Flood unicast packet with unknown destination to all clients

index ab3f10c..e7040be 100644
@@ -991,6 +991,33 @@ multi_learn_addr (struct multi_context *m,
 }
 
 /*
+ * Do we have client instance associated with address?
+ */
+static bool
+multi_check_known_addr (struct multi_context *m,
+				    const struct mroute_addr *addr)
+{
+  struct multi_route *route;
+
+  /* check for local address */
+  if (mroute_addr_equal (addr, &m->local))
+    /* we don't need flooding of all clients when address is local */
+    return true;
+
+  route = (struct multi_route *) hash_lookup (m->vhash, addr);
+
+  /* does host route (possible cached) exist? */
+  if (route && multi_route_defined (m, route))
+    {
+      return true;
+    }
+  else
+    {
+      return false;
+    }
+}
+
+/*
  * Get client instance based on virtual address.
  */
 static struct multi_instance *

@@ -2341,8 +2368,11 @@ multi_process_incoming_tun (struct multi_context *m, const unsigned int mpp_flag
 	{
 	  struct context *c;
 
-	  /* broadcast or multicast dest addr? */
-	  if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST))
+	  /* Broadcast or multicast dest addr? Or unknown unicast dest addr? */
+	  if ((mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST))
+	       || (m->top.options.tap_flood_unknown_unicast == true
+		   && dev_type == DEV_TYPE_TAP
+		   && !multi_check_known_addr (m, &dest)))
 	    {
 	      /* for now, treat multicast as broadcast */
 #ifdef ENABLE_PF

index 0ae2c61..2d9736c 100644
@@ -473,6 +473,8 @@ static const char usage_message[] =
   "--tcp-nodelay   : Macro that sets TCP_NODELAY socket flag on the server\n"
   "                  as well as pushes it to connecting clients.\n"
   "--learn-address cmd : Run command cmd to validate client virtual addresses.\n"
+  "--tap-flood-unknown-unicast  : Flood an unicast packet to all clients whether destination\n"
+  "                               address is not bound to any client.\n"
   "--connect-freq n s : Allow a maximum of n new connections per s seconds.\n"
   "--max-clients n : Allow a maximum of n simultaneously connected clients.\n"
   "--max-routes-per-client n : Allow a maximum of n internal routes per client.\n"

@@ -1194,6 +1196,7 @@ show_p2mp_parms (const struct options *o)
   SHOW_INT (virtual_hash_size);
   SHOW_STR (client_connect_script);
   SHOW_STR (learn_address_script);
+  SHOW_BOOL (tap_flood_unknown_unicast);
   SHOW_STR (client_disconnect_script);
   SHOW_STR (client_config_dir);
   SHOW_BOOL (ccd_exclusive);

@@ -2102,6 +2105,8 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
 	msg (M_USAGE, "--hash-size requires --mode server");
       if (options->learn_address_script)
 	msg (M_USAGE, "--learn-address requires --mode server");
+      if (options->tap_flood_unknown_unicast)
+	msg (M_USAGE, "--tap-flood-unknown-unicast requires --mode server");
       if (options->client_connect_script)
 	msg (M_USAGE, "--client-connect requires --mode server");
       if (options->client_disconnect_script)

@@ -6119,6 +6124,10 @@ add_option (struct options *options,
     {
       VERIFY_PERMISSION (OPT_P_ROUTE_EXTRAS);
     }
+  else if (streq (p[0], "tap-flood-unknown-unicast"))
+    {
+      options->tap_flood_unknown_unicast = true;
+    }
   else if (streq (p[0], "pkcs11-id-type") ||
            streq (p[0], "pkcs11-sign-mode") ||
            streq (p[0], "pkcs11-slot") ||

index f80532c..cba1049 100644
@@ -591,6 +591,8 @@ struct options
   bool show_net_up;
   int route_method;
 #endif
+
+  bool tap_flood_unknown_unicast;
 };
 
 #define streq(x, y) (!strcmp((x), (y)))

index 2839b30..e008c1a 100644
@@ -1002,6 +1002,33 @@ multi_learn_addr (struct multi_context *m,
 }
 
 /*
+ * Do we have client instance associated with address?
+ */
+static bool
+multi_check_known_addr (struct multi_context *m,
+				    const struct mroute_addr *addr)
+{
+  struct multi_route *route;
+
+  /* check for local address */
+  if (mroute_addr_equal (addr, &m->local))
+    /* we don't need flooding of all clients when address is local */
+    return true;
+
+  route = (struct multi_route *) hash_lookup (m->vhash, addr);
+
+  /* does host route (possible cached) exist? */
+  if (route && multi_route_defined (m, route))
+    {
+      return true;
+    }
+  else
+    {
+      return false;
+    }
+}
+
+/*
  * Get client instance based on virtual address.
  */
 static struct multi_instance *

@@ -2348,8 +2375,11 @@ multi_process_incoming_tun (struct multi_context *m, const unsigned int mpp_flag
 	{
 	  struct context *c;
 
-	  /* broadcast or multicast dest addr? */
-	  if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST))
+	  /* Broadcast or multicast dest addr? Or unknown unicast dest addr? */
+	  if ((mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST))
+	       || (m->top.options.tap_flood_unknown_unicast == true
+		   && dev_type == DEV_TYPE_TAP
+		   && !multi_check_known_addr (m, &dest)))
 	    {
 	      /* for now, treat multicast as broadcast */
 #ifdef ENABLE_PF

index ef6170c..6018a94 100644
@@ -492,6 +492,8 @@ static const char usage_message[] =
   "                  sessions to a web server at host:port.  dir specifies an\n"
   "                  optional directory to write origin IP:port data.\n"
 #endif
+  "--tap-flood-unknown-unicast  : Flood an unicast packet to all clients whether destination\n"
+  "                               address is not bound to any client.\n"
 #endif
   "\n"
   "Client options (when connecting to a multi-client server):\n"

@@ -1230,6 +1232,7 @@ show_p2mp_parms (const struct options *o)
   SHOW_STR (port_share_host);
   SHOW_STR (port_share_port);
 #endif
+  SHOW_BOOL (tap_flood_unknown_unicast);
 #endif /* P2MP_SERVER */
 
   SHOW_BOOL (client);

@@ -2143,6 +2146,8 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
         msg (M_USAGE, "--stale-routes-check requires --mode server");
       if (compat_flag (COMPAT_FLAG_QUERY | COMPAT_NO_NAME_REMAPPING))
         msg (M_USAGE, "--compat-x509-names no-remapping requires --mode server");
+      if (options->tap_flood_unknown_unicast)
+	msg (M_USAGE, "--tap-flood-unknown-unicast requires --mode server");
     }
 #endif /* P2MP_SERVER */
 

@@ -5724,6 +5729,10 @@ add_option (struct options *options,
       options->port_share_journal_dir = p[3];
     }
 #endif
+  else if (streq (p[0], "tap-flood-unknown-unicast"))
+    {
+      options->tap_flood_unknown_unicast = true;
+    }
   else if (streq (p[0], "client-to-client"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);

index 27bbc14..47289f9 100644
@@ -458,6 +458,7 @@ struct options
   char *port_share_port;
   const char *port_share_journal_dir;
 #endif
+  bool tap_flood_unknown_unicast;
 #endif
 
   bool client;