OpenVPN
mudp.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2022 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #elif defined(_MSC_VER)
27 #include "config-msvc.h"
28 #endif
29 
30 #include "syshead.h"
31 
32 #include "multi.h"
33 #include <inttypes.h>
34 #include "forward.h"
35 
36 #include "memdbg.h"
37 #include "ssl_pkt.h"
38 
39 #ifdef HAVE_SYS_INOTIFY_H
40 #include <sys/inotify.h>
41 #endif
42 
43 static void
45  struct tls_pre_decrypt_state *state,
46  struct tls_auth_standalone *tas,
47  struct session_id *sid,
48  bool request_resend_wkc)
49 {
52  uint8_t header = 0 | (P_CONTROL_HARD_RESET_SERVER_V2 << P_OPCODE_SHIFT);
53  struct buffer buf = tls_reset_standalone(&state->tls_wrap_tmp, tas, sid,
54  &state->peer_session_id, header,
55  request_resend_wkc);
56 
57  struct context *c = &m->top;
58 
60  buf_copy(&c->c2.buffers->aux_buf, &buf);
61  m->hmac_reply = c->c2.buffers->aux_buf;
62  m->hmac_reply_dest = &m->top.c2.from;
63  msg(D_MULTI_DEBUG, "Reset packet from client, sending HMAC based reset challenge");
64 }
65 
66 
67 /* Returns true if this packet should create a new session */
68 static bool
70  struct tls_pre_decrypt_state *state,
71  struct mroute_addr addr)
72 {
74 
75  enum first_packet_verdict verdict;
76 
78 
79  verdict = tls_pre_decrypt_lite(tas, state, &m->top.c2.from, &m->top.c2.buf);
80 
81  hmac_ctx_t *hmac = m->top.c2.session_id_hmac;
82  struct openvpn_sockaddr *from = &m->top.c2.from.dest;
83  int handwindow = m->top.options.handshake_window;
84 
85  if (verdict == VERDICT_VALID_RESET_V3)
86  {
87  /* Extract the packet id to check if it has the special format that
88  * indicates early negotiation support */
89  struct packet_id_net pin;
90  struct buffer tmp = m->top.c2.buf;
91  ASSERT(buf_advance(&tmp, 1 + SID_SIZE));
92  ASSERT(packet_id_read(&pin, &tmp, true));
93 
94  /* The most significant byte is 0x0f if early negotiation is supported */
95  bool early_neg_support = ((pin.id & EARLY_NEG_MASK) & EARLY_NEG_START) == EARLY_NEG_START;
96 
97  /* All clients that support early negotiation and tls-crypt are assumed
98  * to also support resending the WKc in the 2nd packet */
99  if (early_neg_support)
100  {
101  /* Calculate the session ID HMAC for our reply and create reset packet */
103  from, hmac, handwindow, 0);
104  send_hmac_reset_packet(m, state, tas, &sid, true);
105 
106  return false;
107  }
108  else
109  {
110  /* For tls-crypt-v2 we need to keep the state of the first packet
111  * to store the unwrapped key if the client doesn't support resending
112  * the wrapped key. Unless the user specifically disallowed
113  * compatibility with such clients to avoid state exhaustion */
115  {
116  struct gc_arena gc = gc_new();
117  const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
118  msg(D_MULTI_DEBUG, "tls-crypt-v2 force-cookie is enabled, "
119  "ignoring connection attempt from old client (%s)", peer);
120  gc_free(&gc);
121  return false;
122  }
123  else
124  {
125  return true;
126  }
127  }
128  }
129  else if (verdict == VERDICT_VALID_RESET_V2)
130  {
131  /* Calculate the session ID HMAC for our reply and create reset packet */
133  from, hmac, handwindow, 0);
134 
135  send_hmac_reset_packet(m, state, tas, &sid, false);
136 
137  /* We have a reply do not create a new session */
138  return false;
139 
140  }
141  else if (verdict == VERDICT_VALID_CONTROL_V1 || verdict == VERDICT_VALID_ACK_V1
142  || verdict == VERDICT_VALID_WKC_V1)
143  {
144  /* ACK_V1 contains the peer id (our id) while CONTROL_V1 can but does not
145  * need to contain the peer id */
146  struct gc_arena gc = gc_new();
147 
148  bool ret = check_session_id_hmac(state, from, hmac, handwindow);
149 
150  const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
151  uint8_t pkt_firstbyte = *BPTR( &m->top.c2.buf);
152  int op = pkt_firstbyte >> P_OPCODE_SHIFT;
153 
154  if (!ret)
155  {
156  msg(D_MULTI_MEDIUM, "Packet (%s) with invalid or missing SID from %s",
157  packet_opcode_name(op), peer);
158  }
159  else
160  {
161  msg(D_MULTI_DEBUG, "Valid packet (%s) with HMAC challenge from peer (%s), "
162  "accepting new connection.", packet_opcode_name(op), peer);
163  }
164  gc_free(&gc);
165 
166  return ret;
167  }
168 
169  /* VERDICT_INVALID */
170  return false;
171 }
172 
173 /*
174  * Get a client instance based on real address. If
175  * the instance doesn't exist, create it while
176  * maintaining real address hash table atomicity.
177  */
178 
179 struct multi_instance *
181 {
182  struct gc_arena gc = gc_new();
183  struct mroute_addr real;
184  struct multi_instance *mi = NULL;
185  struct hash *hash = m->hash;
186 
187  if (mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true)
188  && m->top.c2.buf.len > 0)
189  {
190  struct hash_element *he;
191  const uint32_t hv = hash_value(hash, &real);
192  struct hash_bucket *bucket = hash_bucket(hash, hv);
193  uint8_t *ptr = BPTR(&m->top.c2.buf);
194  uint8_t op = ptr[0] >> P_OPCODE_SHIFT;
195  bool v2 = (op == P_DATA_V2) && (m->top.c2.buf.len >= (1 + 3));
196  bool peer_id_disabled = false;
197 
198  /* make sure buffer has enough length to read opcode (1 byte) and peer-id (3 bytes) */
199  if (v2)
200  {
201  uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFFFFFF;
202  peer_id_disabled = (peer_id == MAX_PEER_ID);
203 
204  if (!peer_id_disabled && (peer_id < m->max_clients) && (m->instances[peer_id]))
205  {
206  mi = m->instances[peer_id];
207 
208  *floated = !link_socket_actual_match(&mi->context.c2.from, &m->top.c2.from);
209 
210  if (*floated)
211  {
212  /* reset prefix, since here we are not sure peer is the one it claims to be */
213  ungenerate_prefix(mi);
214  msg(D_MULTI_MEDIUM, "Float requested for peer %" PRIu32 " to %s", peer_id,
215  mroute_addr_print(&real, &gc));
216  }
217  }
218  }
219  if (!v2 || peer_id_disabled)
220  {
221  he = hash_lookup_fast(hash, bucket, &real, hv);
222  if (he)
223  {
224  mi = (struct multi_instance *) he->value;
225  }
226  }
227 
228  /* we have no existing multi instance for this connection */
229  if (!mi)
230  {
231  struct tls_pre_decrypt_state state = {0};
232 
233  if (do_pre_decrypt_check(m, &state, real))
234  {
235  /* This is an unknown session but with valid tls-auth/tls-crypt
236  * (or no auth at all). If this is the initial packet of a
237  * session, we just send a reply with a HMAC session id and
238  * do not generate a session slot */
239 
241  {
242  mi = multi_create_instance(m, &real);
243  if (mi)
244  {
245  hash_add_fast(hash, bucket, &mi->real, hv, mi);
246  mi->did_real_hash = true;
247  multi_assign_peer_id(m, mi);
248 
249  /* If we have a session id already, ensure that the
250  * state is using the same */
252  && session_id_defined((&state.peer_session_id)))
253  {
257  }
258  }
259  }
260  else
261  {
263  "MULTI: Connection from %s would exceed new connection frequency limit as controlled by --connect-freq",
264  mroute_addr_print(&real, &gc));
265  }
266  }
268  }
269 
270 #ifdef ENABLE_DEBUG
272  {
273  const char *status = mi ? "[ok]" : "[failed]";
274 
275  dmsg(D_MULTI_DEBUG, "GET INST BY REAL: %s %s",
276  mroute_addr_print(&real, &gc),
277  status);
278  }
279 #endif
280  }
281 
282  gc_free(&gc);
283  ASSERT(!(mi && mi->halt));
284  return mi;
285 }
286 
287 /*
288  * Send a packet to UDP socket.
289  */
290 static inline void
291 multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
292 {
294  if (mi)
295  {
296  multi_process_outgoing_link_dowork(m, mi, mpp_flags);
297  }
298  if (m->hmac_reply_dest && m->hmac_reply.len > 0)
299  {
300  msg_set_prefix("Connection Attempt");
301  m->top.c2.to_link = m->hmac_reply;
304  m->hmac_reply_dest = NULL;
305  }
306 }
307 
308 /*
309  * Process an I/O event.
310  */
311 static void
313 {
314  const unsigned int status = m->top.c2.event_set_status;
315  const unsigned int mpp_flags = m->top.c2.fast_io
318 
319 #ifdef MULTI_DEBUG_EVENT_LOOP
320  char buf[16];
321  buf[0] = 0;
322  if (status & SOCKET_READ)
323  {
324  strcat(buf, "SR/");
325  }
326  else if (status & SOCKET_WRITE)
327  {
328  strcat(buf, "SW/");
329  }
330  else if (status & TUN_READ)
331  {
332  strcat(buf, "TR/");
333  }
334  else if (status & TUN_WRITE)
335  {
336  strcat(buf, "TW/");
337  }
338  else if (status & FILE_CLOSED)
339  {
340  strcat(buf, "FC/");
341  }
342  printf("IO %s\n", buf);
343 #endif /* ifdef MULTI_DEBUG_EVENT_LOOP */
344 
345 #ifdef ENABLE_MANAGEMENT
347  {
350  }
351 #endif
352 
353  /* UDP port ready to accept write */
354  if (status & SOCKET_WRITE)
355  {
356  multi_process_outgoing_link(m, mpp_flags);
357  }
358  /* TUN device ready to accept write */
359  else if (status & TUN_WRITE)
360  {
361  multi_process_outgoing_tun(m, mpp_flags);
362  }
363  /* Incoming data on UDP port */
364  else if (status & SOCKET_READ)
365  {
366  read_incoming_link(&m->top);
367  if (!IS_SIG(&m->top))
368  {
369  multi_process_incoming_link(m, NULL, mpp_flags);
370  }
371  }
372  /* Incoming data on TUN device */
373  else if (status & TUN_READ)
374  {
375  read_incoming_tun(&m->top);
376  if (!IS_SIG(&m->top))
377  {
378  multi_process_incoming_tun(m, mpp_flags);
379  }
380  }
381 #ifdef ENABLE_ASYNC_PUSH
382  /* INOTIFY callback */
383  else if (status & FILE_CLOSED)
384  {
385  multi_process_file_closed(m, mpp_flags);
386  }
387 #endif
388 #if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD))
389  else if (status & DCO_READ)
390  {
391  if (!IS_SIG(&m->top))
392  {
393  bool ret = true;
394  while (ret)
395  {
397  }
398  }
399  }
400 #endif
401 }
402 
403 /*
404  * Return the io_wait() flags appropriate for
405  * a point-to-multipoint tunnel.
406  */
407 static inline unsigned int
409 {
410  unsigned int flags = IOW_WAIT_SIGNAL;
411  if (m->pending)
412  {
413  if (TUN_OUT(&m->pending->context))
414  {
415  flags |= IOW_TO_TUN;
416  }
417  if (LINK_OUT(&m->pending->context))
418  {
419  flags |= IOW_TO_LINK;
420  }
421  }
422  else if (mbuf_defined(m->mbuf))
423  {
424  flags |= IOW_MBUF;
425  }
426  else if (m->hmac_reply_dest)
427  {
428  flags |= IOW_TO_LINK;
429  }
430  else
431  {
432  flags |= IOW_READ;
433  }
434 #ifdef _WIN32
435  if (tuntap_ring_empty(m->top.c1.tuntap))
436  {
437  flags &= ~IOW_READ_TUN;
438  }
439 #endif
440  return flags;
441 }
442 
443 
444 void
446 {
447  struct multi_context multi;
448 
449  top->mode = CM_TOP;
451 
452  /* initialize top-tunnel instance */
454  if (IS_SIG(top))
455  {
456  return;
457  }
458 
459  /* initialize global multi_context object */
460  multi_init(&multi, top, false);
461 
462  /* initialize our cloned top object */
463  multi_top_init(&multi, top);
464 
465  /* initialize management interface */
467 
468  /* finished with initialization */
469  initialization_sequence_completed(top, ISC_SERVER); /* --mode server --proto udp */
470 
471 #ifdef ENABLE_ASYNC_PUSH
472  multi.top.c2.inotify_fd = inotify_init();
473  if (multi.top.c2.inotify_fd < 0)
474  {
475  msg(D_MULTI_ERRORS | M_ERRNO, "MULTI: inotify_init error");
476  }
477 #endif
478 
479  /* per-packet event loop */
480  while (true)
481  {
483 
484  /* set up and do the io_wait() */
485  multi_get_timeout(&multi, &multi.top.c2.timeval);
486  io_wait(&multi.top, p2mp_iow_flags(&multi));
487  MULTI_CHECK_SIG(&multi);
488 
489  /* check on status of coarse timers */
491 
492  /* timeout? */
493  if (multi.top.c2.event_set_status == ES_TIMEOUT)
494  {
496  }
497  else
498  {
499  /* process I/O */
500  multi_process_io_udp(&multi);
501  MULTI_CHECK_SIG(&multi);
502  }
503 
504  perf_pop();
505  }
506 
507 #ifdef ENABLE_ASYNC_PUSH
508  close(top->c2.inotify_fd);
509 #endif
510 
511  /* shut down management interface */
513 
514  /* save ifconfig-pool */
515  multi_ifconfig_pool_persist(&multi, true);
516 
517  /* tear down tunnel instance (unless --persist-tun) */
518  multi_uninit(&multi);
519  multi_top_free(&multi);
521 }
context_2::event_set_status
unsigned int event_set_status
Definition: openvpn.h:235
context_2::tls_auth_standalone
struct tls_auth_standalone * tls_auth_standalone
TLS state structure required for the initial authentication of a client's connection attempt.
Definition: openvpn.h:327
VERDICT_VALID_RESET_V2
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition: ssl_pkt.h:85
P_DATA_V2
#define P_DATA_V2
Definition: ssl_pkt.h:48
multi_instance
Server-mode state structure for one single VPN tunnel.
Definition: multi.h:100
multi_instance::halt
bool halt
Definition: multi.h:105
multi_process_incoming_dco
bool multi_process_incoming_dco(struct multi_context *m)
Process an incoming DCO message (from kernel space).
mbuf_defined
static bool mbuf_defined(const struct mbuf_set *ms)
Definition: mbuf.h:80
MPP_CLOSE_ON_SIGNAL
#define MPP_CLOSE_ON_SIGNAL
Definition: multi.h:287
hash_bucket
static struct hash_bucket * hash_bucket(struct hash *hash, uint32_t hv)
Definition: list.h:141
TUN_READ
#define TUN_READ
Definition: event.h:65
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:998
hmac_ctx_t
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
Definition: crypto_mbedtls.h:46
M_ERRNO
#define M_ERRNO
Definition: error.h:100
context_2::to_link
struct buffer to_link
Definition: openvpn.h:378
context_2::tls_multi
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:324
forward.h
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition: buffer.h:66
p2mp_iow_flags
static unsigned int p2mp_iow_flags(const struct multi_context *m)
Definition: mudp.c:408
context_2::buf
struct buffer buf
Definition: openvpn.h:376
tunnel_server_udp
void tunnel_server_udp(struct context *top)
Main event loop for OpenVPN in UDP server mode.
Definition: mudp.c:445
TUN_OUT
#define TUN_OUT(c)
Definition: forward.h:38
context_1::tuntap
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition: openvpn.h:167
context
Contains all state information for one tunnel.
Definition: openvpn.h:474
hash
Definition: list.h:58
first_packet_verdict
first_packet_verdict
Definition: ssl_pkt.h:83
tls_multi::session
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition: ssl_common.h:656
packet_id::rec
struct packet_id_rec rec
Definition: packet_id.h:203
multi_context::mbuf
struct mbuf_set * mbuf
Set of buffers for passing data channel packets between VPN tunnel instances.
Definition: multi.h:166
tls_reset_standalone
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition: ssl_pkt.c:430
multi_instance::real
struct mroute_addr real
External network address of the remote peer.
Definition: multi.h:113
D_MULTI_ERRORS
#define D_MULTI_ERRORS
Definition: errlevel.h:65
tls_pre_decrypt_lite
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition: ssl_pkt.c:309
config-msvc.h
multi_uninit
void multi_uninit(struct multi_context *m)
Definition: multi.c:693
MPP_PRE_SELECT
#define MPP_PRE_SELECT
Definition: multi.h:285
hash_element::value
void * value
Definition: list.h:47
VERDICT_VALID_CONTROL_V1
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition: ssl_pkt.h:89
free_tls_pre_decrypt_state
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition: ssl_pkt.c:287
dmsg
#define dmsg(flags,...)
Definition: error.h:154
CO_FORCE_TLSCRYPTV2_COOKIE
#define CO_FORCE_TLSCRYPTV2_COOKIE
Bit-flag indicating that we do not allow clients that do not support resending the wrapped client key...
Definition: crypto.h:263
MANAGEMENT_READ
#define MANAGEMENT_READ
Definition: event.h:71
buf_copy
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition: buffer.h:717
openvpn_sockaddr
Definition: socket.h:65
context_2::buffers
struct context_buffers * buffers
Definition: openvpn.h:368
send_hmac_reset_packet
static void send_hmac_reset_packet(struct multi_context *m, struct tls_pre_decrypt_state *state, struct tls_auth_standalone *tas, struct session_id *sid, bool request_resend_wkc)
Definition: mudp.c:44
multi_ifconfig_pool_persist
void multi_ifconfig_pool_persist(struct multi_context *m, bool force)
Definition: multi.c:164
P_OPCODE_SHIFT
#define P_OPCODE_SHIFT
Definition: ssl_pkt.h:39
context::mode
int mode
Role of this context within the OpenVPN process.
Definition: openvpn.h:488
context_2::to_link_addr
struct link_socket_actual * to_link_addr
Definition: openvpn.h:244
MAX_PEER_ID
#define MAX_PEER_ID
Definition: openvpn.h:546
tls_pre_decrypt_state::server_session_id
struct session_id server_session_id
Definition: ssl_pkt.h:107
buf_reset_len
static void buf_reset_len(struct buffer *buf)
Definition: buffer.h:299
tls_pre_decrypt_state::tls_wrap_tmp
struct tls_wrap_ctx tls_wrap_tmp
Definition: ssl_pkt.h:104
IOW_MBUF
#define IOW_MBUF
Definition: forward.h:61
multi_context::new_connection_limiter
struct frequency_limit * new_connection_limiter
Definition: multi.h:172
session_id
Definition: session_id.h:38
packet_id_net::id
packet_id_type id
Definition: packet_id.h:196
IOW_TO_LINK
#define IOW_TO_LINK
Definition: forward.h:55
context::c2
struct context_2 c2
Level 2 context.
Definition: openvpn.h:515
TM_ACTIVE
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:514
tls_wrap_ctx::opt
struct crypto_options opt
Crypto state.
Definition: ssl_common.h:270
multi_context::instances
struct multi_instance ** instances
Array of multi_instances.
Definition: multi.h:155
ASSERT
#define ASSERT(x)
Definition: error.h:201
tls_pre_decrypt_state::peer_session_id
struct session_id peer_session_id
Definition: ssl_pkt.h:106
buf_advance
static bool buf_advance(struct buffer *buf, int size)
Definition: buffer.h:623
multi_init
void multi_init(struct multi_context *m, struct context *t, bool tcp_mode)
Definition: multi.c:293
multi_context::top
struct context top
Storage structure for process-wide configuration.
Definition: multi.h:193
reset_packet_id_send
static void reset_packet_id_send(struct packet_id_send *p)
Reset the current send packet id to its initial state.
Definition: packet_id.h:301
packet_id_rec::initialized
bool initialized
Definition: packet_id.h:135
hash_add_fast
static void hash_add_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv, void *value)
Definition: list.h:165
multi_assign_peer_id
void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi)
Assigns a peer-id to a a client and adds the instance to the the instances array of the multi_context...
Definition: multi.c:4060
SID_SIZE
#define SID_SIZE
Definition: session_id.h:45
io_wait
static void io_wait(struct context *c, const unsigned int flags)
Definition: forward.h:363
MPP_CONDITIONAL_PRE_SELECT
#define MPP_CONDITIONAL_PRE_SELECT
Definition: multi.h:286
multi_process_io_udp
static void multi_process_io_udp(struct multi_context *m)
Definition: mudp.c:312
IOW_TO_TUN
#define IOW_TO_TUN
Definition: forward.h:54
multi_process_timeout
bool multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags)
Definition: multi.c:3609
ungenerate_prefix
void ungenerate_prefix(struct multi_instance *mi)
Definition: multi.c:506
multi_process_outgoing_link_dowork
static bool multi_process_outgoing_link_dowork(struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags)
Definition: multi.h:674
close_instance
void close_instance(struct context *c)
Definition: init.c:4497
perf_pop
static void perf_pop(void)
Definition: perf.h:82
tls_pre_decrypt_state
struct that stores the temporary data for the tls lite decrypt functions
Definition: ssl_pkt.h:103
hash_lookup_fast
struct hash_element * hash_lookup_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv)
Definition: list.c:85
context::options
struct options options
Options loaded from command line or configuration file.
Definition: openvpn.h:476
read_incoming_tun
void read_incoming_tun(struct context *c)
Read a packet from the virtual tun/tap network interface.
Definition: forward.c:1193
SOCKET_WRITE
#define SOCKET_WRITE
Definition: event.h:63
multi.h
multi_context::hash
struct hash * hash
VPN tunnel instances indexed by real address of the remote peer.
Definition: multi.h:158
DCO_READ
#define DCO_READ
Definition: event.h:76
multi_process_per_second_timers
static void multi_process_per_second_timers(struct multi_context *m)
Definition: multi.h:589
session_skip_to_pre_start
bool session_skip_to_pre_start(struct tls_session *session, struct tls_pre_decrypt_state *state, struct link_socket_actual *from)
Definition: ssl.c:2605
EARLY_NEG_START
#define EARLY_NEG_START
Definition: ssl_pkt.h:282
MULTI_CHECK_SIG
#define MULTI_CHECK_SIG(m)
Definition: multi.h:687
tuntap_ring_empty
static bool tuntap_ring_empty(struct tuntap *tt)
Definition: tun.h:251
multi_context::pending
struct multi_instance * pending
Definition: multi.h:187
msg_set_prefix
static void msg_set_prefix(const char *prefix)
Definition: error.h:311
packet_id_read
bool packet_id_read(struct packet_id_net *pin, struct buffer *buf, bool long_form)
Definition: packet_id.c:301
TUN_WRITE
#define TUN_WRITE
Definition: event.h:66
context_2::session_id_hmac
hmac_ctx_t * session_id_hmac
the HMAC we use to generate and verify our syn cookie like session ids from the server.
Definition: openvpn.h:339
mroute_extract_openvpn_sockaddr
bool mroute_extract_openvpn_sockaddr(struct mroute_addr *addr, const struct openvpn_sockaddr *osaddr, bool use_port)
Definition: mroute.c:266
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
multi_create_instance
struct multi_instance * multi_create_instance(struct multi_context *m, const struct mroute_addr *real)
Definition: multi.c:740
multi_get_create_instance_udp
struct multi_instance * multi_get_create_instance_udp(struct multi_context *m, bool *floated)
Get, and if necessary create, the multi_instance associated with a packet's source address.
Definition: mudp.c:180
ISC_SERVER
#define ISC_SERVER
Definition: init.h:118
calculate_session_id_hmac
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition: ssl_pkt.c:485
IOW_WAIT_SIGNAL
#define IOW_WAIT_SIGNAL
Definition: forward.h:63
multi_context::hmac_reply
struct buffer hmac_reply
Definition: multi.h:196
options::handshake_window
int handshake_window
Definition: options.h:629
context_buffers::aux_buf
struct buffer aux_buf
Definition: openvpn.h:94
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:460
context_2::timeval
struct timeval timeval
Time to next event of timers and similar.
Definition: openvpn.h:397
mroute_addr
Definition: mroute.h:75
multi_process_incoming_tun
bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
Determine the destination VPN tunnel of a packet received over the virtual tun/tap network interface ...
Definition: multi.c:3478
syshead.h
BPTR
#define BPTR(buf)
Definition: buffer.h:124
session_id_defined
static bool session_id_defined(const struct session_id *sid1)
Definition: session_id.h:55
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
context_clear_2
void context_clear_2(struct context *c)
Definition: init.c:90
mroute_addr_print
const char * mroute_addr_print(const struct mroute_addr *ma, struct gc_arena *gc)
Definition: mroute.c:378
uninit_management_callback
void uninit_management_callback(void)
Definition: init.c:4150
LINK_OUT
#define LINK_OUT(c)
Definition: forward.h:39
multi_context
Main OpenVPN server state structure.
Definition: multi.h:154
init_management_callback_multi
void init_management_callback_multi(struct multi_context *m)
Definition: multi.c:4035
multi_top_init
void multi_top_init(struct multi_context *m, struct context *top)
Definition: multi.c:3749
tls_auth_standalone::tls_wrap
struct tls_wrap_ctx tls_wrap
Definition: ssl_pkt.h:79
check_debug_level
static bool check_debug_level(unsigned int level)
Definition: error.h:226
context::es
struct env_set * es
Set of environment variables.
Definition: openvpn.h:497
tls_multi::n_sessions
int n_sessions
Number of sessions negotiated thus far.
Definition: ssl_common.h:591
CC_HARD_USR1_TO_HUP
#define CC_HARD_USR1_TO_HUP
Definition: init.h:108
do_pre_decrypt_check
static bool do_pre_decrypt_check(struct multi_context *m, struct tls_pre_decrypt_state *state, struct mroute_addr addr)
Definition: mudp.c:69
multi_context::hmac_reply_dest
struct link_socket_actual * hmac_reply_dest
Definition: multi.h:197
IS_SIG
#define IS_SIG(c)
Definition: sig.h:50
init_instance_handle_signals
void init_instance_handle_signals(struct context *c, const struct env_set *env, const unsigned int flags)
Definition: init.c:4165
ES_TIMEOUT
#define ES_TIMEOUT
Definition: event.h:69
ssl_pkt.h
packet_id::send
struct packet_id_send send
Definition: packet_id.h:202
EARLY_NEG_MASK
#define EARLY_NEG_MASK
Definition: ssl_pkt.h:281
CM_TOP
#define CM_TOP
Definition: openvpn.h:484
status
static SERVICE_STATUS status
Definition: interactive.c:56
read_incoming_link
void read_incoming_link(struct context *c)
Read a packet from the external network interface.
Definition: forward.c:852
print_link_socket_actual
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
Definition: socket.c:2814
FILE_CLOSED
#define FILE_CLOSED
Definition: event.h:74
management
Definition: manage.h:311
hash_element
Definition: list.h:45
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1006
hash_bucket
Definition: list.h:53
IOW_READ_TUN
#define IOW_READ_TUN
Definition: forward.h:56
VERDICT_VALID_RESET_V3
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition: ssl_pkt.h:87
check_session_id_hmac
bool check_session_id_hmac(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow)
Checks if a control packet has a correct HMAC server session id.
Definition: ssl_pkt.c:527
config.h
packet_id_net
Definition: packet_id.h:194
context_2::from
struct link_socket_actual from
Definition: openvpn.h:245
multi_process_incoming_link
bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags)
Demultiplex and process a packet received over the external network interface.
Definition: multi.c:3274
PERF_EVENT_LOOP
#define PERF_EVENT_LOOP
Definition: perf.h:44
MANAGEMENT_WRITE
#define MANAGEMENT_WRITE
Definition: event.h:72
multi_process_outgoing_tun
static bool multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Send a packet over the virtual tun/tap network interface to its locally reachable destination.
Definition: multi.h:650
session
Definition: keyingmaterialexporter.c:56
multi_process_outgoing_link
static void multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
Definition: mudp.c:291
crypto_options::packet_id
struct packet_id packet_id
Current packet ID state for both sending and receiving directions.
Definition: crypto.h:236
VERDICT_VALID_ACK_V1
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition: ssl_pkt.h:92
crypto_options::flags
unsigned int flags
Bit-flags determining behavior of security operation functions.
Definition: crypto.h:272
D_MULTI_MEDIUM
#define D_MULTI_MEDIUM
Definition: errlevel.h:103
memdbg.h
multi_top_free
void multi_top_free(struct multi_context *m)
Definition: multi.c:3756
SOCKET_READ
#define SOCKET_READ
Definition: event.h:62
IOW_READ
#define IOW_READ
Definition: forward.h:65
VERDICT_VALID_WKC_V1
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition: ssl_pkt.h:94
msg
#define msg(flags,...)
Definition: error.h:150
multi_instance::did_real_hash
bool did_real_hash
Definition: multi.h:126
process_outgoing_link
void process_outgoing_link(struct context *c)
Write a packet to the external network interface.
Definition: forward.c:1663
perf_push
static void perf_push(int type)
Definition: perf.h:78
management_io
void management_io(struct management *man)
Definition: manage.c:3065
multi_instance::context
struct context context
The context structure storing state for this VPN tunnel.
Definition: multi.h:135
D_MULTI_DEBUG
#define D_MULTI_DEBUG
Definition: errlevel.h:126
multi_get_timeout
static void multi_get_timeout(struct multi_context *m, struct timeval *dest)
Definition: multi.h:607
initialization_sequence_completed
void initialization_sequence_completed(struct context *c, const unsigned int flags)
Definition: init.c:1541
multi_process_outgoing_link_pre
static struct multi_instance * multi_process_outgoing_link_pre(struct multi_context *m)
Definition: multi.h:423
hash_value
static uint32_t hash_value(const struct hash *hash, const void *key)
Definition: list.h:123
P_CONTROL_HARD_RESET_SERVER_V2
#define P_CONTROL_HARD_RESET_SERVER_V2
Definition: ssl_pkt.h:52
context::c1
struct context_1 c1
Level 1 context.
Definition: openvpn.h:514
link_socket_actual_match
static bool link_socket_actual_match(const struct link_socket_actual *a1, const struct link_socket_actual *a2)
Definition: socket.h:886
packet_opcode_name
static const char * packet_opcode_name(int op)
Definition: ssl_pkt.h:234
tls_auth_standalone
Definition: ssl_pkt.h:77
frequency_limit_event_allowed
bool frequency_limit_event_allowed(struct frequency_limit *f)
Definition: otime.c:169
context_2::fast_io
bool fast_io
Definition: openvpn.h:425