OpenVPN
push.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #elif defined(_MSC_VER)
27 #include "config-msvc.h"
28 #endif
29 
30 #include "syshead.h"
31 
32 #include "push.h"
33 #include "options.h"
34 #include "ssl.h"
35 #include "ssl_verify.h"
36 #include "manage.h"
37 
38 #include "memdbg.h"
39 
40 #if P2MP
41 
42 static char push_reply_cmd[] = "PUSH_REPLY";
43 
44 /*
45  * Auth username/password
46  *
47  * Client received an authentication failed message from server.
48  * Runs on client.
49  */
50 void
51 receive_auth_failed(struct context *c, const struct buffer *buffer)
52 {
53  msg(M_VERB0, "AUTH: Received control message: %s", BSTR(buffer));
54  c->options.no_advance = true;
55 
56  if (c->options.pull)
57  {
58  switch (auth_retry_get())
59  {
60  case AR_NONE:
61  c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- Auth failure error */
62  break;
63 
64  case AR_INTERACT:
65  ssl_purge_auth(false);
66 
67  case AR_NOINTERACT:
68  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Auth failure error */
69  break;
70 
71  default:
72  ASSERT(0);
73  }
74  c->sig->signal_text = "auth-failure";
75 #ifdef ENABLE_MANAGEMENT
76  if (management)
77  {
78  const char *reason = NULL;
79  struct buffer buf = *buffer;
80  if (buf_string_compare_advance(&buf, "AUTH_FAILED,") && BLEN(&buf))
81  {
82  reason = BSTR(&buf);
83  }
85  }
86 #endif
87  /*
88  * Save the dynamic-challenge text even when management is defined
89  */
90  {
91 #ifdef ENABLE_CLIENT_CR
92  struct buffer buf = *buffer;
93  if (buf_string_match_head_str(&buf, "AUTH_FAILED,CRV1:") && BLEN(&buf))
94  {
95  buf_advance(&buf, 12); /* Length of "AUTH_FAILED," substring */
97  }
98 #endif
99  }
100  }
101 }
102 
103 /*
104  * Act on received restart message from server
105  */
106 void
107 server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
108 {
109  if (c->options.pull)
110  {
111  struct buffer buf = *buffer;
112  const char *m = "";
113  if (buf_advance(&buf, adv) && buf_read_u8(&buf) == ',' && BLEN(&buf))
114  {
115  m = BSTR(&buf);
116  }
117 
118  /* preserve cached passwords? */
119  /* advance to next server? */
120  {
121  bool purge = true;
122 
123  if (m[0] == '[')
124  {
125  int i;
126  for (i = 1; m[i] != '\0' && m[i] != ']'; ++i)
127  {
128  if (m[i] == 'P')
129  {
130  purge = false;
131  }
132  else if (m[i] == 'N')
133  {
134  /* next server? */
135  c->options.no_advance = false;
136  }
137  }
138  }
139  if (purge)
140  {
141  ssl_purge_auth(true);
142  }
143  }
144 
145  if (restart)
146  {
147  msg(D_STREAM_ERRORS, "Connection reset command was pushed by server ('%s')", m);
148  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
149  c->sig->signal_text = "server-pushed-connection-reset";
150  }
151  else
152  {
153  msg(D_STREAM_ERRORS, "Halt command was pushed by server ('%s')", m);
154  c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- server-pushed halt */
155  c->sig->signal_text = "server-pushed-halt";
156  }
157 #ifdef ENABLE_MANAGEMENT
158  if (management)
159  {
160  management_notify(management, "info", c->sig->signal_text, m);
161  }
162 #endif
163  }
164 }
165 
166 #if P2MP_SERVER
167 
181 static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
182  int msglevel, const char *fmt, ...)
183 #ifdef __GNUC__
184 #if __USE_MINGW_ANSI_STDIO
185 __attribute__ ((format(gnu_printf, 4, 5)))
186 #else
187 __attribute__ ((format(__printf__, 4, 5)))
188 #endif
189 #endif
190 ;
191 
192 /*
193  * Send auth failed message from server to client.
194  */
195 void
196 send_auth_failed(struct context *c, const char *client_reason)
197 {
198  struct gc_arena gc = gc_new();
199  static const char auth_failed[] = "AUTH_FAILED";
200  size_t len;
201 
203 
204  len = (client_reason ? strlen(client_reason)+1 : 0) + sizeof(auth_failed);
205  if (len > PUSH_BUNDLE_SIZE)
206  {
207  len = PUSH_BUNDLE_SIZE;
208  }
209 
210  {
211  struct buffer buf = alloc_buf_gc(len, &gc);
212  buf_printf(&buf, auth_failed);
213  if (client_reason)
214  {
215  buf_printf(&buf, ",%s", client_reason);
216  }
218  }
219 
220  gc_free(&gc);
221 }
222 
223 /*
224  * Send restart message from server to client.
225  */
226 void
227 send_restart(struct context *c, const char *kill_msg)
228 {
230  send_control_channel_string(c, kill_msg ? kill_msg : "RESTART", D_PUSH);
231 }
232 
233 #endif /* if P2MP_SERVER */
234 
235 /*
236  * Push/Pull
237  */
238 
239 void
240 incoming_push_message(struct context *c, const struct buffer *buffer)
241 {
242  struct gc_arena gc = gc_new();
243  unsigned int option_types_found = 0;
244  int status;
245 
246  msg(D_PUSH, "PUSH: Received control message: '%s'", sanitize_control_message(BSTR(buffer), &gc));
247 
248  status = process_incoming_push_msg(c,
249  buffer,
250  c->options.pull,
252  &option_types_found);
253 
254  if (status == PUSH_MSG_ERROR)
255  {
256  msg(D_PUSH_ERRORS, "WARNING: Received bad push/pull message: %s", sanitize_control_message(BSTR(buffer), &gc));
257  }
258  else if (status == PUSH_MSG_REPLY || status == PUSH_MSG_CONTINUATION)
259  {
260  c->options.push_option_types_found |= option_types_found;
261 
262  /* delay bringing tun/tap up until --push parms received from remote */
263  if (status == PUSH_MSG_REPLY)
264  {
265  if (!do_up(c, true, c->options.push_option_types_found))
266  {
267  msg(D_PUSH_ERRORS, "Failed to open tun/tap interface");
268  goto error;
269  }
270  }
272  }
273  else if (status == PUSH_MSG_REQUEST)
274  {
275  if (c->options.mode == MODE_SERVER)
276  {
278  /* Do not regenerate keys if client send a second push request */
280  && !tls_session_update_crypto_params(session, &c->options,
281  &c->c2.frame))
282  {
283  msg(D_TLS_ERRORS, "TLS Error: initializing data channel failed");
284  goto error;
285  }
286  }
287  }
288 
289  goto cleanup;
290 error:
291  register_signal(c, SIGUSR1, "process-push-msg-failed");
292 cleanup:
293  gc_free(&gc);
294 }
295 
296 bool
298 {
299  const int max_push_requests = c->options.handshake_window / PUSH_REQUEST_INTERVAL;
300  if (++c->c2.n_sent_push_requests <= max_push_requests)
301  {
302  return send_control_channel_string(c, "PUSH_REQUEST", D_PUSH);
303  }
304  else
305  {
306  msg(D_STREAM_ERRORS, "No reply from server after sending %d push requests", max_push_requests);
307  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
308  c->sig->signal_text = "no-push-reply";
309  return false;
310  }
311 }
312 
313 #if P2MP_SERVER
314 
324 static bool
325 prepare_push_reply(struct context *c, struct gc_arena *gc,
326  struct push_list *push_list)
327 {
328  const char *optstr = NULL;
329  struct tls_multi *tls_multi = c->c2.tls_multi;
330  const char *const peer_info = tls_multi->peer_info;
331  struct options *o = &c->options;
332 
333  /* ipv6 */
335  {
336  push_option_fmt(gc, push_list, M_USAGE, "ifconfig-ipv6 %s/%d %s",
340  0, gc));
341  }
342 
343  /* ipv4 */
346  {
349  {
350  ifconfig_local = c->c2.push_ifconfig_local_alias;
351  }
352  push_option_fmt(gc, push_list, M_USAGE, "ifconfig %s %s",
353  print_in_addr_t(ifconfig_local, 0, gc),
355  0, gc));
356  }
357 
358  /* Send peer-id if client supports it */
359  optstr = peer_info ? strstr(peer_info, "IV_PROTO=") : NULL;
360  if (optstr)
361  {
362  int proto = 0;
363  int r = sscanf(optstr, "IV_PROTO=%d", &proto);
364  if ((r == 1) && (proto >= 2))
365  {
366  push_option_fmt(gc, push_list, M_USAGE, "peer-id %d",
367  tls_multi->peer_id);
368  }
369  }
370 
371  /* Push cipher if client supports Negotiable Crypto Parameters */
372  if (tls_peer_info_ncp_ver(peer_info) >= 2 && o->ncp_enabled)
373  {
374  /* if we have already created our key, we cannot *change* our own
375  * cipher -> so log the fact and push the "what we have now" cipher
376  * (so the client is always told what we expect it to use)
377  */
378  const struct tls_session *session = &tls_multi->session[TM_ACTIVE];
380  {
381  msg( M_INFO, "PUSH: client wants to negotiate cipher (NCP), but "
382  "server has already generated data channel keys, "
383  "re-sending previously negotiated cipher '%s'",
384  o->ciphername );
385  }
386  else
387  {
388  /* Push the first cipher from --ncp-ciphers to the client.
389  * TODO: actual negotiation, instead of server dictatorship. */
390  char *push_cipher = string_alloc(o->ncp_ciphers, &o->gc);
391  o->ciphername = strtok(push_cipher, ":");
392  }
393  push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
394  }
395  else if (o->ncp_enabled)
396  {
397  tls_poor_mans_ncp(o, tls_multi->remote_ciphername);
398  }
399 
400  /* If server uses --auth-gen-token and we have an auth token
401  * to send to the client
402  */
403  if (false == tls_multi->auth_token_sent && NULL != tls_multi->auth_token)
404  {
405  push_option_fmt(gc, push_list, M_USAGE,
406  "auth-token %s", tls_multi->auth_token);
407  tls_multi->auth_token_sent = true;
408  }
409  return true;
410 }
411 
412 static bool
413 send_push_options(struct context *c, struct buffer *buf,
414  struct push_list *push_list, int safe_cap,
415  bool *push_sent, bool *multi_push)
416 {
417  struct push_entry *e = push_list->head;
418 
419  while (e)
420  {
421  if (e->enable)
422  {
423  const int l = strlen(e->option);
424  if (BLEN(buf) + l >= safe_cap)
425  {
426  buf_printf(buf, ",push-continuation 2");
427  {
428  const bool status = send_control_channel_string(c, BSTR(buf), D_PUSH);
429  if (!status)
430  {
431  return false;
432  }
433  *push_sent = true;
434  *multi_push = true;
435  buf_reset_len(buf);
436  buf_printf(buf, "%s", push_reply_cmd);
437  }
438  }
439  if (BLEN(buf) + l >= safe_cap)
440  {
441  msg(M_WARN, "--push option is too long");
442  return false;
443  }
444  buf_printf(buf, ",%s", e->option);
445  }
446  e = e->next;
447  }
448  return true;
449 }
450 
451 static bool
452 send_push_reply(struct context *c, struct push_list *per_client_push_list)
453 {
454  struct gc_arena gc = gc_new();
455  struct buffer buf = alloc_buf_gc(PUSH_BUNDLE_SIZE, &gc);
456  bool multi_push = false;
457  const int extra = 84; /* extra space for possible trailing ifconfig and push-continuation */
458  const int safe_cap = BCAP(&buf) - extra;
459  bool push_sent = false;
460 
461  buf_printf(&buf, "%s", push_reply_cmd);
462 
463  /* send options which are common to all clients */
464  if (!send_push_options(c, &buf, &c->options.push_list, safe_cap,
465  &push_sent, &multi_push))
466  {
467  goto fail;
468  }
469 
470  /* send client-specific options */
471  if (!send_push_options(c, &buf, per_client_push_list, safe_cap,
472  &push_sent, &multi_push))
473  {
474  goto fail;
475  }
476 
477  if (multi_push)
478  {
479  buf_printf(&buf, ",push-continuation 1");
480  }
481 
482  if (BLEN(&buf) > sizeof(push_reply_cmd)-1)
483  {
484  const bool status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
485  if (!status)
486  {
487  goto fail;
488  }
489  push_sent = true;
490  }
491 
492  /* If nothing have been pushed, send an empty push,
493  * as the client is expecting a response
494  */
495  if (!push_sent)
496  {
497  bool status = false;
498 
499  buf_reset_len(&buf);
500  buf_printf(&buf, "%s", push_reply_cmd);
501  status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
502  if (!status)
503  {
504  goto fail;
505  }
506  }
507 
508  gc_free(&gc);
509  return true;
510 
511 fail:
512  gc_free(&gc);
513  return false;
514 }
515 
516 static void
517 push_option_ex(struct gc_arena *gc, struct push_list *push_list,
518  const char *opt, bool enable, int msglevel)
519 {
520  if (!string_class(opt, CC_ANY, CC_COMMA))
521  {
522  msg(msglevel, "PUSH OPTION FAILED (illegal comma (',') in string): '%s'", opt);
523  }
524  else
525  {
526  struct push_entry *e;
527  ALLOC_OBJ_CLEAR_GC(e, struct push_entry, gc);
528  e->enable = true;
529  e->option = opt;
530  if (push_list->head)
531  {
532  ASSERT(push_list->tail);
533  push_list->tail->next = e;
534  push_list->tail = e;
535  }
536  else
537  {
538  ASSERT(!push_list->tail);
539  push_list->head = e;
540  push_list->tail = e;
541  }
542  }
543 }
544 
545 void
546 push_option(struct options *o, const char *opt, int msglevel)
547 {
548  push_option_ex(&o->gc, &o->push_list, opt, true, msglevel);
549 }
550 
551 void
553 {
554  if (o->push_list.head)
555  {
556  const struct push_entry *e = o->push_list.head;
557  push_reset(o);
558  while (e)
559  {
560  push_option_ex(&o->gc, &o->push_list,
561  string_alloc(e->option, &o->gc), true, M_FATAL);
562  e = e->next;
563  }
564  }
565 }
566 
567 void
568 push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
569 {
570  const char **argv = make_extended_arg_array(p, gc);
571  char *opt = print_argv(argv, gc, 0);
572  push_option(o, opt, msglevel);
573 }
574 
575 static bool
576 push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
577  int msglevel, const char *format, ...)
578 {
579  va_list arglist;
580  char tmp[256] = {0};
581  int len;
582  va_start(arglist, format);
583  len = vsnprintf(tmp, sizeof(tmp), format, arglist);
584  va_end(arglist);
585  if (len > sizeof(tmp)-1)
586  {
587  return false;
588  }
589  push_option_ex(gc, push_list, string_alloc(tmp, gc), true, msglevel);
590  return true;
591 }
592 
593 void
594 push_reset(struct options *o)
595 {
596  CLEAR(o->push_list);
597 }
598 
599 void
600 push_remove_option(struct options *o, const char *p)
601 {
602  msg(D_PUSH_DEBUG, "PUSH_REMOVE searching for: '%s'", p);
603 
604  /* ifconfig-ipv6 is special, as not part of the push list */
605  if (streq( p, "ifconfig-ipv6" ))
606  {
607  o->push_ifconfig_ipv6_blocked = true;
608  return;
609  }
610 
611  if (o && o->push_list.head)
612  {
613  struct push_entry *e = o->push_list.head;
614 
615  /* cycle through the push list */
616  while (e)
617  {
618  if (e->enable
619  && strncmp( e->option, p, strlen(p) ) == 0)
620  {
621  msg(D_PUSH_DEBUG, "PUSH_REMOVE removing: '%s'", e->option);
622  e->enable = false;
623  }
624 
625  e = e->next;
626  }
627  }
628 }
629 #endif /* if P2MP_SERVER */
630 
631 #if P2MP_SERVER
632 int
634 {
635  int ret = PUSH_MSG_ERROR;
636 
637 #ifdef ENABLE_ASYNC_PUSH
638  c->c2.push_request_received = true;
639 #endif
641  {
642  const char *client_reason = tls_client_reason(c->c2.tls_multi);
643  send_auth_failed(c, client_reason);
644  ret = PUSH_MSG_AUTH_FAILURE;
645  }
646  else if (!c->c2.push_reply_deferred && c->c2.context_auth == CAS_SUCCEEDED)
647  {
648  time_t now;
649 
650  openvpn_time(&now);
651  if (c->c2.sent_push_reply_expiry > now)
652  {
654  }
655  else
656  {
657  /* per-client push options - peer-id, cipher, ifconfig, ipv6-ifconfig */
658  struct push_list push_list;
659  struct gc_arena gc = gc_new();
660 
661  CLEAR(push_list);
662  if (prepare_push_reply(c, &gc, &push_list)
663  && send_push_reply(c, &push_list))
664  {
665  ret = PUSH_MSG_REQUEST;
666  c->c2.sent_push_reply_expiry = now + 30;
667  }
668  gc_free(&gc);
669  }
670  }
671  else
672  {
674  }
675 
676  return ret;
677 }
678 #endif /* if P2MP_SERVER */
679 
680 static void
681 push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
682 {
683  char line[OPTION_PARM_SIZE];
684  while (buf_parse(buf, ',', line, sizeof(line)))
685  {
686  /* peer-id might change on restart and this should not trigger reopening tun */
687  if (strprefix(line, "peer-id "))
688  {
689  continue;
690  }
691  /* tun reopen only needed if cipher change can change tun MTU */
692  if (strprefix(line, "cipher ") && !opt->ce.tun_mtu_defined)
693  {
694  continue;
695  }
696  md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
697  }
698 }
699 
700 int
702  const struct buffer *buffer,
703  bool honor_received_options,
704  unsigned int permission_mask,
705  unsigned int *option_types_found)
706 {
707  int ret = PUSH_MSG_ERROR;
708  struct buffer buf = *buffer;
709 
710 #if P2MP_SERVER
711  if (buf_string_compare_advance(&buf, "PUSH_REQUEST"))
712  {
714  }
715  else
716 #endif
717 
718  if (honor_received_options && buf_string_compare_advance(&buf, "PUSH_REPLY"))
719  {
720  const uint8_t ch = buf_read_u8(&buf);
721  if (ch == ',')
722  {
723  struct buffer buf_orig = buf;
725  {
729  }
730  if (!c->c2.did_pre_pull_restore)
731  {
732  pre_pull_restore(&c->options, &c->c2.gc);
733  c->c2.did_pre_pull_restore = true;
734  }
735  if (apply_push_options(&c->options,
736  &buf,
737  permission_mask,
738  option_types_found,
739  c->c2.es))
740  {
742  &c->options);
743  switch (c->options.push_continuation)
744  {
745  case 0:
746  case 1:
750  c->c2.pulled_options_state = NULL;
752  ret = PUSH_MSG_REPLY;
753  break;
754 
755  case 2:
756  ret = PUSH_MSG_CONTINUATION;
757  break;
758  }
759  }
760  }
761  else if (ch == '\0')
762  {
763  ret = PUSH_MSG_REPLY;
764  }
765  /* show_settings (&c->options); */
766  }
767  return ret;
768 }
769 
770 #if P2MP_SERVER
771 
772 /*
773  * Remove iroutes from the push_list.
774  */
775 void
777 {
778  if (o && o->push_list.head && o->iroutes)
779  {
780  struct gc_arena gc = gc_new();
781  struct push_entry *e = o->push_list.head;
782 
783  /* cycle through the push list */
784  while (e)
785  {
786  char *p[MAX_PARMS];
787  bool enable = true;
788 
789  /* parse the push item */
790  CLEAR(p);
791  if (e->enable
792  && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
793  {
794  /* is the push item a route directive? */
795  if (p[0] && !strcmp(p[0], "route") && !p[3])
796  {
797  /* get route parameters */
798  bool status1, status2;
799  const in_addr_t network = getaddr(GETADDR_HOST_ORDER, p[1], 0, &status1, NULL);
800  const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, p[2] ? p[2] : "255.255.255.255", 0, &status2, NULL);
801 
802  /* did route parameters parse correctly? */
803  if (status1 && status2)
804  {
805  const struct iroute *ir;
806 
807  /* does route match an iroute? */
808  for (ir = o->iroutes; ir != NULL; ir = ir->next)
809  {
810  if (network == ir->network && netmask == netbits_to_netmask(ir->netbits >= 0 ? ir->netbits : 32))
811  {
812  enable = false;
813  break;
814  }
815  }
816  }
817  }
818 
819  /* should we copy the push item? */
820  e->enable = enable;
821  if (!enable)
822  {
823  msg(D_PUSH, "REMOVE PUSH ROUTE: '%s'", e->option);
824  }
825  }
826 
827  e = e->next;
828  }
829 
830  gc_free(&gc);
831  }
832 }
833 
834 #endif /* if P2MP_SERVER */
835 
836 #endif /* if P2MP */
struct env_set * es
Definition: openvpn.h:435
bool string_class(const char *str, const unsigned int inclusive, const unsigned int exclusive)
Definition: buffer.c:1000
static bool prepare_push_reply(struct context *c, struct gc_arena *gc, struct push_list *push_list)
Prepare push options, based on local options and available peer info.
Definition: push.c:325
void receive_auth_failed(struct context *c, const struct buffer *buffer)
Definition: push.c:51
static void buf_reset_len(struct buffer *buf)
Definition: buffer.h:294
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:458
bool tun_mtu_defined
Definition: options.h:110
void send_restart(struct context *c, const char *kill_msg)
Definition: push.c:227
bool ncp_enabled
Definition: options.h:477
struct key_state key[KS_SIZE]
Definition: ssl_common.h:438
struct iroute * next
Definition: route.h:233
static const char * tls_client_reason(struct tls_multi *multi)
Definition: ssl_verify.h:234
md_ctx_t * md_ctx_new(void)
struct options options
Options loaded from command line or configuration file.
Definition: openvpn.h:510
#define PUSH_MSG_CONTINUATION
Definition: push.h:36
bool push_ifconfig_ipv6_blocked
Definition: options.h:436
void ssl_put_auth_challenge(const char *cr_str)
Definition: ssl.c:504
char * string_alloc(const char *str, struct gc_arena *gc)
Definition: buffer.c:626
#define streq(x, y)
Definition: options.h:613
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, volatile int *signal_received)
Definition: socket.c:84
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:613
struct push_entry * head
Definition: pushlist.h:36
bool do_up(struct context *c, bool pulled_options, unsigned int option_types_found)
Definition: init.c:2038
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2855
#define M_INFO
Definition: errlevel.h:55
void clone_push_list(struct options *o)
Definition: push.c:552
Contains all state information for one tunnel.
Definition: openvpn.h:508
#define UP_TYPE_AUTH
Definition: ssl_common.h:41
#define SIZE(x)
Definition: basic.h:30
#define PUSH_BUNDLE_SIZE
Definition: common.h:84
#define D_PUSH
Definition: errlevel.h:83
bool push_ifconfig_defined
Definition: openvpn.h:449
char * peer_info
Definition: ssl_common.h:552
static void gc_free(struct gc_arena *a)
Definition: buffer.h:990
void send_auth_failed(struct context *c, const char *client_reason)
Definition: push.c:196
bool send_control_channel_string(struct context *c, const char *str, int msglevel)
Definition: forward.c:249
void management_auth_failure(struct management *man, const char *type, const char *reason)
Definition: manage.c:2987
in_addr_t push_ifconfig_local
Definition: openvpn.h:451
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:496
#define D_TLS_ERRORS
Definition: errlevel.h:59
void management_notify(struct management *man, const char *severity, const char *type, const char *text)
Definition: manage.c:2816
#define ASSERT(x)
Definition: error.h:221
int tls_authentication_status(struct tls_multi *multi, const int latency)
Definition: ssl_verify.c:936
#define SIGUSR1
Definition: config-msvc.h:116
bool pulled_options_digest_init_done
Definition: openvpn.h:474
struct in6_addr push_ifconfig_ipv6_local
Definition: openvpn.h:456
static in_addr_t netbits_to_netmask(const int netbits)
Definition: route.h:367
void push_reset(struct options *o)
Definition: push.c:594
#define AR_NONE
Definition: options.h:799
void md_ctx_free(md_ctx_t *ctx)
struct in6_addr push_ifconfig_ipv6_remote
Definition: openvpn.h:458
#define M_FATAL
Definition: error.h:94
bool buf_printf(struct buffer *buf, const char *format,...)
Definition: buffer.c:223
static void event_timeout_clear(struct event_timeout *et)
Definition: interval.h:150
#define CLEAR(x)
Definition: basic.h:33
#define in_addr_t
Definition: config-msvc.h:104
static int buf_read_u8(struct buffer *buf)
Definition: buffer.h:786
struct signal_info * sig
Internal error signaling object.
Definition: openvpn.h:533
#define MAX_PARMS
Definition: options.h:53
struct push_entry * next
Definition: pushlist.h:30
int parse_line(const char *line, char *p[], const int n, const char *file, const int line_num, int msglevel, struct gc_arena *gc)
Definition: options.c:4219
bool did_pre_pull_restore
Definition: openvpn.h:471
char * print_argv(const char **p, struct gc_arena *gc, const unsigned int flags)
Definition: buffer.c:695
#define SIGTERM
Definition: config-msvc.h:118
int handshake_window
Definition: options.h:554
struct gc_arena gc
Garbage collection arena for allocations done in the level 2 scope of this context_2 structure...
Definition: openvpn.h:230
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer...
Definition: ssl_common.h:571
int scheduled_exit_interval
Definition: options.h:464
int context_auth
Definition: openvpn.h:466
#define MODE_SERVER
Definition: options.h:179
bool send_push_request(struct context *c)
Definition: push.c:297
bool initialized
Definition: crypto.h:227
int netbits
Definition: route.h:232
#define BCAP(buf)
Definition: buffer.h:130
#define CC_COMMA
Definition: buffer.h:895
const char * ncp_ciphers
Definition: options.h:478
Definition: pushlist.h:29
static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list, int msglevel, const char *fmt,...)
Add an option to the given push list by providing a format string.
Definition: push.c:576
void md_ctx_final(md_ctx_t *ctx, uint8_t *dst)
void push_remove_option(struct options *o, const char *p)
Definition: push.c:600
#define PUSH_MSG_REPLY
Definition: push.h:33
md_ctx_t * pulled_options_state
Definition: openvpn.h:475
static bool send_push_reply(struct context *c, struct push_list *per_client_push_list)
Definition: push.c:452
#define PUSH_MSG_REQUEST
Definition: push.h:32
#define OPTION_PARM_SIZE
Definition: options.h:58
static char push_reply_cmd[]
Definition: push.c:42
int process_incoming_push_msg(struct context *c, const struct buffer *buffer, bool honor_received_options, unsigned int permission_mask, unsigned int *option_types_found)
Definition: push.c:701
void md_ctx_update(md_ctx_t *ctx, const uint8_t *src, int src_len)
int mode
Definition: options.h:180
#define PUSH_MSG_REQUEST_DEFERRED
Definition: push.h:34
void pre_pull_restore(struct options *o, struct gc_arena *gc)
Definition: options.c:3394
static struct gc_arena gc_new(void)
Definition: buffer.h:982
#define KS_PRIMARY
Primary key state index.
Definition: ssl_common.h:370
time_t now
Definition: otime.c:36
in_addr_t push_ifconfig_local_alias
Definition: openvpn.h:453
struct crypto_options crypto_options
Definition: ssl_common.h:181
#define M_USAGE
Definition: error.h:111
int auth_retry_get(void)
Definition: options.c:4013
static void push_option_ex(struct gc_arena *gc, struct push_list *push_list, const char *opt, bool enable, int msglevel)
Definition: push.c:517
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2835
struct iroute * iroutes
Definition: options.h:423
struct frame frame
Definition: openvpn.h:265
const char * option
Definition: pushlist.h:32
int push_ifconfig_ipv6_netbits
Definition: openvpn.h:457
void remove_iroutes_from_push_route_list(struct options *o)
Definition: push.c:776
uint8_t digest[SHA256_DIGEST_LENGTH]
Definition: crypto.h:135
const char * ciphername
Definition: options.h:476
void ssl_purge_auth(const bool auth_user_pass_only)
Definition: ssl.c:479
void push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
Definition: push.c:568
in_addr_t network
Definition: route.h:231
static SERVICE_STATUS status
Definition: automatic.c:47
static bool send_push_options(struct context *c, struct buffer *buf, struct push_list *push_list, int safe_cap, bool *push_sent, bool *multi_push)
Definition: push.c:413
bool tls_session_update_crypto_params(struct tls_session *session, struct options *options, struct frame *frame)
Update TLS session crypto parameters (cipher and auth) and derive data channel keys based on the supp...
Definition: ssl.c:1949
const char * sanitize_control_message(const char *src, struct gc_arena *gc)
Definition: misc.c:1467
const md_kt_t * md_kt_get(const char *digest)
Return message digest parameters, based on the given digest name.
static time_t openvpn_time(time_t *t)
Definition: otime.h:123
bool enable
Definition: pushlist.h:31
void incoming_push_message(struct context *c, const struct buffer *buffer)
Definition: push.c:240
#define GETADDR_HOST_ORDER
Definition: socket.h:522
char * remote_ciphername
cipher specified in peer&#39;s config file
Definition: ssl_common.h:559
struct connection_entry ce
Definition: options.h:203
struct context_2 c2
Level 2 context.
Definition: openvpn.h:547
struct push_list push_list
Definition: options.h:401
unsigned int pull_permission_mask(const struct context *c)
Definition: init.c:2115
time_t sent_push_reply_expiry
Definition: openvpn.h:450
#define TLS_AUTHENTICATION_FAILED
Definition: ssl_verify.h:71
void md_ctx_cleanup(md_ctx_t *ctx)
#define PUSH_MSG_AUTH_FAILURE
Definition: push.h:35
#define PUSH_MSG_ERROR
Definition: push.h:31
#define BLEN(buf)
Definition: buffer.h:127
void tls_poor_mans_ncp(struct options *o, const char *remote_ciphername)
"Poor man&#39;s NCP": Use peer cipher if it is an allowed (NCP) cipher.
Definition: ssl.c:1900
int push_continuation
Definition: options.h:459
struct event_timeout push_request_interval
Definition: openvpn.h:469
#define CAS_SUCCEEDED
Definition: openvpn.h:461
unsigned int push_option_types_found
Definition: options.h:460
unsigned __int8 uint8_t
Definition: config-msvc.h:123
bool no_advance
Definition: options.h:208
bool push_ifconfig_ipv6_defined
Definition: openvpn.h:455
volatile int signal_received
Definition: sig.h:45
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition: buffer.h:1054
#define PUSH_REQUEST_INTERVAL
Definition: common.h:89
char * auth_token
If server sends a generated auth-token, this is the token to use for future user/pass authentications...
Definition: ssl_common.h:561
bool buf_parse(struct buffer *buf, const int delim, char *line, const int size)
Definition: buffer.c:803
const char ** make_extended_arg_array(char **p, struct gc_arena *gc)
Definition: misc.c:1437
struct push_entry * tail
Definition: pushlist.h:37
void register_signal(struct context *c, int sig, const char *text)
Definition: sig.c:460
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition: crypto.h:236
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:400
struct sha256_digest pulled_options_digest
Definition: openvpn.h:476
bool push_reply_deferred
Definition: openvpn.h:445
#define CAS_FAILED
Definition: openvpn.h:463
int n_sent_push_requests
Definition: openvpn.h:470
#define msg
Definition: error.h:173
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
#define PUSH_MSG_ALREADY_REPLIED
Definition: push.h:37
void server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
Definition: push.c:107
static void push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
Definition: push.c:681
#define AR_NOINTERACT
Definition: options.h:801
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:88
uint32_t peer_id
Definition: ssl_common.h:556
Definition: route.h:230
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
void md_ctx_init(md_ctx_t *ctx, const md_kt_t *kt)
#define AR_INTERACT
Definition: options.h:800
const char * ifconfig_local
Definition: options.h:225
#define D_STREAM_ERRORS
Definition: errlevel.h:63
bool pull
Definition: options.h:458
int process_incoming_push_request(struct context *c)
Definition: push.c:633
#define BSTR(buf)
Definition: buffer.h:129
void push_option(struct options *o, const char *opt, int msglevel)
Definition: push.c:546
#define D_PUSH_DEBUG
Definition: errlevel.h:149
Definition: argv.h:35
struct gc_arena gc
Definition: options.h:171
#define M_VERB0
Definition: errlevel.h:53
int tls_peer_info_ncp_ver(const char *peer_info)
Return the Negotiable Crypto Parameters version advertised in the peer info string, or 0 if none specified.
Definition: ssl.c:4079
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:342
in_addr_t push_ifconfig_remote_netmask
Definition: openvpn.h:452
bool apply_push_options(struct options *options, struct buffer *buf, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition: options.c:4740
void schedule_exit(struct context *c, const int n_seconds, const int signal)
Definition: forward.c:367
#define CC_ANY
Definition: buffer.h:874
bool auth_token_sent
If server uses –auth-gen-token and token has been sent to client.
Definition: ssl_common.h:566
const char * signal_text
Definition: sig.h:47
static bool strprefix(const char *str, const char *prefix)
Return true iff str starts with prefix.
Definition: buffer.h:929
mbedtls_md_context_t md_ctx_t
Generic message digest context.
bool buf_string_match_head_str(const struct buffer *src, const char *match)
Definition: buffer.c:756
#define M_WARN
Definition: error.h:96
#define D_ROUTE_DEBUG
Definition: errlevel.h:129
bool buf_string_compare_advance(struct buffer *src, const char *match)
Definition: buffer.c:767
#define D_PUSH_ERRORS
Definition: errlevel.h:67