OpenVPN
mudp.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #endif
27 
28 #include "syshead.h"
29 
30 #include "multi.h"
31 #include <inttypes.h>
32 #include "forward.h"
33 
34 #include "memdbg.h"
35 #include "ssl_pkt.h"
36 
37 #ifdef HAVE_SYS_INOTIFY_H
38 #include <sys/inotify.h>
39 #endif
40 
41 static void
43  struct tls_pre_decrypt_state *state,
44  struct tls_auth_standalone *tas,
45  struct session_id *sid,
46  bool request_resend_wkc)
47 {
50  uint8_t header = 0 | (P_CONTROL_HARD_RESET_SERVER_V2 << P_OPCODE_SHIFT);
51  struct buffer buf = tls_reset_standalone(&state->tls_wrap_tmp, tas, sid,
52  &state->peer_session_id, header,
53  request_resend_wkc);
54 
55  struct context *c = &m->top;
56 
58  buf_copy(&c->c2.buffers->aux_buf, &buf);
59  m->hmac_reply = c->c2.buffers->aux_buf;
60  m->hmac_reply_dest = &m->top.c2.from;
61  msg(D_MULTI_DEBUG, "Reset packet from client, sending HMAC based reset challenge");
62 }
63 
64 
65 /* Returns true if this packet should create a new session */
66 static bool
68  struct tls_pre_decrypt_state *state,
69  struct mroute_addr addr)
70 {
72 
73  enum first_packet_verdict verdict;
74 
76 
77  verdict = tls_pre_decrypt_lite(tas, state, &m->top.c2.from, &m->top.c2.buf);
78 
79  hmac_ctx_t *hmac = m->top.c2.session_id_hmac;
80  struct openvpn_sockaddr *from = &m->top.c2.from.dest;
81  int handwindow = m->top.options.handshake_window;
82 
83  if (verdict == VERDICT_VALID_RESET_V3 || verdict == VERDICT_VALID_RESET_V2)
84  {
85  /* Check if we are still below our limit for sending out
86  * responses */
88  {
89  return false;
90  }
91  }
92 
93  if (verdict == VERDICT_VALID_RESET_V3)
94  {
95  /* Extract the packet id to check if it has the special format that
96  * indicates early negotiation support */
97  struct packet_id_net pin;
98  struct buffer tmp = m->top.c2.buf;
99  ASSERT(buf_advance(&tmp, 1 + SID_SIZE));
100  ASSERT(packet_id_read(&pin, &tmp, true));
101 
102  /* The most significant byte is 0x0f if early negotiation is supported */
103  bool early_neg_support = ((pin.id & EARLY_NEG_MASK) & EARLY_NEG_START) == EARLY_NEG_START;
104 
105  /* All clients that support early negotiation and tls-crypt are assumed
106  * to also support resending the WKc in the 2nd packet */
107  if (early_neg_support)
108  {
109  /* Calculate the session ID HMAC for our reply and create reset packet */
111  from, hmac, handwindow, 0);
112  send_hmac_reset_packet(m, state, tas, &sid, true);
113 
114  return false;
115  }
116  else
117  {
118  /* For tls-crypt-v2 we need to keep the state of the first packet
119  * to store the unwrapped key if the client doesn't support resending
120  * the wrapped key. Unless the user specifically disallowed
121  * compatibility with such clients to avoid state exhaustion */
123  {
124  struct gc_arena gc = gc_new();
125  const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
126  msg(D_MULTI_DEBUG, "tls-crypt-v2 force-cookie is enabled, "
127  "ignoring connection attempt from old client (%s)", peer);
128  gc_free(&gc);
129  return false;
130  }
131  else
132  {
133  return true;
134  }
135  }
136  }
137  else if (verdict == VERDICT_VALID_RESET_V2)
138  {
139  /* Calculate the session ID HMAC for our reply and create reset packet */
141  from, hmac, handwindow, 0);
142 
143  send_hmac_reset_packet(m, state, tas, &sid, false);
144 
145  /* We have a reply do not create a new session */
146  return false;
147 
148  }
149  else if (verdict == VERDICT_VALID_CONTROL_V1 || verdict == VERDICT_VALID_ACK_V1
150  || verdict == VERDICT_VALID_WKC_V1)
151  {
152  /* ACK_V1 contains the peer id (our id) while CONTROL_V1 can but does not
153  * need to contain the peer id */
154  struct gc_arena gc = gc_new();
155 
156  bool ret = check_session_id_hmac(state, from, hmac, handwindow);
157 
158  const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
159  uint8_t pkt_firstbyte = *BPTR( &m->top.c2.buf);
160  int op = pkt_firstbyte >> P_OPCODE_SHIFT;
161 
162  if (!ret)
163  {
164  msg(D_MULTI_MEDIUM, "Packet (%s) with invalid or missing SID from %s",
165  packet_opcode_name(op), peer);
166  }
167  else
168  {
169  msg(D_MULTI_DEBUG, "Valid packet (%s) with HMAC challenge from peer (%s), "
170  "accepting new connection.", packet_opcode_name(op), peer);
171  }
172  gc_free(&gc);
173 
174  return ret;
175  }
176 
177  /* VERDICT_INVALID */
178  return false;
179 }
180 
181 /*
182  * Get a client instance based on real address. If
183  * the instance doesn't exist, create it while
184  * maintaining real address hash table atomicity.
185  */
186 
187 struct multi_instance *
189 {
190  struct gc_arena gc = gc_new();
191  struct mroute_addr real = {0};
192  struct multi_instance *mi = NULL;
193  struct hash *hash = m->hash;
194 
195  if (mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true)
196  && m->top.c2.buf.len > 0)
197  {
198  struct hash_element *he;
199  const uint32_t hv = hash_value(hash, &real);
200  struct hash_bucket *bucket = hash_bucket(hash, hv);
201  uint8_t *ptr = BPTR(&m->top.c2.buf);
202  uint8_t op = ptr[0] >> P_OPCODE_SHIFT;
203  bool v2 = (op == P_DATA_V2) && (m->top.c2.buf.len >= (1 + 3));
204  bool peer_id_disabled = false;
205 
206  /* make sure buffer has enough length to read opcode (1 byte) and peer-id (3 bytes) */
207  if (v2)
208  {
209  uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFFFFFF;
210  peer_id_disabled = (peer_id == MAX_PEER_ID);
211 
212  if (!peer_id_disabled && (peer_id < m->max_clients) && (m->instances[peer_id]))
213  {
214  mi = m->instances[peer_id];
215 
216  *floated = !link_socket_actual_match(&mi->context.c2.from, &m->top.c2.from);
217 
218  if (*floated)
219  {
220  /* reset prefix, since here we are not sure peer is the one it claims to be */
221  ungenerate_prefix(mi);
222  msg(D_MULTI_MEDIUM, "Float requested for peer %" PRIu32 " to %s", peer_id,
223  mroute_addr_print(&real, &gc));
224  }
225  }
226  }
227  if (!v2 || peer_id_disabled)
228  {
229  he = hash_lookup_fast(hash, bucket, &real, hv);
230  if (he)
231  {
232  mi = (struct multi_instance *) he->value;
233  }
234  }
235 
236  /* we have no existing multi instance for this connection */
237  if (!mi)
238  {
239  struct tls_pre_decrypt_state state = {0};
241  {
243  "MULTI: Connection attempt from %s ignored while server is "
244  "shutting down", mroute_addr_print(&real, &gc));
245  }
246  else if (do_pre_decrypt_check(m, &state, real))
247  {
248  /* This is an unknown session but with valid tls-auth/tls-crypt
249  * (or no auth at all). If this is the initial packet of a
250  * session, we just send a reply with a HMAC session id and
251  * do not generate a session slot */
252 
254  {
255  /* a successful three-way handshake only counts against
256  * connect-freq but not against connect-freq-initial */
258 
259  mi = multi_create_instance(m, &real);
260  if (mi)
261  {
262  hash_add_fast(hash, bucket, &mi->real, hv, mi);
263  mi->did_real_hash = true;
264  multi_assign_peer_id(m, mi);
265 
266  /* If we have a session id already, ensure that the
267  * state is using the same */
269  && session_id_defined((&state.peer_session_id)))
270  {
274  }
275  }
276  }
277  else
278  {
280  "MULTI: Connection from %s would exceed new connection frequency limit as controlled by --connect-freq",
281  mroute_addr_print(&real, &gc));
282  }
283  }
285  }
286 
287 #ifdef ENABLE_DEBUG
289  {
290  const char *status = mi ? "[ok]" : "[failed]";
291 
292  dmsg(D_MULTI_DEBUG, "GET INST BY REAL: %s %s",
293  mroute_addr_print(&real, &gc),
294  status);
295  }
296 #endif
297  }
298 
299  gc_free(&gc);
300  ASSERT(!(mi && mi->halt));
301  return mi;
302 }
303 
304 /*
305  * Send a packet to UDP socket.
306  */
307 static inline void
308 multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
309 {
311  if (mi)
312  {
313  multi_process_outgoing_link_dowork(m, mi, mpp_flags);
314  }
315  if (m->hmac_reply_dest && m->hmac_reply.len > 0)
316  {
317  msg_set_prefix("Connection Attempt");
318  m->top.c2.to_link = m->hmac_reply;
321  m->hmac_reply_dest = NULL;
322  }
323 }
324 
325 /*
326  * Process an I/O event.
327  */
328 static void
330 {
331  const unsigned int status = m->top.c2.event_set_status;
332  const unsigned int mpp_flags = m->top.c2.fast_io
335 
336 #ifdef MULTI_DEBUG_EVENT_LOOP
337  char buf[16];
338  buf[0] = 0;
339  if (status & SOCKET_READ)
340  {
341  strcat(buf, "SR/");
342  }
343  else if (status & SOCKET_WRITE)
344  {
345  strcat(buf, "SW/");
346  }
347  else if (status & TUN_READ)
348  {
349  strcat(buf, "TR/");
350  }
351  else if (status & TUN_WRITE)
352  {
353  strcat(buf, "TW/");
354  }
355  else if (status & FILE_CLOSED)
356  {
357  strcat(buf, "FC/");
358  }
359  printf("IO %s\n", buf);
360 #endif /* ifdef MULTI_DEBUG_EVENT_LOOP */
361 
362 #ifdef ENABLE_MANAGEMENT
364  {
367  }
368 #endif
369 
370  /* UDP port ready to accept write */
371  if (status & SOCKET_WRITE)
372  {
373  multi_process_outgoing_link(m, mpp_flags);
374  }
375  /* TUN device ready to accept write */
376  else if (status & TUN_WRITE)
377  {
378  multi_process_outgoing_tun(m, mpp_flags);
379  }
380  /* Incoming data on UDP port */
381  else if (status & SOCKET_READ)
382  {
383  read_incoming_link(&m->top);
384  if (!IS_SIG(&m->top))
385  {
386  multi_process_incoming_link(m, NULL, mpp_flags);
387  }
388  }
389  /* Incoming data on TUN device */
390  else if (status & TUN_READ)
391  {
392  read_incoming_tun(&m->top);
393  if (!IS_SIG(&m->top))
394  {
395  multi_process_incoming_tun(m, mpp_flags);
396  }
397  }
398 #ifdef ENABLE_ASYNC_PUSH
399  /* INOTIFY callback */
400  else if (status & FILE_CLOSED)
401  {
402  multi_process_file_closed(m, mpp_flags);
403  }
404 #endif
405 #if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD))
406  else if (status & DCO_READ)
407  {
408  if (!IS_SIG(&m->top))
409  {
410  bool ret = true;
411  while (ret)
412  {
414  }
415  }
416  }
417 #endif
418 }
419 
420 /*
421  * Return the io_wait() flags appropriate for
422  * a point-to-multipoint tunnel.
423  */
424 static inline unsigned int
426 {
427  unsigned int flags = IOW_WAIT_SIGNAL;
428  if (m->pending)
429  {
430  if (TUN_OUT(&m->pending->context))
431  {
432  flags |= IOW_TO_TUN;
433  }
434  if (LINK_OUT(&m->pending->context))
435  {
436  flags |= IOW_TO_LINK;
437  }
438  }
439  else if (mbuf_defined(m->mbuf))
440  {
441  flags |= IOW_MBUF;
442  }
443  else if (m->hmac_reply_dest)
444  {
445  flags |= IOW_TO_LINK;
446  }
447  else
448  {
449  flags |= IOW_READ;
450  }
451 #ifdef _WIN32
452  if (tuntap_ring_empty(m->top.c1.tuntap))
453  {
454  flags &= ~IOW_READ_TUN;
455  }
456 #endif
457  return flags;
458 }
459 
460 
461 void
463 {
464  struct multi_context multi;
465 
466  top->mode = CM_TOP;
468 
469  /* initialize top-tunnel instance */
471  if (IS_SIG(top))
472  {
473  return;
474  }
475 
476  /* initialize global multi_context object */
477  multi_init(&multi, top, false);
478 
479  /* initialize our cloned top object */
480  multi_top_init(&multi, top);
481 
482  /* initialize management interface */
484 
485  /* finished with initialization */
486  initialization_sequence_completed(top, ISC_SERVER); /* --mode server --proto udp */
487 
488 #ifdef ENABLE_ASYNC_PUSH
489  multi.top.c2.inotify_fd = inotify_init();
490  if (multi.top.c2.inotify_fd < 0)
491  {
492  msg(D_MULTI_ERRORS | M_ERRNO, "MULTI: inotify_init error");
493  }
494 #endif
495 
496  /* per-packet event loop */
497  while (true)
498  {
500 
501  /* set up and do the io_wait() */
502  multi_get_timeout(&multi, &multi.top.c2.timeval);
503  io_wait(&multi.top, p2mp_iow_flags(&multi));
504  MULTI_CHECK_SIG(&multi);
505 
506  /* check on status of coarse timers */
508 
509  /* timeout? */
510  if (multi.top.c2.event_set_status == ES_TIMEOUT)
511  {
513  }
514  else
515  {
516  /* process I/O */
517  multi_process_io_udp(&multi);
518  MULTI_CHECK_SIG(&multi);
519  }
520 
521  perf_pop();
522  }
523 
524 #ifdef ENABLE_ASYNC_PUSH
525  close(top->c2.inotify_fd);
526 #endif
527 
528  /* shut down management interface */
530 
531  /* save ifconfig-pool */
532  multi_ifconfig_pool_persist(&multi, true);
533 
534  /* tear down tunnel instance (unless --persist-tun) */
535  multi_uninit(&multi);
536  multi_top_free(&multi);
538 }
context_2::event_set_status
unsigned int event_set_status
Definition: openvpn.h:238
context_2::tls_auth_standalone
struct tls_auth_standalone * tls_auth_standalone
TLS state structure required for the initial authentication of a client's connection attempt.
Definition: openvpn.h:329
VERDICT_VALID_RESET_V2
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition: ssl_pkt.h:86
P_DATA_V2
#define P_DATA_V2
Definition: ssl_pkt.h:48
multi_instance
Server-mode state structure for one single VPN tunnel.
Definition: multi.h:101
multi_instance::halt
bool halt
Definition: multi.h:106
multi_process_incoming_dco
bool multi_process_incoming_dco(struct multi_context *m)
Process an incoming DCO message (from kernel space).
mbuf_defined
static bool mbuf_defined(const struct mbuf_set *ms)
Definition: mbuf.h:80
MPP_CLOSE_ON_SIGNAL
#define MPP_CLOSE_ON_SIGNAL
Definition: multi.h:289
hash_bucket
static struct hash_bucket * hash_bucket(struct hash *hash, uint32_t hv)
Definition: list.h:141
TUN_READ
#define TUN_READ
Definition: event.h:65
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:1031
hmac_ctx_t
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
Definition: crypto_mbedtls.h:46
M_ERRNO
#define M_ERRNO
Definition: error.h:100
context_2::to_link
struct buffer to_link
Definition: openvpn.h:380
context_2::tls_multi
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:326
forward.h
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition: buffer.h:66
p2mp_iow_flags
static unsigned int p2mp_iow_flags(const struct multi_context *m)
Definition: mudp.c:425
context_2::buf
struct buffer buf
Definition: openvpn.h:378
reflect_filter_rate_limit_check
bool reflect_filter_rate_limit_check(struct initial_packet_rate_limit *irl)
checks if the connection is still allowed to connect under the rate limit.
Definition: reflect_filter.c:43
tunnel_server_udp
void tunnel_server_udp(struct context *top)
Main event loop for OpenVPN in UDP server mode.
Definition: mudp.c:462
TUN_OUT
#define TUN_OUT(c)
Definition: forward.h:38
context_1::tuntap
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition: openvpn.h:170
context
Contains all state information for one tunnel.
Definition: openvpn.h:476
hash
Definition: list.h:58
first_packet_verdict
first_packet_verdict
Definition: ssl_pkt.h:84
tls_multi::session
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition: ssl_common.h:672
packet_id::rec
struct packet_id_rec rec
Definition: packet_id.h:203
multi_context::mbuf
struct mbuf_set * mbuf
Set of buffers for passing data channel packets between VPN tunnel instances.
Definition: multi.h:167
tls_reset_standalone
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition: ssl_pkt.c:428
multi_instance::real
struct mroute_addr real
External network address of the remote peer.
Definition: multi.h:114
D_MULTI_ERRORS
#define D_MULTI_ERRORS
Definition: errlevel.h:65
tls_pre_decrypt_lite
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition: ssl_pkt.c:307
multi_uninit
void multi_uninit(struct multi_context *m)
Definition: multi.c:705
MPP_PRE_SELECT
#define MPP_PRE_SELECT
Definition: multi.h:287
hash_element::value
void * value
Definition: list.h:47
VERDICT_VALID_CONTROL_V1
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition: ssl_pkt.h:90
free_tls_pre_decrypt_state
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition: ssl_pkt.c:285
dmsg
#define dmsg(flags,...)
Definition: error.h:154
CO_FORCE_TLSCRYPTV2_COOKIE
#define CO_FORCE_TLSCRYPTV2_COOKIE
Bit-flag indicating that we do not allow clients that do not support resending the wrapped client key...
Definition: crypto.h:270
MANAGEMENT_READ
#define MANAGEMENT_READ
Definition: event.h:71
buf_copy
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition: buffer.h:730
openvpn_sockaddr
Definition: socket.h:65
context_2::buffers
struct context_buffers * buffers
Definition: openvpn.h:370
send_hmac_reset_packet
static void send_hmac_reset_packet(struct multi_context *m, struct tls_pre_decrypt_state *state, struct tls_auth_standalone *tas, struct session_id *sid, bool request_resend_wkc)
Definition: mudp.c:42
multi_ifconfig_pool_persist
void multi_ifconfig_pool_persist(struct multi_context *m, bool force)
Definition: multi.c:163
P_OPCODE_SHIFT
#define P_OPCODE_SHIFT
Definition: ssl_pkt.h:39
context::mode
int mode
Role of this context within the OpenVPN process.
Definition: openvpn.h:490
context_2::to_link_addr
struct link_socket_actual * to_link_addr
Definition: openvpn.h:247
MAX_PEER_ID
#define MAX_PEER_ID
Definition: openvpn.h:549
tls_pre_decrypt_state::server_session_id
struct session_id server_session_id
Definition: ssl_pkt.h:108
buf_reset_len
static void buf_reset_len(struct buffer *buf)
Definition: buffer.h:312
tls_pre_decrypt_state::tls_wrap_tmp
struct tls_wrap_ctx tls_wrap_tmp
Definition: ssl_pkt.h:105
IOW_MBUF
#define IOW_MBUF
Definition: forward.h:61
multi_context::new_connection_limiter
struct frequency_limit * new_connection_limiter
Definition: multi.h:173
session_id
Definition: session_id.h:38
packet_id_net::id
packet_id_type id
Definition: packet_id.h:196
multi_context::deferred_shutdown_signal
struct deferred_signal_schedule_entry deferred_shutdown_signal
Definition: multi.h:211
IOW_TO_LINK
#define IOW_TO_LINK
Definition: forward.h:55
context::c2
struct context_2 c2
Level 2 context.
Definition: openvpn.h:517
tls_wrap_ctx::opt
struct crypto_options opt
Crypto state.
Definition: ssl_common.h:270
multi_context::instances
struct multi_instance ** instances
Array of multi_instances.
Definition: multi.h:156
ASSERT
#define ASSERT(x)
Definition: error.h:201
tls_pre_decrypt_state::peer_session_id
struct session_id peer_session_id
Definition: ssl_pkt.h:107
buf_advance
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:636
multi_init
void multi_init(struct multi_context *m, struct context *t, bool tcp_mode)
Definition: multi.c:292
multi_context::top
struct context top
Storage structure for process-wide configuration.
Definition: multi.h:195
reset_packet_id_send
static void reset_packet_id_send(struct packet_id_send *p)
Reset the current send packet id to its initial state.
Definition: packet_id.h:301
packet_id_rec::initialized
bool initialized
Definition: packet_id.h:135
hash_add_fast
static void hash_add_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv, void *value)
Definition: list.h:165
multi_assign_peer_id
void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi)
Assigns a peer-id to a a client and adds the instance to the the instances array of the multi_context...
Definition: multi.c:4144
SID_SIZE
#define SID_SIZE
Definition: session_id.h:45
io_wait
static void io_wait(struct context *c, const unsigned int flags)
Definition: forward.h:364
MPP_CONDITIONAL_PRE_SELECT
#define MPP_CONDITIONAL_PRE_SELECT
Definition: multi.h:288
multi_process_io_udp
static void multi_process_io_udp(struct multi_context *m)
Definition: mudp.c:329
IOW_TO_TUN
#define IOW_TO_TUN
Definition: forward.h:54
multi_process_timeout
bool multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags)
Definition: multi.c:3676
ungenerate_prefix
void ungenerate_prefix(struct multi_instance *mi)
Definition: multi.c:513
multi_process_outgoing_link_dowork
static bool multi_process_outgoing_link_dowork(struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags)
Definition: multi.h:676
close_instance
void close_instance(struct context *c)
Definition: init.c:4713
perf_pop
static void perf_pop(void)
Definition: perf.h:82
tls_pre_decrypt_state
struct that stores the temporary data for the tls lite decrypt functions
Definition: ssl_pkt.h:104
hash_lookup_fast
struct hash_element * hash_lookup_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv)
Definition: list.c:83
context::options
struct options options
Options loaded from command line or configuration file.
Definition: openvpn.h:478
read_incoming_tun
void read_incoming_tun(struct context *c)
Read a packet from the virtual tun/tap network interface.
Definition: forward.c:1273
SOCKET_WRITE
#define SOCKET_WRITE
Definition: event.h:63
multi.h
multi_context::hash
struct hash * hash
VPN tunnel instances indexed by real address of the remote peer.
Definition: multi.h:159
DCO_READ
#define DCO_READ
Definition: event.h:76
multi_process_per_second_timers
static void multi_process_per_second_timers(struct multi_context *m)
Definition: multi.h:591
session_skip_to_pre_start
bool session_skip_to_pre_start(struct tls_session *session, struct tls_pre_decrypt_state *state, struct link_socket_actual *from)
Definition: ssl.c:2464
EARLY_NEG_START
#define EARLY_NEG_START
Definition: ssl_pkt.h:308
MULTI_CHECK_SIG
#define MULTI_CHECK_SIG(m)
Definition: multi.h:689
tuntap_ring_empty
static bool tuntap_ring_empty(struct tuntap *tt)
Definition: tun.h:255
multi_context::pending
struct multi_instance * pending
Definition: multi.h:189
msg_set_prefix
static void msg_set_prefix(const char *prefix)
Definition: error.h:311
packet_id_read
bool packet_id_read(struct packet_id_net *pin, struct buffer *buf, bool long_form)
Definition: packet_id.c:299
TUN_WRITE
#define TUN_WRITE
Definition: event.h:66
context_2::session_id_hmac
hmac_ctx_t * session_id_hmac
the HMAC we use to generate and verify our syn cookie like session ids from the server.
Definition: openvpn.h:341
mroute_extract_openvpn_sockaddr
bool mroute_extract_openvpn_sockaddr(struct mroute_addr *addr, const struct openvpn_sockaddr *osaddr, bool use_port)
Definition: mroute.c:264
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
multi_create_instance
struct multi_instance * multi_create_instance(struct multi_context *m, const struct mroute_addr *real)
Definition: multi.c:753
deferred_signal_schedule_entry::signal_received
int signal_received
Definition: multi.h:62
multi_get_create_instance_udp
struct multi_instance * multi_get_create_instance_udp(struct multi_context *m, bool *floated)
Get, and if necessary create, the multi_instance associated with a packet's source address.
Definition: mudp.c:188
ISC_SERVER
#define ISC_SERVER
Definition: init.h:115
calculate_session_id_hmac
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition: ssl_pkt.c:487
IOW_WAIT_SIGNAL
#define IOW_WAIT_SIGNAL
Definition: forward.h:63
multi_context::hmac_reply
struct buffer hmac_reply
Definition: multi.h:198
options::handshake_window
int handshake_window
Definition: options.h:634
context_buffers::aux_buf
struct buffer aux_buf
Definition: openvpn.h:97
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:468
context_2::timeval
struct timeval timeval
Time to next event of timers and similar.
Definition: openvpn.h:399
mroute_addr
Definition: mroute.h:75
multi_process_incoming_tun
bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
Determine the destination VPN tunnel of a packet received over the virtual tun/tap network interface ...
Definition: multi.c:3547
syshead.h
BPTR
#define BPTR(buf)
Definition: buffer.h:124
session_id_defined
static bool session_id_defined(const struct session_id *sid1)
Definition: session_id.h:55
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
context_clear_2
void context_clear_2(struct context *c)
Definition: init.c:88
mroute_addr_print
const char * mroute_addr_print(const struct mroute_addr *ma, struct gc_arena *gc)
Definition: mroute.c:376
uninit_management_callback
void uninit_management_callback(void)
Definition: init.c:4360
reflect_filter_rate_limit_decrease
void reflect_filter_rate_limit_decrease(struct initial_packet_rate_limit *irl)
decreases the counter of initial packets seen, so connections that successfully completed the three-w...
Definition: reflect_filter.c:76
LINK_OUT
#define LINK_OUT(c)
Definition: forward.h:39
multi_context
Main OpenVPN server state structure.
Definition: multi.h:155
init_management_callback_multi
void init_management_callback_multi(struct multi_context *m)
Definition: multi.c:4119
multi_top_init
void multi_top_init(struct multi_context *m, struct context *top)
Definition: multi.c:3816
tls_auth_standalone::tls_wrap
struct tls_wrap_ctx tls_wrap
Definition: ssl_pkt.h:79
check_debug_level
static bool check_debug_level(unsigned int level)
Definition: error.h:226
context::es
struct env_set * es
Set of environment variables.
Definition: openvpn.h:499
tls_multi::n_sessions
int n_sessions
Number of sessions negotiated thus far.
Definition: ssl_common.h:607
CC_HARD_USR1_TO_HUP
#define CC_HARD_USR1_TO_HUP
Definition: init.h:105
do_pre_decrypt_check
static bool do_pre_decrypt_check(struct multi_context *m, struct tls_pre_decrypt_state *state, struct mroute_addr addr)
Definition: mudp.c:67
multi_context::hmac_reply_dest
struct link_socket_actual * hmac_reply_dest
Definition: multi.h:199
IS_SIG
#define IS_SIG(c)
Definition: sig.h:48
init_instance_handle_signals
void init_instance_handle_signals(struct context *c, const struct env_set *env, const unsigned int flags)
Definition: init.c:4386
ES_TIMEOUT
#define ES_TIMEOUT
Definition: event.h:69
ssl_pkt.h
packet_id::send
struct packet_id_send send
Definition: packet_id.h:202
EARLY_NEG_MASK
#define EARLY_NEG_MASK
Definition: ssl_pkt.h:307
CM_TOP
#define CM_TOP
Definition: openvpn.h:486
status
static SERVICE_STATUS status
Definition: interactive.c:52
read_incoming_link
void read_incoming_link(struct context *c)
Read a packet from the external network interface.
Definition: forward.c:912
print_link_socket_actual
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
Definition: socket.c:2820
FILE_CLOSED
#define FILE_CLOSED
Definition: event.h:74
management
Definition: manage.h:335
hash_element
Definition: list.h:45
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1039
hash_bucket
Definition: list.h:53
IOW_READ_TUN
#define IOW_READ_TUN
Definition: forward.h:56
VERDICT_VALID_RESET_V3
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition: ssl_pkt.h:88
check_session_id_hmac
bool check_session_id_hmac(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow)
Checks if a control packet has a correct HMAC server session id.
Definition: ssl_pkt.c:529
config.h
packet_id_net
Definition: packet_id.h:194
context_2::from
struct link_socket_actual from
Definition: openvpn.h:248
multi_process_incoming_link
bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags)
Demultiplex and process a packet received over the external network interface.
Definition: multi.c:3343
multi_context::initial_rate_limiter
struct initial_packet_rate_limit * initial_rate_limiter
Definition: multi.h:174
PERF_EVENT_LOOP
#define PERF_EVENT_LOOP
Definition: perf.h:44
TM_INITIAL
#define TM_INITIAL
As yet un-trusted tls_session being negotiated.
Definition: ssl_common.h:527
MANAGEMENT_WRITE
#define MANAGEMENT_WRITE
Definition: event.h:72
multi_process_outgoing_tun
static bool multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Send a packet over the virtual tun/tap network interface to its locally reachable destination.
Definition: multi.h:652
session
Definition: keyingmaterialexporter.c:56
multi_process_outgoing_link
static void multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
Definition: mudp.c:308
crypto_options::packet_id
struct packet_id packet_id
Current packet ID state for both sending and receiving directions.
Definition: crypto.h:236
VERDICT_VALID_ACK_V1
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition: ssl_pkt.h:93
crypto_options::flags
unsigned int flags
Bit-flags determining behavior of security operation functions.
Definition: crypto.h:283
D_MULTI_MEDIUM
#define D_MULTI_MEDIUM
Definition: errlevel.h:102
memdbg.h
multi_top_free
void multi_top_free(struct multi_context *m)
Definition: multi.c:3823
SOCKET_READ
#define SOCKET_READ
Definition: event.h:62
IOW_READ
#define IOW_READ
Definition: forward.h:65
VERDICT_VALID_WKC_V1
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition: ssl_pkt.h:95
msg
#define msg(flags,...)
Definition: error.h:150
multi_instance::did_real_hash
bool did_real_hash
Definition: multi.h:127
process_outgoing_link
void process_outgoing_link(struct context *c)
Write a packet to the external network interface.
Definition: forward.c:1723
perf_push
static void perf_push(int type)
Definition: perf.h:78
management_io
void management_io(struct management *man)
Definition: manage.c:3155
multi_instance::context
struct context context
The context structure storing state for this VPN tunnel.
Definition: multi.h:136
D_MULTI_DEBUG
#define D_MULTI_DEBUG
Definition: errlevel.h:127
multi_get_timeout
static void multi_get_timeout(struct multi_context *m, struct timeval *dest)
Definition: multi.h:609
initialization_sequence_completed
void initialization_sequence_completed(struct context *c, const unsigned int flags)
Definition: init.c:1580
multi_process_outgoing_link_pre
static struct multi_instance * multi_process_outgoing_link_pre(struct multi_context *m)
Definition: multi.h:425
hash_value
static uint32_t hash_value(const struct hash *hash, const void *key)
Definition: list.h:123
P_CONTROL_HARD_RESET_SERVER_V2
#define P_CONTROL_HARD_RESET_SERVER_V2
Definition: ssl_pkt.h:52
context::c1
struct context_1 c1
Level 1 context.
Definition: openvpn.h:516
link_socket_actual_match
static bool link_socket_actual_match(const struct link_socket_actual *a1, const struct link_socket_actual *a2)
Definition: socket.h:886
packet_opcode_name
static const char * packet_opcode_name(int op)
Definition: ssl_pkt.h:234
tls_auth_standalone
Definition: ssl_pkt.h:77
frequency_limit_event_allowed
bool frequency_limit_event_allowed(struct frequency_limit *f)
Definition: otime.c:167
context_2::fast_io
bool fast_io
Definition: openvpn.h:427