OpenVPN
openvpn.h
Go to the documentation of this file.
1 /*
2  * OpenVPN -- An application to securely tunnel IP networks
3  * over a single TCP/UDP port, with support for SSL/TLS-based
4  * session authentication and key exchange,
5  * packet encryption, packet authentication, and
6  * packet compression.
7  *
8  * Copyright (C) 2002-2021 OpenVPN Inc <sales@openvpn.net>
9  *
10  * This program is free software; you can redistribute it and/or modify
11  * it under the terms of the GNU General Public License version 2
12  * as published by the Free Software Foundation.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License along
20  * with this program; if not, write to the Free Software Foundation, Inc.,
21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
22  */
23 
24 #ifndef OPENVPN_H
25 #define OPENVPN_H
26 
27 #include "buffer.h"
28 #include "options.h"
29 #include "socket.h"
30 #include "crypto.h"
31 #include "ssl.h"
32 #include "packet_id.h"
33 #include "comp.h"
34 #include "tun.h"
35 #include "interval.h"
36 #include "status.h"
37 #include "fragment.h"
38 #include "shaper.h"
39 #include "route.h"
40 #include "proxy.h"
41 #include "socks.h"
42 #include "sig.h"
43 #include "misc.h"
44 #include "mbuf.h"
45 #include "pool.h"
46 #include "plugin.h"
47 #include "manage.h"
48 
49 /*
50  * Our global key schedules, packaged thusly
51  * to facilitate --persist-key.
52  */
53 
55 {
56  /* which cipher, HMAC digest, and key sizes are we using? */
58 
59  /* pre-shared static key, read from a file */
61 
62  /* our global SSL context */
64 
65  /* optional TLS control channel wrapping */
71 };
72 
73 /*
74  * struct packet_id_persist should be empty if we are not
75  * building with crypto.
76  */
77 #ifndef PACKET_ID_H
79 {
80  int dummy;
81 };
82 static inline void
84 {
85 }
86 #endif
87 
88 /*
89  * Packet processing buffers.
90  */
92 {
93  /* miscellaneous buffer, used by ping, occ, etc. */
94  struct buffer aux_buf;
95 
96  /* workspace buffers used by crypto routines */
97  struct buffer encrypt_buf;
98  struct buffer decrypt_buf;
99 
100  /* workspace buffers for compression */
101 #ifdef USE_COMP
102  struct buffer compress_buf;
103  struct buffer decompress_buf;
104 #endif
105 
106  /*
107  * Buffers used to read from TUN device
108  * and TCP/UDP port.
109  */
110  struct buffer read_link_buf;
111  struct buffer read_tun_buf;
112 };
113 
114 /*
115  * always-persistent context variables
116  */
118 {
120 };
121 
122 
123 /**************************************************************************/
132 struct context_0
133 {
134  /* workspace for --user/--group */
136  /* helper which tells us whether we should keep trying to drop privileges */
140 };
141 
142 
152 struct context_1
153 {
158  /* tunnel session keys */
159  struct key_schedule ks;
160 
161  /* preresolved and cached host names */
163 
164  /* persist crypto sequence number to/from file */
165  struct packet_id_persist pid_persist;
166 
167  struct tuntap *tuntap;
176  /* list of --route-ipv6 directives */
178 
179  /* --status file */
182 
183  /* HTTP proxy object */
186 
187  /* SOCKS proxy object */
190 
191  /* persist --ifconfig-pool db to file */
194 
195  /* if client mode, hash of option strings we pulled from server */
196  struct sha256_digest pulled_options_digest_save;
204 };
205 
206 
207 static inline bool
209 {
210  return cas == CAS_PENDING || cas == CAS_PENDING_DEFERRED
212 }
213 
223 struct context_2
224 {
225  struct gc_arena gc;
229  /* our global wait events */
233 
234  /* bitmask for event status. Check event.h for possible values */
235  unsigned int event_set_status;
236 
237  struct link_socket *link_socket; /* socket used for TCP/UDP connection to remote */
239 
242  const struct link_socket *accept_from; /* possibly do accept() on a parent link_socket */
243 
244  struct link_socket_actual *to_link_addr; /* IP address of remote */
245  struct link_socket_actual from; /* address of incoming datagram */
246 
247  /* MTU frame parameters */
248  struct frame frame; /* Active frame parameters */
249  struct frame frame_initial; /* Restored on new session */
250 
251 #ifdef ENABLE_FRAGMENT
252  /* Object to handle advanced MTU negotiation and datagram fragmentation */
254  struct frame frame_fragment;
255  struct frame frame_fragment_initial;
256  struct frame frame_fragment_omit;
257 #endif
258 
259  /*
260  * Traffic shaper object.
261  */
262  struct shaper shaper;
263 
264  /*
265  * Statistics
266  */
272 #ifdef PACKET_TRUNCATION_CHECK
273  counter_type n_trunc_tun_read;
274  counter_type n_trunc_tun_write;
275  counter_type n_trunc_pre_encrypt;
276  counter_type n_trunc_post_decrypt;
277 #endif
278 
279  /*
280  * Timer objects for ping and inactivity
281  * timeout features.
282  */
283  struct event_timeout wait_for_connect;
284  struct event_timeout ping_send_interval;
285  struct event_timeout ping_rec_interval;
286 
287  /* --inactive */
288  struct event_timeout inactivity_interval;
290 
291  /* the option strings must match across peers */
294 
295  int occ_op; /* INIT to -1 */
297  struct event_timeout occ_interval;
298 
299  /*
300  * Keep track of maximum packet size received so far
301  * (of authenticated packets).
302  */
303  int original_recv_size; /* temporary */
304  int max_recv_size_local; /* max packet size received */
305  int max_recv_size_remote; /* max packet size received by remote */
306  int max_send_size_local; /* max packet size sent */
307  int max_send_size_remote; /* max packet size sent by remote */
308 
309 
310  /* remote wants us to send back a load test packet of this size */
312 
313  struct event_timeout occ_mtu_load_test_interval;
315 
316  /*
317  * TLS-mode crypto objects.
318  */
333  /* used to optimize calls to tls_multi_process */
334  struct interval tmp_int;
335 
336  /* throw this signal on TLS errors */
338 
345  struct event_timeout packet_id_persist_interval;
346 
347 #ifdef USE_COMP
348  struct compress_context *comp_context;
352 #endif
353 
354  /*
355  * Buffers used for packet processing.
356  */
358  bool buffers_owned; /* if true, we should free all buffers on close */
359 
360  /*
361  * These buffers don't actually allocate storage, they are used
362  * as pointers to the allocated buffers in
363  * struct context_buffers.
364  */
365  struct buffer buf;
366  struct buffer to_tun;
367  struct buffer to_link;
368 
369  /* should we print R|W|r|w to console on packet transfers? */
370  bool log_rw;
371 
372  /* route stuff */
373  struct event_timeout route_wakeup;
374  struct event_timeout route_wakeup_expire;
375 
376  /* did we open tun/tap dev during this cycle? */
378 
379  /*
380  * Event loop info
381  */
382 
383  /* how long to wait on link/tun read before we will need to be serviced */
384  struct timeval timeval;
385 
386  /* next wakeup for processing coarse timers (>1 sec resolution) */
388 
389  /* maintain a random delta to add to timeouts to avoid contexts
390  * waking up simultaneously */
392  struct timeval timeout_random_component;
393 
394  /* Timer for everything up to the first packet from the *OpenVPN* server
395  * socks, http proxy, and tcp packets do not count */
396  struct event_timeout server_poll_interval;
397 
398  /* indicates that the do_up_delay function has run */
399  bool do_up_ran;
400 
401  /* indicates that we have received a SIGTERM when
402  * options->explicit_exit_notification is enabled,
403  * but we have not exited yet */
405  struct event_timeout explicit_exit_notification_interval;
406 
407  /* environmental variables to pass to scripts */
408  struct env_set *es;
409  bool es_owned;
410 
411  /* don't wait for TUN/TAP/UDP to be ready to accept write */
412  bool fast_io;
413 
414  /* --ifconfig endpoints to be pushed to client */
421 
423  struct in6_addr push_ifconfig_ipv6_local;
425  struct in6_addr push_ifconfig_ipv6_remote;
426 
427  struct event_timeout push_request_interval;
429 
430  /* hash of pulled options, so we can compare when options change */
433  struct sha256_digest pulled_options_digest;
434 
435  struct event_timeout scheduled_exit;
437 
438  /* packet filter */
439 
440 #ifdef ENABLE_MANAGEMENT
441  struct man_def_auth_context mda_context;
442 #endif
443 
444 #ifdef ENABLE_ASYNC_PUSH
445  int inotify_fd; /* descriptor for monitoring file changes */
446 #endif
447 };
448 
449 
461 struct context
462 {
463  struct options options;
466  bool first_time;
469  /* context modes */
470 #define CM_P2P 0 /* standalone point-to-point session or client */
471 #define CM_TOP 1 /* top level of a multi-client or point-to-multipoint server */
472 #define CM_TOP_CLONE 2 /* clone of a CM_TOP context for one thread */
473 #define CM_CHILD_UDP 3 /* child context of a CM_TOP or CM_THREAD */
474 #define CM_CHILD_TCP 4 /* child context of a CM_TOP or CM_THREAD */
475  int mode;
480  struct gc_arena gc;
484  struct env_set *es;
488  struct signal_info *sig;
498  struct context_persist persist;
500  struct context_0 *c0;
501  struct context_1 c1;
502  struct context_2 c2;
503 };
504 
505 /*
506  * Check for a signal when inside an event loop
507  */
508 #define EVENT_LOOP_CHECK_SIGNAL(c, func, arg) \
509  if (IS_SIG(c)) \
510  { \
511  const int brk = func(arg); \
512  perf_pop(); \
513  if (brk) { \
514  break;} \
515  else { \
516  continue;} \
517  }
518 
519 /*
520  * Macros for referencing objects which may not
521  * have been compiled in.
522  */
523 
524 #define TLS_MODE(c) ((c)->c2.tls_multi != NULL)
525 #define PROTO_DUMP_FLAGS (check_debug_level(D_LINK_RW_VERBOSE) ? (PD_SHOW_DATA|PD_VERBOSE) : 0)
526 #define PROTO_DUMP(buf, gc) protocol_dump((buf), \
527  PROTO_DUMP_FLAGS \
528  |(c->c2.tls_multi ? PD_TLS : 0) \
529  |(c->options.tls_auth_file ? c->c1.ks.key_type.hmac_length : 0), \
530  gc)
531 
532 #define CIPHER_ENABLED(c) (c->c1.ks.key_type.cipher != NULL)
533 
534 /* this represents "disabled peer-id" */
535 #define MAX_PEER_ID 0xFFFFFF
536 
537 #endif /* ifndef OPENVPN_H */
struct env_set * es
Definition: openvpn.h:408
bool socks_proxy_owned
Definition: openvpn.h:189
counter_type tun_read_bytes
Definition: openvpn.h:267
Security parameter state for processing data channel packets.
Definition: crypto.h:232
bool log_rw
Definition: openvpn.h:370
Definition: tun.h:155
Level 1 context containing state that persists across SIGUSR1 restarts.
Definition: openvpn.h:152
Fragmentation and reassembly state for one VPN tunnel instance.
Definition: fragment.h:136
counter_type link_write_bytes
Definition: openvpn.h:271
bool did_open_tun
Definition: openvpn.h:377
struct cached_dns_entry * dns_cache
Definition: openvpn.h:162
Contains all state information for one tunnel.
Definition: openvpn.h:461
Packet geometry parameters.
Definition: mtu.h:93
struct env_set * es
Set of environment variables.
Definition: openvpn.h:484
bool push_ifconfig_defined
Definition: openvpn.h:416
int occ_mtu_load_size
Definition: openvpn.h:311
in_addr_t push_ifconfig_local
Definition: openvpn.h:418
static void packet_id_persist_init(struct packet_id_persist *p)
Definition: openvpn.h:83
Security parameter state for a single VPN tunnel.
Definition: ssl_common.h:566
struct tls_auth_standalone * tls_auth_standalone
TLS state structure required for the initial authentication of a client&#39;s connection attempt...
Definition: openvpn.h:322
int occ_mtu_load_n_tries
Definition: openvpn.h:314
bool pulled_options_digest_init_done
Definition: openvpn.h:431
struct context_buffers * buffers
Definition: openvpn.h:357
struct link_socket_info * link_socket_info
This variable is used instead link_socket->info for P2MP UDP childs.
Definition: openvpn.h:241
const struct link_socket * accept_from
Definition: openvpn.h:242
struct socks_proxy_info * socks_proxy
Definition: openvpn.h:188
#define in_addr_t
Definition: config-msvc.h:103
struct signal_info * sig
Internal error signaling object.
Definition: openvpn.h:488
void * openvpn_net_ctx_t
Definition: networking.h:26
int max_recv_size_local
Definition: openvpn.h:304
int occ_n_tries
Definition: openvpn.h:296
struct tuntap * tuntap
Tun/tap virtual network interface.
Definition: openvpn.h:167
Level 2 context containing state that is reset on both SIGHUP and SIGUSR1 restarts.
Definition: openvpn.h:223
struct key_ctx_bi tls_wrap_key
Definition: openvpn.h:67
Definition: socket.h:75
bool tuntap_owned
Whether the tun/tap interface should be cleaned up when this context is cleaned up.
Definition: openvpn.h:168
at least handler succeeded, no result yet
Definition: ssl_common.h:546
bool push_request_received
Definition: openvpn.h:415
time_t explicit_exit_notification_time_wait
Definition: openvpn.h:404
bool uid_gid_chroot_set
Definition: openvpn.h:137
openvpn_net_ctx_t net_ctx
Networking API opaque context.
Definition: openvpn.h:486
md_ctx_t * pulled_options_state
Definition: openvpn.h:432
counter_type tun_write_bytes
Definition: openvpn.h:268
Definition: shaper.h:47
counter_type link_read_bytes
Definition: openvpn.h:269
struct link_socket_actual * to_link_addr
Definition: openvpn.h:244
int inactivity_bytes
Definition: openvpn.h:289
struct route_list * route_list
List of routing information.
Definition: openvpn.h:172
in_addr_t push_ifconfig_local_alias
Definition: openvpn.h:420
int push_ifconfig_ipv6_netbits
Definition: openvpn.h:424
uint64_t counter_type
Definition: common.h:30
Container for one set of cipher and/or HMAC contexts.
Definition: crypto.h:164
int event_set_max
Definition: openvpn.h:231
static bool is_cas_pending(enum multi_status cas)
Definition: openvpn.h:208
struct key_ctx auth_token_key
Definition: openvpn.h:70
int restart_sleep_seconds
Definition: openvpn.h:119
struct link_socket * link_socket
Definition: openvpn.h:237
struct buffer tls_crypt_v2_wkc
Wrapped client key.
Definition: openvpn.h:69
bool buffers_owned
Definition: openvpn.h:358
struct route_ipv6_list * route_ipv6_list
Definition: openvpn.h:177
time_t sent_push_reply_expiry
Definition: openvpn.h:417
time_t update_timeout_random_component
Definition: openvpn.h:391
bool uid_gid_specified
Definition: openvpn.h:135
struct ifconfig_pool_persist * ifconfig_pool_persist
Definition: openvpn.h:192
struct event_set * event_set
Definition: openvpn.h:230
int max_recv_size_remote
Definition: openvpn.h:305
struct key_type tls_auth_key_type
Definition: openvpn.h:66
int scheduled_exit_signal
Definition: openvpn.h:436
bool push_ifconfig_ipv6_defined
Definition: openvpn.h:422
Structure that wraps the TLS context.
Definition: ssl_mbedtls.h:104
struct context_0 * c0
Level 0 context.
Definition: openvpn.h:500
Level 0 context containing information related to the OpenVPN process.
Definition: openvpn.h:132
int max_send_size_remote
Definition: openvpn.h:307
time_t push_request_timeout
Definition: openvpn.h:428
struct tls_root_ctx ssl_ctx
Definition: openvpn.h:63
int mode
Role of this context within the OpenVPN process.
Definition: openvpn.h:475
char * options_string_remote
Definition: openvpn.h:293
Definition: misc.h:56
Wrapper structure for dynamically allocated memory.
Definition: buffer.h:60
bool plugins_owned
Whether the plug-ins should be cleaned up when this context is cleaned up.
Definition: openvpn.h:491
struct fragment_master * fragment
Definition: openvpn.h:253
struct status_output * status_output
Definition: openvpn.h:180
struct plugin_list * plugins
List of plug-ins.
Definition: openvpn.h:490
struct http_proxy_info * http_proxy
Definition: openvpn.h:184
bool ifconfig_pool_persist_owned
Definition: openvpn.h:193
struct user_pass * auth_user_pass
Username and password for authentication.
Definition: openvpn.h:201
bool first_time
True on the first iteration of OpenVPN&#39;s main loop.
Definition: openvpn.h:466
bool do_up_ran
Definition: openvpn.h:399
multi_status
Definition: ssl_common.h:541
bool fast_io
Definition: openvpn.h:412
char * options_string_local
Definition: openvpn.h:292
Garbage collection arena used to keep track of dynamically allocated memory.
Definition: buffer.h:116
int original_recv_size
Definition: openvpn.h:303
struct key_ctx tls_crypt_v2_server_key
Definition: openvpn.h:68
Data Channel Fragmentation module header file.
bool did_we_daemonize
Whether demonization has already taken place.
Definition: openvpn.h:495
bool status_output_owned
Definition: openvpn.h:181
Wrapper struct to pass around SHA256 digests.
Definition: crypto.h:132
bool link_socket_owned
Definition: openvpn.h:238
unsigned int event_set_status
Definition: openvpn.h:235
struct tls_multi * tls_multi
TLS state structure for this VPN tunnel.
Definition: openvpn.h:319
in_addr_t push_ifconfig_remote_netmask
Definition: openvpn.h:419
int max_send_size_local
Definition: openvpn.h:306
int occ_op
Definition: openvpn.h:295
bool http_proxy_owned
Definition: openvpn.h:185
bool es_owned
Definition: openvpn.h:409
bool event_set_owned
Definition: openvpn.h:232
mbedtls_md_context_t md_ctx_t
Generic message digest context.
int tls_exit_signal
Definition: openvpn.h:337
struct key_ctx_bi static_key
Definition: openvpn.h:60
Container for two sets of OpenSSL cipher and/or HMAC contexts for both sending and receiving directio...
Definition: crypto.h:219
time_t coarse_timer_wakeup
Definition: openvpn.h:387
counter_type link_read_bytes_auth
Definition: openvpn.h:270