[33] == 255)))
633                 route_broadcast(source, packet);
634         else
635                 route_ipv4_unicast(source, packet);
636 }
637
638 static void route_ipv6_unicast(node_t *source, vpn_packet_t *packet) {
639         subnet_t *subnet;
640         node_t *via;
641         ipv6_t dest;
642
643         memcpy(&dest, &packet->data[38], sizeof dest);
644         subnet = lookup_subnet_ipv6(&dest);
645
646         if(!subnet) {
647                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet from %s (%s): unknown IPv6 destination address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
648                                 source->name, source->hostname,
649                                 ntohs(dest.x[0]),
650                                 ntohs(dest.x[1]),
651                                 ntohs(dest.x[2]),
652                                 ntohs(dest.x[3]),
653                                 ntohs(dest.x[4]),
654                                 ntohs(dest.x[5]),
655                                 ntohs(dest.x[6]),
656                                 ntohs(dest.x[7]));
657
658                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR);
659                 return;
660         }
661
662         if(subnet->owner == source) {
663                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
664                 return;
665         }
666
667         if(!subnet->owner->status.reachable)
668                 return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOROUTE);
669
670         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself)
671                 return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
672
673         if(decrement_ttl && source != myself && subnet->owner != myself)
674                 if(!do_decrement_ttl(source, packet))
675                         return;
676
677         via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
678         
679         if(via == source) {
680                 ifdebug(TRAFFIC) logger(LOG_ERR, "Routing loop for packet from %s (%s)!", source->name, source->hostname);
681                 return;
682         }
683         
684         if(directonly && subnet->owner != via)
685                 return route_ipv6_unreachable(source, packet, ether_size, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADMIN);
686
687         if(via && packet->len > MAX(via->mtu, 1294) && via != myself) {
688                 ifdebug(TRAFFIC) logger(LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
689                 packet->len = MAX(via->mtu, 1294);
690                 route_ipv6_unreachable(source, packet, ether_size, ICMP6_PACKET_TOO_BIG, 0);
691                 return;
692         }
693
694         clamp_mss(source, via, packet);
695  
696         send_packet(subnet->owner, packet);
697 }
698
699 /* RFC 2461 */
700
701 static void route_neighborsol(node_t *source, vpn_packet_t *packet) {
702         struct ip6_hdr ip6;
703         struct nd_neighbor_solicit ns;
704         struct nd_opt_hdr opt;
705         subnet_t *subnet;
706         uint16_t checksum;
707         bool has_opt;
708
709         struct {
710                 struct in6_addr ip6_src;        /* source address */
711                 struct in6_addr ip6_dst;        /* destination address */
712                 uint32_t length;
713                 uint32_t next;
714         } pseudo;
715
716         if(!checklength(source, packet, ether_size + ip6_size + ns_size))
717                 return;
718         
719         has_opt = packet->len >= ether_size + ip6_size + ns_size + opt_size + ETH_ALEN;
720         
721         if(source != myself) {
722                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Got neighbor solicitation request from %s (%s) while in router mode!", source->name, source->hostname);
723                 return;
724         }
725
726         /* Copy headers from packet to structs on the stack */
727
728         memcpy(&ip6, packet->data + ether_size, ip6_size);
729         memcpy(&ns, packet->data + ether_size + ip6_size, ns_size);
730         if(has_opt)
731                 memcpy(&opt, packet->data + ether_size + ip6_size + ns_size, opt_size);
732
733         /* First, snatch the source address from the neighbor solicitation packet */
734
735         if(overwrite_mac)
736                 memcpy(mymac.x, packet->data + ETH_ALEN, ETH_ALEN);
737
738         /* Check if this is a valid neighbor solicitation request */
739
740         if(ns.nd_ns_hdr.icmp6_type != ND_NEIGHBOR_SOLICIT ||
741            (has_opt && opt.nd_opt_type != ND_OPT_SOURCE_LINKADDR)) {
742                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet: received unknown type neighbor solicitation request");
743                 return;
744         }
745
746         /* Create pseudo header */
747
748         pseudo.ip6_src = ip6.ip6_src;
749         pseudo.ip6_dst = ip6.ip6_dst;
750         if(has_opt)
751                 pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
752         else
753                 pseudo.length = htonl(ns_size);
754         pseudo.next = htonl(IPPROTO_ICMPV6);
755
756         /* Generate checksum */
757
758         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
759         checksum = inet_checksum(&ns, ns_size, checksum);
760         if(has_opt) {
761                 checksum = inet_checksum(&opt, opt_size, checksum);
762                 checksum = inet_checksum(packet->data + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
763         }
764
765         if(checksum) {
766                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet: checksum error for neighbor solicitation request");
767                 return;
768         }
769
770         /* Check if the IPv6 address exists on the VPN */
771
772         subnet = lookup_subnet_ipv6((ipv6_t *) &ns.nd_ns_target);
773
774         if(!subnet) {
775                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet: neighbor solicitation request for unknown address %hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
776                                    ntohs(((uint16_t *) &ns.nd_ns_target)[0]),
777                                    ntohs(((uint16_t *) &ns.nd_ns_target)[1]),
778                                    ntohs(((uint16_t *) &ns.nd_ns_target)[2]),
779                                    ntohs(((uint16_t *) &ns.nd_ns_target)[3]),
780                                    ntohs(((uint16_t *) &ns.nd_ns_target)[4]),
781                                    ntohs(((uint16_t *) &ns.nd_ns_target)[5]),
782                                    ntohs(((uint16_t *) &ns.nd_ns_target)[6]),
783                                    ntohs(((uint16_t *) &ns.nd_ns_target)[7]));
784
785                 return;
786         }
787
788         /* Check if it is for our own subnet */
789
790         if(subnet->owner == myself)
791                 return;                                 /* silently ignore */
792
793         if(decrement_ttl)
794                 if(!do_decrement_ttl(source, packet))
795                         return;
796
797         /* Create neighbor advertation reply */
798
799         memcpy(packet->data, packet->data + ETH_ALEN, ETH_ALEN);        /* copy destination address */
800         packet->data[ETH_ALEN * 2 - 1] ^= 0xFF; /* mangle source address so it looks like it's not from us */
801
802         ip6.ip6_dst = ip6.ip6_src;                      /* swap destination and source protocoll address */
803         ip6.ip6_src = ns.nd_ns_target;
804
805         if(has_opt)
806                 memcpy(packet->data + ether_size + ip6_size + ns_size + opt_size, packet->data + ETH_ALEN, ETH_ALEN);   /* add fake source hard addr */
807
808         ns.nd_ns_cksum = 0;
809         ns.nd_ns_type = ND_NEIGHBOR_ADVERT;
810         ns.nd_ns_reserved = htonl(0x40000000UL);        /* Set solicited flag */
811         opt.nd_opt_type = ND_OPT_TARGET_LINKADDR;
812
813         /* Create pseudo header */
814
815         pseudo.ip6_src = ip6.ip6_src;
816         pseudo.ip6_dst = ip6.ip6_dst;
817         if(has_opt)
818                 pseudo.length = htonl(ns_size + opt_size + ETH_ALEN);
819         else
820                 pseudo.length = htonl(ns_size);
821         pseudo.next = htonl(IPPROTO_ICMPV6);
822
823         /* Generate checksum */
824
825         checksum = inet_checksum(&pseudo, sizeof(pseudo), ~0);
826         checksum = inet_checksum(&ns, ns_size, checksum);
827         if(has_opt) {
828                 checksum = inet_checksum(&opt, opt_size, checksum);
829                 checksum = inet_checksum(packet->data + ether_size + ip6_size + ns_size + opt_size, ETH_ALEN, checksum);
830         }
831
832         ns.nd_ns_hdr.icmp6_cksum = checksum;
833
834         /* Copy structs on stack back to packet */
835
836         memcpy(packet->data + ether_size, &ip6, ip6_size);
837         memcpy(packet->data + ether_size + ip6_size, &ns, ns_size);
838         if(has_opt)
839                 memcpy(packet->data + ether_size + ip6_size + ns_size, &opt, opt_size);
840
841         send_packet(source, packet);
842 }
843
844 static void route_ipv6(node_t *source, vpn_packet_t *packet) {
845         if(!checklength(source, packet, ether_size + ip6_size))
846                 return;
847
848         if(packet->data[20] == IPPROTO_ICMPV6 && checklength(source, packet, ether_size + ip6_size + icmp6_size) && packet->data[54] == ND_NEIGHBOR_SOLICIT) {
849                 route_neighborsol(source, packet);
850                 return;
851         }
852
853         if(broadcast_mode && packet->data[38] == 255)
854                 route_broadcast(source, packet);
855         else
856                 route_ipv6_unicast(source, packet);
857 }
858
859 /* RFC 826 */
860
861 static void route_arp(node_t *source, vpn_packet_t *packet) {
862         struct ether_arp arp;
863         subnet_t *subnet;
864         struct in_addr addr;
865
866         if(!checklength(source, packet, ether_size + arp_size))
867                 return;
868
869         if(source != myself) {
870                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Got ARP request from %s (%s) while in router mode!", source->name, source->hostname);
871                 return;
872         }
873
874         /* First, snatch the source address from the ARP packet */
875
876         if(overwrite_mac)
877                 memcpy(mymac.x, packet->data + ETH_ALEN, ETH_ALEN);
878
879         /* Copy headers from packet to structs on the stack */
880
881         memcpy(&arp, packet->data + ether_size, arp_size);
882
883         /* Check if this is a valid ARP request */
884
885         if(ntohs(arp.arp_hrd) != ARPHRD_ETHER || ntohs(arp.arp_pro) != ETH_P_IP ||
886            arp.arp_hln != ETH_ALEN || arp.arp_pln != sizeof(addr) || ntohs(arp.arp_op) != ARPOP_REQUEST) {
887                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet: received unknown type ARP request");
888                 return;
889         }
890
891         /* Check if the IPv4 address exists on the VPN */
892
893         subnet = lookup_subnet_ipv4((ipv4_t *) &arp.arp_tpa);
894
895         if(!subnet) {
896                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet: ARP request for unknown address %d.%d.%d.%d",
897                                    arp.arp_tpa[0], arp.arp_tpa[1], arp.arp_tpa[2],
898                                    arp.arp_tpa[3]);
899                 return;
900         }
901
902         /* Check if it is for our own subnet */
903
904         if(subnet->owner == myself)
905                 return;                                 /* silently ignore */
906
907         if(decrement_ttl)
908                 if(!do_decrement_ttl(source, packet))
909                         return;
910
911         memcpy(packet->data, packet->data + ETH_ALEN, ETH_ALEN);        /* copy destination address */
912         packet->data[ETH_ALEN * 2 - 1] ^= 0xFF; /* mangle source address so it looks like it's not from us */
913
914         memcpy(&addr, arp.arp_tpa, sizeof(addr));       /* save protocol addr */
915         memcpy(arp.arp_tpa, arp.arp_spa, sizeof(addr)); /* swap destination and source protocol address */
916         memcpy(arp.arp_spa, &addr, sizeof(addr));       /* ... */
917
918         memcpy(arp.arp_tha, arp.arp_sha, ETH_ALEN);     /* set target hard/proto addr */
919         memcpy(arp.arp_sha, packet->data + ETH_ALEN, ETH_ALEN); /* add fake source hard addr */
920         arp.arp_op = htons(ARPOP_REPLY);
921
922         /* Copy structs on stack back to packet */
923
924         memcpy(packet->data + ether_size, &arp, arp_size);
925
926         send_packet(source, packet);
927 }
928
929 static void route_mac(node_t *source, vpn_packet_t *packet) {
930         subnet_t *subnet;
931         mac_t dest;
932
933         /* Learn source address */
934
935         if(source == myself) {
936                 mac_t src;
937                 memcpy(&src, &packet->data[6], sizeof src);
938                 learn_mac(&src);
939         }
940
941         /* Lookup destination address */
942
943         memcpy(&dest, &packet->data[0], sizeof dest);
944         subnet = lookup_subnet_mac(NULL, &dest);
945
946         if(!subnet) {
947                 route_broadcast(source, packet);
948                 return;
949         }
950
951         if(subnet->owner == source) {
952                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Packet looping back to %s (%s)!", source->name, source->hostname);
953                 return;
954         }
955
956         if(forwarding_mode == FMODE_OFF && source != myself && subnet->owner != myself)
957                 return;
958
959         if(decrement_ttl && source != myself && subnet->owner != myself)
960                 if(!do_decrement_ttl(source, packet))
961                         return;
962
963         uint16_t type = packet->data[12] << 8 | packet->data[13];
964
965         if(priorityinheritance && type == ETH_P_IP && packet->len >= ether_size + ip_size)
966                 packet->priority = packet->data[15];
967
968         // Handle packets larger than PMTU
969
970         node_t *via = (subnet->owner->via == myself) ? subnet->owner->nexthop : subnet->owner->via;
971
972         if(directonly && subnet->owner != via)
973                 return;
974         
975         if(via && packet->len > via->mtu && via != myself) {
976                 ifdebug(TRAFFIC) logger(LOG_INFO, "Packet for %s (%s) length %d larger than MTU %d", subnet->owner->name, subnet->owner->hostname, packet->len, via->mtu);
977                 length_t ethlen = 14;
978
979                 if(type == ETH_P_8021Q) {
980                         type = packet->data[16] << 8 | packet->data[17];
981                         ethlen += 4;
982                 }
983
984                 if(type == ETH_P_IP && packet->len > 576 + ethlen) {
985                         if(packet->data[6 + ethlen] & 0x40) {
986                                 packet->len = via->mtu;
987                                 route_ipv4_unreachable(source, packet, ethlen, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED);
988                         } else {
989                                 fragment_ipv4_packet(via, packet, ethlen);
990                         }
991                         return;
992                 } else if(type == ETH_P_IPV6 && packet->len > 1280 + ethlen) {
993                         packet->len = via->mtu;
994                         route_ipv6_unreachable(source, packet, ethlen, ICMP6_PACKET_TOO_BIG, 0);
995                         return;
996                 }
997         }
998
999         clamp_mss(source, via, packet);
1000  
1001         send_packet(subnet->owner, packet);
1002 }
1003
1004 void route(node_t *source, vpn_packet_t *packet) {
1005         if(forwarding_mode == FMODE_KERNEL && source != myself) {
1006                 send_packet(myself, packet);
1007                 return;
1008         }
1009
1010         if(!checklength(source, packet, ether_size))
1011                 return;
1012
1013         switch (routing_mode) {
1014                 case RMODE_ROUTER:
1015                         {
1016                                 uint16_t type = packet->data[12] << 8 | packet->data[13];
1017
1018                                 switch (type) {
1019                                         case ETH_P_ARP:
1020                                                 route_arp(source, packet);
1021                                                 break;
1022
1023                                         case ETH_P_IP:
1024                                                 route_ipv4(source, packet);
1025                                                 break;
1026
1027                                         case ETH_P_IPV6:
1028                                                 route_ipv6(source, packet);
1029                                                 break;
1030
1031                                         default:
1032                                                 ifdebug(TRAFFIC) logger(LOG_WARNING, "Cannot route packet from %s (%s): unknown type %hx", source->name, source->hostname, type);
1033                                                 break;
1034                                 }
1035                         }
1036                         break;
1037
1038                 case RMODE_SWITCH:
1039                         route_mac(source, packet);
1040                         break;
1041
1042                 case RMODE_HUB:
1043                         route_broadcast(source, packet);
1044                         break;
1045         }
1046 }