OpenVPN
push.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #elif defined(_MSC_VER)
27 #include "config-msvc.h"
28 #endif
29 
30 #include "syshead.h"
31 
32 #include "push.h"
33 #include "options.h"
34 #include "ssl.h"
35 #include "ssl_verify.h"
36 #include "manage.h"
37 
38 #include "memdbg.h"
39 
40 #if P2MP
41 
42 static char push_reply_cmd[] = "PUSH_REPLY";
43 
44 /*
45  * Auth username/password
46  *
47  * Client received an authentication failed message from server.
48  * Runs on client.
49  */
50 void
51 receive_auth_failed(struct context *c, const struct buffer *buffer)
52 {
53  msg(M_VERB0, "AUTH: Received control message: %s", BSTR(buffer));
54  c->options.no_advance = true;
55 
56  if (c->options.pull)
57  {
58  switch (auth_retry_get())
59  {
60  case AR_NONE:
61  c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- Auth failure error */
62  break;
63 
64  case AR_INTERACT:
65  ssl_purge_auth(false);
66 
67  case AR_NOINTERACT:
68  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Auth failure error */
69  break;
70 
71  default:
72  ASSERT(0);
73  }
74  c->sig->signal_text = "auth-failure";
75 #ifdef ENABLE_MANAGEMENT
76  if (management)
77  {
78  const char *reason = NULL;
79  struct buffer buf = *buffer;
80  if (buf_string_compare_advance(&buf, "AUTH_FAILED,") && BLEN(&buf))
81  {
82  reason = BSTR(&buf);
83  }
85  }
86 #endif
87  /*
88  * Save the dynamic-challenge text even when management is defined
89  */
90  {
91 #ifdef ENABLE_CLIENT_CR
92  struct buffer buf = *buffer;
93  if (buf_string_match_head_str(&buf, "AUTH_FAILED,CRV1:") && BLEN(&buf))
94  {
95  buf_advance(&buf, 12); /* Length of "AUTH_FAILED," substring */
97  }
98 #endif
99  }
100  }
101 }
102 
103 /*
104  * Act on received restart message from server
105  */
106 void
107 server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
108 {
109  if (c->options.pull)
110  {
111  struct buffer buf = *buffer;
112  const char *m = "";
113  if (buf_advance(&buf, adv) && buf_read_u8(&buf) == ',' && BLEN(&buf))
114  {
115  m = BSTR(&buf);
116  }
117 
118  /* preserve cached passwords? */
119  /* advance to next server? */
120  {
121  bool purge = true;
122 
123  if (m[0] == '[')
124  {
125  int i;
126  for (i = 1; m[i] != '\0' && m[i] != ']'; ++i)
127  {
128  if (m[i] == 'P')
129  {
130  purge = false;
131  }
132  else if (m[i] == 'N')
133  {
134  /* next server? */
135  c->options.no_advance = false;
136  }
137  }
138  }
139  if (purge)
140  {
141  ssl_purge_auth(true);
142  }
143  }
144 
145  if (restart)
146  {
147  msg(D_STREAM_ERRORS, "Connection reset command was pushed by server ('%s')", m);
148  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
149  c->sig->signal_text = "server-pushed-connection-reset";
150  }
151  else
152  {
153  msg(D_STREAM_ERRORS, "Halt command was pushed by server ('%s')", m);
154  c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- server-pushed halt */
155  c->sig->signal_text = "server-pushed-halt";
156  }
157 #ifdef ENABLE_MANAGEMENT
158  if (management)
159  {
160  management_notify(management, "info", c->sig->signal_text, m);
161  }
162 #endif
163  }
164 }
165 
166 #if P2MP_SERVER
167 
181 static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
182  int msglevel, const char *fmt, ...)
183 #ifdef __GNUC__
184 #if __USE_MINGW_ANSI_STDIO
185 __attribute__ ((format(gnu_printf, 4, 5)))
186 #else
187 __attribute__ ((format(__printf__, 4, 5)))
188 #endif
189 #endif
190 ;
191 
192 /*
193  * Send auth failed message from server to client.
194  */
195 void
196 send_auth_failed(struct context *c, const char *client_reason)
197 {
198  struct gc_arena gc = gc_new();
199  static const char auth_failed[] = "AUTH_FAILED";
200  size_t len;
201 
203 
204  len = (client_reason ? strlen(client_reason)+1 : 0) + sizeof(auth_failed);
205  if (len > PUSH_BUNDLE_SIZE)
206  {
207  len = PUSH_BUNDLE_SIZE;
208  }
209 
210  {
211  struct buffer buf = alloc_buf_gc(len, &gc);
212  buf_printf(&buf, auth_failed);
213  if (client_reason)
214  {
215  buf_printf(&buf, ",%s", client_reason);
216  }
218  }
219 
220  gc_free(&gc);
221 }
222 
223 /*
224  * Send restart message from server to client.
225  */
226 void
227 send_restart(struct context *c, const char *kill_msg)
228 {
230  send_control_channel_string(c, kill_msg ? kill_msg : "RESTART", D_PUSH);
231 }
232 
233 #endif /* if P2MP_SERVER */
234 
235 /*
236  * Push/Pull
237  */
238 
239 void
240 incoming_push_message(struct context *c, const struct buffer *buffer)
241 {
242  struct gc_arena gc = gc_new();
243  unsigned int option_types_found = 0;
244  int status;
245 
246  msg(D_PUSH, "PUSH: Received control message: '%s'", sanitize_control_message(BSTR(buffer), &gc));
247 
248  status = process_incoming_push_msg(c,
249  buffer,
250  c->options.pull,
252  &option_types_found);
253 
254  if (status == PUSH_MSG_ERROR)
255  {
256  msg(D_PUSH_ERRORS, "WARNING: Received bad push/pull message: %s", sanitize_control_message(BSTR(buffer), &gc));
257  }
258  else if (status == PUSH_MSG_REPLY || status == PUSH_MSG_CONTINUATION)
259  {
260  c->options.push_option_types_found |= option_types_found;
261 
262  /* delay bringing tun/tap up until --push parms received from remote */
263  if (status == PUSH_MSG_REPLY)
264  {
265  if (!do_up(c, true, c->options.push_option_types_found))
266  {
267  msg(D_PUSH_ERRORS, "Failed to open tun/tap interface");
268  goto error;
269  }
270  }
272  }
273  else if (status == PUSH_MSG_REQUEST)
274  {
275  if (c->options.mode == MODE_SERVER)
276  {
278  /* Do not regenerate keys if client send a second push request */
280  && !tls_session_update_crypto_params(session, &c->options,
281  &c->c2.frame))
282  {
283  msg(D_TLS_ERRORS, "TLS Error: initializing data channel failed");
284  goto error;
285  }
286  }
287  }
288 
289  goto cleanup;
290 error:
291  register_signal(c, SIGUSR1, "process-push-msg-failed");
292 cleanup:
293  gc_free(&gc);
294 }
295 
296 bool
298 {
299  const int max_push_requests = c->options.handshake_window / PUSH_REQUEST_INTERVAL;
300  if (++c->c2.n_sent_push_requests <= max_push_requests)
301  {
302  return send_control_channel_string(c, "PUSH_REQUEST", D_PUSH);
303  }
304  else
305  {
306  msg(D_STREAM_ERRORS, "No reply from server after sending %d push requests", max_push_requests);
307  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
308  c->sig->signal_text = "no-push-reply";
309  return false;
310  }
311 }
312 
313 #if P2MP_SERVER
314 
324 static bool
325 prepare_push_reply(struct context *c, struct gc_arena *gc,
326  struct push_list *push_list)
327 {
328  const char *optstr = NULL;
329  struct tls_multi *tls_multi = c->c2.tls_multi;
330  const char *const peer_info = tls_multi->peer_info;
331  struct options *o = &c->options;
332 
333  /* ipv6 */
335  {
336  push_option_fmt(gc, push_list, M_USAGE, "ifconfig-ipv6 %s/%d %s",
340  0, gc));
341  }
342 
343  /* ipv4 */
347  {
350  {
351  ifconfig_local = c->c2.push_ifconfig_local_alias;
352  }
353  push_option_fmt(gc, push_list, M_USAGE, "ifconfig %s %s",
354  print_in_addr_t(ifconfig_local, 0, gc),
356  0, gc));
357  }
358 
359  /* Send peer-id if client supports it */
360  optstr = peer_info ? strstr(peer_info, "IV_PROTO=") : NULL;
361  if (optstr)
362  {
363  int proto = 0;
364  int r = sscanf(optstr, "IV_PROTO=%d", &proto);
365  if ((r == 1) && (proto >= 2))
366  {
367  push_option_fmt(gc, push_list, M_USAGE, "peer-id %d",
368  tls_multi->peer_id);
369  tls_multi->use_peer_id = true;
370  }
371  }
372 
373  /* Push cipher if client supports Negotiable Crypto Parameters */
374  if (tls_peer_info_ncp_ver(peer_info) >= 2 && o->ncp_enabled)
375  {
376  /* if we have already created our key, we cannot *change* our own
377  * cipher -> so log the fact and push the "what we have now" cipher
378  * (so the client is always told what we expect it to use)
379  */
380  const struct tls_session *session = &tls_multi->session[TM_ACTIVE];
382  {
383  msg( M_INFO, "PUSH: client wants to negotiate cipher (NCP), but "
384  "server has already generated data channel keys, "
385  "re-sending previously negotiated cipher '%s'",
386  o->ciphername );
387  }
388  else
389  {
390  /* Push the first cipher from --ncp-ciphers to the client.
391  * TODO: actual negotiation, instead of server dictatorship. */
392  char *push_cipher = string_alloc(o->ncp_ciphers, &o->gc);
393  o->ciphername = strtok(push_cipher, ":");
394  }
395  push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
396  }
397  else if (o->ncp_enabled)
398  {
399  tls_poor_mans_ncp(o, tls_multi->remote_ciphername);
400  }
401 
402  /* If server uses --auth-gen-token and we have an auth token
403  * to send to the client
404  */
405  if (false == tls_multi->auth_token_sent && NULL != tls_multi->auth_token)
406  {
407  push_option_fmt(gc, push_list, M_USAGE,
408  "auth-token %s", tls_multi->auth_token);
409  tls_multi->auth_token_sent = true;
410  }
411  return true;
412 }
413 
414 static bool
415 send_push_options(struct context *c, struct buffer *buf,
416  struct push_list *push_list, int safe_cap,
417  bool *push_sent, bool *multi_push)
418 {
419  struct push_entry *e = push_list->head;
420 
421  while (e)
422  {
423  if (e->enable)
424  {
425  const int l = strlen(e->option);
426  if (BLEN(buf) + l >= safe_cap)
427  {
428  buf_printf(buf, ",push-continuation 2");
429  {
430  const bool status = send_control_channel_string(c, BSTR(buf), D_PUSH);
431  if (!status)
432  {
433  return false;
434  }
435  *push_sent = true;
436  *multi_push = true;
437  buf_reset_len(buf);
438  buf_printf(buf, "%s", push_reply_cmd);
439  }
440  }
441  if (BLEN(buf) + l >= safe_cap)
442  {
443  msg(M_WARN, "--push option is too long");
444  return false;
445  }
446  buf_printf(buf, ",%s", e->option);
447  }
448  e = e->next;
449  }
450  return true;
451 }
452 
453 static bool
454 send_push_reply(struct context *c, struct push_list *per_client_push_list)
455 {
456  struct gc_arena gc = gc_new();
457  struct buffer buf = alloc_buf_gc(PUSH_BUNDLE_SIZE, &gc);
458  bool multi_push = false;
459  const int extra = 84; /* extra space for possible trailing ifconfig and push-continuation */
460  const int safe_cap = BCAP(&buf) - extra;
461  bool push_sent = false;
462 
463  buf_printf(&buf, "%s", push_reply_cmd);
464 
465  /* send options which are common to all clients */
466  if (!send_push_options(c, &buf, &c->options.push_list, safe_cap,
467  &push_sent, &multi_push))
468  {
469  goto fail;
470  }
471 
472  /* send client-specific options */
473  if (!send_push_options(c, &buf, per_client_push_list, safe_cap,
474  &push_sent, &multi_push))
475  {
476  goto fail;
477  }
478 
479  if (multi_push)
480  {
481  buf_printf(&buf, ",push-continuation 1");
482  }
483 
484  if (BLEN(&buf) > sizeof(push_reply_cmd)-1)
485  {
486  const bool status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
487  if (!status)
488  {
489  goto fail;
490  }
491  push_sent = true;
492  }
493 
494  /* If nothing have been pushed, send an empty push,
495  * as the client is expecting a response
496  */
497  if (!push_sent)
498  {
499  bool status = false;
500 
501  buf_reset_len(&buf);
502  buf_printf(&buf, "%s", push_reply_cmd);
503  status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
504  if (!status)
505  {
506  goto fail;
507  }
508  }
509 
510  gc_free(&gc);
511  return true;
512 
513 fail:
514  gc_free(&gc);
515  return false;
516 }
517 
518 static void
519 push_option_ex(struct gc_arena *gc, struct push_list *push_list,
520  const char *opt, bool enable, int msglevel)
521 {
522  if (!string_class(opt, CC_ANY, CC_COMMA))
523  {
524  msg(msglevel, "PUSH OPTION FAILED (illegal comma (',') in string): '%s'", opt);
525  }
526  else
527  {
528  struct push_entry *e;
529  ALLOC_OBJ_CLEAR_GC(e, struct push_entry, gc);
530  e->enable = true;
531  e->option = opt;
532  if (push_list->head)
533  {
534  ASSERT(push_list->tail);
535  push_list->tail->next = e;
536  push_list->tail = e;
537  }
538  else
539  {
540  ASSERT(!push_list->tail);
541  push_list->head = e;
542  push_list->tail = e;
543  }
544  }
545 }
546 
547 void
548 push_option(struct options *o, const char *opt, int msglevel)
549 {
550  push_option_ex(&o->gc, &o->push_list, opt, true, msglevel);
551 }
552 
553 void
555 {
556  if (o->push_list.head)
557  {
558  const struct push_entry *e = o->push_list.head;
559  push_reset(o);
560  while (e)
561  {
562  push_option_ex(&o->gc, &o->push_list,
563  string_alloc(e->option, &o->gc), true, M_FATAL);
564  e = e->next;
565  }
566  }
567 }
568 
569 void
570 push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
571 {
572  const char **argv = make_extended_arg_array(p, gc);
573  char *opt = print_argv(argv, gc, 0);
574  push_option(o, opt, msglevel);
575 }
576 
577 static bool
578 push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
579  int msglevel, const char *format, ...)
580 {
581  va_list arglist;
582  char tmp[256] = {0};
583  int len;
584  va_start(arglist, format);
585  len = vsnprintf(tmp, sizeof(tmp), format, arglist);
586  va_end(arglist);
587  if (len > sizeof(tmp)-1)
588  {
589  return false;
590  }
591  push_option_ex(gc, push_list, string_alloc(tmp, gc), true, msglevel);
592  return true;
593 }
594 
595 void
596 push_reset(struct options *o)
597 {
598  CLEAR(o->push_list);
599 }
600 
601 void
602 push_remove_option(struct options *o, const char *p)
603 {
604  msg(D_PUSH_DEBUG, "PUSH_REMOVE searching for: '%s'", p);
605 
606  /* ifconfig is special, as not part of the push list */
607  if (streq(p, "ifconfig"))
608  {
609  o->push_ifconfig_ipv4_blocked = true;
610  return;
611  }
612 
613  /* ifconfig-ipv6 is special, as not part of the push list */
614  if (streq( p, "ifconfig-ipv6" ))
615  {
616  o->push_ifconfig_ipv6_blocked = true;
617  return;
618  }
619 
620  if (o && o->push_list.head)
621  {
622  struct push_entry *e = o->push_list.head;
623 
624  /* cycle through the push list */
625  while (e)
626  {
627  if (e->enable
628  && strncmp( e->option, p, strlen(p) ) == 0)
629  {
630  msg(D_PUSH_DEBUG, "PUSH_REMOVE removing: '%s'", e->option);
631  e->enable = false;
632  }
633 
634  e = e->next;
635  }
636  }
637 }
638 #endif /* if P2MP_SERVER */
639 
640 #if P2MP_SERVER
641 int
643 {
644  int ret = PUSH_MSG_ERROR;
645 
646 #ifdef ENABLE_ASYNC_PUSH
647  c->c2.push_request_received = true;
648 #endif
650  {
651  const char *client_reason = tls_client_reason(c->c2.tls_multi);
652  send_auth_failed(c, client_reason);
653  ret = PUSH_MSG_AUTH_FAILURE;
654  }
655  else if (!c->c2.push_reply_deferred && c->c2.context_auth == CAS_SUCCEEDED)
656  {
657  time_t now;
658 
659  openvpn_time(&now);
660  if (c->c2.sent_push_reply_expiry > now)
661  {
663  }
664  else
665  {
666  /* per-client push options - peer-id, cipher, ifconfig, ipv6-ifconfig */
667  struct push_list push_list;
668  struct gc_arena gc = gc_new();
669 
670  CLEAR(push_list);
671  if (prepare_push_reply(c, &gc, &push_list)
672  && send_push_reply(c, &push_list))
673  {
674  ret = PUSH_MSG_REQUEST;
675  c->c2.sent_push_reply_expiry = now + 30;
676  }
677  gc_free(&gc);
678  }
679  }
680  else
681  {
683  }
684 
685  return ret;
686 }
687 #endif /* if P2MP_SERVER */
688 
689 static void
690 push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
691 {
692  char line[OPTION_PARM_SIZE];
693  while (buf_parse(buf, ',', line, sizeof(line)))
694  {
695  /* peer-id might change on restart and this should not trigger reopening tun */
696  if (strprefix(line, "peer-id "))
697  {
698  continue;
699  }
700  /* tun reopen only needed if cipher change can change tun MTU */
701  if (strprefix(line, "cipher ") && !opt->ce.tun_mtu_defined)
702  {
703  continue;
704  }
705  md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
706  }
707 }
708 
709 int
711  const struct buffer *buffer,
712  bool honor_received_options,
713  unsigned int permission_mask,
714  unsigned int *option_types_found)
715 {
716  int ret = PUSH_MSG_ERROR;
717  struct buffer buf = *buffer;
718 
719 #if P2MP_SERVER
720  if (buf_string_compare_advance(&buf, "PUSH_REQUEST"))
721  {
723  }
724  else
725 #endif
726 
727  if (honor_received_options && buf_string_compare_advance(&buf, "PUSH_REPLY"))
728  {
729  const uint8_t ch = buf_read_u8(&buf);
730  if (ch == ',')
731  {
732  struct buffer buf_orig = buf;
734  {
738  }
739  if (!c->c2.did_pre_pull_restore)
740  {
741  pre_pull_restore(&c->options, &c->c2.gc);
742  c->c2.did_pre_pull_restore = true;
743  }
744  if (apply_push_options(&c->options,
745  &buf,
746  permission_mask,
747  option_types_found,
748  c->c2.es))
749  {
751  &c->options);
752  switch (c->options.push_continuation)
753  {
754  case 0:
755  case 1:
759  c->c2.pulled_options_state = NULL;
761  ret = PUSH_MSG_REPLY;
762  break;
763 
764  case 2:
765  ret = PUSH_MSG_CONTINUATION;
766  break;
767  }
768  }
769  }
770  else if (ch == '\0')
771  {
772  ret = PUSH_MSG_REPLY;
773  }
774  /* show_settings (&c->options); */
775  }
776  return ret;
777 }
778 
779 #if P2MP_SERVER
780 
781 /*
782  * Remove iroutes from the push_list.
783  */
784 void
786 {
787  if (o && o->push_list.head && o->iroutes)
788  {
789  struct gc_arena gc = gc_new();
790  struct push_entry *e = o->push_list.head;
791 
792  /* cycle through the push list */
793  while (e)
794  {
795  char *p[MAX_PARMS];
796  bool enable = true;
797 
798  /* parse the push item */
799  CLEAR(p);
800  if (e->enable
801  && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
802  {
803  /* is the push item a route directive? */
804  if (p[0] && !strcmp(p[0], "route") && !p[3])
805  {
806  /* get route parameters */
807  bool status1, status2;
808  const in_addr_t network = getaddr(GETADDR_HOST_ORDER, p[1], 0, &status1, NULL);
809  const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, p[2] ? p[2] : "255.255.255.255", 0, &status2, NULL);
810 
811  /* did route parameters parse correctly? */
812  if (status1 && status2)
813  {
814  const struct iroute *ir;
815 
816  /* does route match an iroute? */
817  for (ir = o->iroutes; ir != NULL; ir = ir->next)
818  {
819  if (network == ir->network && netmask == netbits_to_netmask(ir->netbits >= 0 ? ir->netbits : 32))
820  {
821  enable = false;
822  break;
823  }
824  }
825  }
826  }
827 
828  /* should we copy the push item? */
829  e->enable = enable;
830  if (!enable)
831  {
832  msg(D_PUSH, "REMOVE PUSH ROUTE: '%s'", e->option);
833  }
834  }
835 
836  e = e->next;
837  }
838 
839  gc_free(&gc);
840  }
841 }
842 
843 #endif /* if P2MP_SERVER */
844 
845 #endif /* if P2MP */
struct env_set * es
Definition: openvpn.h:425
bool string_class(const char *str, const unsigned int inclusive, const unsigned int exclusive)
Definition: buffer.c:1037
static bool prepare_push_reply(struct context *c, struct gc_arena *gc, struct push_list *push_list)
Prepare push options, based on local options and available peer info.
Definition: push.c:325
void receive_auth_failed(struct context *c, const struct buffer *buffer)
Definition: push.c:51
static void buf_reset_len(struct buffer *buf)
Definition: buffer.h:299
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:456
bool tun_mtu_defined
Definition: options.h:108
void send_restart(struct context *c, const char *kill_msg)
Definition: push.c:227
bool ncp_enabled
Definition: options.h:482
struct key_state key[KS_SIZE]
Definition: ssl_common.h:436
struct iroute * next
Definition: route.h:233
static const char * tls_client_reason(struct tls_multi *multi)
Definition: ssl_verify.h:232
md_ctx_t * md_ctx_new(void)
struct options options
Options loaded from command line or configuration file.
Definition: openvpn.h:500
#define PUSH_MSG_CONTINUATION
Definition: push.h:36
bool push_ifconfig_ipv6_blocked
Definition: options.h:442
void ssl_put_auth_challenge(const char *cr_str)
Definition: ssl.c:502
char * string_alloc(const char *str, struct gc_arena *gc)
Definition: buffer.c:663
#define streq(x, y)
Definition: options.h:616
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, volatile int *signal_received)
Definition: socket.c:85
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:622
struct push_entry * head
Definition: pushlist.h:36
bool do_up(struct context *c, bool pulled_options, unsigned int option_types_found)
Definition: init.c:2029
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2872
#define M_INFO
Definition: errlevel.h:55
void clone_push_list(struct options *o)
Definition: push.c:554
Contains all state information for one tunnel.
Definition: openvpn.h:498
#define UP_TYPE_AUTH
Definition: ssl_common.h:41
#define SIZE(x)
Definition: basic.h:30
#define PUSH_BUNDLE_SIZE
Definition: common.h:84
#define D_PUSH
Definition: errlevel.h:83
bool push_ifconfig_defined
Definition: openvpn.h:439
char * peer_info
Definition: ssl_common.h:550
static void gc_free(struct gc_arena *a)
Definition: buffer.h:999
void send_auth_failed(struct context *c, const char *client_reason)
Definition: push.c:196
bool send_control_channel_string(struct context *c, const char *str, int msglevel)
Definition: forward.c:247
void management_auth_failure(struct management *man, const char *type, const char *reason)
Definition: manage.c:3005
in_addr_t push_ifconfig_local
Definition: openvpn.h:441
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:494
#define D_TLS_ERRORS
Definition: errlevel.h:59
void management_notify(struct management *man, const char *severity, const char *type, const char *text)
Definition: manage.c:2834
#define ASSERT(x)
Definition: error.h:221
int tls_authentication_status(struct tls_multi *multi, const int latency)
Definition: ssl_verify.c:941
#define SIGUSR1
Definition: config-msvc.h:115
bool pulled_options_digest_init_done
Definition: openvpn.h:464
struct in6_addr push_ifconfig_ipv6_local
Definition: openvpn.h:446
static in_addr_t netbits_to_netmask(const int netbits)
Definition: route.h:369
void push_reset(struct options *o)
Definition: push.c:596
#define AR_NONE
Definition: options.h:802
void md_ctx_free(md_ctx_t *ctx)
struct in6_addr push_ifconfig_ipv6_remote
Definition: openvpn.h:448
#define M_FATAL
Definition: error.h:94
bool buf_printf(struct buffer *buf, const char *format,...)
Definition: buffer.c:243
static void event_timeout_clear(struct event_timeout *et)
Definition: interval.h:150
#define CLEAR(x)
Definition: basic.h:33
#define in_addr_t
Definition: config-msvc.h:103
static int buf_read_u8(struct buffer *buf)
Definition: buffer.h:795
struct signal_info * sig
Internal error signaling object.
Definition: openvpn.h:523
#define MAX_PARMS
Definition: options.h:51
struct push_entry * next
Definition: pushlist.h:30
int parse_line(const char *line, char *p[], const int n, const char *file, const int line_num, int msglevel, struct gc_arena *gc)
Definition: options.c:4249
bool did_pre_pull_restore
Definition: openvpn.h:461
char * print_argv(const char **p, struct gc_arena *gc, const unsigned int flags)
Definition: buffer.c:732
#define SIGTERM
Definition: config-msvc.h:117
int handshake_window
Definition: options.h:561
struct gc_arena gc
Garbage collection arena for allocations done in the level 2 scope of this context_2 structure...
Definition: openvpn.h:224
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer...
Definition: ssl_common.h:569
int scheduled_exit_interval
Definition: options.h:470
int context_auth
Definition: openvpn.h:456
#define MODE_SERVER
Definition: options.h:186
bool send_push_request(struct context *c)
Definition: push.c:297
bool use_peer_id
Definition: ssl_common.h:555
bool initialized
Definition: crypto.h:225
int netbits
Definition: route.h:232
#define BCAP(buf)
Definition: buffer.h:130
#define CC_COMMA
Definition: buffer.h:904
#define fail()
Definition: cmocka.h:1531
const char * ncp_ciphers
Definition: options.h:483
Definition: pushlist.h:29
static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list, int msglevel, const char *fmt,...)
Add an option to the given push list by providing a format string.
Definition: push.c:578
void md_ctx_final(md_ctx_t *ctx, uint8_t *dst)
void push_remove_option(struct options *o, const char *p)
Definition: push.c:602
#define PUSH_MSG_REPLY
Definition: push.h:33
md_ctx_t * pulled_options_state
Definition: openvpn.h:465
static bool send_push_reply(struct context *c, struct push_list *per_client_push_list)
Definition: push.c:454
#define PUSH_MSG_REQUEST
Definition: push.h:32
#define OPTION_PARM_SIZE
Definition: options.h:56
static char push_reply_cmd[]
Definition: push.c:42
int process_incoming_push_msg(struct context *c, const struct buffer *buffer, bool honor_received_options, unsigned int permission_mask, unsigned int *option_types_found)
Definition: push.c:710
void md_ctx_update(md_ctx_t *ctx, const uint8_t *src, int src_len)
int mode
Definition: options.h:187
#define PUSH_MSG_REQUEST_DEFERRED
Definition: push.h:34
void pre_pull_restore(struct options *o, struct gc_arena *gc)
Definition: options.c:3444
static struct gc_arena gc_new(void)
Definition: buffer.h:991
#define KS_PRIMARY
Primary key state index.
Definition: ssl_common.h:368
time_t now
Definition: otime.c:36
in_addr_t push_ifconfig_local_alias
Definition: openvpn.h:443
struct crypto_options crypto_options
Definition: ssl_common.h:181
#define M_USAGE
Definition: error.h:111
int auth_retry_get(void)
Definition: options.c:4058
static void push_option_ex(struct gc_arena *gc, struct push_list *push_list, const char *opt, bool enable, int msglevel)
Definition: push.c:519
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2852
struct iroute * iroutes
Definition: options.h:428
struct frame frame
Definition: openvpn.h:259
const char * option
Definition: pushlist.h:32
int push_ifconfig_ipv6_netbits
Definition: openvpn.h:447
void remove_iroutes_from_push_route_list(struct options *o)
Definition: push.c:785
uint8_t digest[SHA256_DIGEST_LENGTH]
Definition: crypto.h:133
const char * ciphername
Definition: options.h:481
void ssl_purge_auth(const bool auth_user_pass_only)
Definition: ssl.c:477
void push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
Definition: push.c:570
in_addr_t network
Definition: route.h:231
static SERVICE_STATUS status
Definition: automatic.c:47
#define vsnprintf
static bool send_push_options(struct context *c, struct buffer *buf, struct push_list *push_list, int safe_cap, bool *push_sent, bool *multi_push)
Definition: push.c:415
bool tls_session_update_crypto_params(struct tls_session *session, struct options *options, struct frame *frame)
Update TLS session crypto parameters (cipher and auth) and derive data channel keys based on the supp...
Definition: ssl.c:1957
const char * sanitize_control_message(const char *src, struct gc_arena *gc)
Definition: misc.c:657
const md_kt_t * md_kt_get(const char *digest)
Return message digest parameters, based on the given digest name.
static time_t openvpn_time(time_t *t)
Definition: otime.h:123
bool enable
Definition: pushlist.h:31
bool push_ifconfig_ipv4_blocked
Definition: options.h:437
void incoming_push_message(struct context *c, const struct buffer *buffer)
Definition: push.c:240
#define GETADDR_HOST_ORDER
Definition: socket.h:522
char * remote_ciphername
cipher specified in peer&#39;s config file
Definition: ssl_common.h:557
struct connection_entry ce
Definition: options.h:208
struct context_2 c2
Level 2 context.
Definition: openvpn.h:537
struct push_list push_list
Definition: options.h:406
unsigned int pull_permission_mask(const struct context *c)
Definition: init.c:2106
time_t sent_push_reply_expiry
Definition: openvpn.h:440
#define TLS_AUTHENTICATION_FAILED
Definition: ssl_verify.h:69
void md_ctx_cleanup(md_ctx_t *ctx)
#define PUSH_MSG_AUTH_FAILURE
Definition: push.h:35
#define PUSH_MSG_ERROR
Definition: push.h:31
#define BLEN(buf)
Definition: buffer.h:127
void tls_poor_mans_ncp(struct options *o, const char *remote_ciphername)
"Poor man&#39;s NCP": Use peer cipher if it is an allowed (NCP) cipher.
Definition: ssl.c:1908
int push_continuation
Definition: options.h:465
struct event_timeout push_request_interval
Definition: openvpn.h:459
#define CAS_SUCCEEDED
Definition: openvpn.h:451
unsigned int push_option_types_found
Definition: options.h:466
unsigned __int8 uint8_t
Definition: config-msvc.h:122
bool no_advance
Definition: options.h:213
bool push_ifconfig_ipv6_defined
Definition: openvpn.h:445
volatile int signal_received
Definition: sig.h:45
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition: buffer.h:1063
#define PUSH_REQUEST_INTERVAL
Definition: common.h:89
char * auth_token
If server sends a generated auth-token, this is the token to use for future user/pass authentications...
Definition: ssl_common.h:559
bool buf_parse(struct buffer *buf, const int delim, char *line, const int size)
Definition: buffer.c:840
const char ** make_extended_arg_array(char **p, struct gc_arena *gc)
Definition: misc.c:627
struct push_entry * tail
Definition: pushlist.h:37
void register_signal(struct context *c, int sig, const char *text)
Definition: sig.c:460
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition: crypto.h:234
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:398
struct sha256_digest pulled_options_digest
Definition: openvpn.h:466
bool push_reply_deferred
Definition: openvpn.h:435
#define CAS_FAILED
Definition: openvpn.h:453
int n_sent_push_requests
Definition: openvpn.h:460
#define msg
Definition: error.h:173
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
#define PUSH_MSG_ALREADY_REPLIED
Definition: push.h:37
void server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
Definition: push.c:107
static void push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
Definition: push.c:690
#define AR_NOINTERACT
Definition: options.h:804
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:88
uint32_t peer_id
Definition: ssl_common.h:554
Definition: route.h:230
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
void md_ctx_init(md_ctx_t *ctx, const md_kt_t *kt)
#define AR_INTERACT
Definition: options.h:803
const char * ifconfig_local
Definition: options.h:230
#define D_STREAM_ERRORS
Definition: errlevel.h:63
bool pull
Definition: options.h:464
int process_incoming_push_request(struct context *c)
Definition: push.c:642
#define BSTR(buf)
Definition: buffer.h:129
void push_option(struct options *o, const char *opt, int msglevel)
Definition: push.c:548
#define D_PUSH_DEBUG
Definition: errlevel.h:149
Definition: argv.h:35
struct gc_arena gc
Definition: options.h:178
#define M_VERB0
Definition: errlevel.h:53
int tls_peer_info_ncp_ver(const char *peer_info)
Return the Negotiable Crypto Parameters version advertised in the peer info string, or 0 if none specified.
Definition: ssl.c:4088
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:334
in_addr_t push_ifconfig_remote_netmask
Definition: openvpn.h:442
bool apply_push_options(struct options *options, struct buffer *buf, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition: options.c:4770
void schedule_exit(struct context *c, const int n_seconds, const int signal)
Definition: forward.c:363
#define CC_ANY
Definition: buffer.h:883
bool auth_token_sent
If server uses –auth-gen-token and token has been sent to client.
Definition: ssl_common.h:564
const char * signal_text
Definition: sig.h:47
static bool strprefix(const char *str, const char *prefix)
Return true iff str starts with prefix.
Definition: buffer.h:938
mbedtls_md_context_t md_ctx_t
Generic message digest context.
bool buf_string_match_head_str(const struct buffer *src, const char *match)
Definition: buffer.c:793
#define M_WARN
Definition: error.h:96
#define D_ROUTE_DEBUG
Definition: errlevel.h:129
bool buf_string_compare_advance(struct buffer *src, const char *match)
Definition: buffer.c:804
#define D_PUSH_ERRORS
Definition: errlevel.h:67