OpenVPN
multi.h
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22
28#ifndef MULTI_H
29#define MULTI_H
30
31#include "init.h"
32#include "forward.h"
33#include "mroute.h"
34#include "mbuf.h"
35#include "list.h"
36#include "schedule.h"
37#include "pool.h"
38#include "mudp.h"
39#include "mtcp.h"
40#include "multi_io.h"
41#include "perf.h"
42#include "vlan.h"
43#include "reflect_filter.h"
44
45#define MULTI_PREFIX_MAX_LENGTH 256
46
47/*
48 * Walk (don't run) through the routing table,
49 * deleting old entries, and possibly multi_instance
50 * structs as well which have been marked for deletion.
51 */
58
59
66
72{
73 /* Index of currently executed handler. */
75 /* Remember which option classes where processed for delayed option
76 * handling. */
77 unsigned int option_types_found;
78
84
90};
91
103{
104 struct schedule_entry se; /* this must be the first element of the structure,
105 * We cast between this and schedule_entry so the
106 * beginning of the struct must be identical */
107
113 struct gc_arena gc;
114 bool halt;
116 int route_count; /* number of routes (including cached routes) owned by this instance */
117 time_t created;
121 struct timeval wakeup; /* absolute time */
126
127 /* queued outgoing data in Server/TCP mode */
128 unsigned int tcp_rwflags;
131
132 in_addr_t reporting_addr; /* IP address shown in status listing */
133 struct in6_addr reporting_addr_ipv6; /* IPv6 address in status listing */
134
137#ifdef ENABLE_MANAGEMENT
140#endif
142 int n_clients_delta; /* added to multi_context.n_clients when instance is closed */
143
147#ifdef ENABLE_ASYNC_PUSH
148 int inotify_watch; /* watch descriptor for acf */
149#endif
150};
151
152
164{
168 struct hash *hash;
170 struct hash *vhash;
172 struct hash *iter;
176 struct mbuf_set *mbuf;
190 int n_clients; /* current number of authenticated clients */
191
192#ifdef ENABLE_MANAGEMENT
193 struct hash *cid_hash;
194 unsigned long cid_counter;
195#endif
196
202
203 struct context top;
209
210 /*
211 * Timer object for stale route check
212 */
214
215#ifdef ENABLE_ASYNC_PUSH
216 /* mapping between inotify watch descriptors and multi_instances */
217 struct hash *inotify_watchers;
218#endif
219
221};
222
233
234/*
235 * Host route
236 */
238{
241
242#define MULTI_ROUTE_CACHE (1 << 0)
243#define MULTI_ROUTE_AGEABLE (1 << 1)
244 unsigned int flags;
245
246 unsigned int cache_generation;
248};
249
250
251/**************************************************************************/
258void tunnel_server(struct context *top);
259
260
261const char *multi_instance_string(const struct multi_instance *mi, bool null, struct gc_arena *gc);
262
263/*
264 * Called by mtcp.c, mudp.c, or other (to be written) protocol drivers
265 */
266
268 const struct mroute_addr *real,
269 struct link_socket *sock);
270
271void multi_close_instance(struct multi_context *m, struct multi_instance *mi, bool shutdown);
272
273bool multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags);
274
275#define MPP_PRE_SELECT (1 << 0)
276#define MPP_CONDITIONAL_PRE_SELECT (1 << 1)
277#define MPP_CLOSE_ON_SIGNAL (1 << 2)
278#define MPP_RECORD_TOUCH (1 << 3)
279
280
281/**************************************************************************/
303bool multi_process_post(struct multi_context *m, struct multi_instance *mi,
304 const unsigned int flags);
305
316
317/**************************************************************************/
341bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance,
342 const unsigned int mpp_flags, struct link_socket *sock);
343
344
360bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags);
361
362
363void multi_process_drop_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags);
364
365struct multi_instance *multi_get_queue(struct mbuf_set *ms);
366
367void multi_add_mbuf(struct multi_context *m, struct multi_instance *mi, struct mbuf_buffer *mb);
368
369void multi_ifconfig_pool_persist(struct multi_context *m, bool force);
370
371bool multi_process_signal(struct multi_context *m);
372
374
376
377#ifdef ENABLE_ASYNC_PUSH
385void multi_process_file_closed(struct multi_context *m, const unsigned int mpp_flags);
386
387#endif
388
389/*
390 * Return true if our output queue is not full
391 */
392static inline bool
393multi_output_queue_ready(const struct multi_context *m, const struct multi_instance *mi)
394{
395 if (mi->tcp_link_out_deferred)
396 {
398 }
399 else
400 {
401 return true;
402 }
403}
404
405/*
406 * Determine which instance has pending output
407 * and prepare the output for sending in
408 * the to_link buffer.
409 */
410static inline struct multi_instance *
412{
413 struct multi_instance *mi = NULL;
414
415 if (m->pending)
416 {
417 mi = m->pending;
418 }
419 else if (mbuf_defined(m->mbuf))
420 {
421 mi = multi_get_queue(m->mbuf);
422 }
423 return mi;
424}
425
426/*
427 * Per-client route quota management
428 */
429
430void route_quota_exceeded(const struct multi_instance *mi);
431
432static inline void
434{
435 ++mi->route_count;
436}
437
438static inline void
440{
441 --mi->route_count;
442}
443
444/* can we add a new route? */
445static inline bool
447{
449 {
451 return false;
452 }
453 else
454 {
455 return true;
456 }
457}
458
459/*
460 * Instance reference counting
461 */
462
463static inline void
465{
466 ++mi->refcount;
467}
468
469static inline void
471{
472 if (--mi->refcount <= 0)
473 {
474 gc_free(&mi->gc);
475 free(mi);
476 }
477}
478
479static inline void
481{
482 struct multi_instance *mi = route->instance;
483 route_quota_dec(mi);
485 free(route);
486}
487
488static inline bool
489multi_route_defined(const struct multi_context *m, const struct multi_route *r)
490{
491 if (r->instance->halt)
492 {
493 return false;
494 }
495 else if ((r->flags & MULTI_ROUTE_CACHE)
497 {
498 return false;
499 }
500 else if ((r->flags & MULTI_ROUTE_AGEABLE)
502 {
503 return false;
504 }
505 else
506 {
507 return true;
508 }
509}
510
511/*
512 * Takes prefix away from multi_instance.
513 */
514void ungenerate_prefix(struct multi_instance *mi);
515
516/*
517 * Set a msg() function prefix with our current client instance ID.
518 */
519
520static inline void
522{
523#ifdef MULTI_DEBUG_EVENT_LOOP
524 if (mi->msg_prefix[0])
525 {
526 printf("[%s]\n", mi->msg_prefix);
527 }
528#endif
529 msg_set_prefix(mi->msg_prefix[0] ? mi->msg_prefix : NULL);
530}
531
532static inline void
534{
535#ifdef MULTI_DEBUG_EVENT_LOOP
536 printf("[NULL]\n");
537#endif
538 msg_set_prefix(NULL);
539}
540
541/*
542 * Instance Reaper
543 *
544 * Reaper constants. The reaper is the process where the virtual address
545 * and virtual route hash table is scanned for dead entries which are
546 * then removed. The hash table could potentially be quite large, so we
547 * don't want to reap in a single pass.
548 */
549
550#define REAP_MAX_WAKEUP 10 /* Do reap pass at least once per n seconds */
551#define REAP_DIVISOR 256 /* How many passes to cover whole hash table */
552#define REAP_MIN 16 /* Minimum number of buckets per pass */
553#define REAP_MAX 1024 /* Maximum number of buckets per pass */
554
555/*
556 * Mark a cached host route for deletion after this
557 * many seconds without any references.
558 */
559#define MULTI_CACHE_ROUTE_TTL 60
560
561void multi_reap_process_dowork(const struct multi_context *m);
562
564
565static inline void
567{
568 if (m->reaper->last_call != now)
569 {
571 }
572}
573
574static inline void
583
584/*
585 * Compute earliest timeout expiry from the set of
586 * all instances. Output:
587 *
588 * m->earliest_wakeup : instance needing the earliest service.
589 * dest : earliest timeout as a delta in relation
590 * to current time.
591 */
592static inline void
593multi_get_timeout(struct multi_context *m, struct timeval *dest)
594{
595 struct timeval tv, current;
596
597 CLEAR(tv);
599 if (m->earliest_wakeup)
600 {
601 ASSERT(!openvpn_gettimeofday(&current, NULL));
602 tv_delta(dest, &current, &tv);
603 if (dest->tv_sec >= REAP_MAX_WAKEUP)
604 {
605 m->earliest_wakeup = NULL;
606 dest->tv_sec = REAP_MAX_WAKEUP;
607 dest->tv_usec = 0;
608 }
609 }
610 else
611 {
612 dest->tv_sec = REAP_MAX_WAKEUP;
613 dest->tv_usec = 0;
614 }
615}
616
617
635static inline bool
636multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
637{
638 struct multi_instance *mi = m->pending;
639 bool ret = true;
640
641 ASSERT(mi);
642#ifdef MULTI_DEBUG_EVENT_LOOP
643 printf("%s -> TUN len=%d\n", id(mi), mi->context.c2.to_tun.len);
644#endif
645 set_prefix(mi);
648 ret = multi_process_post(m, mi, mpp_flags);
649 clear_prefix();
650 return ret;
651}
652
653#define CLIENT_CONNECT_OPT_MASK \
654 (OPT_P_INSTANCE | OPT_P_INHERIT | OPT_P_PUSH | OPT_P_TIMER | OPT_P_CONFIG | OPT_P_ECHO \
655 | OPT_P_COMP | OPT_P_SOCKFLAGS)
656
657static inline bool
659 const unsigned int mpp_flags)
660{
661 bool ret = true;
662 set_prefix(mi);
664 ret = multi_process_post(m, mi, mpp_flags);
665 clear_prefix();
666 return ret;
667}
668
669/*
670 * Check for signals.
671 */
672#define MULTI_CHECK_SIG(m) EVENT_LOOP_CHECK_SIGNAL(&(m)->top, multi_process_signal, (m))
673
674static inline void
676{
677 m->pending = mi;
678}
687void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi);
688
689#ifdef ENABLE_MANAGEMENT
690struct multi_instance *
691lookup_by_cid(struct multi_context *m, const unsigned long cid);
692#endif
693
694void
695update_vhash(struct multi_context *m, struct multi_instance *mi, const char *old_ip, const char *old_ipv6);
696
697#endif /* MULTI_H */
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
Interface functions to the internal and external multiplexers.
void tunnel_server(struct context *top)
Main event loop for OpenVPN in server mode.
Definition multi.c:4214
bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags, struct link_socket *sock)
Demultiplex and process a packet received over the external network interface.
Definition multi.c:3352
void process_outgoing_link(struct context *c, struct link_socket *sock)
Write a packet to the external network interface.
Definition forward.c:1736
void process_outgoing_tun(struct context *c, struct link_socket *in_sock)
Write a packet to the virtual tun/tap network interface.
Definition forward.c:1879
static bool multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Send a packet over the virtual tun/tap network interface to its locally reachable destination.
Definition multi.h:636
bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
Determine the destination VPN tunnel of a packet received over the virtual tun/tap network interface ...
Definition multi.c:3552
@ route
Definition interactive.c:85
static bool mbuf_defined(const struct mbuf_set *ms)
Definition mbuf.h:79
static unsigned int mbuf_len(const struct mbuf_set *ms)
Definition mbuf.h:85
bool multi_process_incoming_dco(struct multi_context *m)
Process an incoming DCO message (from kernel space).
client_connect_return
Return values used by the client connect call-back functions.
Definition multi.h:227
@ CC_RET_DEFERRED
Definition multi.h:230
@ CC_RET_FAILED
Definition multi.h:228
@ CC_RET_SKIPPED
Definition multi.h:231
@ CC_RET_SUCCEEDED
Definition multi.h:229
struct multi_instance * multi_create_instance(struct multi_context *m, const struct mroute_addr *real, struct link_socket *sock)
Definition multi.c:732
static bool multi_output_queue_ready(const struct multi_context *m, const struct multi_instance *mi)
Definition multi.h:393
#define REAP_MAX_WAKEUP
Definition multi.h:550
void multi_ifconfig_pool_persist(struct multi_context *m, bool force)
Definition multi.c:161
#define MULTI_PREFIX_MAX_LENGTH
Definition multi.h:45
void multi_reap_process_dowork(const struct multi_context *m)
Definition multi.c:219
static void route_quota_dec(struct multi_instance *mi)
Definition multi.h:439
bool multi_process_signal(struct multi_context *m)
Definition multi.c:3887
void multi_close_instance_on_signal(struct multi_context *m, struct multi_instance *mi)
Definition multi.c:3212
bool multi_process_post(struct multi_context *m, struct multi_instance *mi, const unsigned int flags)
Perform postprocessing of a VPN tunnel instance.
Definition multi.c:3013
void multi_process_per_second_timers_dowork(struct multi_context *m)
Definition multi.c:3791
struct multi_instance * multi_get_queue(struct mbuf_set *ms)
Definition multi.c:3644
bool multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags)
Definition multi.c:3680
static void set_prefix(struct multi_instance *mi)
Definition multi.h:521
static void multi_route_del(struct multi_route *route)
Definition multi.h:480
static void multi_reap_process(const struct multi_context *m)
Definition multi.h:566
struct multi_instance * lookup_by_cid(struct multi_context *m, const unsigned long cid)
Definition multi.c:4002
static void route_quota_inc(struct multi_instance *mi)
Definition multi.h:433
#define MULTI_ROUTE_CACHE
Definition multi.h:242
const char * multi_instance_string(const struct multi_instance *mi, bool null, struct gc_arena *gc)
Definition multi.c:442
void update_vhash(struct multi_context *m, struct multi_instance *mi, const char *old_ip, const char *old_ipv6)
Update the vhash with new IP/IPv6 addresses in the multi_context when a push-update message containin...
Definition multi.c:4277
static void clear_prefix(void)
Definition multi.h:533
void multi_close_instance(struct multi_context *m, struct multi_instance *mi, bool shutdown)
Definition multi.c:582
static bool multi_route_defined(const struct multi_context *m, const struct multi_route *r)
Definition multi.h:489
static struct multi_instance * multi_process_outgoing_link_pre(struct multi_context *m)
Definition multi.h:411
static void multi_instance_dec_refcount(struct multi_instance *mi)
Definition multi.h:470
void multi_add_mbuf(struct multi_context *m, struct multi_instance *mi, struct mbuf_buffer *mb)
Definition multi.c:2865
static void multi_instance_inc_refcount(struct multi_instance *mi)
Definition multi.h:464
void route_quota_exceeded(const struct multi_instance *mi)
Definition multi.c:3734
void ungenerate_prefix(struct multi_instance *mi)
Definition multi.c:489
void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi)
Assigns a peer-id to a a client and adds the instance to the the instances array of the multi_context...
Definition multi.c:4150
static void multi_get_timeout(struct multi_context *m, struct timeval *dest)
Definition multi.h:593
static void multi_set_pending(struct multi_context *m, struct multi_instance *mi)
Definition multi.h:675
void init_management_callback_multi(struct multi_context *m)
Definition multi.c:4123
#define MULTI_ROUTE_AGEABLE
Definition multi.h:243
void multi_process_drop_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Definition multi.c:3712
static bool multi_process_outgoing_link_dowork(struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags)
Definition multi.h:658
static void multi_process_per_second_timers(struct multi_context *m)
Definition multi.h:575
static bool route_quota_test(const struct multi_instance *mi)
Definition multi.h:446
#define CLEAR(x)
Definition basic.h:32
static void msg_set_prefix(const char *prefix)
Definition error.h:336
#define ASSERT(x)
Definition error.h:217
time_t now
Definition otime.c:33
static void tv_delta(struct timeval *dest, const struct timeval *t1, const struct timeval *t2)
Definition otime.h:219
static int openvpn_gettimeofday(struct timeval *tv, void *tz)
Definition otime.h:63
int ifconfig_pool_handle
Definition pool.h:72
static struct schedule_entry * schedule_get_earliest_wakeup(struct schedule *s, struct timeval *wakeup)
Definition schedule.h:115
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
Detached client connection state.
Definition multi.h:72
char * config_file
The temporary file name that contains the config directives returned by the client-connect script.
Definition multi.h:89
unsigned int option_types_found
Definition multi.h:77
char * deferred_ret_file
The temporary file name that contains the return status of the client-connect script if it exits with...
Definition multi.h:83
struct buffer to_tun
Definition openvpn.h:376
struct link_socket ** link_sockets
Definition openvpn.h:237
Contains all state information for one tunnel.
Definition openvpn.h:474
struct context_2 c2
Level 2 context.
Definition openvpn.h:517
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:475
Definition multi.h:61
int signal_received
Definition multi.h:63
struct timeval wakeup
Definition multi.h:64
struct schedule_entry se
Definition multi.h:62
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
Definition list.h:56
struct that handles all the rate limiting logic for initial responses
int ageable_ttl_secs
Definition mroute.h:130
unsigned int cache_generation
Definition mroute.h:129
Main OpenVPN server state structure.
Definition multi.h:164
int n_clients
Definition multi.h:190
struct mroute_addr local
Definition multi.h:185
struct schedule * schedule
Definition multi.h:175
time_t per_second_trigger
Definition multi.h:201
struct mbuf_set * mbuf
Set of buffers for passing data channel packets between VPN tunnel instances.
Definition multi.h:176
struct initial_packet_rate_limit * initial_rate_limiter
Definition multi.h:182
struct deferred_signal_schedule_entry deferred_shutdown_signal
Definition multi.h:220
struct link_socket_actual * hmac_reply_dest
Definition multi.h:207
int max_clients
Definition multi.h:187
struct multi_reap * reaper
Definition multi.h:184
struct multi_io * multi_io
I/O state and events tracker.
Definition multi.h:179
struct hash * hash
VPN tunnel instances indexed by real address of the remote peer.
Definition multi.h:168
struct context_buffers * context_buffers
Definition multi.h:200
struct hash * cid_hash
Definition multi.h:193
unsigned long cid_counter
Definition multi.h:194
struct event_timeout stale_routes_check_et
Definition multi.h:213
struct link_socket * hmac_reply_ls
Definition multi.h:208
int tcp_queue_limit
Definition multi.h:188
struct ifconfig_pool * ifconfig_pool
Definition multi.h:180
struct frequency_limit * new_connection_limiter
Definition multi.h:181
struct context top
Storage structure for process-wide configuration.
Definition multi.h:203
int status_file_version
Definition multi.h:189
struct multi_instance * pending
Definition multi.h:197
struct hash * vhash
VPN tunnel instances indexed by virtual address of remote hosts.
Definition multi.h:170
struct hash * iter
VPN tunnel instances indexed by real address of the remote peer, optimized for iteration.
Definition multi.h:172
struct multi_instance ** instances
Array of multi_instances.
Definition multi.h:165
struct multi_instance ** mpp_touched
Definition multi.h:199
struct buffer hmac_reply
Definition multi.h:206
bool enable_c2c
Definition multi.h:186
struct multi_instance * earliest_wakeup
Definition multi.h:198
struct mroute_helper * route_helper
Definition multi.h:183
Server-mode state structure for one single VPN tunnel.
Definition multi.h:103
struct mbuf_set * tcp_link_out_deferred
Definition multi.h:129
struct buffer_list * cc_config
Definition multi.h:139
bool did_cid_hash
Definition multi.h:138
time_t created
Time at which a VPN tunnel instance was created.
Definition multi.h:117
in_addr_t reporting_addr
Definition multi.h:132
unsigned int tcp_rwflags
Definition multi.h:128
char msg_prefix[MULTI_PREFIX_MAX_LENGTH]
Definition multi.h:125
struct mroute_addr real
External network address of the remote peer.
Definition multi.h:122
bool did_iroutes
Definition multi.h:141
bool socket_set_called
Definition multi.h:130
int route_count
Definition multi.h:116
ifconfig_pool_handle vaddr_handle
Definition multi.h:124
bool did_real_hash
Definition multi.h:135
struct gc_arena gc
Definition multi.h:113
struct in6_addr reporting_addr_ipv6
Definition multi.h:133
struct timeval wakeup
Definition multi.h:121
struct event_arg ev_arg
this struct will store a pointer to either mi or link_socket, depending on the event type,...
Definition multi.h:108
bool did_iter
Definition multi.h:136
struct context context
The context structure storing state for this VPN tunnel.
Definition multi.h:144
struct schedule_entry se
Definition multi.h:104
int n_clients_delta
Definition multi.h:142
time_t last_call
Definition multi.h:56
int buckets_per_pass
Definition multi.h:55
int bucket_base
Definition multi.h:54
struct mroute_addr addr
Definition multi.h:239
time_t last_reference
Definition multi.h:247
unsigned int cache_generation
Definition multi.h:246
unsigned int flags
Definition multi.h:244
struct multi_instance * instance
Definition multi.h:240
int max_routes_per_client
Definition options.h:539
Definition schedule.h:44
struct gc_arena gc
Definition test_ssl.c:154
void vlan_process_outgoing_tun(struct multi_context *m, struct multi_instance *mi)
Definition vlan.c:291