OpenVPN
mudp.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22
23#ifdef HAVE_CONFIG_H
24#include "config.h"
25#endif
26
27#include "syshead.h"
28
29#include "multi.h"
30#include <inttypes.h>
31#include "forward.h"
32
33#include "memdbg.h"
34#include "ssl_pkt.h"
35
36#ifdef HAVE_SYS_INOTIFY_H
37#include <sys/inotify.h>
38#endif
39
40static void
42 struct tls_auth_standalone *tas, struct session_id *sid,
43 bool request_resend_wkc)
44{
47 uint8_t header = 0 | (P_CONTROL_HARD_RESET_SERVER_V2 << P_OPCODE_SHIFT);
48 struct buffer buf = tls_reset_standalone(&state->tls_wrap_tmp, tas, sid,
49 &state->peer_session_id, header, request_resend_wkc);
50
51 struct context *c = &m->top;
52
53 /* dco-win server requires prepend with sockaddr, so preserve offset */
55
56 buf_copy(&c->c2.buffers->aux_buf, &buf);
58 m->hmac_reply_dest = &m->top.c2.from;
59 msg(D_MULTI_DEBUG, "Reset packet from client, sending HMAC based reset challenge");
60}
61
62
63/* Returns true if this packet should create a new session */
64static bool
66 struct mroute_addr addr)
67{
69
70 enum first_packet_verdict verdict;
71
73
74 verdict = tls_pre_decrypt_lite(tas, state, &m->top.c2.from, &m->top.c2.buf);
75
77 struct openvpn_sockaddr *from = &m->top.c2.from.dest;
78 int handwindow = m->top.options.handshake_window;
79
80 if (verdict == VERDICT_VALID_RESET_V3 || verdict == VERDICT_VALID_RESET_V2)
81 {
82 /* Check if we are still below our limit for sending out
83 * responses */
85 {
86 return false;
87 }
88 }
89
90 if (verdict == VERDICT_VALID_RESET_V3)
91 {
92 /* Extract the packet id to check if it has the special format that
93 * indicates early negotiation support */
94 struct packet_id_net pin;
95 struct buffer tmp = m->top.c2.buf;
97 ASSERT(packet_id_read(&pin, &tmp, true));
98
99 /* The most significant byte is 0x0f if early negotiation is supported */
101
102 /* All clients that support early negotiation and tls-crypt are assumed
103 * to also support resending the WKc in the 2nd packet */
105 {
106 /* Calculate the session ID HMAC for our reply and create reset packet */
107 struct session_id sid =
108 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, 0);
109 send_hmac_reset_packet(m, state, tas, &sid, true);
110
111 return false;
112 }
113 else
114 {
115 /* For tls-crypt-v2 we need to keep the state of the first packet
116 * to store the unwrapped key if the client doesn't support resending
117 * the wrapped key. Unless the user specifically disallowed
118 * compatibility with such clients to avoid state exhaustion */
120 {
121 struct gc_arena gc = gc_new();
122 const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
124 "tls-crypt-v2 force-cookie is enabled, "
125 "ignoring connection attempt from old client (%s)",
126 peer);
127 gc_free(&gc);
128 return false;
129 }
130 else
131 {
132 return true;
133 }
134 }
135 }
136 else if (verdict == VERDICT_VALID_RESET_V2)
137 {
138 /* Calculate the session ID HMAC for our reply and create reset packet */
139 struct session_id sid =
140 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, 0);
141
142 send_hmac_reset_packet(m, state, tas, &sid, false);
143
144 /* We have a reply do not create a new session */
145 return false;
146 }
147 else if (verdict == VERDICT_VALID_CONTROL_V1 || verdict == VERDICT_VALID_ACK_V1
148 || verdict == VERDICT_VALID_WKC_V1)
149 {
150 /* ACK_V1 contains the peer id (our id) while CONTROL_V1 can but does not
151 * need to contain the peer id */
152 struct gc_arena gc = gc_new();
153
154 bool pkt_is_ack = (verdict == VERDICT_VALID_ACK_V1);
155 bool ret = check_session_hmac_and_pkt_id(state, from, hmac, handwindow, pkt_is_ack);
156
157 const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
158 uint8_t pkt_firstbyte = *BPTR(&m->top.c2.buf);
159 int op = pkt_firstbyte >> P_OPCODE_SHIFT;
160
161 if (!ret)
162 {
163 msg(D_MULTI_MEDIUM, "Packet (%s) with invalid or missing SID from"
164 " %s or wrong packet id",
165 packet_opcode_name(op), peer);
166 }
167 else
168 {
170 "Valid packet (%s) with HMAC challenge from peer (%s), "
171 "accepting new connection.",
172 packet_opcode_name(op), peer);
173 }
174 gc_free(&gc);
175
176 return ret;
177 }
178
179 /* VERDICT_INVALID */
180 return false;
181}
182
183/*
184 * Get a client instance based on real address. If
185 * the instance doesn't exist, create it while
186 * maintaining real address hash table atomicity.
187 */
188
189struct multi_instance *
190multi_get_create_instance_udp(struct multi_context *m, bool *floated, struct link_socket *sock)
191{
192 struct gc_arena gc = gc_new();
193 struct mroute_addr real = { 0 };
194 struct multi_instance *mi = NULL;
195 struct hash *hash = m->hash;
196 real.proto = sock->info.proto;
197 m->hmac_reply_ls = sock;
198
199 if (mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true) && m->top.c2.buf.len > 0)
200 {
201 struct hash_element *he;
202 const uint32_t hv = hash_value(hash, &real);
203 struct hash_bucket *bucket = hash_bucket(hash, hv);
204 uint8_t *ptr = BPTR(&m->top.c2.buf);
205 uint8_t op = ptr[0] >> P_OPCODE_SHIFT;
206 bool v2 = (op == P_DATA_V2) && (m->top.c2.buf.len >= (1 + 3));
207 bool peer_id_disabled = false;
208
209 /* make sure buffer has enough length to read opcode (1 byte) and peer-id (3 bytes) */
210 if (v2)
211 {
212 uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFFFFFF;
213 peer_id_disabled = (peer_id == MAX_PEER_ID);
214
215 if (!peer_id_disabled && (peer_id < m->max_clients) && (m->instances[peer_id]))
216 {
217 /* Floating on TCP will never be possible, so ensure we only process
218 * UDP clients */
219 if (m->instances[peer_id]->context.c2.link_sockets[0]->info.proto
220 == sock->info.proto)
221 {
222 mi = m->instances[peer_id];
223 *floated = !link_socket_actual_match(&mi->context.c2.from, &m->top.c2.from);
224
225 if (*floated)
226 {
227 /* reset prefix, since here we are not sure peer is the one it claims to be
228 */
230 msg(D_MULTI_MEDIUM, "Float requested for peer %" PRIu32 " to %s", peer_id,
231 mroute_addr_print(&real, &gc));
232 }
233 }
234 }
235 }
236 if (!v2 || peer_id_disabled)
237 {
238 he = hash_lookup_fast(hash, bucket, &real, hv);
239 if (he)
240 {
241 mi = (struct multi_instance *)he->value;
242 }
243 }
244
245 /* we have no existing multi instance for this connection */
246 if (!mi)
247 {
248 struct tls_pre_decrypt_state state = { 0 };
250 {
252 "MULTI: Connection attempt from %s ignored while server is "
253 "shutting down",
254 mroute_addr_print(&real, &gc));
255 }
256 else if (do_pre_decrypt_check(m, &state, real))
257 {
258 /* This is an unknown session but with valid tls-auth/tls-crypt
259 * (or no auth at all). If this is the initial packet of a
260 * session, we just send a reply with a HMAC session id and
261 * do not generate a session slot */
262
264 {
265 /* a successful three-way handshake only counts against
266 * connect-freq but not against connect-freq-initial */
268
269 mi = multi_create_instance(m, &real, sock);
270 if (mi)
271 {
272 hash_add_fast(hash, bucket, &mi->real, hv, mi);
273 mi->did_real_hash = true;
275
276 /* If we have a session id already, ensure that the
277 * state is using the same */
280 {
282 struct tls_session *session =
285 }
286 }
287 }
288 else
289 {
291 "MULTI: Connection from %s would exceed new connection frequency limit as controlled by --connect-freq",
292 mroute_addr_print(&real, &gc));
293 }
294 }
296 }
297
298#ifdef ENABLE_DEBUG
300 {
301 const char *status = mi ? "[ok]" : "[failed]";
302
303 dmsg(D_MULTI_DEBUG, "GET INST BY REAL: %s %s", mroute_addr_print(&real, &gc), status);
304 }
305#endif
306 }
307
308 gc_free(&gc);
309 ASSERT(!(mi && mi->halt));
310 return mi;
311}
312
313/*
314 * Send a packet to UDP socket.
315 */
316static inline void
317multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
318{
320 if (mi)
321 {
322 multi_process_outgoing_link_dowork(m, mi, mpp_flags);
323 }
324 if (m->hmac_reply_dest && m->hmac_reply.len > 0)
325 {
326 msg_set_prefix("Connection Attempt");
327 m->top.c2.to_link = m->hmac_reply;
330 m->hmac_reply_ls = NULL;
331 m->hmac_reply_dest = NULL;
332 }
333}
334
335/*
336 * Process an I/O event.
337 */
338void
340{
341 const unsigned int status = m->multi_io->udp_flags;
342 const unsigned int mpp_flags = m->top.c2.fast_io
345
346#ifdef MULTI_DEBUG_EVENT_LOOP
347 char buf[16];
348 buf[0] = 0;
349 if (status & SOCKET_READ)
350 {
351 strcat(buf, "SR/");
352 }
353 else if (status & SOCKET_WRITE)
354 {
355 strcat(buf, "SW/");
356 }
357 else if (status & TUN_READ)
358 {
359 strcat(buf, "TR/");
360 }
361 else if (status & TUN_WRITE)
362 {
363 strcat(buf, "TW/");
364 }
365 else if (status & FILE_CLOSED)
366 {
367 strcat(buf, "FC/");
368 }
369 printf("IO %s\n", buf);
370#endif /* ifdef MULTI_DEBUG_EVENT_LOOP */
371
372#ifdef ENABLE_MANAGEMENT
374 {
377 }
378#endif
379
380 /* UDP port ready to accept write */
381 if (status & SOCKET_WRITE)
382 {
383 multi_process_outgoing_link(m, mpp_flags);
384 }
385 /* TUN device ready to accept write */
386 else if (status & TUN_WRITE)
387 {
388 multi_process_outgoing_tun(m, mpp_flags);
389 }
390 /* Incoming data on UDP port */
391 else if (status & SOCKET_READ)
392 {
393 read_incoming_link(&m->top, sock);
394 if (!IS_SIG(&m->top))
395 {
396 multi_process_incoming_link(m, NULL, mpp_flags, sock);
397 }
398 }
399 /* Incoming data on TUN device */
400 else if (status & TUN_READ)
401 {
403 if (!IS_SIG(&m->top))
404 {
405 multi_process_incoming_tun(m, mpp_flags);
406 }
407 }
408#ifdef ENABLE_ASYNC_PUSH
409 /* INOTIFY callback */
410 else if (status & FILE_CLOSED)
411 {
412 multi_process_file_closed(m, mpp_flags);
413 }
414#endif
415#if defined(ENABLE_DCO)
416 else if (status & DCO_READ)
417 {
418 if (!IS_SIG(&m->top))
419 {
420 bool ret = true;
421 while (ret)
422 {
424 }
425 }
426 }
427#endif
428
430}
431
432/*
433 * Return the io_wait() flags appropriate for
434 * a point-to-multipoint tunnel.
435 */
436unsigned int
438{
439 unsigned int flags = IOW_WAIT_SIGNAL;
440 if (m->pending)
441 {
442 if (TUN_OUT(&m->pending->context))
443 {
444 flags |= IOW_TO_TUN;
445 }
446 if (LINK_OUT(&m->pending->context))
447 {
448 flags |= IOW_TO_LINK;
449 }
450 }
451 else if (mbuf_defined(m->mbuf))
452 {
453 flags |= IOW_MBUF;
454 }
455 else if (m->hmac_reply_dest)
456 {
457 flags |= IOW_TO_LINK;
458 }
459 else
460 {
461 flags |= IOW_READ;
462 }
463 return flags;
464}
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition buffer.h:704
#define BPTR(buf)
Definition buffer.h:123
static bool buf_advance(struct buffer *buf, int size)
Definition buffer.h:616
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
#define buf_init(buf, offset)
Definition buffer.h:209
static struct gc_arena gc_new(void)
Definition buffer.h:1007
#define CO_FORCE_TLSCRYPTV2_COOKIE
Bit-flag indicating that we do not allow clients that do not support resending the wrapped client key...
Definition crypto.h:365
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
#define D_MULTI_ERRORS
Definition errlevel.h:64
#define D_MULTI_MEDIUM
Definition errlevel.h:101
#define D_MULTI_DEBUG
Definition errlevel.h:126
#define DCO_READ
Definition event.h:75
#define FILE_CLOSED
Definition event.h:73
#define TUN_WRITE
Definition event.h:65
#define SOCKET_READ
Definition event.h:61
#define MANAGEMENT_READ
Definition event.h:70
#define MANAGEMENT_WRITE
Definition event.h:71
#define ES_ERROR
Definition event.h:67
#define SOCKET_WRITE
Definition event.h:62
#define TUN_READ
Definition event.h:64
Interface functions to the internal and external multiplexers.
#define IOW_WAIT_SIGNAL
Definition forward.h:63
#define IOW_MBUF
Definition forward.h:61
#define LINK_OUT(c)
Definition forward.h:38
#define TUN_OUT(c)
Definition forward.h:37
#define IOW_TO_TUN
Definition forward.h:54
#define IOW_READ
Definition forward.h:65
#define IOW_TO_LINK
Definition forward.h:55
#define TM_INITIAL
As yet un-trusted tls_session \ being negotiated.
Definition ssl_common.h:546
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition ssl_pkt.c:293
bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags, struct link_socket *sock)
Demultiplex and process a packet received over the external network interface.
Definition multi.c:3352
void process_outgoing_link(struct context *c, struct link_socket *sock)
Write a packet to the external network interface.
Definition forward.c:1736
void read_incoming_link(struct context *c, struct link_socket *sock)
Read a packet from the external network interface.
Definition forward.c:919
struct multi_instance * multi_get_create_instance_udp(struct multi_context *m, bool *floated, struct link_socket *sock)
Get, and if necessary create, the multi_instance associated with a packet's source address.
Definition mudp.c:190
void read_incoming_tun(struct context *c)
Read a packet from the virtual tun/tap network interface.
Definition forward.c:1316
static bool multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Send a packet over the virtual tun/tap network interface to its locally reachable destination.
Definition multi.h:636
bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
Determine the destination VPN tunnel of a packet received over the virtual tun/tap network interface ...
Definition multi.c:3552
static SERVICE_STATUS status
Definition interactive.c:51
struct hash_element * hash_lookup_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv)
Definition list.c:81
static uint32_t hash_value(const struct hash *hash, const void *key)
Definition list.h:107
static void hash_add_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv, void *value)
Definition list.h:149
void management_io(struct management *man)
Definition manage.c:3179
static bool mbuf_defined(const struct mbuf_set *ms)
Definition mbuf.h:79
bool mroute_extract_openvpn_sockaddr(struct mroute_addr *addr, const struct openvpn_sockaddr *osaddr, bool use_port)
Definition mroute.c:254
const char * mroute_addr_print(const struct mroute_addr *ma, struct gc_arena *gc)
Definition mroute.c:371
static bool do_pre_decrypt_check(struct multi_context *m, struct tls_pre_decrypt_state *state, struct mroute_addr addr)
Definition mudp.c:65
unsigned int p2mp_iow_flags(const struct multi_context *m)
Definition mudp.c:437
static void send_hmac_reset_packet(struct multi_context *m, struct tls_pre_decrypt_state *state, struct tls_auth_standalone *tas, struct session_id *sid, bool request_resend_wkc)
Definition mudp.c:41
void multi_process_io_udp(struct multi_context *m, struct link_socket *sock)
Definition mudp.c:339
static void multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
Definition mudp.c:317
struct multi_instance * multi_create_instance(struct multi_context *m, const struct mroute_addr *real, struct link_socket *sock)
Definition multi.c:732
void ungenerate_prefix(struct multi_instance *mi)
Definition multi.c:489
void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi)
Assigns a peer-id to a a client and adds the instance to the the instances array of the multi_context...
Definition multi.c:4150
Header file for server-mode related structures and functions.
bool multi_process_incoming_dco(struct multi_context *m)
Process an incoming DCO message (from kernel space).
#define MPP_CONDITIONAL_PRE_SELECT
Definition multi.h:276
#define MPP_CLOSE_ON_SIGNAL
Definition multi.h:277
static struct multi_instance * multi_process_outgoing_link_pre(struct multi_context *m)
Definition multi.h:411
#define MPP_PRE_SELECT
Definition multi.h:275
static bool multi_process_outgoing_link_dowork(struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags)
Definition multi.h:658
static void msg_set_prefix(const char *prefix)
Definition error.h:336
static bool check_debug_level(unsigned int level)
Definition error.h:257
#define dmsg(flags,...)
Definition error.h:170
#define msg(flags,...)
Definition error.h:150
#define ASSERT(x)
Definition error.h:217
#define MAX_PEER_ID
Definition openvpn.h:554
bool frequency_limit_event_allowed(struct frequency_limit *f)
Definition otime.c:162
bool packet_id_read(struct packet_id_net *pin, struct buffer *buf, bool long_form)
Definition packet_id.c:314
static void reset_packet_id_send(struct packet_id_send *p)
Reset the current send packet id to its initial state.
Definition packet_id.h:303
void reflect_filter_rate_limit_decrease(struct initial_packet_rate_limit *irl)
decreases the counter of initial packets seen, so connections that successfully completed the three-w...
bool reflect_filter_rate_limit_check(struct initial_packet_rate_limit *irl)
checks if the connection is still allowed to connect under the rate limit.
static bool session_id_defined(const struct session_id *sid1)
Definition session_id.h:53
#define SID_SIZE
Definition session_id.h:44
#define IS_SIG(c)
Definition sig.h:47
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
static bool link_socket_actual_match(const struct link_socket_actual *a1, const struct link_socket_actual *a2)
bool session_skip_to_pre_start(struct tls_session *session, struct tls_pre_decrypt_state *state, struct link_socket_actual *from)
Definition ssl.c:2489
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition ssl_pkt.c:459
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition ssl_pkt.c:271
bool check_session_hmac_and_pkt_id(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, bool pkt_is_ack)
Checks if a control packet has a correct HMAC server session id.
Definition ssl_pkt.c:499
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition ssl_pkt.c:403
SSL control channel wrap/unwrap and decode functions.
#define P_DATA_V2
Definition ssl_pkt.h:48
#define P_OPCODE_SHIFT
Definition ssl_pkt.h:39
static const char * packet_opcode_name(int op)
Definition ssl_pkt.h:241
#define EARLY_NEG_MASK
Definition ssl_pkt.h:314
#define P_CONTROL_HARD_RESET_SERVER_V2
Definition ssl_pkt.h:52
first_packet_verdict
Definition ssl_pkt.h:85
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition ssl_pkt.h:94
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition ssl_pkt.h:96
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition ssl_pkt.h:87
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition ssl_pkt.h:89
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition ssl_pkt.h:91
#define EARLY_NEG_START
Definition ssl_pkt.h:315
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
int offset
Offset in bytes of the actual content within the allocated memory.
Definition buffer.h:63
hmac_ctx_t * session_id_hmac
the HMAC we use to generate and verify our syn cookie like session ids from the server.
Definition openvpn.h:338
struct tls_auth_standalone * tls_auth_standalone
TLS state structure required for the initial authentication of a client's connection attempt.
Definition openvpn.h:326
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition openvpn.h:323
struct link_socket_actual from
Definition openvpn.h:245
struct buffer to_link
Definition openvpn.h:377
struct link_socket ** link_sockets
Definition openvpn.h:237
struct link_socket_actual * to_link_addr
Definition openvpn.h:244
struct buffer buf
Definition openvpn.h:375
bool fast_io
Definition openvpn.h:424
struct context_buffers * buffers
Definition openvpn.h:367
struct buffer aux_buf
Definition openvpn.h:97
Contains all state information for one tunnel.
Definition openvpn.h:474
struct context_2 c2
Level 2 context.
Definition openvpn.h:517
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:475
unsigned int flags
Bit-flags determining behavior of security operation functions.
Definition crypto.h:384
struct packet_id packet_id
Current packet ID state for both sending and receiving directions.
Definition crypto.h:331
int signal_received
Definition multi.h:63
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
void * value
Definition list.h:44
Definition list.h:56
uint8_t proto
Definition mroute.h:80
Main OpenVPN server state structure.
Definition multi.h:164
struct mbuf_set * mbuf
Set of buffers for passing data channel packets between VPN tunnel instances.
Definition multi.h:176
struct initial_packet_rate_limit * initial_rate_limiter
Definition multi.h:182
struct deferred_signal_schedule_entry deferred_shutdown_signal
Definition multi.h:220
struct link_socket_actual * hmac_reply_dest
Definition multi.h:207
struct multi_io * multi_io
I/O state and events tracker.
Definition multi.h:179
struct hash * hash
VPN tunnel instances indexed by real address of the remote peer.
Definition multi.h:168
struct link_socket * hmac_reply_ls
Definition multi.h:208
struct frequency_limit * new_connection_limiter
Definition multi.h:181
struct context top
Storage structure for process-wide configuration.
Definition multi.h:203
struct multi_instance * pending
Definition multi.h:197
struct multi_instance ** instances
Array of multi_instances.
Definition multi.h:165
struct buffer hmac_reply
Definition multi.h:206
Server-mode state structure for one single VPN tunnel.
Definition multi.h:103
struct mroute_addr real
External network address of the remote peer.
Definition multi.h:122
bool did_real_hash
Definition multi.h:135
struct context context
The context structure storing state for this VPN tunnel.
Definition multi.h:144
unsigned int udp_flags
Definition multi_io.h:58
int handshake_window
Definition options.h:655
Data structure for describing the packet id that is received/send to the network.
Definition packet_id.h:191
struct packet_id_send send
Definition packet_id.h:200
struct packet_id_rec rec
Definition packet_id.h:201
struct tls_wrap_ctx tls_wrap
Definition ssl_pkt.h:79
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition ssl_common.h:712
int n_sessions
Number of sessions negotiated thus far.
Definition ssl_common.h:631
struct that stores the temporary data for the tls lite decrypt functions
Definition ssl_pkt.h:106
struct session_id peer_session_id
Definition ssl_pkt.h:109
struct session_id server_session_id
Definition ssl_pkt.h:110
struct tls_wrap_ctx tls_wrap_tmp
Definition ssl_pkt.h:107
Security parameter state of a single session within a VPN tunnel.
Definition ssl_common.h:490
struct crypto_options opt
Crypto state.
Definition ssl_common.h:283
struct gc_arena gc
Definition test_ssl.c:154