2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program (see the file COPYING included with this
21 * distribution); if not, write to the Free Software Foundation, Inc.,
22 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
30 #include "forward-inline.h"
38 #define TA_SOCKET_READ 1
39 #define TA_SOCKET_READ_RESIDUAL 2
40 #define TA_SOCKET_WRITE 3
41 #define TA_SOCKET_WRITE_READY 4
42 #define TA_SOCKET_WRITE_DEFERRED 5
44 #define TA_TUN_WRITE 7
47 #define TA_TUN_WRITE_TIMEOUT 10
50 * Special tags passed to event.[ch] functions
52 #define MTCP_SOCKET ((void*)1)
53 #define MTCP_TUN ((void*)2)
54 #define MTCP_SIG ((void*)3) /* Only on Windows */
55 #ifdef ENABLE_MANAGEMENT
56 # define MTCP_MANAGEMENT ((void*)4)
59 #define MTCP_N ((void*)16) /* upper bound on MTCP_x */
77 return "TA_SOCKET_READ";
78 case TA_SOCKET_READ_RESIDUAL
:
79 return "TA_SOCKET_READ_RESIDUAL";
81 return "TA_SOCKET_WRITE";
82 case TA_SOCKET_WRITE_READY
:
83 return "TA_SOCKET_WRITE_READY";
84 case TA_SOCKET_WRITE_DEFERRED
:
85 return "TA_SOCKET_WRITE_DEFERRED";
89 return "TA_TUN_WRITE";
94 case TA_TUN_WRITE_TIMEOUT
:
95 return "TA_TUN_WRITE_TIMEOUT";
101 static struct multi_instance
*
102 multi_create_instance_tcp (struct multi_context
*m
)
104 struct gc_arena gc
= gc_new ();
105 struct multi_instance
*mi
= NULL
;
106 struct hash
*hash
= m
->hash
;
108 mi
= multi_create_instance (m
, NULL
);
111 struct hash_element
*he
;
112 const uint32_t hv
= hash_value (hash
, &mi
->real
);
113 struct hash_bucket
*bucket
= hash_bucket (hash
, hv
);
115 hash_bucket_lock (bucket
);
116 he
= hash_lookup_fast (hash
, bucket
, &mi
->real
, hv
);
120 struct multi_instance
*oldmi
= (struct multi_instance
*) he
->value
;
121 msg (D_MULTI_LOW
, "MULTI TCP: new incoming client address matches existing client address -- new client takes precedence");
122 oldmi
->did_real_hash
= false;
123 multi_close_instance (m
, oldmi
, false);
128 hash_add_fast (hash
, bucket
, &mi
->real
, hv
, mi
);
130 mi
->did_real_hash
= true;
132 hash_bucket_unlock (bucket
);
137 dmsg (D_MULTI_DEBUG
, "MULTI TCP: instance added: %s", mroute_addr_print (&mi
->real
, &gc
));
139 dmsg (D_MULTI_DEBUG
, "MULTI TCP: new client instance failed");
143 ASSERT (!(mi
&& mi
->halt
));
148 multi_tcp_instance_specific_init (struct multi_context
*m
, struct multi_instance
*mi
)
150 /* buffer for queued TCP socket output packets */
151 mi
->tcp_link_out_deferred
= mbuf_init (m
->top
.options
.n_bcast_buf
);
153 ASSERT (mi
->context
.c2
.link_socket
);
154 ASSERT (mi
->context
.c2
.link_socket
->info
.lsa
);
155 ASSERT (mi
->context
.c2
.link_socket
->mode
== LS_MODE_TCP_ACCEPT_FROM
);
156 if (!mroute_extract_openvpn_sockaddr (&mi
->real
, &mi
->context
.c2
.link_socket
->info
.lsa
->actual
.dest
, true))
158 msg (D_MULTI_ERRORS
, "MULTI TCP: TCP client address is undefined");
165 multi_tcp_instance_specific_free (struct multi_instance
*mi
)
167 mbuf_free (mi
->tcp_link_out_deferred
);
171 multi_tcp_init (int maxevents
, int *maxclients
)
173 struct multi_tcp
*mtcp
;
174 const int extra_events
= BASE_N_EVENTS
;
176 ASSERT (maxevents
>= 1);
179 ALLOC_OBJ_CLEAR (mtcp
, struct multi_tcp
);
180 mtcp
->maxevents
= maxevents
+ extra_events
;
181 mtcp
->es
= event_set_init (&mtcp
->maxevents
, 0);
182 wait_signal (mtcp
->es
, MTCP_SIG
);
183 ALLOC_ARRAY (mtcp
->esr
, struct event_set_return
, mtcp
->maxevents
);
184 *maxclients
= max_int (min_int (mtcp
->maxevents
- extra_events
, *maxclients
), 1);
185 msg (D_MULTI_LOW
, "MULTI: TCP INIT maxclients=%d maxevents=%d", *maxclients
, mtcp
->maxevents
);
190 multi_tcp_delete_event (struct multi_tcp
*mtcp
, event_t event
)
192 if (mtcp
&& mtcp
->es
)
193 event_del (mtcp
->es
, event
);
197 multi_tcp_free (struct multi_tcp
*mtcp
)
201 event_free (mtcp
->es
);
209 multi_tcp_dereference_instance (struct multi_tcp
*mtcp
, struct multi_instance
*mi
)
211 struct link_socket
*ls
= mi
->context
.c2
.link_socket
;
212 if (ls
&& mi
->socket_set_called
)
213 event_del (mtcp
->es
, socket_event_handle (ls
));
218 multi_tcp_set_global_rw_flags (struct multi_context
*m
, struct multi_instance
*mi
)
222 mi
->socket_set_called
= true;
223 socket_set (mi
->context
.c2
.link_socket
,
225 mbuf_defined (mi
->tcp_link_out_deferred
) ? EVENT_WRITE
: EVENT_READ
,
232 multi_tcp_wait (const struct context
*c
,
233 struct multi_tcp
*mtcp
)
236 socket_set_listen_persistent (c
->c2
.link_socket
, mtcp
->es
, MTCP_SOCKET
);
237 tun_set (c
->c1
.tuntap
, mtcp
->es
, EVENT_READ
, MTCP_TUN
, &mtcp
->tun_rwflags
);
238 #ifdef ENABLE_MANAGEMENT
240 management_socket_set (management
, mtcp
->es
, MTCP_MANAGEMENT
, &mtcp
->management_persist_flags
);
242 status
= event_wait (mtcp
->es
, &c
->c2
.timeval
, mtcp
->esr
, mtcp
->maxevents
);
246 mtcp
->n_esr
= status
;
250 static inline struct context
*
251 multi_tcp_context (struct multi_context
*m
, struct multi_instance
*mi
)
260 multi_tcp_process_outgoing_link_ready (struct multi_context
*m
, struct multi_instance
*mi
, const unsigned int mpp_flags
)
262 struct mbuf_item item
;
266 /* extract from queue */
267 if (mbuf_extract_item (mi
->tcp_link_out_deferred
, &item
, true)) /* ciphertext IP packet */
269 dmsg (D_MULTI_TCP
, "MULTI TCP: transmitting previously deferred packet");
271 ASSERT (mi
== item
.instance
);
272 mi
->context
.c2
.to_link
= item
.buffer
->buf
;
273 ret
= multi_process_outgoing_link_dowork (m
, mi
, mpp_flags
);
276 mbuf_free_buf (item
.buffer
);
282 multi_tcp_process_outgoing_link (struct multi_context
*m
, bool defer
, const unsigned int mpp_flags
)
284 struct multi_instance
*mi
= multi_process_outgoing_link_pre (m
);
289 if (defer
|| mbuf_defined (mi
->tcp_link_out_deferred
))
292 struct buffer
*buf
= &mi
->context
.c2
.to_link
;
295 struct mbuf_buffer
*mb
= mbuf_alloc_buf (buf
);
296 struct mbuf_item item
;
299 dmsg (D_MULTI_TCP
, "MULTI TCP: queuing deferred packet");
302 mbuf_add_item (mi
->tcp_link_out_deferred
, &item
);
305 ret
= multi_process_post (m
, mi
, mpp_flags
);
313 ret
= multi_process_outgoing_link_dowork (m
, mi
, mpp_flags
);
322 multi_tcp_wait_lite (struct multi_context
*m
, struct multi_instance
*mi
, const int action
, bool *tun_input_pending
)
324 struct context
*c
= multi_tcp_context (m
, mi
);
325 unsigned int looking_for
= 0;
327 dmsg (D_MULTI_DEBUG
, "MULTI TCP: multi_tcp_wait_lite a=%s mi=" ptr_format
,
331 tv_clear (&c
->c2
.timeval
); /* ZERO-TIMEOUT */
336 looking_for
= TUN_READ
;
337 tun_input_pending
= NULL
;
338 io_wait (c
, IOW_READ_TUN
);
341 looking_for
= SOCKET_READ
;
342 tun_input_pending
= NULL
;
343 io_wait (c
, IOW_READ_LINK
);
346 looking_for
= TUN_WRITE
;
347 tun_input_pending
= NULL
;
348 c
->c2
.timeval
.tv_sec
= 1; /* For some reason, the Linux 2.2 TUN/TAP driver hits this timeout */
349 perf_push (PERF_PROC_OUT_TUN_MTCP
);
350 io_wait (c
, IOW_TO_TUN
);
353 case TA_SOCKET_WRITE
:
354 looking_for
= SOCKET_WRITE
;
355 io_wait (c
, IOW_TO_LINK
|IOW_READ_TUN_FORCE
);
358 msg (M_FATAL
, "MULTI TCP: multi_tcp_wait_lite, unhandled action=%d", action
);
361 if (tun_input_pending
&& (c
->c2
.event_set_status
& TUN_READ
))
362 *tun_input_pending
= true;
364 if (c
->c2
.event_set_status
& looking_for
)
372 /* TCP socket output buffer is full */
373 case TA_SOCKET_WRITE
:
374 return TA_SOCKET_WRITE_DEFERRED
;
376 /* TUN device timed out on accepting write */
378 return TA_TUN_WRITE_TIMEOUT
;
385 static struct multi_instance
*
386 multi_tcp_dispatch (struct multi_context
*m
, struct multi_instance
*mi
, const int action
)
388 const unsigned int mpp_flags
= MPP_PRE_SELECT
|MPP_RECORD_TOUCH
;
389 struct multi_instance
*touched
= mi
;
390 m
->mpp_touched
= &touched
;
392 dmsg (D_MULTI_DEBUG
, "MULTI TCP: multi_tcp_dispatch a=%s mi=" ptr_format
,
399 read_incoming_tun (&m
->top
);
400 if (!IS_SIG (&m
->top
))
401 multi_process_incoming_tun (m
, mpp_flags
);
404 case TA_SOCKET_READ_RESIDUAL
:
406 ASSERT (mi
->context
.c2
.link_socket
);
408 read_incoming_link (&mi
->context
);
410 if (!IS_SIG (&mi
->context
))
412 multi_process_incoming_link (m
, mi
, mpp_flags
);
413 if (!IS_SIG (&mi
->context
))
414 stream_buf_read_setup (mi
->context
.c2
.link_socket
);
418 multi_process_timeout (m
, mpp_flags
);
421 multi_process_outgoing_tun (m
, mpp_flags
);
423 case TA_TUN_WRITE_TIMEOUT
:
424 multi_process_drop_outgoing_tun (m
, mpp_flags
);
426 case TA_SOCKET_WRITE_READY
:
428 multi_tcp_process_outgoing_link_ready (m
, mi
, mpp_flags
);
430 case TA_SOCKET_WRITE
:
431 multi_tcp_process_outgoing_link (m
, false, mpp_flags
);
433 case TA_SOCKET_WRITE_DEFERRED
:
434 multi_tcp_process_outgoing_link (m
, true, mpp_flags
);
438 multi_tcp_set_global_rw_flags (m
, mi
);
439 multi_process_post (m
, mi
, mpp_flags
);
442 msg (M_FATAL
, "MULTI TCP: multi_tcp_dispatch, unhandled action=%d", action
);
445 m
->mpp_touched
= NULL
;
450 multi_tcp_post (struct multi_context
*m
, struct multi_instance
*mi
, const int action
)
452 struct context
*c
= multi_tcp_context (m
, mi
);
453 int newaction
= TA_UNDEF
;
456 # define MTP_TUN_OUT (1<<0)
457 # define MTP_LINK_OUT (1<<1)
458 unsigned int flags
= MTP_NONE
;
461 flags
|= MTP_TUN_OUT
;
463 flags
|= MTP_LINK_OUT
;
467 case MTP_TUN_OUT
|MTP_LINK_OUT
:
469 newaction
= TA_TUN_WRITE
;
472 newaction
= TA_SOCKET_WRITE
;
475 if (mi
&& socket_read_residual (c
->c2
.link_socket
))
476 newaction
= TA_SOCKET_READ_RESIDUAL
;
478 multi_tcp_set_global_rw_flags (m
, mi
);
482 struct gc_arena gc
= gc_new ();
483 msg (M_FATAL
, "MULTI TCP: multi_tcp_post bad state, mi=%s flags=%d",
484 multi_instance_string (mi
, false, &gc
),
491 dmsg (D_MULTI_DEBUG
, "MULTI TCP: multi_tcp_post %s -> %s",
499 multi_tcp_action (struct multi_context
*m
, struct multi_instance
*mi
, int action
, bool poll
)
501 bool tun_input_pending
= false;
504 dmsg (D_MULTI_DEBUG
, "MULTI TCP: multi_tcp_action a=%s p=%d",
509 * If TA_SOCKET_READ_RESIDUAL, it means we still have pending
510 * input packets which were read by a prior TCP recv.
512 * Otherwise do a "lite" wait, which means we wait with 0 timeout
513 * on I/O events only related to the current instance, not
514 * the big list of events.
516 * On our first pass, poll will be false because we already know
517 * that input is available, and to call io_wait would be redundant.
519 if (poll
&& action
!= TA_SOCKET_READ_RESIDUAL
)
521 const int orig_action
= action
;
522 action
= multi_tcp_wait_lite (m
, mi
, action
, &tun_input_pending
);
523 if (action
== TA_UNDEF
)
524 msg (M_FATAL
, "MULTI TCP: I/O wait required blocking in multi_tcp_action, action=%d", orig_action
);
528 * Dispatch the action
531 struct multi_instance
*touched
= multi_tcp_dispatch (m
, mi
, action
);
534 * Signal received or TCP connection
537 if (touched
&& IS_SIG (&touched
->context
))
541 multi_close_instance_on_signal (m
, touched
);
546 * If dispatch produced any pending output
547 * for a particular instance, point to
554 * Based on the effects of the action,
555 * such as generating pending output,
556 * possibly transition to a new action state.
558 action
= multi_tcp_post (m
, mi
, action
);
561 * If we are finished processing the original action,
562 * check if we have any TUN input. If so, transition
563 * our action state to processing this input.
565 if (tun_input_pending
&& action
== TA_UNDEF
)
567 action
= TA_TUN_READ
;
569 tun_input_pending
= false;
575 } while (action
!= TA_UNDEF
);
579 multi_tcp_process_io (struct multi_context
*m
)
581 struct multi_tcp
*mtcp
= m
->mtcp
;
584 for (i
= 0; i
< mtcp
->n_esr
; ++i
)
586 struct event_set_return
*e
= &mtcp
->esr
[i
];
588 /* incoming data for instance? */
589 if (e
->arg
>= MTCP_N
)
591 struct multi_instance
*mi
= (struct multi_instance
*) e
->arg
;
594 if (e
->rwflags
& EVENT_WRITE
)
595 multi_tcp_action (m
, mi
, TA_SOCKET_WRITE_READY
, false);
596 else if (e
->rwflags
& EVENT_READ
)
597 multi_tcp_action (m
, mi
, TA_SOCKET_READ
, false);
602 #ifdef ENABLE_MANAGEMENT
603 if (e
->arg
== MTCP_MANAGEMENT
)
606 management_io (management
);
610 /* incoming data on TUN? */
611 if (e
->arg
== MTCP_TUN
)
613 if (e
->rwflags
& EVENT_WRITE
)
614 multi_tcp_action (m
, NULL
, TA_TUN_WRITE
, false);
615 else if (e
->rwflags
& EVENT_READ
)
616 multi_tcp_action (m
, NULL
, TA_TUN_READ
, false);
618 /* new incoming TCP client attempting to connect? */
619 else if (e
->arg
== MTCP_SOCKET
)
621 struct multi_instance
*mi
;
622 ASSERT (m
->top
.c2
.link_socket
);
623 socket_reset_listen_persistent (m
->top
.c2
.link_socket
);
624 mi
= multi_create_instance_tcp (m
);
626 multi_tcp_action (m
, mi
, TA_INITIAL
, false);
628 /* signal received? */
629 else if (e
->arg
== MTCP_SIG
)
631 get_signal (&m
->top
.sig
->signal_received
);
634 if (IS_SIG (&m
->top
))
640 * Process queued mbuf packets destined for TCP socket
643 struct multi_instance
*mi
;
644 while (!IS_SIG (&m
->top
) && (mi
= mbuf_peek (m
->mbuf
)) != NULL
)
646 multi_tcp_action (m
, mi
, TA_SOCKET_WRITE
, true);
652 * Top level event loop for single-threaded operation.
656 tunnel_server_tcp (struct context
*top
)
658 struct multi_context multi
;
662 context_clear_2 (top
);
664 /* initialize top-tunnel instance */
665 init_instance_handle_signals (top
, top
->es
, CC_HARD_USR1_TO_HUP
);
669 /* initialize global multi_context object */
670 multi_init (&multi
, top
, true, MC_SINGLE_THREADED
);
672 /* initialize our cloned top object */
673 multi_top_init (&multi
, top
, true);
675 /* initialize management interface */
676 init_management_callback_multi (&multi
);
678 /* finished with initialization */
679 initialization_sequence_completed (top
, ISC_SERVER
); /* --mode server --proto tcp-server */
681 /* per-packet event loop */
684 perf_push (PERF_EVENT_LOOP
);
686 /* wait on tun/socket list */
687 multi_get_timeout (&multi
, &multi
.top
.c2
.timeval
);
688 status
= multi_tcp_wait (&multi
.top
, multi
.mtcp
);
689 MULTI_CHECK_SIG (&multi
);
691 /* check on status of coarse timers */
692 multi_process_per_second_timers (&multi
);
697 /* process the I/O which triggered select */
698 multi_tcp_process_io (&multi
);
699 MULTI_CHECK_SIG (&multi
);
701 else if (status
== 0)
703 multi_tcp_action (&multi
, NULL
, TA_TIMEOUT
, false);
709 /* shut down management interface */
710 uninit_management_callback_multi (&multi
);
712 /* save ifconfig-pool */
713 multi_ifconfig_pool_persist (&multi
, true);
715 /* tear down tunnel instance (unless --persist-tun) */
716 multi_uninit (&multi
);
717 multi_top_free (&multi
);
718 close_instance (top
);