2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program (see the file COPYING included with this
21 * distribution); if not, write to the Free Software Foundation, Inc.,
22 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
33 #include "packet_id.h"
51 * Our global key schedules, packaged thusly
52 * to facilitate --persist-key.
58 /* which cipher, HMAC digest, and key sizes are we using? */
59 struct key_type key_type
;
61 /* pre-shared static key, read from a file */
62 struct key_ctx_bi static_key
;
65 /* our global SSL context */
68 /* optional authentication HMAC key for TLS control channel */
69 struct key_ctx_bi tls_auth_key
;
72 #else /* USE_CRYPTO */
74 #endif /* USE_CRYPTO */
78 * struct packet_id_persist should be empty if we are not
79 * building with crypto.
82 struct packet_id_persist
87 packet_id_persist_init (struct packet_id_persist
*p
)
93 * Packet processing buffers.
95 struct context_buffers
97 /* miscellaneous buffer, used by ping, occ, etc. */
98 struct buffer aux_buf
;
100 /* workspace buffers used by crypto routines */
102 struct buffer encrypt_buf
;
103 struct buffer decrypt_buf
;
106 /* workspace buffers for LZO compression */
108 struct buffer lzo_compress_buf
;
109 struct buffer lzo_decompress_buf
;
113 * Buffers used to read from TUN device
116 struct buffer read_link_buf
;
117 struct buffer read_tun_buf
;
121 * level 0 context contains data related to
122 * once-per OpenVPN instantiation events
123 * such as daemonization.
127 /* workspace for get_pid_file/write_pid */
128 struct pid_state pid_state
;
130 /* workspace for --user/--group */
131 bool uid_gid_specified
;
133 struct user_state user_state
;
134 struct group_state group_state
;
138 * Contains the persist-across-restart OpenVPN tunnel instance state.
139 * Reset only for SIGHUP restarts.
143 /* local and remote addresses */
144 struct link_socket_addr link_socket_addr
;
146 /* tunnel session keys */
147 struct key_schedule ks
;
149 /* persist crypto sequence number to/from file */
150 struct packet_id_persist pid_persist
;
152 /* array of remote addresses */
153 struct remote_list
*remote_list
;
155 /* TUN/TAP interface */
156 struct tuntap
*tuntap
;
159 /* list of --route directives */
160 struct route_list
*route_list
;
163 struct status_output
*status_output
;
164 bool status_output_owned
;
166 #ifdef ENABLE_HTTP_PROXY
167 /* HTTP proxy object */
168 struct http_proxy_info
*http_proxy
;
172 /* SOCKS proxy object */
173 struct socks_proxy_info
*socks_proxy
;
176 /* shared object plugins */
177 struct plugin_list
*plugins
;
183 /* persist --ifconfig-pool db to file */
184 struct ifconfig_pool_persist
*ifconfig_pool_persist
;
185 bool ifconfig_pool_persist_owned
;
188 /* if client mode, option strings we pulled from server */
189 char *pulled_options_string_save
;
191 /* save user/pass for authentication */
192 struct user_pass
*auth_user_pass
;
197 * Contains the OpenVPN tunnel instance state, wiped across
198 * SIGUSR1 and SIGHUP restarts.
202 /* garbage collection arena for context_2 scope */
205 /* our global wait events */
206 struct event_set
*event_set
;
208 bool event_set_owned
;
210 /* event flags returned by io_wait */
211 # define SOCKET_READ (1<<0)
212 # define SOCKET_WRITE (1<<1)
213 # define TUN_READ (1<<2)
214 # define TUN_WRITE (1<<3)
215 # define ES_ERROR (1<<4)
216 # define ES_TIMEOUT (1<<5)
217 # ifdef ENABLE_MANAGEMENT
218 # define MANAGEMENT_READ (1<<6)
219 # define MANAGEMENT_WRITE (1<<7)
222 unsigned int event_set_status
;
224 struct link_socket
*link_socket
; /* socket used for TCP/UDP connection to remote */
225 bool link_socket_owned
;
226 struct link_socket_info
*link_socket_info
;
227 const struct link_socket
*accept_from
; /* possibly do accept() on a parent link_socket */
229 struct sockaddr_in to_link_addr
; /* IP address of remote */
230 struct sockaddr_in from
; /* address of incoming datagram */
232 /* MTU frame parameters */
235 #ifdef ENABLE_FRAGMENT
236 /* Object to handle advanced MTU negotiation and datagram fragmentation */
237 struct fragment_master
*fragment
;
238 struct frame frame_fragment
;
239 struct frame frame_fragment_omit
;
242 #ifdef HAVE_GETTIMEOFDAY
244 * Traffic shaper object.
246 struct shaper shaper
;
252 counter_type tun_read_bytes
;
253 counter_type tun_write_bytes
;
254 counter_type link_read_bytes
;
255 counter_type link_read_bytes_auth
;
256 counter_type link_write_bytes
;
259 * Timer objects for ping and inactivity
262 struct event_timeout wait_for_connect
;
263 struct event_timeout inactivity_interval
;
264 struct event_timeout ping_send_interval
;
265 struct event_timeout ping_rec_interval
;
268 /* the option strings must match across peers */
269 char *options_string_local
;
270 char *options_string_remote
;
272 int occ_op
; /* INIT to -1 */
274 struct event_timeout occ_interval
;
278 * Keep track of maximum packet size received so far
279 * (of authenticated packets).
281 int original_recv_size
; /* temporary */
282 int max_recv_size_local
; /* max packet size received */
283 int max_recv_size_remote
; /* max packet size received by remote */
284 int max_send_size_local
; /* max packet size sent */
285 int max_send_size_remote
; /* max packet size sent by remote */
288 /* remote wants us to send back a load test packet of this size */
289 int occ_mtu_load_size
;
291 struct event_timeout occ_mtu_load_test_interval
;
292 int occ_mtu_load_n_tries
;
298 * TLS-mode crypto objects.
302 /* master OpenVPN SSL/TLS object */
303 struct tls_multi
*tls_multi
;
305 /* check --tls-auth signature without needing
306 a full-size tls_multi object */
307 struct tls_auth_standalone
*tls_auth_standalone
;
309 /* used to optimize calls to tls_multi_process */
310 struct interval tmp_int
;
312 /* throw this signal on TLS errors */
317 /* passed to encrypt or decrypt, contains all
318 crypto-related command line options related
319 to data channel encryption/decryption */
320 struct crypto_options crypto_options
;
322 /* used to keep track of data channel packet sequence numbers */
323 struct packet_id packet_id
;
324 struct event_timeout packet_id_persist_interval
;
326 #endif /* USE_CRYPTO */
329 * LZO compression library workspace.
332 struct lzo_compress_workspace lzo_compwork
;
336 * Buffers used for packet processing.
338 struct context_buffers
*buffers
;
339 bool buffers_owned
; /* if true, we should free all buffers on close */
342 * These buffers don't actually allocate storage, they are used
343 * as pointers to the allocated buffers in
344 * struct context_buffers.
347 struct buffer to_tun
;
348 struct buffer to_link
;
355 /* should we print R|W|r|w to console on packet transfers? */
359 struct event_timeout route_wakeup
;
360 struct event_timeout route_wakeup_expire
;
362 /* did we open tun/tap dev during this cycle? */
369 /* how long to wait on link/tun read before we will need to be serviced */
370 struct timeval timeval
;
372 /* next wakeup for processing coarse timers (>1 sec resolution) */
373 time_t coarse_timer_wakeup
;
375 /* maintain a random delta to add to timeouts to avoid contexts
376 waking up simultaneously */
377 time_t update_timeout_random_component
;
378 struct timeval timeout_random_component
;
380 /* indicates that the do_up_delay function has run */
384 /* indicates that we have received a SIGTERM when
385 options->explicit_exit_notification is enabled,
386 but we have not exited yet */
387 time_t explicit_exit_notification_time_wait
;
388 struct event_timeout explicit_exit_notification_interval
;
391 /* environmental variables to pass to scripts */
394 /* don't wait for TUN/TAP/UDP to be ready to accept write */
400 /* --ifconfig endpoints to be pushed to client */
401 bool push_reply_deferred
;
402 bool push_ifconfig_defined
;
403 in_addr_t push_ifconfig_local
;
404 in_addr_t push_ifconfig_remote_netmask
;
406 /* client authentication state, CAS_SUCCEEDED must be 0 */
407 # define CAS_SUCCEEDED 0
408 # define CAS_PENDING 1
409 # define CAS_FAILED 2
410 # define CAS_PARTIAL 3 /* at least one client-connect script/plugin
411 succeeded while a later one in the chain failed */
415 struct event_timeout push_request_interval
;
416 const char *pulled_options_string
;
418 struct event_timeout scheduled_exit
;
424 * Contains all state information for one tunnel.
428 /* command line or config file options */
429 struct options options
;
431 /* true on initial VPN iteration */
434 /* used by multi-client code to lock the context */
435 /*MUTEX_DEFINE (mutex);*/
438 # define CM_P2P 0 /* standalone point-to-point session or client */
439 # define CM_TOP 1 /* top level of a multi-client or point-to-multipoint server */
440 # define CM_TOP_CLONE 2 /* clone of a CM_TOP context for one thread */
441 # define CM_CHILD_UDP 3 /* child context of a CM_TOP or CM_THREAD */
442 # define CM_CHILD_TCP 4 /* child context of a CM_TOP or CM_THREAD */
445 /* garbage collection for context scope
449 /* environmental variable settings */
453 struct signal_info
*sig
;
455 /* set to true after we daemonize */
456 bool did_we_daemonize
;
458 /* level 0 context contains data related to
459 once-per OpenVPN instantiation events
460 such as daemonization */
461 struct context_0
*c0
;
463 /* level 1 context is preserved for
464 SIGUSR1 restarts, but initialized
465 for SIGHUP restarts */
468 /* level 2 context is initialized for all
469 restarts (SIGUSR1 and SIGHUP) */
474 * Check for a signal when inside an event loop
476 #define EVENT_LOOP_CHECK_SIGNAL(c, func, arg) \
479 const int brk = func (arg); \
488 * Macros for referencing objects which may not
489 * have been compiled in.
492 #if defined(USE_CRYPTO) && defined(USE_SSL)
493 #define TLS_MODE(c) ((c)->c2.tls_multi != NULL)
494 #define PROTO_DUMP_FLAGS (check_debug_level (D_LINK_RW_VERBOSE) ? (PD_SHOW_DATA|PD_VERBOSE) : 0)
495 #define PROTO_DUMP(buf, gc) protocol_dump((buf), \
497 (c->c2.tls_multi ? PD_TLS : 0) | \
498 (c->options.tls_auth_file ? c->c1.ks.key_type.hmac_length : 0), \
501 #define TLS_MODE(c) (false)
502 #define PROTO_DUMP(buf, gc) format_hex (BPTR (buf), BLEN (buf), 80, gc)
506 #define MD5SUM(buf, len, gc) md5sum((buf), (len), 0, (gc))
508 #define MD5SUM(buf, len, gc) "[unavailable]"
512 #define CIPHER_ENABLED(c) (c->c1.ks.key_type.cipher != NULL)
514 #define CIPHER_ENABLED(c) (false)