OpenVPN
mudp.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22
23#ifdef HAVE_CONFIG_H
24#include "config.h"
25#endif
26
27#include "syshead.h"
28
29#include "multi.h"
30#include <inttypes.h>
31#include "forward.h"
32
33#include "memdbg.h"
34#include "ssl_pkt.h"
35
36#ifdef HAVE_SYS_INOTIFY_H
37#include <sys/inotify.h>
38#endif
39
40static void
42 struct tls_auth_standalone *tas, struct session_id *sid,
43 bool request_resend_wkc)
44{
47 uint8_t header = 0 | (P_CONTROL_HARD_RESET_SERVER_V2 << P_OPCODE_SHIFT);
48 struct buffer buf = tls_reset_standalone(&state->tls_wrap_tmp, tas, sid,
49 &state->peer_session_id, header, request_resend_wkc);
50
51 struct context *c = &m->top;
52
53 /* dco-win server requires prepend with sockaddr, so preserve offset */
55
56 buf_copy(&c->c2.buffers->aux_buf, &buf);
58 m->hmac_reply_dest = &m->top.c2.from;
59 msg(D_MULTI_DEBUG, "Reset packet from client, sending HMAC based reset challenge");
60}
61
62
63/* Returns true if this packet should create a new session */
64static bool
66 struct mroute_addr addr)
67{
69
70 enum first_packet_verdict verdict;
71
73
74 verdict = tls_pre_decrypt_lite(tas, state, &m->top.c2.from, &m->top.c2.buf);
75
77 struct openvpn_sockaddr *from = &m->top.c2.from.dest;
78 int handwindow = m->top.options.handshake_window;
79
80 if (verdict == VERDICT_VALID_RESET_V3 || verdict == VERDICT_VALID_RESET_V2)
81 {
82 /* Check if we are still below our limit for sending out
83 * responses */
85 {
86 return false;
87 }
88 }
89
90 if (verdict == VERDICT_VALID_RESET_V3)
91 {
92 /* Extract the packet id to check if it has the special format that
93 * indicates early negotiation support */
94 struct packet_id_net pin;
95 struct buffer tmp = m->top.c2.buf;
97 ASSERT(packet_id_read(&pin, &tmp, true));
98
99 /* The most significant byte is 0x0f if early negotiation is supported */
101
102 /* All clients that support early negotiation and tls-crypt are assumed
103 * to also support resending the WKc in the 2nd packet */
105 {
106 /* Calculate the session ID HMAC for our reply and create reset packet */
107 struct session_id sid =
108 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, 0);
109 send_hmac_reset_packet(m, state, tas, &sid, true);
110
111 return false;
112 }
113 else
114 {
115 /* For tls-crypt-v2 we need to keep the state of the first packet
116 * to store the unwrapped key if the client doesn't support resending
117 * the wrapped key. Unless the user specifically disallowed
118 * compatibility with such clients to avoid state exhaustion */
120 {
121 struct gc_arena gc = gc_new();
122 const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
124 "tls-crypt-v2 force-cookie is enabled, "
125 "ignoring connection attempt from old client (%s)",
126 peer);
127 gc_free(&gc);
128 return false;
129 }
130 else
131 {
132 return true;
133 }
134 }
135 }
136 else if (verdict == VERDICT_VALID_RESET_V2)
137 {
138 /* Calculate the session ID HMAC for our reply and create reset packet */
139 struct session_id sid =
140 calculate_session_id_hmac(state->peer_session_id, from, hmac, handwindow, 0);
141
142 send_hmac_reset_packet(m, state, tas, &sid, false);
143
144 /* We have a reply do not create a new session */
145 return false;
146 }
147 else if (verdict == VERDICT_VALID_CONTROL_V1 || verdict == VERDICT_VALID_ACK_V1
148 || verdict == VERDICT_VALID_WKC_V1)
149 {
150 /* ACK_V1 contains the peer id (our id) while CONTROL_V1 can but does not
151 * need to contain the peer id */
152 struct gc_arena gc = gc_new();
153
154 bool pkt_is_ack = (verdict == VERDICT_VALID_ACK_V1);
155 bool ret = check_session_hmac_and_pkt_id(state, from, hmac, handwindow, pkt_is_ack);
156
157 const char *peer = print_link_socket_actual(&m->top.c2.from, &gc);
158 uint8_t pkt_firstbyte = *BPTR(&m->top.c2.buf);
159 int op = pkt_firstbyte >> P_OPCODE_SHIFT;
160
161 if (!ret)
162 {
163 msg(D_MULTI_MEDIUM, "Packet (%s) with invalid or missing SID from"
164 " %s or wrong packet id",
165 packet_opcode_name(op), peer);
166 }
167 else
168 {
170 "Valid packet (%s) with HMAC challenge from peer (%s), "
171 "accepting new connection.",
172 packet_opcode_name(op), peer);
173 }
174 gc_free(&gc);
175
176 return ret;
177 }
178
179 /* VERDICT_INVALID */
180 return false;
181}
182
183#if defined(__GNUC__) || defined(__clang__)
184#pragma GCC diagnostic push
185#pragma GCC diagnostic ignored "-Wconversion"
186#endif
187
188/*
189 * Get a client instance based on real address. If
190 * the instance doesn't exist, create it while
191 * maintaining real address hash table atomicity.
192 */
193
194struct multi_instance *
195multi_get_create_instance_udp(struct multi_context *m, bool *floated, struct link_socket *sock)
196{
197 struct gc_arena gc = gc_new();
198 struct mroute_addr real = { 0 };
199 struct multi_instance *mi = NULL;
200 struct hash *hash = m->hash;
201 real.proto = sock->info.proto;
202 m->hmac_reply_ls = sock;
203
204 if (mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true) && m->top.c2.buf.len > 0)
205 {
206 struct hash_element *he;
207 const uint32_t hv = hash_value(hash, &real);
208 struct hash_bucket *bucket = hash_bucket(hash, hv);
209 uint8_t *ptr = BPTR(&m->top.c2.buf);
210 uint8_t op = ptr[0] >> P_OPCODE_SHIFT;
211 bool v2 = (op == P_DATA_V2) && (m->top.c2.buf.len >= (1 + 3));
212 bool peer_id_disabled = false;
213
214 /* make sure buffer has enough length to read opcode (1 byte) and peer-id (3 bytes) */
215 if (v2)
216 {
217 uint32_t peer_id = ntohl(*(uint32_t *)ptr) & 0xFFFFFF;
218 peer_id_disabled = (peer_id == MAX_PEER_ID);
219
220 if (!peer_id_disabled && (peer_id < m->max_clients) && (m->instances[peer_id]))
221 {
222 /* Floating on TCP will never be possible, so ensure we only process
223 * UDP clients */
224 if (m->instances[peer_id]->context.c2.link_sockets[0]->info.proto
225 == sock->info.proto)
226 {
227 mi = m->instances[peer_id];
228 *floated = !link_socket_actual_match(&mi->context.c2.from, &m->top.c2.from);
229
230 if (*floated)
231 {
232 /* reset prefix, since here we are not sure peer is the one it claims to be
233 */
235 msg(D_MULTI_MEDIUM, "Float requested for peer %" PRIu32 " to %s", peer_id,
236 mroute_addr_print(&real, &gc));
237 }
238 }
239 }
240 }
241 if (!v2 || peer_id_disabled)
242 {
243 he = hash_lookup_fast(hash, bucket, &real, hv);
244 if (he)
245 {
246 mi = (struct multi_instance *)he->value;
247 }
248 }
249
250 /* we have no existing multi instance for this connection */
251 if (!mi)
252 {
253 struct tls_pre_decrypt_state state = { 0 };
255 {
257 "MULTI: Connection attempt from %s ignored while server is "
258 "shutting down",
259 mroute_addr_print(&real, &gc));
260 }
261 else if (do_pre_decrypt_check(m, &state, real))
262 {
263 /* This is an unknown session but with valid tls-auth/tls-crypt
264 * (or no auth at all). If this is the initial packet of a
265 * session, we just send a reply with a HMAC session id and
266 * do not generate a session slot */
267
269 {
270 /* a successful three-way handshake only counts against
271 * connect-freq but not against connect-freq-initial */
273
274 mi = multi_create_instance(m, &real, sock);
275 if (mi)
276 {
277 hash_add_fast(hash, bucket, &mi->real, hv, mi);
278 mi->did_real_hash = true;
280
281 /* If we have a session id already, ensure that the
282 * state is using the same */
285 {
287 struct tls_session *session =
290 }
291 }
292 }
293 else
294 {
296 "MULTI: Connection from %s would exceed new connection frequency limit as controlled by --connect-freq",
297 mroute_addr_print(&real, &gc));
298 }
299 }
301 }
302
303#ifdef ENABLE_DEBUG
305 {
306 const char *status = mi ? "[ok]" : "[failed]";
307
308 dmsg(D_MULTI_DEBUG, "GET INST BY REAL: %s %s", mroute_addr_print(&real, &gc), status);
309 }
310#endif
311 }
312
313 gc_free(&gc);
314 ASSERT(!(mi && mi->halt));
315 return mi;
316}
317
318#if defined(__GNUC__) || defined(__clang__)
319#pragma GCC diagnostic pop
320#endif
321
322/*
323 * Send a packet to UDP socket.
324 */
325static inline void
326multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
327{
329 if (mi)
330 {
331 multi_process_outgoing_link_dowork(m, mi, mpp_flags);
332 }
333 if (m->hmac_reply_dest && m->hmac_reply.len > 0)
334 {
335 msg_set_prefix("Connection Attempt");
336 m->top.c2.to_link = m->hmac_reply;
339 m->hmac_reply_ls = NULL;
340 m->hmac_reply_dest = NULL;
341 }
342}
343
344/*
345 * Process an I/O event.
346 */
347void
349{
350 const unsigned int status = m->multi_io->udp_flags;
351 const unsigned int mpp_flags = m->top.c2.fast_io
354
355#ifdef MULTI_DEBUG_EVENT_LOOP
356 char buf[16];
357 buf[0] = 0;
358 if (status & SOCKET_READ)
359 {
360 strcat(buf, "SR/");
361 }
362 else if (status & SOCKET_WRITE)
363 {
364 strcat(buf, "SW/");
365 }
366 else if (status & TUN_READ)
367 {
368 strcat(buf, "TR/");
369 }
370 else if (status & TUN_WRITE)
371 {
372 strcat(buf, "TW/");
373 }
374 else if (status & FILE_CLOSED)
375 {
376 strcat(buf, "FC/");
377 }
378 printf("IO %s\n", buf);
379#endif /* ifdef MULTI_DEBUG_EVENT_LOOP */
380
381#ifdef ENABLE_MANAGEMENT
383 {
386 }
387#endif
388
389 /* UDP port ready to accept write */
390 if (status & SOCKET_WRITE)
391 {
392 multi_process_outgoing_link(m, mpp_flags);
393 }
394 /* TUN device ready to accept write */
395 else if (status & TUN_WRITE)
396 {
397 multi_process_outgoing_tun(m, mpp_flags);
398 }
399 /* Incoming data on UDP port */
400 else if (status & SOCKET_READ)
401 {
402 read_incoming_link(&m->top, sock);
403 if (!IS_SIG(&m->top))
404 {
405 multi_process_incoming_link(m, NULL, mpp_flags, sock);
406 }
407 }
408 /* Incoming data on TUN device */
409 else if (status & TUN_READ)
410 {
412 if (!IS_SIG(&m->top))
413 {
414 multi_process_incoming_tun(m, mpp_flags);
415 }
416 }
417#ifdef ENABLE_ASYNC_PUSH
418 /* INOTIFY callback */
419 else if (status & FILE_CLOSED)
420 {
421 multi_process_file_closed(m, mpp_flags);
422 }
423#endif
424#if defined(ENABLE_DCO)
425 else if (status & DCO_READ)
426 {
427 if (!IS_SIG(&m->top))
428 {
429 bool ret = true;
430 while (ret)
431 {
433 }
434 }
435 }
436#endif
437
439}
440
441/*
442 * Return the io_wait() flags appropriate for
443 * a point-to-multipoint tunnel.
444 */
445unsigned int
447{
448 unsigned int flags = IOW_WAIT_SIGNAL;
449 if (m->pending)
450 {
451 if (TUN_OUT(&m->pending->context))
452 {
453 flags |= IOW_TO_TUN;
454 }
455 if (LINK_OUT(&m->pending->context))
456 {
457 flags |= IOW_TO_LINK;
458 }
459 }
460 else if (mbuf_defined(m->mbuf))
461 {
462 flags |= IOW_MBUF;
463 }
464 else if (m->hmac_reply_dest)
465 {
466 flags |= IOW_TO_LINK;
467 }
468 else
469 {
470 flags |= IOW_READ;
471 }
472 return flags;
473}
static bool buf_copy(struct buffer *dest, const struct buffer *src)
Definition buffer.h:704
#define BPTR(buf)
Definition buffer.h:123
static bool buf_advance(struct buffer *buf, int size)
Definition buffer.h:616
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
#define buf_init(buf, offset)
Definition buffer.h:209
static struct gc_arena gc_new(void)
Definition buffer.h:1007
#define CO_FORCE_TLSCRYPTV2_COOKIE
Bit-flag indicating that we do not allow clients that do not support resending the wrapped client key...
Definition crypto.h:365
mbedtls_md_context_t hmac_ctx_t
Generic HMAC context.
#define D_MULTI_ERRORS
Definition errlevel.h:64
#define D_MULTI_MEDIUM
Definition errlevel.h:101
#define D_MULTI_DEBUG
Definition errlevel.h:126
#define DCO_READ
Definition event.h:75
#define FILE_CLOSED
Definition event.h:73
#define TUN_WRITE
Definition event.h:65
#define SOCKET_READ
Definition event.h:61
#define MANAGEMENT_READ
Definition event.h:70
#define MANAGEMENT_WRITE
Definition event.h:71
#define ES_ERROR
Definition event.h:67
#define SOCKET_WRITE
Definition event.h:62
#define TUN_READ
Definition event.h:64
Interface functions to the internal and external multiplexers.
#define IOW_WAIT_SIGNAL
Definition forward.h:63
#define IOW_MBUF
Definition forward.h:61
#define LINK_OUT(c)
Definition forward.h:38
#define TUN_OUT(c)
Definition forward.h:37
#define IOW_TO_TUN
Definition forward.h:54
#define IOW_READ
Definition forward.h:65
#define IOW_TO_LINK
Definition forward.h:55
#define TM_INITIAL
As yet un-trusted tls_session \ being negotiated.
Definition ssl_common.h:546
enum first_packet_verdict tls_pre_decrypt_lite(const struct tls_auth_standalone *tas, struct tls_pre_decrypt_state *state, const struct link_socket_actual *from, const struct buffer *buf)
Inspect an incoming packet for which no VPN tunnel is active, and determine whether a new VPN tunnel ...
Definition ssl_pkt.c:298
bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags, struct link_socket *sock)
Demultiplex and process a packet received over the external network interface.
Definition multi.c:3351
void process_outgoing_link(struct context *c, struct link_socket *sock)
Write a packet to the external network interface.
Definition forward.c:1742
void read_incoming_link(struct context *c, struct link_socket *sock)
Read a packet from the external network interface.
Definition forward.c:925
struct multi_instance * multi_get_create_instance_udp(struct multi_context *m, bool *floated, struct link_socket *sock)
Get, and if necessary create, the multi_instance associated with a packet's source address.
Definition mudp.c:195
void read_incoming_tun(struct context *c)
Read a packet from the virtual tun/tap network interface.
Definition forward.c:1322
static bool multi_process_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Send a packet over the virtual tun/tap network interface to its locally reachable destination.
Definition multi.h:636
bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
Determine the destination VPN tunnel of a packet received over the virtual tun/tap network interface ...
Definition multi.c:3551
static SERVICE_STATUS status
Definition interactive.c:51
struct hash_element * hash_lookup_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv)
Definition list.c:79
static uint32_t hash_value(const struct hash *hash, const void *key)
Definition list.h:104
static void hash_add_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv, void *value)
Definition list.h:146
void management_io(struct management *man)
Definition manage.c:3197
static bool mbuf_defined(const struct mbuf_set *ms)
Definition mbuf.h:79
bool mroute_extract_openvpn_sockaddr(struct mroute_addr *addr, const struct openvpn_sockaddr *osaddr, bool use_port)
Definition mroute.c:259
const char * mroute_addr_print(const struct mroute_addr *ma, struct gc_arena *gc)
Definition mroute.c:376
static bool do_pre_decrypt_check(struct multi_context *m, struct tls_pre_decrypt_state *state, struct mroute_addr addr)
Definition mudp.c:65
unsigned int p2mp_iow_flags(const struct multi_context *m)
Definition mudp.c:446
static void send_hmac_reset_packet(struct multi_context *m, struct tls_pre_decrypt_state *state, struct tls_auth_standalone *tas, struct session_id *sid, bool request_resend_wkc)
Definition mudp.c:41
void multi_process_io_udp(struct multi_context *m, struct link_socket *sock)
Definition mudp.c:348
static void multi_process_outgoing_link(struct multi_context *m, const unsigned int mpp_flags)
Definition mudp.c:326
struct multi_instance * multi_create_instance(struct multi_context *m, const struct mroute_addr *real, struct link_socket *sock)
Definition multi.c:731
void ungenerate_prefix(struct multi_instance *mi)
Definition multi.c:488
void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi)
Assigns a peer-id to a a client and adds the instance to the the instances array of the multi_context...
Definition multi.c:4153
Header file for server-mode related structures and functions.
bool multi_process_incoming_dco(struct multi_context *m)
Process an incoming DCO message (from kernel space).
#define MPP_CONDITIONAL_PRE_SELECT
Definition multi.h:276
#define MPP_CLOSE_ON_SIGNAL
Definition multi.h:277
static struct multi_instance * multi_process_outgoing_link_pre(struct multi_context *m)
Definition multi.h:411
#define MPP_PRE_SELECT
Definition multi.h:275
static bool multi_process_outgoing_link_dowork(struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags)
Definition multi.h:658
static bool check_debug_level(msglvl_t level)
Definition error.h:259
static void msg_set_prefix(const char *prefix)
Definition error.h:338
#define dmsg(flags,...)
Definition error.h:172
#define msg(flags,...)
Definition error.h:152
#define ASSERT(x)
Definition error.h:219
#define MAX_PEER_ID
Definition openvpn.h:554
bool frequency_limit_event_allowed(struct frequency_limit *f)
Definition otime.c:171
bool packet_id_read(struct packet_id_net *pin, struct buffer *buf, bool long_form)
Definition packet_id.c:319
static void reset_packet_id_send(struct packet_id_send *p)
Reset the current send packet id to its initial state.
Definition packet_id.h:312
void reflect_filter_rate_limit_decrease(struct initial_packet_rate_limit *irl)
decreases the counter of initial packets seen, so connections that successfully completed the three-w...
bool reflect_filter_rate_limit_check(struct initial_packet_rate_limit *irl)
checks if the connection is still allowed to connect under the rate limit.
static bool session_id_defined(const struct session_id *sid1)
Definition session_id.h:53
#define SID_SIZE
Definition session_id.h:44
#define IS_SIG(c)
Definition sig.h:47
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
static bool link_socket_actual_match(const struct link_socket_actual *a1, const struct link_socket_actual *a2)
bool session_skip_to_pre_start(struct tls_session *session, struct tls_pre_decrypt_state *state, struct link_socket_actual *from)
Definition ssl.c:2503
struct session_id calculate_session_id_hmac(struct session_id client_sid, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, int offset)
Calculates the HMAC based server session id based on a client session id and socket addr.
Definition ssl_pkt.c:464
void free_tls_pre_decrypt_state(struct tls_pre_decrypt_state *state)
Definition ssl_pkt.c:276
bool check_session_hmac_and_pkt_id(struct tls_pre_decrypt_state *state, const struct openvpn_sockaddr *from, hmac_ctx_t *hmac, int handwindow, bool pkt_is_ack)
Checks if a control packet has a correct HMAC server session id.
Definition ssl_pkt.c:508
struct buffer tls_reset_standalone(struct tls_wrap_ctx *ctx, struct tls_auth_standalone *tas, struct session_id *own_sid, struct session_id *remote_sid, uint8_t header, bool request_resend_wkc)
This function creates a reset packet using the information from the tls pre decrypt state.
Definition ssl_pkt.c:408
SSL control channel wrap/unwrap and decode functions.
#define P_DATA_V2
Definition ssl_pkt.h:48
#define P_OPCODE_SHIFT
Definition ssl_pkt.h:39
static const char * packet_opcode_name(int op)
Definition ssl_pkt.h:241
#define EARLY_NEG_MASK
Definition ssl_pkt.h:314
#define P_CONTROL_HARD_RESET_SERVER_V2
Definition ssl_pkt.h:52
first_packet_verdict
Definition ssl_pkt.h:85
@ VERDICT_VALID_ACK_V1
This packet is a valid ACK control packet from the peer, i.e.
Definition ssl_pkt.h:94
@ VERDICT_VALID_WKC_V1
The packet is a valid control packet with appended wrapped client key.
Definition ssl_pkt.h:96
@ VERDICT_VALID_RESET_V2
This packet is a valid reset packet from the peer (all but tls-crypt-v2)
Definition ssl_pkt.h:87
@ VERDICT_VALID_RESET_V3
This is a valid v3 reset (tls-crypt-v2)
Definition ssl_pkt.h:89
@ VERDICT_VALID_CONTROL_V1
This packet is a valid control packet from the peer.
Definition ssl_pkt.h:91
#define EARLY_NEG_START
Definition ssl_pkt.h:315
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
int offset
Offset in bytes of the actual content within the allocated memory.
Definition buffer.h:63
hmac_ctx_t * session_id_hmac
the HMAC we use to generate and verify our syn cookie like session ids from the server.
Definition openvpn.h:338
struct tls_auth_standalone * tls_auth_standalone
TLS state structure required for the initial authentication of a client's connection attempt.
Definition openvpn.h:326
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition openvpn.h:323
struct link_socket_actual from
Definition openvpn.h:245
struct buffer to_link
Definition openvpn.h:377
struct link_socket ** link_sockets
Definition openvpn.h:237
struct link_socket_actual * to_link_addr
Definition openvpn.h:244
struct buffer buf
Definition openvpn.h:375
bool fast_io
Definition openvpn.h:424
struct context_buffers * buffers
Definition openvpn.h:367
struct buffer aux_buf
Definition openvpn.h:97
Contains all state information for one tunnel.
Definition openvpn.h:474
struct context_2 c2
Level 2 context.
Definition openvpn.h:517
struct options options
Options loaded from command line or configuration file.
Definition openvpn.h:475
unsigned int flags
Bit-flags determining behavior of security operation functions.
Definition crypto.h:384
struct packet_id packet_id
Current packet ID state for both sending and receiving directions.
Definition crypto.h:331
int signal_received
Definition multi.h:63
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
void * value
Definition list.h:41
Definition list.h:53
uint8_t proto
Definition mroute.h:80
Main OpenVPN server state structure.
Definition multi.h:164
struct mbuf_set * mbuf
Set of buffers for passing data channel packets between VPN tunnel instances.
Definition multi.h:176
struct initial_packet_rate_limit * initial_rate_limiter
Definition multi.h:182
struct deferred_signal_schedule_entry deferred_shutdown_signal
Definition multi.h:220
struct link_socket_actual * hmac_reply_dest
Definition multi.h:207
struct multi_io * multi_io
I/O state and events tracker.
Definition multi.h:179
struct hash * hash
VPN tunnel instances indexed by real address of the remote peer.
Definition multi.h:168
struct link_socket * hmac_reply_ls
Definition multi.h:208
struct frequency_limit * new_connection_limiter
Definition multi.h:181
struct context top
Storage structure for process-wide configuration.
Definition multi.h:203
struct multi_instance * pending
Definition multi.h:197
struct multi_instance ** instances
Array of multi_instances.
Definition multi.h:165
struct buffer hmac_reply
Definition multi.h:206
Server-mode state structure for one single VPN tunnel.
Definition multi.h:103
struct mroute_addr real
External network address of the remote peer.
Definition multi.h:122
bool did_real_hash
Definition multi.h:135
struct context context
The context structure storing state for this VPN tunnel.
Definition multi.h:144
unsigned int udp_flags
Definition multi_io.h:58
int handshake_window
Definition options.h:655
Data structure for describing the packet id that is received/send to the network.
Definition packet_id.h:191
struct packet_id_send send
Definition packet_id.h:200
struct packet_id_rec rec
Definition packet_id.h:201
struct tls_wrap_ctx tls_wrap
Definition ssl_pkt.h:79
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition ssl_common.h:712
int n_sessions
Number of sessions negotiated thus far.
Definition ssl_common.h:631
struct that stores the temporary data for the tls lite decrypt functions
Definition ssl_pkt.h:106
struct session_id peer_session_id
Definition ssl_pkt.h:109
struct session_id server_session_id
Definition ssl_pkt.h:110
struct tls_wrap_ctx tls_wrap_tmp
Definition ssl_pkt.h:107
Security parameter state of a single session within a VPN tunnel.
Definition ssl_common.h:490
struct crypto_options opt
Crypto state.
Definition ssl_common.h:283
struct gc_arena gc
Definition test_ssl.c:131