OpenVPN
forward.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22
23#ifdef HAVE_CONFIG_H
24#include "config.h"
25#endif
26
27#include "syshead.h"
28
29#include "forward.h"
30#include "init.h"
31#include "push.h"
32#include "gremlin.h"
33#include "mss.h"
34#include "event.h"
35#include "occ.h"
36#include "ping.h"
37#include "ps.h"
38#include "dhcp.h"
39#include "common.h"
40#include "ssl_verify.h"
41#include "dco.h"
42#include "auth_token.h"
43#include "tun_afunix.h"
44
45#include "memdbg.h"
46
47#include "mstats.h"
48
51
52/* show event wait debugging info */
53
54#ifdef ENABLE_DEBUG
55
56static const char *
57wait_status_string(struct context *c, struct gc_arena *gc)
58{
59 struct buffer out = alloc_buf_gc(64, gc);
60
61 buf_printf(&out, "I/O WAIT %s|%s| %s", tun_stat(c->c1.tuntap, EVENT_READ, gc),
62 tun_stat(c->c1.tuntap, EVENT_WRITE, gc), tv_string(&c->c2.timeval, gc));
63 for (int i = 0; i < c->c1.link_sockets_num; i++)
64 {
65 buf_printf(&out, "\n %s|%s", socket_stat(c->c2.link_sockets[i], EVENT_READ, gc),
66 socket_stat(c->c2.link_sockets[i], EVENT_WRITE, gc));
67 }
68 return BSTR(&out);
69}
70
71static void
73{
74 struct gc_arena gc = gc_new();
75 dmsg(D_EVENT_WAIT, "%s", wait_status_string(c, &gc));
76 gc_free(&gc);
77}
78
79#endif /* ifdef ENABLE_DEBUG */
80
81static void
83{
84 msg(D_STREAM_ERRORS, "Fatal TLS error (check_tls_errors_co), restarting");
85 register_signal(c->sig, c->c2.tls_exit_signal, "tls-error"); /* SOFT-SIGUSR1 -- TLS error */
86}
87
88static void
90{
91 register_signal(c->sig, c->c2.tls_exit_signal, "tls-error"); /* SOFT-SIGUSR1 -- TLS error */
92}
93
94/*
95 * TLS errors are fatal in TCP mode.
96 * Also check for --tls-exit trigger.
97 */
98static inline void
100{
101 if (c->c2.tls_multi && c->c2.tls_exit_signal)
102 {
104 {
105 if (c->c2.tls_multi->n_soft_errors)
106 {
108 }
109 }
110 else
111 {
112 if (c->c2.tls_multi->n_hard_errors)
113 {
115 }
116 }
117 }
118}
119
120/*
121 * Set our wakeup to 0 seconds, so we will be rescheduled
122 * immediately.
123 */
124static inline void
126{
127 c->c2.timeval.tv_sec = 0; /* ZERO-TIMEOUT */
128 c->c2.timeval.tv_usec = 0;
129}
130
131static inline void
133{
134 if (sec < 0)
135 {
136 sec = 0;
137 }
138 if (sec < c->c2.timeval.tv_sec)
139 {
140 c->c2.timeval.tv_sec = sec;
141 c->c2.timeval.tv_usec = 0;
142 }
143}
144
145void
147{
148 /* DCO context is not yet initialised or enabled */
149 if (!dco_enabled(&c->options))
150 {
151 return;
152 }
153
154 /* no active peer (p2p tls-server mode) */
155 if (c->c2.tls_multi->dco_peer_id == -1)
156 {
157 return;
158 }
159
160 if (!dco_update_keys(&c->c1.tuntap->dco, c->c2.tls_multi))
161 {
162 /* Something bad happened. Kill the connection to
163 * be able to recover. */
164 register_signal(c->sig, SIGUSR1, "dco update keys error");
165 }
166}
167
168/*
169 * In TLS mode, let TLS level respond to any control-channel
170 * packets which were received, or prepare any packets for
171 * transmission.
172 *
173 * tmp_int is purely an optimization that allows us to call
174 * tls_multi_process less frequently when there's not much
175 * traffic on the control-channel.
176 *
177 */
178static void
180{
181 interval_t wakeup = BIG_TIMEOUT;
182
183 if (interval_test(&c->c2.tmp_int))
184 {
185 const int tmp_status = tls_multi_process(
186 c->c2.tls_multi, &c->c2.to_link, &c->c2.to_link_addr, get_link_socket_info(c), &wakeup);
187
188 if (tmp_status == TLSMP_RECONNECT)
189 {
192 }
193
194 if (tmp_status == TLSMP_ACTIVE || tmp_status == TLSMP_RECONNECT)
195 {
196 update_time();
198 }
199 else if (tmp_status == TLSMP_KILL)
200 {
201 if (c->options.mode == MODE_SERVER)
202 {
204 }
205 else
206 {
207 register_signal(c->sig, SIGTERM, "auth-control-exit");
208 }
209 }
210
212 }
213
214 interval_schedule_wakeup(&c->c2.tmp_int, &wakeup);
215
216 /*
217 * Our current code has no good hooks in the TLS machinery to update
218 * DCO keys. So we check the key status after the whole TLS machinery
219 * has been completed and potentially update them
220 *
221 * We have a hidden state transition from secondary to primary key based
222 * on ks->auth_deferred_expire that DCO needs to check that the normal
223 * TLS state engine does not check. So we call the \c check_dco_key_status
224 * function even if tmp_status does not indicate that something has changed.
225 */
227
228 if (wakeup)
229 {
230 context_reschedule_sec(c, wakeup);
231 }
232}
233
234static void
236{
237 if (buf_string_match_head_str(buf, "AUTH_FAILED"))
238 {
239 receive_auth_failed(c, buf);
240 }
241 else if (buf_string_match_head_str(buf, "PUSH_"))
242 {
243 incoming_push_message(c, buf);
244 }
245 else if (buf_string_match_head_str(buf, "RESTART"))
246 {
247 server_pushed_signal(c, buf, true, 7);
248 }
249 else if (buf_string_match_head_str(buf, "HALT"))
250 {
251 server_pushed_signal(c, buf, false, 4);
252 }
253 else if (buf_string_match_head_str(buf, "INFO_PRE"))
254 {
255 server_pushed_info(buf, 8);
256 }
257 else if (buf_string_match_head_str(buf, "INFO"))
258 {
259 server_pushed_info(buf, 4);
260 }
261 else if (buf_string_match_head_str(buf, "CR_RESPONSE"))
262 {
263 receive_cr_response(c, buf);
264 }
265 else if (buf_string_match_head_str(buf, "AUTH_PENDING"))
266 {
267 receive_auth_pending(c, buf);
268 }
269 else if (buf_string_match_head_str(buf, "EXIT"))
270 {
272 }
273 else
274 {
275 msg(D_PUSH_ERRORS, "WARNING: Received unknown control message: %s", BSTR(buf));
276 }
277}
278
279/*
280 * Handle incoming configuration
281 * messages on the control channel.
282 */
283static void
285{
286 int len = tls_test_payload_len(c->c2.tls_multi);
287 /* We should only be called with len >0 */
288 ASSERT(len > 0);
289
290 struct gc_arena gc = gc_new();
291 struct buffer buf = alloc_buf_gc(len, &gc);
292 if (tls_rec_payload(c->c2.tls_multi, &buf))
293 {
294 while (BLEN(&buf) > 1)
295 {
296 struct buffer cmdbuf = extract_command_buffer(&buf, &gc);
297
298 if (cmdbuf.len > 0)
299 {
301 }
302 }
303 }
304 else
305 {
306 msg(D_PUSH_ERRORS, "WARNING: Receive control message failed");
307 }
308
309 gc_free(&gc);
310}
311
312/*
313 * Periodically resend PUSH_REQUEST until PUSH message received
314 */
315static void
317{
319
320 /* if no response to first push_request, retry at PUSH_REQUEST_INTERVAL second intervals */
321 event_timeout_modify_wakeup(&c->c2.push_request_interval, PUSH_REQUEST_INTERVAL);
322}
323
324/*
325 * Things that need to happen immediately after connection initiation should go here.
326 *
327 * Options like --up-delay need to be triggered by this function which
328 * checks for connection establishment.
329 *
330 * Note: The process_incoming_push_reply currently assumes that this function
331 * only sets up the pull request timer when pull is enabled.
332 */
333static void
335{
337 {
338 /* if --pull was specified, send a push request to server */
339 if (c->c2.tls_multi && c->options.pull)
340 {
341#ifdef ENABLE_MANAGEMENT
342 if (management)
343 {
345 NULL);
346 }
347#endif
348 /* fire up push request right away (already 1s delayed) */
349 /* We might receive a AUTH_PENDING request before we armed this
350 * timer. In that case we don't change the value */
351 if (c->c2.push_request_timeout < now)
352 {
353 c->c2.push_request_timeout = now + c->options.handshake_window;
354 }
355 event_timeout_init(&c->c2.push_request_interval, 0, now);
357 }
358 else
359 {
360 if (!do_up(c, false, 0))
361 {
362 register_signal(c->sig, SIGUSR1, "connection initialisation failed");
363 }
364 }
365
366 event_timeout_clear(&c->c2.wait_for_connect);
367 }
368}
369
370bool
372{
373 struct gc_arena gc = gc_new();
374 bool stat;
375
377 struct key_state *ks = &session->key[KS_PRIMARY];
378
379 /* buffered cleartext write onto TLS control channel */
380 stat = tls_send_payload(ks, (uint8_t *)str, strlen(str) + 1);
381
382 msg(msglevel, "SENT CONTROL [%s]: '%s' (status=%d)",
383 session->common_name ? session->common_name : "UNDEF", sanitize_control_message(str, &gc),
384 (int)stat);
385
386 gc_free(&gc);
387 return stat;
388}
389
390void
392{
394 context_immediate_reschedule(c); /* ZERO-TIMEOUT */
395}
396
397bool
398send_control_channel_string(struct context *c, const char *str, int msglevel)
399{
400 if (c->c2.tls_multi)
401 {
403 bool ret = send_control_channel_string_dowork(session, str, msglevel);
405
406 return ret;
407 }
408 return true;
409}
410/*
411 * Add routes.
412 */
413
414static void
415check_add_routes_action(struct context *c, const bool errors)
416{
417 bool route_status = do_route(&c->options, c->c1.route_list, c->c1.route_ipv6_list, c->c1.tuntap,
418 c->plugins, c->c2.es, &c->net_ctx);
419
420 int flags = (errors ? ISC_ERRORS : 0);
421 flags |= (!route_status ? ISC_ROUTE_ERRORS : 0);
422
423 update_time();
426 initialization_sequence_completed(c, flags); /* client/p2p --route-delay was defined */
427}
428
429static void
431{
432 if (test_routes(c->c1.route_list, c->c1.tuntap))
433 {
434 check_add_routes_action(c, false);
435 }
437 {
439 }
440 else
441 {
442 msg(D_ROUTE, "Route: Waiting for TUN/TAP interface to come up...");
443 if (c->c1.tuntap)
444 {
445 if (!tun_standby(c->c1.tuntap))
446 {
447 register_signal(c->sig, SIGHUP, "ip-fail");
449#ifdef _WIN32
452#endif
453 }
454 }
455 update_time();
456 if (c->c2.route_wakeup.n != 1)
457 {
459 }
461 }
462}
463
464/*
465 * Should we exit due to inactivity timeout?
466 *
467 * In the non-dco case, the timeout is reset via register_activity()
468 * whenever there is sufficient activity on tun or link, so this function
469 * is only ever called to raise the TERM signal.
470 *
471 * With DCO, OpenVPN does not see incoming or outgoing data packets anymore
472 * and the logic needs to change - we permit the event to trigger and check
473 * kernel DCO counters here, returning and rearming the timer if there was
474 * sufficient traffic.
475 */
476static void
478{
479 if (dco_enabled(&c->options) && dco_get_peer_stats(c, true) == 0)
480 {
481 int64_t tot_bytes = c->c2.tun_read_bytes + c->c2.tun_write_bytes;
482 int64_t new_bytes = tot_bytes - c->c2.inactivity_bytes;
483
484 if (new_bytes > c->options.inactivity_minimum_bytes)
485 {
486 c->c2.inactivity_bytes = tot_bytes;
488 return;
489 }
490 }
491
492 msg(M_INFO, "Inactivity timeout (--inactive), exiting");
493 register_signal(c->sig, SIGTERM, "inactive");
494}
495
496int
498{
499 update_time();
500 int remaining = event_timeout_remaining(server_poll_timeout);
501 return max_int(0, remaining);
502}
503
504static void
506{
508 ASSERT(c->c2.tls_multi);
510 {
511 msg(M_INFO, "Server poll timeout, restarting");
512 register_signal(c->sig, SIGUSR1, "server_poll");
514 }
515}
516
517/*
518 * Schedule a SIGTERM signal c->options.scheduled_exit_interval seconds from now.
519 */
520bool
522{
523 const int n_seconds = c->options.scheduled_exit_interval;
524 /* don't reschedule if already scheduled. */
526 {
527 return false;
528 }
530 update_time();
532 event_timeout_init(&c->c2.scheduled_exit, n_seconds, now);
533 c->c2.scheduled_exit_signal = SIGTERM;
534 msg(D_SCHED_EXIT, "Delayed exit in %d seconds", n_seconds);
535 return true;
536}
537
538/*
539 * Scheduled exit?
540 */
541static void
543{
544 register_signal(c->sig, c->c2.scheduled_exit_signal, "delayed-exit");
545}
546
547/*
548 * Should we write timer-triggered status file.
549 */
550static void
552{
553 if (c->c1.status_output)
554 {
556 }
557}
558
559#ifdef ENABLE_FRAGMENT
560/*
561 * Should we deliver a datagram fragment to remote?
562 * c is expected to be a single-link context (p2p or child)
563 */
564static void
566{
567 struct link_socket_info *lsi = get_link_socket_info(c);
568
569 /* OS MTU Hint? */
570 if (lsi->mtu_changed && lsi->lsa)
571 {
573 lsi->mtu_changed = false;
574 }
575
577 {
578 if (!c->c2.to_link.len)
579 {
580 /* encrypt a fragment for output to TCP/UDP port */
582 encrypt_sign(c, false);
583 }
584 }
585
587}
588#endif /* ifdef ENABLE_FRAGMENT */
589
590/*
591 * Buffer reallocation, for use with null encryption.
592 */
593static inline void
594buffer_turnover(const uint8_t *orig_buf, struct buffer *dest_stub, struct buffer *src_stub,
595 struct buffer *storage)
596{
597 if (orig_buf == src_stub->data && src_stub->data != storage->data)
598 {
599 buf_assign(storage, src_stub);
600 *dest_stub = *storage;
601 }
602 else
603 {
604 *dest_stub = *src_stub;
605 }
606}
607
608/*
609 * Compress, fragment, encrypt and HMAC-sign an outgoing packet.
610 * Input: c->c2.buf
611 * Output: c->c2.to_link
612 */
613void
614encrypt_sign(struct context *c, bool comp_frag)
615{
616 struct context_buffers *b = c->c2.buffers;
617 const uint8_t *orig_buf = c->c2.buf.data;
618 struct crypto_options *co = NULL;
619
620 if (dco_enabled(&c->options))
621 {
622 msg(M_WARN, "Attempting to send data packet while data channel offload is in use. "
623 "Dropping packet");
624 c->c2.buf.len = 0;
625 }
626
627 /*
628 * Drop non-TLS outgoing packet if client-connect script/plugin
629 * has not yet succeeded. In non-TLS tls_multi mode is not defined
630 * and we always pass packets.
631 */
633 {
634 c->c2.buf.len = 0;
635 }
636
637 if (comp_frag)
638 {
639#ifdef USE_COMP
640 /* Compress the packet. */
641 if (c->c2.comp_context)
642 {
643 (*c->c2.comp_context->alg.compress)(&c->c2.buf, b->compress_buf, c->c2.comp_context,
644 &c->c2.frame);
645 }
646#endif
647#ifdef ENABLE_FRAGMENT
648 if (c->c2.fragment)
649 {
651 }
652#endif
653 }
654
655 /* initialize work buffer with buf.headroom bytes of prepend capacity */
657
658 if (c->c2.tls_multi)
659 {
660 /* Get the key we will use to encrypt the packet. */
661 tls_pre_encrypt(c->c2.tls_multi, &c->c2.buf, &co);
662 /* If using P_DATA_V2, prepend the 1-byte opcode and 3-byte peer-id to the
663 * packet before openvpn_encrypt(), so we can authenticate the opcode too.
664 */
665 if (c->c2.buf.len > 0 && c->c2.tls_multi->use_peer_id)
666 {
668 }
669 }
670 else
671 {
672 co = &c->c2.crypto_options;
673 }
674
675 /* Encrypt and authenticate the packet */
676 openvpn_encrypt(&c->c2.buf, b->encrypt_buf, co);
677
678 /* Do packet administration */
679 if (c->c2.tls_multi)
680 {
681 if (c->c2.buf.len > 0 && !c->c2.tls_multi->use_peer_id)
682 {
684 }
686 }
687
688 /*
689 * Get the address we will be sending the packet to.
690 */
692
693 /* if null encryption, copy result to read_tun_buf */
694 buffer_turnover(orig_buf, &c->c2.to_link, &c->c2.buf, &b->read_tun_buf);
695}
696
697/*
698 * Should we exit due to session timeout?
699 */
700static void
702{
705 {
706 msg(M_INFO, "Session timeout, exiting");
707 register_signal(c->sig, SIGTERM, "session-timeout");
708 }
709}
710
711/*
712 * Coarse timers work to 1 second resolution.
713 */
714static void
716{
717 /* flush current packet-id to file once per 60
718 * seconds if --replay-persist was specified */
721 {
723 }
724
725 /* Should we write timer-triggered status file */
726 if (c->c1.status_output
728 {
730 }
731
732 /* process connection establishment items */
734 {
736 }
737
738 /* see if we should send a push_request (option --pull) */
740 {
742 }
743
744 /* process --route options */
746 {
748 }
749
750 /* check if we want to refresh the auth-token */
752 {
754 }
755
756 /* possibly exit due to --inactive */
759 {
761 }
762
763 if (c->sig->signal_received)
764 {
765 return;
766 }
767
768 /* kill session if time is over */
770 if (c->sig->signal_received)
771 {
772 return;
773 }
774
775 /* restart if ping not received */
777 if (c->sig->signal_received)
778 {
779 return;
780 }
781
782 if (c->c2.tls_multi)
783 {
786 {
788 }
789 if (c->sig->signal_received)
790 {
791 return;
792 }
794 {
796 }
797 if (c->sig->signal_received)
798 {
799 return;
800 }
801 }
802
803 /* Should we send an OCC_REQUEST message? */
805
806 /* Should we send an MTU load test? */
808
809 /* Should we send an OCC_EXIT message to remote? */
811 {
813 }
814
815 /* Should we ping the remote? */
817
818#ifdef ENABLE_MANAGEMENT
819 if (management)
820 {
822 }
823#endif /* ENABLE_MANAGEMENT */
824}
825
826static void
828{
829 if (now < c->c2.coarse_timer_wakeup)
830 {
832 return;
833 }
834
835 const struct timeval save = c->c2.timeval;
836 c->c2.timeval.tv_sec = BIG_TIMEOUT;
837 c->c2.timeval.tv_usec = 0;
839 c->c2.coarse_timer_wakeup = now + c->c2.timeval.tv_sec;
840
841 dmsg(D_INTERVAL, "TIMER: coarse timer wakeup %" PRIi64 " seconds",
842 (int64_t)c->c2.timeval.tv_sec);
843
844 /* Is the coarse timeout NOT the earliest one? */
845 if (c->c2.timeval.tv_sec > save.tv_sec)
846 {
847 c->c2.timeval = save;
848 }
849}
850
851static void
853{
854 const int update_interval = 10; /* seconds */
855 c->c2.update_timeout_random_component = now + update_interval;
856 c->c2.timeout_random_component.tv_usec = (time_t)get_random() & 0x0003FFFF;
857 c->c2.timeout_random_component.tv_sec = 0;
858
859 dmsg(D_INTERVAL, "RANDOM USEC=%ld", (long)c->c2.timeout_random_component.tv_usec);
860}
861
862static inline void
864{
866 {
868 }
869 if (c->c2.timeval.tv_sec >= 1)
870 {
872 }
873}
874
875/*
876 * Handle addition and removal of the 10-byte Socks5 header
877 * in UDP packets.
878 */
879
880static inline void
882{
883 if (sock->socks_proxy && sock->info.proto == PROTO_UDP)
884 {
886 }
887}
888
889static inline void
891 struct link_socket_actual **to_addr, int *size_delta)
892{
893 if (sock->socks_proxy && sock->info.proto == PROTO_UDP)
894 {
895 *size_delta += socks_process_outgoing_udp(&c->c2.to_link, c->c2.to_link_addr);
896 *to_addr = &sock->socks_relay;
897 }
898}
899
900/* undo effect of socks_preprocess_outgoing_link */
901static inline void
902link_socket_write_post_size_adjust(int *size, int size_delta, struct buffer *buf)
903{
904 if (size_delta > 0 && *size > size_delta)
905 {
906 *size -= size_delta;
907 if (!buf_advance(buf, size_delta))
908 {
909 *size = 0;
910 }
911 }
912}
913
914/*
915 * Output: c->c2.buf
916 */
917
918void
919read_incoming_link(struct context *c, struct link_socket *sock)
920{
921 /*
922 * Set up for recvfrom call to read datagram
923 * sent to our TCP/UDP port.
924 */
925 int status;
926
927 /*ASSERT (!c->c2.to_tun.len);*/
928
930
931 c->c2.buf = c->c2.buffers->read_link_buf;
933
934 status = link_socket_read(sock, &c->c2.buf, &c->c2.from);
935
937 {
938#if PORT_SHARE
939 if (port_share && socket_foreign_protocol_detected(sock))
940 {
941 const struct buffer *fbuf = socket_foreign_protocol_head(sock);
942 const int sd = socket_foreign_protocol_sd(sock);
944 register_signal(c->sig, SIGTERM, "port-share-redirect");
945 }
946 else
947#endif
948 {
949 /* received a disconnect from a connection-oriented protocol */
950 if (event_timeout_defined(&c->c2.explicit_exit_notification_interval))
951 {
953 "Connection reset during exit notification period, ignoring [%d]", status);
955 }
956 else
957 {
959 "connection-reset"); /* SOFT-SIGUSR1 -- TCP connection reset */
960 msg(D_STREAM_ERRORS, "Connection reset, restarting [%d]", status);
961 }
962 }
963 perf_pop();
964 return;
965 }
966
967 /* check_status() call below resets last-error code */
969
970 /* check recvfrom status */
971 check_status(status, "read", sock, NULL);
972
973 if (dco_win_timeout)
974 {
976 }
977
978 /* Remove socks header if applicable */
980
981 perf_pop();
982}
983
984bool
986{
987 struct gc_arena gc = gc_new();
988 bool decrypt_status = false;
989
990 if (c->c2.buf.len > 0)
991 {
992 c->c2.link_read_bytes += c->c2.buf.len;
994#ifdef ENABLE_MEMSTATS
995 if (mmap_stats)
996 {
997 mmap_stats->link_read_bytes = link_read_bytes_global;
998 }
999#endif
1000 c->c2.original_recv_size = c->c2.buf.len;
1001 }
1002 else
1003 {
1004 c->c2.original_recv_size = 0;
1005 }
1006
1007#ifdef ENABLE_DEBUG
1008 /* take action to corrupt packet if we are in gremlin test mode */
1009 if (c->options.gremlin)
1010 {
1011 if (!ask_gremlin(c->options.gremlin))
1012 {
1013 c->c2.buf.len = 0;
1014 }
1015 corrupt_gremlin(&c->c2.buf, c->options.gremlin);
1016 }
1017#endif
1018
1019 /* log incoming packet */
1020#ifdef LOG_RW
1021 if (c->c2.log_rw && c->c2.buf.len > 0)
1022 {
1023 fprintf(stderr, "R");
1024 }
1025#endif
1026 msg(D_LINK_RW, "%s READ [%d] from %s: %s", proto2ascii(lsi->proto, lsi->af, true),
1027 BLEN(&c->c2.buf), print_link_socket_actual(&c->c2.from, &gc), PROTO_DUMP(&c->c2.buf, &gc));
1028
1029 /*
1030 * Good, non-zero length packet received.
1031 * Commence multi-stage processing of packet,
1032 * such as authenticate, decrypt, decompress.
1033 * If any stage fails, it sets buf.len to 0 or -1,
1034 * telling downstream stages to ignore the packet.
1035 */
1036 if (c->c2.buf.len > 0)
1037 {
1038 struct crypto_options *co = NULL;
1039 const uint8_t *ad_start = NULL;
1040 if (!link_socket_verify_incoming_addr(&c->c2.buf, lsi, &c->c2.from))
1041 {
1043 }
1044
1045 if (c->c2.tls_multi)
1046 {
1047 uint8_t opcode = *BPTR(&c->c2.buf) >> P_OPCODE_SHIFT;
1048
1049 /*
1050 * If DCO is enabled, the kernel drivers require that the
1051 * other end only sends P_DATA_V2 packets. V1 are unknown
1052 * to kernel and passed to userland, but we cannot handle them
1053 * either because crypto context is missing - so drop the packet.
1054 *
1055 * This can only happen with particular old (2.4.0-2.4.4) servers.
1056 */
1057 if ((opcode == P_DATA_V1) && dco_enabled(&c->options))
1058 {
1059 msg(D_LINK_ERRORS, "Data Channel Offload doesn't support DATA_V1 packets. "
1060 "Upgrade your server to 2.4.5 or newer.");
1061 c->c2.buf.len = 0;
1062 }
1063
1064 /*
1065 * If tls_pre_decrypt returns true, it means the incoming
1066 * packet was a good TLS control channel packet. If so, TLS code
1067 * will deal with the packet and set buf.len to 0 so downstream
1068 * stages ignore it.
1069 *
1070 * If the packet is a data channel packet, tls_pre_decrypt
1071 * will load crypto_options with the correct encryption key
1072 * and return false.
1073 */
1074 if (tls_pre_decrypt(c->c2.tls_multi, &c->c2.from, &c->c2.buf, &co, floated, &ad_start))
1075 {
1077
1078 /* reset packet received timer if TLS packet */
1080 {
1082 }
1083 }
1084 }
1085 else
1086 {
1087 co = &c->c2.crypto_options;
1088 }
1089
1090 /*
1091 * Drop non-TLS packet if client-connect script/plugin and cipher selection
1092 * has not yet succeeded. In non-TLS mode tls_multi is not defined
1093 * and we always pass packets.
1094 */
1096 {
1097 c->c2.buf.len = 0;
1098 }
1099
1100 /* authenticate and decrypt the incoming packet */
1101 decrypt_status =
1102 openvpn_decrypt(&c->c2.buf, c->c2.buffers->decrypt_buf, co, &c->c2.frame, ad_start);
1103
1104 if (!decrypt_status
1105 /* on the instance context we have only one socket, so just check the first one */
1107 {
1108 /* decryption errors are fatal in TCP mode */
1109 register_signal(c->sig, SIGUSR1,
1110 "decryption-error"); /* SOFT-SIGUSR1 -- decryption error in TCP mode */
1111 msg(D_STREAM_ERRORS, "Fatal decryption error (process_incoming_link), restarting");
1112 }
1113 }
1114 else
1115 {
1116 buf_reset(&c->c2.to_tun);
1117 }
1118 gc_free(&gc);
1119
1120 return decrypt_status;
1121}
1122
1123void
1125 const uint8_t *orig_buf)
1126{
1127 if (c->c2.buf.len > 0)
1128 {
1129#ifdef ENABLE_FRAGMENT
1130 if (c->c2.fragment)
1131 {
1133 }
1134#endif
1135
1136#ifdef USE_COMP
1137 /* decompress the incoming packet */
1138 if (c->c2.comp_context)
1139 {
1140 (*c->c2.comp_context->alg.decompress)(&c->c2.buf, c->c2.buffers->decompress_buf,
1141 c->c2.comp_context, &c->c2.frame);
1142 }
1143#endif
1144
1145#ifdef PACKET_TRUNCATION_CHECK
1146 /* if (c->c2.buf.len > 1) --c->c2.buf.len; */
1147 ipv4_packet_size_verify(BPTR(&c->c2.buf), BLEN(&c->c2.buf), TUNNEL_TYPE(c->c1.tuntap),
1148 "POST_DECRYPT", &c->c2.n_trunc_post_decrypt);
1149#endif
1150
1151 /*
1152 * Set our "official" outgoing address, since
1153 * if buf.len is non-zero, we know the packet
1154 * authenticated. In TLS mode we do nothing
1155 * because TLS mode takes care of source address
1156 * authentication.
1157 *
1158 * Also, update the persisted version of our packet-id.
1159 */
1160 if (!TLS_MODE(c) && c->c2.buf.len > 0)
1161 {
1162 link_socket_set_outgoing_addr(lsi, &c->c2.from, NULL, c->c2.es);
1163 }
1164
1165 /* reset packet received timer */
1166 if (c->options.ping_rec_timeout && c->c2.buf.len > 0)
1167 {
1169 }
1170
1171 /* increment authenticated receive byte count */
1172 if (c->c2.buf.len > 0)
1173 {
1174 c->c2.link_read_bytes_auth += c->c2.buf.len;
1177 }
1178
1179 /* Did we just receive an openvpn ping packet? */
1180 if (is_ping_msg(&c->c2.buf))
1181 {
1182 dmsg(D_PING, "RECEIVED PING PACKET");
1183 c->c2.buf.len = 0; /* drop packet */
1184 }
1185
1186 /* Did we just receive an OCC packet? */
1187 if (is_occ_msg(&c->c2.buf))
1188 {
1190 }
1191
1192 buffer_turnover(orig_buf, &c->c2.to_tun, &c->c2.buf, &c->c2.buffers->read_link_buf);
1193
1194 /* to_tun defined + unopened tuntap can cause deadlock */
1195 if (!tuntap_defined(c->c1.tuntap))
1196 {
1197 c->c2.to_tun.len = 0;
1198 }
1199 }
1200 else
1201 {
1202 buf_reset(&c->c2.to_tun);
1203 }
1204}
1205
1206static void
1208{
1210
1211 struct link_socket_info *lsi = &sock->info;
1212 const uint8_t *orig_buf = c->c2.buf.data;
1213
1214 process_incoming_link_part1(c, lsi, false);
1215 process_incoming_link_part2(c, lsi, orig_buf);
1216
1217 perf_pop();
1218}
1219
1220void
1221extract_dco_float_peer_addr(const sa_family_t socket_family, struct openvpn_sockaddr *out_osaddr,
1222 const struct sockaddr *float_sa)
1223{
1224 if (float_sa->sa_family == AF_INET)
1225 {
1226 struct sockaddr_in *float4 = (struct sockaddr_in *)float_sa;
1227 /* DCO treats IPv4-mapped IPv6 addresses as pure IPv4. However, on a
1228 * dual-stack socket, we need to preserve the mapping otherwise openvpn
1229 * will not be able to find the peer by its transport address.
1230 */
1231 if (socket_family == AF_INET6)
1232 {
1233 out_osaddr->addr.in6.sin6_family = AF_INET6;
1234 out_osaddr->addr.in6.sin6_port = float4->sin_port;
1235
1236 memset(&out_osaddr->addr.in6.sin6_addr.s6_addr, 0, 10);
1237 out_osaddr->addr.in6.sin6_addr.s6_addr[10] = 0xff;
1238 out_osaddr->addr.in6.sin6_addr.s6_addr[11] = 0xff;
1239 memcpy(&out_osaddr->addr.in6.sin6_addr.s6_addr[12], &float4->sin_addr.s_addr,
1240 sizeof(in_addr_t));
1241 }
1242 else
1243 {
1244 memcpy(&out_osaddr->addr.in4, float4, sizeof(struct sockaddr_in));
1245 }
1246 }
1247 else
1248 {
1249 struct sockaddr_in6 *float6 = (struct sockaddr_in6 *)float_sa;
1250 memcpy(&out_osaddr->addr.in6, float6, sizeof(struct sockaddr_in6));
1251 }
1252}
1253
1254static void
1256{
1257#if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD))
1258 dco_context_t *dco = &c->c1.tuntap->dco;
1259
1260 dco_do_read(dco);
1261
1262 /* no message for us to handle - platform specific code has logged details */
1263 if (dco->dco_message_type == 0)
1264 {
1265 return;
1266 }
1267
1268 /* FreeBSD currently sends us removal notifcation with the old peer-id in
1269 * p2p mode with the ping timeout reason, so ignore that one to not shoot
1270 * ourselves in the foot and removing the just established session */
1271 if (dco->dco_message_peer_id != c->c2.tls_multi->dco_peer_id)
1272 {
1274 "%s: received message for mismatching peer-id %d, "
1275 "expected %d",
1276 __func__, dco->dco_message_peer_id, c->c2.tls_multi->dco_peer_id);
1277 return;
1278 }
1279
1280 switch (dco->dco_message_type)
1281 {
1282 case OVPN_CMD_DEL_PEER:
1283 /* peer is gone, unset ID to prevent more kernel calls */
1284 c->c2.tls_multi->dco_peer_id = -1;
1285 if (dco->dco_del_peer_reason == OVPN_DEL_PEER_REASON_EXPIRED)
1286 {
1288 "%s: received peer expired notification of for peer-id "
1289 "%d",
1290 __func__, dco->dco_message_peer_id);
1292 return;
1293 }
1294 break;
1295
1296 case OVPN_CMD_SWAP_KEYS:
1297 msg(D_DCO_DEBUG, "%s: received key rotation notification for peer-id %d", __func__,
1298 dco->dco_message_peer_id);
1300 break;
1301
1302 default:
1303 msg(D_DCO_DEBUG, "%s: received message of type %u - ignoring", __func__,
1304 dco->dco_message_type);
1305 return;
1306 }
1307
1308#endif /* if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD)) */
1309}
1310
1311/*
1312 * Output: c->c2.buf
1313 */
1314
1315void
1317{
1318 /*
1319 * Setup for read() call on TUN/TAP device.
1320 */
1321 /*ASSERT (!c->c2.to_link.len);*/
1322
1324
1325 c->c2.buf = c->c2.buffers->read_tun_buf;
1326
1327#ifdef _WIN32
1328 /* we cannot end up here when using dco */
1329 ASSERT(!dco_enabled(&c->options));
1330
1331 sockethandle_t sh = { .is_handle = true, .h = c->c1.tuntap->hand, .prepend_sa = false };
1332 sockethandle_finalize(sh, &c->c1.tuntap->reads, &c->c2.buf, NULL);
1333#else /* ifdef _WIN32 */
1337 {
1338 c->c2.buf.len =
1340 }
1341 else
1342 {
1343 c->c2.buf.len = read_tun(c->c1.tuntap, BPTR(&c->c2.buf), c->c2.frame.buf.payload_size);
1344 }
1345#endif /* ifdef _WIN32 */
1346
1347#ifdef PACKET_TRUNCATION_CHECK
1348 ipv4_packet_size_verify(BPTR(&c->c2.buf), BLEN(&c->c2.buf), TUNNEL_TYPE(c->c1.tuntap),
1349 "READ_TUN", &c->c2.n_trunc_tun_read);
1350#endif
1351
1352 /* Was TUN/TAP interface stopped? */
1353 if (tuntap_stop(c->c2.buf.len))
1354 {
1355 register_signal(c->sig, SIGTERM, "tun-stop");
1356 msg(M_INFO, "TUN/TAP interface has been stopped, exiting");
1357 perf_pop();
1358 return;
1359 }
1360
1361 /* Was TUN/TAP I/O operation aborted? */
1362 if (tuntap_abort(c->c2.buf.len))
1363 {
1364 register_signal(c->sig, SIGHUP, "tun-abort");
1366 msg(M_INFO, "TUN/TAP I/O operation aborted, restarting");
1367 perf_pop();
1368 return;
1369 }
1370
1371 /* Check the status return from read() */
1372 check_status(c->c2.buf.len, "read from TUN/TAP", NULL, c->c1.tuntap);
1373
1374 perf_pop();
1375}
1376
1385static void
1387{
1388 bool drop = false;
1389 struct openvpn_sockaddr tun_sa;
1390 int ip_hdr_offset = 0;
1391
1392 if (c->c2.to_link_addr == NULL) /* no remote addr known */
1393 {
1394 return;
1395 }
1396
1397 tun_sa = c->c2.to_link_addr->dest;
1398
1399 int proto_ver = get_tun_ip_ver(TUNNEL_TYPE(c->c1.tuntap), &c->c2.buf, &ip_hdr_offset);
1400
1401 if (proto_ver == 4)
1402 {
1403 /* make sure we got whole IP header */
1404 if (BLEN(buf) < ((int)sizeof(struct openvpn_iphdr) + ip_hdr_offset))
1405 {
1406 return;
1407 }
1408
1409 /* skip ipv4 packets for ipv6 tun */
1410 if (tun_sa.addr.sa.sa_family != AF_INET)
1411 {
1412 return;
1413 }
1414
1415 struct openvpn_iphdr *pip = (struct openvpn_iphdr *)(BPTR(buf) + ip_hdr_offset);
1416
1417 /* drop packets with same dest addr as gateway */
1418 if (memcmp(&tun_sa.addr.in4.sin_addr.s_addr, &pip->daddr, sizeof(pip->daddr)) == 0)
1419 {
1420 drop = true;
1421 }
1422 }
1423 else if (proto_ver == 6)
1424 {
1425 /* make sure we got whole IPv6 header */
1426 if (BLEN(buf) < ((int)sizeof(struct openvpn_ipv6hdr) + ip_hdr_offset))
1427 {
1428 return;
1429 }
1430
1431 /* skip ipv6 packets for ipv4 tun */
1432 if (tun_sa.addr.sa.sa_family != AF_INET6)
1433 {
1434 return;
1435 }
1436
1437 struct openvpn_ipv6hdr *pip6 = (struct openvpn_ipv6hdr *)(BPTR(buf) + ip_hdr_offset);
1438
1439 /* drop packets with same dest addr as gateway */
1440 if (OPENVPN_IN6_ARE_ADDR_EQUAL(&tun_sa.addr.in6.sin6_addr, &pip6->daddr))
1441 {
1442 drop = true;
1443 }
1444 }
1445
1446 if (drop)
1447 {
1448 struct gc_arena gc = gc_new();
1449
1450 c->c2.buf.len = 0;
1451
1452 msg(D_LOW, "Recursive routing detected, drop tun packet to %s",
1454 gc_free(&gc);
1455 }
1456}
1457
1458/*
1459 * Input: c->c2.buf
1460 * Output: c->c2.to_link
1461 */
1462
1463void
1464process_incoming_tun(struct context *c, struct link_socket *out_sock)
1465{
1466 struct gc_arena gc = gc_new();
1467
1469
1470 if (c->c2.buf.len > 0)
1471 {
1472 c->c2.tun_read_bytes += c->c2.buf.len;
1473 }
1474
1475#ifdef LOG_RW
1476 if (c->c2.log_rw && c->c2.buf.len > 0)
1477 {
1478 fprintf(stderr, "r");
1479 }
1480#endif
1481
1482 /* Show packet content */
1483 dmsg(D_TUN_RW, "TUN READ [%d]", BLEN(&c->c2.buf));
1484
1485 if (c->c2.buf.len > 0)
1486 {
1488 {
1490 }
1491 /*
1492 * The --passtos and --mssfix options require
1493 * us to examine the IP header (IPv4 or IPv6).
1494 */
1495 unsigned int flags =
1497 process_ip_header(c, flags, &c->c2.buf, out_sock);
1498
1499#ifdef PACKET_TRUNCATION_CHECK
1500 /* if (c->c2.buf.len > 1) --c->c2.buf.len; */
1501 ipv4_packet_size_verify(BPTR(&c->c2.buf), BLEN(&c->c2.buf), TUNNEL_TYPE(c->c1.tuntap),
1502 "PRE_ENCRYPT", &c->c2.n_trunc_pre_encrypt);
1503#endif
1504 }
1505 if (c->c2.buf.len > 0)
1506 {
1507 encrypt_sign(c, true);
1508 }
1509 else
1510 {
1511 buf_reset(&c->c2.to_link);
1512 }
1513 perf_pop();
1514 gc_free(&gc);
1515}
1516
1527void
1528ipv6_send_icmp_unreachable(struct context *c, struct buffer *buf, bool client)
1529{
1530#define MAX_ICMPV6LEN 1280
1531 struct openvpn_icmp6hdr icmp6out;
1532 CLEAR(icmp6out);
1533
1534 /*
1535 * Get a buffer to the ip packet, is_ipv6 automatically forwards
1536 * the buffer to the ip packet
1537 */
1538 struct buffer inputipbuf = *buf;
1539
1540 is_ipv6(TUNNEL_TYPE(c->c1.tuntap), &inputipbuf);
1541
1542 if (BLEN(&inputipbuf) < (int)sizeof(struct openvpn_ipv6hdr))
1543 {
1544 return;
1545 }
1546
1547 const struct openvpn_ipv6hdr *pip6 = (struct openvpn_ipv6hdr *)BPTR(&inputipbuf);
1548
1549 /* Copy version, traffic class, flow label from input packet */
1550 struct openvpn_ipv6hdr pip6out = *pip6;
1551
1552 pip6out.version_prio = pip6->version_prio;
1553 pip6out.daddr = pip6->saddr;
1554
1555 /*
1556 * Use the IPv6 remote address if we have one, otherwise use a fake one
1557 * using the remote address is preferred since it makes debugging and
1558 * understanding where the ICMPv6 error originates easier
1559 */
1561 {
1562 inet_pton(AF_INET6, c->options.ifconfig_ipv6_remote, &pip6out.saddr);
1563 }
1564 else
1565 {
1566 inet_pton(AF_INET6, "fe80::7", &pip6out.saddr);
1567 }
1568
1570
1571 /*
1572 * The ICMPv6 unreachable code worked best in my (arne) tests with Windows,
1573 * Linux and Android. Windows did not like the administratively prohibited
1574 * return code (no fast fail)
1575 */
1578
1579 int icmpheader_len = sizeof(struct openvpn_ipv6hdr) + sizeof(struct openvpn_icmp6hdr);
1580 int totalheader_len = icmpheader_len;
1581
1582 if (TUNNEL_TYPE(c->c1.tuntap) == DEV_TYPE_TAP)
1583 {
1584 totalheader_len += sizeof(struct openvpn_ethhdr);
1585 }
1586
1587 /*
1588 * Calculate size for payload, defined in the standard that the resulting
1589 * frame should be <= 1280 and have as much as possible of the original
1590 * packet
1591 */
1592 int max_payload_size = min_int(MAX_ICMPV6LEN, c->c2.frame.tun_mtu - icmpheader_len);
1593 int payload_len = min_int(max_payload_size, BLEN(&inputipbuf));
1594
1595 pip6out.payload_len = htons(sizeof(struct openvpn_icmp6hdr) + payload_len);
1596
1597 /* Construct the packet as outgoing packet back to the client */
1598 struct buffer *outbuf;
1599 if (client)
1600 {
1601 c->c2.to_tun = c->c2.buffers->aux_buf;
1602 outbuf = &(c->c2.to_tun);
1603 }
1604 else
1605 {
1606 c->c2.to_link = c->c2.buffers->aux_buf;
1607 outbuf = &(c->c2.to_link);
1608 }
1610
1611 /* Fill the end of the buffer with original packet */
1612 ASSERT(buf_safe(outbuf, payload_len));
1613 ASSERT(buf_copy_n(outbuf, &inputipbuf, payload_len));
1614
1615 /* ICMP Header, copy into buffer to allow checksum calculation */
1617
1618 /* Calculate checksum over the packet and write to header */
1619
1623 ((struct openvpn_icmp6hdr *)BPTR(outbuf))->icmp6_cksum = htons(new_csum);
1624
1625
1626 /* IPv6 Header */
1627 ASSERT(buf_write_prepend(outbuf, &pip6out, sizeof(struct openvpn_ipv6hdr)));
1628
1629 /*
1630 * Tap mode, we also need to create an Ethernet header.
1631 */
1632 if (TUNNEL_TYPE(c->c1.tuntap) == DEV_TYPE_TAP)
1633 {
1634 if (BLEN(buf) < (int)sizeof(struct openvpn_ethhdr))
1635 {
1636 return;
1637 }
1638
1639 const struct openvpn_ethhdr *orig_ethhdr = (struct openvpn_ethhdr *)BPTR(buf);
1640
1641 /* Copy frametype and reverse source/destination for the response */
1642 struct openvpn_ethhdr ethhdr;
1643 memcpy(ethhdr.source, orig_ethhdr->dest, OPENVPN_ETH_ALEN);
1644 memcpy(ethhdr.dest, orig_ethhdr->source, OPENVPN_ETH_ALEN);
1645 ethhdr.proto = htons(OPENVPN_ETH_P_IPV6);
1646 ASSERT(buf_write_prepend(outbuf, &ethhdr, sizeof(struct openvpn_ethhdr)));
1647 }
1648#undef MAX_ICMPV6LEN
1649}
1650
1651void
1652process_ip_header(struct context *c, unsigned int flags, struct buffer *buf,
1653 struct link_socket *sock)
1654{
1655 if (!c->options.ce.mssfix)
1656 {
1657 flags &= ~PIP_MSSFIX;
1658 }
1659#if PASSTOS_CAPABILITY
1660 if (!c->options.passtos)
1661 {
1662 flags &= ~PIPV4_PASSTOS;
1663 }
1664#endif
1665 if (!c->options.client_nat)
1666 {
1667 flags &= ~PIPV4_CLIENT_NAT;
1668 }
1670 {
1671 flags &= ~PIPV4_EXTRACT_DHCP_ROUTER;
1672 }
1673 if (!c->options.block_ipv6)
1674 {
1676 }
1677
1678 if (buf->len > 0)
1679 {
1680 struct buffer ipbuf = *buf;
1681 if (is_ipv4(TUNNEL_TYPE(c->c1.tuntap), &ipbuf))
1682 {
1683#if PASSTOS_CAPABILITY
1684 /* extract TOS from IP header */
1685 if (flags & PIPV4_PASSTOS)
1686 {
1688 }
1689#endif
1690
1691 /* possibly alter the TCP MSS */
1692 if (flags & PIP_MSSFIX)
1693 {
1694 mss_fixup_ipv4(&ipbuf, c->c2.frame.mss_fix);
1695 }
1696
1697 /* possibly do NAT on packet */
1698 if ((flags & PIPV4_CLIENT_NAT) && c->options.client_nat)
1699 {
1700 const int direction = (flags & PIP_OUTGOING) ? CN_INCOMING : CN_OUTGOING;
1701 client_nat_transform(c->options.client_nat, &ipbuf, direction);
1702 }
1703 /* possibly extract a DHCP router message */
1704 if (flags & PIPV4_EXTRACT_DHCP_ROUTER)
1705 {
1707 if (dhcp_router)
1708 {
1709 route_list_add_vpn_gateway(c->c1.route_list, c->c2.es, dhcp_router);
1710 }
1711 }
1712 }
1713 else if (is_ipv6(TUNNEL_TYPE(c->c1.tuntap), &ipbuf))
1714 {
1715 /* possibly alter the TCP MSS */
1716 if (flags & PIP_MSSFIX)
1717 {
1718 mss_fixup_ipv6(&ipbuf, c->c2.frame.mss_fix);
1719 }
1720 if (!(flags & PIP_OUTGOING)
1722 {
1724 /* Drop the IPv6 packet */
1725 buf->len = 0;
1726 }
1727 }
1728 }
1729}
1730
1731/*
1732 * Input: c->c2.to_link
1733 */
1734
1735void
1737{
1738 struct gc_arena gc = gc_new();
1739 int error_code = 0;
1740
1742
1743 if (c->c2.to_link.len > 0 && c->c2.to_link.len <= c->c2.frame.buf.payload_size)
1744 {
1745 /*
1746 * Setup for call to send/sendto which will send
1747 * packet to remote over the TCP/UDP port.
1748 */
1749 int size = 0;
1751
1752#ifdef ENABLE_DEBUG
1753 /* In gremlin-test mode, we may choose to drop this packet */
1754 if (!c->options.gremlin || ask_gremlin(c->options.gremlin))
1755#endif
1756 {
1757 /*
1758 * Let the traffic shaper know how many bytes
1759 * we wrote.
1760 */
1761 if (c->options.shaper)
1762 {
1763 int overhead =
1764 datagram_overhead(c->c2.to_link_addr->dest.addr.sa.sa_family, sock->info.proto);
1765 shaper_wrote_bytes(&c->c2.shaper, BLEN(&c->c2.to_link) + overhead);
1766 }
1767
1768 /*
1769 * Let the pinger know that we sent a packet.
1770 */
1772 {
1774 }
1775
1776#if PASSTOS_CAPABILITY
1777 /* Set TOS */
1778 link_socket_set_tos(sock);
1779#endif
1780
1781 /* Log packet send */
1782#ifdef LOG_RW
1783 if (c->c2.log_rw)
1784 {
1785 fprintf(stderr, "W");
1786 }
1787#endif
1788 msg(D_LINK_RW, "%s WRITE [%d] to %s: %s",
1789 proto2ascii(sock->info.proto, sock->info.af, true), BLEN(&c->c2.to_link),
1791
1792 /* Packet send complexified by possible Socks5 usage */
1793 {
1794 struct link_socket_actual *to_addr = c->c2.to_link_addr;
1795 int size_delta = 0;
1796
1797 /* If Socks5 over UDP, prepend header */
1798 socks_preprocess_outgoing_link(c, sock, &to_addr, &size_delta);
1799
1800 /* Send packet */
1801 size = (int)link_socket_write(sock, &c->c2.to_link, to_addr);
1802
1803 /* Undo effect of prepend */
1804 link_socket_write_post_size_adjust(&size, size_delta, &c->c2.to_link);
1805 }
1806
1807 if (size > 0)
1808 {
1810 c->c2.link_write_bytes += size;
1812#ifdef ENABLE_MEMSTATS
1813 if (mmap_stats)
1814 {
1815 mmap_stats->link_write_bytes = link_write_bytes_global;
1816 }
1817#endif
1818 }
1819 }
1820
1821 /* Check return status */
1822 error_code = openvpn_errno();
1823 check_status(size, "write", sock, NULL);
1824
1825 if (size > 0)
1826 {
1827 /* Did we write a different size packet than we intended? */
1828 if (size != BLEN(&c->c2.to_link))
1829 {
1831 "TCP/UDP packet was truncated/expanded on write to %s (tried=%d,actual=%d)",
1833 }
1834 }
1835
1836 /* if not a ping/control message, indicate activity regarding --inactive parameter */
1837 if (c->c2.buf.len > 0)
1838 {
1839 register_activity(c, size);
1840 }
1841
1842 /* for unreachable network and "connecting" state switch to the next host */
1843
1844 bool unreachable = error_code ==
1845#ifdef _WIN32
1846 WSAENETUNREACH;
1847#else
1848 ENETUNREACH;
1849#endif
1850 if (size < 0 && unreachable && c->c2.tls_multi
1853 {
1854 msg(M_INFO, "Network unreachable, restarting");
1855 register_signal(c->sig, SIGUSR1, "network-unreachable");
1856 }
1857 }
1858 else
1859 {
1860 if (c->c2.to_link.len > 0)
1861 {
1862 msg(D_LINK_ERRORS, "TCP/UDP packet too large on write to %s (tried=%d,max=%d)",
1865 }
1866 }
1867
1868 buf_reset(&c->c2.to_link);
1869
1870 perf_pop();
1871 gc_free(&gc);
1872}
1873
1874/*
1875 * Input: c->c2.to_tun
1876 */
1877
1878void
1879process_outgoing_tun(struct context *c, struct link_socket *in_sock)
1880{
1881 /*
1882 * Set up for write() call to TUN/TAP
1883 * device.
1884 */
1885 if (c->c2.to_tun.len <= 0)
1886 {
1887 return;
1888 }
1889
1891
1892 /*
1893 * The --mssfix option requires
1894 * us to examine the IP header (IPv4 or IPv6).
1895 */
1897 &c->c2.to_tun, in_sock);
1898
1899 if (c->c2.to_tun.len <= c->c2.frame.buf.payload_size)
1900 {
1901 /*
1902 * Write to TUN/TAP device.
1903 */
1904 int size;
1905
1906#ifdef LOG_RW
1907 if (c->c2.log_rw)
1908 {
1909 fprintf(stderr, "w");
1910 }
1911#endif
1912 dmsg(D_TUN_RW, "TUN WRITE [%d]", BLEN(&c->c2.to_tun));
1913
1914#ifdef PACKET_TRUNCATION_CHECK
1915 ipv4_packet_size_verify(BPTR(&c->c2.to_tun), BLEN(&c->c2.to_tun), TUNNEL_TYPE(c->c1.tuntap),
1916 "WRITE_TUN", &c->c2.n_trunc_tun_write);
1917#endif
1918
1919#ifdef _WIN32
1920 size = tun_write_win32(c->c1.tuntap, &c->c2.to_tun);
1921#else
1923 {
1924 size = write_tun_afunix(c->c1.tuntap, BPTR(&c->c2.to_tun), BLEN(&c->c2.to_tun));
1925 }
1926 else
1927 {
1928 size = write_tun(c->c1.tuntap, BPTR(&c->c2.to_tun), BLEN(&c->c2.to_tun));
1929 }
1930#endif
1931
1932 if (size > 0)
1933 {
1934 c->c2.tun_write_bytes += size;
1935 }
1936 check_status(size, "write to TUN/TAP", NULL, c->c1.tuntap);
1937
1938 /* check written packet size */
1939 if (size > 0)
1940 {
1941 /* Did we write a different size packet than we intended? */
1942 if (size != BLEN(&c->c2.to_tun))
1943 {
1945 "TUN/TAP packet was destructively fragmented on write to %s (tried=%d,actual=%d)",
1946 c->c1.tuntap->actual_name, BLEN(&c->c2.to_tun), size);
1947 }
1948
1949 /* indicate activity regarding --inactive parameter */
1950 register_activity(c, size);
1951 }
1952 }
1953 else
1954 {
1955 /*
1956 * This should never happen, probably indicates some kind
1957 * of MTU mismatch.
1958 */
1959 msg(D_LINK_ERRORS, "tun packet too large on write (tried=%d,max=%d)", c->c2.to_tun.len,
1961 }
1962
1963 buf_reset(&c->c2.to_tun);
1964
1965 perf_pop();
1966}
1967
1968void
1970{
1971 /* make sure current time (now) is updated on function entry */
1972
1973 /*
1974 * Start with an effectively infinite timeout, then let it
1975 * reduce to a timeout that reflects the component which
1976 * needs the earliest service.
1977 */
1978 c->c2.timeval.tv_sec = BIG_TIMEOUT;
1979 c->c2.timeval.tv_usec = 0;
1980
1981#if defined(_WIN32)
1983 {
1984 c->c2.timeval.tv_sec = 1;
1985 if (tuntap_defined(c->c1.tuntap))
1986 {
1988 }
1989 }
1990#endif
1991
1992 /* check coarse timers? */
1994 if (c->sig->signal_received)
1995 {
1996 return;
1997 }
1998
1999 /* If tls is enabled, do tls control channel packet processing. */
2000 if (c->c2.tls_multi)
2001 {
2002 check_tls(c);
2003 }
2004
2005 /* In certain cases, TLS errors will require a restart */
2007 if (c->sig->signal_received)
2008 {
2009 return;
2010 }
2011
2012 /* check for incoming control messages on the control channel like
2013 * push request/reply/update, or authentication failure and 2FA messages */
2014 if (tls_test_payload_len(c->c2.tls_multi) > 0)
2015 {
2017 }
2018
2019 /* Should we send an OCC message? */
2021
2022#ifdef ENABLE_FRAGMENT
2023 /* Should we deliver a datagram fragment to remote? */
2024 if (c->c2.fragment)
2025 {
2026 check_fragment(c);
2027 }
2028#endif
2029
2030 /* Update random component of timeout */
2032}
2033
2034static void
2035multi_io_process_flags(struct context *c, struct event_set *es, const unsigned int flags,
2036 unsigned int *out_socket, unsigned int *out_tuntap)
2037{
2038 unsigned int socket = 0;
2039 unsigned int tuntap = 0;
2040 static uintptr_t tun_shift = TUN_SHIFT;
2041 static uintptr_t err_shift = ERR_SHIFT;
2042
2043 /*
2044 * Calculate the flags based on the provided 'flags' argument.
2045 */
2046 if ((c->options.mode != MODE_SERVER) && (flags & IOW_WAIT_SIGNAL))
2047 {
2048 wait_signal(es, (void *)err_shift);
2049 }
2050
2051 if (flags & IOW_TO_LINK)
2052 {
2053 if (flags & IOW_SHAPER)
2054 {
2055 /*
2056 * If sending this packet would put us over our traffic shaping
2057 * quota, don't send -- instead compute the delay we must wait
2058 * until it will be OK to send the packet.
2059 */
2060 int delay = 0;
2061
2062 /* set traffic shaping delay in microseconds */
2063 if (c->options.shaper)
2064 {
2065 delay = max_int(delay, shaper_delay(&c->c2.shaper));
2066 }
2067
2068 if (delay < 1000)
2069 {
2070 socket |= EVENT_WRITE;
2071 }
2072 else
2073 {
2074 shaper_soonest_event(&c->c2.timeval, delay);
2075 }
2076 }
2077 else
2078 {
2079 socket |= EVENT_WRITE;
2080 }
2081 }
2082 else if (!((flags & IOW_FRAG) && TO_LINK_FRAG(c)))
2083 {
2084 if (flags & IOW_READ_TUN)
2085 {
2086 tuntap |= EVENT_READ;
2087 }
2088 }
2089
2090 /*
2091 * If outgoing data (for TUN/TAP device) pending, wait for ready-to-send status
2092 * from device. Otherwise, wait for incoming data on TCP/UDP port.
2093 */
2094 if (flags & IOW_TO_TUN)
2095 {
2097 }
2098 else
2099 {
2100 if (flags & IOW_READ_LINK)
2101 {
2102 socket |= EVENT_READ;
2103 }
2104 }
2105
2106 /*
2107 * outgoing bcast buffer waiting to be sent?
2108 */
2109 if (flags & IOW_MBUF)
2110 {
2111 socket |= EVENT_WRITE;
2112 }
2113
2114 /*
2115 * Force wait on TUN input, even if also waiting on TCP/UDP output
2116 */
2117 if (flags & IOW_READ_TUN_FORCE)
2118 {
2119 tuntap |= EVENT_READ;
2120 }
2121
2122 /*
2123 * Configure event wait based on socket, tuntap flags.
2124 * (for TCP server sockets this happens in
2125 * socket_set_listen_persistent()).
2126 */
2127 for (int i = 0; i < c->c1.link_sockets_num; i++)
2128 {
2130 {
2131 socket_set(c->c2.link_sockets[i], es, socket, &c->c2.link_sockets[i]->ev_arg, NULL);
2132 }
2133 }
2134
2135 tun_set(c->c1.tuntap, es, tuntap, (void *)tun_shift, NULL);
2136
2137 if (out_socket)
2138 {
2139 *out_socket = socket;
2140 }
2141
2142 if (out_tuntap)
2143 {
2144 *out_tuntap = tuntap;
2145 }
2146}
2147
2148/*
2149 * Wait for I/O events. Used for both TCP & UDP sockets
2150 * in point-to-point mode and for UDP sockets in
2151 * point-to-multipoint mode.
2152 */
2153
2154void
2155get_io_flags_dowork_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
2156{
2157 unsigned int out_socket, out_tuntap;
2158
2159 multi_io_process_flags(c, multi_io->es, flags, &out_socket, &out_tuntap);
2160 multi_io->udp_flags = out_socket | out_tuntap;
2161}
2162
2163void
2164get_io_flags_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
2165{
2167 if (c->c2.fast_io && (flags & (IOW_TO_TUN | IOW_TO_LINK | IOW_MBUF)))
2168 {
2169 /* fast path -- only for TUN/TAP/UDP writes */
2170 unsigned int ret = 0;
2171 if (flags & IOW_TO_TUN)
2172 {
2173 ret |= TUN_WRITE;
2174 }
2175 if (flags & (IOW_TO_LINK | IOW_MBUF))
2176 {
2177 ret |= SOCKET_WRITE;
2178 }
2179 multi_io->udp_flags = ret;
2180 }
2181 else
2182 {
2183 /* slow path - delegate to io_wait_dowork_udp to calculate flags */
2185 }
2186}
2187
2188void
2189io_wait_dowork(struct context *c, const unsigned int flags)
2190{
2191 unsigned int out_socket;
2192 unsigned int out_tuntap;
2193 struct event_set_return esr[4];
2194
2195 /* These shifts all depend on EVENT_READ and EVENT_WRITE */
2196 static uintptr_t socket_shift = SOCKET_SHIFT; /* depends on SOCKET_READ and SOCKET_WRITE */
2197#ifdef ENABLE_MANAGEMENT
2198 static uintptr_t management_shift =
2199 MANAGEMENT_SHIFT; /* depends on MANAGEMENT_READ and MANAGEMENT_WRITE */
2200#endif
2201#ifdef ENABLE_ASYNC_PUSH
2202 static uintptr_t file_shift = FILE_SHIFT;
2203#endif
2204#if defined(TARGET_LINUX) || defined(TARGET_FREEBSD)
2205 static uintptr_t dco_shift = DCO_SHIFT; /* Event from DCO linux kernel module */
2206#endif
2207
2208 /*
2209 * Decide what kind of events we want to wait for.
2210 */
2212
2213 multi_io_process_flags(c, c->c2.event_set, flags, &out_socket, &out_tuntap);
2214
2215#if defined(TARGET_LINUX) || defined(TARGET_FREEBSD)
2216 if (out_socket & EVENT_READ && c->c2.did_open_tun)
2217 {
2218 dco_event_set(&c->c1.tuntap->dco, c->c2.event_set, (void *)dco_shift);
2219 }
2220#endif
2221
2222#ifdef ENABLE_MANAGEMENT
2223 if (management)
2224 {
2225 management_socket_set(management, c->c2.event_set, (void *)management_shift, NULL);
2226 }
2227#endif
2228
2229#ifdef ENABLE_ASYNC_PUSH
2230 /* arm inotify watcher */
2231 if (c->options.mode == MODE_SERVER)
2232 {
2233 event_ctl(c->c2.event_set, c->c2.inotify_fd, EVENT_READ, (void *)file_shift);
2234 }
2235#endif
2236
2237 /*
2238 * Possible scenarios:
2239 * (1) tcp/udp port has data available to read
2240 * (2) tcp/udp port is ready to accept more data to write
2241 * (3) tun dev has data available to read
2242 * (4) tun dev is ready to accept more data to write
2243 * (5) we received a signal (handler sets signal_received)
2244 * (6) timeout (tv) expired
2245 */
2246
2248
2249 if (!c->sig->signal_received)
2250 {
2251 if (!(flags & IOW_CHECK_RESIDUAL) || !sockets_read_residual(c))
2252 {
2253 int status;
2254
2255#ifdef ENABLE_DEBUG
2257 {
2258 show_wait_status(c);
2259 }
2260#endif
2261
2262 /*
2263 * Wait for something to happen.
2264 */
2265 status = event_wait(c->c2.event_set, &c->c2.timeval, esr, SIZE(esr));
2266
2267 check_status(status, "event_wait", NULL, NULL);
2268
2269 if (status > 0)
2270 {
2271 int i;
2272 c->c2.event_set_status = 0;
2273 for (i = 0; i < status; ++i)
2274 {
2275 const struct event_set_return *e = &esr[i];
2276 uintptr_t shift;
2277
2278 if (e->arg >= MULTI_N)
2279 {
2280 struct event_arg *ev_arg = (struct event_arg *)e->arg;
2281 if (ev_arg->type != EVENT_ARG_LINK_SOCKET)
2282 {
2284 msg(D_LINK_ERRORS, "io_work: non socket event delivered");
2285 return;
2286 }
2287
2288 shift = socket_shift;
2289 }
2290 else
2291 {
2292 shift = (uintptr_t)e->arg;
2293 }
2294
2295 c->c2.event_set_status |= ((e->rwflags & 3) << shift);
2296 }
2297 }
2298 else if (status == 0)
2299 {
2301 }
2302 }
2303 else
2304 {
2306 }
2307 }
2308
2309 /* 'now' should always be a reasonably up-to-date timestamp */
2310 update_time();
2311
2312 /* set signal_received if a signal was received */
2313 if (c->c2.event_set_status & ES_ERROR)
2314 {
2316 }
2317
2318 dmsg(D_EVENT_WAIT, "I/O WAIT status=0x%04x", c->c2.event_set_status);
2319}
2320
2321void
2323{
2324 const unsigned int status = c->c2.event_set_status;
2325
2326#ifdef ENABLE_MANAGEMENT
2328 {
2331 }
2332#endif
2333
2334 /* TCP/UDP port ready to accept write */
2335 if (status & SOCKET_WRITE)
2336 {
2338 }
2339 /* TUN device ready to accept write */
2340 else if (status & TUN_WRITE)
2341 {
2343 }
2344 /* Incoming data on TCP/UDP port */
2345 else if (status & SOCKET_READ)
2346 {
2348 if (!IS_SIG(c))
2349 {
2351 }
2352 }
2353 /* Incoming data on TUN device */
2354 else if (status & TUN_READ)
2355 {
2357 if (!IS_SIG(c))
2358 {
2360 }
2361 }
2362 else if (status & DCO_READ)
2363 {
2364 if (!IS_SIG(c))
2365 {
2367 }
2368 }
2369}
void check_send_auth_token(struct context *c)
Checks if the timer to resend the auth-token has expired and if a new auth-token should be send to th...
Definition auth_token.c:415
bool buf_printf(struct buffer *buf, const char *format,...)
Definition buffer.c:241
bool buf_assign(struct buffer *dest, const struct buffer *src)
Definition buffer.c:174
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:89
bool buf_string_match_head_str(const struct buffer *src, const char *match)
Definition buffer.c:778
#define BSTR(buf)
Definition buffer.h:128
#define BPTR(buf)
Definition buffer.h:123
static bool buf_write_prepend(struct buffer *dest, const void *src, int size)
Definition buffer.h:672
static bool buf_copy_n(struct buffer *dest, struct buffer *src, int n)
Definition buffer.h:710
static void buf_reset(struct buffer *buf)
Definition buffer.h:303
static bool buf_safe(const struct buffer *buf, size_t len)
Definition buffer.h:518
static bool buf_advance(struct buffer *buf, int size)
Definition buffer.h:616
#define BLEN(buf)
Definition buffer.h:126
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
#define buf_init(buf, offset)
Definition buffer.h:209
static struct gc_arena gc_new(void)
Definition buffer.h:1007
void client_nat_transform(const struct client_nat_option_list *list, struct buffer *ipbuf, const int direction)
Definition clinat.c:184
#define CN_INCOMING
Definition clinat.h:31
#define CN_OUTGOING
Definition clinat.h:30
uint64_t counter_type
Definition common.h:29
int interval_t
Definition common.h:35
#define PUSH_REQUEST_INTERVAL
Definition common.h:92
#define BIG_TIMEOUT
Definition common.h:40
long int get_random(void)
Definition crypto.c:1716
static int dco_do_read(dco_context_t *dco)
Definition dco.h:311
static void dco_event_set(dco_context_t *dco, struct event_set *es, void *arg)
Definition dco.h:318
static bool dco_update_keys(dco_context_t *dco, struct tls_multi *multi)
Definition dco.h:330
void * dco_context_t
Definition dco.h:261
static int dco_get_peer_stats(struct context *c, const bool raise_sigusr1_on_err)
Definition dco.h:377
in_addr_t dhcp_extract_router_msg(struct buffer *ipbuf)
Definition dhcp.c:148
#define D_TUN_RW
Definition errlevel.h:113
#define D_TAP_WIN_DEBUG
Definition errlevel.h:114
#define D_PING
Definition errlevel.h:143
#define D_EVENT_WAIT
Definition errlevel.h:161
#define D_INTERVAL
Definition errlevel.h:157
#define D_STREAM_ERRORS
Definition errlevel.h:62
#define D_DCO_DEBUG
Definition errlevel.h:117
#define D_PUSH_ERRORS
Definition errlevel.h:66
#define D_LOW
Definition errlevel.h:96
#define M_INFO
Definition errlevel.h:54
#define D_SCHED_EXIT
Definition errlevel.h:88
#define D_ROUTE
Definition errlevel.h:79
#define D_LINK_ERRORS
Definition errlevel.h:56
#define D_LINK_RW
Definition errlevel.h:112
#define DCO_READ
Definition event.h:75
#define MANAGEMENT_SHIFT
Definition event.h:69
#define SOCKET_SHIFT
Definition event.h:60
#define TUN_WRITE
Definition event.h:65
#define SOCKET_READ
Definition event.h:61
#define MANAGEMENT_READ
Definition event.h:70
#define MANAGEMENT_WRITE
Definition event.h:71
static int event_wait(struct event_set *es, const struct timeval *tv, struct event_set_return *out, int outlen)
Definition event.h:189
#define ES_ERROR
Definition event.h:67
#define SOCKET_WRITE
Definition event.h:62
#define ES_TIMEOUT
Definition event.h:68
#define EVENT_WRITE
Definition event.h:39
#define MULTI_N
Definition event.h:88
#define TUN_SHIFT
Definition event.h:63
#define EVENT_READ
Definition event.h:38
#define FILE_SHIFT
Definition event.h:72
#define TUN_READ
Definition event.h:64
static void event_reset(struct event_set *es)
Definition event.h:171
static void wait_signal(struct event_set *es, void *arg)
Definition event.h:208
#define DCO_SHIFT
Definition event.h:74
#define ERR_SHIFT
Definition event.h:66
@ EVENT_ARG_LINK_SOCKET
Definition event.h:138
static void event_ctl(struct event_set *es, event_t event, unsigned int rwflags, void *arg)
Definition event.h:183
counter_type link_write_bytes_global
Definition forward.c:50
static void check_inactivity_timeout(struct context *c)
Definition forward.c:477
void reschedule_multi_process(struct context *c)
Reschedule tls_multi_process.
Definition forward.c:391
int get_server_poll_remaining_time(struct event_timeout *server_poll_timeout)
Definition forward.c:497
static void check_fragment(struct context *c)
Definition forward.c:565
static void check_tls_errors(struct context *c)
Definition forward.c:99
static void check_scheduled_exit(struct context *c)
Definition forward.c:542
#define MAX_ICMPV6LEN
static void check_session_timeout(struct context *c)
Definition forward.c:701
bool send_control_channel_string_dowork(struct tls_session *session, const char *str, int msglevel)
Definition forward.c:371
void process_io(struct context *c, struct link_socket *sock)
Definition forward.c:2322
static void context_reschedule_sec(struct context *c, int sec)
Definition forward.c:132
static void check_timeout_random_component(struct context *c)
Definition forward.c:863
bool schedule_exit(struct context *c)
Definition forward.c:521
static void process_coarse_timers(struct context *c)
Definition forward.c:715
static void check_connection_established(struct context *c)
Definition forward.c:334
static void check_timeout_random_component_dowork(struct context *c)
Definition forward.c:852
bool send_control_channel_string(struct context *c, const char *str, int msglevel)
Definition forward.c:398
static void buffer_turnover(const uint8_t *orig_buf, struct buffer *dest_stub, struct buffer *src_stub, struct buffer *storage)
Definition forward.c:594
static void check_tls_errors_nco(struct context *c)
Definition forward.c:89
void ipv6_send_icmp_unreachable(struct context *c, struct buffer *buf, bool client)
Forges a IPv6 ICMP packet with a no route to host error code from the IPv6 packet in buf and sends it...
Definition forward.c:1528
void get_io_flags_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
Definition forward.c:2164
static void multi_io_process_flags(struct context *c, struct event_set *es, const unsigned int flags, unsigned int *out_socket, unsigned int *out_tuntap)
Definition forward.c:2035
void pre_select(struct context *c)
Definition forward.c:1969
static void check_incoming_control_channel(struct context *c)
Definition forward.c:284
static void check_add_routes(struct context *c)
Definition forward.c:430
static void check_server_poll_timeout(struct context *c)
Definition forward.c:505
static void parse_incoming_control_channel_command(struct context *c, struct buffer *buf)
Definition forward.c:235
static void socks_postprocess_incoming_link(struct context *c, struct link_socket *sock)
Definition forward.c:881
static void check_push_request(struct context *c)
Definition forward.c:316
static void process_incoming_link(struct context *c, struct link_socket *sock)
Definition forward.c:1207
static void check_tls_errors_co(struct context *c)
Definition forward.c:82
static void socks_preprocess_outgoing_link(struct context *c, struct link_socket *sock, struct link_socket_actual **to_addr, int *size_delta)
Definition forward.c:890
static void link_socket_write_post_size_adjust(int *size, int size_delta, struct buffer *buf)
Definition forward.c:902
void get_io_flags_dowork_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
Definition forward.c:2155
static void context_immediate_reschedule(struct context *c)
Definition forward.c:125
static void check_add_routes_action(struct context *c, const bool errors)
Definition forward.c:415
static void drop_if_recursive_routing(struct context *c, struct buffer *buf)
Drops UDP packets which OS decided to route via tun.
Definition forward.c:1386
counter_type link_read_bytes_global
Definition forward.c:49
static void check_coarse_timers(struct context *c)
Definition forward.c:827
void check_dco_key_status(struct context *c)
Definition forward.c:146
void io_wait_dowork(struct context *c, const unsigned int flags)
Definition forward.c:2189
static void process_incoming_dco(struct context *c)
Definition forward.c:1255
void process_ip_header(struct context *c, unsigned int flags, struct buffer *buf, struct link_socket *sock)
Definition forward.c:1652
void extract_dco_float_peer_addr(const sa_family_t socket_family, struct openvpn_sockaddr *out_osaddr, const struct sockaddr *float_sa)
Transfers float_sa data extracted from an incoming DCO PEER_FLOAT_NTF to out_osaddr for later process...
Definition forward.c:1221
static void check_tls(struct context *c)
Definition forward.c:179
static void check_status_file(struct context *c)
Definition forward.c:551
Interface functions to the internal and external multiplexers.
#define PIP_MSSFIX
Definition forward.h:318
#define PIPV4_CLIENT_NAT
Definition forward.h:321
#define IOW_WAIT_SIGNAL
Definition forward.h:63
#define IOW_READ_TUN
Definition forward.h:56
#define PIPV4_EXTRACT_DHCP_ROUTER
Definition forward.h:320
#define PIPV6_ICMP_NOHOST_SERVER
Definition forward.h:323
#define PIPV6_ICMP_NOHOST_CLIENT
Definition forward.h:322
#define IOW_SHAPER
Definition forward.h:58
#define IOW_FRAG
Definition forward.h:60
#define IOW_MBUF
Definition forward.h:61
static struct link_socket_info * get_link_socket_info(struct context *c)
Definition forward.h:332
#define IOW_READ_LINK
Definition forward.h:57
#define IOW_CHECK_RESIDUAL
Definition forward.h:59
#define TO_LINK_FRAG(c)
Definition forward.h:42
static bool connection_established(struct context *c)
Definition forward.h:407
static void register_activity(struct context *c, const int size)
Definition forward.h:345
#define IOW_TO_TUN
Definition forward.h:54
#define PIPV4_PASSTOS
Definition forward.h:317
#define IOW_READ_TUN_FORCE
Definition forward.h:62
#define PIP_OUTGOING
Definition forward.h:319
#define IOW_TO_LINK
Definition forward.h:55
#define KS_PRIMARY
Primary key state index.
Definition ssl_common.h:465
#define TM_ACTIVE
Active tls_session.
Definition ssl_common.h:545
void encrypt_sign(struct context *c, bool comp_frag)
Process a data channel packet that will be sent through a VPN tunnel.
Definition forward.c:614
void tls_post_encrypt(struct tls_multi *multi, struct buffer *buf)
Perform some accounting for the key state used.
Definition ssl.c:3997
void openvpn_encrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt)
Encrypt and HMAC sign a packet so that it can be sent as a data channel VPN tunnel packet to a remote...
Definition crypto.c:322
void tls_prepend_opcode_v1(const struct tls_multi *multi, struct buffer *buf)
Prepend a one-byte OpenVPN data channel P_DATA_V1 opcode to the packet.
Definition ssl.c:3969
void tls_pre_encrypt(struct tls_multi *multi, struct buffer *buf, struct crypto_options **opt)
Choose the appropriate security parameters with which to process an outgoing packet.
Definition ssl.c:3937
void tls_prepend_opcode_v2(const struct tls_multi *multi, struct buffer *buf)
Prepend an OpenVPN data channel P_DATA_V2 header to the packet.
Definition ssl.c:3983
bool openvpn_decrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt, const struct frame *frame, const uint8_t *ad_start)
HMAC verify and decrypt a data channel packet received from a remote OpenVPN peer.
Definition crypto.c:773
bool process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, bool floated)
Starts processing a packet read from the external network interface.
Definition forward.c:985
void process_incoming_link_part2(struct context *c, struct link_socket_info *lsi, const uint8_t *orig_buf)
Continues processing a packet read from the external network interface.
Definition forward.c:1124
void process_outgoing_link(struct context *c, struct link_socket *sock)
Write a packet to the external network interface.
Definition forward.c:1736
void read_incoming_link(struct context *c, struct link_socket *sock)
Read a packet from the external network interface.
Definition forward.c:919
bool tls_pre_decrypt(struct tls_multi *multi, const struct link_socket_actual *from, struct buffer *buf, struct crypto_options **opt, bool floated, const uint8_t **ad_start)
Determine whether an incoming packet is a data channel or control channel packet, and process accordi...
Definition ssl.c:3557
static void fragment_housekeeping(struct fragment_master *f, struct frame *frame, struct timeval *tv)
Perform housekeeping of a fragment_master structure.
Definition fragment.h:456
static bool fragment_outgoing_defined(struct fragment_master *f)
Check whether a fragment_master structure contains fragments ready to be sent.
Definition fragment.h:428
void fragment_outgoing(struct fragment_master *f, struct buffer *buf, const struct frame *frame)
Process an outgoing packet, which may or may not need to be fragmented.
Definition fragment.c:313
void fragment_incoming(struct fragment_master *f, struct buffer *buf, const struct frame *frame)
Process an incoming packet, which may or may not be fragmented.
Definition fragment.c:139
bool fragment_ready_to_send(struct fragment_master *f, struct buffer *buf, const struct frame *frame)
Check whether outgoing fragments are ready to be send, and if so make one available.
Definition fragment.c:363
void read_incoming_tun(struct context *c)
Read a packet from the virtual tun/tap network interface.
Definition forward.c:1316
void process_incoming_tun(struct context *c, struct link_socket *out_sock)
Process a packet read from the virtual tun/tap network interface.
Definition forward.c:1464
void process_outgoing_tun(struct context *c, struct link_socket *in_sock)
Write a packet to the virtual tun/tap network interface.
Definition forward.c:1879
void initialization_sequence_completed(struct context *c, const unsigned int flags)
Definition init.c:1547
void reset_coarse_timers(struct context *c)
Definition init.c:1315
bool do_up(struct context *c, bool pulled_options, unsigned int option_types_found)
Definition init.c:2351
bool do_route(const struct options *options, struct route_list *route_list, struct route_ipv6_list *route_ipv6_list, const struct tuntap *tt, const struct plugin_list *plugins, struct env_set *es, openvpn_net_ctx_t *ctx)
Definition init.c:1668
#define ISC_ERRORS
Definition init.h:126
#define ISC_ROUTE_ERRORS
Definition init.h:128
static int min_int(int x, int y)
Definition integer.h:105
static int max_int(int x, int y)
Definition integer.h:92
static SERVICE_STATUS status
Definition interactive.c:51
bool event_timeout_trigger(struct event_timeout *et, struct timeval *tv, const int et_const_retry)
This is the principal function for testing and triggering recurring timers.
Definition interval.c:42
#define ETT_DEFAULT
Definition interval.h:222
static void interval_future_trigger(struct interval *top, interval_t wakeup)
Definition interval.h:106
static void event_timeout_reset(struct event_timeout *et)
Resets a timer.
Definition interval.h:187
static void interval_action(struct interval *top)
Definition interval.h:122
static bool event_timeout_defined(const struct event_timeout *et)
Definition interval.h:142
static void event_timeout_init(struct event_timeout *et, interval_t n, const time_t last)
Initialises a timer struct.
Definition interval.h:172
static void event_timeout_clear(struct event_timeout *et)
Clears the timeout and reset all values to 0.
Definition interval.h:153
static void interval_schedule_wakeup(struct interval *top, interval_t *wakeup)
Definition interval.h:92
static void event_timeout_modify_wakeup(struct event_timeout *et, interval_t n)
Sets the interval n of a timeout.
Definition interval.h:204
static bool interval_test(struct interval *top)
Definition interval.h:65
static interval_t event_timeout_remaining(struct event_timeout *et)
Returns the time until the timeout should triggered, from now.
Definition interval.h:217
void management_socket_set(struct management *man, struct event_set *es, void *arg, unsigned int *persistent)
Definition manage.c:3141
void management_set_state(struct management *man, const int state, const char *detail, const in_addr_t *tun_local_ip, const struct in6_addr *tun_local_ip6, const struct openvpn_sockaddr *local, const struct openvpn_sockaddr *remote)
Definition manage.c:2778
void management_io(struct management *man)
Definition manage.c:3179
void management_check_bytecount_client(struct context *c, struct management *man, struct timeval *timeval)
Definition manage.c:4155
void management_sleep(const int n)
A sleep function that services the management layer for n seconds rather than doing nothing.
Definition manage.c:4131
#define OPENVPN_STATE_GET_CONFIG
Definition manage.h:459
const char * sanitize_control_message(const char *src, struct gc_arena *gc)
Definition misc.c:651
void mss_fixup_ipv6(struct buffer *buf, uint16_t maxmss)
Definition mss.c:83
void mss_fixup_ipv4(struct buffer *buf, uint16_t maxmss)
Definition mss.c:46
void frame_adjust_path_mtu(struct context *c)
Checks and adjusts the fragment and mssfix value according to the discovered path mtu value.
Definition mss.c:341
void process_received_occ_msg(struct context *c)
Definition occ.c:351
static void check_send_occ_msg(struct context *c)
Definition occ.h:138
static bool is_occ_msg(const struct buffer *buf)
Definition occ.h:83
static void check_send_occ_req(struct context *c)
Definition occ.h:110
static void check_send_occ_load_test(struct context *c)
Definition occ.h:124
#define CLEAR(x)
Definition basic.h:32
#define SIZE(x)
Definition basic.h:29
#define M_NOPREFIX
Definition error.h:96
static bool check_debug_level(unsigned int level)
Definition error.h:257
#define dmsg(flags,...)
Definition error.h:170
#define openvpn_errno()
Definition error.h:71
#define msg(flags,...)
Definition error.h:150
#define ASSERT(x)
Definition error.h:217
#define M_WARN
Definition error.h:90
static void check_status(int status, const char *description, struct link_socket *sock, struct tuntap *tt)
Definition error.h:312
#define TLS_MODE(c)
Definition openvpn.h:543
#define PROTO_DUMP(buf, gc)
Definition openvpn.h:545
#define MODE_POINT_TO_POINT
Definition options.h:260
#define MODE_SERVER
Definition options.h:261
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:936
time_t now
Definition otime.c:33
const char * tv_string(const struct timeval *tv, struct gc_arena *gc)
Definition otime.c:83
static void update_time(void)
Definition otime.h:76
static void tv_add(struct timeval *dest, const struct timeval *src)
Definition otime.h:131
@ OVPN_DEL_PEER_REASON_EXPIRED
@ OVPN_CMD_SWAP_KEYS
@ OVPN_CMD_DEL_PEER
void packet_id_persist_save(struct packet_id_persist *p)
Definition packet_id.c:503
static bool packet_id_persist_enabled(const struct packet_id_persist *p)
Definition packet_id.h:278
static void perf_push(int type)
Definition perf.h:77
#define PERF_PROC_OUT_TUN
Definition perf.h:55
#define PERF_PROC_OUT_LINK
Definition perf.h:54
#define PERF_PROC_IN_TUN
Definition perf.h:53
#define PERF_PROC_IN_LINK
Definition perf.h:51
static void perf_pop(void)
Definition perf.h:81
#define PERF_READ_IN_TUN
Definition perf.h:52
#define PERF_READ_IN_LINK
Definition perf.h:50
void trigger_ping_timeout_signal(struct context *c)
Trigger the correct signal on a –ping timeout depending if –ping-exit is set (SIGTERM) or not (SIGUSR...
Definition ping.c:45
static void check_ping_restart(struct context *c)
Definition ping.h:59
static bool is_ping_msg(const struct buffer *buf)
Definition ping.h:40
static void check_ping_send(struct context *c)
Definition ping.h:76
bool is_ipv4(int tunnel_type, struct buffer *buf)
Definition proto.c:108
bool is_ipv6(int tunnel_type, struct buffer *buf)
Definition proto.c:113
uint16_t ip_checksum(const sa_family_t af, const uint8_t *payload, const int len_payload, const uint8_t *src_addr, const uint8_t *dest_addr, const int proto)
Calculates an IP or IPv6 checksum with a pseudo header as required by TCP, UDP and ICMPv6.
Definition proto.c:120
static int get_tun_ip_ver(int tunnel_type, struct buffer *buf, int *ip_hdr_offset)
Definition proto.h:251
#define DEV_TYPE_TAP
Definition proto.h:36
#define OPENVPN_ETH_ALEN
Definition proto.h:52
#define OPENVPN_ETH_P_IPV6
Definition proto.h:59
#define OPENVPN_IPPROTO_ICMPV6
Definition proto.h:107
#define OPENVPN_IN6_ARE_ADDR_EQUAL(a, b)
Version of IN6_ARE_ADDR_EQUAL that is guaranteed to work for unaligned access.
Definition proto.h:87
#define OPENVPN_ICMP6_DESTINATION_UNREACHABLE
Definition proto.h:136
#define OPENVPN_ICMP6_DU_NOROUTE
Definition proto.h:144
void receive_auth_pending(struct context *c, const struct buffer *buffer)
Parses an AUTH_PENDING message and if in pull mode extends the timeout.
Definition push.c:336
void receive_auth_failed(struct context *c, const struct buffer *buffer)
Definition push.c:48
void server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
Definition push.c:128
void receive_cr_response(struct context *c, const struct buffer *buffer)
Definition push.c:263
void send_auth_failed(struct context *c, const char *client_reason)
Definition push.c:393
void receive_exit_message(struct context *c)
Definition push.c:189
bool send_push_request(struct context *c)
Definition push.c:563
void incoming_push_message(struct context *c, const struct buffer *buffer)
Definition push.c:501
void server_pushed_info(const struct buffer *buffer, const int adv)
Definition push.c:225
bool test_routes(const struct route_list *rl, const struct tuntap *tt)
Definition route.c:2434
void show_routes(int msglev)
Definition route.c:3062
void route_list_add_vpn_gateway(struct route_list *rl, struct env_set *es, const in_addr_t addr)
Definition route.c:535
bool shaper_soonest_event(struct timeval *tv, int delay)
Definition shaper.c:36
static void shaper_wrote_bytes(struct shaper *s, int nbytes)
Definition shaper.h:121
static int shaper_delay(struct shaper *s)
Definition shaper.h:96
void print_status(struct context *c, struct status_output *so)
Definition sig.c:478
void process_explicit_exit_notification_timer_wakeup(struct context *c)
Definition sig.c:563
void register_signal(struct signal_info *si, int signum, const char *signal_text)
Register a soft signal in the signal_info struct si respecting priority.
Definition sig.c:228
#define IS_SIG(c)
Definition sig.h:47
static void get_signal(volatile int *sig)
Copy the global signal_received (if non-zero) to the passed-in argument sig.
Definition sig.h:109
const char * socket_stat(const struct link_socket *s, unsigned int rwflags, struct gc_arena *gc)
Definition socket.c:2051
int sockethandle_finalize(sockethandle_t sh, struct overlapped_io *io, struct buffer *buf, struct link_socket_actual *from)
Definition socket.c:2841
unsigned int socket_set(struct link_socket *s, struct event_set *es, unsigned int rwflags, void *arg, unsigned int *persistent)
Definition socket.c:2934
void link_socket_bad_incoming_addr(struct buffer *buf, const struct link_socket_info *info, const struct link_socket_actual *from_addr)
Definition socket.c:1951
bool sockets_read_residual(const struct context *c)
Definition socket.c:45
static ssize_t link_socket_write(struct link_socket *sock, struct buffer *buf, struct link_socket_actual *to)
Definition socket.h:677
static bool link_socket_connection_oriented(const struct link_socket *sock)
Definition socket.h:379
static bool socket_connection_reset(const struct link_socket *sock, int status)
Definition socket.h:414
static bool link_socket_verify_incoming_addr(struct buffer *buf, const struct link_socket_info *info, const struct link_socket_actual *from_addr)
Definition socket.h:437
static void link_socket_set_outgoing_addr(struct link_socket_info *info, const struct link_socket_actual *act, const char *common_name, struct env_set *es)
Definition socket.h:484
static int link_socket_read(struct link_socket *sock, struct buffer *buf, struct link_socket_actual *from)
Definition socket.h:558
static void link_socket_get_outgoing_addr(struct buffer *buf, const struct link_socket_info *info, struct link_socket_actual **act)
Definition socket.h:464
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
static bool link_socket_actual_defined(const struct link_socket_actual *act)
static int datagram_overhead(sa_family_t af, int proto)
@ PROTO_UDP
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
int socks_process_outgoing_udp(struct buffer *buf, const struct link_socket_actual *to)
Definition socks.c:597
void socks_process_incoming_udp(struct buffer *buf, struct link_socket_actual *from)
Definition socks.c:559
bool tls_send_payload(struct key_state *ks, const uint8_t *data, int size)
Definition ssl.c:4017
bool tls_rec_payload(struct tls_multi *multi, struct buffer *buf)
Definition ssl.c:4049
void tls_session_soft_reset(struct tls_multi *tls_multi)
Definition ssl.c:1765
int tls_multi_process(struct tls_multi *multi, struct buffer *to_link, struct link_socket_actual **to_link_addr, struct link_socket_info *to_link_socket_info, interval_t *wakeup)
Definition ssl.c:3197
#define TLSMP_RECONNECT
Definition ssl.h:232
#define TLSMP_ACTIVE
Definition ssl.h:230
static bool tls_initial_packet_received(const struct tls_multi *multi)
Definition ssl.h:490
static void tls_set_single_session(struct tls_multi *multi)
Definition ssl.h:510
#define TLSMP_KILL
Definition ssl.h:231
static int tls_test_payload_len(const struct tls_multi *multi)
Definition ssl.h:496
@ CAS_CONNECT_DONE
Definition ssl_common.h:594
struct buffer extract_command_buffer(struct buffer *buf, struct gc_arena *gc)
Extracts a control channel message from buf and adjusts the size of buf after the message has been ex...
Definition ssl_pkt.c:563
#define P_DATA_V1
Definition ssl_pkt.h:47
#define P_OPCODE_SHIFT
Definition ssl_pkt.h:39
Control Channel Verification Module.
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:67
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
int mssfix
Definition options.h:141
int connect_timeout
Definition options.h:118
struct status_output * status_output
Definition openvpn.h:185
struct route_list * route_list
List of routing information.
Definition openvpn.h:177
int link_sockets_num
Definition openvpn.h:158
struct route_ipv6_list * route_ipv6_list
Definition openvpn.h:182
struct packet_id_persist pid_persist
Definition openvpn.h:170
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition openvpn.h:172
counter_type link_read_bytes
Definition openvpn.h:266
counter_type link_write_bytes
Definition openvpn.h:269
struct event_timeout server_poll_interval
Definition openvpn.h:408
int max_recv_size_local
Definition openvpn.h:308
struct fragment_master * fragment
Definition openvpn.h:252
time_t update_timeout_random_component
Definition openvpn.h:403
unsigned int event_set_status
Definition openvpn.h:235
struct event_timeout route_wakeup_expire
Definition openvpn.h:384
struct event_timeout ping_send_interval
Definition openvpn.h:283
int max_send_size_local
Definition openvpn.h:310
bool did_open_tun
Definition openvpn.h:387
struct timeval timeout_random_component
Definition openvpn.h:404
counter_type tun_read_bytes
Definition openvpn.h:264
struct event_timeout scheduled_exit
Definition openvpn.h:447
struct env_set * es
Definition openvpn.h:420
struct interval tmp_int
Definition openvpn.h:344
struct event_timeout auth_token_renewal_interval
Definition openvpn.h:293
struct event_timeout wait_for_connect
Definition openvpn.h:282
struct shaper shaper
Definition openvpn.h:259
struct event_timeout push_request_interval
Definition openvpn.h:439
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition openvpn.h:323
time_t coarse_timer_wakeup
Definition openvpn.h:399
int scheduled_exit_signal
Definition openvpn.h:448
struct frame frame
Definition openvpn.h:248
struct link_socket_actual from
Definition openvpn.h:245
struct frame frame_fragment
Definition openvpn.h:253
struct buffer to_link
Definition openvpn.h:377
int64_t inactivity_bytes
Definition openvpn.h:288
struct crypto_options crypto_options
Security parameters and crypto state used by the Data Channel Crypto module to process data channel p...
Definition openvpn.h:349
struct buffer to_tun
Definition openvpn.h:376
counter_type tun_write_bytes
Definition openvpn.h:265
struct link_socket ** link_sockets
Definition openvpn.h:237
counter_type link_read_bytes_auth
Definition openvpn.h:268
struct event_timeout packet_id_persist_interval
Definition openvpn.h:355
struct link_socket_actual * to_link_addr
Definition openvpn.h:244
struct event_timeout session_interval
Definition openvpn.h:290
int original_recv_size
Definition openvpn.h:307
struct buffer buf
Definition openvpn.h:375
struct timeval timeval
Time to next event of timers and similar.
Definition openvpn.h:396
time_t explicit_exit_notification_time_wait
Definition openvpn.h:416
bool log_rw
Definition openvpn.h:380
bool fast_io
Definition openvpn.h:424
struct event_set * event_set
Definition openvpn.h:230
struct context_buffers * buffers
Definition openvpn.h:367
struct event_timeout route_wakeup
Definition openvpn.h:383
int tls_exit_signal
Definition openvpn.h:347
struct event_timeout inactivity_interval
Definition openvpn.h:287
struct event_timeout ping_rec_interval
Definition openvpn.h:284
struct buffer read_link_buf
Definition openvpn.h:113
struct buffer encrypt_buf
Definition openvpn.h:100
struct buffer read_tun_buf
Definition openvpn.h:114
struct buffer decrypt_buf
Definition openvpn.h:101
int restart_sleep_seconds
Definition openvpn.h:122
Contains all state information for one tunnel.
Definition openvpn.h:474
struct signal_info * sig
Internal error signaling object.
Definition openvpn.h:503
openvpn_net_ctx_t net_ctx
Networking API opaque context.
Definition openvpn.h:501
struct plugin_list * plugins
List of plug-ins.
Definition openvpn.h:505
struct context_2 c2
Level 2 context.
Definition openvpn.h:517
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:475
struct context_1 c1
Level 1 context.
Definition openvpn.h:516
struct context_persist persist
Persistent context.
Definition openvpn.h:513
Security parameter state for processing data channel packets.
Definition crypto.h:293
struct link_socket * sock
Definition event.h:148
event_arg_t type
Definition event.h:144
unsigned int rwflags
Definition event.h:126
interval_t n
periodic interval for periodic timeouts
Definition interval.h:137
int tun_mtu
the (user) configured tun-mtu.
Definition mtu.h:137
int payload_size
the maximum size that a payload that our buffers can hold from either tun device or network link.
Definition mtu.h:108
int headroom
the headroom in the buffer, this is choosen to allow all potential header to be added before the pack...
Definition mtu.h:114
struct frame::@8 buf
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
Security parameter state of one TLS and data channel key session.
Definition ssl_common.h:208
struct event_set * es
Definition multi_io.h:53
unsigned int udp_flags
Definition multi_io.h:58
uint8_t dest[OPENVPN_ETH_ALEN]
Definition proto.h:55
uint16_t proto
Definition proto.h:62
uint8_t source[OPENVPN_ETH_ALEN]
Definition proto.h:56
uint8_t icmp6_type
Definition proto.h:143
uint16_t icmp6_cksum
Definition proto.h:147
uint8_t icmp6_code
Definition proto.h:146
uint32_t daddr
Definition proto.h:112
uint8_t version_prio
Definition proto.h:121
struct in6_addr saddr
Definition proto.h:127
struct in6_addr daddr
Definition proto.h:128
uint8_t nexthdr
Definition proto.h:124
uint16_t payload_len
Definition proto.h:123
union openvpn_sockaddr::@27 addr
struct sockaddr sa
Definition socket_util.h:42
struct sockaddr_in in4
Definition socket_util.h:43
struct sockaddr_in6 in6
Definition socket_util.h:44
const char * ifconfig_ipv6_remote
Definition options.h:327
int scheduled_exit_interval
Definition options.h:566
int shaper
Definition options.h:330
bool allow_recursive_routing
Definition options.h:721
int64_t inactivity_minimum_bytes
Definition options.h:346
int inactivity_timeout
Definition options.h:345
struct connection_entry ce
Definition options.h:290
int mode
Definition options.h:262
bool block_ipv6
Definition options.h:439
int ping_rec_timeout
Definition options.h:351
int ping_send_timeout
Definition options.h:350
bool route_gateway_via_dhcp
Definition options.h:441
struct client_nat_option_list * client_nat
Definition options.h:443
int session_timeout
Definition options.h:348
volatile int signal_received
Definition sig.h:42
bool is_handle
Definition socket.h:261
struct event_timeout et
Definition status.h:61
int n_hard_errors
Definition ssl_common.h:638
enum multi_status multi_state
Definition ssl_common.h:633
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition ssl_common.h:712
char * client_reason
An error message to send to client on AUTH_FAILED.
Definition ssl_common.h:667
bool use_peer_id
Definition ssl_common.h:701
int dco_peer_id
This is the handle that DCO uses to identify this session with the kernel.
Definition ssl_common.h:724
int n_soft_errors
Definition ssl_common.h:639
Security parameter state of a single session within a VPN tunnel.
Definition ssl_common.h:490
Definition tun.h:183
enum tun_driver_type backend_driver
The backend driver that used for this tun/tap device.
Definition tun.h:193
HANDLE hand
Definition tun.h:218
struct overlapped_io reads
Definition tun.h:221
dco_context_t dco
Definition tun.h:249
char * actual_name
Definition tun.h:207
unsigned short sa_family_t
Definition syshead.h:396
struct env_set * es
struct gc_arena gc
Definition test_ssl.c:154
void tun_show_debug(struct tuntap *tt)
Definition tun.c:6429
const char * tun_stat(const struct tuntap *tt, unsigned int rwflags, struct gc_arena *gc)
Definition tun.c:727
int tun_write_win32(struct tuntap *tt, struct buffer *buf)
Definition tun.c:3574
void show_adapters(int msglev)
Definition tun.c:4838
bool tun_standby(struct tuntap *tt)
Definition tun.c:5497
static bool tuntap_abort(int status)
Definition tun.h:490
#define TUNNEL_TYPE(tt)
Definition tun.h:184
static bool tuntap_defined(const struct tuntap *tt)
Definition tun.h:254
@ DRIVER_AFUNIX
using an AF_UNIX socket to pass packets from/to an external program.
Definition tun.h:51
static void tun_set(struct tuntap *tt, struct event_set *es, unsigned int rwflags, void *arg, unsigned int *persistent)
Definition tun.h:598
int read_tun(struct tuntap *tt, uint8_t *buf, int len)
static bool tuntap_is_dco_win_timeout(struct tuntap *tt, int status)
Definition tun.h:538
static bool tuntap_stop(int status)
Definition tun.h:476
int write_tun(struct tuntap *tt, uint8_t *buf, int len)
ssize_t read_tun_afunix(struct tuntap *tt, uint8_t *buf, int len)
Reads a packet from a AF_UNIX based tun device.
Definition tun_afunix.c:151
ssize_t write_tun_afunix(struct tuntap *tt, uint8_t *buf, int len)
Writes a packet to a AF_UNIX based tun device.
Definition tun_afunix.c:138