#include "syshead.h"
#include "multi.h"
#include <inttypes.h>
#include "forward.h"
#include "memdbg.h"
#include "ssl_pkt.h"

Include dependency graph for mudp.c:

Enumerations
enum	pre_decrypt_verdict { PRE_DECRYPT_NO_ACTION , PRE_DECRYPT_CREATE_SESSION , PRE_DECRYPT_CREATE_SESSION_SKIP }
	Verdict if this packet should create a new session. More...

Functions
static void	send_standalone_reply (struct multi_context m, struct buffer buf, const char prefix, const char detail, struct link_socket *sock)
	Send an already-built standalone control packet back to the peer that just contacted us (c2.from), synchronously and without keeping any state.

static void	send_hmac_reset_packet (struct multi_context m, struct tls_pre_decrypt_state state, struct tls_auth_standalone tas, struct session_id sid, bool request_resend_wkc, struct link_socket *sock)

static enum pre_decrypt_verdict	do_pre_decrypt_check (struct multi_context m, struct tls_pre_decrypt_state state, struct mroute_addr addr, struct link_socket *sock)
	Returns a verdict if this packet should create a new session.

static struct multi_instance *	handle_connection_attempt (struct multi_context m, struct link_socket sock, struct mroute_addr *real)
	Handles a packet if no existing session exists for this incoming packet.

static struct multi_instance *	multi_get_instance_udp_real (struct multi_context m, struct mroute_addr real)
	Looks up an multi instance by its real address (IP and port)

struct multi_instance *	multi_get_instance_udp_control (struct multi_context m, struct link_socket sock)

struct multi_instance *	multi_get_instance_udp_data (struct multi_context m, bool floated, struct mroute_addr real, struct link_socket sock)
	Get a client instance based on real address.

struct multi_instance *	multi_get_create_instance_udp (struct multi_context m, bool floated, struct link_socket *sock)
	Get, and if necessary create, the multi_instance associated with a packet's source address.

static void	multi_process_outgoing_link (struct multi_context *m, const unsigned int mpp_flags)

void	multi_process_io_udp (struct multi_context m, struct link_socket sock, unsigned int rwflags)

Enumeration Type Documentation

◆ pre_decrypt_verdict

enum pre_decrypt_verdict

Verdict if this packet should create a new session.

If a packet is invalid or we send out an HMAC based challenge, we do not want to create a new session.

Enumerator

PRE_DECRYPT_NO_ACTION

This packet should not create a new session.

PRE_DECRYPT_CREATE_SESSION

This packet creates a new session on the first packet on the session.

We only do this for legacy tls-crypt-v2 clients that do not work with the HMAC cookie challenge approach where we need to keep the client specific tls-crypt key to be able to decrypt the third packet

PRE_DECRYPT_CREATE_SESSION_SKIP

Creates a new session.

The HMAC challenge has been already completed and the first two packets of the three way handshake are skipped in the session setup

Definition at line 95 of file mudp.c.

Function Documentation

◆ do_pre_decrypt_check()

static enum pre_decrypt_verdict do_pre_decrypt_check	(	struct multi_context *	m,
		struct tls_pre_decrypt_state *	state,
		struct mroute_addr	addr,
		struct link_socket *	sock
	)

static

Returns a verdict if this packet should create a new session.

Definition at line 112 of file mudp.c.

References ASSERT, BPTR, context_2::buf, buf_advance(), context::c2, calculate_session_id_hmac(), check_session_hmac_and_pkt_id(), CO_FORCE_TLSCRYPTV2_COOKIE, D_MULTI_DEBUG, D_MULTI_MEDIUM, link_socket_actual::dest, EARLY_NEG_MASK, EARLY_NEG_START, crypto_options::flags, context_2::from, gc, gc_free(), gc_new(), options::handshake_window, multi_context::initial_rate_limiter, buffer::len, msg, tls_wrap_ctx::opt, context::options, P_OPCODE_SHIFT, packet_id_read(), packet_opcode_name(), tls_pre_decrypt_state::peer_session_id, PRE_DECRYPT_CREATE_SESSION, PRE_DECRYPT_CREATE_SESSION_SKIP, PRE_DECRYPT_NO_ACTION, print_link_socket_actual(), reflect_filter_rate_limit_check(), send_hmac_reset_packet(), context_2::session_id_key, SID_SIZE, context_2::tls_auth_standalone, tls_pre_decrypt_lite(), tls_auth_standalone::tls_wrap, multi_context::top, VERDICT_VALID_ACK_V1, VERDICT_VALID_CONTROL_V1, VERDICT_VALID_RESET_V2, VERDICT_VALID_RESET_V3, and VERDICT_VALID_WKC_V1.

Referenced by handle_connection_attempt().

◆ handle_connection_attempt()

static struct multi_instance * handle_connection_attempt	(	struct multi_context *	m,
		struct link_socket *	sock,
		struct mroute_addr *	real
	)

static

Handles a packet if no existing session exists for this incoming packet.

It will either send a reply with a hmac cookie if this is the first packet of a three-way handshake or create a multi_instance if it is a packet that completes the three-way handshake.

Definition at line 240 of file mudp.c.

References ASSERT, context::c2, multi_instance::context, D_MULTI_ERRORS, multi_context::deferred_shutdown_signal, multi_instance::did_real_hash, do_pre_decrypt_check(), free_tls_pre_decrypt_state(), frequency_limit_event_allowed(), context_2::from, gc, gc_free(), gc_new(), multi_context::hash, hash_add_fast(), hash_value(), multi_context::initial_rate_limiter, mroute_addr_print(), msg, multi_assign_peer_id(), multi_create_instance(), tls_multi::n_sessions, multi_context::new_connection_limiter, tls_pre_decrypt_state::peer_session_id, PRE_DECRYPT_CREATE_SESSION_SKIP, PRE_DECRYPT_NO_ACTION, multi_instance::real, reflect_filter_rate_limit_decrease(), tls_multi::session, session_id_defined(), session_skip_to_pre_start(), deferred_signal_schedule_entry::signal_received, context_2::tls_multi, TM_INITIAL, and multi_context::top.

Referenced by multi_get_create_instance_udp().

◆ multi_get_instance_udp_control()

struct multi_instance * multi_get_instance_udp_control	(	struct multi_context *	m,
		struct link_socket *	sock
	)

Definition at line 330 of file mudp.c.

References link_socket::info, mroute_addr::len, mroute_extract_openvpn_sockaddr(), multi_get_instance_udp_real(), mroute_addr::proto, and link_socket_info::proto.

Referenced by multi_get_create_instance_udp().

◆ multi_get_instance_udp_data()

struct multi_instance * multi_get_instance_udp_data	(	struct multi_context *	m,
		bool *	floated,
		struct mroute_addr *	real,
		struct link_socket *	sock
	)

Get a client instance based on real address.

If the instance doesn't exist, create it while maintaining real address hash table atomicity.

Definition at line 349 of file mudp.c.

References BPTR, context_2::buf, context::c2, multi_instance::context, D_MULTI_MEDIUM, context_2::from, gc, gc_free(), gc_new(), link_socket::info, multi_context::instances, buffer::len, link_socket_actual_match(), context_2::link_sockets, MAX_PEER_ID, mroute_addr_print(), msg, multi_get_instance_udp_real(), P_DATA_V2, P_OPCODE_SHIFT, link_socket_info::proto, multi_context::top, and ungenerate_prefix().

Referenced by multi_get_create_instance_udp().

◆ multi_get_instance_udp_real()

static struct multi_instance * multi_get_instance_udp_real	(	struct multi_context *	m,
		struct mroute_addr *	real
	)

static

Looks up an multi instance by its real address (IP and port)

Parameters

m	multi context
real	Address to look up

Returns: instance matching the address, NULL otherwise

Definition at line 316 of file mudp.c.

References multi_context::hash, hash_lookup_fast(), hash_value(), and hash_element::value.

Referenced by multi_get_instance_udp_control(), and multi_get_instance_udp_data().

◆ multi_process_io_udp()

void multi_process_io_udp	(	struct multi_context *	m,
		struct link_socket *	sock,
		unsigned int	rwflags
	)

Definition at line 464 of file mudp.c.

References IS_SIG, MPP_CLOSE_ON_SIGNAL, MPP_PRE_SELECT, multi_process_incoming_link(), multi_process_outgoing_link(), read_incoming_link(), SOCKET_READ, SOCKET_WRITE, and multi_context::top.

Referenced by multi_io_process_io().

◆ multi_process_outgoing_link()

static void multi_process_outgoing_link	(	struct multi_context *	m,
		const unsigned int	mpp_flags
	)

inlinestatic

Definition at line 452 of file mudp.c.

References multi_process_outgoing_link_dowork(), and multi_context::pending.

Referenced by multi_process_io_udp().

◆ send_hmac_reset_packet()

static void send_hmac_reset_packet	(	struct multi_context *	m,
		struct tls_pre_decrypt_state *	state,
		struct tls_auth_standalone *	tas,
		struct session_id *	sid,
		bool	request_resend_wkc,
		struct link_socket *	sock
	)

static

Definition at line 76 of file mudp.c.

References packet_id_rec::initialized, buffer::len, tls_wrap_ctx::opt, P_CONTROL_HARD_RESET_SERVER_V2, P_OPCODE_SHIFT, crypto_options::packet_id, tls_pre_decrypt_state::peer_session_id, packet_id::rec, reset_packet_id_send(), packet_id::send, send_standalone_reply(), tls_reset_standalone(), and tls_pre_decrypt_state::tls_wrap_tmp.

Referenced by do_pre_decrypt_check().

◆ send_standalone_reply()

static void send_standalone_reply	(	struct multi_context *	m,
		struct buffer *	buf,
		const char *	prefix,
		const char *	detail,
		struct link_socket *	sock
	)

static

Send an already-built standalone control packet back to the peer that just contacted us (c2.from), synchronously and without keeping any state.

We do not want to keep state for a reply to an initial/out-of-band packet, so we send it without queueing. If we hit EAGAIN on a busy socket the packet is lost and the client simply retries – an acceptable compromise that avoids consuming server resources under attack.

Parameters

m	the server's multi_context
buf	the packet to send (built by a tls_*_standalone() helper)
prefix	msg() prefix to set for the duration of the send
detail	D_MULTI_DEBUG message describing the reply
sock	the socket to send the reply on

Definition at line 56 of file mudp.c.

References ASSERT, context_buffers::aux_buf, buf_copy(), buf_init, context_2::buffers, context::c2, D_MULTI_DEBUG, context_2::from, buffer::len, msg, msg_set_prefix(), buffer::offset, process_outgoing_link(), context_2::to_link, context_2::to_link_addr, and multi_context::top.

Referenced by send_hmac_reset_packet().

Enumerations

Functions

Enumeration Type Documentation

◆ pre_decrypt_verdict

Function Documentation

◆ do_pre_decrypt_check()

◆ handle_connection_attempt()

◆ multi_get_instance_udp_control()

◆ multi_get_instance_udp_data()

◆ multi_get_instance_udp_real()

◆ multi_process_io_udp()

◆ multi_process_outgoing_link()

◆ send_hmac_reset_packet()

◆ send_standalone_reply()