OpenVPN
forward.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22 */
23
24#ifdef HAVE_CONFIG_H
25#include "config.h"
26#endif
27
28#include "syshead.h"
29
30#include "forward.h"
31#include "init.h"
32#include "push.h"
33#include "gremlin.h"
34#include "mss.h"
35#include "event.h"
36#include "occ.h"
37#include "ping.h"
38#include "ps.h"
39#include "dhcp.h"
40#include "common.h"
41#include "ssl_verify.h"
42#include "dco.h"
43#include "auth_token.h"
44#include "tun_afunix.h"
45
46#include "memdbg.h"
47
48#include "mstats.h"
49
52
53/* show event wait debugging info */
54
55#ifdef ENABLE_DEBUG
56
57static const char *
58wait_status_string(struct context *c, struct gc_arena *gc)
59{
60 struct buffer out = alloc_buf_gc(64, gc);
61
62 buf_printf(&out, "I/O WAIT %s|%s| %s",
63 tun_stat(c->c1.tuntap, EVENT_READ, gc),
64 tun_stat(c->c1.tuntap, EVENT_WRITE, gc),
65 tv_string(&c->c2.timeval, gc));
66 for (int i = 0; i < c->c1.link_sockets_num; i++)
67 {
68 buf_printf(&out, "\n %s|%s",
69 socket_stat(c->c2.link_sockets[i], EVENT_READ, gc),
70 socket_stat(c->c2.link_sockets[i], EVENT_WRITE, gc));
71 }
72 return BSTR(&out);
73}
74
75static void
77{
78 struct gc_arena gc = gc_new();
79 dmsg(D_EVENT_WAIT, "%s", wait_status_string(c, &gc));
80 gc_free(&gc);
81}
82
83#endif /* ifdef ENABLE_DEBUG */
84
85static void
87{
88 msg(D_STREAM_ERRORS, "Fatal TLS error (check_tls_errors_co), restarting");
89 register_signal(c->sig, c->c2.tls_exit_signal, "tls-error"); /* SOFT-SIGUSR1 -- TLS error */
90}
91
92static void
94{
95 register_signal(c->sig, c->c2.tls_exit_signal, "tls-error"); /* SOFT-SIGUSR1 -- TLS error */
96}
97
98/*
99 * TLS errors are fatal in TCP mode.
100 * Also check for --tls-exit trigger.
101 */
102static inline void
104{
105 if (c->c2.tls_multi && c->c2.tls_exit_signal)
106 {
108 {
109 if (c->c2.tls_multi->n_soft_errors)
110 {
112 }
113 }
114 else
115 {
116 if (c->c2.tls_multi->n_hard_errors)
117 {
119 }
120 }
121 }
122}
123
124/*
125 * Set our wakeup to 0 seconds, so we will be rescheduled
126 * immediately.
127 */
128static inline void
130{
131 c->c2.timeval.tv_sec = 0; /* ZERO-TIMEOUT */
132 c->c2.timeval.tv_usec = 0;
133}
134
135static inline void
137{
138 if (sec < 0)
139 {
140 sec = 0;
141 }
142 if (sec < c->c2.timeval.tv_sec)
143 {
144 c->c2.timeval.tv_sec = sec;
145 c->c2.timeval.tv_usec = 0;
146 }
147}
148
149void
151{
152 /* DCO context is not yet initialised or enabled */
153 if (!dco_enabled(&c->options))
154 {
155 return;
156 }
157
158 /* no active peer (p2p tls-server mode) */
159 if (c->c2.tls_multi->dco_peer_id == -1)
160 {
161 return;
162 }
163
164 if (!dco_update_keys(&c->c1.tuntap->dco, c->c2.tls_multi))
165 {
166 /* Something bad happened. Kill the connection to
167 * be able to recover. */
168 register_signal(c->sig, SIGUSR1, "dco update keys error");
169 }
170}
171
172/*
173 * In TLS mode, let TLS level respond to any control-channel
174 * packets which were received, or prepare any packets for
175 * transmission.
176 *
177 * tmp_int is purely an optimization that allows us to call
178 * tls_multi_process less frequently when there's not much
179 * traffic on the control-channel.
180 *
181 */
182static void
184{
185 interval_t wakeup = BIG_TIMEOUT;
186
187 if (interval_test(&c->c2.tmp_int))
188 {
189 const int tmp_status = tls_multi_process
190 (c->c2.tls_multi, &c->c2.to_link, &c->c2.to_link_addr,
191 get_link_socket_info(c), &wakeup);
192
193 if (tmp_status == TLSMP_RECONNECT)
194 {
197 }
198
199 if (tmp_status == TLSMP_ACTIVE || tmp_status == TLSMP_RECONNECT)
200 {
201 update_time();
203 }
204 else if (tmp_status == TLSMP_KILL)
205 {
206 if (c->options.mode == MODE_SERVER)
207 {
209 }
210 else
211 {
212 register_signal(c->sig, SIGTERM, "auth-control-exit");
213 }
214 }
215
217 }
218
219 interval_schedule_wakeup(&c->c2.tmp_int, &wakeup);
220
221 /*
222 * Our current code has no good hooks in the TLS machinery to update
223 * DCO keys. So we check the key status after the whole TLS machinery
224 * has been completed and potentially update them
225 *
226 * We have a hidden state transition from secondary to primary key based
227 * on ks->auth_deferred_expire that DCO needs to check that the normal
228 * TLS state engine does not check. So we call the \c check_dco_key_status
229 * function even if tmp_status does not indicate that something has changed.
230 */
232
233 if (wakeup)
234 {
235 context_reschedule_sec(c, wakeup);
236 }
237}
238
239static void
241{
242 if (buf_string_match_head_str(buf, "AUTH_FAILED"))
243 {
244 receive_auth_failed(c, buf);
245 }
246 else if (buf_string_match_head_str(buf, "PUSH_"))
247 {
248 incoming_push_message(c, buf);
249 }
250 else if (buf_string_match_head_str(buf, "RESTART"))
251 {
252 server_pushed_signal(c, buf, true, 7);
253 }
254 else if (buf_string_match_head_str(buf, "HALT"))
255 {
256 server_pushed_signal(c, buf, false, 4);
257 }
258 else if (buf_string_match_head_str(buf, "INFO_PRE"))
259 {
260 server_pushed_info(buf, 8);
261 }
262 else if (buf_string_match_head_str(buf, "INFO"))
263 {
264 server_pushed_info(buf, 4);
265 }
266 else if (buf_string_match_head_str(buf, "CR_RESPONSE"))
267 {
268 receive_cr_response(c, buf);
269 }
270 else if (buf_string_match_head_str(buf, "AUTH_PENDING"))
271 {
272 receive_auth_pending(c, buf);
273 }
274 else if (buf_string_match_head_str(buf, "EXIT"))
275 {
277 }
278 else
279 {
280 msg(D_PUSH_ERRORS, "WARNING: Received unknown control message: %s", BSTR(buf));
281 }
282}
283
284/*
285 * Handle incoming configuration
286 * messages on the control channel.
287 */
288static void
290{
291 int len = tls_test_payload_len(c->c2.tls_multi);
292 /* We should only be called with len >0 */
293 ASSERT(len > 0);
294
295 struct gc_arena gc = gc_new();
296 struct buffer buf = alloc_buf_gc(len, &gc);
297 if (tls_rec_payload(c->c2.tls_multi, &buf))
298 {
299 while (BLEN(&buf) > 1)
300 {
301 struct buffer cmdbuf = extract_command_buffer(&buf, &gc);
302
303 if (cmdbuf.len > 0)
304 {
306 }
307 }
308 }
309 else
310 {
311 msg(D_PUSH_ERRORS, "WARNING: Receive control message failed");
312 }
313
314 gc_free(&gc);
315}
316
317/*
318 * Periodically resend PUSH_REQUEST until PUSH message received
319 */
320static void
322{
324
325 /* if no response to first push_request, retry at PUSH_REQUEST_INTERVAL second intervals */
326 event_timeout_modify_wakeup(&c->c2.push_request_interval, PUSH_REQUEST_INTERVAL);
327}
328
329/*
330 * Things that need to happen immediately after connection initiation should go here.
331 *
332 * Options like --up-delay need to be triggered by this function which
333 * checks for connection establishment.
334 *
335 * Note: The process_incoming_push_reply currently assumes that this function
336 * only sets up the pull request timer when pull is enabled.
337 */
338static void
340{
342 {
343 /* if --pull was specified, send a push request to server */
344 if (c->c2.tls_multi && c->options.pull)
345 {
346#ifdef ENABLE_MANAGEMENT
347 if (management)
348 {
351 NULL,
352 NULL,
353 NULL,
354 NULL,
355 NULL);
356 }
357#endif
358 /* fire up push request right away (already 1s delayed) */
359 /* We might receive a AUTH_PENDING request before we armed this
360 * timer. In that case we don't change the value */
361 if (c->c2.push_request_timeout < now)
362 {
363 c->c2.push_request_timeout = now + c->options.handshake_window;
364 }
365 event_timeout_init(&c->c2.push_request_interval, 0, now);
367 }
368 else
369 {
370 if (!do_up(c, false, 0))
371 {
372 register_signal(c->sig, SIGUSR1, "connection initialisation failed");
373 }
374 }
375
376 event_timeout_clear(&c->c2.wait_for_connect);
377 }
378}
379
380bool
382 const char *str, int msglevel)
383{
384 struct gc_arena gc = gc_new();
385 bool stat;
386
388 struct key_state *ks = &session->key[KS_PRIMARY];
389
390 /* buffered cleartext write onto TLS control channel */
391 stat = tls_send_payload(ks, (uint8_t *) str, strlen(str) + 1);
392
393 msg(msglevel, "SENT CONTROL [%s]: '%s' (status=%d)",
394 session->common_name ? session->common_name : "UNDEF",
396 (int) stat);
397
398 gc_free(&gc);
399 return stat;
400}
401
402void
404{
406 context_immediate_reschedule(c); /* ZERO-TIMEOUT */
407}
408
409bool
410send_control_channel_string(struct context *c, const char *str, int msglevel)
411{
412 if (c->c2.tls_multi)
413 {
415 bool ret = send_control_channel_string_dowork(session, str, msglevel);
417
418 return ret;
419 }
420 return true;
421}
422/*
423 * Add routes.
424 */
425
426static void
427check_add_routes_action(struct context *c, const bool errors)
428{
429 bool route_status = do_route(&c->options, c->c1.route_list, c->c1.route_ipv6_list,
430 c->c1.tuntap, c->plugins, c->c2.es, &c->net_ctx);
431
432 int flags = (errors ? ISC_ERRORS : 0);
433 flags |= (!route_status ? ISC_ROUTE_ERRORS : 0);
434
435 update_time();
438 initialization_sequence_completed(c, flags); /* client/p2p --route-delay was defined */
439}
440
441static void
443{
444 if (test_routes(c->c1.route_list, c->c1.tuntap))
445 {
446 check_add_routes_action(c, false);
447 }
449 {
451 }
452 else
453 {
454 msg(D_ROUTE, "Route: Waiting for TUN/TAP interface to come up...");
455 if (c->c1.tuntap)
456 {
457 if (!tun_standby(c->c1.tuntap))
458 {
459 register_signal(c->sig, SIGHUP, "ip-fail");
461#ifdef _WIN32
464#endif
465 }
466 }
467 update_time();
468 if (c->c2.route_wakeup.n != 1)
469 {
471 }
473 }
474}
475
476/*
477 * Should we exit due to inactivity timeout?
478 *
479 * In the non-dco case, the timeout is reset via register_activity()
480 * whenever there is sufficient activity on tun or link, so this function
481 * is only ever called to raise the TERM signal.
482 *
483 * With DCO, OpenVPN does not see incoming or outgoing data packets anymore
484 * and the logic needs to change - we permit the event to trigger and check
485 * kernel DCO counters here, returning and rearming the timer if there was
486 * sufficient traffic.
487 */
488static void
490{
491 if (dco_enabled(&c->options) && dco_get_peer_stats(c, true) == 0)
492 {
493 int64_t tot_bytes = c->c2.tun_read_bytes + c->c2.tun_write_bytes;
494 int64_t new_bytes = tot_bytes - c->c2.inactivity_bytes;
495
496 if (new_bytes > c->options.inactivity_minimum_bytes)
497 {
498 c->c2.inactivity_bytes = tot_bytes;
500 return;
501 }
502 }
503
504 msg(M_INFO, "Inactivity timeout (--inactive), exiting");
505 register_signal(c->sig, SIGTERM, "inactive");
506}
507
508int
510{
511 update_time();
512 int remaining = event_timeout_remaining(server_poll_timeout);
513 return max_int(0, remaining);
514}
515
516static void
518{
520 ASSERT(c->c2.tls_multi);
522 {
523 msg(M_INFO, "Server poll timeout, restarting");
524 register_signal(c->sig, SIGUSR1, "server_poll");
526 }
527}
528
529/*
530 * Schedule a SIGTERM signal c->options.scheduled_exit_interval seconds from now.
531 */
532bool
534{
535 const int n_seconds = c->options.scheduled_exit_interval;
536 /* don't reschedule if already scheduled. */
538 {
539 return false;
540 }
542 update_time();
544 event_timeout_init(&c->c2.scheduled_exit, n_seconds, now);
545 c->c2.scheduled_exit_signal = SIGTERM;
546 msg(D_SCHED_EXIT, "Delayed exit in %d seconds", n_seconds);
547 return true;
548}
549
550/*
551 * Scheduled exit?
552 */
553static void
555{
556 register_signal(c->sig, c->c2.scheduled_exit_signal, "delayed-exit");
557}
558
559/*
560 * Should we write timer-triggered status file.
561 */
562static void
564{
565 if (c->c1.status_output)
566 {
568 }
569}
570
571#ifdef ENABLE_FRAGMENT
572/*
573 * Should we deliver a datagram fragment to remote?
574 * c is expected to be a single-link context (p2p or child)
575 */
576static void
578{
579 struct link_socket_info *lsi = get_link_socket_info(c);
580
581 /* OS MTU Hint? */
582 if (lsi->mtu_changed && lsi->lsa)
583 {
585 lsi->mtu_changed = false;
586 }
587
589 {
590 if (!c->c2.to_link.len)
591 {
592 /* encrypt a fragment for output to TCP/UDP port */
594 encrypt_sign(c, false);
595 }
596 }
597
599}
600#endif /* ifdef ENABLE_FRAGMENT */
601
602/*
603 * Buffer reallocation, for use with null encryption.
604 */
605static inline void
606buffer_turnover(const uint8_t *orig_buf, struct buffer *dest_stub, struct buffer *src_stub, struct buffer *storage)
607{
608 if (orig_buf == src_stub->data && src_stub->data != storage->data)
609 {
610 buf_assign(storage, src_stub);
611 *dest_stub = *storage;
612 }
613 else
614 {
615 *dest_stub = *src_stub;
616 }
617}
618
619/*
620 * Compress, fragment, encrypt and HMAC-sign an outgoing packet.
621 * Input: c->c2.buf
622 * Output: c->c2.to_link
623 */
624void
625encrypt_sign(struct context *c, bool comp_frag)
626{
627 struct context_buffers *b = c->c2.buffers;
628 const uint8_t *orig_buf = c->c2.buf.data;
629 struct crypto_options *co = NULL;
630
631 if (dco_enabled(&c->options))
632 {
633 msg(M_WARN, "Attempting to send data packet while data channel offload is in use. "
634 "Dropping packet");
635 c->c2.buf.len = 0;
636 }
637
638 /*
639 * Drop non-TLS outgoing packet if client-connect script/plugin
640 * has not yet succeeded. In non-TLS tls_multi mode is not defined
641 * and we always pass packets.
642 */
644 {
645 c->c2.buf.len = 0;
646 }
647
648 if (comp_frag)
649 {
650#ifdef USE_COMP
651 /* Compress the packet. */
652 if (c->c2.comp_context)
653 {
654 (*c->c2.comp_context->alg.compress)(&c->c2.buf, b->compress_buf, c->c2.comp_context, &c->c2.frame);
655 }
656#endif
657#ifdef ENABLE_FRAGMENT
658 if (c->c2.fragment)
659 {
661 }
662#endif
663 }
664
665 /* initialize work buffer with buf.headroom bytes of prepend capacity */
667
668 if (c->c2.tls_multi)
669 {
670 /* Get the key we will use to encrypt the packet. */
671 tls_pre_encrypt(c->c2.tls_multi, &c->c2.buf, &co);
672 /* If using P_DATA_V2, prepend the 1-byte opcode and 3-byte peer-id to the
673 * packet before openvpn_encrypt(), so we can authenticate the opcode too.
674 */
675 if (c->c2.buf.len > 0 && c->c2.tls_multi->use_peer_id)
676 {
678 }
679 }
680 else
681 {
682 co = &c->c2.crypto_options;
683 }
684
685 /* Encrypt and authenticate the packet */
686 openvpn_encrypt(&c->c2.buf, b->encrypt_buf, co);
687
688 /* Do packet administration */
689 if (c->c2.tls_multi)
690 {
691 if (c->c2.buf.len > 0 && !c->c2.tls_multi->use_peer_id)
692 {
694 }
696 }
697
698 /*
699 * Get the address we will be sending the packet to.
700 */
702 &c->c2.to_link_addr);
703
704 /* if null encryption, copy result to read_tun_buf */
705 buffer_turnover(orig_buf, &c->c2.to_link, &c->c2.buf, &b->read_tun_buf);
706}
707
708/*
709 * Should we exit due to session timeout?
710 */
711static void
713{
717 {
718 msg(M_INFO, "Session timeout, exiting");
719 register_signal(c->sig, SIGTERM, "session-timeout");
720 }
721}
722
723/*
724 * Coarse timers work to 1 second resolution.
725 */
726static void
728{
729 /* flush current packet-id to file once per 60
730 * seconds if --replay-persist was specified */
733 {
735 }
736
737 /* Should we write timer-triggered status file */
738 if (c->c1.status_output
740 {
742 }
743
744 /* process connection establishment items */
746 {
748 }
749
750 /* see if we should send a push_request (option --pull) */
752 {
754 }
755
756 /* process --route options */
758 {
760 }
761
762 /* check if we want to refresh the auth-token */
764 {
766 }
767
768 /* possibly exit due to --inactive */
771 {
773 }
774
775 if (c->sig->signal_received)
776 {
777 return;
778 }
779
780 /* kill session if time is over */
782 if (c->sig->signal_received)
783 {
784 return;
785 }
786
787 /* restart if ping not received */
789 if (c->sig->signal_received)
790 {
791 return;
792 }
793
794 if (c->c2.tls_multi)
795 {
798 {
800 }
801 if (c->sig->signal_received)
802 {
803 return;
804 }
806 {
808 }
809 if (c->sig->signal_received)
810 {
811 return;
812 }
813 }
814
815 /* Should we send an OCC_REQUEST message? */
817
818 /* Should we send an MTU load test? */
820
821 /* Should we send an OCC_EXIT message to remote? */
823 {
825 }
826
827 /* Should we ping the remote? */
829
830#ifdef ENABLE_MANAGEMENT
831 if (management)
832 {
834 }
835#endif /* ENABLE_MANAGEMENT */
836}
837
838static void
840{
841 if (now < c->c2.coarse_timer_wakeup)
842 {
844 return;
845 }
846
847 const struct timeval save = c->c2.timeval;
848 c->c2.timeval.tv_sec = BIG_TIMEOUT;
849 c->c2.timeval.tv_usec = 0;
851 c->c2.coarse_timer_wakeup = now + c->c2.timeval.tv_sec;
852
853 dmsg(D_INTERVAL, "TIMER: coarse timer wakeup %" PRIi64 " seconds", (int64_t)c->c2.timeval.tv_sec);
854
855 /* Is the coarse timeout NOT the earliest one? */
856 if (c->c2.timeval.tv_sec > save.tv_sec)
857 {
858 c->c2.timeval = save;
859 }
860}
861
862static void
864{
865 const int update_interval = 10; /* seconds */
866 c->c2.update_timeout_random_component = now + update_interval;
867 c->c2.timeout_random_component.tv_usec = (time_t) get_random() & 0x0003FFFF;
868 c->c2.timeout_random_component.tv_sec = 0;
869
870 dmsg(D_INTERVAL, "RANDOM USEC=%ld", (long) c->c2.timeout_random_component.tv_usec);
871}
872
873static inline void
875{
877 {
879 }
880 if (c->c2.timeval.tv_sec >= 1)
881 {
883 }
884}
885
886/*
887 * Handle addition and removal of the 10-byte Socks5 header
888 * in UDP packets.
889 */
890
891static inline void
893{
894 if (sock->socks_proxy && sock->info.proto == PROTO_UDP)
895 {
897 }
898}
899
900static inline void
902 struct link_socket *sock,
903 struct link_socket_actual **to_addr,
904 int *size_delta)
905{
906 if (sock->socks_proxy && sock->info.proto == PROTO_UDP)
907 {
908 *size_delta += socks_process_outgoing_udp(&c->c2.to_link, c->c2.to_link_addr);
909 *to_addr = &sock->socks_relay;
910 }
911}
912
913/* undo effect of socks_preprocess_outgoing_link */
914static inline void
916 int size_delta,
917 struct buffer *buf)
918{
919 if (size_delta > 0 && *size > size_delta)
920 {
921 *size -= size_delta;
922 if (!buf_advance(buf, size_delta))
923 {
924 *size = 0;
925 }
926 }
927}
928
929/*
930 * Output: c->c2.buf
931 */
932
933void
934read_incoming_link(struct context *c, struct link_socket *sock)
935{
936 /*
937 * Set up for recvfrom call to read datagram
938 * sent to our TCP/UDP port.
939 */
940 int status;
941
942 /*ASSERT (!c->c2.to_tun.len);*/
943
945
946 c->c2.buf = c->c2.buffers->read_link_buf;
948
950 &c->c2.buf,
951 &c->c2.from);
952
954 {
955#if PORT_SHARE
956 if (port_share && socket_foreign_protocol_detected(sock))
957 {
958 const struct buffer *fbuf = socket_foreign_protocol_head(sock);
959 const int sd = socket_foreign_protocol_sd(sock);
961 register_signal(c->sig, SIGTERM, "port-share-redirect");
962 }
963 else
964#endif
965 {
966 /* received a disconnect from a connection-oriented protocol */
967 if (event_timeout_defined(&c->c2.explicit_exit_notification_interval))
968 {
969 msg(D_STREAM_ERRORS, "Connection reset during exit notification period, ignoring [%d]", status);
971 }
972 else
973 {
974 register_signal(c->sig, SIGUSR1, "connection-reset"); /* SOFT-SIGUSR1 -- TCP connection reset */
975 msg(D_STREAM_ERRORS, "Connection reset, restarting [%d]", status);
976 }
977 }
978 perf_pop();
979 return;
980 }
981
982 /* check_status() call below resets last-error code */
984
985 /* check recvfrom status */
986 check_status(status, "read", sock, NULL);
987
988 if (dco_win_timeout)
989 {
991 }
992
993 /* Remove socks header if applicable */
995
996 perf_pop();
997}
998
999bool
1001{
1002 struct gc_arena gc = gc_new();
1003 bool decrypt_status = false;
1004
1005 if (c->c2.buf.len > 0)
1006 {
1007 c->c2.link_read_bytes += c->c2.buf.len;
1009#ifdef ENABLE_MEMSTATS
1010 if (mmap_stats)
1011 {
1012 mmap_stats->link_read_bytes = link_read_bytes_global;
1013 }
1014#endif
1015 c->c2.original_recv_size = c->c2.buf.len;
1016#ifdef ENABLE_MANAGEMENT
1017 if (management)
1018 {
1021 }
1022#endif
1023 }
1024 else
1025 {
1026 c->c2.original_recv_size = 0;
1027 }
1028
1029#ifdef ENABLE_DEBUG
1030 /* take action to corrupt packet if we are in gremlin test mode */
1031 if (c->options.gremlin)
1032 {
1033 if (!ask_gremlin(c->options.gremlin))
1034 {
1035 c->c2.buf.len = 0;
1036 }
1037 corrupt_gremlin(&c->c2.buf, c->options.gremlin);
1038 }
1039#endif
1040
1041 /* log incoming packet */
1042#ifdef LOG_RW
1043 if (c->c2.log_rw && c->c2.buf.len > 0)
1044 {
1045 fprintf(stderr, "R");
1046 }
1047#endif
1048 msg(D_LINK_RW, "%s READ [%d] from %s: %s",
1049 proto2ascii(lsi->proto, lsi->af, true),
1050 BLEN(&c->c2.buf),
1052 PROTO_DUMP(&c->c2.buf, &gc));
1053
1054 /*
1055 * Good, non-zero length packet received.
1056 * Commence multi-stage processing of packet,
1057 * such as authenticate, decrypt, decompress.
1058 * If any stage fails, it sets buf.len to 0 or -1,
1059 * telling downstream stages to ignore the packet.
1060 */
1061 if (c->c2.buf.len > 0)
1062 {
1063 struct crypto_options *co = NULL;
1064 const uint8_t *ad_start = NULL;
1065 if (!link_socket_verify_incoming_addr(&c->c2.buf, lsi, &c->c2.from))
1066 {
1068 }
1069
1070 if (c->c2.tls_multi)
1071 {
1072 uint8_t opcode = *BPTR(&c->c2.buf) >> P_OPCODE_SHIFT;
1073
1074 /*
1075 * If DCO is enabled, the kernel drivers require that the
1076 * other end only sends P_DATA_V2 packets. V1 are unknown
1077 * to kernel and passed to userland, but we cannot handle them
1078 * either because crypto context is missing - so drop the packet.
1079 *
1080 * This can only happen with particular old (2.4.0-2.4.4) servers.
1081 */
1082 if ((opcode == P_DATA_V1) && dco_enabled(&c->options))
1083 {
1085 "Data Channel Offload doesn't support DATA_V1 packets. "
1086 "Upgrade your server to 2.4.5 or newer.");
1087 c->c2.buf.len = 0;
1088 }
1089
1090 /*
1091 * If tls_pre_decrypt returns true, it means the incoming
1092 * packet was a good TLS control channel packet. If so, TLS code
1093 * will deal with the packet and set buf.len to 0 so downstream
1094 * stages ignore it.
1095 *
1096 * If the packet is a data channel packet, tls_pre_decrypt
1097 * will load crypto_options with the correct encryption key
1098 * and return false.
1099 */
1100 if (tls_pre_decrypt(c->c2.tls_multi, &c->c2.from, &c->c2.buf, &co,
1101 floated, &ad_start))
1102 {
1104
1105 /* reset packet received timer if TLS packet */
1107 {
1109 }
1110 }
1111 }
1112 else
1113 {
1114 co = &c->c2.crypto_options;
1115 }
1116
1117 /*
1118 * Drop non-TLS packet if client-connect script/plugin and cipher selection
1119 * has not yet succeeded. In non-TLS mode tls_multi is not defined
1120 * and we always pass packets.
1121 */
1123 {
1124 c->c2.buf.len = 0;
1125 }
1126
1127 /* authenticate and decrypt the incoming packet */
1128 decrypt_status = openvpn_decrypt(&c->c2.buf, c->c2.buffers->decrypt_buf,
1129 co, &c->c2.frame, ad_start);
1130
1131 if (!decrypt_status
1132 /* on the instance context we have only one socket, so just check the first one */
1134 {
1135 /* decryption errors are fatal in TCP mode */
1136 register_signal(c->sig, SIGUSR1, "decryption-error"); /* SOFT-SIGUSR1 -- decryption error in TCP mode */
1137 msg(D_STREAM_ERRORS, "Fatal decryption error (process_incoming_link), restarting");
1138 }
1139 }
1140 else
1141 {
1142 buf_reset(&c->c2.to_tun);
1143 }
1144 gc_free(&gc);
1145
1146 return decrypt_status;
1147}
1148
1149void
1150process_incoming_link_part2(struct context *c, struct link_socket_info *lsi, const uint8_t *orig_buf)
1151{
1152 if (c->c2.buf.len > 0)
1153 {
1154#ifdef ENABLE_FRAGMENT
1155 if (c->c2.fragment)
1156 {
1158 }
1159#endif
1160
1161#ifdef USE_COMP
1162 /* decompress the incoming packet */
1163 if (c->c2.comp_context)
1164 {
1165 (*c->c2.comp_context->alg.decompress)(&c->c2.buf, c->c2.buffers->decompress_buf, c->c2.comp_context, &c->c2.frame);
1166 }
1167#endif
1168
1169#ifdef PACKET_TRUNCATION_CHECK
1170 /* if (c->c2.buf.len > 1) --c->c2.buf.len; */
1171 ipv4_packet_size_verify(BPTR(&c->c2.buf),
1172 BLEN(&c->c2.buf),
1173 TUNNEL_TYPE(c->c1.tuntap),
1174 "POST_DECRYPT",
1175 &c->c2.n_trunc_post_decrypt);
1176#endif
1177
1178 /*
1179 * Set our "official" outgoing address, since
1180 * if buf.len is non-zero, we know the packet
1181 * authenticated. In TLS mode we do nothing
1182 * because TLS mode takes care of source address
1183 * authentication.
1184 *
1185 * Also, update the persisted version of our packet-id.
1186 */
1187 if (!TLS_MODE(c) && c->c2.buf.len > 0)
1188 {
1189 link_socket_set_outgoing_addr(lsi, &c->c2.from, NULL, c->c2.es);
1190 }
1191
1192 /* reset packet received timer */
1193 if (c->options.ping_rec_timeout && c->c2.buf.len > 0)
1194 {
1196 }
1197
1198 /* increment authenticated receive byte count */
1199 if (c->c2.buf.len > 0)
1200 {
1201 c->c2.link_read_bytes_auth += c->c2.buf.len;
1203 }
1204
1205 /* Did we just receive an openvpn ping packet? */
1206 if (is_ping_msg(&c->c2.buf))
1207 {
1208 dmsg(D_PING, "RECEIVED PING PACKET");
1209 c->c2.buf.len = 0; /* drop packet */
1210 }
1211
1212 /* Did we just receive an OCC packet? */
1213 if (is_occ_msg(&c->c2.buf))
1214 {
1216 }
1217
1218 buffer_turnover(orig_buf, &c->c2.to_tun, &c->c2.buf, &c->c2.buffers->read_link_buf);
1219
1220 /* to_tun defined + unopened tuntap can cause deadlock */
1221 if (!tuntap_defined(c->c1.tuntap))
1222 {
1223 c->c2.to_tun.len = 0;
1224 }
1225 }
1226 else
1227 {
1228 buf_reset(&c->c2.to_tun);
1229 }
1230}
1231
1232static void
1234{
1236
1237 struct link_socket_info *lsi = &sock->info;
1238 const uint8_t *orig_buf = c->c2.buf.data;
1239
1240 process_incoming_link_part1(c, lsi, false);
1241 process_incoming_link_part2(c, lsi, orig_buf);
1242
1243 perf_pop();
1244}
1245
1246static void
1248{
1249#if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD))
1250 dco_context_t *dco = &c->c1.tuntap->dco;
1251
1252 dco_do_read(dco);
1253
1254 /* no message for us to handle - platform specific code has logged details */
1255 if (dco->dco_message_type == 0)
1256 {
1257 return;
1258 }
1259
1260 /* FreeBSD currently sends us removal notifcation with the old peer-id in
1261 * p2p mode with the ping timeout reason, so ignore that one to not shoot
1262 * ourselves in the foot and removing the just established session */
1263 if (dco->dco_message_peer_id != c->c2.tls_multi->dco_peer_id)
1264 {
1265 msg(D_DCO_DEBUG, "%s: received message for mismatching peer-id %d, "
1266 "expected %d", __func__, dco->dco_message_peer_id,
1268 return;
1269 }
1270
1271 switch (dco->dco_message_type)
1272 {
1273 case OVPN_CMD_DEL_PEER:
1274 /* peer is gone, unset ID to prevent more kernel calls */
1275 c->c2.tls_multi->dco_peer_id = -1;
1276 if (dco->dco_del_peer_reason == OVPN_DEL_PEER_REASON_EXPIRED)
1277 {
1278 msg(D_DCO_DEBUG, "%s: received peer expired notification of for peer-id "
1279 "%d", __func__, dco->dco_message_peer_id);
1281 return;
1282 }
1283 break;
1284
1285 case OVPN_CMD_SWAP_KEYS:
1286 msg(D_DCO_DEBUG, "%s: received key rotation notification for peer-id %d",
1287 __func__, dco->dco_message_peer_id);
1289 break;
1290
1291 default:
1292 msg(D_DCO_DEBUG, "%s: received message of type %u - ignoring", __func__,
1293 dco->dco_message_type);
1294 return;
1295 }
1296
1297#endif /* if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD)) */
1298}
1299
1300/*
1301 * Output: c->c2.buf
1302 */
1303
1304void
1306{
1307 /*
1308 * Setup for read() call on TUN/TAP device.
1309 */
1310 /*ASSERT (!c->c2.to_link.len);*/
1311
1313
1314 c->c2.buf = c->c2.buffers->read_tun_buf;
1315
1316#ifdef _WIN32
1317 /* we cannot end up here when using dco */
1318 ASSERT(!dco_enabled(&c->options));
1319
1320 sockethandle_t sh = { .is_handle = true, .h = c->c1.tuntap->hand, .prepend_sa = false };
1321 sockethandle_finalize(sh, &c->c1.tuntap->reads, &c->c2.buf, NULL);
1322#else /* ifdef _WIN32 */
1326 {
1328 }
1329 else
1330 {
1331 c->c2.buf.len = read_tun(c->c1.tuntap, BPTR(&c->c2.buf), c->c2.frame.buf.payload_size);
1332 }
1333#endif /* ifdef _WIN32 */
1334
1335#ifdef PACKET_TRUNCATION_CHECK
1336 ipv4_packet_size_verify(BPTR(&c->c2.buf),
1337 BLEN(&c->c2.buf),
1338 TUNNEL_TYPE(c->c1.tuntap),
1339 "READ_TUN",
1340 &c->c2.n_trunc_tun_read);
1341#endif
1342
1343 /* Was TUN/TAP interface stopped? */
1344 if (tuntap_stop(c->c2.buf.len))
1345 {
1346 register_signal(c->sig, SIGTERM, "tun-stop");
1347 msg(M_INFO, "TUN/TAP interface has been stopped, exiting");
1348 perf_pop();
1349 return;
1350 }
1351
1352 /* Was TUN/TAP I/O operation aborted? */
1353 if (tuntap_abort(c->c2.buf.len))
1354 {
1355 register_signal(c->sig, SIGHUP, "tun-abort");
1357 msg(M_INFO, "TUN/TAP I/O operation aborted, restarting");
1358 perf_pop();
1359 return;
1360 }
1361
1362 /* Check the status return from read() */
1363 check_status(c->c2.buf.len, "read from TUN/TAP", NULL, c->c1.tuntap);
1364
1365 perf_pop();
1366}
1367
1376static void
1378{
1379 bool drop = false;
1380 struct openvpn_sockaddr tun_sa;
1381 int ip_hdr_offset = 0;
1382
1383 if (c->c2.to_link_addr == NULL) /* no remote addr known */
1384 {
1385 return;
1386 }
1387
1388 tun_sa = c->c2.to_link_addr->dest;
1389
1390 int proto_ver = get_tun_ip_ver(TUNNEL_TYPE(c->c1.tuntap), &c->c2.buf, &ip_hdr_offset);
1391
1392 if (proto_ver == 4)
1393 {
1394 /* make sure we got whole IP header */
1395 if (BLEN(buf) < ((int) sizeof(struct openvpn_iphdr) + ip_hdr_offset))
1396 {
1397 return;
1398 }
1399
1400 /* skip ipv4 packets for ipv6 tun */
1401 if (tun_sa.addr.sa.sa_family != AF_INET)
1402 {
1403 return;
1404 }
1405
1406 struct openvpn_iphdr *pip = (struct openvpn_iphdr *) (BPTR(buf) + ip_hdr_offset);
1407
1408 /* drop packets with same dest addr as gateway */
1409 if (memcmp(&tun_sa.addr.in4.sin_addr.s_addr, &pip->daddr, sizeof(pip->daddr)) == 0)
1410 {
1411 drop = true;
1412 }
1413 }
1414 else if (proto_ver == 6)
1415 {
1416 /* make sure we got whole IPv6 header */
1417 if (BLEN(buf) < ((int) sizeof(struct openvpn_ipv6hdr) + ip_hdr_offset))
1418 {
1419 return;
1420 }
1421
1422 /* skip ipv6 packets for ipv4 tun */
1423 if (tun_sa.addr.sa.sa_family != AF_INET6)
1424 {
1425 return;
1426 }
1427
1428 struct openvpn_ipv6hdr *pip6 = (struct openvpn_ipv6hdr *) (BPTR(buf) + ip_hdr_offset);
1429
1430 /* drop packets with same dest addr as gateway */
1431 if (OPENVPN_IN6_ARE_ADDR_EQUAL(&tun_sa.addr.in6.sin6_addr, &pip6->daddr))
1432 {
1433 drop = true;
1434 }
1435 }
1436
1437 if (drop)
1438 {
1439 struct gc_arena gc = gc_new();
1440
1441 c->c2.buf.len = 0;
1442
1443 msg(D_LOW, "Recursive routing detected, drop tun packet to %s",
1445 gc_free(&gc);
1446 }
1447}
1448
1449/*
1450 * Input: c->c2.buf
1451 * Output: c->c2.to_link
1452 */
1453
1454void
1455process_incoming_tun(struct context *c, struct link_socket *out_sock)
1456{
1457 struct gc_arena gc = gc_new();
1458
1460
1461 if (c->c2.buf.len > 0)
1462 {
1463 c->c2.tun_read_bytes += c->c2.buf.len;
1464 }
1465
1466#ifdef LOG_RW
1467 if (c->c2.log_rw && c->c2.buf.len > 0)
1468 {
1469 fprintf(stderr, "r");
1470 }
1471#endif
1472
1473 /* Show packet content */
1474 dmsg(D_TUN_RW, "TUN READ [%d]", BLEN(&c->c2.buf));
1475
1476 if (c->c2.buf.len > 0)
1477 {
1479 {
1481 }
1482 /*
1483 * The --passtos and --mssfix options require
1484 * us to examine the IP header (IPv4 or IPv6).
1485 */
1486 unsigned int flags = PIPV4_PASSTOS | PIP_MSSFIX | PIPV4_CLIENT_NAT
1488 process_ip_header(c, flags, &c->c2.buf, out_sock);
1489
1490#ifdef PACKET_TRUNCATION_CHECK
1491 /* if (c->c2.buf.len > 1) --c->c2.buf.len; */
1492 ipv4_packet_size_verify(BPTR(&c->c2.buf),
1493 BLEN(&c->c2.buf),
1494 TUNNEL_TYPE(c->c1.tuntap),
1495 "PRE_ENCRYPT",
1496 &c->c2.n_trunc_pre_encrypt);
1497#endif
1498
1499 }
1500 if (c->c2.buf.len > 0)
1501 {
1502 encrypt_sign(c, true);
1503 }
1504 else
1505 {
1506 buf_reset(&c->c2.to_link);
1507 }
1508 perf_pop();
1509 gc_free(&gc);
1510}
1511
1522void
1523ipv6_send_icmp_unreachable(struct context *c, struct buffer *buf, bool client)
1524{
1525#define MAX_ICMPV6LEN 1280
1526 struct openvpn_icmp6hdr icmp6out;
1527 CLEAR(icmp6out);
1528
1529 /*
1530 * Get a buffer to the ip packet, is_ipv6 automatically forwards
1531 * the buffer to the ip packet
1532 */
1533 struct buffer inputipbuf = *buf;
1534
1535 is_ipv6(TUNNEL_TYPE(c->c1.tuntap), &inputipbuf);
1536
1537 if (BLEN(&inputipbuf) < (int)sizeof(struct openvpn_ipv6hdr))
1538 {
1539 return;
1540 }
1541
1542 const struct openvpn_ipv6hdr *pip6 = (struct openvpn_ipv6hdr *)BPTR(&inputipbuf);
1543
1544 /* Copy version, traffic class, flow label from input packet */
1545 struct openvpn_ipv6hdr pip6out = *pip6;
1546
1547 pip6out.version_prio = pip6->version_prio;
1548 pip6out.daddr = pip6->saddr;
1549
1550 /*
1551 * Use the IPv6 remote address if we have one, otherwise use a fake one
1552 * using the remote address is preferred since it makes debugging and
1553 * understanding where the ICMPv6 error originates easier
1554 */
1556 {
1557 inet_pton(AF_INET6, c->options.ifconfig_ipv6_remote, &pip6out.saddr);
1558 }
1559 else
1560 {
1561 inet_pton(AF_INET6, "fe80::7", &pip6out.saddr);
1562 }
1563
1565
1566 /*
1567 * The ICMPv6 unreachable code worked best in my (arne) tests with Windows,
1568 * Linux and Android. Windows did not like the administratively prohibited
1569 * return code (no fast fail)
1570 */
1573
1574 int icmpheader_len = sizeof(struct openvpn_ipv6hdr)
1575 + sizeof(struct openvpn_icmp6hdr);
1576 int totalheader_len = icmpheader_len;
1577
1578 if (TUNNEL_TYPE(c->c1.tuntap) == DEV_TYPE_TAP)
1579 {
1580 totalheader_len += sizeof(struct openvpn_ethhdr);
1581 }
1582
1583 /*
1584 * Calculate size for payload, defined in the standard that the resulting
1585 * frame should be <= 1280 and have as much as possible of the original
1586 * packet
1587 */
1588 int max_payload_size = min_int(MAX_ICMPV6LEN,
1589 c->c2.frame.tun_mtu - icmpheader_len);
1590 int payload_len = min_int(max_payload_size, BLEN(&inputipbuf));
1591
1592 pip6out.payload_len = htons(sizeof(struct openvpn_icmp6hdr) + payload_len);
1593
1594 /* Construct the packet as outgoing packet back to the client */
1595 struct buffer *outbuf;
1596 if (client)
1597 {
1598 c->c2.to_tun = c->c2.buffers->aux_buf;
1599 outbuf = &(c->c2.to_tun);
1600 }
1601 else
1602 {
1603 c->c2.to_link = c->c2.buffers->aux_buf;
1604 outbuf = &(c->c2.to_link);
1605 }
1607
1608 /* Fill the end of the buffer with original packet */
1609 ASSERT(buf_safe(outbuf, payload_len));
1610 ASSERT(buf_copy_n(outbuf, &inputipbuf, payload_len));
1611
1612 /* ICMP Header, copy into buffer to allow checksum calculation */
1614
1615 /* Calculate checksum over the packet and write to header */
1616
1618 (const uint8_t *)&pip6out.saddr,
1620 ((struct openvpn_icmp6hdr *) BPTR(outbuf))->icmp6_cksum = htons(new_csum);
1621
1622
1623 /* IPv6 Header */
1624 ASSERT(buf_write_prepend(outbuf, &pip6out, sizeof(struct openvpn_ipv6hdr)));
1625
1626 /*
1627 * Tap mode, we also need to create an Ethernet header.
1628 */
1629 if (TUNNEL_TYPE(c->c1.tuntap) == DEV_TYPE_TAP)
1630 {
1631 if (BLEN(buf) < (int)sizeof(struct openvpn_ethhdr))
1632 {
1633 return;
1634 }
1635
1636 const struct openvpn_ethhdr *orig_ethhdr = (struct openvpn_ethhdr *) BPTR(buf);
1637
1638 /* Copy frametype and reverse source/destination for the response */
1639 struct openvpn_ethhdr ethhdr;
1640 memcpy(ethhdr.source, orig_ethhdr->dest, OPENVPN_ETH_ALEN);
1641 memcpy(ethhdr.dest, orig_ethhdr->source, OPENVPN_ETH_ALEN);
1642 ethhdr.proto = htons(OPENVPN_ETH_P_IPV6);
1643 ASSERT(buf_write_prepend(outbuf, &ethhdr, sizeof(struct openvpn_ethhdr)));
1644 }
1645#undef MAX_ICMPV6LEN
1646}
1647
1648void
1649process_ip_header(struct context *c, unsigned int flags, struct buffer *buf,
1650 struct link_socket *sock)
1651{
1652 if (!c->options.ce.mssfix)
1653 {
1654 flags &= ~PIP_MSSFIX;
1655 }
1656#if PASSTOS_CAPABILITY
1657 if (!c->options.passtos)
1658 {
1659 flags &= ~PIPV4_PASSTOS;
1660 }
1661#endif
1662 if (!c->options.client_nat)
1663 {
1664 flags &= ~PIPV4_CLIENT_NAT;
1665 }
1667 {
1668 flags &= ~PIPV4_EXTRACT_DHCP_ROUTER;
1669 }
1670 if (!c->options.block_ipv6)
1671 {
1673 }
1674
1675 if (buf->len > 0)
1676 {
1677 struct buffer ipbuf = *buf;
1678 if (is_ipv4(TUNNEL_TYPE(c->c1.tuntap), &ipbuf))
1679 {
1680#if PASSTOS_CAPABILITY
1681 /* extract TOS from IP header */
1682 if (flags & PIPV4_PASSTOS)
1683 {
1685 }
1686#endif
1687
1688 /* possibly alter the TCP MSS */
1689 if (flags & PIP_MSSFIX)
1690 {
1691 mss_fixup_ipv4(&ipbuf, c->c2.frame.mss_fix);
1692 }
1693
1694 /* possibly do NAT on packet */
1695 if ((flags & PIPV4_CLIENT_NAT) && c->options.client_nat)
1696 {
1697 const int direction = (flags & PIP_OUTGOING) ? CN_INCOMING : CN_OUTGOING;
1698 client_nat_transform(c->options.client_nat, &ipbuf, direction);
1699 }
1700 /* possibly extract a DHCP router message */
1701 if (flags & PIPV4_EXTRACT_DHCP_ROUTER)
1702 {
1704 if (dhcp_router)
1705 {
1706 route_list_add_vpn_gateway(c->c1.route_list, c->c2.es, dhcp_router);
1707 }
1708 }
1709 }
1710 else if (is_ipv6(TUNNEL_TYPE(c->c1.tuntap), &ipbuf))
1711 {
1712 /* possibly alter the TCP MSS */
1713 if (flags & PIP_MSSFIX)
1714 {
1715 mss_fixup_ipv6(&ipbuf, c->c2.frame.mss_fix);
1716 }
1717 if (!(flags & PIP_OUTGOING) && (flags
1719 {
1721 (bool)(flags & PIPV6_ICMP_NOHOST_CLIENT));
1722 /* Drop the IPv6 packet */
1723 buf->len = 0;
1724 }
1725
1726 }
1727 }
1728}
1729
1730/*
1731 * Input: c->c2.to_link
1732 */
1733
1734void
1736{
1737 struct gc_arena gc = gc_new();
1738 int error_code = 0;
1739
1741
1742 if (c->c2.to_link.len > 0 && c->c2.to_link.len <= c->c2.frame.buf.payload_size)
1743 {
1744 /*
1745 * Setup for call to send/sendto which will send
1746 * packet to remote over the TCP/UDP port.
1747 */
1748 int size = 0;
1750
1751#ifdef ENABLE_DEBUG
1752 /* In gremlin-test mode, we may choose to drop this packet */
1753 if (!c->options.gremlin || ask_gremlin(c->options.gremlin))
1754#endif
1755 {
1756 /*
1757 * Let the traffic shaper know how many bytes
1758 * we wrote.
1759 */
1760 if (c->options.shaper)
1761 {
1762 int overhead = datagram_overhead(c->c2.to_link_addr->dest.addr.sa.sa_family,
1763 sock->info.proto);
1765 BLEN(&c->c2.to_link) + overhead);
1766 }
1767
1768 /*
1769 * Let the pinger know that we sent a packet.
1770 */
1772 {
1774 }
1775
1776#if PASSTOS_CAPABILITY
1777 /* Set TOS */
1778 link_socket_set_tos(sock);
1779#endif
1780
1781 /* Log packet send */
1782#ifdef LOG_RW
1783 if (c->c2.log_rw)
1784 {
1785 fprintf(stderr, "W");
1786 }
1787#endif
1788 msg(D_LINK_RW, "%s WRITE [%d] to %s: %s",
1789 proto2ascii(sock->info.proto, sock->info.af, true),
1790 BLEN(&c->c2.to_link),
1792 PROTO_DUMP(&c->c2.to_link, &gc));
1793
1794 /* Packet send complexified by possible Socks5 usage */
1795 {
1796 struct link_socket_actual *to_addr = c->c2.to_link_addr;
1797 int size_delta = 0;
1798
1799 /* If Socks5 over UDP, prepend header */
1800 socks_preprocess_outgoing_link(c, sock, &to_addr, &size_delta);
1801
1802 /* Send packet */
1803 size = (int)link_socket_write(sock,
1804 &c->c2.to_link,
1805 to_addr);
1806
1807 /* Undo effect of prepend */
1808 link_socket_write_post_size_adjust(&size, size_delta, &c->c2.to_link);
1809 }
1810
1811 if (size > 0)
1812 {
1814 c->c2.link_write_bytes += size;
1816#ifdef ENABLE_MEMSTATS
1817 if (mmap_stats)
1818 {
1819 mmap_stats->link_write_bytes = link_write_bytes_global;
1820 }
1821#endif
1822#ifdef ENABLE_MANAGEMENT
1823 if (management)
1824 {
1827 }
1828#endif
1829 }
1830 }
1831
1832 /* Check return status */
1833 error_code = openvpn_errno();
1834 check_status(size, "write", sock, NULL);
1835
1836 if (size > 0)
1837 {
1838 /* Did we write a different size packet than we intended? */
1839 if (size != BLEN(&c->c2.to_link))
1840 {
1842 "TCP/UDP packet was truncated/expanded on write to %s (tried=%d,actual=%d)",
1844 BLEN(&c->c2.to_link),
1845 size);
1846 }
1847 }
1848
1849 /* if not a ping/control message, indicate activity regarding --inactive parameter */
1850 if (c->c2.buf.len > 0)
1851 {
1852 register_activity(c, size);
1853 }
1854
1855 /* for unreachable network and "connecting" state switch to the next host */
1856
1857 bool unreachable = error_code ==
1858#ifdef _WIN32
1859 WSAENETUNREACH;
1860#else
1861 ENETUNREACH;
1862#endif
1863 if (size < 0 && unreachable && c->c2.tls_multi
1865 {
1866 msg(M_INFO, "Network unreachable, restarting");
1867 register_signal(c->sig, SIGUSR1, "network-unreachable");
1868 }
1869 }
1870 else
1871 {
1872 if (c->c2.to_link.len > 0)
1873 {
1874 msg(D_LINK_ERRORS, "TCP/UDP packet too large on write to %s (tried=%d,max=%d)",
1876 c->c2.to_link.len,
1878 }
1879 }
1880
1881 buf_reset(&c->c2.to_link);
1882
1883 perf_pop();
1884 gc_free(&gc);
1885}
1886
1887/*
1888 * Input: c->c2.to_tun
1889 */
1890
1891void
1892process_outgoing_tun(struct context *c, struct link_socket *in_sock)
1893{
1894 /*
1895 * Set up for write() call to TUN/TAP
1896 * device.
1897 */
1898 if (c->c2.to_tun.len <= 0)
1899 {
1900 return;
1901 }
1902
1904
1905 /*
1906 * The --mssfix option requires
1907 * us to examine the IP header (IPv4 or IPv6).
1908 */
1910 in_sock);
1911
1912 if (c->c2.to_tun.len <= c->c2.frame.buf.payload_size)
1913 {
1914 /*
1915 * Write to TUN/TAP device.
1916 */
1917 int size;
1918
1919#ifdef LOG_RW
1920 if (c->c2.log_rw)
1921 {
1922 fprintf(stderr, "w");
1923 }
1924#endif
1925 dmsg(D_TUN_RW, "TUN WRITE [%d]", BLEN(&c->c2.to_tun));
1926
1927#ifdef PACKET_TRUNCATION_CHECK
1928 ipv4_packet_size_verify(BPTR(&c->c2.to_tun),
1929 BLEN(&c->c2.to_tun),
1930 TUNNEL_TYPE(c->c1.tuntap),
1931 "WRITE_TUN",
1932 &c->c2.n_trunc_tun_write);
1933#endif
1934
1935#ifdef _WIN32
1936 size = tun_write_win32(c->c1.tuntap, &c->c2.to_tun);
1937#else
1939 {
1940 size = write_tun_afunix(c->c1.tuntap, BPTR(&c->c2.to_tun), BLEN(&c->c2.to_tun));
1941 }
1942 else
1943 {
1944 size = write_tun(c->c1.tuntap, BPTR(&c->c2.to_tun), BLEN(&c->c2.to_tun));
1945 }
1946#endif
1947
1948 if (size > 0)
1949 {
1950 c->c2.tun_write_bytes += size;
1951 }
1952 check_status(size, "write to TUN/TAP", NULL, c->c1.tuntap);
1953
1954 /* check written packet size */
1955 if (size > 0)
1956 {
1957 /* Did we write a different size packet than we intended? */
1958 if (size != BLEN(&c->c2.to_tun))
1959 {
1961 "TUN/TAP packet was destructively fragmented on write to %s (tried=%d,actual=%d)",
1962 c->c1.tuntap->actual_name,
1963 BLEN(&c->c2.to_tun),
1964 size);
1965 }
1966
1967 /* indicate activity regarding --inactive parameter */
1968 register_activity(c, size);
1969 }
1970 }
1971 else
1972 {
1973 /*
1974 * This should never happen, probably indicates some kind
1975 * of MTU mismatch.
1976 */
1977 msg(D_LINK_ERRORS, "tun packet too large on write (tried=%d,max=%d)",
1978 c->c2.to_tun.len,
1980 }
1981
1982 buf_reset(&c->c2.to_tun);
1983
1984 perf_pop();
1985}
1986
1987void
1989{
1990 /* make sure current time (now) is updated on function entry */
1991
1992 /*
1993 * Start with an effectively infinite timeout, then let it
1994 * reduce to a timeout that reflects the component which
1995 * needs the earliest service.
1996 */
1997 c->c2.timeval.tv_sec = BIG_TIMEOUT;
1998 c->c2.timeval.tv_usec = 0;
1999
2000#if defined(_WIN32)
2002 {
2003 c->c2.timeval.tv_sec = 1;
2004 if (tuntap_defined(c->c1.tuntap))
2005 {
2007 }
2008 }
2009#endif
2010
2011 /* check coarse timers? */
2013 if (c->sig->signal_received)
2014 {
2015 return;
2016 }
2017
2018 /* If tls is enabled, do tls control channel packet processing. */
2019 if (c->c2.tls_multi)
2020 {
2021 check_tls(c);
2022 }
2023
2024 /* In certain cases, TLS errors will require a restart */
2026 if (c->sig->signal_received)
2027 {
2028 return;
2029 }
2030
2031 /* check for incoming control messages on the control channel like
2032 * push request/reply, or authentication failure and 2FA messages */
2033 if (tls_test_payload_len(c->c2.tls_multi) > 0)
2034 {
2036 }
2037
2038 /* Should we send an OCC message? */
2040
2041#ifdef ENABLE_FRAGMENT
2042 /* Should we deliver a datagram fragment to remote? */
2043 if (c->c2.fragment)
2044 {
2045 check_fragment(c);
2046 }
2047#endif
2048
2049 /* Update random component of timeout */
2051}
2052
2053static void
2055 const unsigned int flags, unsigned int *out_socket,
2056 unsigned int *out_tuntap)
2057{
2058 unsigned int socket = 0;
2059 unsigned int tuntap = 0;
2060 static uintptr_t tun_shift = TUN_SHIFT;
2061 static uintptr_t err_shift = ERR_SHIFT;
2062
2063 /*
2064 * Calculate the flags based on the provided 'flags' argument.
2065 */
2066 if ((c->options.mode != MODE_SERVER) && (flags & IOW_WAIT_SIGNAL))
2067 {
2068 wait_signal(es, (void *)err_shift);
2069 }
2070
2071 if (flags & IOW_TO_LINK)
2072 {
2073 if (flags & IOW_SHAPER)
2074 {
2075 /*
2076 * If sending this packet would put us over our traffic shaping
2077 * quota, don't send -- instead compute the delay we must wait
2078 * until it will be OK to send the packet.
2079 */
2080 int delay = 0;
2081
2082 /* set traffic shaping delay in microseconds */
2083 if (c->options.shaper)
2084 {
2085 delay = max_int(delay, shaper_delay(&c->c2.shaper));
2086 }
2087
2088 if (delay < 1000)
2089 {
2090 socket |= EVENT_WRITE;
2091 }
2092 else
2093 {
2094 shaper_soonest_event(&c->c2.timeval, delay);
2095 }
2096 }
2097 else
2098 {
2099 socket |= EVENT_WRITE;
2100 }
2101 }
2102 else if (!((flags & IOW_FRAG) && TO_LINK_FRAG(c)))
2103 {
2104 if (flags & IOW_READ_TUN)
2105 {
2106 tuntap |= EVENT_READ;
2107 }
2108 }
2109
2110 /*
2111 * If outgoing data (for TUN/TAP device) pending, wait for ready-to-send status
2112 * from device. Otherwise, wait for incoming data on TCP/UDP port.
2113 */
2114 if (flags & IOW_TO_TUN)
2115 {
2117 }
2118 else
2119 {
2120 if (flags & IOW_READ_LINK)
2121 {
2122 socket |= EVENT_READ;
2123 }
2124 }
2125
2126 /*
2127 * outgoing bcast buffer waiting to be sent?
2128 */
2129 if (flags & IOW_MBUF)
2130 {
2131 socket |= EVENT_WRITE;
2132 }
2133
2134 /*
2135 * Force wait on TUN input, even if also waiting on TCP/UDP output
2136 */
2137 if (flags & IOW_READ_TUN_FORCE)
2138 {
2139 tuntap |= EVENT_READ;
2140 }
2141
2142 /*
2143 * Configure event wait based on socket, tuntap flags.
2144 */
2145 for (int i = 0; i < c->c1.link_sockets_num; i++)
2146 {
2147 socket_set(c->c2.link_sockets[i], es, socket,
2148 &c->c2.link_sockets[i]->ev_arg, NULL);
2149 }
2150
2151 tun_set(c->c1.tuntap, es, tuntap, (void *)tun_shift, NULL);
2152
2153 if (out_socket)
2154 {
2155 *out_socket = socket;
2156 }
2157
2158 if (out_tuntap)
2159 {
2160 *out_tuntap = tuntap;
2161 }
2162
2163}
2164
2165/*
2166 * Wait for I/O events. Used for both TCP & UDP sockets
2167 * in point-to-point mode and for UDP sockets in
2168 * point-to-multipoint mode.
2169 */
2170
2171void
2172get_io_flags_dowork_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
2173{
2174 unsigned int out_socket, out_tuntap;
2175
2176 multi_io_process_flags(c, multi_io->es, flags, &out_socket, &out_tuntap);
2177 multi_io->udp_flags = out_socket | out_tuntap;
2178}
2179
2180void
2181get_io_flags_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
2182{
2184 if (c->c2.fast_io && (flags & (IOW_TO_TUN | IOW_TO_LINK | IOW_MBUF)))
2185 {
2186 /* fast path -- only for TUN/TAP/UDP writes */
2187 unsigned int ret = 0;
2188 if (flags & IOW_TO_TUN)
2189 {
2190 ret |= TUN_WRITE;
2191 }
2192 if (flags & (IOW_TO_LINK | IOW_MBUF))
2193 {
2194 ret |= SOCKET_WRITE;
2195 }
2196 multi_io->udp_flags = ret;
2197 }
2198 else
2199 {
2200 /* slow path - delegate to io_wait_dowork_udp to calculate flags */
2202 }
2203}
2204
2205void
2206io_wait_dowork(struct context *c, const unsigned int flags)
2207{
2208 unsigned int out_socket;
2209 unsigned int out_tuntap;
2210 struct event_set_return esr[4];
2211
2212 /* These shifts all depend on EVENT_READ and EVENT_WRITE */
2213 static uintptr_t socket_shift = SOCKET_SHIFT; /* depends on SOCKET_READ and SOCKET_WRITE */
2214#ifdef ENABLE_MANAGEMENT
2215 static uintptr_t management_shift = MANAGEMENT_SHIFT; /* depends on MANAGEMENT_READ and MANAGEMENT_WRITE */
2216#endif
2217#ifdef ENABLE_ASYNC_PUSH
2218 static uintptr_t file_shift = FILE_SHIFT;
2219#endif
2220#if defined(TARGET_LINUX) || defined(TARGET_FREEBSD)
2221 static uintptr_t dco_shift = DCO_SHIFT; /* Event from DCO linux kernel module */
2222#endif
2223
2224 /*
2225 * Decide what kind of events we want to wait for.
2226 */
2228
2229 multi_io_process_flags(c, c->c2.event_set, flags, &out_socket, &out_tuntap);
2230
2231#if defined(TARGET_LINUX) || defined(TARGET_FREEBSD)
2232 if (out_socket & EVENT_READ && c->c2.did_open_tun)
2233 {
2234 dco_event_set(&c->c1.tuntap->dco, c->c2.event_set, (void *)dco_shift);
2235 }
2236#endif
2237
2238#ifdef ENABLE_MANAGEMENT
2239 if (management)
2240 {
2241 management_socket_set(management, c->c2.event_set, (void *)management_shift, NULL);
2242 }
2243#endif
2244
2245#ifdef ENABLE_ASYNC_PUSH
2246 /* arm inotify watcher */
2247 if (c->options.mode == MODE_SERVER)
2248 {
2249 event_ctl(c->c2.event_set, c->c2.inotify_fd, EVENT_READ, (void *)file_shift);
2250 }
2251#endif
2252
2253 /*
2254 * Possible scenarios:
2255 * (1) tcp/udp port has data available to read
2256 * (2) tcp/udp port is ready to accept more data to write
2257 * (3) tun dev has data available to read
2258 * (4) tun dev is ready to accept more data to write
2259 * (5) we received a signal (handler sets signal_received)
2260 * (6) timeout (tv) expired
2261 */
2262
2264
2265 if (!c->sig->signal_received)
2266 {
2267 if (!(flags & IOW_CHECK_RESIDUAL) || !sockets_read_residual(c))
2268 {
2269 int status;
2270
2271#ifdef ENABLE_DEBUG
2273 {
2274 show_wait_status(c);
2275 }
2276#endif
2277
2278 /*
2279 * Wait for something to happen.
2280 */
2281 status = event_wait(c->c2.event_set, &c->c2.timeval, esr, SIZE(esr));
2282
2283 check_status(status, "event_wait", NULL, NULL);
2284
2285 if (status > 0)
2286 {
2287 int i;
2288 c->c2.event_set_status = 0;
2289 for (i = 0; i < status; ++i)
2290 {
2291 const struct event_set_return *e = &esr[i];
2292 uintptr_t shift;
2293
2294 if (e->arg >= MULTI_N)
2295 {
2296 struct event_arg *ev_arg = (struct event_arg *)e->arg;
2297 if (ev_arg->type != EVENT_ARG_LINK_SOCKET)
2298 {
2301 "io_work: non socket event delivered");
2302 return;
2303 }
2304
2305 shift = socket_shift;
2306 }
2307 else
2308 {
2309 shift = (uintptr_t)e->arg;
2310 }
2311
2312 c->c2.event_set_status |= ((e->rwflags & 3) << shift);
2313 }
2314 }
2315 else if (status == 0)
2316 {
2318 }
2319 }
2320 else
2321 {
2323 }
2324 }
2325
2326 /* 'now' should always be a reasonably up-to-date timestamp */
2327 update_time();
2328
2329 /* set signal_received if a signal was received */
2330 if (c->c2.event_set_status & ES_ERROR)
2331 {
2333 }
2334
2335 dmsg(D_EVENT_WAIT, "I/O WAIT status=0x%04x", c->c2.event_set_status);
2336}
2337
2338void
2340{
2341 const unsigned int status = c->c2.event_set_status;
2342
2343#ifdef ENABLE_MANAGEMENT
2345 {
2348 }
2349#endif
2350
2351 /* TCP/UDP port ready to accept write */
2352 if (status & SOCKET_WRITE)
2353 {
2355 }
2356 /* TUN device ready to accept write */
2357 else if (status & TUN_WRITE)
2358 {
2360 }
2361 /* Incoming data on TCP/UDP port */
2362 else if (status & SOCKET_READ)
2363 {
2365 if (!IS_SIG(c))
2366 {
2368 }
2369 }
2370 /* Incoming data on TUN device */
2371 else if (status & TUN_READ)
2372 {
2374 if (!IS_SIG(c))
2375 {
2377 }
2378 }
2379 else if (status & DCO_READ)
2380 {
2381 if (!IS_SIG(c))
2382 {
2384 }
2385 }
2386}
void check_send_auth_token(struct context *c)
Checks if the timer to resend the auth-token has expired and if a new auth-token should be send to th...
Definition auth_token.c:422
bool buf_printf(struct buffer *buf, const char *format,...)
Definition buffer.c:240
bool buf_assign(struct buffer *dest, const struct buffer *src)
Definition buffer.c:173
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:88
bool buf_string_match_head_str(const struct buffer *src, const char *match)
Definition buffer.c:778
#define BSTR(buf)
Definition buffer.h:129
#define BPTR(buf)
Definition buffer.h:124
static bool buf_write_prepend(struct buffer *dest, const void *src, int size)
Definition buffer.h:680
static bool buf_copy_n(struct buffer *dest, struct buffer *src, int n)
Definition buffer.h:718
static void buf_reset(struct buffer *buf)
Definition buffer.h:303
static bool buf_safe(const struct buffer *buf, size_t len)
Definition buffer.h:520
static bool buf_advance(struct buffer *buf, int size)
Definition buffer.h:618
#define BLEN(buf)
Definition buffer.h:127
static void gc_free(struct gc_arena *a)
Definition buffer.h:1033
#define buf_init(buf, offset)
Definition buffer.h:209
static struct gc_arena gc_new(void)
Definition buffer.h:1025
void client_nat_transform(const struct client_nat_option_list *list, struct buffer *ipbuf, const int direction)
Definition clinat.c:193
#define CN_INCOMING
Definition clinat.h:32
#define CN_OUTGOING
Definition clinat.h:31
uint64_t counter_type
Definition common.h:30
int interval_t
Definition common.h:36
#define PUSH_REQUEST_INTERVAL
Definition common.h:93
#define BIG_TIMEOUT
Definition common.h:41
long int get_random(void)
Definition crypto.c:1757
static int dco_do_read(dco_context_t *dco)
Definition dco.h:317
static void dco_event_set(dco_context_t *dco, struct event_set *es, void *arg)
Definition dco.h:324
static bool dco_update_keys(dco_context_t *dco, struct tls_multi *multi)
Definition dco.h:337
void * dco_context_t
Definition dco.h:267
static int dco_get_peer_stats(struct context *c, const bool raise_sigusr1_on_err)
Definition dco.h:386
in_addr_t dhcp_extract_router_msg(struct buffer *ipbuf)
Definition dhcp.c:149
#define D_TUN_RW
Definition errlevel.h:114
#define D_TAP_WIN_DEBUG
Definition errlevel.h:115
#define D_PING
Definition errlevel.h:144
#define D_EVENT_WAIT
Definition errlevel.h:162
#define D_INTERVAL
Definition errlevel.h:158
#define D_STREAM_ERRORS
Definition errlevel.h:63
#define D_DCO_DEBUG
Definition errlevel.h:118
#define D_PUSH_ERRORS
Definition errlevel.h:67
#define D_LOW
Definition errlevel.h:97
#define M_INFO
Definition errlevel.h:55
#define D_SCHED_EXIT
Definition errlevel.h:89
#define D_ROUTE
Definition errlevel.h:80
#define D_LINK_ERRORS
Definition errlevel.h:57
#define D_LINK_RW
Definition errlevel.h:113
#define DCO_READ
Definition event.h:76
#define MANAGEMENT_SHIFT
Definition event.h:70
#define SOCKET_SHIFT
Definition event.h:61
#define TUN_WRITE
Definition event.h:66
#define SOCKET_READ
Definition event.h:62
#define MANAGEMENT_READ
Definition event.h:71
#define MANAGEMENT_WRITE
Definition event.h:72
static int event_wait(struct event_set *es, const struct timeval *tv, struct event_set_return *out, int outlen)
Definition event.h:187
#define ES_ERROR
Definition event.h:68
#define SOCKET_WRITE
Definition event.h:63
#define ES_TIMEOUT
Definition event.h:69
#define EVENT_WRITE
Definition event.h:40
#define MULTI_N
Definition event.h:89
#define TUN_SHIFT
Definition event.h:64
#define EVENT_READ
Definition event.h:39
#define FILE_SHIFT
Definition event.h:73
#define TUN_READ
Definition event.h:65
static void event_reset(struct event_set *es)
Definition event.h:169
static void wait_signal(struct event_set *es, void *arg)
Definition event.h:206
#define DCO_SHIFT
Definition event.h:75
#define ERR_SHIFT
Definition event.h:67
@ EVENT_ARG_LINK_SOCKET
Definition event.h:137
static void event_ctl(struct event_set *es, event_t event, unsigned int rwflags, void *arg)
Definition event.h:181
counter_type link_write_bytes_global
Definition forward.c:51
static void check_inactivity_timeout(struct context *c)
Definition forward.c:489
void reschedule_multi_process(struct context *c)
Reschedule tls_multi_process.
Definition forward.c:403
int get_server_poll_remaining_time(struct event_timeout *server_poll_timeout)
Definition forward.c:509
static void check_fragment(struct context *c)
Definition forward.c:577
static void check_tls_errors(struct context *c)
Definition forward.c:103
static void check_scheduled_exit(struct context *c)
Definition forward.c:554
#define MAX_ICMPV6LEN
static void check_session_timeout(struct context *c)
Definition forward.c:712
bool send_control_channel_string_dowork(struct tls_session *session, const char *str, int msglevel)
Definition forward.c:381
void process_io(struct context *c, struct link_socket *sock)
Definition forward.c:2339
static void context_reschedule_sec(struct context *c, int sec)
Definition forward.c:136
static void check_timeout_random_component(struct context *c)
Definition forward.c:874
bool schedule_exit(struct context *c)
Definition forward.c:533
static void process_coarse_timers(struct context *c)
Definition forward.c:727
static void check_connection_established(struct context *c)
Definition forward.c:339
static void check_timeout_random_component_dowork(struct context *c)
Definition forward.c:863
bool send_control_channel_string(struct context *c, const char *str, int msglevel)
Definition forward.c:410
static void buffer_turnover(const uint8_t *orig_buf, struct buffer *dest_stub, struct buffer *src_stub, struct buffer *storage)
Definition forward.c:606
static void check_tls_errors_nco(struct context *c)
Definition forward.c:93
void ipv6_send_icmp_unreachable(struct context *c, struct buffer *buf, bool client)
Forges a IPv6 ICMP packet with a no route to host error code from the IPv6 packet in buf and sends it...
Definition forward.c:1523
void get_io_flags_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
Definition forward.c:2181
static void multi_io_process_flags(struct context *c, struct event_set *es, const unsigned int flags, unsigned int *out_socket, unsigned int *out_tuntap)
Definition forward.c:2054
void pre_select(struct context *c)
Definition forward.c:1988
static void check_incoming_control_channel(struct context *c)
Definition forward.c:289
static void check_add_routes(struct context *c)
Definition forward.c:442
static void check_server_poll_timeout(struct context *c)
Definition forward.c:517
static void parse_incoming_control_channel_command(struct context *c, struct buffer *buf)
Definition forward.c:240
static void socks_postprocess_incoming_link(struct context *c, struct link_socket *sock)
Definition forward.c:892
static void check_push_request(struct context *c)
Definition forward.c:321
static void process_incoming_link(struct context *c, struct link_socket *sock)
Definition forward.c:1233
static void check_tls_errors_co(struct context *c)
Definition forward.c:86
static void socks_preprocess_outgoing_link(struct context *c, struct link_socket *sock, struct link_socket_actual **to_addr, int *size_delta)
Definition forward.c:901
static void link_socket_write_post_size_adjust(int *size, int size_delta, struct buffer *buf)
Definition forward.c:915
void get_io_flags_dowork_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags)
Definition forward.c:2172
static void context_immediate_reschedule(struct context *c)
Definition forward.c:129
static void check_add_routes_action(struct context *c, const bool errors)
Definition forward.c:427
static void drop_if_recursive_routing(struct context *c, struct buffer *buf)
Drops UDP packets which OS decided to route via tun.
Definition forward.c:1377
counter_type link_read_bytes_global
Definition forward.c:50
static void check_coarse_timers(struct context *c)
Definition forward.c:839
void check_dco_key_status(struct context *c)
Definition forward.c:150
void io_wait_dowork(struct context *c, const unsigned int flags)
Definition forward.c:2206
static void process_incoming_dco(struct context *c)
Definition forward.c:1247
void process_ip_header(struct context *c, unsigned int flags, struct buffer *buf, struct link_socket *sock)
Definition forward.c:1649
static void check_tls(struct context *c)
Definition forward.c:183
static void check_status_file(struct context *c)
Definition forward.c:563
Interface functions to the internal and external multiplexers.
#define PIP_MSSFIX
Definition forward.h:307
#define PIPV4_CLIENT_NAT
Definition forward.h:310
#define IOW_WAIT_SIGNAL
Definition forward.h:64
#define IOW_READ_TUN
Definition forward.h:57
#define PIPV4_EXTRACT_DHCP_ROUTER
Definition forward.h:309
#define PIPV6_ICMP_NOHOST_SERVER
Definition forward.h:312
#define PIPV6_ICMP_NOHOST_CLIENT
Definition forward.h:311
#define IOW_SHAPER
Definition forward.h:59
#define IOW_FRAG
Definition forward.h:61
#define IOW_MBUF
Definition forward.h:62
static struct link_socket_info * get_link_socket_info(struct context *c)
Definition forward.h:321
#define IOW_READ_LINK
Definition forward.h:58
#define IOW_CHECK_RESIDUAL
Definition forward.h:60
#define TO_LINK_FRAG(c)
Definition forward.h:43
static bool connection_established(struct context *c)
Definition forward.h:396
static void register_activity(struct context *c, const int size)
Definition forward.h:334
#define IOW_TO_TUN
Definition forward.h:55
#define PIPV4_PASSTOS
Definition forward.h:306
#define IOW_READ_TUN_FORCE
Definition forward.h:63
#define PIP_OUTGOING
Definition forward.h:308
#define IOW_TO_LINK
Definition forward.h:56
#define KS_PRIMARY
Primary key state index.
Definition ssl_common.h:459
#define TM_ACTIVE
Active tls_session.
Definition ssl_common.h:538
void encrypt_sign(struct context *c, bool comp_frag)
Process a data channel packet that will be sent through a VPN tunnel.
Definition forward.c:625
void tls_post_encrypt(struct tls_multi *multi, struct buffer *buf)
Perform some accounting for the key state used.
Definition ssl.c:4153
void openvpn_encrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt)
Encrypt and HMAC sign a packet so that it can be sent as a data channel VPN tunnel packet to a remote...
Definition crypto.c:336
void tls_prepend_opcode_v1(const struct tls_multi *multi, struct buffer *buf)
Prepend a one-byte OpenVPN data channel P_DATA_V1 opcode to the packet.
Definition ssl.c:4124
void tls_pre_encrypt(struct tls_multi *multi, struct buffer *buf, struct crypto_options **opt)
Choose the appropriate security parameters with which to process an outgoing packet.
Definition ssl.c:4091
void tls_prepend_opcode_v2(const struct tls_multi *multi, struct buffer *buf)
Prepend an OpenVPN data channel P_DATA_V2 header to the packet.
Definition ssl.c:4138
bool openvpn_decrypt(struct buffer *buf, struct buffer work, struct crypto_options *opt, const struct frame *frame, const uint8_t *ad_start)
HMAC verify and decrypt a data channel packet received from a remote OpenVPN peer.
Definition crypto.c:794
bool process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, bool floated)
Starts processing a packet read from the external network interface.
Definition forward.c:1000
void process_incoming_link_part2(struct context *c, struct link_socket_info *lsi, const uint8_t *orig_buf)
Continues processing a packet read from the external network interface.
Definition forward.c:1150
void process_outgoing_link(struct context *c, struct link_socket *sock)
Write a packet to the external network interface.
Definition forward.c:1735
void read_incoming_link(struct context *c, struct link_socket *sock)
Read a packet from the external network interface.
Definition forward.c:934
bool tls_pre_decrypt(struct tls_multi *multi, const struct link_socket_actual *from, struct buffer *buf, struct crypto_options **opt, bool floated, const uint8_t **ad_start)
Determine whether an incoming packet is a data channel or control channel packet, and process accordi...
Definition ssl.c:3684
static void fragment_housekeeping(struct fragment_master *f, struct frame *frame, struct timeval *tv)
Perform housekeeping of a fragment_master structure.
Definition fragment.h:455
static bool fragment_outgoing_defined(struct fragment_master *f)
Check whether a fragment_master structure contains fragments ready to be sent.
Definition fragment.h:427
void fragment_outgoing(struct fragment_master *f, struct buffer *buf, const struct frame *frame)
Process an outgoing packet, which may or may not need to be fragmented.
Definition fragment.c:321
void fragment_incoming(struct fragment_master *f, struct buffer *buf, const struct frame *frame)
Process an incoming packet, which may or may not be fragmented.
Definition fragment.c:136
bool fragment_ready_to_send(struct fragment_master *f, struct buffer *buf, const struct frame *frame)
Check whether outgoing fragments are ready to be send, and if so make one available.
Definition fragment.c:376
void read_incoming_tun(struct context *c)
Read a packet from the virtual tun/tap network interface.
Definition forward.c:1305
void process_incoming_tun(struct context *c, struct link_socket *out_sock)
Process a packet read from the virtual tun/tap network interface.
Definition forward.c:1455
void process_outgoing_tun(struct context *c, struct link_socket *in_sock)
Write a packet to the virtual tun/tap network interface.
Definition forward.c:1892
void initialization_sequence_completed(struct context *c, const unsigned int flags)
Definition init.c:1591
void reset_coarse_timers(struct context *c)
Definition init.c:1343
bool do_up(struct context *c, bool pulled_options, unsigned int option_types_found)
Definition init.c:2464
bool do_route(const struct options *options, struct route_list *route_list, struct route_ipv6_list *route_ipv6_list, const struct tuntap *tt, const struct plugin_list *plugins, struct env_set *es, openvpn_net_ctx_t *ctx)
Definition init.c:1718
#define ISC_ERRORS
Definition init.h:115
#define ISC_ROUTE_ERRORS
Definition init.h:117
static int min_int(int x, int y)
Definition integer.h:102
static int max_int(int x, int y)
Definition integer.h:89
static SERVICE_STATUS status
Definition interactive.c:52
bool event_timeout_trigger(struct event_timeout *et, struct timeval *tv, const int et_const_retry)
This is the principal function for testing and triggering recurring timers.
Definition interval.c:43
#define ETT_DEFAULT
Definition interval.h:224
static void interval_future_trigger(struct interval *top, interval_t wakeup)
Definition interval.h:108
static void event_timeout_reset(struct event_timeout *et)
Resets a timer.
Definition interval.h:189
static void interval_action(struct interval *top)
Definition interval.h:124
static bool event_timeout_defined(const struct event_timeout *et)
Definition interval.h:144
static void event_timeout_init(struct event_timeout *et, interval_t n, const time_t last)
Initialises a timer struct.
Definition interval.h:174
static void event_timeout_clear(struct event_timeout *et)
Clears the timeout and reset all values to 0.
Definition interval.h:155
static void interval_schedule_wakeup(struct interval *top, interval_t *wakeup)
Definition interval.h:94
static void event_timeout_modify_wakeup(struct event_timeout *et, interval_t n)
Sets the interval n of a timeout.
Definition interval.h:206
static bool interval_test(struct interval *top)
Definition interval.h:66
static interval_t event_timeout_remaining(struct event_timeout *et)
Returns the time until the timeout should triggered, from now.
Definition interval.h:219
void management_check_bytecount(struct context *c, struct management *man, struct timeval *timeval)
Definition manage.c:4145
void management_socket_set(struct management *man, struct event_set *es, void *arg, unsigned int *persistent)
Definition manage.c:3128
void management_set_state(struct management *man, const int state, const char *detail, const in_addr_t *tun_local_ip, const struct in6_addr *tun_local_ip6, const struct openvpn_sockaddr *local, const struct openvpn_sockaddr *remote)
Definition manage.c:2750
void management_io(struct management *man)
Definition manage.c:3168
void management_sleep(const int n)
A sleep function that services the management layer for n seconds rather than doing nothing.
Definition manage.c:4121
static void management_bytes_server(struct management *man, const counter_type *bytes_in_total, const counter_type *bytes_out_total, struct man_def_auth_context *mdac)
Definition manage.h:539
static void management_bytes_client(struct management *man, const int size_in, const int size_out)
Definition manage.h:522
#define OPENVPN_STATE_GET_CONFIG
Definition manage.h:480
const char * sanitize_control_message(const char *src, struct gc_arena *gc)
Definition misc.c:670
void mss_fixup_ipv6(struct buffer *buf, uint16_t maxmss)
Definition mss.c:87
void mss_fixup_ipv4(struct buffer *buf, uint16_t maxmss)
Definition mss.c:47
void frame_adjust_path_mtu(struct context *c)
Checks and adjusts the fragment and mssfix value according to the discovered path mtu value.
Definition mss.c:355
void process_received_occ_msg(struct context *c)
Definition occ.c:363
static void check_send_occ_msg(struct context *c)
Definition occ.h:140
static bool is_occ_msg(const struct buffer *buf)
Definition occ.h:83
static void check_send_occ_req(struct context *c)
Definition occ.h:110
static void check_send_occ_load_test(struct context *c)
Definition occ.h:125
#define CLEAR(x)
Definition basic.h:33
#define SIZE(x)
Definition basic.h:30
#define M_NOPREFIX
Definition error.h:97
static bool check_debug_level(unsigned int level)
Definition error.h:220
#define dmsg(flags,...)
Definition error.h:148
#define openvpn_errno()
Definition error.h:72
#define msg(flags,...)
Definition error.h:144
#define ASSERT(x)
Definition error.h:195
#define M_WARN
Definition error.h:91
static void check_status(int status, const char *description, struct link_socket *sock, struct tuntap *tt)
Definition error.h:277
#define TLS_MODE(c)
Definition openvpn.h:538
#define PROTO_DUMP(buf, gc)
Definition openvpn.h:540
#define MODE_POINT_TO_POINT
Definition options.h:259
#define MODE_SERVER
Definition options.h:260
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition options.h:929
time_t now
Definition otime.c:34
const char * tv_string(const struct timeval *tv, struct gc_arena *gc)
Definition otime.c:84
static void update_time(void)
Definition otime.h:77
static void tv_add(struct timeval *dest, const struct timeval *src)
Definition otime.h:132
@ OVPN_DEL_PEER_REASON_EXPIRED
@ OVPN_CMD_SWAP_KEYS
@ OVPN_CMD_DEL_PEER
void packet_id_persist_save(struct packet_id_persist *p)
Definition packet_id.c:519
static bool packet_id_persist_enabled(const struct packet_id_persist *p)
Definition packet_id.h:282
static void perf_push(int type)
Definition perf.h:78
#define PERF_PROC_OUT_TUN
Definition perf.h:56
#define PERF_PROC_OUT_LINK
Definition perf.h:55
#define PERF_PROC_IN_TUN
Definition perf.h:54
#define PERF_PROC_IN_LINK
Definition perf.h:52
static void perf_pop(void)
Definition perf.h:82
#define PERF_READ_IN_TUN
Definition perf.h:53
#define PERF_READ_IN_LINK
Definition perf.h:51
void trigger_ping_timeout_signal(struct context *c)
Trigger the correct signal on a –ping timeout depending if –ping-exit is set (SIGTERM) or not (SIGUSR...
Definition ping.c:48
static void check_ping_restart(struct context *c)
Definition ping.h:60
static bool is_ping_msg(const struct buffer *buf)
Definition ping.h:41
static void check_ping_send(struct context *c)
Definition ping.h:77
bool is_ipv4(int tunnel_type, struct buffer *buf)
Definition proto.c:111
bool is_ipv6(int tunnel_type, struct buffer *buf)
Definition proto.c:116
uint16_t ip_checksum(const sa_family_t af, const uint8_t *payload, const int len_payload, const uint8_t *src_addr, const uint8_t *dest_addr, const int proto)
Calculates an IP or IPv6 checksum with a pseudo header as required by TCP, UDP and ICMPv6.
Definition proto.c:123
static int get_tun_ip_ver(int tunnel_type, struct buffer *buf, int *ip_hdr_offset)
Definition proto.h:241
#define DEV_TYPE_TAP
Definition proto.h:37
#define OPENVPN_ETH_ALEN
Definition proto.h:53
#define OPENVPN_ETH_P_IPV6
Definition proto.h:60
#define OPENVPN_IPPROTO_ICMPV6
Definition proto.h:109
#define OPENVPN_IN6_ARE_ADDR_EQUAL(a, b)
Version of IN6_ARE_ADDR_EQUAL that is guaranteed to work for unaligned access.
Definition proto.h:89
#define OPENVPN_ICMP6_DESTINATION_UNREACHABLE
Definition proto.h:136
#define OPENVPN_ICMP6_DU_NOROUTE
Definition proto.h:144
void receive_auth_pending(struct context *c, const struct buffer *buffer)
Parses an AUTH_PENDING message and if in pull mode extends the timeout.
Definition push.c:341
void receive_auth_failed(struct context *c, const struct buffer *buffer)
Definition push.c:51
void server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
Definition push.c:133
void receive_cr_response(struct context *c, const struct buffer *buffer)
Definition push.c:266
void send_auth_failed(struct context *c, const char *client_reason)
Definition push.c:397
void receive_exit_message(struct context *c)
Definition push.c:193
bool send_push_request(struct context *c)
Definition push.c:552
void incoming_push_message(struct context *c, const struct buffer *buffer)
Definition push.c:507
void server_pushed_info(const struct buffer *buffer, const int adv)
Definition push.c:229
bool test_routes(const struct route_list *rl, const struct tuntap *tt)
Definition route.c:2656
void show_routes(int msglev)
Definition route.c:3317
void route_list_add_vpn_gateway(struct route_list *rl, struct env_set *es, const in_addr_t addr)
Definition route.c:565
bool shaper_soonest_event(struct timeval *tv, int delay)
Definition shaper.c:37
static void shaper_wrote_bytes(struct shaper *s, int nbytes)
Definition shaper.h:122
static int shaper_delay(struct shaper *s)
Definition shaper.h:97
void print_status(struct context *c, struct status_output *so)
Definition sig.c:484
void process_explicit_exit_notification_timer_wakeup(struct context *c)
Definition sig.c:567
void register_signal(struct signal_info *si, int signum, const char *signal_text)
Register a soft signal in the signal_info struct si respecting priority.
Definition sig.c:231
#define IS_SIG(c)
Definition sig.h:48
static void get_signal(volatile int *sig)
Copy the global signal_received (if non-zero) to the passed-in argument sig.
Definition sig.h:110
const char * proto2ascii(int proto, sa_family_t af, bool display_form)
Definition socket.c:3225
const char * socket_stat(const struct link_socket *s, unsigned int rwflags, struct gc_arena *gc)
Definition socket.c:2628
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
Definition socket.c:2926
int sockethandle_finalize(sockethandle_t sh, struct overlapped_io *io, struct buffer *buf, struct link_socket_actual *from)
Definition socket.c:3934
unsigned int socket_set(struct link_socket *s, struct event_set *es, unsigned int rwflags, void *arg, unsigned int *persistent)
Definition socket.c:4029
void link_socket_bad_incoming_addr(struct buffer *buf, const struct link_socket_info *info, const struct link_socket_actual *from_addr)
Definition socket.c:2525
bool sockets_read_residual(const struct context *c)
Definition socket.c:46
static bool link_socket_actual_defined(const struct link_socket_actual *act)
Definition socket.h:726
static int datagram_overhead(sa_family_t af, int proto)
Definition socket.h:629
static ssize_t link_socket_write(struct link_socket *sock, struct buffer *buf, struct link_socket_actual *to)
Definition socket.h:1196
static bool link_socket_connection_oriented(const struct link_socket *sock)
Definition socket.h:648
@ PROTO_UDP
Definition socket.h:568
static bool socket_connection_reset(const struct link_socket *sock, int status)
Definition socket.h:912
static bool link_socket_verify_incoming_addr(struct buffer *buf, const struct link_socket_info *info, const struct link_socket_actual *from_addr)
Definition socket.h:935
static void link_socket_set_outgoing_addr(struct link_socket_info *info, const struct link_socket_actual *act, const char *common_name, struct env_set *es)
Definition socket.h:984
static int link_socket_read(struct link_socket *sock, struct buffer *buf, struct link_socket_actual *from)
Definition socket.h:1066
static void link_socket_get_outgoing_addr(struct buffer *buf, const struct link_socket_info *info, struct link_socket_actual **act)
Definition socket.h:963
int socks_process_outgoing_udp(struct buffer *buf, const struct link_socket_actual *to)
Definition socks.c:603
void socks_process_incoming_udp(struct buffer *buf, struct link_socket_actual *from)
Definition socks.c:564
bool tls_send_payload(struct key_state *ks, const uint8_t *data, int size)
Definition ssl.c:4173
bool tls_rec_payload(struct tls_multi *multi, struct buffer *buf)
Definition ssl.c:4207
void tls_session_soft_reset(struct tls_multi *tls_multi)
Definition ssl.c:1846
int tls_multi_process(struct tls_multi *multi, struct buffer *to_link, struct link_socket_actual **to_link_addr, struct link_socket_info *to_link_socket_info, interval_t *wakeup)
Definition ssl.c:3311
#define TLSMP_RECONNECT
Definition ssl.h:231
#define TLSMP_ACTIVE
Definition ssl.h:229
static bool tls_initial_packet_received(const struct tls_multi *multi)
Definition ssl.h:504
static void tls_set_single_session(struct tls_multi *multi)
Definition ssl.h:524
#define TLSMP_KILL
Definition ssl.h:230
static int tls_test_payload_len(const struct tls_multi *multi)
Definition ssl.h:510
@ CAS_CONNECT_DONE
Definition ssl_common.h:586
struct buffer extract_command_buffer(struct buffer *buf, struct gc_arena *gc)
Extracts a control channel message from buf and adjusts the size of buf after the message has been ex...
Definition ssl_pkt.c:563
#define P_DATA_V1
Definition ssl_pkt.h:48
#define P_OPCODE_SHIFT
Definition ssl_pkt.h:40
Control Channel Verification Module.
Wrapper structure for dynamically allocated memory.
Definition buffer.h:61
uint8_t * data
Pointer to the allocated memory.
Definition buffer.h:68
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:66
int mssfix
Definition options.h:142
int connect_timeout
Definition options.h:119
struct status_output * status_output
Definition openvpn.h:186
struct route_list * route_list
List of routing information.
Definition openvpn.h:178
int link_sockets_num
Definition openvpn.h:159
struct route_ipv6_list * route_ipv6_list
Definition openvpn.h:183
struct packet_id_persist pid_persist
Definition openvpn.h:171
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition openvpn.h:173
counter_type link_read_bytes
Definition openvpn.h:268
counter_type link_write_bytes
Definition openvpn.h:271
struct event_timeout server_poll_interval
Definition openvpn.h:410
int max_recv_size_local
Definition openvpn.h:310
struct fragment_master * fragment
Definition openvpn.h:254
time_t update_timeout_random_component
Definition openvpn.h:405
unsigned int event_set_status
Definition openvpn.h:237
struct event_timeout route_wakeup_expire
Definition openvpn.h:386
struct event_timeout ping_send_interval
Definition openvpn.h:285
int max_send_size_local
Definition openvpn.h:312
bool did_open_tun
Definition openvpn.h:389
struct timeval timeout_random_component
Definition openvpn.h:406
counter_type tun_read_bytes
Definition openvpn.h:266
struct man_def_auth_context mda_context
Definition openvpn.h:455
struct event_timeout scheduled_exit
Definition openvpn.h:449
struct env_set * es
Definition openvpn.h:422
struct interval tmp_int
Definition openvpn.h:346
struct event_timeout auth_token_renewal_interval
Definition openvpn.h:295
struct event_timeout wait_for_connect
Definition openvpn.h:284
struct shaper shaper
Definition openvpn.h:261
struct event_timeout push_request_interval
Definition openvpn.h:441
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition openvpn.h:325
time_t coarse_timer_wakeup
Definition openvpn.h:401
int scheduled_exit_signal
Definition openvpn.h:450
struct frame frame
Definition openvpn.h:250
struct link_socket_actual from
Definition openvpn.h:247
struct frame frame_fragment
Definition openvpn.h:255
struct buffer to_link
Definition openvpn.h:379
int64_t inactivity_bytes
Definition openvpn.h:290
struct crypto_options crypto_options
Security parameters and crypto state used by the Data Channel Crypto module to process data channel p...
Definition openvpn.h:351
struct buffer to_tun
Definition openvpn.h:378
counter_type tun_write_bytes
Definition openvpn.h:267
struct link_socket ** link_sockets
Definition openvpn.h:239
counter_type link_read_bytes_auth
Definition openvpn.h:270
struct event_timeout packet_id_persist_interval
Definition openvpn.h:357
struct link_socket_actual * to_link_addr
Definition openvpn.h:246
struct event_timeout session_interval
Definition openvpn.h:292
int original_recv_size
Definition openvpn.h:309
struct buffer buf
Definition openvpn.h:377
struct timeval timeval
Time to next event of timers and similar.
Definition openvpn.h:398
time_t explicit_exit_notification_time_wait
Definition openvpn.h:418
bool log_rw
Definition openvpn.h:382
bool fast_io
Definition openvpn.h:426
struct event_set * event_set
Definition openvpn.h:232
struct context_buffers * buffers
Definition openvpn.h:369
struct event_timeout route_wakeup
Definition openvpn.h:385
int tls_exit_signal
Definition openvpn.h:349
struct event_timeout inactivity_interval
Definition openvpn.h:289
struct event_timeout ping_rec_interval
Definition openvpn.h:286
struct buffer read_link_buf
Definition openvpn.h:114
struct buffer encrypt_buf
Definition openvpn.h:101
struct buffer read_tun_buf
Definition openvpn.h:115
struct buffer decrypt_buf
Definition openvpn.h:102
int restart_sleep_seconds
Definition openvpn.h:123
Contains all state information for one tunnel.
Definition openvpn.h:476
struct signal_info * sig
Internal error signaling object.
Definition openvpn.h:502
openvpn_net_ctx_t net_ctx
Networking API opaque context.
Definition openvpn.h:500
struct plugin_list * plugins
List of plug-ins.
Definition openvpn.h:504
struct context_2 c2
Level 2 context.
Definition openvpn.h:516
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:477
struct context_1 c1
Level 1 context.
Definition openvpn.h:515
struct context_persist persist
Persistent context.
Definition openvpn.h:512
Security parameter state for processing data channel packets.
Definition crypto.h:292
struct link_socket * sock
Definition event.h:146
event_arg_t type
Definition event.h:143
unsigned int rwflags
Definition event.h:126
interval_t n
periodic interval for periodic timeouts
Definition interval.h:139
int tun_mtu
the (user) configured tun-mtu.
Definition mtu.h:131
int payload_size
the maximum size that a payload that our buffers can hold from either tun device or network link.
Definition mtu.h:102
int headroom
the headroom in the buffer, this is choosen to allow all potential header to be added before the pack...
Definition mtu.h:108
struct frame::@8 buf
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:117
Security parameter state of one TLS and data channel key session.
Definition ssl_common.h:203
struct event_set * es
Definition multi_io.h:54
unsigned int udp_flags
Definition multi_io.h:59
uint8_t dest[OPENVPN_ETH_ALEN]
Definition proto.h:56
uint16_t proto
Definition proto.h:63
uint8_t source[OPENVPN_ETH_ALEN]
Definition proto.h:57
uint8_t icmp6_type
Definition proto.h:143
uint16_t icmp6_cksum
Definition proto.h:147
uint8_t icmp6_code
Definition proto.h:146
uint32_t daddr
Definition proto.h:114
uint8_t version_prio
Definition proto.h:122
struct in6_addr saddr
Definition proto.h:128
struct in6_addr daddr
Definition proto.h:129
uint8_t nexthdr
Definition proto.h:125
uint16_t payload_len
Definition proto.h:124
struct sockaddr sa
Definition socket.h:69
union openvpn_sockaddr::@24 addr
struct sockaddr_in in4
Definition socket.h:70
struct sockaddr_in6 in6
Definition socket.h:71
const char * ifconfig_ipv6_remote
Definition options.h:326
int scheduled_exit_interval
Definition options.h:565
int shaper
Definition options.h:329
bool allow_recursive_routing
Definition options.h:720
int64_t inactivity_minimum_bytes
Definition options.h:345
int inactivity_timeout
Definition options.h:344
struct connection_entry ce
Definition options.h:289
int mode
Definition options.h:261
bool block_ipv6
Definition options.h:438
int ping_rec_timeout
Definition options.h:350
int ping_send_timeout
Definition options.h:349
bool route_gateway_via_dhcp
Definition options.h:440
struct client_nat_option_list * client_nat
Definition options.h:442
int session_timeout
Definition options.h:347
volatile int signal_received
Definition sig.h:43
bool is_handle
Definition socket.h:290
struct event_timeout et
Definition status.h:61
int n_hard_errors
Definition ssl_common.h:630
enum multi_status multi_state
Definition ssl_common.h:625
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition ssl_common.h:704
char * client_reason
An error message to send to client on AUTH_FAILED.
Definition ssl_common.h:659
bool use_peer_id
Definition ssl_common.h:693
int dco_peer_id
This is the handle that DCO uses to identify this session with the kernel.
Definition ssl_common.h:716
int n_soft_errors
Definition ssl_common.h:631
Security parameter state of a single session within a VPN tunnel.
Definition ssl_common.h:483
Definition tun.h:178
enum tun_driver_type backend_driver
The backend driver that used for this tun/tap device.
Definition tun.h:188
HANDLE hand
Definition tun.h:213
struct overlapped_io reads
Definition tun.h:216
dco_context_t dco
Definition tun.h:244
char * actual_name
Definition tun.h:202
struct env_set * es
struct gc_arena gc
Definition test_ssl.c:155
void tun_show_debug(struct tuntap *tt)
Definition tun.c:6741
const char * tun_stat(const struct tuntap *tt, unsigned int rwflags, struct gc_arena *gc)
Definition tun.c:771
int tun_write_win32(struct tuntap *tt, struct buffer *buf)
Definition tun.c:3720
void show_adapters(int msglev)
Definition tun.c:5059
bool tun_standby(struct tuntap *tt)
Definition tun.c:5783
static bool tuntap_abort(int status)
Definition tun.h:494
#define TUNNEL_TYPE(tt)
Definition tun.h:179
static bool tuntap_defined(const struct tuntap *tt)
Definition tun.h:249
@ DRIVER_AFUNIX
using an AF_UNIX socket to pass packets from/to an external program.
Definition tun.h:51
static void tun_set(struct tuntap *tt, struct event_set *es, unsigned int rwflags, void *arg, unsigned int *persistent)
Definition tun.h:602
int read_tun(struct tuntap *tt, uint8_t *buf, int len)
static bool tuntap_is_dco_win_timeout(struct tuntap *tt, int status)
Definition tun.h:542
static bool tuntap_stop(int status)
Definition tun.h:480
int write_tun(struct tuntap *tt, uint8_t *buf, int len)
ssize_t read_tun_afunix(struct tuntap *tt, uint8_t *buf, int len)
Reads a packet from a AF_UNIX based tun device.
Definition tun_afunix.c:157
ssize_t write_tun_afunix(struct tuntap *tt, uint8_t *buf, int len)
Writes a packet to a AF_UNIX based tun device.
Definition tun_afunix.c:144