2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
8 * Copyright (C) 2002-2008 Telethra, Inc. <sales@openvpn.net>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program (see the file COPYING included with this
21 * distribution); if not, write to the Free Software Foundation, Inc.,
22 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
33 #include "packet_id.h"
52 * Our global key schedules, packaged thusly
53 * to facilitate --persist-key.
59 /* which cipher, HMAC digest, and key sizes are we using? */
60 struct key_type key_type
;
62 /* pre-shared static key, read from a file */
63 struct key_ctx_bi static_key
;
66 /* our global SSL context */
69 /* optional authentication HMAC key for TLS control channel */
70 struct key_ctx_bi tls_auth_key
;
73 #else /* USE_CRYPTO */
75 #endif /* USE_CRYPTO */
79 * struct packet_id_persist should be empty if we are not
80 * building with crypto.
83 struct packet_id_persist
88 packet_id_persist_init (struct packet_id_persist
*p
)
94 * Packet processing buffers.
96 struct context_buffers
98 /* miscellaneous buffer, used by ping, occ, etc. */
99 struct buffer aux_buf
;
101 /* workspace buffers used by crypto routines */
103 struct buffer encrypt_buf
;
104 struct buffer decrypt_buf
;
107 /* workspace buffers for LZO compression */
109 struct buffer lzo_compress_buf
;
110 struct buffer lzo_decompress_buf
;
114 * Buffers used to read from TUN device
117 struct buffer read_link_buf
;
118 struct buffer read_tun_buf
;
122 * always-persistent context variables
124 struct context_persist
126 int restart_sleep_seconds
;
130 * level 0 context contains data related to
131 * once-per OpenVPN instantiation events
132 * such as daemonization.
136 /* workspace for get_pid_file/write_pid */
137 struct pid_state pid_state
;
139 /* workspace for --user/--group */
140 bool uid_gid_specified
;
142 struct user_state user_state
;
143 struct group_state group_state
;
147 * Contains the persist-across-restart OpenVPN tunnel instance state.
148 * Reset only for SIGHUP restarts.
152 /* local and remote addresses */
153 struct link_socket_addr link_socket_addr
;
155 /* tunnel session keys */
156 struct key_schedule ks
;
158 /* persist crypto sequence number to/from file */
159 struct packet_id_persist pid_persist
;
161 /* TUN/TAP interface */
162 struct tuntap
*tuntap
;
165 /* list of --route directives */
166 struct route_list
*route_list
;
169 struct status_output
*status_output
;
170 bool status_output_owned
;
172 #ifdef ENABLE_HTTP_PROXY
173 /* HTTP proxy object */
174 struct http_proxy_info
*http_proxy
;
175 bool http_proxy_owned
;
179 /* SOCKS proxy object */
180 struct socks_proxy_info
*socks_proxy
;
181 bool socks_proxy_owned
;
187 /* persist --ifconfig-pool db to file */
188 struct ifconfig_pool_persist
*ifconfig_pool_persist
;
189 bool ifconfig_pool_persist_owned
;
192 /* if client mode, option strings we pulled from server */
193 char *pulled_options_string_save
;
195 /* save user/pass for authentication */
196 struct user_pass
*auth_user_pass
;
201 * Contains the OpenVPN tunnel instance state, wiped across
202 * SIGUSR1 and SIGHUP restarts.
206 /* garbage collection arena for context_2 scope */
209 /* our global wait events */
210 struct event_set
*event_set
;
212 bool event_set_owned
;
214 /* event flags returned by io_wait */
215 # define SOCKET_READ (1<<0)
216 # define SOCKET_WRITE (1<<1)
217 # define TUN_READ (1<<2)
218 # define TUN_WRITE (1<<3)
219 # define ES_ERROR (1<<4)
220 # define ES_TIMEOUT (1<<5)
221 # ifdef ENABLE_MANAGEMENT
222 # define MANAGEMENT_READ (1<<6)
223 # define MANAGEMENT_WRITE (1<<7)
226 unsigned int event_set_status
;
228 struct link_socket
*link_socket
; /* socket used for TCP/UDP connection to remote */
229 bool link_socket_owned
;
230 struct link_socket_info
*link_socket_info
;
231 const struct link_socket
*accept_from
; /* possibly do accept() on a parent link_socket */
233 struct link_socket_actual
*to_link_addr
; /* IP address of remote */
234 struct link_socket_actual from
; /* address of incoming datagram */
236 /* MTU frame parameters */
239 #ifdef ENABLE_FRAGMENT
240 /* Object to handle advanced MTU negotiation and datagram fragmentation */
241 struct fragment_master
*fragment
;
242 struct frame frame_fragment
;
243 struct frame frame_fragment_omit
;
246 #ifdef HAVE_GETTIMEOFDAY
248 * Traffic shaper object.
250 struct shaper shaper
;
256 counter_type tun_read_bytes
;
257 counter_type tun_write_bytes
;
258 counter_type link_read_bytes
;
259 counter_type link_read_bytes_auth
;
260 counter_type link_write_bytes
;
261 #ifdef PACKET_TRUNCATION_CHECK
262 counter_type n_trunc_tun_read
;
263 counter_type n_trunc_tun_write
;
264 counter_type n_trunc_pre_encrypt
;
265 counter_type n_trunc_post_decrypt
;
269 * Timer objects for ping and inactivity
272 struct event_timeout wait_for_connect
;
273 struct event_timeout ping_send_interval
;
274 struct event_timeout ping_rec_interval
;
277 struct event_timeout inactivity_interval
;
278 int inactivity_bytes
;
281 /* the option strings must match across peers */
282 char *options_string_local
;
283 char *options_string_remote
;
285 int occ_op
; /* INIT to -1 */
287 struct event_timeout occ_interval
;
291 * Keep track of maximum packet size received so far
292 * (of authenticated packets).
294 int original_recv_size
; /* temporary */
295 int max_recv_size_local
; /* max packet size received */
296 int max_recv_size_remote
; /* max packet size received by remote */
297 int max_send_size_local
; /* max packet size sent */
298 int max_send_size_remote
; /* max packet size sent by remote */
301 /* remote wants us to send back a load test packet of this size */
302 int occ_mtu_load_size
;
304 struct event_timeout occ_mtu_load_test_interval
;
305 int occ_mtu_load_n_tries
;
311 * TLS-mode crypto objects.
315 /* master OpenVPN SSL/TLS object */
316 struct tls_multi
*tls_multi
;
318 /* check --tls-auth signature without needing
319 a full-size tls_multi object */
320 struct tls_auth_standalone
*tls_auth_standalone
;
322 /* used to optimize calls to tls_multi_process */
323 struct interval tmp_int
;
325 /* throw this signal on TLS errors */
330 /* passed to encrypt or decrypt, contains all
331 crypto-related command line options related
332 to data channel encryption/decryption */
333 struct crypto_options crypto_options
;
335 /* used to keep track of data channel packet sequence numbers */
336 struct packet_id packet_id
;
337 struct event_timeout packet_id_persist_interval
;
339 #endif /* USE_CRYPTO */
342 * LZO compression library workspace.
345 struct lzo_compress_workspace lzo_compwork
;
349 * Buffers used for packet processing.
351 struct context_buffers
*buffers
;
352 bool buffers_owned
; /* if true, we should free all buffers on close */
355 * These buffers don't actually allocate storage, they are used
356 * as pointers to the allocated buffers in
357 * struct context_buffers.
360 struct buffer to_tun
;
361 struct buffer to_link
;
368 /* should we print R|W|r|w to console on packet transfers? */
372 struct event_timeout route_wakeup
;
373 struct event_timeout route_wakeup_expire
;
375 /* did we open tun/tap dev during this cycle? */
382 /* how long to wait on link/tun read before we will need to be serviced */
383 struct timeval timeval
;
385 /* next wakeup for processing coarse timers (>1 sec resolution) */
386 time_t coarse_timer_wakeup
;
388 /* maintain a random delta to add to timeouts to avoid contexts
389 waking up simultaneously */
390 time_t update_timeout_random_component
;
391 struct timeval timeout_random_component
;
393 /* indicates that the do_up_delay function has run */
397 /* indicates that we have received a SIGTERM when
398 options->explicit_exit_notification is enabled,
399 but we have not exited yet */
400 time_t explicit_exit_notification_time_wait
;
401 struct event_timeout explicit_exit_notification_interval
;
404 /* environmental variables to pass to scripts */
408 /* don't wait for TUN/TAP/UDP to be ready to accept write */
414 /* --ifconfig endpoints to be pushed to client */
415 bool push_reply_deferred
;
416 bool push_ifconfig_defined
;
417 in_addr_t push_ifconfig_local
;
418 in_addr_t push_ifconfig_remote_netmask
;
420 /* client authentication state, CAS_SUCCEEDED must be 0 */
421 # define CAS_SUCCEEDED 0
422 # define CAS_PENDING 1
423 # define CAS_FAILED 2
424 # define CAS_PARTIAL 3 /* at least one client-connect script/plugin
425 succeeded while a later one in the chain failed */
429 struct event_timeout push_request_interval
;
430 const char *pulled_options_string
;
432 struct event_timeout scheduled_exit
;
437 struct pf_context pf
;
440 #ifdef MANAGEMENT_DEF_AUTH
441 struct man_def_auth_context mda_context
;
446 * Contains all state information for one tunnel.
450 /* command line or config file options */
451 struct options options
;
453 /* true on initial VPN iteration */
456 /* used by multi-client code to lock the context */
457 /*MUTEX_DEFINE (mutex);*/
460 # define CM_P2P 0 /* standalone point-to-point session or client */
461 # define CM_TOP 1 /* top level of a multi-client or point-to-multipoint server */
462 # define CM_TOP_CLONE 2 /* clone of a CM_TOP context for one thread */
463 # define CM_CHILD_UDP 3 /* child context of a CM_TOP or CM_THREAD */
464 # define CM_CHILD_TCP 4 /* child context of a CM_TOP or CM_THREAD */
467 /* garbage collection for context scope
471 /* environmental variable settings */
475 struct signal_info
*sig
;
477 /* shared object plugins */
478 struct plugin_list
*plugins
;
481 /* set to true after we daemonize */
482 bool did_we_daemonize
;
484 /* persistent across SIGHUP */
485 struct context_persist persist
;
487 /* level 0 context contains data related to
488 once-per OpenVPN instantiation events
489 such as daemonization */
490 struct context_0
*c0
;
492 /* level 1 context is preserved for
493 SIGUSR1 restarts, but initialized
494 for SIGHUP restarts */
497 /* level 2 context is initialized for all
498 restarts (SIGUSR1 and SIGHUP) */
503 * Check for a signal when inside an event loop
505 #define EVENT_LOOP_CHECK_SIGNAL(c, func, arg) \
508 const int brk = func (arg); \
517 * Macros for referencing objects which may not
518 * have been compiled in.
521 #if defined(USE_CRYPTO) && defined(USE_SSL)
522 #define TLS_MODE(c) ((c)->c2.tls_multi != NULL)
523 #define PROTO_DUMP_FLAGS (check_debug_level (D_LINK_RW_VERBOSE) ? (PD_SHOW_DATA|PD_VERBOSE) : 0)
524 #define PROTO_DUMP(buf, gc) protocol_dump((buf), \
526 (c->c2.tls_multi ? PD_TLS : 0) | \
527 (c->options.tls_auth_file ? c->c1.ks.key_type.hmac_length : 0), \
530 #define TLS_MODE(c) (false)
531 #define PROTO_DUMP(buf, gc) format_hex (BPTR (buf), BLEN (buf), 80, gc)
535 #define MD5SUM(buf, len, gc) md5sum((buf), (len), 0, (gc))
537 #define MD5SUM(buf, len, gc) "[unavailable]"
541 #define CIPHER_ENABLED(c) (c->c1.ks.key_type.cipher != NULL)
543 #define CIPHER_ENABLED(c) (false)