release/src/router/openvpn/openvpn.h

   1 /*
   2  *  OpenVPN -- An application to securely tunnel IP networks
   3  *             over a single TCP/UDP port, with support for SSL/TLS-based
   4  *             session authentication and key exchange,
   5  *             packet encryption, packet authentication, and
   6  *             packet compression.
   7  *
   8  *  Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net>
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License version 2
  12  *  as published by the Free Software Foundation.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program (see the file COPYING included with this
  21  *  distribution); if not, write to the Free Software Foundation, Inc.,
  22  *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  23  */
  24
  25 #ifndef OPENVPN_H
  26 #define OPENVPN_H
  27
  28 #include "buffer.h"
  29 #include "options.h"
  30 #include "socket.h"
  31 #include "crypto.h"
  32 #include "ssl.h"
  33 #include "packet_id.h"
  34 #include "lzo.h"
  35 #include "tun.h"
  36 #include "interval.h"
  37 #include "status.h"
  38 #include "fragment.h"
  39 #include "shaper.h"
  40 #include "route.h"
  41 #include "proxy.h"
  42 #include "socks.h"
  43 #include "sig.h"
  44 #include "misc.h"
  45 #include "mbuf.h"
  46 #include "pool.h"
  47 #include "plugin.h"
  48 #include "manage.h"
  49 #include "pf.h"
  50
  51 /*
  52  * Our global key schedules, packaged thusly
  53  * to facilitate --persist-key.
  54  */
  55
  56 struct key_schedule
  57 {
  58 #ifdef USE_CRYPTO
  59   /* which cipher, HMAC digest, and key sizes are we using? */
  60   struct key_type key_type;
  61
  62   /* pre-shared static key, read from a file */
  63   struct key_ctx_bi static_key;
  64
  65 #ifdef USE_SSL
  66   /* our global SSL context */
  67   SSL_CTX *ssl_ctx;
  68
  69   /* optional authentication HMAC key for TLS control channel */
  70   struct key_ctx_bi tls_auth_key;
  71
  72 #endif                          /* USE_SSL */
  73 #else                           /* USE_CRYPTO */
  74   int dummy;
  75 #endif                          /* USE_CRYPTO */
  76 };
  77
  78 /*
  79  * struct packet_id_persist should be empty if we are not
  80  * building with crypto.
  81  */
  82 #ifndef PACKET_ID_H
  83 struct packet_id_persist
  84 {
  85   int dummy;
  86 };
  87 static inline void
  88 packet_id_persist_init (struct packet_id_persist *p)
  89 {
  90 }
  91 #endif
  92
  93 /*
  94  * Packet processing buffers.
  95  */
  96 struct context_buffers
  97 {
  98   /* miscellaneous buffer, used by ping, occ, etc. */
  99   struct buffer aux_buf;
 100
 101   /* workspace buffers used by crypto routines */
 102 #ifdef USE_CRYPTO
 103   struct buffer encrypt_buf;
 104   struct buffer decrypt_buf;
 105 #endif
 106
 107   /* workspace buffers for LZO compression */
 108 #ifdef USE_LZO
 109   struct buffer lzo_compress_buf;
 110   struct buffer lzo_decompress_buf;
 111 #endif
 112
 113   /*
 114    * Buffers used to read from TUN device
 115    * and TCP/UDP port.
 116    */
 117   struct buffer read_link_buf;
 118   struct buffer read_tun_buf;
 119 };
 120
 121 /*
 122  * always-persistent context variables
 123  */
 124 struct context_persist
 125 {
 126   int restart_sleep_seconds;
 127 };
 128
 129 /*
 130  * level 0 context contains data related to
 131  * once-per OpenVPN instantiation events
 132  * such as daemonization.
 133  */
 134 struct context_0
 135 {
 136   /* workspace for get_pid_file/write_pid */
 137   struct pid_state pid_state;
 138
 139   /* workspace for --user/--group */
 140   bool uid_gid_specified;
 141   bool uid_gid_set;
 142   struct user_state user_state;
 143   struct group_state group_state;
 144 };
 145
 146 /*
 147  * Contains the persist-across-restart OpenVPN tunnel instance state.
 148  * Reset only for SIGHUP restarts.
 149  */
 150 struct context_1
 151 {
 152   /* local and remote addresses */
 153   struct link_socket_addr link_socket_addr;
 154
 155   /* tunnel session keys */
 156   struct key_schedule ks;
 157
 158   /* persist crypto sequence number to/from file */
 159   struct packet_id_persist pid_persist;
 160
 161   /* TUN/TAP interface */
 162   struct tuntap *tuntap;
 163   bool tuntap_owned;
 164
 165   /* list of --route directives */
 166   struct route_list *route_list;
 167
 168   /* --status file */
 169   struct status_output *status_output;
 170   bool status_output_owned;
 171
 172 #ifdef ENABLE_HTTP_PROXY
 173   /* HTTP proxy object */
 174   struct http_proxy_info *http_proxy;
 175   bool http_proxy_owned;
 176 #endif
 177
 178 #ifdef ENABLE_SOCKS
 179   /* SOCKS proxy object */
 180   struct socks_proxy_info *socks_proxy;
 181   bool socks_proxy_owned;
 182 #endif
 183
 184 #if P2MP
 185
 186 #if P2MP_SERVER
 187   /* persist --ifconfig-pool db to file */
 188   struct ifconfig_pool_persist *ifconfig_pool_persist;
 189   bool ifconfig_pool_persist_owned;
 190 #endif
 191
 192   /* if client mode, hash of option strings we pulled from server */
 193   struct md5_digest pulled_options_digest_save;
 194
 195   /* save user/pass for authentication */
 196   struct user_pass *auth_user_pass;
 197 #endif
 198 };
 199
 200 /*
 201  * Contains the OpenVPN tunnel instance state, wiped across
 202  * SIGUSR1 and SIGHUP restarts.
 203  */
 204 struct context_2
 205 {
 206   /* garbage collection arena for context_2 scope */
 207   struct gc_arena gc;
 208
 209   /* our global wait events */
 210   struct event_set *event_set;
 211   int event_set_max;
 212   bool event_set_owned;
 213
 214   /* event flags returned by io_wait */
 215 # define SOCKET_READ       (1<<0)
 216 # define SOCKET_WRITE      (1<<1)
 217 # define TUN_READ          (1<<2)
 218 # define TUN_WRITE         (1<<3)
 219 # define ES_ERROR          (1<<4)
 220 # define ES_TIMEOUT        (1<<5)
 221 # ifdef ENABLE_MANAGEMENT
 222 #  define MANAGEMENT_READ  (1<<6)
 223 #  define MANAGEMENT_WRITE (1<<7)
 224 # endif
 225
 226   unsigned int event_set_status;
 227
 228   struct link_socket *link_socket;       /* socket used for TCP/UDP connection to remote */
 229   bool link_socket_owned;
 230   struct link_socket_info *link_socket_info;
 231   const struct link_socket *accept_from; /* possibly do accept() on a parent link_socket */
 232
 233   struct link_socket_actual *to_link_addr;      /* IP address of remote */
 234   struct link_socket_actual from;               /* address of incoming datagram */
 235
 236   /* MTU frame parameters */
 237   struct frame frame;
 238
 239 #ifdef ENABLE_FRAGMENT
 240   /* Object to handle advanced MTU negotiation and datagram fragmentation */
 241   struct fragment_master *fragment;
 242   struct frame frame_fragment;
 243   struct frame frame_fragment_omit;
 244 #endif
 245
 246 #ifdef HAVE_GETTIMEOFDAY
 247   /*
 248    * Traffic shaper object.
 249    */
 250   struct shaper shaper;
 251 #endif
 252
 253   /*
 254    * Statistics
 255    */
 256   counter_type tun_read_bytes;
 257   counter_type tun_write_bytes;
 258   counter_type link_read_bytes;
 259   counter_type link_read_bytes_auth;
 260   counter_type link_write_bytes;
 261 #ifdef PACKET_TRUNCATION_CHECK
 262   counter_type n_trunc_tun_read;
 263   counter_type n_trunc_tun_write;
 264   counter_type n_trunc_pre_encrypt;
 265   counter_type n_trunc_post_decrypt;
 266 #endif
 267
 268   /*
 269    * Timer objects for ping and inactivity
 270    * timeout features.
 271    */
 272   struct event_timeout wait_for_connect;
 273   struct event_timeout ping_send_interval;
 274   struct event_timeout ping_rec_interval;
 275
 276   /* --inactive */
 277   struct event_timeout inactivity_interval;
 278   int inactivity_bytes;
 279
 280 #ifdef ENABLE_OCC
 281   /* the option strings must match across peers */
 282   char *options_string_local;
 283   char *options_string_remote;
 284
 285   int occ_op;                   /* INIT to -1 */
 286   int occ_n_tries;
 287   struct event_timeout occ_interval;
 288 #endif
 289
 290   /*
 291    * Keep track of maximum packet size received so far
 292    * (of authenticated packets).
 293    */
 294   int original_recv_size;       /* temporary */
 295   int max_recv_size_local;      /* max packet size received */
 296   int max_recv_size_remote;     /* max packet size received by remote */
 297   int max_send_size_local;      /* max packet size sent */
 298   int max_send_size_remote;     /* max packet size sent by remote */
 299
 300 #ifdef ENABLE_OCC
 301   /* remote wants us to send back a load test packet of this size */
 302   int occ_mtu_load_size;
 303
 304   struct event_timeout occ_mtu_load_test_interval;
 305   int occ_mtu_load_n_tries;
 306 #endif
 307
 308 #ifdef USE_CRYPTO
 309
 310   /*
 311    * TLS-mode crypto objects.
 312    */
 313 #ifdef USE_SSL
 314
 315   /* master OpenVPN SSL/TLS object */
 316   struct tls_multi *tls_multi;
 317
 318   /* check --tls-auth signature without needing
 319      a full-size tls_multi object */
 320   struct tls_auth_standalone *tls_auth_standalone;
 321
 322   /* used to optimize calls to tls_multi_process */
 323   struct interval tmp_int;
 324
 325   /* throw this signal on TLS errors */
 326   int tls_exit_signal;
 327
 328 #endif /* USE_SSL */
 329
 330   /* passed to encrypt or decrypt, contains all
 331      crypto-related command line options related
 332      to data channel encryption/decryption */
 333   struct crypto_options crypto_options;
 334
 335   /* used to keep track of data channel packet sequence numbers */
 336   struct packet_id packet_id;
 337   struct event_timeout packet_id_persist_interval;
 338
 339 #endif /* USE_CRYPTO */
 340
 341   /*
 342    * LZO compression library workspace.
 343    */
 344 #ifdef USE_LZO
 345   struct lzo_compress_workspace lzo_compwork;
 346 #endif
 347
 348   /*
 349    * Buffers used for packet processing.
 350    */
 351   struct context_buffers *buffers;
 352   bool buffers_owned; /* if true, we should free all buffers on close */
 353
 354   /*
 355    * These buffers don't actually allocate storage, they are used
 356    * as pointers to the allocated buffers in
 357    * struct context_buffers.
 358    */
 359   struct buffer buf;
 360   struct buffer to_tun;
 361   struct buffer to_link;
 362
 363   /*
 364    * IPv4 TUN device?
 365    */
 366   bool ipv4_tun;
 367
 368   /* should we print R|W|r|w to console on packet transfers? */
 369   bool log_rw;
 370
 371   /* route stuff */
 372   struct event_timeout route_wakeup;
 373   struct event_timeout route_wakeup_expire;
 374
 375   /* did we open tun/tap dev during this cycle? */
 376   bool did_open_tun;
 377
 378   /*
 379    * Event loop info
 380    */
 381
 382   /* how long to wait on link/tun read before we will need to be serviced */
 383   struct timeval timeval;
 384
 385   /* next wakeup for processing coarse timers (>1 sec resolution) */
 386   time_t coarse_timer_wakeup;
 387
 388   /* maintain a random delta to add to timeouts to avoid contexts
 389      waking up simultaneously */
 390   time_t update_timeout_random_component;
 391   struct timeval timeout_random_component;
 392
 393   /* indicates that the do_up_delay function has run */
 394   bool do_up_ran;
 395
 396 #ifdef ENABLE_OCC
 397   /* indicates that we have received a SIGTERM when
 398      options->explicit_exit_notification is enabled,
 399      but we have not exited yet */
 400   time_t explicit_exit_notification_time_wait;
 401   struct event_timeout explicit_exit_notification_interval;
 402 #endif
 403
 404   /* environmental variables to pass to scripts */
 405   struct env_set *es;
 406   bool es_owned;
 407
 408   /* don't wait for TUN/TAP/UDP to be ready to accept write */
 409   bool fast_io;
 410
 411 #if P2MP
 412
 413 #if P2MP_SERVER
 414   /* --ifconfig endpoints to be pushed to client */
 415   bool push_reply_deferred;
 416   bool push_ifconfig_defined;
 417   in_addr_t push_ifconfig_local;
 418   in_addr_t push_ifconfig_remote_netmask;
 419
 420   /* client authentication state, CAS_SUCCEEDED must be 0 */
 421 # define CAS_SUCCEEDED 0
 422 # define CAS_PENDING   1
 423 # define CAS_FAILED    2
 424 # define CAS_PARTIAL   3 /* at least one client-connect script/plugin
 425                             succeeded while a later one in the chain failed */
 426   int context_auth;
 427 #endif
 428
 429   struct event_timeout push_request_interval;
 430   bool did_pre_pull_restore;
 431
 432   /* hash of pulled options, so we can compare when options change */
 433   struct md5_state pulled_options_state;
 434   struct md5_digest pulled_options_digest;
 435
 436   struct event_timeout server_poll_interval;
 437
 438   struct event_timeout scheduled_exit;
 439   int scheduled_exit_signal;
 440 #endif
 441
 442   /* packet filter */
 443 #ifdef ENABLE_PF
 444   struct pf_context pf;
 445 #endif
 446
 447 #ifdef MANAGEMENT_DEF_AUTH
 448   struct man_def_auth_context mda_context;
 449 #endif
 450 };
 451
 452 /*
 453  * Contains all state information for one tunnel.
 454  */
 455 struct context
 456 {
 457   /* command line or config file options */
 458   struct options options;
 459
 460   /* true on initial VPN iteration */
 461   bool first_time;
 462
 463   /* used by multi-client code to lock the context */
 464   /*MUTEX_DEFINE (mutex);*/
 465
 466   /* context modes */
 467 # define CM_P2P            0 /* standalone point-to-point session or client */
 468 # define CM_TOP            1 /* top level of a multi-client or point-to-multipoint server */
 469 # define CM_TOP_CLONE      2 /* clone of a CM_TOP context for one thread */
 470 # define CM_CHILD_UDP      3 /* child context of a CM_TOP or CM_THREAD */
 471 # define CM_CHILD_TCP      4 /* child context of a CM_TOP or CM_THREAD */
 472   int mode;
 473
 474   /* garbage collection for context scope
 475      allocations */
 476   struct gc_arena gc;
 477
 478   /* environmental variable settings */
 479   struct env_set *es;
 480
 481   /* signal info */
 482   struct signal_info *sig;
 483
 484   /* shared object plugins */
 485   struct plugin_list *plugins;
 486   bool plugins_owned;
 487
 488   /* set to true after we daemonize */
 489   bool did_we_daemonize;
 490
 491   /* persistent across SIGHUP */
 492   struct context_persist persist;
 493
 494   /* level 0 context contains data related to
 495      once-per OpenVPN instantiation events
 496      such as daemonization */
 497   struct context_0 *c0;
 498
 499   /* level 1 context is preserved for
 500      SIGUSR1 restarts, but initialized
 501      for SIGHUP restarts */
 502   struct context_1 c1;
 503
 504   /* level 2 context is initialized for all
 505      restarts (SIGUSR1 and SIGHUP) */
 506   struct context_2 c2;
 507 };
 508
 509 /*
 510  * Check for a signal when inside an event loop
 511  */
 512 #define EVENT_LOOP_CHECK_SIGNAL(c, func, arg)   \
 513       if (IS_SIG (c))                           \
 514         {                                       \
 515           const int brk = func (arg);           \
 516           perf_pop ();                          \
 517           if (brk)                              \
 518             break;                              \
 519           else                                  \
 520             continue;                           \
 521         }
 522
 523 /*
 524  * Macros for referencing objects which may not
 525  * have been compiled in.
 526  */
 527
 528 #if defined(USE_CRYPTO) && defined(USE_SSL)
 529 #define TLS_MODE(c) ((c)->c2.tls_multi != NULL)
 530 #define PROTO_DUMP_FLAGS (check_debug_level (D_LINK_RW_VERBOSE) ? (PD_SHOW_DATA|PD_VERBOSE) : 0)
 531 #define PROTO_DUMP(buf, gc) protocol_dump((buf), \
 532                                       PROTO_DUMP_FLAGS | \
 533                                       (c->c2.tls_multi ? PD_TLS : 0) | \
 534                                       (c->options.tls_auth_file ? c->c1.ks.key_type.hmac_length : 0), \
 535                                       gc)
 536 #else
 537 #define TLS_MODE(c) (false)
 538 #define PROTO_DUMP(buf, gc) format_hex (BPTR (buf), BLEN (buf), 80, gc)
 539 #endif
 540
 541 #ifdef USE_CRYPTO
 542 #define MD5SUM(buf, len, gc) md5sum((buf), (len), 0, (gc))
 543 #else
 544 #define MD5SUM(buf, len, gc) "[unavailable]"
 545 #endif
 546
 547 #ifdef USE_CRYPTO
 548 #define CIPHER_ENABLED(c) (c->c1.ks.key_type.cipher != NULL)
 549 #else
 550 #define CIPHER_ENABLED(c) (false)
 551 #endif
 552
 553 #endif