OpenVPN
multi.c
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #endif
27 
28 #ifdef HAVE_SYS_INOTIFY_H
29 #include <sys/inotify.h>
30 #define INOTIFY_EVENT_BUFFER_SIZE 16384
31 #endif
32 
33 #include "syshead.h"
34 
35 #include "forward.h"
36 #include "multi.h"
37 #include "push.h"
38 #include "run_command.h"
39 #include "otime.h"
40 #include "gremlin.h"
41 #include "mstats.h"
42 #include "ssl_verify.h"
43 #include "ssl_ncp.h"
44 #include "vlan.h"
45 #include <inttypes.h>
46 
47 #include "memdbg.h"
48 
49 
50 #include "crypto_backend.h"
51 #include "ssl_util.h"
52 #include "dco.h"
53 #include "reflect_filter.h"
54 
55 /*#define MULTI_DEBUG_EVENT_LOOP*/
56 
57 #ifdef MULTI_DEBUG_EVENT_LOOP
58 static const char *
59 id(struct multi_instance *mi)
60 {
61  if (mi)
62  {
63  return tls_common_name(mi->context.c2.tls_multi, false);
64  }
65  else
66  {
67  return "NULL";
68  }
69 }
70 #endif
71 
72 #ifdef ENABLE_MANAGEMENT
73 static void
75 {
77  mi->cc_config = cc_config;
78 }
79 #endif
80 
81 static inline void
82 update_mstat_n_clients(const int n_clients)
83 {
84 #ifdef ENABLE_MEMSTATS
85  if (mmap_stats)
86  {
87  mmap_stats->n_clients = n_clients;
88  }
89 #endif
90 }
91 
92 static bool
94  const struct multi_instance *mi,
95  const char *op,
96  const struct mroute_addr *addr)
97 {
98  struct gc_arena gc = gc_new();
99  struct env_set *es;
100  bool ret = true;
101  struct plugin_list *plugins;
102 
103  /* get environmental variable source */
104  if (mi && mi->context.c2.es)
105  {
106  es = mi->context.c2.es;
107  }
108  else
109  {
110  es = env_set_create(&gc);
111  }
112 
113  /* get plugin source */
114  if (mi)
115  {
116  plugins = mi->context.plugins;
117  }
118  else
119  {
120  plugins = m->top.plugins;
121  }
122 
124  {
125  struct argv argv = argv_new();
126  argv_printf(&argv, "%s %s",
127  op,
128  mroute_addr_print(addr, &gc));
129  if (mi)
130  {
132  }
134  {
135  msg(M_WARN, "WARNING: learn-address plugin call failed");
136  ret = false;
137  }
138  argv_free(&argv);
139  }
140 
142  {
143  struct argv argv = argv_new();
144  setenv_str(es, "script_type", "learn-address");
146  argv_printf_cat(&argv, "%s %s", op, mroute_addr_print(addr, &gc));
147  if (mi)
148  {
150  }
151  if (!openvpn_run_script(&argv, es, 0, "--learn-address"))
152  {
153  ret = false;
154  }
155  argv_free(&argv);
156  }
157 
158  gc_free(&gc);
159  return ret;
160 }
161 
162 void
164 {
165  /* write pool data to file */
166  if (m->ifconfig_pool
169  {
171  }
172 }
173 
174 static void
176  int start_bucket,
177  int end_bucket)
178 {
179  struct gc_arena gc = gc_new();
180  struct hash_iterator hi;
181  struct hash_element *he;
182 
183  if (start_bucket < 0)
184  {
185  start_bucket = 0;
186  end_bucket = hash_n_buckets(m->vhash);
187  }
188 
189  dmsg(D_MULTI_DEBUG, "MULTI: REAP range %d -> %d", start_bucket, end_bucket);
190  hash_iterator_init_range(m->vhash, &hi, start_bucket, end_bucket);
191  while ((he = hash_iterator_next(&hi)) != NULL)
192  {
193  struct multi_route *r = (struct multi_route *) he->value;
194  if (!multi_route_defined(m, r))
195  {
196  dmsg(D_MULTI_DEBUG, "MULTI: REAP DEL %s",
197  mroute_addr_print(&r->addr, &gc));
198  learn_address_script(m, NULL, "delete", &r->addr);
199  multi_route_del(r);
201  }
202  }
203  hash_iterator_free(&hi);
204  gc_free(&gc);
205 }
206 
207 static void
209 {
210  multi_reap_range(m, -1, 0);
211 }
212 
213 static struct multi_reap *
215 {
216  struct multi_reap *mr;
217  ALLOC_OBJ(mr, struct multi_reap);
218  mr->bucket_base = 0;
220  mr->last_call = now;
221  return mr;
222 }
223 
224 void
226 {
227  struct multi_reap *mr = m->reaper;
228  if (mr->bucket_base >= hash_n_buckets(m->vhash))
229  {
230  mr->bucket_base = 0;
231  }
233  mr->bucket_base += mr->buckets_per_pass;
234  mr->last_call = now;
235 }
236 
237 static void
239 {
240  free(mr);
241 }
242 
243 /*
244  * How many buckets in vhash to reap per pass.
245  */
246 static int
247 reap_buckets_per_pass(int n_buckets)
248 {
249  return constrain_int(n_buckets / REAP_DIVISOR, REAP_MIN, REAP_MAX);
250 }
251 
252 #ifdef ENABLE_MANAGEMENT
253 
254 static uint32_t
255 cid_hash_function(const void *key, uint32_t iv)
256 {
257  const unsigned long *k = (const unsigned long *)key;
258  return (uint32_t) *k;
259 }
260 
261 static bool
262 cid_compare_function(const void *key1, const void *key2)
263 {
264  const unsigned long *k1 = (const unsigned long *)key1;
265  const unsigned long *k2 = (const unsigned long *)key2;
266  return *k1 == *k2;
267 }
268 
269 #endif
270 
271 #ifdef ENABLE_ASYNC_PUSH
272 static uint32_t
273 /*
274  * inotify watcher descriptors are used as hash value
275  */
276 int_hash_function(const void *key, uint32_t iv)
277 {
278  return (unsigned long)key;
279 }
280 
281 static bool
282 int_compare_function(const void *key1, const void *key2)
283 {
284  return (unsigned long)key1 == (unsigned long)key2;
285 }
286 #endif
287 
288 /*
289  * Main initialization function, init multi_context object.
290  */
291 void
292 multi_init(struct multi_context *m, struct context *t, bool tcp_mode)
293 {
294  int dev = DEV_TYPE_UNDEF;
295 
296  msg(D_MULTI_LOW, "MULTI: multi_init called, r=%d v=%d",
299 
300  /*
301  * Get tun/tap/null device type
302  */
303  dev = dev_type_enum(t->options.dev, t->options.dev_type);
304 
305  /*
306  * Init our multi_context object.
307  */
308  CLEAR(*m);
309 
310  /*
311  * Real address hash table (source port number is
312  * considered to be part of the address). Used
313  * to determine which client sent an incoming packet
314  * which is seen on the TCP/UDP socket.
315  */
317  get_random(),
320 
321  /*
322  * Virtual address hash table. Used to determine
323  * which client to route a packet to.
324  */
326  get_random(),
329 
330  /*
331  * This hash table is a clone of m->hash but with a
332  * bucket size of one so that it can be used
333  * for fast iteration through the list.
334  */
335  m->iter = hash_init(1,
336  get_random(),
339 
340 #ifdef ENABLE_MANAGEMENT
342  0,
345 #endif
346 
347 #ifdef ENABLE_ASYNC_PUSH
348  /*
349  * Mapping between inotify watch descriptors and
350  * multi_instances.
351  */
352  m->inotify_watchers = hash_init(t->options.real_hash_size,
353  get_random(),
354  int_hash_function,
355  int_compare_function);
356 #endif
357 
358  /*
359  * This is our scheduler, for time-based wakeup
360  * events.
361  */
362  m->schedule = schedule_init();
363 
364  /*
365  * Limit frequency of incoming connections to control
366  * DoS.
367  */
369  t->options.cf_per);
372 
373  /*
374  * Allocate broadcast/multicast buffer list
375  */
377 
378  /*
379  * Different status file format options are available
380  */
382 
383  /*
384  * Possibly allocate an ifconfig pool, do it
385  * differently based on whether a tun or tap style
386  * tunnel.
387  */
390  {
392 
393  if (dev == DEV_TYPE_TUN && t->options.topology == TOP_NET30)
394  {
396  }
397 
399  pool_type,
406 
407  /* reload pool data from file */
408  if (t->c1.ifconfig_pool_persist)
409  {
411  }
412  }
413 
414  /*
415  * Help us keep track of routing table.
416  */
418 
419  /*
420  * Initialize route and instance reaper.
421  */
423 
424  /*
425  * Get local ifconfig address
426  */
427  CLEAR(m->local);
428  ASSERT(t->c1.tuntap);
430 
431  /*
432  * Per-client limits
433  */
435 
436  m->instances = calloc(m->max_clients, sizeof(struct multi_instance *));
437 
438  /*
439  * Initialize multi-socket TCP I/O wait object
440  */
441  if (tcp_mode)
442  {
444  }
446 
447  /*
448  * Allow client <-> client communication, without going through
449  * tun/tap interface and network stack?
450  */
451  m->enable_c2c = t->options.enable_c2c;
452 
453  /* initialize stale routes check timer */
455  {
456  msg(M_INFO, "Initializing stale route check timer to run every %i seconds and to removing routes with activity timeout older than %i seconds",
459  }
460 
462 }
463 
464 const char *
465 multi_instance_string(const struct multi_instance *mi, bool null, struct gc_arena *gc)
466 {
467  if (mi)
468  {
469  struct buffer out = alloc_buf_gc(MULTI_PREFIX_MAX_LENGTH, gc);
470  const char *cn = tls_common_name(mi->context.c2.tls_multi, true);
471 
472  if (cn)
473  {
474  buf_printf(&out, "%s/", cn);
475  }
476  buf_printf(&out, "%s", mroute_addr_print(&mi->real, gc));
477  if (mi->context.c2.tls_multi
479  && dco_enabled(&mi->context.options))
480  {
481  buf_printf(&out, " peer-id=%d", mi->context.c2.tls_multi->peer_id);
482  }
483  return BSTR(&out);
484  }
485  else if (null)
486  {
487  return NULL;
488  }
489  else
490  {
491  return "UNDEF";
492  }
493 }
494 
495 static void
497 {
498  struct gc_arena gc = gc_new();
499  const char *prefix = multi_instance_string(mi, true, &gc);
500  if (prefix)
501  {
502  strncpynt(mi->msg_prefix, prefix, sizeof(mi->msg_prefix));
503  }
504  else
505  {
506  mi->msg_prefix[0] = '\0';
507  }
508  set_prefix(mi);
509  gc_free(&gc);
510 }
511 
512 void
514 {
515  mi->msg_prefix[0] = '\0';
516  set_prefix(mi);
517 }
518 
519 /*
520  * Tell the route helper about deleted iroutes so
521  * that it can update its mask of currently used
522  * CIDR netlengths.
523  */
524 static void
526  struct multi_instance *mi)
527 {
528  const struct iroute *ir;
529  const struct iroute_ipv6 *ir6;
530 
531  dco_delete_iroutes(m, mi);
532 
534  {
535  for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next)
536  {
538  }
539 
540  for (ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next)
541  {
543  }
544  }
545 }
546 
547 static void
548 setenv_stats(struct multi_context *m, struct context *c)
549 {
550  if (dco_enabled(&m->top.options))
551  {
553  }
554 
555  setenv_counter(c->c2.es, "bytes_received", c->c2.link_read_bytes + c->c2.dco_read_bytes);
556  setenv_counter(c->c2.es, "bytes_sent", c->c2.link_write_bytes + c->c2.dco_write_bytes);
557 }
558 
559 static void
561 {
562  /* setenv client real IP address */
564 
565  /* setenv stats */
566  setenv_stats(m, &mi->context);
567 
568  /* setenv connection duration */
569  setenv_long_long(mi->context.c2.es, "time_duration", now - mi->created);
570 }
571 
572 static void
574 {
576 
578  {
580  {
581  msg(M_WARN, "WARNING: client-disconnect plugin call failed");
582  }
583  }
584 
586  {
587  struct argv argv = argv_new();
588  setenv_str(mi->context.c2.es, "script_type", "client-disconnect");
590  openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-disconnect");
591  argv_free(&argv);
592  }
593 #ifdef ENABLE_MANAGEMENT
594  if (management)
595  {
597  }
598 #endif
599 }
600 
601 void
603  struct multi_instance *mi,
604  bool shutdown)
605 {
607 
608  ASSERT(!mi->halt);
609  mi->halt = true;
610 
611  dmsg(D_MULTI_DEBUG, "MULTI: multi_close_instance called");
612 
613  /* adjust current client connection count */
614  m->n_clients += mi->n_clients_delta;
616  mi->n_clients_delta = 0;
617 
618  /* prevent dangling pointers */
619  if (m->pending == mi)
620  {
621  multi_set_pending(m, NULL);
622  }
623  if (m->earliest_wakeup == mi)
624  {
625  m->earliest_wakeup = NULL;
626  }
627 
628  if (!shutdown)
629  {
630  if (mi->did_real_hash)
631  {
632  ASSERT(hash_remove(m->hash, &mi->real));
633  }
634  if (mi->did_iter)
635  {
636  ASSERT(hash_remove(m->iter, &mi->real));
637  }
638 #ifdef ENABLE_MANAGEMENT
639  if (mi->did_cid_hash)
640  {
642  }
643 #endif
644 
645 #ifdef ENABLE_ASYNC_PUSH
646  if (mi->inotify_watch != -1)
647  {
648  hash_remove(m->inotify_watchers, (void *) (unsigned long)mi->inotify_watch);
649  mi->inotify_watch = -1;
650  }
651 #endif
652 
653  if (mi->context.c2.tls_multi->peer_id != MAX_PEER_ID)
654  {
655  m->instances[mi->context.c2.tls_multi->peer_id] = NULL;
656  }
657 
658  schedule_remove_entry(m->schedule, (struct schedule_entry *) mi);
659 
660  ifconfig_pool_release(m->ifconfig_pool, mi->vaddr_handle, false);
661 
662  if (mi->did_iroutes)
663  {
664  multi_del_iroutes(m, mi);
665  mi->did_iroutes = false;
666  }
667 
668  if (m->mtcp)
669  {
671  }
672 
674  }
675 
676 #ifdef ENABLE_MANAGEMENT
677  set_cc_config(mi, NULL);
678 #endif
679 
681  {
683  }
684 
685  close_context(&mi->context, SIGTERM, CC_GC_FREE);
686 
688 
689  ungenerate_prefix(mi);
690 
691  /*
692  * Don't actually delete the instance memory allocation yet,
693  * because virtual routes may still point to it. Let the
694  * vhash reaper deal with it.
695  */
697 
698  perf_pop();
699 }
700 
701 /*
702  * Called on shutdown or restart.
703  */
704 void
706 {
707  if (m->hash)
708  {
709  struct hash_iterator hi;
710  struct hash_element *he;
711 
712  hash_iterator_init(m->iter, &hi);
713  while ((he = hash_iterator_next(&hi)))
714  {
715  struct multi_instance *mi = (struct multi_instance *) he->value;
716  mi->did_iter = false;
717  multi_close_instance(m, mi, true);
718  }
719  hash_iterator_free(&hi);
720 
721  multi_reap_all(m);
722 
723  hash_free(m->hash);
724  hash_free(m->vhash);
725  hash_free(m->iter);
726 #ifdef ENABLE_MANAGEMENT
727  hash_free(m->cid_hash);
728 #endif
729  m->hash = NULL;
730 
731  free(m->instances);
732 
733 #ifdef ENABLE_ASYNC_PUSH
734  hash_free(m->inotify_watchers);
735  m->inotify_watchers = NULL;
736 #endif
737 
739  mbuf_free(m->mbuf);
745  multi_tcp_free(m->mtcp);
746  }
747 }
748 
749 /*
750  * Create a client instance object for a newly connected client.
751  */
752 struct multi_instance *
754 {
755  struct gc_arena gc = gc_new();
756  struct multi_instance *mi;
757 
759 
760  msg(D_MULTI_MEDIUM, "MULTI: multi_create_instance called");
761 
762  ALLOC_OBJ_CLEAR(mi, struct multi_instance);
763 
764  mi->gc = gc_new();
766  mi->vaddr_handle = -1;
767  mi->created = now;
768  mroute_addr_init(&mi->real);
769 
770  if (real)
771  {
772  mi->real = *real;
773  generate_prefix(mi);
774  }
775 
776  inherit_context_child(&mi->context, &m->top);
777  if (IS_SIG(&mi->context))
778  {
779  goto err;
780  }
781 
783 
784  if (hash_n_elements(m->hash) >= m->max_clients)
785  {
786  msg(D_MULTI_ERRORS, "MULTI: new incoming connection would exceed maximum number of clients (%d)", m->max_clients);
787  goto err;
788  }
789 
790  if (!real) /* TCP mode? */
791  {
793  {
794  goto err;
795  }
796  generate_prefix(mi);
797  }
798 
799  if (!hash_add(m->iter, &mi->real, mi, false))
800  {
801  msg(D_MULTI_LOW, "MULTI: unable to add real address [%s] to iterator hash table",
802  mroute_addr_print(&mi->real, &gc));
803  goto err;
804  }
805  mi->did_iter = true;
806 
807 #ifdef ENABLE_MANAGEMENT
808  do
809  {
810  mi->context.c2.mda_context.cid = m->cid_counter++;
811  } while (!hash_add(m->cid_hash, &mi->context.c2.mda_context.cid, mi, false));
812  mi->did_cid_hash = true;
813 #endif
814 
815  mi->context.c2.push_request_received = false;
816 #ifdef ENABLE_ASYNC_PUSH
817  mi->inotify_watch = -1;
818 #endif
819 
820  if (!multi_process_post(m, mi, MPP_PRE_SELECT))
821  {
822  msg(D_MULTI_ERRORS, "MULTI: signal occurred during client instance initialization");
823  goto err;
824  }
825 
826  perf_pop();
827  gc_free(&gc);
828  return mi;
829 
830 err:
831  multi_close_instance(m, mi, false);
832  perf_pop();
833  gc_free(&gc);
834  return NULL;
835 }
836 
837 /*
838  * Dump tables -- triggered by SIGUSR2.
839  * If status file is defined, write to file.
840  * If status file is NULL, write to syslog.
841  */
842 void
843 multi_print_status(struct multi_context *m, struct status_output *so, const int version)
844 {
845  if (m->hash)
846  {
847  struct gc_arena gc_top = gc_new();
848  struct hash_iterator hi;
849  const struct hash_element *he;
850 
851  status_reset(so);
852 
853  if (dco_enabled(&m->top.options))
854  {
856  }
857 
858  if (version == 1)
859  {
860  /*
861  * Status file version 1
862  */
863  status_printf(so, "OpenVPN CLIENT LIST");
864  status_printf(so, "Updated,%s", time_string(0, 0, false, &gc_top));
865  status_printf(so, "Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since");
866  hash_iterator_init(m->hash, &hi);
867  while ((he = hash_iterator_next(&hi)))
868  {
869  struct gc_arena gc = gc_new();
870  const struct multi_instance *mi = (struct multi_instance *) he->value;
871 
872  if (!mi->halt)
873  {
874  status_printf(so, "%s,%s," counter_format "," counter_format ",%s",
875  tls_common_name(mi->context.c2.tls_multi, false),
876  mroute_addr_print(&mi->real, &gc),
879  time_string(mi->created, 0, false, &gc));
880  }
881  gc_free(&gc);
882  }
883  hash_iterator_free(&hi);
884 
885  status_printf(so, "ROUTING TABLE");
886  status_printf(so, "Virtual Address,Common Name,Real Address,Last Ref");
887  hash_iterator_init(m->vhash, &hi);
888  while ((he = hash_iterator_next(&hi)))
889  {
890  struct gc_arena gc = gc_new();
891  const struct multi_route *route = (struct multi_route *) he->value;
892 
893  if (multi_route_defined(m, route))
894  {
895  const struct multi_instance *mi = route->instance;
896  const struct mroute_addr *ma = &route->addr;
897  char flags[2] = {0, 0};
898 
899  if (route->flags & MULTI_ROUTE_CACHE)
900  {
901  flags[0] = 'C';
902  }
903  status_printf(so, "%s%s,%s,%s,%s",
904  mroute_addr_print(ma, &gc),
905  flags,
906  tls_common_name(mi->context.c2.tls_multi, false),
907  mroute_addr_print(&mi->real, &gc),
908  time_string(route->last_reference, 0, false, &gc));
909  }
910  gc_free(&gc);
911  }
912  hash_iterator_free(&hi);
913 
914  status_printf(so, "GLOBAL STATS");
915  if (m->mbuf)
916  {
917  status_printf(so, "Max bcast/mcast queue length,%d",
919  }
920 
921  status_printf(so, "END");
922  }
923  else if (version == 2 || version == 3)
924  {
925  const char sep = (version == 3) ? '\t' : ',';
926 
927  /*
928  * Status file version 2 and 3
929  */
930  status_printf(so, "TITLE%c%s", sep, title_string);
931  status_printf(so, "TIME%c%s%c%u", sep, time_string(now, 0, false, &gc_top), sep, (unsigned int)now);
932  status_printf(so, "HEADER%cCLIENT_LIST%cCommon Name%cReal Address%cVirtual Address%cVirtual IPv6 Address%cBytes Received%cBytes Sent%cConnected Since%cConnected Since (time_t)%cUsername%cClient ID%cPeer ID%cData Channel Cipher",
933  sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep);
934  hash_iterator_init(m->hash, &hi);
935  while ((he = hash_iterator_next(&hi)))
936  {
937  struct gc_arena gc = gc_new();
938  const struct multi_instance *mi = (struct multi_instance *) he->value;
939 
940  if (!mi->halt)
941  {
942  status_printf(so, "CLIENT_LIST%c%s%c%s%c%s%c%s%c" counter_format "%c" counter_format "%c%s%c%u%c%s%c"
943 #ifdef ENABLE_MANAGEMENT
944  "%lu"
945 #else
946  ""
947 #endif
948  "%c%" PRIu32 "%c%s",
949  sep, tls_common_name(mi->context.c2.tls_multi, false),
950  sep, mroute_addr_print(&mi->real, &gc),
955  sep, time_string(mi->created, 0, false, &gc),
956  sep, (unsigned int)mi->created,
957  sep, tls_username(mi->context.c2.tls_multi, false),
958 #ifdef ENABLE_MANAGEMENT
959  sep, mi->context.c2.mda_context.cid,
960 #else
961  sep,
962 #endif
963  sep, mi->context.c2.tls_multi ? mi->context.c2.tls_multi->peer_id : UINT32_MAX,
965  }
966  gc_free(&gc);
967  }
968  hash_iterator_free(&hi);
969 
970  status_printf(so, "HEADER%cROUTING_TABLE%cVirtual Address%cCommon Name%cReal Address%cLast Ref%cLast Ref (time_t)",
971  sep, sep, sep, sep, sep, sep);
972  hash_iterator_init(m->vhash, &hi);
973  while ((he = hash_iterator_next(&hi)))
974  {
975  struct gc_arena gc = gc_new();
976  const struct multi_route *route = (struct multi_route *) he->value;
977 
978  if (multi_route_defined(m, route))
979  {
980  const struct multi_instance *mi = route->instance;
981  const struct mroute_addr *ma = &route->addr;
982  char flags[2] = {0, 0};
983 
984  if (route->flags & MULTI_ROUTE_CACHE)
985  {
986  flags[0] = 'C';
987  }
988  status_printf(so, "ROUTING_TABLE%c%s%s%c%s%c%s%c%s%c%u",
989  sep, mroute_addr_print(ma, &gc), flags,
990  sep, tls_common_name(mi->context.c2.tls_multi, false),
991  sep, mroute_addr_print(&mi->real, &gc),
992  sep, time_string(route->last_reference, 0, false, &gc),
993  sep, (unsigned int)route->last_reference);
994  }
995  gc_free(&gc);
996  }
997  hash_iterator_free(&hi);
998 
999  if (m->mbuf)
1000  {
1001  status_printf(so, "GLOBAL_STATS%cMax bcast/mcast queue length%c%d",
1002  sep, sep, mbuf_maximum_queued(m->mbuf));
1003  }
1004 
1005  status_printf(so, "GLOBAL_STATS%cdco_enabled%c%d", sep, sep, dco_enabled(&m->top.options));
1006  status_printf(so, "END");
1007  }
1008  else
1009  {
1010  status_printf(so, "ERROR: bad status format version number");
1011  }
1012 
1013 #ifdef PACKET_TRUNCATION_CHECK
1014  {
1015  status_printf(so, "HEADER,ERRORS,Common Name,TUN Read Trunc,TUN Write Trunc,Pre-encrypt Trunc,Post-decrypt Trunc");
1016  hash_iterator_init(m->hash, &hi);
1017  while ((he = hash_iterator_next(&hi)))
1018  {
1019  struct gc_arena gc = gc_new();
1020  const struct multi_instance *mi = (struct multi_instance *) he->value;
1021 
1022  if (!mi->halt)
1023  {
1025  tls_common_name(mi->context.c2.tls_multi, false),
1026  m->top.c2.n_trunc_tun_read,
1027  mi->context.c2.n_trunc_tun_write,
1028  mi->context.c2.n_trunc_pre_encrypt,
1029  mi->context.c2.n_trunc_post_decrypt);
1030  }
1031  gc_free(&gc);
1032  }
1033  hash_iterator_free(&hi);
1034  }
1035 #endif /* ifdef PACKET_TRUNCATION_CHECK */
1036 
1037  status_flush(so);
1038  gc_free(&gc_top);
1039  }
1040 
1041 #ifdef ENABLE_ASYNC_PUSH
1042  if (m->inotify_watchers)
1043  {
1044  msg(D_MULTI_DEBUG, "inotify watchers count: %d\n", hash_n_elements(m->inotify_watchers));
1045  }
1046 #endif
1047 }
1048 
1049 /*
1050  * Learn a virtual address or route.
1051  * The learn will fail if the learn address
1052  * script/plugin fails. In this case the
1053  * return value may be != mi.
1054  * Return the instance which owns this route,
1055  * or NULL if none.
1056  */
1057 static struct multi_instance *
1059  struct multi_instance *mi,
1060  const struct mroute_addr *addr,
1061  const unsigned int flags)
1062 {
1063  struct hash_element *he;
1064  const uint32_t hv = hash_value(m->vhash, addr);
1065  struct hash_bucket *bucket = hash_bucket(m->vhash, hv);
1066  struct multi_route *oldroute = NULL;
1067  struct multi_instance *owner = NULL;
1068  struct gc_arena gc = gc_new();
1069 
1070  /* if route currently exists, get the instance which owns it */
1071  he = hash_lookup_fast(m->vhash, bucket, addr, hv);
1072  if (he)
1073  {
1074  oldroute = (struct multi_route *) he->value;
1075  }
1076  if (oldroute && multi_route_defined(m, oldroute))
1077  {
1078  owner = oldroute->instance;
1079  }
1080 
1081  /* do we need to add address to hash table? */
1082  if ((!owner || owner != mi) && mroute_learnable_address(addr, &gc)
1083  && !mroute_addr_equal(addr, &m->local))
1084  {
1085  struct multi_route *newroute;
1086  bool learn_succeeded = false;
1087 
1088  ALLOC_OBJ(newroute, struct multi_route);
1089  newroute->addr = *addr;
1090  newroute->instance = mi;
1091  newroute->flags = flags;
1092  newroute->last_reference = now;
1093  newroute->cache_generation = 0;
1094 
1095  /* The cache is invalidated when cache_generation is incremented */
1096  if (flags & MULTI_ROUTE_CACHE)
1097  {
1099  }
1100 
1101  if (oldroute) /* route already exists? */
1102  {
1103  if (route_quota_test(mi) && learn_address_script(m, mi, "update", &newroute->addr))
1104  {
1105  learn_succeeded = true;
1106  owner = mi;
1108  route_quota_inc(mi);
1109 
1110  /* delete old route */
1111  multi_route_del(oldroute);
1112 
1113  /* modify hash table entry, replacing old route */
1114  he->key = &newroute->addr;
1115  he->value = newroute;
1116  }
1117  }
1118  else
1119  {
1120  if (route_quota_test(mi) && learn_address_script(m, mi, "add", &newroute->addr))
1121  {
1122  learn_succeeded = true;
1123  owner = mi;
1125  route_quota_inc(mi);
1126 
1127  /* add new route */
1128  hash_add_fast(m->vhash, bucket, &newroute->addr, hv, newroute);
1129  }
1130  }
1131 
1132  msg(D_MULTI_LOW, "MULTI: Learn%s: %s -> %s",
1133  learn_succeeded ? "" : " FAILED",
1134  mroute_addr_print(&newroute->addr, &gc),
1135  multi_instance_string(mi, false, &gc));
1136 
1137  if (!learn_succeeded)
1138  {
1139  free(newroute);
1140  }
1141  }
1142  gc_free(&gc);
1143 
1144  return owner;
1145 }
1146 
1147 /*
1148  * Get client instance based on virtual address.
1149  */
1150 static struct multi_instance *
1152  const struct mroute_addr *addr,
1153  bool cidr_routing)
1154 {
1155  struct multi_route *route;
1156  struct multi_instance *ret = NULL;
1157 
1158  /* check for local address */
1159  if (mroute_addr_equal(addr, &m->local))
1160  {
1161  return NULL;
1162  }
1163 
1164  route = (struct multi_route *) hash_lookup(m->vhash, addr);
1165 
1166  /* does host route (possible cached) exist? */
1167  if (route && multi_route_defined(m, route))
1168  {
1169  struct multi_instance *mi = route->instance;
1170  route->last_reference = now;
1171  ret = mi;
1172  }
1173  else if (cidr_routing) /* do we need to regenerate a host route cache entry? */
1174  {
1175  struct mroute_helper *rh = m->route_helper;
1176  struct mroute_addr tryaddr;
1177  int i;
1178 
1179  /* cycle through each CIDR length */
1180  for (i = 0; i < rh->n_net_len; ++i)
1181  {
1182  tryaddr = *addr;
1183  tryaddr.type |= MR_WITH_NETBITS;
1184  tryaddr.netbits = rh->net_len[i];
1185  mroute_addr_mask_host_bits(&tryaddr);
1186 
1187  /* look up a possible route with netbits netmask */
1188  route = (struct multi_route *) hash_lookup(m->vhash, &tryaddr);
1189 
1190  if (route && multi_route_defined(m, route))
1191  {
1192  /* found an applicable route, cache host route */
1193  struct multi_instance *mi = route->instance;
1195  ret = mi;
1196  break;
1197  }
1198  }
1199  }
1200 
1201 #ifdef ENABLE_DEBUG
1203  {
1204  struct gc_arena gc = gc_new();
1205  const char *addr_text = mroute_addr_print(addr, &gc);
1206  if (ret)
1207  {
1208  dmsg(D_MULTI_DEBUG, "GET INST BY VIRT: %s -> %s via %s",
1209  addr_text,
1210  multi_instance_string(ret, false, &gc),
1211  mroute_addr_print(&route->addr, &gc));
1212  }
1213  else
1214  {
1215  dmsg(D_MULTI_DEBUG, "GET INST BY VIRT: %s [failed]",
1216  addr_text);
1217  }
1218  gc_free(&gc);
1219  }
1220 #endif
1221 
1222  ASSERT(!(ret && ret->halt));
1223  return ret;
1224 }
1225 
1226 /*
1227  * Helper function to multi_learn_addr().
1228  */
1229 static struct multi_instance *
1231  struct multi_instance *mi,
1232  in_addr_t a,
1233  int netbits, /* -1 if host route, otherwise # of network bits in address */
1234  bool primary)
1235 {
1236  struct openvpn_sockaddr remote_si;
1237  struct mroute_addr addr = {0};
1238 
1239  CLEAR(remote_si);
1240  remote_si.addr.in4.sin_family = AF_INET;
1241  remote_si.addr.in4.sin_addr.s_addr = htonl(a);
1242  ASSERT(mroute_extract_openvpn_sockaddr(&addr, &remote_si, false));
1243 
1244  if (netbits >= 0)
1245  {
1246  addr.type |= MR_WITH_NETBITS;
1247  addr.netbits = (uint8_t) netbits;
1248  }
1249 
1250  struct multi_instance *owner = multi_learn_addr(m, mi, &addr, 0);
1251 #ifdef ENABLE_MANAGEMENT
1252  if (management && owner)
1253  {
1254  management_learn_addr(management, &mi->context.c2.mda_context, &addr, primary);
1255  }
1256 #endif
1257  if (!primary)
1258  {
1259  /* "primary" is the VPN ifconfig address of the peer and already
1260  * known to DCO, so only install "extra" iroutes (primary = false)
1261  */
1262  ASSERT(netbits >= 0); /* DCO requires populated netbits */
1263  dco_install_iroute(m, mi, &addr);
1264  }
1265 
1266  return owner;
1267 }
1268 
1269 static struct multi_instance *
1271  struct multi_instance *mi,
1272  struct in6_addr a6,
1273  int netbits, /* -1 if host route, otherwise # of network bits in address */
1274  bool primary)
1275 {
1276  struct mroute_addr addr = {0};
1277 
1278  addr.len = 16;
1279  addr.type = MR_ADDR_IPV6;
1280  addr.netbits = 0;
1281  addr.v6.addr = a6;
1282 
1283  if (netbits >= 0)
1284  {
1285  addr.type |= MR_WITH_NETBITS;
1286  addr.netbits = (uint8_t) netbits;
1288  }
1289 
1290  struct multi_instance *owner = multi_learn_addr(m, mi, &addr, 0);
1291 #ifdef ENABLE_MANAGEMENT
1292  if (management && owner)
1293  {
1294  management_learn_addr(management, &mi->context.c2.mda_context, &addr, primary);
1295  }
1296 #endif
1297  if (!primary)
1298  {
1299  /* "primary" is the VPN ifconfig address of the peer and already
1300  * known to DCO, so only install "extra" iroutes (primary = false)
1301  */
1302  ASSERT(netbits >= 0); /* DCO requires populated netbits */
1303  dco_install_iroute(m, mi, &addr);
1304  }
1305 
1306  return owner;
1307 }
1308 
1309 /*
1310  * A new client has connected, add routes (server -> client)
1311  * to internal routing table.
1312  */
1313 static void
1315  struct multi_instance *mi)
1316 {
1317  struct gc_arena gc = gc_new();
1318  const struct iroute *ir;
1319  const struct iroute_ipv6 *ir6;
1321  {
1322  mi->did_iroutes = true;
1323  for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next)
1324  {
1325  if (ir->netbits >= 0)
1326  {
1327  msg(D_MULTI_LOW, "MULTI: internal route %s/%d -> %s",
1328  print_in_addr_t(ir->network, 0, &gc),
1329  ir->netbits,
1330  multi_instance_string(mi, false, &gc));
1331  }
1332  else
1333  {
1334  msg(D_MULTI_LOW, "MULTI: internal route %s -> %s",
1335  print_in_addr_t(ir->network, 0, &gc),
1336  multi_instance_string(mi, false, &gc));
1337  }
1338 
1340 
1341  multi_learn_in_addr_t(m, mi, ir->network, ir->netbits, false);
1342  }
1343  for (ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next)
1344  {
1345  msg(D_MULTI_LOW, "MULTI: internal route %s/%d -> %s",
1346  print_in6_addr(ir6->network, 0, &gc),
1347  ir6->netbits,
1348  multi_instance_string(mi, false, &gc));
1349 
1351 
1352  multi_learn_in6_addr(m, mi, ir6->network, ir6->netbits, false);
1353  }
1354  }
1355  gc_free(&gc);
1356 }
1357 
1358 /*
1359  * Given an instance (new_mi), delete all other instances which use the
1360  * same common name.
1361  */
1362 static void
1364 {
1365  if (new_mi)
1366  {
1367  const char *new_cn = tls_common_name(new_mi->context.c2.tls_multi, true);
1368  if (new_cn)
1369  {
1370  struct hash_iterator hi;
1371  struct hash_element *he;
1372  int count = 0;
1373 
1374  hash_iterator_init(m->iter, &hi);
1375  while ((he = hash_iterator_next(&hi)))
1376  {
1377  struct multi_instance *mi = (struct multi_instance *) he->value;
1378  if (mi != new_mi && !mi->halt)
1379  {
1380  const char *cn = tls_common_name(mi->context.c2.tls_multi, true);
1381  if (cn && !strcmp(cn, new_cn))
1382  {
1383  mi->did_iter = false;
1384  multi_close_instance(m, mi, false);
1386  ++count;
1387  }
1388  }
1389  }
1390  hash_iterator_free(&hi);
1391 
1392  if (count)
1393  {
1394  msg(D_MULTI_LOW, "MULTI: new connection by client '%s' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.", new_cn);
1395  }
1396  }
1397  }
1398 }
1399 
1400 static void
1402 {
1403 
1404  struct gc_arena gc = gc_new();
1405  struct hash_iterator hi;
1406  struct hash_element *he;
1407 
1408  dmsg(D_MULTI_DEBUG, "MULTI: Checking stale routes");
1410  while ((he = hash_iterator_next(&hi)) != NULL)
1411  {
1412  struct multi_route *r = (struct multi_route *) he->value;
1413  if (multi_route_defined(m, r) && difftime(now, r->last_reference) >= m->top.options.stale_routes_ageing_time)
1414  {
1415  dmsg(D_MULTI_DEBUG, "MULTI: Deleting stale route for address '%s'",
1416  mroute_addr_print(&r->addr, &gc));
1417  learn_address_script(m, NULL, "delete", &r->addr);
1418  multi_route_del(r);
1420  }
1421  }
1422  hash_iterator_free(&hi);
1423  gc_free(&gc);
1424 }
1425 
1426 /*
1427  * Ensure that endpoint to be pushed to client
1428  * complies with --ifconfig-push-constraint directive.
1429  */
1430 static bool
1432 {
1433  const struct options *o = &c->options;
1435  {
1437  }
1438  else
1439  {
1440  return true;
1441  }
1442 }
1443 
1444 /*
1445  * Select a virtual address for a new client instance.
1446  * Use an --ifconfig-push directive, if given (static IP).
1447  * Otherwise use an --ifconfig-pool address (dynamic IP).
1448  */
1449 static void
1451 {
1452  struct gc_arena gc = gc_new();
1453 
1454  /*
1455  * If ifconfig addresses were set by dynamic config file,
1456  * release pool addresses, otherwise keep them.
1457  */
1459  {
1460  /* ifconfig addresses were set statically,
1461  * release dynamic allocation */
1462  if (mi->vaddr_handle >= 0)
1463  {
1465  mi->vaddr_handle = -1;
1466  }
1467 
1468  mi->context.c2.push_ifconfig_defined = true;
1472 
1473  /* the current implementation does not allow "static IPv4, pool IPv6",
1474  * (see below) so issue a warning if that happens - don't break the
1475  * session, though, as we don't even know if this client WANTS IPv6
1476  */
1479  {
1480  msg( M_INFO, "MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." );
1481  }
1482  }
1483  else if (m->ifconfig_pool && mi->vaddr_handle < 0) /* otherwise, choose a pool address */
1484  {
1485  in_addr_t local = 0, remote = 0;
1486  struct in6_addr remote_ipv6;
1487  const char *cn = NULL;
1488 
1489  if (!mi->context.options.duplicate_cn)
1490  {
1491  cn = tls_common_name(mi->context.c2.tls_multi, true);
1492  }
1493 
1494  CLEAR(remote_ipv6);
1495  mi->vaddr_handle = ifconfig_pool_acquire(m->ifconfig_pool, &local, &remote, &remote_ipv6, cn);
1496  if (mi->vaddr_handle >= 0)
1497  {
1498  const int tunnel_type = TUNNEL_TYPE(mi->context.c1.tuntap);
1499  const int tunnel_topology = TUNNEL_TOPOLOGY(mi->context.c1.tuntap);
1500 
1501  msg( M_INFO, "MULTI_sva: pool returned IPv4=%s, IPv6=%s",
1503  ? print_in_addr_t(remote, 0, &gc)
1504  : "(Not enabled)"),
1506  ? print_in6_addr( remote_ipv6, 0, &gc )
1507  : "(Not enabled)") );
1508 
1510  {
1511  /* set push_ifconfig_remote_netmask from pool ifconfig address(es) */
1512  mi->context.c2.push_ifconfig_local = remote;
1513  if (tunnel_type == DEV_TYPE_TAP || (tunnel_type == DEV_TYPE_TUN && tunnel_topology == TOP_SUBNET))
1514  {
1517  {
1519  }
1520  }
1521  else if (tunnel_type == DEV_TYPE_TUN)
1522  {
1523  if (tunnel_topology == TOP_P2P)
1524  {
1526  }
1527  else if (tunnel_topology == TOP_NET30)
1528  {
1530  }
1531  }
1532 
1534  {
1535  mi->context.c2.push_ifconfig_defined = true;
1536  }
1537  else
1538  {
1540  "MULTI: no --ifconfig-pool netmask parameter is available to push to %s",
1541  multi_instance_string(mi, false, &gc));
1542  }
1543  }
1544 
1546  {
1547  mi->context.c2.push_ifconfig_ipv6_local = remote_ipv6;
1549  mi->context.c1.tuntap->local_ipv6;
1553  }
1554  }
1555  else
1556  {
1557  msg(D_MULTI_ERRORS, "MULTI: no free --ifconfig-pool addresses are available");
1558  }
1559  }
1560 
1561  /* IPv6 push_ifconfig is a bit problematic - since IPv6 shares the
1562  * pool handling with IPv4, the combination "static IPv4, dynamic IPv6"
1563  * will fail (because no pool will be allocated in this case).
1564  * OTOH, this doesn't make too much sense in reality - and the other
1565  * way round ("dynamic IPv4, static IPv6") or "both static" makes sense
1566  * -> and so it's implemented right now
1567  */
1569  {
1577 
1578  msg( M_INFO, "MULTI_sva: push_ifconfig_ipv6 %s/%d",
1581  }
1582 
1583  gc_free(&gc);
1584 }
1585 
1586 /*
1587  * Set virtual address environmental variables.
1588  */
1589 static void
1591 {
1592  setenv_del(mi->context.c2.es, "ifconfig_pool_local_ip");
1593  setenv_del(mi->context.c2.es, "ifconfig_pool_remote_ip");
1594  setenv_del(mi->context.c2.es, "ifconfig_pool_netmask");
1595 
1597  {
1598  const int tunnel_type = TUNNEL_TYPE(mi->context.c1.tuntap);
1599  const int tunnel_topology = TUNNEL_TOPOLOGY(mi->context.c1.tuntap);
1600 
1602  "ifconfig_pool_remote_ip",
1605 
1606  if (tunnel_type == DEV_TYPE_TAP || (tunnel_type == DEV_TYPE_TUN && tunnel_topology == TOP_SUBNET))
1607  {
1609  "ifconfig_pool_netmask",
1612  }
1613  else if (tunnel_type == DEV_TYPE_TUN)
1614  {
1616  "ifconfig_pool_local_ip",
1619  }
1620  }
1621 
1622  setenv_del(mi->context.c2.es, "ifconfig_pool_local_ip6");
1623  setenv_del(mi->context.c2.es, "ifconfig_pool_remote_ip6");
1624  setenv_del(mi->context.c2.es, "ifconfig_pool_ip6_netbits");
1625 
1627  {
1629  "ifconfig_pool_remote",
1633  "ifconfig_pool_local",
1636  setenv_int(mi->context.c2.es,
1637  "ifconfig_pool_ip6_netbits",
1639  }
1640 }
1641 
1642 /*
1643  * Called after client-connect script is called
1644  */
1645 static void
1647  struct multi_instance *mi,
1648  const char *dc_file,
1649  unsigned int *option_types_found)
1650 {
1651  /* Did script generate a dynamic config file? */
1652  if (platform_test_file(dc_file))
1653  {
1655  dc_file,
1658  option_types_found,
1659  mi->context.c2.es);
1660 
1661  /*
1662  * If the --client-connect script generates a config file
1663  * with an --ifconfig-push directive, it will override any
1664  * --ifconfig-push directive from the --client-config-dir
1665  * directory or any --ifconfig-pool dynamic address.
1666  */
1669  }
1670 }
1671 
1672 #ifdef ENABLE_PLUGIN
1673 
1674 /*
1675  * Called after client-connect plug-in is called
1676  */
1677 static void
1679  struct multi_instance *mi,
1680  const struct plugin_return *pr,
1681  unsigned int *option_types_found)
1682 {
1683  struct plugin_return config;
1684 
1685  plugin_return_get_column(pr, &config, "config");
1686 
1687  /* Did script generate a dynamic config file? */
1688  if (plugin_return_defined(&config))
1689  {
1690  int i;
1691  for (i = 0; i < config.n; ++i)
1692  {
1693  if (config.list[i] && config.list[i]->value)
1694  {
1696  config.list[i]->value,
1699  option_types_found,
1700  mi->context.c2.es);
1701  }
1702  }
1703 
1704  /*
1705  * If the --client-connect script generates a config file
1706  * with an --ifconfig-push directive, it will override any
1707  * --ifconfig-push directive from the --client-config-dir
1708  * directory or any --ifconfig-pool dynamic address.
1709  */
1712  }
1713 }
1714 
1715 #endif /* ifdef ENABLE_PLUGIN */
1716 
1717 
1718 /*
1719  * Called to load management-derived client-connect config
1720  */
1723  struct multi_instance *mi,
1724  bool deferred,
1725  unsigned int *option_types_found)
1726 {
1727  /* We never return CC_RET_DEFERRED */
1728  ASSERT(!deferred);
1730 #ifdef ENABLE_MANAGEMENT
1731  if (mi->cc_config)
1732  {
1733  struct buffer_entry *be;
1734  for (be = mi->cc_config->head; be != NULL; be = be->next)
1735  {
1736  const char *opt = BSTR(&be->buf);
1738  opt,
1741  option_types_found,
1742  mi->context.c2.es);
1743  }
1744 
1745  /*
1746  * If the --client-connect script generates a config file
1747  * with an --ifconfig-push directive, it will override any
1748  * --ifconfig-push directive from the --client-config-dir
1749  * directory or any --ifconfig-pool dynamic address.
1750  */
1753 
1754  ret = CC_RET_SUCCEEDED;
1755  }
1756 #endif /* ifdef ENABLE_MANAGEMENT */
1757  return ret;
1758 }
1759 
1760 static void
1762  struct multi_instance *mi)
1763 {
1764  struct gc_arena gc = gc_new();
1765 
1766  /* setenv incoming cert common name for script */
1767  setenv_str(mi->context.c2.es, "common_name", tls_common_name(mi->context.c2.tls_multi, true));
1768 
1769  /* setenv client real IP address */
1771 
1772  /* setenv client virtual IP address */
1774 
1775  /* setenv connection time */
1776  {
1777  const char *created_ascii = time_string(mi->created, 0, false, &gc);
1778  setenv_str(mi->context.c2.es, "time_ascii", created_ascii);
1779  setenv_long_long(mi->context.c2.es, "time_unix", mi->created);
1780  }
1781 
1782  gc_free(&gc);
1783 }
1784 
1791 static bool
1793 {
1794  struct tls_multi *tls_multi = c->c2.tls_multi;
1795  const char *const peer_info = tls_multi->peer_info;
1796  struct options *o = &c->options;
1797 
1798 
1799  unsigned int proto = extract_iv_proto(peer_info);
1800  if (proto & IV_PROTO_DATA_V2)
1801  {
1802  tls_multi->use_peer_id = true;
1803  o->use_peer_id = true;
1804  }
1805  else if (dco_enabled(o))
1806  {
1807  msg(M_INFO, "Client does not support DATA_V2. Data channel offloaing "
1808  "requires DATA_V2. Dropping client.");
1809  auth_set_client_reason(tls_multi, "Data channel negotiation "
1810  "failed (missing DATA_V2)");
1811  return false;
1812  }
1813 
1814  /* Print a warning if we detect the client being in P2P mode and will
1815  * not accept our pushed ciphers */
1816  if (proto & IV_PROTO_NCP_P2P)
1817  {
1818  msg(M_WARN, "Note: peer reports running in P2P mode (no --pull/--client"
1819  "option). It will not negotiate ciphers with this server. "
1820  "Expect this connection to fail.");
1821  }
1822 
1823  if (proto & IV_PROTO_REQUEST_PUSH)
1824  {
1825  c->c2.push_request_received = true;
1826  }
1827 
1828 #ifdef HAVE_EXPORT_KEYING_MATERIAL
1829  if (proto & IV_PROTO_TLS_KEY_EXPORT)
1830  {
1832  }
1833  else if (o->force_key_material_export)
1834  {
1835  msg(M_INFO, "PUSH: client does not support TLS Keying Material "
1836  "Exporters but --force-tls-key-material-export is enabled.");
1837  auth_set_client_reason(tls_multi, "Client incompatible with this "
1838  "server. Keying Material Exporters (RFC 5705) "
1839  "support missing. Upgrade to a client that "
1840  "supports this feature (OpenVPN 2.6.0+).");
1841  return false;
1842  }
1843  if (proto & IV_PROTO_DYN_TLS_CRYPT)
1844  {
1846  }
1847 #endif
1848 
1849  if (proto & IV_PROTO_CC_EXIT_NOTIFY)
1850  {
1852  }
1853 
1854  /* Select cipher if client supports Negotiable Crypto Parameters */
1855 
1856  /* if we have already created our key, we cannot *change* our own
1857  * cipher -> so log the fact and push the "what we have now" cipher
1858  * (so the client is always told what we expect it to use)
1859  */
1861  {
1862  msg(M_INFO, "PUSH: client wants to negotiate cipher (NCP), but "
1863  "server has already generated data channel keys, "
1864  "re-sending previously negotiated cipher '%s'",
1865  o->ciphername );
1866  return true;
1867  }
1868 
1869  /*
1870  * Push the first cipher from --data-ciphers to the client that
1871  * the client announces to be supporting.
1872  */
1873  char *push_cipher = ncp_get_best_cipher(o->ncp_ciphers, peer_info,
1875  &o->gc);
1876 
1877  if (push_cipher)
1878  {
1879  o->ciphername = push_cipher;
1880  return true;
1881  }
1882 
1883  /* NCP cipher negotiation failed. Try to figure out why exactly it
1884  * failed and give good error messages and potentially do a fallback
1885  * for non NCP clients */
1886  struct gc_arena gc = gc_new();
1887  bool ret = false;
1888 
1889  const char *peer_ciphers = tls_peer_ncp_list(peer_info, &gc);
1890  /* If we are in a situation where we know the client ciphers, there is no
1891  * reason to fall back to a cipher that will not be accepted by the other
1892  * side, in this situation we fail the auth*/
1893  if (strlen(peer_ciphers) > 0)
1894  {
1895  msg(M_INFO, "PUSH: No common cipher between server and client. "
1896  "Server data-ciphers: '%s', client supported ciphers '%s'",
1897  o->ncp_ciphers, peer_ciphers);
1898  }
1899  else if (tls_multi->remote_ciphername)
1900  {
1901  msg(M_INFO, "PUSH: No common cipher between server and client. "
1902  "Server data-ciphers: '%s', client supports cipher '%s'",
1904  }
1905  else
1906  {
1907  msg(M_INFO, "PUSH: No NCP or OCC cipher data received from peer.");
1908 
1910  {
1911  msg(M_INFO, "Using data channel cipher '%s' since "
1912  "--data-ciphers-fallback is set.", o->ciphername);
1913  ret = true;
1914  }
1915  else
1916  {
1917  msg(M_INFO, "Use --data-ciphers-fallback with the cipher the "
1918  "client is using if you want to allow the client to connect");
1919  }
1920  }
1921  if (!ret)
1922  {
1923  auth_set_client_reason(tls_multi, "Data channel cipher negotiation "
1924  "failed (no shared cipher)");
1925  }
1926 
1927  gc_free(&gc);
1928  return ret;
1929 }
1930 
1935 static void
1937 {
1939  if (!ccs->deferred_ret_file)
1940  {
1941  return;
1942  }
1943 
1944  setenv_del(mi->context.c2.es, "client_connect_deferred_file");
1946  {
1947  msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s",
1948  ccs->deferred_ret_file);
1949  }
1950  free(ccs->deferred_ret_file);
1951  ccs->deferred_ret_file = NULL;
1952 }
1953 
1961 static bool
1963 {
1965  struct gc_arena gc = gc_new();
1966  const char *fn;
1967 
1968  /* Delete file if it already exists */
1970 
1971  fn = platform_create_temp_file(mi->context.options.tmp_dir, "ccr", &gc);
1972  if (!fn)
1973  {
1974  gc_free(&gc);
1975  return false;
1976  }
1977  ccs->deferred_ret_file = string_alloc(fn, NULL);
1978 
1979  setenv_str(mi->context.c2.es, "client_connect_deferred_file",
1980  ccs->deferred_ret_file);
1981 
1982  gc_free(&gc);
1983  return true;
1984 }
1985 
1994 static enum client_connect_return
1996 {
1998  FILE *fp = fopen(ccs->deferred_ret_file, "r");
1999  if (!fp)
2000  {
2001  return CC_RET_SKIPPED;
2002  }
2003 
2005  const int c = fgetc(fp);
2006  switch (c)
2007  {
2008  case '0':
2009  ret = CC_RET_FAILED;
2010  break;
2011 
2012  case '1':
2013  ret = CC_RET_SUCCEEDED;
2014  break;
2015 
2016  case '2':
2017  ret = CC_RET_DEFERRED;
2018  break;
2019 
2020  case EOF:
2021  if (feof(fp))
2022  {
2023  ret = CC_RET_SKIPPED;
2024  break;
2025  }
2026 
2027  /* Not EOF but other error -> fall through to error state */
2028  default:
2029  /* We received an unknown/unexpected value. Assume failure. */
2030  msg(M_WARN, "WARNING: Unknown/unexpected value in deferred"
2031  "client-connect resultfile");
2032  ret = CC_RET_FAILED;
2033  }
2034  fclose(fp);
2035 
2036  return ret;
2037 }
2038 
2044 static void
2046 {
2048  if (ccs->config_file)
2049  {
2050  setenv_del(mi->context.c2.es, "client_connect_config_file");
2051  if (!platform_unlink(ccs->config_file))
2052  {
2053  msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s",
2054  ccs->config_file);
2055  }
2056  free(ccs->config_file);
2057  ccs->config_file = NULL;
2058  }
2059 }
2060 
2068 static bool
2070 {
2072  struct gc_arena gc = gc_new();
2073  const char *fn;
2074 
2075  if (ccs->config_file)
2076  {
2078  }
2079 
2080  fn = platform_create_temp_file(mi->context.options.tmp_dir, "cc", &gc);
2081  if (!fn)
2082  {
2083  gc_free(&gc);
2084  return false;
2085  }
2086  ccs->config_file = string_alloc(fn, NULL);
2087 
2088  setenv_str(mi->context.c2.es, "client_connect_config_file",
2089  ccs->config_file);
2090 
2091  gc_free(&gc);
2092  return true;
2093 }
2094 
2095 static enum client_connect_return
2097  struct multi_instance *mi,
2098  bool deferred,
2099  unsigned int *option_types_found)
2100 {
2102 #ifdef ENABLE_PLUGIN
2103  ASSERT(m);
2104  ASSERT(mi);
2105  ASSERT(option_types_found);
2107 
2108  /* deprecated callback, use a file for passing back return info */
2110  {
2111  struct argv argv = argv_new();
2112  int call;
2113 
2114  if (!deferred)
2115  {
2117  if (!ccs_gen_config_file(mi)
2118  || !ccs_gen_deferred_ret_file(mi))
2119  {
2120  ret = CC_RET_FAILED;
2121  goto cleanup;
2122  }
2123  }
2124  else
2125  {
2127  /* the initial call should have created these files */
2128  ASSERT(ccs->config_file);
2129  ASSERT(ccs->deferred_ret_file);
2130  }
2131 
2132  argv_printf(&argv, "%s", ccs->config_file);
2133  int plug_ret = plugin_call(mi->context.plugins, call,
2134  &argv, NULL, mi->context.c2.es);
2135  if (plug_ret == OPENVPN_PLUGIN_FUNC_SUCCESS)
2136  {
2137  ret = CC_RET_SUCCEEDED;
2138  }
2139  else if (plug_ret == OPENVPN_PLUGIN_FUNC_DEFERRED)
2140  {
2141  ret = CC_RET_DEFERRED;
2147  }
2148  else
2149  {
2150  msg(M_WARN, "WARNING: client-connect plugin call failed");
2151  ret = CC_RET_FAILED;
2152  }
2153 
2154 
2160  int file_ret = ccs_test_deferred_ret_file(mi);
2161 
2162  if (file_ret == CC_RET_FAILED)
2163  {
2164  ret = CC_RET_FAILED;
2165  }
2166  else if (ret == CC_RET_SUCCEEDED && file_ret == CC_RET_DEFERRED)
2167  {
2168  ret = CC_RET_DEFERRED;
2169  }
2170 
2171  /* if we still think we have succeeded, do postprocessing */
2172  if (ret == CC_RET_SUCCEEDED)
2173  {
2175  option_types_found);
2176  }
2177 cleanup:
2178  argv_free(&argv);
2179 
2180  if (ret != CC_RET_DEFERRED)
2181  {
2184  }
2185  }
2186 #endif /* ifdef ENABLE_PLUGIN */
2187  return ret;
2188 }
2189 
2190 static enum client_connect_return
2192  struct multi_instance *mi,
2193  bool deferred,
2194  unsigned int *option_types_found)
2195 {
2197 #ifdef ENABLE_PLUGIN
2198  ASSERT(m);
2199  ASSERT(mi);
2200  ASSERT(option_types_found);
2201 
2202  int call = deferred ? OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2 :
2204  /* V2 callback, use a plugin_return struct for passing back return info */
2205  if (plugin_defined(mi->context.plugins, call))
2206  {
2207  struct plugin_return pr;
2208 
2209  plugin_return_init(&pr);
2210 
2211  int plug_ret = plugin_call(mi->context.plugins, call,
2212  NULL, &pr, mi->context.c2.es);
2213  if (plug_ret == OPENVPN_PLUGIN_FUNC_SUCCESS)
2214  {
2215  multi_client_connect_post_plugin(m, mi, &pr, option_types_found);
2216  ret = CC_RET_SUCCEEDED;
2217  }
2218  else if (plug_ret == OPENVPN_PLUGIN_FUNC_DEFERRED)
2219  {
2220  ret = CC_RET_DEFERRED;
2221  if (!(plugin_defined(mi->context.plugins,
2223  {
2224  msg(M_WARN, "A plugin that defers from the "
2225  "OPENVPN_PLUGIN_CLIENT_CONNECT_V2 call must also "
2226  "declare support for "
2227  "OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2");
2228  ret = CC_RET_FAILED;
2229  }
2230  }
2231  else
2232  {
2233  msg(M_WARN, "WARNING: client-connect-v2 plugin call failed");
2234  ret = CC_RET_FAILED;
2235  }
2236 
2237 
2238  plugin_return_free(&pr);
2239  }
2240 #endif /* ifdef ENABLE_PLUGIN */
2241  return ret;
2242 }
2243 
2244 static enum client_connect_return
2246  struct multi_instance *mi,
2247  unsigned int *option_types_found)
2248 {
2249  ASSERT(mi);
2250  ASSERT(option_types_found);
2253 
2254  ret = ccs_test_deferred_ret_file(mi);
2255 
2256  if (ret == CC_RET_SKIPPED)
2257  {
2258  /*
2259  * Skipped and deferred are equivalent in this context.
2260  * skipped means that the called program has not yet
2261  * written a return status implicitly needing more time
2262  * while deferred is the explicit notification that it
2263  * needs more time
2264  */
2265  ret = CC_RET_DEFERRED;
2266  }
2267 
2268  if (ret == CC_RET_SUCCEEDED)
2269  {
2274  }
2275  if (ret == CC_RET_FAILED)
2276  {
2277  msg(M_INFO, "MULTI: deferred --client-connect script returned CC_RET_FAILED");
2280  }
2281  return ret;
2282 }
2283 
2287 static enum client_connect_return
2289  struct multi_instance *mi,
2290  bool deferred,
2291  unsigned int *option_types_found)
2292 {
2293  if (deferred)
2294  {
2296  }
2297  ASSERT(m);
2298  ASSERT(mi);
2299 
2302 
2304  {
2305  struct argv argv = argv_new();
2306  struct gc_arena gc = gc_new();
2307 
2308  setenv_str(mi->context.c2.es, "script_type", "client-connect");
2309 
2310  if (!ccs_gen_config_file(mi)
2311  || !ccs_gen_deferred_ret_file(mi))
2312  {
2313  ret = CC_RET_FAILED;
2314  goto cleanup;
2315  }
2316 
2318  argv_printf_cat(&argv, "%s", ccs->config_file);
2319 
2320  if (openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-connect"))
2321  {
2323  {
2324  ret = CC_RET_DEFERRED;
2325  }
2326  else
2327  {
2329  option_types_found);
2330  ret = CC_RET_SUCCEEDED;
2331  }
2332  }
2333  else
2334  {
2335  ret = CC_RET_FAILED;
2336  }
2337 cleanup:
2338  if (ret != CC_RET_DEFERRED)
2339  {
2342  }
2343  argv_free(&argv);
2344  gc_free(&gc);
2345  }
2346  return ret;
2347 }
2348 
2349 static bool
2351  struct multi_instance *mi,
2352  struct gc_arena *gc)
2353 {
2354  if (!dco_enabled(&mi->context.options))
2355  {
2356  /* DCO not enabled, nothing to do, return sucess */
2357  return true;
2358  }
2359  int ret = dco_multi_add_new_peer(m, mi);
2360  if (ret < 0)
2361  {
2362  msg(D_DCO, "Cannot add peer to DCO for %s: %s (%d)",
2363  multi_instance_string(mi, false, gc), strerror(-ret), ret);
2364  return false;
2365  }
2366 
2368  {
2369  ret = dco_set_peer(&mi->context.c1.tuntap->dco,
2373  mi->context.c2.frame.mss_fix);
2374  if (ret < 0)
2375  {
2376  msg(D_DCO, "Cannot set DCO peer parameters for %s (id=%u): %s",
2377  multi_instance_string(mi, false, gc),
2378  mi->context.c2.tls_multi->dco_peer_id, strerror(-ret));
2379  return false;
2380  }
2381  }
2382  return true;
2383 }
2384 
2388 static bool
2390 {
2391  struct frame *frame_fragment = NULL;
2392 #ifdef ENABLE_FRAGMENT
2393  if (c->options.ce.fragment)
2394  {
2395  frame_fragment = &c->c2.frame_fragment;
2396  }
2397 #endif
2398  struct tls_session *session = &c->c2.tls_multi->session[TM_ACTIVE];
2400  &c->c2.frame, frame_fragment,
2402  {
2403  msg(D_TLS_ERRORS, "TLS Error: initializing data channel failed");
2404  register_signal(c->sig, SIGUSR1, "process-push-msg-failed");
2405  return false;
2406  }
2407 
2408  return true;
2409 }
2410 
2411 static void
2413  struct multi_instance *mi,
2414  const unsigned int option_types_found)
2415 {
2416  ASSERT(m);
2417  ASSERT(mi);
2418 
2419  struct gc_arena gc = gc_new();
2420  /*
2421  * Process sourced options.
2422  */
2423  do_deferred_options(&mi->context, option_types_found);
2424 
2425  /*
2426  * make sure we got ifconfig settings from somewhere
2427  */
2428  if (!mi->context.c2.push_ifconfig_defined)
2429  {
2430  msg(D_MULTI_ERRORS, "MULTI: no dynamic or static remote"
2431  "--ifconfig address is available for %s",
2432  multi_instance_string(mi, false, &gc));
2433  }
2434 
2435  /*
2436  * make sure that ifconfig settings comply with constraints
2437  */
2439  {
2440  const char *ifconfig_constraint_network =
2442  const char *ifconfig_constraint_netmask =
2444 
2445  /* JYFIXME -- this should cause the connection to fail */
2446  msg(D_MULTI_ERRORS, "MULTI ERROR: primary virtual IP for %s (%s)"
2447  "violates tunnel network/netmask constraint (%s/%s)",
2448  multi_instance_string(mi, false, &gc),
2450  ifconfig_constraint_network, ifconfig_constraint_netmask);
2451  }
2452 
2453  /*
2454  * For routed tunnels, set up internal route to endpoint
2455  * plus add all iroute routes.
2456  */
2458  {
2460  {
2461  multi_learn_in_addr_t(m, mi,
2463  -1, true);
2464  msg(D_MULTI_LOW, "MULTI: primary virtual IP for %s: %s",
2465  multi_instance_string(mi, false, &gc),
2467  }
2468 
2470  {
2471  multi_learn_in6_addr(m, mi,
2473  -1, true);
2474  /* TODO: find out where addresses are "unlearned"!! */
2475  const char *ifconfig_local_ipv6 =
2477  msg(D_MULTI_LOW, "MULTI: primary virtual IPv6 for %s: %s",
2478  multi_instance_string(mi, false, &gc),
2479  ifconfig_local_ipv6);
2480  }
2481 
2482  /* add routes locally, pointing to new client, if
2483  * --iroute options have been specified */
2484  multi_add_iroutes(m, mi);
2485 
2486  /*
2487  * iroutes represent subnets which are "owned" by a particular
2488  * client. Therefore, do not actually push a route to a client
2489  * if it matches one of the client's iroutes.
2490  */
2492  }
2493  else if (mi->context.options.iroutes)
2494  {
2495  msg(D_MULTI_ERRORS, "MULTI: --iroute options rejected for %s -- iroute"
2496  "only works with tun-style tunnels",
2497  multi_instance_string(mi, false, &gc));
2498  }
2499 
2500  /* set our client's VPN endpoint for status reporting purposes */
2503 
2504  /* set context-level authentication flag */
2506 
2507  /* authentication complete, calculate dynamic client specific options */
2509  {
2511  }
2512  /* only continue if setting protocol options worked */
2513  else if (!multi_client_setup_dco_initial(m, mi, &gc))
2514  {
2516  }
2517  /* Generate data channel keys only if setting protocol options
2518  * and DCO initial setup has not failed */
2519  else if (!multi_client_generate_tls_keys(&mi->context))
2520  {
2522  }
2523 
2524  /* send push reply if ready */
2526  {
2528  }
2529  gc_free(&gc);
2530 }
2531 
2532 static void
2534  struct multi_instance *mi)
2535 {
2536  ASSERT(mi->context.c1.tuntap);
2537  /*
2538  * lock down the common name and cert hashes so they can't change
2539  * during future TLS renegotiations
2540  */
2543 
2544  /* generate a msg() prefix for this client instance */
2545  generate_prefix(mi);
2546 
2547  /* delete instances of previous clients with same common-name */
2548  if (!mi->context.options.duplicate_cn)
2549  {
2550  multi_delete_dup(m, mi);
2551  }
2552 
2553  /* reset pool handle to null */
2554  mi->vaddr_handle = -1;
2555 
2556  /* do --client-connect setenvs */
2558 
2560 }
2561 
2568 static enum client_connect_return
2570  struct multi_instance *mi,
2571  bool deferred,
2572  unsigned int *option_types_found)
2573 {
2574 #ifdef USE_COMP
2575  struct options *o = &mi->context.options;
2576  const char *const peer_info = mi->context.c2.tls_multi->peer_info;
2577 
2579  {
2580  if (peer_info && strstr(peer_info, "IV_COMP_STUBv2=1"))
2581  {
2582  push_option(o, "compress stub-v2", M_USAGE);
2583  }
2584  else
2585  {
2586  /* Client is old and does not support STUBv2 but since it
2587  * announced comp-lzo via OCC we assume it uses comp-lzo, so
2588  * switch to that and push the uncompressed variant. */
2589  push_option(o, "comp-lzo no", M_USAGE);
2590  o->comp.alg = COMP_ALG_STUB;
2591  *option_types_found |= OPT_P_COMP;
2592  }
2593  }
2594 #endif
2595  return CC_RET_SUCCEEDED;
2596 }
2597 
2602 static enum client_connect_return
2604  struct multi_instance *mi,
2605  bool deferred,
2606  unsigned int *option_types_found)
2607 {
2608  /* Since we never return a CC_RET_DEFERRED, this indicates a serious
2609  * problem */
2610  ASSERT(!deferred);
2613  {
2614  struct gc_arena gc = gc_new();
2615  const char *ccd_file = NULL;
2616 
2617  const char *ccd_client =
2619  tls_common_name(mi->context.c2.tls_multi, false),
2620  &gc);
2621 
2622  const char *ccd_default =
2624  CCD_DEFAULT, &gc);
2625 
2626 
2627  /* try common-name file */
2628  if (platform_test_file(ccd_client))
2629  {
2630  ccd_file = ccd_client;
2631  }
2632  /* try default file */
2633  else if (platform_test_file(ccd_default))
2634  {
2635  ccd_file = ccd_default;
2636  }
2637 
2638  if (ccd_file)
2639  {
2641  ccd_file,
2644  option_types_found,
2645  mi->context.c2.es);
2646  /*
2647  * Select a virtual address from either --ifconfig-push in
2648  * --client-config-dir file or --ifconfig-pool.
2649  */
2651 
2653 
2654  ret = CC_RET_SUCCEEDED;
2655  }
2656  gc_free(&gc);
2657  }
2658  return ret;
2659 }
2660 
2662  (struct multi_context *m, struct multi_instance *mi,
2663  bool from_deferred, unsigned int *option_types_found);
2664 
2672  NULL,
2673 };
2674 
2675 /*
2676  * Called as soon as the SSL/TLS connection is authenticated.
2677  *
2678  * Will collect the client specific configuration from the different
2679  * sources like ccd files, connect plugins and management interface.
2680  *
2681  * This method starts with cas_context CAS_PENDING and will move the
2682  * state machine to either CAS_SUCCEEDED on success or
2683  * CAS_FAILED/CAS_PARTIAL on failure.
2684  *
2685  * Instance-specific directives to be processed (CLIENT_CONNECT_OPT_MASK)
2686  * include:
2687  *
2688  * iroute start-ip end-ip
2689  * ifconfig-push local remote-netmask
2690  * push
2691  *
2692  *
2693  */
2694 static void
2696 {
2697  /* We are only called for the CAS_PENDING_x states, so we
2698  * can ignore other states here */
2699  bool from_deferred = (mi->context.c2.tls_multi->multi_state != CAS_PENDING);
2700 
2701  int *cur_handler_index = &mi->client_connect_defer_state.cur_handler_index;
2702  unsigned int *option_types_found =
2704 
2705  /* We are called for the first time */
2706  if (!from_deferred)
2707  {
2708  *cur_handler_index = 0;
2709  *option_types_found = 0;
2710  /* Initially we have no handler that has returned a result */
2712 
2714  }
2715 
2716  bool cc_succeeded = true;
2717 
2718  while (cc_succeeded
2719  && client_connect_handlers[*cur_handler_index] != NULL)
2720  {
2721  enum client_connect_return ret;
2722  ret = client_connect_handlers[*cur_handler_index](m, mi, from_deferred,
2723  option_types_found);
2724 
2725  from_deferred = false;
2726 
2727  switch (ret)
2728  {
2729  case CC_RET_SUCCEEDED:
2730  /*
2731  * Remember that we already had at least one handler
2732  * returning a result should we go to into deferred state
2733  */
2734  mi->context.c2.tls_multi->multi_state = CAS_PENDING_DEFERRED_PARTIAL;
2735  break;
2736 
2737  case CC_RET_SKIPPED:
2738  /*
2739  * Move on with the next handler without modifying any
2740  * other state
2741  */
2742  break;
2743 
2744  case CC_RET_DEFERRED:
2745  /*
2746  * we already set multi_status to DEFERRED_RESULT or
2747  * DEFERRED_NO_RESULT. We just return
2748  * from the function as having multi_status
2749  */
2750  return;
2751 
2752  case CC_RET_FAILED:
2753  /*
2754  * One handler failed. We abort the chain and set the final
2755  * result to failed
2756  */
2757  cc_succeeded = false;
2758  break;
2759 
2760  default:
2761  ASSERT(0);
2762  }
2763 
2764  /*
2765  * Check for "disable" directive in client-config-dir file
2766  * or config file generated by --client-connect script.
2767  */
2768  if (mi->context.options.disable)
2769  {
2770  msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to "
2771  "'disable' directive");
2772  cc_succeeded = false;
2773  }
2774 
2775  (*cur_handler_index)++;
2776  }
2777 
2778  /* Check if we have forbidding options in the current mode */
2779  if (dco_enabled(&mi->context.options)
2781  {
2782  msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to incompatible DCO options");
2783  cc_succeeded = false;
2784  }
2785 
2787  {
2788  msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to invalid compression options");
2789  cc_succeeded = false;
2790  }
2791 
2792  if (cc_succeeded)
2793  {
2794  multi_client_connect_late_setup(m, mi, *option_types_found);
2795  }
2796  else
2797  {
2798  /* run the disconnect script if we had a connect script that
2799  * did not fail */
2801  {
2803  }
2804 
2806  }
2807 
2808  /* increment number of current authenticated clients */
2809  ++m->n_clients;
2811  --mi->n_clients_delta;
2812 
2813 #ifdef ENABLE_MANAGEMENT
2814  if (management)
2815  {
2817  &mi->context.c2.mda_context, mi->context.c2.es);
2818  }
2819 #endif
2820 }
2821 
2822 #ifdef ENABLE_ASYNC_PUSH
2823 /*
2824  * Called when inotify event is fired, which happens when acf
2825  * or connect-status file is closed or deleted.
2826  * Continues authentication and sends push_reply
2827  * (or be deferred again by client-connect)
2828  */
2829 void
2830 multi_process_file_closed(struct multi_context *m, const unsigned int mpp_flags)
2831 {
2832  char buffer[INOTIFY_EVENT_BUFFER_SIZE];
2833  size_t buffer_i = 0;
2834  int r = read(m->top.c2.inotify_fd, buffer, INOTIFY_EVENT_BUFFER_SIZE);
2835 
2836  while (buffer_i < r)
2837  {
2838  /* parse inotify events */
2839  struct inotify_event *pevent = (struct inotify_event *) &buffer[buffer_i];
2840  size_t event_size = sizeof(struct inotify_event) + pevent->len;
2841  buffer_i += event_size;
2842 
2843  msg(D_MULTI_DEBUG, "MULTI: modified fd %d, mask %d", pevent->wd, pevent->mask);
2844 
2845  struct multi_instance *mi = hash_lookup(m->inotify_watchers, (void *) (unsigned long) pevent->wd);
2846 
2847  if (pevent->mask & IN_CLOSE_WRITE)
2848  {
2849  if (mi)
2850  {
2851  /* continue authentication, perform NCP negotiation and send push_reply */
2852  multi_process_post(m, mi, mpp_flags);
2853  }
2854  else
2855  {
2856  msg(D_MULTI_ERRORS, "MULTI: multi_instance not found!");
2857  }
2858  }
2859  else if (pevent->mask & IN_IGNORED)
2860  {
2861  /* this event is _always_ fired when watch is removed or file is deleted */
2862  if (mi)
2863  {
2864  hash_remove(m->inotify_watchers, (void *) (unsigned long) pevent->wd);
2865  mi->inotify_watch = -1;
2866  }
2867  }
2868  else
2869  {
2870  msg(D_MULTI_ERRORS, "MULTI: unknown mask %d", pevent->mask);
2871  }
2872  }
2873 }
2874 #endif /* ifdef ENABLE_ASYNC_PUSH */
2875 
2876 /*
2877  * Add a mbuf buffer to a particular
2878  * instance.
2879  */
2880 void
2882  struct multi_instance *mi,
2883  struct mbuf_buffer *mb)
2884 {
2885  if (multi_output_queue_ready(m, mi))
2886  {
2887  struct mbuf_item item;
2888  item.buffer = mb;
2889  item.instance = mi;
2890  mbuf_add_item(m->mbuf, &item);
2891  }
2892  else
2893  {
2894  msg(D_MULTI_DROPPED, "MULTI: packet dropped due to output saturation (multi_add_mbuf)");
2895  }
2896 }
2897 
2898 /*
2899  * Add a packet to a client instance output queue.
2900  */
2901 static inline void
2903  const struct buffer *buf,
2904  struct multi_instance *mi)
2905 {
2906  struct mbuf_buffer *mb;
2907 
2908  if (BLEN(buf) > 0)
2909  {
2910  mb = mbuf_alloc_buf(buf);
2911  mb->flags = MF_UNICAST;
2912  multi_add_mbuf(m, mi, mb);
2913  mbuf_free_buf(mb);
2914  }
2915 }
2916 
2917 /*
2918  * Broadcast a packet to all clients.
2919  */
2920 static void
2922  const struct buffer *buf,
2923  const struct multi_instance *sender_instance,
2924  const struct mroute_addr *sender_addr,
2925  uint16_t vid)
2926 {
2927  struct hash_iterator hi;
2928  struct hash_element *he;
2929  struct multi_instance *mi;
2930  struct mbuf_buffer *mb;
2931 
2932  if (BLEN(buf) > 0)
2933  {
2935 #ifdef MULTI_DEBUG_EVENT_LOOP
2936  printf("BCAST len=%d\n", BLEN(buf));
2937 #endif
2938  mb = mbuf_alloc_buf(buf);
2939  hash_iterator_init(m->iter, &hi);
2940 
2941  while ((he = hash_iterator_next(&hi)))
2942  {
2943  mi = (struct multi_instance *) he->value;
2944  if (mi != sender_instance && !mi->halt)
2945  {
2946  if (vid != 0 && vid != mi->context.options.vlan_pvid)
2947  {
2948  continue;
2949  }
2950  multi_add_mbuf(m, mi, mb);
2951  }
2952  }
2953 
2954  hash_iterator_free(&hi);
2955  mbuf_free_buf(mb);
2956  perf_pop();
2957  }
2958 }
2959 
2960 /*
2961  * Given a time delta, indicating that we wish to be
2962  * awoken by the scheduler at time now + delta, figure
2963  * a sigma parameter (in microseconds) that represents
2964  * a sort of fuzz factor around delta, so that we're
2965  * really telling the scheduler to wake us up any time
2966  * between now + delta - sigma and now + delta + sigma.
2967  *
2968  * The sigma parameter helps the scheduler to run more efficiently.
2969  * Sigma should be no larger than TV_WITHIN_SIGMA_MAX_USEC
2970  */
2971 static inline unsigned int
2972 compute_wakeup_sigma(const struct timeval *delta)
2973 {
2974  if (delta->tv_sec < 1)
2975  {
2976  /* if < 1 sec, fuzz = # of microseconds / 8 */
2977  return delta->tv_usec >> 3;
2978  }
2979  else
2980  {
2981  /* if < 10 minutes, fuzz = 13.1% of timeout */
2982  if (delta->tv_sec < 600)
2983  {
2984  return delta->tv_sec << 17;
2985  }
2986  else
2987  {
2988  return 120000000; /* if >= 10 minutes, fuzz = 2 minutes */
2989  }
2990  }
2991 }
2992 
2993 static void
2995 {
2996  /* calculate an absolute wakeup time */
2997  ASSERT(!openvpn_gettimeofday(&mi->wakeup, NULL));
2998  tv_add(&mi->wakeup, &mi->context.c2.timeval);
2999 
3000  /* tell scheduler to wake us up at some point in the future */
3002  (struct schedule_entry *) mi,
3003  &mi->wakeup,
3004  compute_wakeup_sigma(&mi->context.c2.timeval));
3005 }
3006 
3007 #if defined(ENABLE_ASYNC_PUSH)
3008 static void
3009 add_inotify_file_watch(struct multi_context *m, struct multi_instance *mi,
3010  int inotify_fd, const char *file)
3011 {
3012  /* watch acf file */
3013  long watch_descriptor = inotify_add_watch(inotify_fd, file,
3014  IN_CLOSE_WRITE | IN_ONESHOT);
3015  if (watch_descriptor >= 0)
3016  {
3017  if (mi->inotify_watch != -1)
3018  {
3019  hash_remove(m->inotify_watchers,
3020  (void *) (unsigned long)mi->inotify_watch);
3021  }
3022  hash_add(m->inotify_watchers, (const uintptr_t *)watch_descriptor,
3023  mi, true);
3024  mi->inotify_watch = watch_descriptor;
3025  }
3026  else
3027  {
3028  msg(M_NONFATAL | M_ERRNO, "MULTI: inotify_add_watch error");
3029  }
3030 }
3031 #endif /* if defined(ENABLE_ASYNC_PUSH) */
3032 
3033 /*
3034  * Figure instance-specific timers, convert
3035  * earliest to absolute time in mi->wakeup,
3036  * call scheduler with our future wakeup time.
3037  *
3038  * Also close context on signal.
3039  */
3040 bool
3041 multi_process_post(struct multi_context *m, struct multi_instance *mi, const unsigned int flags)
3042 {
3043  bool ret = true;
3044 
3045  if (!IS_SIG(&mi->context) && ((flags & MPP_PRE_SELECT) || ((flags & MPP_CONDITIONAL_PRE_SELECT) && !ANY_OUT(&mi->context))))
3046  {
3047 #if defined(ENABLE_ASYNC_PUSH)
3048  bool was_unauthenticated = true;
3049  struct key_state *ks = NULL;
3050  if (mi->context.c2.tls_multi)
3051  {
3053  was_unauthenticated = (ks->authenticated == KS_AUTH_FALSE);
3054  }
3055 #endif
3056 
3057  /* figure timeouts and fetch possible outgoing
3058  * to_link packets (such as ping or TLS control) */
3059  pre_select(&mi->context);
3060 
3061 #if defined(ENABLE_ASYNC_PUSH)
3062  /*
3063  * if we see the state transition from unauthenticated to deferred
3064  * and an auth_control_file, we assume it got just added and add
3065  * inotify watch to that file
3066  */
3067  if (ks && ks->plugin_auth.auth_control_file && was_unauthenticated
3068  && (ks->authenticated == KS_AUTH_DEFERRED))
3069  {
3070  add_inotify_file_watch(m, mi, m->top.c2.inotify_fd,
3072  }
3073  if (ks && ks->script_auth.auth_control_file && was_unauthenticated
3074  && (ks->authenticated == KS_AUTH_DEFERRED))
3075  {
3076  add_inotify_file_watch(m, mi, m->top.c2.inotify_fd,
3078  }
3079 #endif
3080 
3081  if (!IS_SIG(&mi->context))
3082  {
3083  /* connection is "established" when SSL/TLS key negotiation succeeds
3084  * and (if specified) auth user/pass succeeds */
3085 
3087  {
3089  }
3090 #if defined(ENABLE_ASYNC_PUSH)
3093  {
3094  add_inotify_file_watch(m, mi, m->top.c2.inotify_fd,
3096  deferred_ret_file);
3097  }
3098 #endif
3099  /* tell scheduler to wake us up at some point in the future */
3101  }
3102  }
3103 
3104  if (IS_SIG(&mi->context))
3105  {
3106  if (flags & MPP_CLOSE_ON_SIGNAL)
3107  {
3109  ret = false;
3110  }
3111  }
3112  else
3113  {
3114  /* continue to pend on output? */
3115  multi_set_pending(m, ANY_OUT(&mi->context) ? mi : NULL);
3116 
3117 #ifdef MULTI_DEBUG_EVENT_LOOP
3118  printf("POST %s[%d] to=%d lo=%d/%d w=%" PRIi64 "/%ld\n",
3119  id(mi),
3120  (int) (mi == m->pending),
3121  mi ? mi->context.c2.to_tun.len : -1,
3122  mi ? mi->context.c2.to_link.len : -1,
3123  (mi && mi->context.c2.fragment) ? mi->context.c2.fragment->outgoing.len : -1,
3124  (int64_t)mi->context.c2.timeval.tv_sec,
3125  (long)mi->context.c2.timeval.tv_usec);
3126 #endif
3127  }
3128 
3129  if ((flags & MPP_RECORD_TOUCH) && m->mpp_touched)
3130  {
3131  *m->mpp_touched = mi;
3132  }
3133 
3134  return ret;
3135 }
3136 
3137 void
3139 {
3140  struct mroute_addr real = {0};
3141  struct hash *hash = m->hash;
3142  struct gc_arena gc = gc_new();
3143 
3144  if (!mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true))
3145  {
3146  goto done;
3147  }
3148 
3149  const uint32_t hv = hash_value(hash, &real);
3150  struct hash_bucket *bucket = hash_bucket(hash, hv);
3151 
3152  /* make sure that we don't float to an address taken by another client */
3153  struct hash_element *he = hash_lookup_fast(hash, bucket, &real, hv);
3154  if (he)
3155  {
3156  struct multi_instance *ex_mi = (struct multi_instance *) he->value;
3157 
3158  struct tls_multi *m1 = mi->context.c2.tls_multi;
3159  struct tls_multi *m2 = ex_mi->context.c2.tls_multi;
3160 
3161  /* do not float if target address is taken by client with another cert */
3162  if (!cert_hash_compare(m1->locked_cert_hash_set, m2->locked_cert_hash_set))
3163  {
3164  msg(D_MULTI_LOW, "Disallow float to an address taken by another client %s",
3165  multi_instance_string(ex_mi, false, &gc));
3166 
3167  mi->context.c2.buf.len = 0;
3168 
3169  goto done;
3170  }
3171 
3172  msg(D_MULTI_MEDIUM, "closing instance %s", multi_instance_string(ex_mi, false, &gc));
3173  multi_close_instance(m, ex_mi, false);
3174  }
3175 
3176  msg(D_MULTI_MEDIUM, "peer %" PRIu32 " (%s) floated from %s to %s",
3177  mi->context.c2.tls_multi->peer_id,
3178  tls_common_name(mi->context.c2.tls_multi, false),
3179  mroute_addr_print(&mi->real, &gc),
3181 
3182  /* remove old address from hash table before changing address */
3183  ASSERT(hash_remove(m->hash, &mi->real));
3184  ASSERT(hash_remove(m->iter, &mi->real));
3185 
3186  /* change external network address of the remote peer */
3187  mi->real = real;
3188  generate_prefix(mi);
3189 
3190  mi->context.c2.from = m->top.c2.from;
3191  mi->context.c2.to_link_addr = &mi->context.c2.from;
3192 
3193  /* inherit parent link_socket and link_socket_info */
3196 
3198 
3199  ASSERT(hash_add(m->hash, &mi->real, mi, false));
3200  ASSERT(hash_add(m->iter, &mi->real, mi, false));
3201 
3202 #ifdef ENABLE_MANAGEMENT
3203  ASSERT(hash_add(m->cid_hash, &mi->context.c2.mda_context.cid, mi, true));
3204 #endif
3205 
3206 done:
3207  gc_free(&gc);
3208 }
3209 
3210 /*
3211  * Called when an instance should be closed due to the
3212  * reception of a soft signal.
3213  */
3214 void
3216 {
3217  remap_signal(&mi->context);
3218  set_prefix(mi);
3219  print_signal(mi->context.sig, "client-instance", D_MULTI_LOW);
3220  clear_prefix();
3221  multi_close_instance(m, mi, false);
3222 }
3223 
3224 #if (defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD))) || defined(ENABLE_MANAGEMENT)
3225 static void
3226 multi_signal_instance(struct multi_context *m, struct multi_instance *mi, const int sig)
3227 {
3228  mi->context.sig->signal_received = sig;
3230 }
3231 #endif
3232 
3233 #if defined(ENABLE_DCO) && (defined(TARGET_LINUX) || defined(TARGET_FREEBSD))
3234 static void
3235 process_incoming_del_peer(struct multi_context *m, struct multi_instance *mi,
3236  dco_context_t *dco)
3237 {
3238  const char *reason = "ovpn-dco: unknown reason";
3239  switch (dco->dco_del_peer_reason)
3240  {
3242  reason = "ovpn-dco: ping expired";
3243  break;
3244 
3246  reason = "ovpn-dco: transport error";
3247  break;
3248 
3250  reason = "ovpn-dco: transport disconnected";
3251  break;
3252 
3254  /* We assume that is ourselves. Unfortunately, sometimes these
3255  * events happen with enough delay that they can have an order of
3256  *
3257  * dco_del_peer x
3258  * [new client connecting]
3259  * dco_new_peer x
3260  * event from dco_del_peer arrives.
3261  *
3262  * if we do not ignore this we get desynced with the kernel
3263  * since we assume the peer-id is free again. The other way would
3264  * be to send a dco_del_peer again
3265  */
3266  return;
3267  }
3268 
3269  /* When kernel already deleted the peer, the socket is no longer
3270  * installed, and we do not need to clean up the state in the kernel */
3271  mi->context.c2.tls_multi->dco_peer_id = -1;
3272  mi->context.sig->signal_text = reason;
3273  mi->context.c2.dco_read_bytes = dco->dco_read_bytes;
3274  mi->context.c2.dco_write_bytes = dco->dco_write_bytes;
3275  multi_signal_instance(m, mi, SIGTERM);
3276 }
3277 
3278 bool
3280 {
3281  dco_context_t *dco = &m->top.c1.tuntap->dco;
3282 
3283  struct multi_instance *mi = NULL;
3284 
3285  int ret = dco_do_read(&m->top.c1.tuntap->dco);
3286 
3287  int peer_id = dco->dco_message_peer_id;
3288 
3289  /* no peer-specific message delivered -> nothing to process.
3290  * bail out right away
3291  */
3292  if (peer_id < 0)
3293  {
3294  return ret > 0;
3295  }
3296 
3297  if ((peer_id < m->max_clients) && (m->instances[peer_id]))
3298  {
3299  mi = m->instances[peer_id];
3300  if (dco->dco_message_type == OVPN_CMD_DEL_PEER)
3301  {
3302  process_incoming_del_peer(m, mi, dco);
3303  }
3304  else if (dco->dco_message_type == OVPN_CMD_SWAP_KEYS)
3305  {
3307  }
3308  }
3309  else
3310  {
3311  int msglevel = D_DCO;
3312  if (dco->dco_message_type == OVPN_CMD_DEL_PEER
3313  && dco->dco_del_peer_reason == OVPN_DEL_PEER_REASON_USERSPACE)
3314  {
3315  /* we receive OVPN_CMD_DEL_PEER message with reason USERSPACE
3316  * after we kill the peer ourselves. This peer may have already
3317  * been deleted, so we end up here.
3318  * In this case, print the following debug message with DCO_DEBUG
3319  * level only to avoid polluting the standard DCO level with this
3320  * harmless event.
3321  */
3322  msglevel = D_DCO_DEBUG;
3323  }
3324  msg(msglevel, "Received DCO message for unknown peer-id: %d, "
3325  "type %d, del_peer_reason %d", peer_id, dco->dco_message_type,
3326  dco->dco_del_peer_reason);
3327  }
3328 
3329  dco->dco_message_type = 0;
3330  dco->dco_message_peer_id = -1;
3331  dco->dco_del_peer_reason = -1;
3332  dco->dco_read_bytes = 0;
3333  dco->dco_write_bytes = 0;
3334  return ret > 0;
3335 }
3336 #endif /* if defined(ENABLE_DCO) && defined(TARGET_LINUX) */
3337 
3338 /*
3339  * Process packets in the TCP/UDP socket -> TUN/TAP interface direction,
3340  * i.e. client -> server direction.
3341  */
3342 bool
3343 multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags)
3344 {
3345  struct gc_arena gc = gc_new();
3346 
3347  struct context *c;
3348  struct mroute_addr src, dest;
3349  unsigned int mroute_flags;
3350  struct multi_instance *mi;
3351  bool ret = true;
3352  bool floated = false;
3353 
3354  if (m->pending)
3355  {
3356  return true;
3357  }
3358 
3359  if (!instance)
3360  {
3361 #ifdef MULTI_DEBUG_EVENT_LOOP
3362  printf("TCP/UDP -> TUN [%d]\n", BLEN(&m->top.c2.buf));
3363 #endif
3365  }
3366  else
3367  {
3368  multi_set_pending(m, instance);
3369  }
3370 
3371  if (m->pending)
3372  {
3373  set_prefix(m->pending);
3374 
3375  /* get instance context */
3376  c = &m->pending->context;
3377 
3378  if (!instance)
3379  {
3380  /* transfer packet pointer from top-level context buffer to instance */
3381  c->c2.buf = m->top.c2.buf;
3382 
3383  /* transfer from-addr from top-level context buffer to instance */
3384  if (!floated)
3385  {
3386  c->c2.from = m->top.c2.from;
3387  }
3388  }
3389 
3390  if (BLEN(&c->c2.buf) > 0)
3391  {
3392  struct link_socket_info *lsi;
3393  const uint8_t *orig_buf;
3394 
3395  /* decrypt in instance context */
3396 
3398  lsi = get_link_socket_info(c);
3399  orig_buf = c->c2.buf.data;
3400  if (process_incoming_link_part1(c, lsi, floated))
3401  {
3402  /* nonzero length means that we have a valid, decrypted packed */
3403  if (floated && c->c2.buf.len > 0)
3404  {
3406  }
3407 
3408  process_incoming_link_part2(c, lsi, orig_buf);
3409  }
3410  perf_pop();
3411 
3412  if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TUN)
3413  {
3414  /* extract packet source and dest addresses */
3415  mroute_flags = mroute_extract_addr_from_packet(&src,
3416  &dest,
3417  0,
3418  &c->c2.to_tun,
3419  DEV_TYPE_TUN);
3420 
3421  /* drop packet if extract failed */
3422  if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED))
3423  {
3424  c->c2.to_tun.len = 0;
3425  }
3426  /* make sure that source address is associated with this client */
3427  else if (multi_get_instance_by_virtual_addr(m, &src, true) != m->pending)
3428  {
3429  /* IPv6 link-local address (fe80::xxx)? */
3430  if ( (src.type & MR_ADDR_MASK) == MR_ADDR_IPV6
3431  && IN6_IS_ADDR_LINKLOCAL(&src.v6.addr) )
3432  {
3433  /* do nothing, for now. TODO: add address learning */
3434  }
3435  else
3436  {
3437  msg(D_MULTI_DROPPED, "MULTI: bad source address from client [%s], packet dropped",
3438  mroute_addr_print(&src, &gc));
3439  }
3440  c->c2.to_tun.len = 0;
3441  }
3442  /* client-to-client communication enabled? */
3443  else if (m->enable_c2c)
3444  {
3445  /* multicast? */
3446  if (mroute_flags & MROUTE_EXTRACT_MCAST)
3447  {
3448  /* for now, treat multicast as broadcast */
3449  multi_bcast(m, &c->c2.to_tun, m->pending, NULL, 0);
3450  }
3451  else /* possible client to client routing */
3452  {
3453  ASSERT(!(mroute_flags & MROUTE_EXTRACT_BCAST));
3454  mi = multi_get_instance_by_virtual_addr(m, &dest, true);
3455 
3456  /* if dest addr is a known client, route to it */
3457  if (mi)
3458  {
3459  {
3460  multi_unicast(m, &c->c2.to_tun, mi);
3461  register_activity(c, BLEN(&c->c2.to_tun));
3462  }
3463  c->c2.to_tun.len = 0;
3464  }
3465  }
3466  }
3467  }
3468  else if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TAP)
3469  {
3470  uint16_t vid = 0;
3471 
3472  if (m->top.options.vlan_tagging)
3473  {
3474  if (vlan_is_tagged(&c->c2.to_tun))
3475  {
3476  /* Drop VLAN-tagged frame. */
3477  msg(D_VLAN_DEBUG, "dropping incoming VLAN-tagged frame");
3478  c->c2.to_tun.len = 0;
3479  }
3480  else
3481  {
3482  vid = c->options.vlan_pvid;
3483  }
3484  }
3485  /* extract packet source and dest addresses */
3486  mroute_flags = mroute_extract_addr_from_packet(&src,
3487  &dest,
3488  vid,
3489  &c->c2.to_tun,
3490  DEV_TYPE_TAP);
3491 
3492  if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED)
3493  {
3494  if (multi_learn_addr(m, m->pending, &src, 0) == m->pending)
3495  {
3496  /* check for broadcast */
3497  if (m->enable_c2c)
3498  {
3499  if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST))
3500  {
3501  multi_bcast(m, &c->c2.to_tun, m->pending, NULL,
3502  vid);
3503  }
3504  else /* try client-to-client routing */
3505  {
3506  mi = multi_get_instance_by_virtual_addr(m, &dest, false);
3507 
3508  /* if dest addr is a known client, route to it */
3509  if (mi)
3510  {
3511  multi_unicast(m, &c->c2.to_tun, mi);
3512  register_activity(c, BLEN(&c->c2.to_tun));
3513  c->c2.to_tun.len = 0;
3514  }
3515  }
3516  }
3517  }
3518  else
3519  {
3520  msg(D_MULTI_DROPPED, "MULTI: bad source address from client [%s], packet dropped",
3521  mroute_addr_print(&src, &gc));
3522  c->c2.to_tun.len = 0;
3523  }
3524  }
3525  else
3526  {
3527  c->c2.to_tun.len = 0;
3528  }
3529  }
3530  }
3531 
3532  /* postprocess and set wakeup */
3533  ret = multi_process_post(m, m->pending, mpp_flags);
3534 
3535  clear_prefix();
3536  }
3537 
3538  gc_free(&gc);
3539  return ret;
3540 }
3541 
3542 /*
3543  * Process packets in the TUN/TAP interface -> TCP/UDP socket direction,
3544  * i.e. server -> client direction.
3545  */
3546 bool
3547 multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
3548 {
3549  bool ret = true;
3550 
3551  if (BLEN(&m->top.c2.buf) > 0)
3552  {
3553  unsigned int mroute_flags;
3554  struct mroute_addr src = {0}, dest = {0};
3555  const int dev_type = TUNNEL_TYPE(m->top.c1.tuntap);
3556  int16_t vid = 0;
3557 
3558 
3559 #ifdef MULTI_DEBUG_EVENT_LOOP
3560  printf("TUN -> TCP/UDP [%d]\n", BLEN(&m->top.c2.buf));
3561 #endif
3562 
3563  if (m->pending)
3564  {
3565  return true;
3566  }
3567 
3568  if (dev_type == DEV_TYPE_TAP && m->top.options.vlan_tagging)
3569  {
3570  vid = vlan_decapsulate(&m->top, &m->top.c2.buf);
3571  if (vid < 0)
3572  {
3573  return false;
3574  }
3575  }
3576 
3577  /*
3578  * Route an incoming tun/tap packet to
3579  * the appropriate multi_instance object.
3580  */
3581 
3582  mroute_flags = mroute_extract_addr_from_packet(&src,
3583  &dest,
3584  vid,
3585  &m->top.c2.buf,
3586  dev_type);
3587 
3588  if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED)
3589  {
3590  struct context *c;
3591 
3592  /* broadcast or multicast dest addr? */
3593  if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST))
3594  {
3595  /* for now, treat multicast as broadcast */
3596  multi_bcast(m, &m->top.c2.buf, NULL, NULL, vid);
3597  }
3598  else
3599  {
3601 
3602  if (m->pending)
3603  {
3604  /* get instance context */
3605  c = &m->pending->context;
3606 
3607  set_prefix(m->pending);
3608 
3609  {
3610  if (multi_output_queue_ready(m, m->pending))
3611  {
3612  /* transfer packet pointer from top-level context buffer to instance */
3613  c->c2.buf = m->top.c2.buf;
3614  }
3615  else
3616  {
3617  /* drop packet */
3618  msg(D_MULTI_DROPPED, "MULTI: packet dropped due to output saturation (multi_process_incoming_tun)");
3619  buf_reset_len(&c->c2.buf);
3620  }
3621  }
3622 
3623  /* encrypt in instance context */
3625 
3626  /* postprocess and set wakeup */
3627  ret = multi_process_post(m, m->pending, mpp_flags);
3628 
3629  clear_prefix();
3630  }
3631  }
3632  }
3633  }
3634  return ret;
3635 }
3636 
3637 /*
3638  * Process a possible client-to-client/bcast/mcast message in the
3639  * queue.
3640  */
3641 struct multi_instance *
3643 {
3644  struct mbuf_item item;
3645 
3646  if (mbuf_extract_item(ms, &item)) /* cleartext IP packet */
3647  {
3648  unsigned int pip_flags = PIPV4_PASSTOS | PIPV6_ICMP_NOHOST_SERVER;
3649 
3650  set_prefix(item.instance);
3651  item.instance->context.c2.buf = item.buffer->buf;
3652  if (item.buffer->flags & MF_UNICAST) /* --mssfix doesn't make sense for broadcast or multicast */
3653  {
3654  pip_flags |= PIP_MSSFIX;
3655  }
3656  process_ip_header(&item.instance->context, pip_flags, &item.instance->context.c2.buf);
3657  encrypt_sign(&item.instance->context, true);
3658  mbuf_free_buf(item.buffer);
3659 
3660  dmsg(D_MULTI_DEBUG, "MULTI: C2C/MCAST/BCAST");
3661 
3662  clear_prefix();
3663  return item.instance;
3664  }
3665  else
3666  {
3667  return NULL;
3668  }
3669 }
3670 
3671 /*
3672  * Called when an I/O wait times out. Usually means that a particular
3673  * client instance object needs timer-based service.
3674  */
3675 bool
3676 multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags)
3677 {
3678  bool ret = true;
3679 
3680 #ifdef MULTI_DEBUG_EVENT_LOOP
3681  printf("%s -> TIMEOUT\n", id(m->earliest_wakeup));
3682 #endif
3683 
3684  /* instance marked for wakeup? */
3685  if (m->earliest_wakeup)
3686  {
3688  {
3691  }
3692  else
3693  {
3695  ret = multi_process_post(m, m->earliest_wakeup, mpp_flags);
3696  clear_prefix();
3697  }
3698  m->earliest_wakeup = NULL;
3699  }
3700  return ret;
3701 }
3702 
3703 /*
3704  * Drop a TUN/TAP outgoing packet..
3705  */
3706 void
3707 multi_process_drop_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
3708 {
3709  struct multi_instance *mi = m->pending;
3710 
3711  ASSERT(mi);
3712 
3713  set_prefix(mi);
3714 
3715  msg(D_MULTI_ERRORS, "MULTI: Outgoing TUN queue full, dropped packet len=%d",
3716  mi->context.c2.to_tun.len);
3717 
3718  buf_reset(&mi->context.c2.to_tun);
3719 
3720  multi_process_post(m, mi, mpp_flags);
3721  clear_prefix();
3722 }
3723 
3724 /*
3725  * Per-client route quota management
3726  */
3727 
3728 void
3730 {
3731  struct gc_arena gc = gc_new();
3732  msg(D_ROUTE_QUOTA, "MULTI ROUTE: route quota (%d) exceeded for %s (see --max-routes-per-client option)",
3734  multi_instance_string(mi, false, &gc));
3735  gc_free(&gc);
3736 }
3737 
3738 #ifdef ENABLE_DEBUG
3739 /*
3740  * Flood clients with random packets
3741  */
3742 static void
3743 gremlin_flood_clients(struct multi_context *m)
3744 {
3745  const int level = GREMLIN_PACKET_FLOOD_LEVEL(m->top.options.gremlin);
3746  if (level)
3747  {
3748  struct gc_arena gc = gc_new();
3749  struct buffer buf = alloc_buf_gc(BUF_SIZE(&m->top.c2.frame), &gc);
3750  struct packet_flood_parms parm = get_packet_flood_parms(level);
3751  int i;
3752 
3753  ASSERT(buf_init(&buf, m->top.c2.frame.buf.headroom));
3754  parm.packet_size = min_int(parm.packet_size, m->top.c2.frame.buf.payload_size);
3755 
3756  msg(D_GREMLIN, "GREMLIN_FLOOD_CLIENTS: flooding clients with %d packets of size %d",
3757  parm.n_packets,
3758  parm.packet_size);
3759 
3760  for (i = 0; i < parm.packet_size; ++i)
3761  {
3762  ASSERT(buf_write_u8(&buf, get_random() & 0xFF));
3763  }
3764 
3765  for (i = 0; i < parm.n_packets; ++i)
3766  {
3767  multi_bcast(m, &buf, NULL, NULL, 0);
3768  }
3769 
3770  gc_free(&gc);
3771  }
3772 }
3773 #endif /* ifdef ENABLE_DEBUG */
3774 
3775 static bool
3777 {
3778  struct timeval null;
3779  CLEAR(null);
3781 }
3782 
3783 /*
3784  * Process timers in the top-level context
3785  */
3786 void
3788 {
3789  /* possibly reap instances/routes in vhash */
3790  multi_reap_process(m);
3791 
3792  /* possibly print to status log */
3793  if (m->top.c1.status_output)
3794  {
3796  {
3798  }
3799  }
3800 
3801  /* possibly flush ifconfig-pool file */
3802  multi_ifconfig_pool_persist(m, false);
3803 
3804 #ifdef ENABLE_DEBUG
3805  gremlin_flood_clients(m);
3806 #endif
3807 
3808  /* Should we check for stale routes? */
3810  {
3811  check_stale_routes(m);
3812  }
3813 }
3814 
3815 void
3816 multi_top_init(struct multi_context *m, struct context *top)
3817 {
3818  inherit_context_top(&m->top, top);
3819  m->top.c2.buffers = init_context_buffers(&top->c2.frame);
3820 }
3821 
3822 void
3824 {
3825  close_context(&m->top, -1, CC_GC_FREE);
3827 }
3828 
3829 static bool
3831 {
3832  return (sig == SIGUSR1 || sig == SIGTERM || sig == SIGHUP || sig == SIGINT);
3833 }
3834 
3835 static void
3837 {
3838  struct hash_iterator hi;
3839  struct hash_element *he;
3840  struct timeval tv;
3841 
3842  /* tell all clients to restart */
3843  hash_iterator_init(m->iter, &hi);
3844  while ((he = hash_iterator_next(&hi)))
3845  {
3846  struct multi_instance *mi = (struct multi_instance *) he->value;
3847  if (!mi->halt)
3848  {
3849  send_control_channel_string(&mi->context, next_server ? "RESTART,[N]" : "RESTART", D_PUSH);
3851  }
3852  }
3853  hash_iterator_free(&hi);
3854 
3855  /* reschedule signal */
3857  tv.tv_sec = 2;
3858  tv.tv_usec = 0;
3860 
3862 
3867 
3868  signal_reset(m->top.sig, 0);
3869 }
3870 
3871 /*
3872  * Return true if event loop should break,
3873  * false if it should continue.
3874  */
3875 bool
3877 {
3878  if (signal_reset(m->top.sig, SIGUSR2) == SIGUSR2)
3879  {
3880  struct status_output *so = status_open(NULL, 0, M_INFO, NULL, 0);
3882  status_close(so);
3883  return false;
3884  }
3885  else if (proto_is_dgram(m->top.options.ce.proto)
3889  {
3891  return false;
3892  }
3893  return true;
3894 }
3895 
3896 /*
3897  * Management subsystem callbacks
3898  */
3899 #ifdef ENABLE_MANAGEMENT
3900 
3901 static void
3902 management_callback_status(void *arg, const int version, struct status_output *so)
3903 {
3904  struct multi_context *m = (struct multi_context *) arg;
3905 
3906  if (!version)
3907  {
3909  }
3910  else
3911  {
3912  multi_print_status(m, so, version);
3913  }
3914 }
3915 
3916 static int
3918 {
3919  struct multi_context *m = (struct multi_context *) arg;
3920  return m->n_clients;
3921 }
3922 
3923 static int
3924 management_callback_kill_by_cn(void *arg, const char *del_cn)
3925 {
3926  struct multi_context *m = (struct multi_context *) arg;
3927  struct hash_iterator hi;
3928  struct hash_element *he;
3929  int count = 0;
3930 
3931  hash_iterator_init(m->iter, &hi);
3932  while ((he = hash_iterator_next(&hi)))
3933  {
3934  struct multi_instance *mi = (struct multi_instance *) he->value;
3935  if (!mi->halt)
3936  {
3937  const char *cn = tls_common_name(mi->context.c2.tls_multi, false);
3938  if (cn && !strcmp(cn, del_cn))
3939  {
3940  multi_signal_instance(m, mi, SIGTERM);
3941  ++count;
3942  }
3943  }
3944  }
3945  hash_iterator_free(&hi);
3946  return count;
3947 }
3948 
3949 static int
3950 management_callback_kill_by_addr(void *arg, const in_addr_t addr, const int port)
3951 {
3952  struct multi_context *m = (struct multi_context *) arg;
3953  struct hash_iterator hi;
3954  struct hash_element *he;
3955  struct openvpn_sockaddr saddr;
3956  struct mroute_addr maddr;
3957  int count = 0;
3958 
3959  CLEAR(saddr);
3960  saddr.addr.in4.sin_family = AF_INET;
3961  saddr.addr.in4.sin_addr.s_addr = htonl(addr);
3962  saddr.addr.in4.sin_port = htons(port);
3963  if (mroute_extract_openvpn_sockaddr(&maddr, &saddr, true))
3964  {
3965  hash_iterator_init(m->iter, &hi);
3966  while ((he = hash_iterator_next(&hi)))
3967  {
3968  struct multi_instance *mi = (struct multi_instance *) he->value;
3969  if (!mi->halt && mroute_addr_equal(&maddr, &mi->real))
3970  {
3971  multi_signal_instance(m, mi, SIGTERM);
3972  ++count;
3973  }
3974  }
3975  hash_iterator_free(&hi);
3976  }
3977  return count;
3978 }
3979 
3980 static void
3982 {
3983  struct multi_context *m = (struct multi_context *) arg;
3984  if (m->mtcp)
3985  {
3986  multi_tcp_delete_event(m->mtcp, event);
3987  }
3988 }
3989 
3990 static struct multi_instance *
3991 lookup_by_cid(struct multi_context *m, const unsigned long cid)
3992 {
3993  if (m)
3994  {
3995  struct multi_instance *mi = (struct multi_instance *) hash_lookup(m->cid_hash, &cid);
3996  if (mi && !mi->halt)
3997  {
3998  return mi;
3999  }
4000  }
4001  return NULL;
4002 }
4003 
4004 static bool
4005 management_kill_by_cid(void *arg, const unsigned long cid, const char *kill_msg)
4006 {
4007  struct multi_context *m = (struct multi_context *) arg;
4008  struct multi_instance *mi = lookup_by_cid(m, cid);
4009  if (mi)
4010  {
4011  send_restart(&mi->context, kill_msg); /* was: multi_signal_instance (m, mi, SIGTERM); */
4013  return true;
4014  }
4015  else
4016  {
4017  return false;
4018  }
4019 }
4020 
4021 static bool
4023  const unsigned long cid,
4024  const unsigned int mda_key_id,
4025  const char *extra,
4026  unsigned int timeout)
4027 {
4028  struct multi_context *m = (struct multi_context *) arg;
4029  struct multi_instance *mi = lookup_by_cid(m, cid);
4030 
4031  if (mi)
4032  {
4033  struct tls_multi *multi = mi->context.c2.tls_multi;
4034  struct tls_session *session;
4035 
4036  if (multi->session[TM_INITIAL].key[KS_PRIMARY].mda_key_id == mda_key_id)
4037  {
4038  session = &multi->session[TM_INITIAL];
4039  }
4040  else if (multi->session[TM_ACTIVE].key[KS_PRIMARY].mda_key_id == mda_key_id)
4041  {
4042  session = &multi->session[TM_ACTIVE];
4043  }
4044  else
4045  {
4046  return false;
4047  }
4048 
4049  /* sends INFO_PRE and AUTH_PENDING messages to client */
4050  bool ret = send_auth_pending_messages(multi, session, extra,
4051  timeout);
4054  return ret;
4055  }
4056  return false;
4057 }
4058 
4059 
4060 static bool
4062  const unsigned long cid,
4063  const unsigned int mda_key_id,
4064  const bool auth,
4065  const char *reason,
4066  const char *client_reason,
4067  struct buffer_list *cc_config) /* ownership transferred */
4068 {
4069  struct multi_context *m = (struct multi_context *) arg;
4070  struct multi_instance *mi = lookup_by_cid(m, cid);
4071  bool cc_config_owned = true;
4072  bool ret = false;
4073 
4074  if (mi)
4075  {
4076  ret = tls_authenticate_key(mi->context.c2.tls_multi, mda_key_id, auth, client_reason);
4077  if (ret)
4078  {
4079  if (auth)
4080  {
4082  {
4083  set_cc_config(mi, cc_config);
4084  cc_config_owned = false;
4085  }
4086  }
4087  else if (reason)
4088  {
4089  msg(D_MULTI_LOW, "MULTI: connection rejected: %s, CLI:%s", reason, np(client_reason));
4090  }
4091  }
4092  }
4093  if (cc_config_owned && cc_config)
4094  {
4096  }
4097  return ret;
4098 }
4099 
4100 static char *
4101 management_get_peer_info(void *arg, const unsigned long cid)
4102 {
4103  struct multi_context *m = (struct multi_context *) arg;
4104  struct multi_instance *mi = lookup_by_cid(m, cid);
4105  char *ret = NULL;
4106 
4107  if (mi)
4108  {
4109  ret = mi->context.c2.tls_multi->peer_info;
4110  }
4111 
4112  return ret;
4113 }
4114 
4115 #endif /* ifdef ENABLE_MANAGEMENT */
4116 
4117 
4118 void
4120 {
4121 #ifdef ENABLE_MANAGEMENT
4122  if (management)
4123  {
4124  struct management_callback cb;
4125  CLEAR(cb);
4126  cb.arg = m;
4127  cb.flags = MCF_SERVER;
4139  }
4140 #endif /* ifdef ENABLE_MANAGEMENT */
4141 }
4142 
4143 void
4145 {
4146  /* max_clients must be less then max peer-id value */
4148 
4149  for (int i = 0; i < m->max_clients; ++i)
4150  {
4151  if (!m->instances[i])
4152  {
4153  mi->context.c2.tls_multi->peer_id = i;
4154  m->instances[i] = mi;
4155  break;
4156  }
4157  }
4158 
4159  /* should not really end up here, since multi_create_instance returns null
4160  * if amount of clients exceeds max_clients */
4162 }
4163 
4164 
4165 /*
4166  * Top level event loop.
4167  */
4168 void
4170 {
4171  ASSERT(top->options.mode == MODE_SERVER);
4172 
4173  if (proto_is_dgram(top->options.ce.proto))
4174  {
4175  tunnel_server_udp(top);
4176  }
4177  else
4178  {
4179  tunnel_server_tcp(top);
4180  }
4181 }
status_open
struct status_output * status_open(const char *filename, const int refresh_freq, const int msglevel, const struct virtual_output *vout, const unsigned int flags)
Definition: status.c:61
mroute_helper_init
struct mroute_helper * mroute_helper_init(int ageable_ttl_secs)
Definition: mroute.c:471
multi_reap::buckets_per_pass
int buckets_per_pass
Definition: multi.h:54
plugin_return::list
struct openvpn_plugin_string_list * list[MAX_PLUGINS]
Definition: plugin.h:104
setenv_trusted
void setenv_trusted(struct env_set *es, const struct link_socket_info *info)
Definition: socket.c:2349
multi_client_connect_call_plugin_v1
static enum client_connect_return multi_client_connect_call_plugin_v1(struct multi_context *m, struct multi_instance *mi, bool deferred, unsigned int *option_types_found)
Definition: multi.c:2096
management_callback::client_auth
bool(* client_auth)(void *arg, const unsigned long cid, const unsigned int mda_key_id, const bool auth, const char *reason, const char *client_reason, struct buffer_list *cc_config)
Definition: manage.h:188
PERF_MULTI_BCAST
#define PERF_MULTI_BCAST
Definition: perf.h:48
platform_create_temp_file
const char * platform_create_temp_file(const char *directory, const char *prefix, struct gc_arena *gc)
Create a temporary file in directory, returns the filename of the created file.
Definition: platform.c:554
multi_learn_in6_addr
static struct multi_instance * multi_learn_in6_addr(struct multi_context *m, struct multi_instance *mi, struct in6_addr a6, int netbits, bool primary)
Definition: multi.c:1270
multi_context::n_clients
int n_clients
Definition: multi.h:182
options::vlan_tagging
bool vlan_tagging
Definition: options.h:693
mbuf_extract_item
bool mbuf_extract_item(struct mbuf_set *ms, struct mbuf_item *item)
Definition: mbuf.c:111
OPENVPN_PLUGIN_CLIENT_CONNECT_V2
#define OPENVPN_PLUGIN_CLIENT_CONNECT_V2
Definition: openvpn-plugin.h:126
OVPN_CMD_DEL_PEER
@ OVPN_CMD_DEL_PEER
@OVPN_CMD_DEL_PEER: Remove peer from internal table
Definition: ovpn_dco_linux.h:40
MR_ADDR_MASK
#define MR_ADDR_MASK
Definition: mroute.h:64
dco_check_option
static bool dco_check_option(int msglevel, const struct options *o)
Definition: dco.h:269
signal_info::signal_received
volatile int signal_received
Definition: sig.h:43
multi_instance
Server-mode state structure for one single VPN tunnel.
Definition: multi.h:101
status_trigger
bool status_trigger(struct status_output *so)
Definition: status.c:133
iroute
Definition: route.h:234
D_DCO_DEBUG
#define D_DCO_DEBUG
Definition: errlevel.h:118
multi_instance::halt
bool halt
Definition: multi.h:106
multi_client_connect_compress_migrate
static enum client_connect_return multi_client_connect_compress_migrate(struct multi_context *m, struct multi_instance *mi, bool deferred, unsigned int *option_types_found)
Do the necessary modification for doing the compress migrate.
Definition: multi.c:2569
reflect_filter.h
OPENVPN_PLUGIN_LEARN_ADDRESS
#define OPENVPN_PLUGIN_LEARN_ADDRESS
Definition: openvpn-plugin.h:125
CAS_PENDING_DEFERRED
@ CAS_PENDING_DEFERRED
Waiting on an async option import handler.
Definition: ssl_common.h:565
openvpn_sockaddr::addr
union openvpn_sockaddr::@14 addr
multi_process_incoming_dco
bool multi_process_incoming_dco(struct multi_context *m)
Process an incoming DCO message (from kernel space).
M_INFO
#define M_INFO
Definition: errlevel.h:55
hash_n_elements
static int hash_n_elements(const struct hash *hash)
Definition: list.h:122
compress_options::alg
int alg
Definition: comp.h:66
options::use_peer_id
bool use_peer_id
Definition: options.h:682
lookup_by_cid
static struct multi_instance * lookup_by_cid(struct multi_context *m, const unsigned long cid)
Definition: multi.c:3991
multi_context::route_helper
struct mroute_helper * route_helper
Definition: multi.h:175
M_OPTERR
#define M_OPTERR
Definition: error.h:100
MPP_RECORD_TOUCH
#define MPP_RECORD_TOUCH
Definition: multi.h:290
options::client_connect_script
const char * client_connect_script
Definition: options.h:485
CC_RET_FAILED
@ CC_RET_FAILED
Definition: multi.h:219
hash_init
struct hash * hash_init(const int n_buckets, const uint32_t iv, uint32_t(*hash_function)(const void *key, uint32_t iv), bool(*compare_function)(const void *key1, const void *key2))
Definition: list.c:38
route_quota_test
static bool route_quota_test(const struct multi_instance *mi)
Definition: multi.h:460
options::tcp_queue_limit
int tcp_queue_limit
Definition: options.h:493
options::enable_ncp_fallback
bool enable_ncp_fallback
If defined fall back to ciphername if NCP fails.
Definition: options.h:557
print_signal
void print_signal(const struct signal_info *si, const char *title, int msglevel)
Definition: sig.c:294
MPP_CLOSE_ON_SIGNAL
#define MPP_CLOSE_ON_SIGNAL
Definition: multi.h:289
hash_bucket
static struct hash_bucket * hash_bucket(struct hash *hash, uint32_t hv)
Definition: list.h:134
multi_context::stale_routes_check_et
struct event_timeout stale_routes_check_et
Definition: multi.h:204
gc_new
static struct gc_arena gc_new(void)
Definition: buffer.h:1030
options::cf_initial_per
int cf_initial_per
Definition: options.h:516
run_command.h
M_ERRNO
#define M_ERRNO
Definition: error.h:94
IV_PROTO_DATA_V2
#define IV_PROTO_DATA_V2
Support P_DATA_V2.
Definition: ssl.h:79
process_incoming_link_part2
void process_incoming_link_part2(struct context *c, struct link_socket_info *lsi, const uint8_t *orig_buf)
Continues processing a packet read from the external network interface.
Definition: forward.c:1168
DEV_TYPE_TUN
#define DEV_TYPE_TUN
Definition: proto.h:37
connection_entry::explicit_exit_notification
int explicit_exit_notification
Definition: options.h:141
context_2::to_link
struct buffer to_link
Definition: openvpn.h:380
context_2::tls_multi
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:326
multi_context::reaper
struct multi_reap * reaper
Definition: multi.h:176
forward.h
multi_instance::reporting_addr
in_addr_t reporting_addr
Definition: multi.h:124
setenv_stats
static void setenv_stats(struct multi_context *m, struct context *c)
Definition: multi.c:548
plugin_return
Definition: plugin.h:101
OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER
#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER
Definition: openvpn-plugin.h:130
signal_info::signal_text
const char * signal_text
Definition: sig.h:45
gremlin.h
stale_route_check_trigger
static bool stale_route_check_trigger(struct multi_context *m)
Definition: multi.c:3776
CC_RET_SUCCEEDED
@ CC_RET_SUCCEEDED
Definition: multi.h:220
options_server_import
void options_server_import(struct options *o, const char *filename, int msglevel, unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition: options.c:5533
buffer::len
int len
Length in bytes of the actual content within the allocated memory.
Definition: buffer.h:66
context_2::buf
struct buffer buf
Definition: openvpn.h:378
buf_reset
static void buf_reset(struct buffer *buf)
Definition: buffer.h:303
multi_context::tcp_queue_limit
int tcp_queue_limit
Definition: multi.h:180
MULTI_ROUTE_AGEABLE
#define MULTI_ROUTE_AGEABLE
Definition: multi.h:234
multi_del_iroutes
static void multi_del_iroutes(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:525
hash_iterator
Definition: list.h:88
tunnel_server_udp
void tunnel_server_udp(struct context *top)
Main event loop for OpenVPN in UDP server mode.
Definition: mudp.c:462
context_1::tuntap
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition: openvpn.h:170
argv
Definition: argv.h:35
options::enable_c2c
bool enable_c2c
Definition: options.h:509
options::duplicate_cn
bool duplicate_cn
Definition: options.h:510
multi_client_connect_post
static void multi_client_connect_post(struct multi_context *m, struct multi_instance *mi, const char *dc_file, unsigned int *option_types_found)
Definition: multi.c:1646
M_NONFATAL
#define M_NONFATAL
Definition: error.h:90
management_callback::get_peer_info
char *(* get_peer_info)(void *arg, const unsigned long cid)
Definition: manage.h:200
CLIENT_CONNECT_OPT_MASK
#define CLIENT_CONNECT_OPT_MASK
Definition: multi.h:671
KS_PRIMARY
#define KS_PRIMARY
Primary key state index.
Definition: ssl_common.h:448
context_2::link_write_bytes
counter_type link_write_bytes
Definition: openvpn.h:272
translate_cipher_name_to_openvpn
const char * translate_cipher_name_to_openvpn(const char *cipher_name)
Translate a crypto library cipher name to an OpenVPN cipher name.
Definition: crypto.c:1687
buf_init
#define buf_init(buf, offset)
Definition: buffer.h:209
context
Contains all state information for one tunnel.
Definition: openvpn.h:476
es
struct env_set * es
Definition: test_pkcs11.c:133
generate_prefix
static void generate_prefix(struct multi_instance *mi)
Definition: multi.c:496
hash
Definition: list.h:56
tls_multi::session
struct tls_session session[TM_SIZE]
Array of tls_session objects representing control channel sessions with the remote peer.
Definition: ssl_common.h:675
CC_GC_FREE
#define CC_GC_FREE
Definition: init.h:103
deferred_signal_schedule_entry::wakeup
struct timeval wakeup
Definition: multi.h:63
ifconfig_push_constraint_satisfied
static bool ifconfig_push_constraint_satisfied(const struct context *c)
Definition: multi.c:1431
options::topology
int topology
Definition: options.h:307
key1
static const char *const key1
Definition: cert_data.h:56
BSTR
#define BSTR(buf)
Definition: buffer.h:129
management_callback::flags
unsigned int flags
Definition: manage.h:178
mbuf_set
Definition: mbuf.h:56
multi_context::mbuf
struct mbuf_set * mbuf
Set of buffers for passing data channel packets between VPN tunnel instances.
Definition: multi.h:167
options::dev_type
const char * dev_type
Definition: options.h:304
get_random
long int get_random(void)
Definition: crypto.c:1611
multi_instance::real
struct mroute_addr real
External network address of the remote peer.
Definition: multi.h:114
context_2::push_ifconfig_ipv6_local
struct in6_addr push_ifconfig_ipv6_local
Definition: openvpn.h:438
multi_instance::gc
struct gc_arena gc
Definition: multi.h:105
options::iroutes
struct iroute * iroutes
Definition: options.h:494
set_prefix
static void set_prefix(struct multi_instance *mi)
Definition: multi.h:537
context::plugins
struct plugin_list * plugins
List of plug-ins.
Definition: openvpn.h:505
plugin_return_init
static void plugin_return_init(struct plugin_return *pr)
Definition: plugin.h:171
multi_get_queue
struct multi_instance * multi_get_queue(struct mbuf_set *ms)
Definition: multi.c:3642
D_MULTI_ERRORS
#define D_MULTI_ERRORS
Definition: errlevel.h:65
client_connect_defer_state::deferred_ret_file
char * deferred_ret_file
The temporary file name that contains the return status of the client-connect script if it exits with...
Definition: multi.h:82
multi_instance::wakeup
struct timeval wakeup
Definition: multi.h:113
argv_printf_cat
bool argv_printf_cat(struct argv *argres, const char *format,...)
printf() inspired argv concatenation.
Definition: argv.c:464
register_activity
static void register_activity(struct context *c, const int size)
Definition: forward.h:322
alloc_buf_gc
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition: buffer.c:88
openvpn_run_script
static int openvpn_run_script(const struct argv *a, const struct env_set *es, const unsigned int flags, const char *hook)
Will run a script and return the exit code of the script if between 0 and 255, -1 otherwise.
Definition: run_command.h:64
context_2::es
struct env_set * es
Definition: openvpn.h:423
multi_client_connect_call_plugin_v2
static enum client_connect_return multi_client_connect_call_plugin_v2(struct multi_context *m, struct multi_instance *mi, bool deferred, unsigned int *option_types_found)
Definition: multi.c:2191
multi_tcp_dereference_instance
void multi_tcp_dereference_instance(struct multi_tcp *mtcp, struct multi_instance *mi)
Definition: mtcp.c:236
argv_free
void argv_free(struct argv *a)
Frees all memory allocations allocated by the struct argv related functions.
Definition: argv.c:102
context_2::push_ifconfig_defined
bool push_ifconfig_defined
Definition: openvpn.h:431
vlan.h
remove_iroutes_from_push_route_list
void remove_iroutes_from_push_route_list(struct options *o)
Definition: push.c:1111
multi_uninit
void multi_uninit(struct multi_context *m)
Definition: multi.c:705
MPP_PRE_SELECT
#define MPP_PRE_SELECT
Definition: multi.h:287
IV_PROTO_TLS_KEY_EXPORT
#define IV_PROTO_TLS_KEY_EXPORT
Supports key derivation via TLS key material exporter [RFC5705].
Definition: ssl.h:86
context_2::push_ifconfig_local
in_addr_t push_ifconfig_local
Definition: openvpn.h:433
options::mode
int mode
Definition: options.h:247
hash_add
bool hash_add(struct hash *hash, const void *key, void *value, bool replace)
Definition: list.c:147
compute_wakeup_sigma
static unsigned int compute_wakeup_sigma(const struct timeval *delta)
Definition: multi.c:2972
multi_client_connect_setenv
static void multi_client_connect_setenv(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:1761
hash_element::value
void * value
Definition: list.h:45
CAS_PENDING
@ CAS_PENDING
Options import (Connect script/plugin, ccd,...)
Definition: ssl_common.h:564
get_primary_key
static const struct key_state * get_primary_key(const struct tls_multi *multi)
gets an item of key_state objects in the order they should be scanned by data channel modules.
Definition: ssl_common.h:722
pre_select
void pre_select(struct context *c)
Definition: forward.c:1997
management_callback::kill_by_cn
int(* kill_by_cn)(void *arg, const char *common_name)
Definition: manage.h:182
KS_AUTH_FALSE
@ KS_AUTH_FALSE
Key state is not authenticated
Definition: ssl_common.h:147
options::push_ifconfig_ipv6_local
struct in6_addr push_ifconfig_ipv6_local
Definition: options.h:505
management_client_pending_auth
static bool management_client_pending_auth(void *arg, const unsigned long cid, const unsigned int mda_key_id, const char *extra, unsigned int timeout)
Definition: multi.c:4022
hash_remove
static bool hash_remove(struct hash *hash, const void *key)
Definition: list.h:176
learn_address_script
static bool learn_address_script(const struct multi_context *m, const struct multi_instance *mi, const char *op, const struct mroute_addr *addr)
Definition: multi.c:93
key_ctx_bi::initialized
bool initialized
Definition: crypto.h:223
process_ip_header
void process_ip_header(struct context *c, unsigned int flags, struct buffer *buf)
Definition: forward.c:1667
dmsg
#define dmsg(flags,...)
Definition: error.h:148
ENABLE_MANAGEMENT
#define ENABLE_MANAGEMENT
Definition: config.h:53
multi_learn_in_addr_t
static struct multi_instance * multi_learn_in_addr_t(struct multi_context *m, struct multi_instance *mi, in_addr_t a, int netbits, bool primary)
Definition: multi.c:1230
options::ce
struct connection_entry ce
Definition: options.h:275
PERF_MULTI_CLOSE_INSTANCE
#define PERF_MULTI_CLOSE_INSTANCE
Definition: perf.h:46
set_cc_config
static void set_cc_config(struct multi_instance *mi, struct buffer_list *cc_config)
Definition: multi.c:74
hash_lookup
static void * hash_lookup(struct hash *hash, const void *key)
Definition: list.h:140
openvpn_sockaddr
Definition: socket.h:65
iroute::netbits
int netbits
Definition: route.h:236
SA_SET_IF_NONZERO
#define SA_SET_IF_NONZERO
Definition: socket.h:399
options::n_bcast_buf
int n_bcast_buf
Definition: options.h:492
context_2::buffers
struct context_buffers * buffers
Definition: openvpn.h:370
multi_close_instance_on_signal
void multi_close_instance_on_signal(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:3215
options::ifconfig_ipv6_pool_defined
bool ifconfig_ipv6_pool_defined
Definition: options.h:479
multi_unicast
static void multi_unicast(struct multi_context *m, const struct buffer *buf, struct multi_instance *mi)
Definition: multi.c:2902
multi_set_virtual_addr_env
static void multi_set_virtual_addr_env(struct multi_instance *mi)
Definition: multi.c:1590
multi_client_disconnect_script
static void multi_client_disconnect_script(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:573
event_timeout_init
static void event_timeout_init(struct event_timeout *et, interval_t n, const time_t last)
Initialises a timer struct.
Definition: interval.h:174
init_context_buffers
struct context_buffers * init_context_buffers(const struct frame *frame)
Definition: init.c:3642
TOP_SUBNET
#define TOP_SUBNET
Definition: proto.h:45
argv_parse_cmd
void argv_parse_cmd(struct argv *argres, const char *cmdstr)
Parses a command string, tokenizes it and puts each element into a separate struct argv argument slot...
Definition: argv.c:483
proto_is_dgram
static bool proto_is_dgram(int proto)
Return if the protocol is datagram (UDP)
Definition: socket.h:584
client_connect_defer_state::config_file
char * config_file
The temporary file name that contains the config directives returned by the client-connect script.
Definition: multi.h:88
multi_ifconfig_pool_persist
void multi_ifconfig_pool_persist(struct multi_context *m, bool force)
Definition: multi.c:163
reap_buckets_per_pass
static int reap_buckets_per_pass(int n_buckets)
Definition: multi.c:247
D_VLAN_DEBUG
#define D_VLAN_DEBUG
Definition: errlevel.h:154
mroute_addr::netbits
uint8_t netbits
Definition: mroute.h:79
MCF_SERVER
#define MCF_SERVER
Definition: manage.h:177
multi_context::schedule
struct schedule * schedule
Definition: multi.h:166
mroute_addr_hash_function
uint32_t mroute_addr_hash_function(const void *key, uint32_t iv)
Definition: mroute.c:361
context_2::link_socket_info
struct link_socket_info * link_socket_info
This variable is used instead link_socket->info for P2MP UDP childs.
Definition: openvpn.h:244
MODE_SERVER
#define MODE_SERVER
Definition: options.h:246
ccs_gen_deferred_ret_file
static bool ccs_gen_deferred_ret_file(struct multi_instance *mi)
Create a temporary file for the return value of client connect and puts it into the client_connect_de...
Definition: multi.c:1962
PERF_MULTI_CREATE_INSTANCE
#define PERF_MULTI_CREATE_INSTANCE
Definition: perf.h:45
client_connect_defer_state
Detached client connection state.
Definition: multi.h:70
dco_do_read
int dco_do_read(dco_context_t *dco)
Definition: dco_win.c:418
frame
Packet geometry parameters.
Definition: mtu.h:98
schedule_add_entry
static void schedule_add_entry(struct schedule *s, struct schedule_entry *e, const struct timeval *tv, unsigned int sigma)
Definition: schedule.h:98
multi_route::addr
struct mroute_addr addr
Definition: multi.h:230
tls_multi
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:590
context_2::to_link_addr
struct link_socket_actual * to_link_addr
Definition: openvpn.h:247
OVPN_DEL_PEER_REASON_TRANSPORT_ERROR
@ OVPN_DEL_PEER_REASON_TRANSPORT_ERROR
Definition: ovpn_dco_linux.h:74
multi_route::last_reference
time_t last_reference
Definition: multi.h:238
MAX_PEER_ID
#define MAX_PEER_ID
Definition: openvpn.h:549
PIP_MSSFIX
#define PIP_MSSFIX
Definition: forward.h:296
multi_reap::last_call
time_t last_call
Definition: multi.h:55
setenv_int
void setenv_int(struct env_set *es, const char *name, int value)
Definition: env_set.c:267
CAS_FAILED
@ CAS_FAILED
Option import failed or explicitly denied the client.
Definition: ssl_common.h:567
mroute_helper::net_len
uint8_t net_len[MR_HELPER_NET_LEN]
Definition: mroute.h:135
route_quota_exceeded
void route_quota_exceeded(const struct multi_instance *mi)
Definition: multi.c:3729
management_show_net_callback
void management_show_net_callback(void *arg, const int msglevel)
Definition: init.c:4207
key_state::authenticated
enum ks_auth_state authenticated
Definition: ssl_common.h:250
multi_process_per_second_timers_dowork
void multi_process_per_second_timers_dowork(struct multi_context *m)
Definition: multi.c:3787
setenv_counter
void setenv_counter(struct env_set *es, const char *name, counter_type value)
Definition: env_set.c:259
multi_bcast
static void multi_bcast(struct multi_context *m, const struct buffer *buf, const struct multi_instance *sender_instance, const struct mroute_addr *sender_addr, uint16_t vid)
Definition: multi.c:2921
multi_context::enable_c2c
bool enable_c2c
Definition: multi.h:178
iroute_ipv6::network
struct in6_addr network
Definition: route.h:241
key_state
Security parameter state of one TLS and data channel key session.
Definition: ssl_common.h:198
multi_client_connect_mda
enum client_connect_return multi_client_connect_mda(struct multi_context *m, struct multi_instance *mi, bool deferred, unsigned int *option_types_found)
Definition: multi.c:1722
context_2::push_request_received
bool push_request_received
Definition: openvpn.h:430
initial_rate_limit_init
struct initial_packet_rate_limit * initial_rate_limit_init(int max_per_period, int period_length)
allocate and initialize the initial-packet rate limiter structure
Definition: reflect_filter.c:86
buf_reset_len
static void buf_reset_len(struct buffer *buf)
Definition: buffer.h:312
key
Container for unidirectional cipher and HMAC key material.
Definition: crypto.h:149
context_2::link_read_bytes
counter_type link_read_bytes
Definition: openvpn.h:269
CAS_WAITING_AUTH
@ CAS_WAITING_AUTH
Initial TLS connection established but deferred auth is not yet finished.
Definition: ssl_common.h:563
multi_route::instance
struct multi_instance * instance
Definition: multi.h:231
iroute::next
struct iroute * next
Definition: route.h:237
multi_signal_instance
static void multi_signal_instance(struct multi_context *m, struct multi_instance *mi, const int sig)
Definition: multi.c:3226
np
static const char * np(const char *str)
Definition: multi-auth.c:146
multi_context::max_clients
int max_clients
Definition: multi.h:179
multi_context::new_connection_limiter
struct frequency_limit * new_connection_limiter
Definition: multi.h:173
IFCONFIG_POOL_30NET
@ IFCONFIG_POOL_30NET
Definition: pool.h:37
plugin_call
static int plugin_call(const struct plugin_list *pl, const int type, const struct argv *av, struct plugin_return *pr, struct env_set *es)
Definition: plugin.h:202
hash_iterator_free
void hash_iterator_free(struct hash_iterator *hi)
Definition: list.c:283
MULTI_CACHE_ROUTE_TTL
#define MULTI_CACHE_ROUTE_TTL
Definition: multi.h:575
multi_client_connect_call_script
static enum client_connect_return multi_client_connect_call_script(struct multi_context *m, struct multi_instance *mi, bool deferred, unsigned int *option_types_found)
Runs the –client-connect script if one is defined.
Definition: multi.c:2288
CLEAR
#define CLEAR(x)
Definition: basic.h:33
IV_PROTO_REQUEST_PUSH
#define IV_PROTO_REQUEST_PUSH
Assume client will send a push request and server does not need to wait for a push-request to send a ...
Definition: ssl.h:83
multi_context::cid_counter
unsigned long cid_counter
Definition: multi.h:186
tls_multi::multi_state
enum multi_status multi_state
Definition: ssl_common.h:612
TUNNEL_TYPE
#define TUNNEL_TYPE(tt)
Definition: tun.h:173
multi_context::deferred_shutdown_signal
struct deferred_signal_schedule_entry deferred_shutdown_signal
Definition: multi.h:211
clear_prefix
static void clear_prefix(void)
Definition: multi.h:549
iroute::network
in_addr_t network
Definition: route.h:235
multi_instance_dec_refcount
static void multi_instance_dec_refcount(struct multi_instance *mi)
Definition: multi.h:484
ssl_util.h
context::c2
struct context_2 c2
Level 2 context.
Definition: openvpn.h:517
MR_ADDR_IPV6
#define MR_ADDR_IPV6
Definition: mroute.h:63
mroute_helper_free
void mroute_helper_free(struct mroute_helper *mh)
Definition: mroute.c:540
context_2::push_ifconfig_ipv6_remote
struct in6_addr push_ifconfig_ipv6_remote
Definition: openvpn.h:440
push_option
void push_option(struct options *o, const char *opt, int msglevel)
Definition: push.c:869
mroute_helper_del_iroute46
void mroute_helper_del_iroute46(struct mroute_helper *mh, int netbits)
Definition: mroute.c:524
TM_ACTIVE
#define TM_ACTIVE
Active tls_session.
Definition: ssl_common.h:529
options::max_clients
int max_clients
Definition: options.h:518
string_alloc
char * string_alloc(const char *str, struct gc_arena *gc)
Definition: buffer.c:667
tls_update_remote_addr
void tls_update_remote_addr(struct tls_multi *multi, const struct link_socket_actual *addr)
Updates remote address in TLS sessions.
Definition: ssl.c:4033
multi_context::instances
struct multi_instance ** instances
Array of multi_instances.
Definition: multi.h:156
tls_multi::remote_usescomp
bool remote_usescomp
remote announced comp-lzo in OCC string
Definition: ssl_common.h:670
ssl_verify.h
options::dev
const char * dev
Definition: options.h:303
ASSERT
#define ASSERT(x)
Definition: error.h:195
CAS_NOT_CONNECTED
@ CAS_NOT_CONNECTED
Definition: ssl_common.h:562
tls_session_soft_reset
void tls_session_soft_reset(struct tls_multi *tls_multi)
Definition: ssl.c:1772
route_quota_inc
static void route_quota_inc(struct multi_instance *mi)
Definition: multi.h:447
tuntap::local_ipv6
struct in6_addr local_ipv6
Definition: tun.h:192
print_in6_addr
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2924
D_ROUTE_QUOTA
#define D_ROUTE_QUOTA
Definition: errlevel.h:90
read
@ read
Definition: interactive.c:218
iroute_ipv6::netbits
unsigned int netbits
Definition: route.h:242
platform_test_file
bool platform_test_file(const char *filename)
Return true if filename can be opened for read.
Definition: platform.c:673
tls_username
const char * tls_username(const struct tls_multi *multi, const bool null)
Returns the username field for the given tunnel.
Definition: ssl_verify.c:177
buffer_entry::buf
struct buffer buf
Definition: buffer.h:1121
D_DCO
#define D_DCO
Definition: errlevel.h:94
multi_init
void multi_init(struct multi_context *m, struct context *t, bool tcp_mode)
Definition: multi.c:292
multi_instance::cc_config
struct buffer_list * cc_config
Definition: multi.h:131
hash_iterator_next
struct hash_element * hash_iterator_next(struct hash_iterator *hi)
Definition: list.c:289
multi_context::top
struct context top
Storage structure for process-wide configuration.
Definition: multi.h:195
mbuf_add_item
void mbuf_add_item(struct mbuf_set *ms, const struct mbuf_item *item)
Definition: mbuf.c:89
management_kill_by_cid
static bool management_kill_by_cid(void *arg, const unsigned long cid, const char *kill_msg)
Definition: multi.c:4005
multi_reap_process_dowork
void multi_reap_process_dowork(const struct multi_context *m)
Definition: multi.c:225
options::cf_initial_max
int cf_initial_max
Definition: options.h:515
options::ping_send_timeout
int ping_send_timeout
Definition: options.h:335
tls_lock_common_name
void tls_lock_common_name(struct tls_multi *multi)
Locks the common name field for the given tunnel.
Definition: ssl_verify.c:138
encrypt_sign
void encrypt_sign(struct context *c, bool comp_frag)
Process a data channel packet that will be sent through a VPN tunnel.
Definition: forward.c:646
multi_client_connect_handler
enum client_connect_return(* multi_client_connect_handler)(struct multi_context *m, struct multi_instance *mi, bool from_deferred, unsigned int *option_types_found)
Definition: multi.c:2662
tls_peer_ncp_list
const char * tls_peer_ncp_list(const char *peer_info, struct gc_arena *gc)
Returns the support cipher list from the peer according to the IV_NCP and IV_CIPHER values in peer_in...
Definition: ssl_ncp.c:227
multi_context::status_file_version
int status_file_version
Definition: multi.h:181
multi_connection_established
static void multi_connection_established(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:2695
mroute_addr::addr
uint8_t addr[OPENVPN_ETH_ALEN]
Definition: mroute.h:84
BLEN
#define BLEN(buf)
Definition: buffer.h:127
multi_reap_free
static void multi_reap_free(struct multi_reap *mr)
Definition: multi.c:238
hash_add_fast
static void hash_add_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv, void *value)
Definition: list.h:158
COMP_F_MIGRATE
#define COMP_F_MIGRATE
Definition: comp.h:40
multi_assign_peer_id
void multi_assign_peer_id(struct multi_context *m, struct multi_instance *mi)
Assigns a peer-id to a a client and adds the instance to the the instances array of the multi_context...
Definition: multi.c:4144
status_reset
void status_reset(struct status_output *so)
Definition: status.c:148
management_callback::kill_by_cid
bool(* kill_by_cid)(void *arg, const unsigned long cid, const char *kill_msg)
Definition: manage.h:187
options::ifconfig_ipv6_netbits
int ifconfig_ipv6_netbits
Definition: options.h:311
options::ncp_ciphers
const char * ncp_ciphers
Definition: options.h:559
options::push_ifconfig_ipv6_defined
bool push_ifconfig_ipv6_defined
Definition: options.h:504
tunnel_server_tcp
void tunnel_server_tcp(struct context *top)
Main event loop for OpenVPN in TCP server mode.
Definition: mtcp.c:789
multi_context::local
struct mroute_addr local
Definition: multi.h:177
management_notify_client_close
void management_notify_client_close(struct management *management, struct man_def_auth_context *mdac, const struct env_set *es)
Definition: manage.c:2985
MPP_CONDITIONAL_PRE_SELECT
#define MPP_CONDITIONAL_PRE_SELECT
Definition: multi.h:288
PIPV4_PASSTOS
#define PIPV4_PASSTOS
Definition: forward.h:295
ALLOC_OBJ
#define ALLOC_OBJ(dptr, type)
Definition: buffer.h:1060
ccs_delete_deferred_ret_file
static void ccs_delete_deferred_ret_file(struct multi_instance *mi)
Delete the temporary file for the return value of client connect It also removes it from client_conne...
Definition: multi.c:1936
buf_write_u8
static bool buf_write_u8(struct buffer *dest, uint8_t data)
Definition: buffer.h:697
options::comp
struct compress_options comp
Definition: options.h:395
multi_process_timeout
bool multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags)
Definition: multi.c:3676
frame::payload_size
int payload_size
the maximum size that a payload that our buffers can hold from either tun device or network link.
Definition: mtu.h:102
cid_hash_function
static uint32_t cid_hash_function(const void *key, uint32_t iv)
Definition: multi.c:255
tunnel_server
void tunnel_server(struct context *top)
Main event loop for OpenVPN in server mode.
Definition: multi.c:4169
options::imported_protocol_flags
unsigned int imported_protocol_flags
Definition: options.h:704
multi_close_instance
void multi_close_instance(struct multi_context *m, struct multi_instance *mi, bool shutdown)
Definition: multi.c:602
ANY_OUT
#define ANY_OUT(c)
Definition: forward.h:40
hash_element::key
const void * key
Definition: list.h:46
tls_session::key
struct key_state key[KS_SIZE]
Definition: ssl_common.h:509
openvpn_sockaddr::in4
struct sockaddr_in in4
Definition: socket.h:70
multi_client_generate_tls_keys
static bool multi_client_generate_tls_keys(struct context *c)
Generates the data channel keys.
Definition: multi.c:2389
ungenerate_prefix
void ungenerate_prefix(struct multi_instance *mi)
Definition: multi.c:513
send_auth_pending_messages
bool send_auth_pending_messages(struct tls_multi *tls_multi, struct tls_session *session, const char *extra, unsigned int timeout)
Sends the auth pending control messages to a client.
Definition: push.c:438
mroute_addr_init
void mroute_addr_init(struct mroute_addr *addr)
Definition: mroute.c:39
multi_tcp_instance_specific_init
bool multi_tcp_instance_specific_init(struct multi_context *m, struct multi_instance *mi)
Definition: mtcp.c:171
buffer_entry::next
struct buffer_entry * next
Definition: buffer.h:1122
plugin_return_free
void plugin_return_free(struct plugin_return *pr)
Definition: plugin.c:1015
multi_context::cid_hash
struct hash * cid_hash
Definition: multi.h:185
mbuf_free
void mbuf_free(struct mbuf_set *ms)
Definition: mbuf.c:49
push.h
reschedule_multi_process
void reschedule_multi_process(struct context *c)
Reschedule tls_multi_process.
Definition: forward.c:424
multi_push_restart_schedule_exit
static void multi_push_restart_schedule_exit(struct multi_context *m, bool next_server)
Definition: multi.c:3836
context_2::dco_write_bytes
counter_type dco_write_bytes
Definition: openvpn.h:273
M_WARN
#define M_WARN
Definition: error.h:91
OPENVPN_PLUGIN_FUNC_DEFERRED
#define OPENVPN_PLUGIN_FUNC_DEFERRED
Definition: openvpn-plugin.h:150
plugin_return::n
int n
Definition: plugin.h:103
options::push_ifconfig_defined
bool push_ifconfig_defined
Definition: options.h:496
perf_pop
static void perf_pop(void)
Definition: perf.h:82
multi_instance_inc_refcount
static void multi_instance_inc_refcount(struct multi_instance *mi)
Definition: multi.h:478
MF_UNICAST
#define MF_UNICAST
Definition: mbuf.h:46
vlan_decapsulate
int16_t vlan_decapsulate(const struct context *c, struct buffer *buf)
Definition: vlan.c:82
D_GREMLIN
#define D_GREMLIN
Definition: errlevel.h:78
mroute_addr::port
in_port_t port
Definition: mroute.h:89
hash_lookup_fast
struct hash_element * hash_lookup_fast(struct hash *hash, struct hash_bucket *bucket, const void *key, uint32_t hv)
Definition: list.c:83
context::options
struct options options
Options loaded from command line or configuration file.
Definition: openvpn.h:478
fragment_master::outgoing
struct buffer outgoing
Buffer containing the remaining parts of the fragmented packet being sent.
Definition: fragment.h:172
multi_context::mpp_touched
struct multi_instance ** mpp_touched
Definition: multi.h:191
do_deferred_options
bool do_deferred_options(struct context *c, const unsigned int found)
Definition: init.c:2593
options::push_ifconfig_constraint_defined
bool push_ifconfig_constraint_defined
Definition: options.h:500
status_printf
void status_printf(struct status_output *so, const char *format,...)
Definition: status.c:222
D_MULTI_LOW
#define D_MULTI_LOW
Definition: errlevel.h:86
options
Definition: options.h:236
context_2::push_ifconfig_local_alias
in_addr_t push_ifconfig_local_alias
Definition: openvpn.h:435
tls_multi::dco_peer_id
int dco_peer_id
This is the handle that DCO uses to identify this session with the kernel.
Definition: ssl_common.h:690
multi_schedule_context_wakeup
static void multi_schedule_context_wakeup(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:2994
options::gc
struct gc_arena gc
Definition: options.h:238
throw_signal
void throw_signal(const int signum)
Throw a hard signal.
Definition: sig.c:177
OPT_P_COMP
#define OPT_P_COMP
Definition: options.h:722
mroute_helper::cache_generation
unsigned int cache_generation
Definition: mroute.h:132
options_string_import
void options_string_import(struct options *options, const char *config, const int msglevel, const unsigned int permission_mask, unsigned int *option_types_found, struct env_set *es)
Definition: options.c:5553
multi.h
is_cas_pending
static bool is_cas_pending(enum multi_status cas)
Definition: openvpn.h:211
CCD_DEFAULT
#define CCD_DEFAULT
Definition: common.h:62
multi_context::hash
struct hash * hash
VPN tunnel instances indexed by real address of the remote peer.
Definition: multi.h:159
pool_type
pool_type
Definition: pool.h:35
dco_context_t
void * dco_context_t
Definition: dco.h:254
multi_instance::reporting_addr_ipv6
struct in6_addr reporting_addr_ipv6
Definition: multi.h:125
status_output
Definition: status.h:48
management_callback::show_net
void(* show_net)(void *arg, const int msglevel)
Definition: manage.h:181
mbuf_item::instance
struct multi_instance * instance
Definition: mbuf.h:53
management_callback::arg
void * arg
Definition: manage.h:175
options::virtual_hash_size
int virtual_hash_size
Definition: options.h:484
multi_instance::did_cid_hash
bool did_cid_hash
Definition: multi.h:130
multi_reap
Definition: multi.h:51
options::ifconfig_pool_netmask
in_addr_t ifconfig_pool_netmask
Definition: options.h:475
multi_select_virtual_addr
static void multi_select_virtual_addr(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:1450
multi_context::pending
struct multi_instance * pending
Definition: multi.h:189
context_2::push_ifconfig_ipv6_netbits
int push_ifconfig_ipv6_netbits
Definition: openvpn.h:439
context_2::frame_fragment
struct frame frame_fragment
Definition: openvpn.h:256
compress_options::flags
unsigned int flags
Definition: comp.h:67
options::push_ifconfig_ipv6_netbits
int push_ifconfig_ipv6_netbits
Definition: options.h:506
multi_reap_new
static struct multi_reap * multi_reap_new(int buckets_per_pass)
Definition: multi.c:214
multi_process_post
bool multi_process_post(struct multi_context *m, struct multi_instance *mi, const unsigned int flags)
Perform postprocessing of a VPN tunnel instance.
Definition: multi.c:3041
OVPN_DEL_PEER_REASON_USERSPACE
@ OVPN_DEL_PEER_REASON_USERSPACE
Definition: ovpn_dco_linux.h:72
DEV_TYPE_TAP
#define DEV_TYPE_TAP
Definition: proto.h:38
ifconfig_pool_write
void ifconfig_pool_write(struct ifconfig_pool_persist *persist, const struct ifconfig_pool *pool)
Definition: pool.c:733
options::stale_routes_check_interval
int stale_routes_check_interval
Definition: options.h:520
mbuf_buffer::buf
struct buffer buf
Definition: mbuf.h:43
options::ping_rec_timeout
int ping_rec_timeout
Definition: options.h:336
mroute_extract_openvpn_sockaddr
bool mroute_extract_openvpn_sockaddr(struct mroute_addr *addr, const struct openvpn_sockaddr *osaddr, bool use_port)
Definition: mroute.c:264
multi_context::vhash
struct hash * vhash
VPN tunnel instances indexed by virtual address of remote hosts.
Definition: multi.h:161
get_link_socket_info
static struct link_socket_info * get_link_socket_info(struct context *c)
Definition: forward.h:309
tls_multi::peer_info
char * peer_info
Definition: ssl_common.h:643
tls_session_update_crypto_params
bool tls_session_update_crypto_params(struct tls_multi *multi, struct tls_session *session, struct options *options, struct frame *frame, struct frame *frame_fragment, struct link_socket_info *lsi)
Update TLS session crypto parameters (cipher and auth) and derive data channel keys based on the supp...
Definition: ssl.c:1638
buffer
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
multi_create_instance
struct multi_instance * multi_create_instance(struct multi_context *m, const struct mroute_addr *real)
Definition: multi.c:753
deferred_signal_schedule_entry::signal_received
int signal_received
Definition: multi.h:62
argv::gc
struct gc_arena gc
Definition: argv.h:36
PERF_PROC_IN_LINK
#define PERF_PROC_IN_LINK
Definition: perf.h:52
multi_context::earliest_wakeup
struct multi_instance * earliest_wakeup
Definition: multi.h:190
multi_get_create_instance_udp
struct multi_instance * multi_get_create_instance_udp(struct multi_context *m, bool *floated)
Get, and if necessary create, the multi_instance associated with a packet's source address.
Definition: mudp.c:188
openvpn_plugin_string_list::value
char * value
Definition: openvpn-plugin.h:194
IFCONFIG_POOL_INDIV
@ IFCONFIG_POOL_INDIV
Definition: pool.h:38
dco_set_peer
int dco_set_peer(dco_context_t *dco, unsigned int peerid, int keepalive_interval, int keepalive_timeout, int mss)
Definition: dco_win.c:272
multi_get_instance_by_virtual_addr
static struct multi_instance * multi_get_instance_by_virtual_addr(struct multi_context *m, const struct mroute_addr *addr, bool cidr_routing)
Definition: multi.c:1151
options::push_ifconfig_ipv6_remote
struct in6_addr push_ifconfig_ipv6_remote
Definition: options.h:507
cert_hash_compare
bool cert_hash_compare(const struct cert_hash_set *chs1, const struct cert_hash_set *chs2)
Compares certificates hashes, returns true if hashes are equal.
Definition: ssl_verify.c:234
plugin_return_defined
static bool plugin_return_defined(const struct plugin_return *pr)
Definition: plugin.h:165
multi_instance::vaddr_handle
ifconfig_pool_handle vaddr_handle
Definition: multi.h:116
tls_lock_cert_hash_set
void tls_lock_cert_hash_set(struct tls_multi *multi)
Locks the certificate hash set used in the given tunnel.
Definition: ssl_verify.c:292
CO_USE_DYNAMIC_TLS_CRYPT
#define CO_USE_DYNAMIC_TLS_CRYPT
Bit-flag indicating that renegotiations are using tls-crypt with a TLS-EKM derived key.
Definition: crypto.h:278
D_TLS_ERRORS
#define D_TLS_ERRORS
Definition: errlevel.h:59
hash_iterator_delete_element
void hash_iterator_delete_element(struct hash_iterator *hi)
Definition: list.c:321
tls_authenticate_key
bool tls_authenticate_key(struct tls_multi *multi, const unsigned int mda_key_id, const bool auth, const char *client_reason)
Definition: ssl_verify.c:1251
multi_route::flags
unsigned int flags
Definition: multi.h:235
print_in_addr_t
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
Definition: socket.c:2904
options::status_file_version
int status_file_version
Definition: options.h:389
mbuf_item
Definition: mbuf.h:50
schedule_remove_entry
void schedule_remove_entry(struct schedule *s, struct schedule_entry *e)
Definition: schedule.c:427
multi_instance::msg_prefix
char msg_prefix[MULTI_PREFIX_MAX_LENGTH]
Definition: multi.h:117
management_callback::client_pending_auth
bool(* client_pending_auth)(void *arg, const unsigned long cid, const unsigned int kid, const char *extra, unsigned int timeout)
Definition: manage.h:195
auth_deferred_status::auth_control_file
char * auth_control_file
Definition: ssl_common.h:159
platform_unlink
bool platform_unlink(const char *filename)
Definition: platform.c:501
multi_set_pending
static void multi_set_pending(struct multi_context *m, struct multi_instance *mi)
Definition: multi.h:692
mroute_addr::vid
uint16_t vid
Definition: mroute.h:85
OVPN_DEL_PEER_REASON_EXPIRED
@ OVPN_DEL_PEER_REASON_EXPIRED
Definition: ovpn_dco_linux.h:73
check_stale_routes
static void check_stale_routes(struct multi_context *m)
Definition: multi.c:1401
dco_delete_iroutes
static void dco_delete_iroutes(struct multi_context *m, struct multi_instance *mi)
Definition: dco.h:361
REAP_MAX
#define REAP_MAX
Definition: multi.h:569
tls_session
Security parameter state of a single session within a VPN tunnel.
Definition: ssl_common.h:471
env_set_create
struct env_set * env_set_create(struct gc_arena *gc)
Definition: env_set.c:156
management_callback::status
void(* status)(void *arg, const int version, struct status_output *so)
Definition: manage.h:180
context_2::timeval
struct timeval timeval
Time to next event of timers and similar.
Definition: openvpn.h:399
signal_reset
int signal_reset(struct signal_info *si, int signum)
Clear the signal if its current value equals signum.
Definition: sig.c:266
key_state::mda_key_id
unsigned int mda_key_id
Definition: ssl_common.h:254
status_close
bool status_close(struct status_output *so)
Definition: status.c:188
frame::buf
struct frame::@6 buf
context_2::frame
struct frame frame
Definition: openvpn.h:251
context_2::link_socket
struct link_socket * link_socket
Definition: openvpn.h:240
mroute_addr
Definition: mroute.h:75
multi_client_connect_late_setup
static void multi_client_connect_late_setup(struct multi_context *m, struct multi_instance *mi, const unsigned int option_types_found)
Definition: multi.c:2412
CAS_CONNECT_DONE
@ CAS_CONNECT_DONE
Definition: ssl_common.h:573
multi_process_incoming_tun
bool multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags)
Determine the destination VPN tunnel of a packet received over the virtual tun/tap network interface ...
Definition: multi.c:3547
management_connection_established
void management_connection_established(struct management *management, struct man_def_auth_context *mdac, const struct env_set *es)
Definition: manage.c:2974
options::force_key_material_export
bool force_key_material_export
Definition: options.h:691
syshead.h
multi_reap_range
static void multi_reap_range(const struct multi_context *m, int start_bucket, int end_bucket)
Definition: multi.c:175
mbuf_alloc_buf
struct mbuf_buffer * mbuf_alloc_buf(const struct buffer *buf)
Definition: mbuf.c:65
inherit_context_child
void inherit_context_child(struct context *dest, const struct context *src)
Definition: init.c:4786
D_PUSH
#define D_PUSH
Definition: errlevel.h:83
hash_iterator_init
void hash_iterator_init(struct hash *hash, struct hash_iterator *hi)
Definition: list.c:246
schedule_entry
Definition: schedule.h:44
TUNNEL_TOPOLOGY
#define TUNNEL_TOPOLOGY(tt)
Definition: tun.h:176
tv_add
static void tv_add(struct timeval *dest, const struct timeval *src)
Definition: otime.h:132
management_callback_kill_by_cn
static int management_callback_kill_by_cn(void *arg, const char *del_cn)
Definition: multi.c:3924
options::client_config_dir
const char * client_config_dir
Definition: options.h:489
PIPV6_ICMP_NOHOST_SERVER
#define PIPV6_ICMP_NOHOST_SERVER
Definition: forward.h:301
initial_rate_limit_free
void initial_rate_limit_free(struct initial_packet_rate_limit *irl)
free the initial-packet rate limiter structure
Definition: reflect_filter.c:102
gc_arena
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
mbuf_maximum_queued
static int mbuf_maximum_queued(const struct mbuf_set *ms)
Definition: mbuf.h:92
context::sig
struct signal_info * sig
Internal error signaling object.
Definition: openvpn.h:503
iroute_ipv6::next
struct iroute_ipv6 * next
Definition: route.h:243
mroute_addr_print
const char * mroute_addr_print(const struct mroute_addr *ma, struct gc_arena *gc)
Definition: mroute.c:376
setenv_str
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition: env_set.c:283
mbuf_buffer
Definition: mbuf.h:41
ifconfig_pool_write_trigger
bool ifconfig_pool_write_trigger(struct ifconfig_pool_persist *persist)
Definition: pool.c:585
options::vlan_pvid
uint16_t vlan_pvid
Definition: options.h:695
ccs_test_deferred_ret_file
static enum client_connect_return ccs_test_deferred_ret_file(struct multi_instance *mi)
Tests whether the deferred return value file exists and returns the contained return value.
Definition: multi.c:1995
mbuf_buffer::flags
unsigned int flags
Definition: mbuf.h:47
check_compression_settings_valid
bool check_compression_settings_valid(struct compress_options *info, int msglevel)
Checks if the compression settings are valid.
Definition: comp.c:163
IV_PROTO_DYN_TLS_CRYPT
#define IV_PROTO_DYN_TLS_CRYPT
Support to dynamic tls-crypt (renegotiation with TLS-EKM derived tls-crypt key)
Definition: ssl.h:107
ifconfig_pool_acquire
ifconfig_pool_handle ifconfig_pool_acquire(struct ifconfig_pool *pool, in_addr_t *local, in_addr_t *remote, struct in6_addr *remote_ipv6, const char *common_name)
Definition: pool.c:306
route
@ route
Definition: interactive.c:87
multi_route
Definition: multi.h:228
multi_client_connect_script_deferred
static enum client_connect_return multi_client_connect_script_deferred(struct multi_context *m, struct multi_instance *mi, unsigned int *option_types_found)
Definition: multi.c:2245
strncpynt
static void strncpynt(char *dest, const char *src, size_t maxlen)
Definition: buffer.h:361
env_set
Definition: env_set.h:42
multi_instance::did_iter
bool did_iter
Definition: multi.h:128
status_flush
void status_flush(struct status_output *so)
Definition: status.c:157
key_state::plugin_auth
struct auth_deferred_status plugin_auth
Definition: ssl_common.h:259
multi_tcp_free
void multi_tcp_free(struct multi_tcp *mtcp)
Definition: mtcp.c:225
cid_compare_function
static bool cid_compare_function(const void *key1, const void *key2)
Definition: multi.c:262
setenv_in6_addr
void setenv_in6_addr(struct env_set *es, const char *name_prefix, const struct in6_addr *addr, const unsigned int flags)
Definition: socket.c:3044
plugin_list
Definition: plugin.h:94
multi_context
Main OpenVPN server state structure.
Definition: multi.h:155
argv_new
struct argv argv_new(void)
Allocates a new struct argv and ensures it is initialised.
Definition: argv.c:88
inherit_context_top
void inherit_context_top(struct context *dest, const struct context *src)
Definition: init.c:4864
counter_format
#define counter_format
Definition: common.h:31
free_context_buffers
void free_context_buffers(struct context_buffers *b)
Definition: init.c:3667
TOP_P2P
#define TOP_P2P
Definition: proto.h:44
init_management_callback_multi
void init_management_callback_multi(struct multi_context *m)
Definition: multi.c:4119
dco_enabled
static bool dco_enabled(const struct options *o)
Returns whether the current configuration has dco enabled.
Definition: options.h:907
argv_printf
bool argv_printf(struct argv *argres, const char *format,...)
printf() variant which populates a struct argv.
Definition: argv.c:440
multi_top_init
void multi_top_init(struct multi_context *m, struct context *top)
Definition: multi.c:3816
ifconfig_pool_free
void ifconfig_pool_free(struct ifconfig_pool *pool)
Definition: pool.c:290
dco.h
man_def_auth_context::cid
unsigned long cid
Definition: manage.h:65
check_debug_level
static bool check_debug_level(unsigned int level)
Definition: error.h:220
tls_multi::use_peer_id
bool use_peer_id
Definition: ssl_common.h:667
plugin_return_get_column
void plugin_return_get_column(const struct plugin_return *src, struct plugin_return *dest, const char *colname)
Definition: plugin.c:1000
client_connect_handlers
static const multi_client_connect_handler client_connect_handlers[]
Definition: multi.c:2665
hash_free
void hash_free(struct hash *hash)
Definition: list.c:63
ETT_DEFAULT
#define ETT_DEFAULT
Definition: interval.h:224
mroute_addr::v6
struct mroute_addr::@1::@4 v6
platform_gen_path
const char * platform_gen_path(const char *directory, const char *filename, struct gc_arena *gc)
Put a directory and filename together.
Definition: platform.c:607
options::ifconfig_pool_end
in_addr_t ifconfig_pool_end
Definition: options.h:474
management_client_auth
static bool management_client_auth(void *arg, const unsigned long cid, const unsigned int mda_key_id, const bool auth, const char *reason, const char *client_reason, struct buffer_list *cc_config)
Definition: multi.c:4061
multi_output_queue_ready
static bool multi_output_queue_ready(const struct multi_context *m, const struct multi_instance *mi)
Definition: multi.h:406
ncp_get_best_cipher
char * ncp_get_best_cipher(const char *server_list, const char *peer_info, const char *remote_cipher, struct gc_arena *gc)
Iterates through the ciphers in server_list and return the first cipher that is also supported by the...
Definition: ssl_ncp.c:248
COMP_ALG_STUB
#define COMP_ALG_STUB
Definition: comp.h:46
client_connect_defer_state::cur_handler_index
int cur_handler_index
Definition: multi.h:73
management_delete_event
static void management_delete_event(void *arg, event_t event)
Definition: multi.c:3981
client_connect_return
client_connect_return
Return values used by the client connect call-back functions.
Definition: multi.h:217
D_MULTI_DROPPED
#define D_MULTI_DROPPED
Definition: errlevel.h:101
send_restart
void send_restart(struct context *c, const char *kill_msg)
Definition: push.c:495
tuntap::local
in_addr_t local
Definition: tun.h:189
schedule_init
struct schedule * schedule_init(void)
Definition: schedule.c:412
context_2::mda_context
struct man_def_auth_context mda_context
Definition: openvpn.h:456
mstats.h
event_timeout_trigger
bool event_timeout_trigger(struct event_timeout *et, struct timeval *tv, const int et_const_retry)
This is the principal function for testing and triggering recurring timers.
Definition: interval.c:43
context_2::to_tun
struct buffer to_tun
Definition: openvpn.h:379
frame::mss_fix
uint16_t mss_fix
The actual MSS value that should be written to the payload packets.
Definition: mtu.h:118
IS_SIG
#define IS_SIG(c)
Definition: sig.h:48
multi_context::iter
struct hash * iter
VPN tunnel instances indexed by real address of the remote peer, optimized for iteration.
Definition: multi.h:163
IV_PROTO_NCP_P2P
#define IV_PROTO_NCP_P2P
Support doing NCP in P2P mode.
Definition: ssl.h:94
multi_tcp_init
struct multi_tcp * multi_tcp_init(int maxevents, int *maxclients)
Definition: mtcp.c:197
options::ifconfig_pool_defined
bool ifconfig_pool_defined
Definition: options.h:472
OPENVPN_PLUGIN_CLIENT_DISCONNECT
#define OPENVPN_PLUGIN_CLIENT_DISCONNECT
Definition: openvpn-plugin.h:124
mroute_helper_add_iroute46
void mroute_helper_add_iroute46(struct mroute_helper *mh, int netbits)
Definition: mroute.c:509
key_state::script_auth
struct auth_deferred_status script_auth
Definition: ssl_common.h:260
client_connect_defer_state::option_types_found
unsigned int option_types_found
Definition: multi.h:76
context_2::fragment
struct fragment_master * fragment
Definition: openvpn.h:255
mbuf_free_buf
void mbuf_free_buf(struct mbuf_buffer *mb)
Definition: mbuf.c:76
otime.h
tuntap::dco
dco_context_t dco
Definition: tun.h:234
is_exit_restart
static bool is_exit_restart(int sig)
Definition: multi.c:3830
context_2::dco_read_bytes
counter_type dco_read_bytes
Definition: openvpn.h:270
iroute_ipv6
Definition: route.h:240
openvpn_gettimeofday
static int openvpn_gettimeofday(struct timeval *tv, void *tz)
Definition: otime.h:64
management_get_peer_info
static char * management_get_peer_info(void *arg, const unsigned long cid)
Definition: multi.c:4101
multi_process_drop_outgoing_tun
void multi_process_drop_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags)
Definition: multi.c:3707
auth_set_client_reason
void auth_set_client_reason(struct tls_multi *multi, const char *client_reason)
Sets the reason why authentication of a client failed.
Definition: ssl_verify.c:817
context_2::push_ifconfig_remote_netmask
in_addr_t push_ifconfig_remote_netmask
Definition: openvpn.h:434
REAP_DIVISOR
#define REAP_DIVISOR
Definition: multi.h:567
print_link_socket_actual
const char * print_link_socket_actual(const struct link_socket_actual *act, struct gc_arena *gc)
Definition: socket.c:2823
options::push_ifconfig_remote_netmask
in_addr_t push_ifconfig_remote_netmask
Definition: options.h:498
management
Definition: manage.h:335
mroute_helper
Definition: mroute.h:131
hash_element
Definition: list.h:43
min_int
static int min_int(int x, int y)
Definition: integer.h:89
multi_learn_addr
static struct multi_instance * multi_learn_addr(struct multi_context *m, struct multi_instance *mi, const struct mroute_addr *addr, const unsigned int flags)
Definition: multi.c:1058
gc_free
static void gc_free(struct gc_arena *a)
Definition: buffer.h:1038
mroute_addr::type
uint8_t type
Definition: mroute.h:78
CC_RET_SKIPPED
@ CC_RET_SKIPPED
Definition: multi.h:222
multi_client_connect_post_plugin
static void multi_client_connect_post_plugin(struct multi_context *m, struct multi_instance *mi, const struct plugin_return *pr, unsigned int *option_types_found)
Definition: multi.c:1678
BUF_SIZE
#define BUF_SIZE(f)
Definition: mtu.h:172
ccs_delete_config_file
static void ccs_delete_config_file(struct multi_instance *mi)
Deletes the temporary file for the config directives of the client connect script and removes it into...
Definition: multi.c:2045
mroute_addr_compare_function
bool mroute_addr_compare_function(const void *key1, const void *key2)
Definition: mroute.c:369
tuntap::remote_netmask
in_addr_t remote_netmask
Definition: tun.h:190
REAP_MIN
#define REAP_MIN
Definition: multi.h:568
multi_reap_all
static void multi_reap_all(const struct multi_context *m)
Definition: multi.c:208
multi_route::cache_generation
unsigned int cache_generation
Definition: multi.h:237
options::cf_per
int cf_per
Definition: options.h:513
management_callback_kill_by_addr
static int management_callback_kill_by_addr(void *arg, const in_addr_t addr, const int port)
Definition: multi.c:3950
multi_client_connect_early_setup
static void multi_client_connect_early_setup(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:2533
MR_WITH_NETBITS
#define MR_WITH_NETBITS
Definition: mroute.h:70
KS_AUTH_DEFERRED
@ KS_AUTH_DEFERRED
Key state authentication is being deferred, by async auth.
Definition: ssl_common.h:148
rw_handle
Definition: win32.h:79
multi_client_set_protocol_options
static bool multi_client_set_protocol_options(struct context *c)
Calculates the options that depend on the client capabilities based on local options and available pe...
Definition: multi.c:1792
options::ifconfig_ipv6_pool_netbits
int ifconfig_ipv6_pool_netbits
Definition: options.h:481
multi_instance_string
const char * multi_instance_string(const struct multi_instance *mi, bool null, struct gc_arena *gc)
Definition: multi.c:465
hash_bucket
Definition: list.h:51
extract_iv_proto
unsigned int extract_iv_proto(const char *peer_info)
Extracts the IV_PROTO variable and returns its value or 0 if it cannot be extracted.
Definition: ssl_util.c:62
multi_route_defined
static bool multi_route_defined(const struct multi_context *m, const struct multi_route *r)
Definition: multi.h:503
options::max_routes_per_client
int max_routes_per_client
Definition: options.h:519
multi_reap::bucket_base
int bucket_base
Definition: multi.h:53
ALLOC_OBJ_CLEAR
#define ALLOC_OBJ_CLEAR(dptr, type)
Definition: buffer.h:1065
crypto_options::key_ctx_bi
struct key_ctx_bi key_ctx_bi
OpenSSL cipher and HMAC contexts for both sending and receiving directions.
Definition: crypto.h:232
MULTI_ROUTE_CACHE
#define MULTI_ROUTE_CACHE
Definition: multi.h:233
now
time_t now
Definition: otime.c:34
multi_instance::did_iroutes
bool did_iroutes
Definition: multi.h:133
multi_instance::created
time_t created
Time at which a VPN tunnel instance was created.
Definition: multi.h:109
mroute_learnable_address
bool mroute_learnable_address(const struct mroute_addr *addr, struct gc_arena *gc)
Definition: mroute.c:65
frequency_limit_init
struct frequency_limit * frequency_limit_init(int max, int per)
Definition: otime.c:146
context_1::status_output
struct status_output * status_output
Definition: openvpn.h:183
CAS_PENDING_DEFERRED_PARTIAL
@ CAS_PENDING_DEFERRED_PARTIAL
at least handler succeeded but another is still pending
Definition: ssl_common.h:566
TOP_NET30
#define TOP_NET30
Definition: proto.h:43
OPENVPN_PLUGIN_FUNC_SUCCESS
#define OPENVPN_PLUGIN_FUNC_SUCCESS
Definition: openvpn-plugin.h:148
config.h
options::ifconfig_pool_start
in_addr_t ifconfig_pool_start
Definition: options.h:473
OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT
@ OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT
Definition: ovpn_dco_linux.h:75
multi_add_mbuf
void multi_add_mbuf(struct multi_context *m, struct multi_instance *mi, struct mbuf_buffer *mb)
Definition: multi.c:2881
MROUTE_EXTRACT_BCAST
#define MROUTE_EXTRACT_BCAST
Definition: mroute.h:39
ssl_ncp.h
connection_entry::fragment
int fragment
Definition: options.h:132
context_2::from
struct link_socket_actual from
Definition: openvpn.h:248
time_string
const char * time_string(time_t t, int usec, bool show_usec, struct gc_arena *gc)
Definition: otime.c:108
multi_route_del
static void multi_route_del(struct multi_route *route)
Definition: multi.h:494
context_1::ifconfig_pool_persist
struct ifconfig_pool_persist * ifconfig_pool_persist
Definition: openvpn.h:195
buffer_list_free
void buffer_list_free(struct buffer_list *ol)
Frees a buffer list and all the buffers in it.
Definition: buffer.c:1185
multi_process_incoming_link
bool multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags)
Demultiplex and process a packet received over the external network interface.
Definition: multi.c:3343
multi_context::initial_rate_limiter
struct initial_packet_rate_limit * initial_rate_limiter
Definition: multi.h:174
tls_multi::remote_ciphername
char * remote_ciphername
cipher specified in peer's config file
Definition: ssl_common.h:669
tls_multi::peer_id
uint32_t peer_id
Definition: ssl_common.h:666
management_callback::kill_by_addr
int(* kill_by_addr)(void *arg, const in_addr_t addr, const int port)
Definition: manage.h:183
multi_instance::client_connect_defer_state
struct client_connect_defer_state client_connect_defer_state
Definition: multi.h:138
key2
Container for bidirectional cipher and HMAC key material.
Definition: crypto.h:179
mbuf_item::buffer
struct mbuf_buffer * buffer
Definition: mbuf.h:52
connection_entry::proto
int proto
Definition: options.h:99
frequency_limit_free
void frequency_limit_free(struct frequency_limit *f)
Definition: otime.c:161
management_set_callback
void management_set_callback(struct management *man, const struct management_callback *cb)
Definition: manage.c:2720
multi_context::mtcp
struct multi_tcp * mtcp
State specific to OpenVPN using TCP as external transport.
Definition: multi.h:170
options::ifconfig_ipv6_pool_base
struct in6_addr ifconfig_ipv6_pool_base
Definition: options.h:480
IA_EMPTY_IF_UNDEF
#define IA_EMPTY_IF_UNDEF
Definition: socket.h:388
management_learn_addr
void management_learn_addr(struct management *management, struct man_def_auth_context *mdac, const struct mroute_addr *addr, const bool primary)
Definition: manage.c:2998
mroute_extract_addr_from_packet
static unsigned int mroute_extract_addr_from_packet(struct mroute_addr *src, struct mroute_addr *dest, uint16_t vid, const struct buffer *buf, int tunnel_type)
Definition: mroute.h:188
TM_INITIAL
#define TM_INITIAL
As yet un-trusted tls_session being negotiated.
Definition: ssl_common.h:530
options::real_hash_size
int real_hash_size
Definition: options.h:483
OVPN_CMD_SWAP_KEYS
@ OVPN_CMD_SWAP_KEYS
Definition: ovpn_dco_linux.h:44
options::client_disconnect_script
const char * client_disconnect_script
Definition: options.h:486
dco_get_peer_stats_multi
int dco_get_peer_stats_multi(dco_context_t *dco, struct multi_context *m)
Definition: dco_win.c:426
dco_multi_add_new_peer
static int dco_multi_add_new_peer(struct multi_context *m, struct multi_instance *mi)
Definition: dco.h:349
options::stale_routes_ageing_time
int stale_routes_ageing_time
Definition: options.h:521
hash_n_buckets
static int hash_n_buckets(const struct hash *hash)
Definition: list.h:128
session
Definition: keyingmaterialexporter.c:56
process_incoming_link_part1
bool process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, bool floated)
Starts processing a packet read from the external network interface.
Definition: forward.c:1020
MROUTE_EXTRACT_MCAST
#define MROUTE_EXTRACT_MCAST
Definition: mroute.h:40
context_2::push_ifconfig_ipv6_defined
bool push_ifconfig_ipv6_defined
Definition: openvpn.h:437
plugin_defined
bool plugin_defined(const struct plugin_list *pl, const int type)
Definition: plugin.c:932
options::tmp_dir
const char * tmp_dir
Definition: options.h:450
mroute_addr_mask_host_bits
void mroute_addr_mask_host_bits(struct mroute_addr *ma)
Definition: mroute.c:321
options::cf_max
int cf_max
Definition: options.h:512
options::iroutes_ipv6
struct iroute_ipv6 * iroutes_ipv6
Definition: options.h:495
constrain_int
static int constrain_int(int x, int min, int max)
Definition: integer.h:102
mbuf_dereference_instance
void mbuf_dereference_instance(struct mbuf_set *ms, struct multi_instance *mi)
Definition: mbuf.c:152
remap_signal
void remap_signal(struct context *c)
Definition: sig.c:588
CC_RET_DEFERRED
@ CC_RET_DEFERRED
Definition: multi.h:221
MROUTE_EXTRACT_SUCCEEDED
#define MROUTE_EXTRACT_SUCCEEDED
Definition: mroute.h:38
options::push_ifconfig_local_alias
in_addr_t push_ifconfig_local_alias
Definition: options.h:499
MULTI_PREFIX_MAX_LENGTH
#define MULTI_PREFIX_MAX_LENGTH
Definition: multi.h:44
register_signal
void register_signal(struct signal_info *si, int signum, const char *signal_text)
Register a soft signal in the signal_info struct si respecting priority.
Definition: sig.c:231
options::push_ifconfig_constraint_network
in_addr_t push_ifconfig_constraint_network
Definition: options.h:501
D_MULTI_MEDIUM
#define D_MULTI_MEDIUM
Definition: errlevel.h:102
CO_USE_TLS_KEY_MATERIAL_EXPORT
#define CO_USE_TLS_KEY_MATERIAL_EXPORT
Bit-flag indicating that data channel key derivation is done using TLS keying material export [RFC570...
Definition: crypto.h:262
management_callback::delete_event
void(* delete_event)(void *arg, event_t event)
Definition: manage.h:184
setenv_del
void setenv_del(struct env_set *es, const char *name)
Definition: env_set.c:328
management_callback_status
static void management_callback_status(void *arg, const int version, struct status_output *so)
Definition: multi.c:3902
management_callback_n_clients
static int management_callback_n_clients(void *arg)
Definition: multi.c:3917
multi_context::ifconfig_pool
struct ifconfig_pool * ifconfig_pool
Definition: multi.h:172
options::push_ifconfig_local
in_addr_t push_ifconfig_local
Definition: options.h:497
memdbg.h
multi_client_setup_dco_initial
static bool multi_client_setup_dco_initial(struct multi_context *m, struct multi_instance *mi, struct gc_arena *gc)
Definition: multi.c:2350
options::learn_address_script
const char * learn_address_script
Definition: options.h:487
mbuf_init
struct mbuf_set * mbuf_init(unsigned int size)
Definition: mbuf.c:39
DEV_TYPE_UNDEF
#define DEV_TYPE_UNDEF
Definition: proto.h:35
process_incoming_tun
void process_incoming_tun(struct context *c)
Process a packet read from the virtual tun/tap network interface.
Definition: forward.c:1473
management_callback
Definition: manage.h:173
options::ciphername
const char * ciphername
Definition: options.h:556
multi_top_free
void multi_top_free(struct multi_context *m)
Definition: multi.c:3823
update_mstat_n_clients
static void update_mstat_n_clients(const int n_clients)
Definition: multi.c:82
title_string
const char title_string[]
Definition: options.c:67
ifconfig_pool_release
bool ifconfig_pool_release(struct ifconfig_pool *pool, ifconfig_pool_handle hand, const bool hard)
Definition: pool.c:357
ccs_gen_config_file
static bool ccs_gen_config_file(struct multi_instance *mi)
Create a temporary file for the config directives of the client connect script and puts it into the c...
Definition: multi.c:2069
buffer_list
Definition: buffer.h:1125
multi_tcp_instance_specific_free
void multi_tcp_instance_specific_free(struct multi_instance *mi)
Definition: mtcp.c:191
ifconfig_pool_init
struct ifconfig_pool * ifconfig_pool_init(const bool ipv4_pool, enum pool_type type, in_addr_t start, in_addr_t end, const bool duplicate_cn, const bool ipv6_pool, const struct in6_addr ipv6_base, const int ipv6_netbits)
Definition: pool.c:146
multi_tcp_delete_event
void multi_tcp_delete_event(struct multi_tcp *mtcp, event_t event)
Definition: mtcp.c:216
M_USAGE
#define M_USAGE
Definition: error.h:106
CO_USE_CC_EXIT_NOTIFY
#define CO_USE_CC_EXIT_NOTIFY
Bit-flag indicating that explicit exit notifies should be sent via the control channel instead of usi...
Definition: crypto.h:274
multi_client_disconnect_setenv
static void multi_client_disconnect_setenv(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:560
ifconfig_pool_read
void ifconfig_pool_read(struct ifconfig_pool_persist *persist, struct ifconfig_pool *pool)
Definition: pool.c:598
OPENVPN_PLUGIN_CLIENT_CONNECT
#define OPENVPN_PLUGIN_CLIENT_CONNECT
Definition: openvpn-plugin.h:123
msg
#define msg(flags,...)
Definition: error.h:144
multi_process_float
void multi_process_float(struct multi_context *m, struct multi_instance *mi)
Handles peer floating.
Definition: multi.c:3138
IV_PROTO_CC_EXIT_NOTIFY
#define IV_PROTO_CC_EXIT_NOTIFY
Support for explicit exit notify via control channel This also includes support for the protocol-flag...
Definition: ssl.h:101
setenv_long_long
void setenv_long_long(struct env_set *es, const char *name, long long value)
Definition: env_set.c:275
dco_install_iroute
static void dco_install_iroute(struct multi_context *m, struct multi_instance *mi, struct mroute_addr *addr)
Definition: dco.h:355
multi_add_iroutes
static void multi_add_iroutes(struct multi_context *m, struct multi_instance *mi)
Definition: multi.c:1314
buffer_entry
Definition: buffer.h:1119
multi_instance::did_real_hash
bool did_real_hash
Definition: multi.h:127
crypto_backend.h
hash_iterator_init_range
void hash_iterator_init_range(struct hash *hash, struct hash_iterator *hi, int start_bucket, int end_bucket)
Definition: list.c:223
vlan_is_tagged
bool vlan_is_tagged(const struct buffer *buf)
Definition: vlan.c:266
perf_push
static void perf_push(int type)
Definition: perf.h:78
buf_printf
bool buf_printf(struct buffer *buf, const char *format,...)
Definition: buffer.c:240
multi_process_signal
bool multi_process_signal(struct multi_context *m)
Definition: multi.c:3876
multi_print_status
void multi_print_status(struct multi_context *m, struct status_output *so, const int version)
Definition: multi.c:843
multi_instance::context
struct context context
The context structure storing state for this VPN tunnel.
Definition: multi.h:136
multi_client_connect_source_ccd
static enum client_connect_return multi_client_connect_source_ccd(struct multi_context *m, struct multi_instance *mi, bool deferred, unsigned int *option_types_found)
Try to source a dynamic config file from the –client-config-dir directory.
Definition: multi.c:2603
buffer_list::head
struct buffer_entry * head
Definition: buffer.h:1127
multi_delete_dup
static void multi_delete_dup(struct multi_context *m, struct multi_instance *new_mi)
Definition: multi.c:1363
D_MULTI_DEBUG
#define D_MULTI_DEBUG
Definition: errlevel.h:127
schedule_free
void schedule_free(struct schedule *s)
Definition: schedule.c:421
setenv_in_addr_t
void setenv_in_addr_t(struct env_set *es, const char *name_prefix, in_addr_t addr, const unsigned int flags)
Definition: socket.c:3031
mroute_extract_in_addr_t
static void mroute_extract_in_addr_t(struct mroute_addr *dest, const in_addr_t src)
Definition: mroute.h:239
multi_instance::n_clients_delta
int n_clients_delta
Definition: multi.h:134
frame::headroom
int headroom
the headroom in the buffer, this is choosen to allow all potential header to be added before the pack...
Definition: mtu.h:108
options::push_ifconfig_constraint_netmask
in_addr_t push_ifconfig_constraint_netmask
Definition: options.h:502
mroute_helper::n_net_len
int n_net_len
Definition: mroute.h:134
hash_value
static uint32_t hash_value(const struct hash *hash, const void *key)
Definition: list.h:116
crypto_options
Security parameter state for processing data channel packets.
Definition: crypto.h:230
context::c1
struct context_1 c1
Level 1 context.
Definition: openvpn.h:516
tls_common_name
const char * tls_common_name(const struct tls_multi *multi, const bool null)
Returns the common name field for the given tunnel.
Definition: ssl_verify.c:113
D_IMPORT_ERRORS
#define D_IMPORT_ERRORS
Definition: errlevel.h:64
close_context
void close_context(struct context *c, int sig, unsigned int flags)
Definition: init.c:4914
mroute_addr_equal
static bool mroute_addr_equal(const struct mroute_addr *a1, const struct mroute_addr *a2)
Definition: mroute.h:208
management_callback::n_clients
int(* n_clients)(void *arg)
Definition: manage.h:185
dev_type_enum
int dev_type_enum(const char *dev, const char *dev_type)
Definition: tun.c:436
process_incoming_push_request
int process_incoming_push_request(struct context *c)
Definition: push.c:961
OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2
#define OPENVPN_PLUGIN_CLIENT_CONNECT_DEFER_V2
Definition: openvpn-plugin.h:131
buffer::data
uint8_t * data
Pointer to the allocated memory.
Definition: buffer.h:68
send_control_channel_string
bool send_control_channel_string(struct context *c, const char *str, int msglevel)
Definition: forward.c:431
multi_reap_process
static void multi_reap_process(const struct multi_context *m)
Definition: multi.h:582
cleanup
static int cleanup(void **state)
Definition: test_pkcs11.c:280