#include "syshead.h"
#include "multi.h"
#include <inttypes.h>
#include "forward.h"
#include "memdbg.h"
#include "ssl_pkt.h"

Include dependency graph for mudp.c:

Functions
static void	send_standalone_reply (struct multi_context m, struct buffer buf, const char prefix, const char detail, struct link_socket *sock)
	Send an already-built standalone control packet back to the peer that just contacted us (c2.from), synchronously and without keeping any state.

static void	send_hmac_reset_packet (struct multi_context m, struct tls_pre_decrypt_state state, struct tls_auth_standalone tas, struct session_id sid, bool request_resend_wkc, struct link_socket *sock)

static bool	do_pre_decrypt_check (struct multi_context m, struct tls_pre_decrypt_state state, struct mroute_addr addr, struct link_socket *sock)

static struct multi_instance *	handle_connection_attempt (struct multi_context m, struct link_socket sock, struct mroute_addr *real)
	Handles a packet if no existing session exists for this incoming packet.

static struct multi_instance *	multi_get_instance_udp_real (struct multi_context m, struct mroute_addr real)
	Looks up an multi instance by its real address (IP and port)

struct multi_instance *	multi_get_instance_udp_control (struct multi_context m, struct link_socket sock)

struct multi_instance *	multi_get_instance_udp_data (struct multi_context m, bool floated, struct mroute_addr real, struct link_socket sock)
	Get a client instance based on real address.

struct multi_instance *	multi_get_create_instance_udp (struct multi_context m, bool floated, struct link_socket *sock)
	Get, and if necessary create, the multi_instance associated with a packet's source address.

static void	multi_process_outgoing_link (struct multi_context *m, const unsigned int mpp_flags)

void	multi_process_io_udp (struct multi_context m, struct link_socket sock, unsigned int rwflags)

Function Documentation

◆ do_pre_decrypt_check()

static bool do_pre_decrypt_check	(	struct multi_context *	m,
		struct tls_pre_decrypt_state *	state,
		struct mroute_addr	addr,
		struct link_socket *	sock
	)

static

Definition at line 93 of file mudp.c.

References ASSERT, BPTR, context_2::buf, buf_advance(), context::c2, calculate_session_id_hmac(), check_session_hmac_and_pkt_id(), CO_FORCE_TLSCRYPTV2_COOKIE, D_MULTI_DEBUG, D_MULTI_MEDIUM, link_socket_actual::dest, EARLY_NEG_MASK, EARLY_NEG_START, crypto_options::flags, context_2::from, gc, gc_free(), gc_new(), options::handshake_window, multi_context::initial_rate_limiter, buffer::len, msg, tls_wrap_ctx::opt, context::options, P_OPCODE_SHIFT, packet_id_read(), packet_opcode_name(), tls_pre_decrypt_state::peer_session_id, print_link_socket_actual(), reflect_filter_rate_limit_check(), send_hmac_reset_packet(), context_2::session_id_key, SID_SIZE, context_2::tls_auth_standalone, tls_pre_decrypt_lite(), tls_auth_standalone::tls_wrap, multi_context::top, VERDICT_VALID_ACK_V1, VERDICT_VALID_CONTROL_V1, VERDICT_VALID_RESET_V2, VERDICT_VALID_RESET_V3, and VERDICT_VALID_WKC_V1.

Referenced by handle_connection_attempt().

◆ handle_connection_attempt()

static struct multi_instance * handle_connection_attempt	(	struct multi_context *	m,
		struct link_socket *	sock,
		struct mroute_addr *	real
	)

static

Handles a packet if no existing session exists for this incoming packet.

It will either send a reply with a hmac cookie if this is the first packet of a three-way handshake or create a multi_instance if it is a packet that completes the three-way handshake.

Definition at line 219 of file mudp.c.

References context::c2, multi_instance::context, D_MULTI_ERRORS, multi_context::deferred_shutdown_signal, multi_instance::did_real_hash, do_pre_decrypt_check(), free_tls_pre_decrypt_state(), frequency_limit_event_allowed(), context_2::from, gc, gc_free(), gc_new(), multi_context::hash, hash_add_fast(), hash_value(), multi_context::initial_rate_limiter, mroute_addr_print(), msg, multi_assign_peer_id(), multi_create_instance(), tls_multi::n_sessions, multi_context::new_connection_limiter, tls_pre_decrypt_state::peer_session_id, multi_instance::real, reflect_filter_rate_limit_decrease(), tls_pre_decrypt_state::server_session_id, tls_multi::session, session_id_defined(), session_skip_to_pre_start(), deferred_signal_schedule_entry::signal_received, context_2::tls_multi, TM_INITIAL, and multi_context::top.

Referenced by multi_get_create_instance_udp().

◆ multi_get_instance_udp_control()

struct multi_instance * multi_get_instance_udp_control	(	struct multi_context *	m,
		struct link_socket *	sock
	)

Definition at line 304 of file mudp.c.

References link_socket::info, mroute_addr::len, mroute_extract_openvpn_sockaddr(), multi_get_instance_udp_real(), mroute_addr::proto, and link_socket_info::proto.

Referenced by multi_get_create_instance_udp().

◆ multi_get_instance_udp_data()

struct multi_instance * multi_get_instance_udp_data	(	struct multi_context *	m,
		bool *	floated,
		struct mroute_addr *	real,
		struct link_socket *	sock
	)

Get a client instance based on real address.

If the instance doesn't exist, create it while maintaining real address hash table atomicity.

Definition at line 323 of file mudp.c.

References BPTR, context_2::buf, context::c2, multi_instance::context, D_MULTI_MEDIUM, context_2::from, gc, gc_free(), gc_new(), link_socket::info, multi_context::instances, buffer::len, link_socket_actual_match(), context_2::link_sockets, MAX_PEER_ID, mroute_addr_print(), msg, multi_get_instance_udp_real(), P_DATA_V2, P_OPCODE_SHIFT, link_socket_info::proto, multi_context::top, and ungenerate_prefix().

Referenced by multi_get_create_instance_udp().

◆ multi_get_instance_udp_real()

static struct multi_instance * multi_get_instance_udp_real	(	struct multi_context *	m,
		struct mroute_addr *	real
	)

static

Looks up an multi instance by its real address (IP and port)

Parameters

m	multi context
real	Address to look up

Returns: instance matching the address, NULL otherwise

Definition at line 289 of file mudp.c.

References multi_context::hash, hash_lookup_fast(), hash_value(), and hash_element::value.

Referenced by multi_get_instance_udp_control(), and multi_get_instance_udp_data().

◆ multi_process_io_udp()

void multi_process_io_udp	(	struct multi_context *	m,
		struct link_socket *	sock,
		unsigned int	rwflags
	)

Definition at line 439 of file mudp.c.

References IS_SIG, MPP_CLOSE_ON_SIGNAL, MPP_PRE_SELECT, multi_process_incoming_link(), multi_process_outgoing_link(), read_incoming_link(), SOCKET_READ, SOCKET_WRITE, and multi_context::top.

Referenced by multi_io_process_io().

◆ multi_process_outgoing_link()

static void multi_process_outgoing_link	(	struct multi_context *	m,
		const unsigned int	mpp_flags
	)

inlinestatic

Definition at line 426 of file mudp.c.

References multi_process_outgoing_link_dowork(), and multi_process_outgoing_link_pre().

Referenced by multi_process_io_udp().

◆ send_hmac_reset_packet()

static void send_hmac_reset_packet	(	struct multi_context *	m,
		struct tls_pre_decrypt_state *	state,
		struct tls_auth_standalone *	tas,
		struct session_id *	sid,
		bool	request_resend_wkc,
		struct link_socket *	sock
	)

static

Definition at line 76 of file mudp.c.

References packet_id_rec::initialized, buffer::len, tls_wrap_ctx::opt, P_CONTROL_HARD_RESET_SERVER_V2, P_OPCODE_SHIFT, crypto_options::packet_id, tls_pre_decrypt_state::peer_session_id, packet_id::rec, reset_packet_id_send(), packet_id::send, send_standalone_reply(), tls_reset_standalone(), and tls_pre_decrypt_state::tls_wrap_tmp.

Referenced by do_pre_decrypt_check().

◆ send_standalone_reply()

static void send_standalone_reply	(	struct multi_context *	m,
		struct buffer *	buf,
		const char *	prefix,
		const char *	detail,
		struct link_socket *	sock
	)

static

Send an already-built standalone control packet back to the peer that just contacted us (c2.from), synchronously and without keeping any state.

We do not want to keep state for a reply to an initial/out-of-band packet, so we send it without queueing. If we hit EAGAIN on a busy socket the packet is lost and the client simply retries – an acceptable compromise that avoids consuming server resources under attack.

Parameters

m	the server's multi_context
buf	the packet to send (built by a tls_*_standalone() helper)
prefix	msg() prefix to set for the duration of the send
detail	D_MULTI_DEBUG message describing the reply
sock	the socket to send the reply on

Definition at line 56 of file mudp.c.

References ASSERT, context_buffers::aux_buf, buf_copy(), buf_init, context_2::buffers, context::c2, D_MULTI_DEBUG, context_2::from, buffer::len, msg, msg_set_prefix(), buffer::offset, process_outgoing_link(), context_2::to_link, context_2::to_link_addr, and multi_context::top.

Referenced by send_hmac_reset_packet().

Functions

Function Documentation

◆ do_pre_decrypt_check()

◆ handle_connection_attempt()

◆ multi_get_instance_udp_control()

◆ multi_get_instance_udp_data()

◆ multi_get_instance_udp_real()

◆ multi_process_io_udp()

◆ multi_process_outgoing_link()

◆ send_hmac_reset_packet()

◆ send_standalone_reply()