OpenVPN
push.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #elif defined(_MSC_VER)
27 #include "config-msvc.h"
28 #endif
29 
30 #include "syshead.h"
31 
32 #include "push.h"
33 #include "options.h"
34 #include "ssl.h"
35 #include "ssl_verify.h"
36 #include "ssl_ncp.h"
37 #include "manage.h"
38 
39 #include "memdbg.h"
40 #include "ssl_util.h"
41 
42 static char push_reply_cmd[] = "PUSH_REPLY";
43 
44 /*
45  * Auth username/password
46  *
47  * Client received an authentication failed message from server.
48  * Runs on client.
49  */
50 void
51 receive_auth_failed(struct context *c, const struct buffer *buffer)
52 {
53  msg(M_VERB0, "AUTH: Received control message: %s", BSTR(buffer));
54  c->options.no_advance = true;
55 
56  if (c->options.pull)
57  {
58  /* Before checking how to react on AUTH_FAILED, first check if the
59  * failed auth might be the result of an expired auth-token.
60  * Note that a server restart will trigger a generic AUTH_FAILED
61  * instead an AUTH_FAILED,SESSION so handle all AUTH_FAILED message
62  * identical for this scenario */
64  {
65  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Auth failure error */
66  c->sig->signal_text = "auth-failure (auth-token)";
67  }
68  else
69  {
70  switch (auth_retry_get())
71  {
72  case AR_NONE:
73  c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- Auth failure error */
74  break;
75 
76  case AR_INTERACT:
77  ssl_purge_auth(false);
78 
79  case AR_NOINTERACT:
80  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Auth failure error */
81  break;
82 
83  default:
84  ASSERT(0);
85  }
86  c->sig->signal_text = "auth-failure";
87  }
88 #ifdef ENABLE_MANAGEMENT
89  if (management)
90  {
91  const char *reason = NULL;
92  struct buffer buf = *buffer;
93  if (buf_string_compare_advance(&buf, "AUTH_FAILED,") && BLEN(&buf))
94  {
95  reason = BSTR(&buf);
96  }
98  }
99 #endif
100  /*
101  * Save the dynamic-challenge text even when management is defined
102  */
103  {
104 #ifdef ENABLE_MANAGEMENT
105  struct buffer buf = *buffer;
106  if (buf_string_match_head_str(&buf, "AUTH_FAILED,CRV1:") && BLEN(&buf))
107  {
108  buf_advance(&buf, 12); /* Length of "AUTH_FAILED," substring */
110  }
111 #endif
112  }
113  }
114 }
115 
116 /*
117  * Act on received restart message from server
118  */
119 void
120 server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
121 {
122  if (c->options.pull)
123  {
124  struct buffer buf = *buffer;
125  const char *m = "";
126  if (buf_advance(&buf, adv) && buf_read_u8(&buf) == ',' && BLEN(&buf))
127  {
128  m = BSTR(&buf);
129  }
130 
131  /* preserve cached passwords? */
132  /* advance to next server? */
133  {
134  bool purge = true;
135 
136  if (m[0] == '[')
137  {
138  int i;
139  for (i = 1; m[i] != '\0' && m[i] != ']'; ++i)
140  {
141  if (m[i] == 'P')
142  {
143  purge = false;
144  }
145  else if (m[i] == 'N')
146  {
147  /* next server? */
148  c->options.no_advance = false;
149  }
150  }
151  }
152  if (purge)
153  {
154  ssl_purge_auth(true);
155  }
156  }
157 
158  if (restart)
159  {
160  msg(D_STREAM_ERRORS, "Connection reset command was pushed by server ('%s')", m);
161  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
162  c->sig->signal_text = "server-pushed-connection-reset";
163  }
164  else
165  {
166  msg(D_STREAM_ERRORS, "Halt command was pushed by server ('%s')", m);
167  c->sig->signal_received = SIGTERM; /* SOFT-SIGTERM -- server-pushed halt */
168  c->sig->signal_text = "server-pushed-halt";
169  }
170 #ifdef ENABLE_MANAGEMENT
171  if (management)
172  {
173  management_notify(management, "info", c->sig->signal_text, m);
174  }
175 #endif
176  }
177 }
178 
179 void
180 server_pushed_info(struct context *c, const struct buffer *buffer,
181  const int adv)
182 {
183  const char *m = "";
184  struct buffer buf = *buffer;
185 
186  if (buf_advance(&buf, adv) && buf_read_u8(&buf) == ',' && BLEN(&buf))
187  {
188  m = BSTR(&buf);
189  }
190 
191 #ifdef ENABLE_MANAGEMENT
192  struct gc_arena gc;
193  if (management)
194  {
195  gc = gc_new();
196 
197  /*
198  * We use >INFOMSG here instead of plain >INFO since INFO is used to
199  * for management greeting and we don't want to confuse the client
200  */
201  struct buffer out = alloc_buf_gc(256, &gc);
202  buf_printf(&out, ">%s:%s", "INFOMSG", m);
204 
205  gc_free(&gc);
206  }
207  #endif
208  msg(D_PUSH, "Info command was pushed by server ('%s')", m);
209 }
210 
211 void
212 receive_cr_response(struct context *c, const struct buffer *buffer)
213 {
214  struct buffer buf = *buffer;
215  const char *m = "";
216 
217  if (buf_advance(&buf, 11) && buf_read_u8(&buf) == ',' && BLEN(&buf))
218  {
219  m = BSTR(&buf);
220  }
221 #ifdef ENABLE_MANAGEMENT
223  struct man_def_auth_context *mda = session->opt->mda_context;
224  struct env_set *es = session->opt->es;
225  int key_id = get_primary_key(c->c2.tls_multi)->key_id;
226 
227 
228  management_notify_client_cr_response(key_id, mda, es, m);
229 #endif
230  msg(D_PUSH, "CR response was sent by client ('%s')", m);
231 }
232 
240 static void
242  unsigned int *server_timeout)
243 {
244  struct buffer buf = *buffer;
245 
246  /* does the buffer start with "AUTH_PENDING," ? */
247  if (!buf_advance(&buf, strlen("AUTH_PENDING"))
248  || !(buf_read_u8(&buf) == ',') || !BLEN(&buf))
249  {
250 #ifdef ENABLE_MANAGEMENT
251  if (management)
252  {
254  "", NULL, NULL, NULL, NULL);
255  }
256 #endif
257 
258  return;
259  }
260 
261  /* parse the keywords in the same way that push options are parsed */
262  char line[OPTION_LINE_SIZE];
263 
264 #ifdef ENABLE_MANAGEMENT
265  /* Need to do the management notification with the keywords before
266  * buf_parse is called, as it will insert \0 bytes into the buffer */
267  if (management)
268  {
270  BSTR(&buf), NULL, NULL, NULL, NULL);
271  }
272 #endif
273 
274  while (buf_parse(&buf, ',', line, sizeof(line)))
275  {
276  if (sscanf(line, "timeout %u", server_timeout) != 1)
277  {
278  msg(D_PUSH, "ignoring AUTH_PENDING parameter: %s", line);
279  }
280  }
281 }
282 
283 void
284 receive_auth_pending(struct context *c, const struct buffer *buffer)
285 {
286  if (!c->options.pull)
287  return;
288 
289  /* Cap the increase at the maximum time we are willing stay in the
290  * pending authentication state */
291  unsigned int max_timeout = max_uint(c->options.renegotiate_seconds/2,
293 
294  /* try to parse parameter keywords, default to hand-winow timeout if the
295  * server does not supply a timeout */
296  unsigned int server_timeout = c->options.handshake_window;
297  parse_auth_pending_keywords(buffer, &server_timeout);
298 
299  msg(D_PUSH, "AUTH_PENDING received, extending handshake timeout from %us "
300  "to %us", c->options.handshake_window,
301  min_uint(max_timeout, server_timeout));
302 
303  const struct key_state *ks = get_primary_key(c->c2.tls_multi);
304  c->c2.push_request_timeout = ks->established + min_uint(max_timeout, server_timeout);
305 }
306 
321 static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
322  int msglevel, const char *fmt, ...)
323 #ifdef __GNUC__
324 #if __USE_MINGW_ANSI_STDIO
325 __attribute__ ((format(gnu_printf, 4, 5)))
326 #else
327 __attribute__ ((format(__printf__, 4, 5)))
328 #endif
329 #endif
330 ;
331 
332 /*
333  * Send auth failed message from server to client.
334  *
335  * Does nothing if an exit is already scheduled
336  */
337 void
338 send_auth_failed(struct context *c, const char *client_reason)
339 {
341  {
342  msg(D_TLS_DEBUG, "exit already scheduled for context");
343  return;
344  }
345 
346  struct gc_arena gc = gc_new();
347  static const char auth_failed[] = "AUTH_FAILED";
348  size_t len;
349 
351 
352  len = (client_reason ? strlen(client_reason)+1 : 0) + sizeof(auth_failed);
353  if (len > PUSH_BUNDLE_SIZE)
354  {
355  len = PUSH_BUNDLE_SIZE;
356  }
357 
358  {
359  struct buffer buf = alloc_buf_gc(len, &gc);
360  buf_printf(&buf, auth_failed);
361  if (client_reason)
362  {
363  buf_printf(&buf, ",%s", client_reason);
364  }
366  }
367 
368  gc_free(&gc);
369 }
370 
371 
372 bool
373 send_auth_pending_messages(struct tls_multi *tls_multi, const char *extra,
374  unsigned int timeout)
375 {
376  struct key_state *ks = get_key_scan(tls_multi, 0);
377 
378  static const char info_pre[] = "INFO_PRE,";
379 
380  const char *const peer_info = tls_multi->peer_info;
381  unsigned int proto = extract_iv_proto(peer_info);
382 
383 
384  /* Calculate the maximum timeout and subtract the time we already waited */
385  unsigned int max_timeout = max_uint(tls_multi->opt.renegotiate_seconds/2,
386  tls_multi->opt.handshake_window);
387  max_timeout = max_timeout - (now - ks->initial);
388  timeout = min_uint(max_timeout, timeout);
389 
390  struct gc_arena gc = gc_new();
391  if ((proto & IV_PROTO_AUTH_PENDING_KW) == 0)
392  {
393  send_control_channel_string_dowork(tls_multi, "AUTH_PENDING", D_PUSH);
394  }
395  else
396  {
397  static const char auth_pre[] = "AUTH_PENDING,timeout ";
398  // Assume a worst case of 8 byte uint64 in decimal which
399  // needs 20 bytes
400  size_t len = 20 + 1 + sizeof(auth_pre);
401  struct buffer buf = alloc_buf_gc(len, &gc);
402  buf_printf(&buf, auth_pre);
403  buf_printf(&buf, "%u", timeout);
405  }
406 
407  size_t len = strlen(extra) + 1 + sizeof(info_pre);
408  if (len > PUSH_BUNDLE_SIZE)
409  {
410  gc_free(&gc);
411  return false;
412  }
413 
414  struct buffer buf = alloc_buf_gc(len, &gc);
415  buf_printf(&buf, info_pre);
416  buf_printf(&buf, "%s", extra);
418 
419  ks->auth_deferred_expire = now + timeout;
420 
421  gc_free(&gc);
422  return true;
423 }
424 
425 /*
426  * Send restart message from server to client.
427  */
428 void
429 send_restart(struct context *c, const char *kill_msg)
430 {
432  send_control_channel_string(c, kill_msg ? kill_msg : "RESTART", D_PUSH);
433 }
434 
435 /*
436  * Push/Pull
437  */
438 
439 void
440 incoming_push_message(struct context *c, const struct buffer *buffer)
441 {
442  struct gc_arena gc = gc_new();
443  unsigned int option_types_found = 0;
444 
445  msg(D_PUSH, "PUSH: Received control message: '%s'", sanitize_control_message(BSTR(buffer), &gc));
446 
447  int status = process_incoming_push_msg(c, buffer, c->options.pull,
449  &option_types_found);
450 
451  if (status == PUSH_MSG_ERROR)
452  {
453  msg(D_PUSH_ERRORS, "WARNING: Received bad push/pull message: %s", sanitize_control_message(BSTR(buffer), &gc));
454  }
455  else if (status == PUSH_MSG_REPLY || status == PUSH_MSG_CONTINUATION)
456  {
457  c->options.push_option_types_found |= option_types_found;
458 
459  /* delay bringing tun/tap up until --push parms received from remote */
460  if (status == PUSH_MSG_REPLY)
461  {
462  if (!do_up(c, true, c->options.push_option_types_found))
463  {
464  msg(D_PUSH_ERRORS, "Failed to open tun/tap interface");
465  goto error;
466  }
467  }
470  }
471 
472  goto cleanup;
473 
474 error:
475  register_signal(c, SIGUSR1, "process-push-msg-failed");
476 cleanup:
477  gc_free(&gc);
478 }
479 
480 bool
482 {
483  const struct key_state *ks = get_primary_key(c->c2.tls_multi);
484 
485  /* We timeout here under two conditions:
486  * a) we reached the hard limit of push_request_timeout
487  * b) we have not seen anything from the server in hand_window time
488  *
489  * for non auth-pending scenario, push_request_timeout is the same as
490  * hand_window timeout. For b) every PUSH_REQUEST is a acknowledged by
491  * the server by a P_ACK_V1 packet that reset the keepalive timer
492  */
493 
494  if (c->c2.push_request_timeout > now
496  {
497  return send_control_channel_string(c, "PUSH_REQUEST", D_PUSH);
498  }
499  else
500  {
501  msg(D_STREAM_ERRORS, "No reply from server to push requests in %ds",
502  (int)(now - ks->established));
503  c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- server-pushed connection reset */
504  c->sig->signal_text = "no-push-reply";
505  return false;
506  }
507 }
508 
517 void
519  struct push_list *push_list)
520 {
521  /*
522  * If server uses --auth-gen-token and we have an auth token
523  * to send to the client
524  */
525  if (tls_multi->auth_token)
526  {
527  push_option_fmt(gc, push_list, M_USAGE,
528  "auth-token %s",
529  tls_multi->auth_token);
530  if (!tls_multi->auth_token_initial)
531  {
532  /*
533  * Save the initial auth token for clients that ignore
534  * the updates to the token
535  */
536  tls_multi->auth_token_initial = strdup(tls_multi->auth_token);
537  }
538  }
539 }
540 
550 bool
551 prepare_push_reply(struct context *c, struct gc_arena *gc,
552  struct push_list *push_list)
553 {
554  struct tls_multi *tls_multi = c->c2.tls_multi;
555  struct options *o = &c->options;
556 
557  /* ipv6 */
559  {
560  push_option_fmt(gc, push_list, M_USAGE, "ifconfig-ipv6 %s/%d %s",
564  0, gc));
565  }
566 
567  /* ipv4 */
571  {
574  {
575  ifconfig_local = c->c2.push_ifconfig_local_alias;
576  }
577  push_option_fmt(gc, push_list, M_USAGE, "ifconfig %s %s",
578  print_in_addr_t(ifconfig_local, 0, gc),
580  0, gc));
581  }
582 
583  if (tls_multi->use_peer_id)
584  {
585  push_option_fmt(gc, push_list, M_USAGE, "peer-id %d",
586  tls_multi->peer_id);
587  }
588  /*
589  * If server uses --auth-gen-token and we have an auth token
590  * to send to the client
591  */
592  prepare_auth_token_push_reply(tls_multi, gc, push_list);
593 
594  /*
595  * Push the selected cipher, at this point the cipher has been
596  * already negotiated and been fixed.
597  *
598  * We avoid pushing the cipher to clients not supporting NCP
599  * to avoid error messages in their logs
600  */
602  {
603  push_option_fmt(gc, push_list, M_USAGE, "cipher %s", o->ciphername);
604  }
606  {
607  push_option_fmt(gc, push_list, M_USAGE, "key-derivation tls-ekm");
608  }
609  return true;
610 }
611 
612 static bool
613 send_push_options(struct context *c, struct buffer *buf,
614  struct push_list *push_list, int safe_cap,
615  bool *push_sent, bool *multi_push)
616 {
617  struct push_entry *e = push_list->head;
618 
619  e = push_list->head;
620  while (e)
621  {
622  if (e->enable)
623  {
624  const int l = strlen(e->option);
625  if (BLEN(buf) + l >= safe_cap)
626  {
627  buf_printf(buf, ",push-continuation 2");
628  {
629  const bool status = send_control_channel_string(c, BSTR(buf), D_PUSH);
630  if (!status)
631  {
632  return false;
633  }
634  *push_sent = true;
635  *multi_push = true;
636  buf_reset_len(buf);
637  buf_printf(buf, "%s", push_reply_cmd);
638  }
639  }
640  if (BLEN(buf) + l >= safe_cap)
641  {
642  msg(M_WARN, "--push option is too long");
643  return false;
644  }
645  buf_printf(buf, ",%s", e->option);
646  }
647  e = e->next;
648  }
649  return true;
650 }
651 
652 void
654 {
655  struct gc_arena gc = gc_new();
656  struct push_list push_list = { 0 };
657 
658  prepare_auth_token_push_reply(multi, &gc, &push_list);
659 
660  /* prepare auth token should always add the auth-token option */
661  struct push_entry *e = push_list.head;
662  ASSERT(e && e->enable);
663 
664  /* Construct a mimimal control channel push reply message */
665  struct buffer buf = alloc_buf_gc(PUSH_BUNDLE_SIZE, &gc);
666  buf_printf(&buf, "%s, %s", push_reply_cmd, e->option);
668  gc_free(&gc);
669 }
670 
671 bool
672 send_push_reply(struct context *c, struct push_list *per_client_push_list)
673 {
674  struct gc_arena gc = gc_new();
675  struct buffer buf = alloc_buf_gc(PUSH_BUNDLE_SIZE, &gc);
676  bool multi_push = false;
677  const int extra = 84; /* extra space for possible trailing ifconfig and push-continuation */
678  const int safe_cap = BCAP(&buf) - extra;
679  bool push_sent = false;
680 
681  buf_printf(&buf, "%s", push_reply_cmd);
682 
683  /* send options which are common to all clients */
684  if (!send_push_options(c, &buf, &c->options.push_list, safe_cap,
685  &push_sent, &multi_push))
686  {
687  goto fail;
688  }
689 
690  /* send client-specific options */
691  if (!send_push_options(c, &buf, per_client_push_list, safe_cap,
692  &push_sent, &multi_push))
693  {
694  goto fail;
695  }
696 
697  if (multi_push)
698  {
699  buf_printf(&buf, ",push-continuation 1");
700  }
701 
702  if (BLEN(&buf) > sizeof(push_reply_cmd)-1)
703  {
704  const bool status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
705  if (!status)
706  {
707  goto fail;
708  }
709  push_sent = true;
710  }
711 
712  /* If nothing have been pushed, send an empty push,
713  * as the client is expecting a response
714  */
715  if (!push_sent)
716  {
717  bool status = false;
718 
719  buf_reset_len(&buf);
720  buf_printf(&buf, "%s", push_reply_cmd);
721  status = send_control_channel_string(c, BSTR(&buf), D_PUSH);
722  if (!status)
723  {
724  goto fail;
725  }
726  }
727 
728  gc_free(&gc);
729  return true;
730 
731 fail:
732  gc_free(&gc);
733  return false;
734 }
735 
736 static void
737 push_option_ex(struct gc_arena *gc, struct push_list *push_list,
738  const char *opt, bool enable, int msglevel)
739 {
740  if (!string_class(opt, CC_ANY, CC_COMMA))
741  {
742  msg(msglevel, "PUSH OPTION FAILED (illegal comma (',') in string): '%s'", opt);
743  }
744  else
745  {
746  struct push_entry *e;
747  ALLOC_OBJ_CLEAR_GC(e, struct push_entry, gc);
748  e->enable = true;
749  e->option = opt;
750  if (push_list->head)
751  {
752  ASSERT(push_list->tail);
753  push_list->tail->next = e;
754  push_list->tail = e;
755  }
756  else
757  {
758  ASSERT(!push_list->tail);
759  push_list->head = e;
760  push_list->tail = e;
761  }
762  }
763 }
764 
765 void
766 push_option(struct options *o, const char *opt, int msglevel)
767 {
768  push_option_ex(&o->gc, &o->push_list, opt, true, msglevel);
769 }
770 
771 void
773 {
774  if (o->push_list.head)
775  {
776  const struct push_entry *e = o->push_list.head;
777  push_reset(o);
778  while (e)
779  {
780  push_option_ex(&o->gc, &o->push_list,
781  string_alloc(e->option, &o->gc), true, M_FATAL);
782  e = e->next;
783  }
784  }
785 }
786 
787 void
788 push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
789 {
790  const char **argv = make_extended_arg_array(p, false, gc);
791  char *opt = print_argv(argv, gc, 0);
792  push_option(o, opt, msglevel);
793 }
794 
795 static bool
796 push_option_fmt(struct gc_arena *gc, struct push_list *push_list,
797  int msglevel, const char *format, ...)
798 {
799  va_list arglist;
800  char tmp[256] = {0};
801  int len;
802  va_start(arglist, format);
803  len = vsnprintf(tmp, sizeof(tmp), format, arglist);
804  va_end(arglist);
805  if (len > sizeof(tmp)-1)
806  {
807  return false;
808  }
809  push_option_ex(gc, push_list, string_alloc(tmp, gc), true, msglevel);
810  return true;
811 }
812 
813 void
814 push_reset(struct options *o)
815 {
816  CLEAR(o->push_list);
817 }
818 
819 void
820 push_remove_option(struct options *o, const char *p)
821 {
822  msg(D_PUSH_DEBUG, "PUSH_REMOVE searching for: '%s'", p);
823 
824  /* ifconfig is special, as not part of the push list */
825  if (streq(p, "ifconfig"))
826  {
827  o->push_ifconfig_ipv4_blocked = true;
828  return;
829  }
830 
831  /* ifconfig-ipv6 is special, as not part of the push list */
832  if (streq( p, "ifconfig-ipv6" ))
833  {
834  o->push_ifconfig_ipv6_blocked = true;
835  return;
836  }
837 
838  if (o && o->push_list.head)
839  {
840  struct push_entry *e = o->push_list.head;
841 
842  /* cycle through the push list */
843  while (e)
844  {
845  if (e->enable
846  && strncmp( e->option, p, strlen(p) ) == 0)
847  {
848  msg(D_PUSH_DEBUG, "PUSH_REMOVE removing: '%s'", e->option);
849  e->enable = false;
850  }
851 
852  e = e->next;
853  }
854  }
855 }
856 
857 int
859 {
860  int ret = PUSH_MSG_ERROR;
861 
862 
865  {
866  const char *client_reason = tls_client_reason(c->c2.tls_multi);
867  send_auth_failed(c, client_reason);
868  ret = PUSH_MSG_AUTH_FAILURE;
869  }
870  else if (c->c2.tls_multi->multi_state == CAS_SUCCEEDED)
871  {
872  time_t now;
873 
874  openvpn_time(&now);
875  if (c->c2.sent_push_reply_expiry > now)
876  {
878  }
879  else
880  {
881  /* per-client push options - peer-id, cipher, ifconfig, ipv6-ifconfig */
882  struct push_list push_list = { 0 };
883  struct gc_arena gc = gc_new();
884 
885  if (prepare_push_reply(c, &gc, &push_list)
886  && send_push_reply(c, &push_list))
887  {
888  ret = PUSH_MSG_REQUEST;
889  c->c2.sent_push_reply_expiry = now + 30;
890  }
891  gc_free(&gc);
892  }
893  }
894  else
895  {
897  }
898 
899  return ret;
900 }
901 
902 static void
903 push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
904 {
905  char line[OPTION_PARM_SIZE];
906  while (buf_parse(buf, ',', line, sizeof(line)))
907  {
908  /* peer-id might change on restart and this should not trigger reopening tun */
909  if (strprefix(line, "peer-id "))
910  {
911  continue;
912  }
913  /* tun reopen only needed if cipher change can change tun MTU */
914  if (strprefix(line, "cipher ") && !opt->ce.tun_mtu_defined)
915  {
916  continue;
917  }
918  md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
919  }
920 }
921 
922 static int
924  unsigned int permission_mask,
925  unsigned int *option_types_found,
926  struct buffer *buf)
927 {
928  int ret = PUSH_MSG_ERROR;
929  const uint8_t ch = buf_read_u8(buf);
930  if (ch == ',')
931  {
932  struct buffer buf_orig = (*buf);
934  {
938  }
939  if (apply_push_options(&c->options,
940  buf,
941  permission_mask,
942  option_types_found,
943  c->c2.es))
944  {
946  &c->options);
947  switch (c->options.push_continuation)
948  {
949  case 0:
950  case 1:
955  c->c2.pulled_options_state = NULL;
957  ret = PUSH_MSG_REPLY;
958  break;
959 
960  case 2:
961  ret = PUSH_MSG_CONTINUATION;
962  break;
963  }
964  }
965  }
966  else if (ch == '\0')
967  {
968  ret = PUSH_MSG_REPLY;
969  }
970  /* show_settings (&c->options); */
971  return ret;
972 }
973 
974 int
976  const struct buffer *buffer,
977  bool honor_received_options,
978  unsigned int permission_mask,
979  unsigned int *option_types_found)
980 {
981  struct buffer buf = *buffer;
982 
983  if (buf_string_compare_advance(&buf, "PUSH_REQUEST"))
984  {
985  c->c2.push_request_received = true;
987  }
988  else if (honor_received_options
990  {
991  return process_incoming_push_reply(c, permission_mask,
992  option_types_found, &buf);
993  }
994  else
995  {
996  return PUSH_MSG_ERROR;
997  }
998 }
999 
1000 
1001 /*
1002  * Remove iroutes from the push_list.
1003  */
1004 void
1006 {
1007  if (o && o->push_list.head && o->iroutes)
1008  {
1009  struct gc_arena gc = gc_new();
1010  struct push_entry *e = o->push_list.head;
1011 
1012  /* cycle through the push list */
1013  while (e)
1014  {
1015  char *p[MAX_PARMS];
1016  bool enable = true;
1017 
1018  /* parse the push item */
1019  CLEAR(p);
1020  if (e->enable
1021  && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
1022  {
1023  /* is the push item a route directive? */
1024  if (p[0] && !strcmp(p[0], "route") && !p[3])
1025  {
1026  /* get route parameters */
1027  bool status1, status2;
1028  const in_addr_t network = getaddr(GETADDR_HOST_ORDER, p[1], 0, &status1, NULL);
1029  const in_addr_t netmask = getaddr(GETADDR_HOST_ORDER, p[2] ? p[2] : "255.255.255.255", 0, &status2, NULL);
1030 
1031  /* did route parameters parse correctly? */
1032  if (status1 && status2)
1033  {
1034  const struct iroute *ir;
1035 
1036  /* does route match an iroute? */
1037  for (ir = o->iroutes; ir != NULL; ir = ir->next)
1038  {
1039  if (network == ir->network && netmask == netbits_to_netmask(ir->netbits >= 0 ? ir->netbits : 32))
1040  {
1041  enable = false;
1042  break;
1043  }
1044  }
1045  }
1046  }
1047 
1048  /* should we copy the push item? */
1049  e->enable = enable;
1050  if (!enable)
1051  {
1052  msg(D_PUSH, "REMOVE PUSH ROUTE: '%s'", e->option);
1053  }
1054  }
1055 
1056  e = e->next;
1057  }
1058 
1059  gc_free(&gc);
1060  }
1061 }
struct env_set * es
Definition: openvpn.h:407
bool string_class(const char *str, const unsigned int inclusive, const unsigned int exclusive)
Definition: buffer.c:1058
void receive_auth_failed(struct context *c, const struct buffer *buffer)
Definition: push.c:51
void prepare_auth_token_push_reply(struct tls_multi *tls_multi, struct gc_arena *gc, struct push_list *push_list)
Prepare push option for auth-token.
Definition: push.c:518
static void buf_reset_len(struct buffer *buf)
Definition: buffer.h:299
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:492
Security parameter state of one TLS and data channel key session.
Definition: ssl_common.h:194
bool tun_mtu_defined
Definition: options.h:118
void send_restart(struct context *c, const char *kill_msg)
Definition: push.c:429
struct iroute * next
Definition: route.h:237
static const char * tls_client_reason(struct tls_multi *multi)
Definition: ssl_verify.h:260
md_ctx_t * md_ctx_new(void)
struct options options
Options loaded from command line or configuration file.
Definition: openvpn.h:465
#define PUSH_MSG_CONTINUATION
Definition: push.h:34
bool push_ifconfig_ipv6_blocked
Definition: options.h:471
void ssl_put_auth_challenge(const char *cr_str)
Definition: ssl.c:489
char * string_alloc(const char *str, struct gc_arena *gc)
Definition: buffer.c:685
#define D_TLS_DEBUG
Definition: errlevel.h:163
#define streq(x, y)
Definition: options.h:664
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, volatile int *signal_received)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition: socket.c:193
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:639
struct push_entry * head
Definition: pushlist.h:36
bool do_up(struct context *c, bool pulled_options, unsigned int option_types_found)
Definition: init.c:2140
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2896
void clone_push_list(struct options *o)
Definition: push.c:772
Contains all state information for one tunnel.
Definition: openvpn.h:463
#define UP_TYPE_AUTH
Definition: ssl_common.h:41
#define IV_PROTO_AUTH_PENDING_KW
Supports signaling keywords with AUTH_PENDING, e.g.
Definition: ssl.h:120
#define PUSH_BUNDLE_SIZE
Definition: common.h:75
#define D_PUSH
Definition: errlevel.h:83
#define M_USAGE
Definition: error.h:115
struct tls_options * opt
Definition: ssl_common.h:437
bool push_ifconfig_defined
Definition: openvpn.h:415
char * peer_info
Definition: ssl_common.h:595
char * auth_token_initial
The first auth-token we sent to a client, for clients that do not update their auth-token (older Open...
Definition: ssl_common.h:600
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1023
void receive_auth_pending(struct context *c, const struct buffer *buffer)
Parses an AUTH_PENDING message and if in pull mode extends the timeout.
Definition: push.c:284
static const struct key_state * get_primary_key(const struct tls_multi *multi)
gets an item of key_state objects in the order they should be scanned by data channel modules...
Definition: ssl_common.h:659
void send_auth_failed(struct context *c, const char *client_reason)
Definition: push.c:338
bool send_control_channel_string(struct context *c, const char *str, int msglevel)
Definition: forward.c:346
void management_auth_failure(struct management *man, const char *type, const char *reason)
Definition: manage.c:3062
in_addr_t push_ifconfig_local
Definition: openvpn.h:417
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:542
void management_notify(struct management *man, const char *severity, const char *type, const char *text)
Definition: manage.c:2869
void send_push_reply_auth_token(struct tls_multi *multi)
Sends a push reply message only containin the auth-token to update the auth-token on the client...
Definition: push.c:653
int renegotiate_seconds
Definition: options.h:587
#define SIGUSR1
Definition: config-msvc.h:115
bool pulled_options_digest_init_done
Definition: openvpn.h:430
struct in6_addr push_ifconfig_ipv6_local
Definition: openvpn.h:422
struct event_timeout wait_for_connect
Definition: openvpn.h:282
static in_addr_t netbits_to_netmask(const int netbits)
Definition: route.h:377
unsigned int extract_iv_proto(const char *peer_info)
Extracts the IV_PROTO variable and returns its value or 0 if it cannot be extracted.
Definition: ssl_util.c:64
void push_reset(struct options *o)
Definition: push.c:814
int handshake_window
Definition: ssl_common.h:298
#define AR_NONE
Definition: options.h:838
void md_ctx_free(md_ctx_t *ctx)
struct in6_addr push_ifconfig_ipv6_remote
Definition: openvpn.h:424
void receive_cr_response(struct context *c, const struct buffer *buffer)
Definition: push.c:212
bool buf_printf(struct buffer *buf, const char *format,...)
Definition: buffer.c:242
struct man_def_auth_context * mda_context
Definition: ssl_common.h:385
static void event_timeout_clear(struct event_timeout *et)
Definition: interval.h:150
#define SIZE(x)
Definition: basic.h:30
#define in_addr_t
Definition: config-msvc.h:103
static int buf_read_u8(struct buffer *buf)
Definition: buffer.h:812
struct signal_info * sig
Internal error signaling object.
Definition: openvpn.h:490
#define MAX_PARMS
Definition: options.h:51
struct push_entry * next
Definition: pushlist.h:30
int parse_line(const char *line, char *p[], const int n, const char *file, const int line_num, int msglevel, struct gc_arena *gc)
Definition: options.c:4502
char * print_argv(const char **p, struct gc_arena *gc, const unsigned int flags)
Definition: buffer.c:753
#define SIGTERM
Definition: config-msvc.h:117
int handshake_window
Definition: options.h:592
#define ASSERT(x)
Definition: error.h:204
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer...
Definition: ssl_common.h:629
int scheduled_exit_interval
Definition: options.h:503
static int process_incoming_push_reply(struct context *c, unsigned int permission_mask, unsigned int *option_types_found, struct buffer *buf)
Definition: push.c:923
bool send_push_request(struct context *c)
Definition: push.c:481
unsigned int data_channel_crypto_flags
Definition: options.h:661
bool use_peer_id
Definition: ssl_common.h:621
static void parse_auth_pending_keywords(const struct buffer *buffer, unsigned int *server_timeout)
Parse the keyword for the AUTH_PENDING request.
Definition: push.c:241
int netbits
Definition: route.h:236
bool tls_peer_supports_ncp(const char *peer_info)
Returns whether the client supports NCP either by announcing IV_NCP>=2 or the IV_CIPHERS list...
Definition: ssl_ncp.c:79
#define BCAP(buf)
Definition: buffer.h:130
bool send_control_channel_string_dowork(struct tls_multi *multi, const char *str, int msglevel)
Definition: forward.c:321
#define CC_COMMA
Definition: buffer.h:928
int len
Length in bytes of the actual content within the allocated memory.
Definition: buffer.h:66
#define fail()
Definition: cmocka.h:1531
bool push_request_received
Definition: openvpn.h:414
Definition: pushlist.h:29
#define CLEAR(x)
Definition: basic.h:33
static bool push_option_fmt(struct gc_arena *gc, struct push_list *push_list, int msglevel, const char *fmt,...)
Add an option to the given push list by providing a format string.
Definition: push.c:796
void md_ctx_final(md_ctx_t *ctx, uint8_t *dst)
void push_remove_option(struct options *o, const char *p)
Definition: push.c:820
#define PUSH_MSG_REPLY
Definition: push.h:31
md_ctx_t * pulled_options_state
Definition: openvpn.h:431
interval_t renegotiate_seconds
Definition: ssl_common.h:302
#define PUSH_MSG_REQUEST
Definition: push.h:30
#define OPTION_PARM_SIZE
Definition: options.h:56
static char push_reply_cmd[]
Definition: push.c:42
int process_incoming_push_msg(struct context *c, const struct buffer *buffer, bool honor_received_options, unsigned int permission_mask, unsigned int *option_types_found)
Definition: push.c:975
void md_ctx_update(md_ctx_t *ctx, const uint8_t *src, int src_len)
#define PUSH_MSG_REQUEST_DEFERRED
Definition: push.h:32
static struct gc_arena gc_new(void)
Definition: buffer.h:1015
time_t now
Definition: otime.c:36
time_t established
Definition: ssl_common.h:207
void management_notify_generic(struct management *man, const char *str)
Definition: manage.c:2875
in_addr_t push_ifconfig_local_alias
Definition: openvpn.h:419
#define OPTION_LINE_SIZE
Definition: options.h:57
int auth_retry_get(void)
Definition: options.c:4313
static void push_option_ex(struct gc_arena *gc, struct push_list *push_list, const char *opt, bool enable, int msglevel)
Definition: push.c:737
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2876
struct iroute * iroutes
Definition: options.h:457
static bool event_timeout_defined(const struct event_timeout *et)
Definition: interval.h:144
const char * option
Definition: pushlist.h:32
int push_ifconfig_ipv6_netbits
Definition: openvpn.h:423
enum tls_auth_status tls_authentication_status(struct tls_multi *multi)
Return current session authentication state of the tls_multi structure This will return TLS_AUTHENTIC...
Definition: ssl_verify.c:1097
void remove_iroutes_from_push_route_list(struct options *o)
Definition: push.c:1005
uint8_t digest[SHA256_DIGEST_LENGTH]
Definition: crypto.h:133
const char * ciphername
Definition: options.h:512
void ssl_purge_auth(const bool auth_user_pass_only)
Definition: ssl.c:464
void push_options(struct options *o, char **p, int msglevel, struct gc_arena *gc)
Definition: push.c:788
in_addr_t network
Definition: route.h:235
__attribute__((unused))
Definition: test.c:41
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition: crypto.h:257
#define vsnprintf
struct event_timeout scheduled_exit
Definition: openvpn.h:434
static bool send_push_options(struct context *c, struct buffer *buf, struct push_list *push_list, int safe_cap, bool *push_sent, bool *multi_push)
Definition: push.c:613
struct tls_options opt
Definition: ssl_common.h:548
const char * sanitize_control_message(const char *src, struct gc_arena *gc)
Definition: misc.c:629
const char ** make_extended_arg_array(char **p, bool is_inline, struct gc_arena *gc)
Definition: misc.c:599
const md_kt_t * md_kt_get(const char *digest)
Return message digest parameters, based on the given digest name.
static time_t openvpn_time(time_t *t)
Definition: otime.h:90
static struct key_state * get_key_scan(struct tls_multi *multi, int index)
gets an item of key_state objects in the order they should be scanned by data channel modules...
Definition: ssl_common.h:639
bool enable
Definition: pushlist.h:31
bool push_ifconfig_ipv4_blocked
Definition: options.h:466
void incoming_push_message(struct context *c, const struct buffer *buffer)
Definition: push.c:440
#define GETADDR_HOST_ORDER
Definition: socket.h:473
struct connection_entry ce
Definition: options.h:248
struct context_2 c2
Level 2 context.
Definition: openvpn.h:504
struct push_list push_list
Definition: options.h:435
unsigned int pull_permission_mask(const struct context *c)
Definition: init.c:2213
time_t sent_push_reply_expiry
Definition: openvpn.h:416
void md_ctx_cleanup(md_ctx_t *ctx)
#define PUSH_MSG_AUTH_FAILURE
Definition: push.h:33
#define PUSH_MSG_ERROR
Definition: push.h:29
enum client_connect_status multi_state
Definition: ssl_common.h:564
#define BLEN(buf)
Definition: buffer.h:127
time_t auth_deferred_expire
Definition: ssl_common.h:237
bool prepare_push_reply(struct context *c, struct gc_arena *gc, struct push_list *push_list)
Prepare push options, based on local options.
Definition: push.c:551
int push_continuation
Definition: options.h:498
#define msg(flags,...)
Definition: error.h:153
int key_id
Key id for this key_state, inherited from struct tls_session.
Definition: ssl_common.h:202
struct event_timeout push_request_interval
Definition: openvpn.h:426
unsigned int push_option_types_found
Definition: options.h:499
bool no_advance
Definition: options.h:253
bool push_ifconfig_ipv6_defined
Definition: openvpn.h:421
volatile int signal_received
Definition: sig.h:45
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition: buffer.h:1087
char * auth_token
If server sends a generated auth-token, this is the token to use for future user/pass authentications...
Definition: ssl_common.h:596
bool ssl_clean_auth_token(void)
Definition: ssl.c:453
bool buf_parse(struct buffer *buf, const int delim, char *line, const int size)
Definition: buffer.c:861
time_t push_request_timeout
Definition: openvpn.h:427
struct push_entry * tail
Definition: pushlist.h:37
void register_signal(struct context *c, int sig, const char *text)
Definition: sig.c:447
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:434
struct sha256_digest pulled_options_digest
Definition: openvpn.h:432
bool send_push_reply(struct context *c, struct push_list *per_client_push_list)
Definition: push.c:672
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
#define M_FATAL
Definition: error.h:98
#define PUSH_MSG_ALREADY_REPLIED
Definition: push.h:35
time_t peer_last_packet
Definition: ssl_common.h:210
void server_pushed_signal(struct context *c, const struct buffer *buffer, const bool restart, const int adv)
Definition: push.c:120
void management_set_state(struct management *man, const int state, const char *detail, const in_addr_t *tun_local_ip, const struct in6_addr *tun_local_ip6, const struct openvpn_sockaddr *local, const struct openvpn_sockaddr *remote)
Definition: manage.c:2718
static void push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
Definition: push.c:903
void management_notify_client_cr_response(unsigned mda_key_id, const struct man_def_auth_context *mdac, const struct env_set *es, const char *response)
Definition: manage.c:2932
#define AR_NOINTERACT
Definition: options.h:840
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:90
uint32_t peer_id
Definition: ssl_common.h:620
Definition: route.h:234
#define M_WARN
Definition: error.h:100
static unsigned int max_uint(unsigned int x, unsigned int y)
Definition: integer.h:43
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
time_t initial
Definition: ssl_common.h:206
void md_ctx_init(md_ctx_t *ctx, const md_kt_t *kt)
#define AR_INTERACT
Definition: options.h:839
static unsigned int min_uint(unsigned int x, unsigned int y)
Definition: integer.h:56
const char * ifconfig_local
Definition: options.h:270
#define D_STREAM_ERRORS
Definition: errlevel.h:63
bool pull
Definition: options.h:497
int process_incoming_push_request(struct context *c)
Definition: push.c:858
#define BSTR(buf)
Definition: buffer.h:129
void push_option(struct options *o, const char *opt, int msglevel)
Definition: push.c:766
#define D_PUSH_DEBUG
Definition: errlevel.h:150
Definition: argv.h:35
bool send_auth_pending_messages(struct tls_multi *tls_multi, const char *extra, unsigned int timeout)
Sends the auth pending control messages to a client.
Definition: push.c:373
struct gc_arena gc
Definition: options.h:215
#define M_VERB0
Definition: errlevel.h:53
static SERVICE_STATUS status
Definition: interactive.c:56
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:318
in_addr_t push_ifconfig_remote_netmask
Definition: openvpn.h:418
bool apply_push_options(struct options *options, struct buffer *buf, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition: options.c:5034
void schedule_exit(struct context *c, const int n_seconds, const int signal)
Definition: forward.c:443
#define CC_ANY
Definition: buffer.h:907
#define OPENVPN_STATE_AUTH_PENDING
Definition: manage.h:496
const char * signal_text
Definition: sig.h:47
static bool strprefix(const char *str, const char *prefix)
Return true iff str starts with prefix.
Definition: buffer.h:962
mbedtls_md_context_t md_ctx_t
Generic message digest context.
bool buf_string_match_head_str(const struct buffer *src, const char *match)
Definition: buffer.c:814
struct env_set * es
Definition: ssl_common.h:361
#define D_ROUTE_DEBUG
Definition: errlevel.h:131
void server_pushed_info(struct context *c, const struct buffer *buffer, const int adv)
Definition: push.c:180
bool buf_string_compare_advance(struct buffer *src, const char *match)
Definition: buffer.c:825
#define D_PUSH_ERRORS
Definition: errlevel.h:67