?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Downgrade OpenVPN version to 2.1rc13 from 2.1.rc15
[tomato.git] / release / src / router / openvpn / init.c
blob9bf1c3fd61e2ef63944736c125036af142d3fcfc
1 /*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2008 OpenVPN Technologies, Inc. <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program (see the file COPYING included with this
21 * distribution); if not, write to the Free Software Foundation, Inc.,
22 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
23 */
24
25 #include "syshead.h"
26
27 #include "win32.h"
28 #include "init.h"
29 #include "sig.h"
30 #include "occ.h"
31 #include "list.h"
32 #include "otime.h"
33 #include "pool.h"
34 #include "gremlin.h"
35 #include "pkcs11.h"
36 #include "ps.h"
37 #include "lladdr.h"
38
39 #include "memdbg.h"
40
41 #include "occ-inline.h"
42
43 #include "ping.h"
44
45 /*
46 * Crypto initialization flags
47 */
48 #define CF_LOAD_PERSISTED_PACKET_ID (1<<0)
49 #define CF_INIT_TLS_MULTI (1<<1)
50 #define CF_INIT_TLS_AUTH_STANDALONE (1<<2)
51
52 static void do_init_first_time (struct context *c);
53
54 void
55 context_clear (struct context *c)
56 {
57 CLEAR (*c);
58 }
59
60 void
61 context_clear_1 (struct context *c)
62 {
63 CLEAR (c->c1);
64 }
65
66 void
67 context_clear_2 (struct context *c)
68 {
69 CLEAR (c->c2);
70 }
71
72 void
73 context_clear_all_except_first_time (struct context *c)
74 {
75 const bool first_time_save = c->first_time;
76 const struct context_persist cpsave = c->persist;
77 context_clear (c);
78 c->first_time = first_time_save;
79 c->persist = cpsave;
80 }
81
82 /*
83 * Should be called after options->ce is modified at the top
84 * of a SIGUSR1 restart.
85 */
86 static void
87 update_options_ce_post (struct options *options)
88 {
89 #if P2MP
90 /*
91 * In pull mode, we usually import --ping/--ping-restart parameters from
92 * the server. However we should also set an initial default --ping-restart
93 * for the period of time before we pull the --ping-restart parameter
94 * from the server.
95 */
96 if (options->pull
97 && options->ping_rec_timeout_action == PING_UNDEF
98 && options->ce.proto == PROTO_UDPv4)
99 {
100 options->ping_rec_timeout = PRE_PULL_INITIAL_PING_RESTART;
101 options->ping_rec_timeout_action = PING_RESTART;
102 }
103 #endif
104 #ifdef USE_CRYPTO
105 /*
106 * Don't use replay window for TCP mode (i.e. require that packets be strictly in sequence).
107 */
108 if (link_socket_proto_connection_oriented (options->ce.proto))
109 options->replay_window = options->replay_time = 0;
110 #endif
111 }
112
113 /*
114 * Initialize and possibly randomize connection list.
115 */
116 static void
117 init_connection_list (struct context *c)
118 {
119 #ifdef ENABLE_CONNECTION
120 struct connection_list *l = c->options.connection_list;
121 if (l)
122 {
123 l->current = -1;
124 if (c->options.remote_random)
125 {
126 int i;
127 for (i = 0; i < l->len; ++i)
128 {
129 const int j = get_random () % l->len;
130 if (i != j)
131 {
132 struct connection_entry *tmp;
133 tmp = l->array[i];
134 l->array[i] = l->array[j];
135 l->array[j] = tmp;
136 }
137 }
138 }
139 }
140 #endif
141 }
142
143 /*
144 * Increment to next connection entry
145 */
146 static void
147 next_connection_entry (struct context *c)
148 {
149 #ifdef ENABLE_CONNECTION
150 struct connection_list *l = c->options.connection_list;
151 if (l)
152 {
153 if (l->no_advance && l->current >= 0)
154 {
155 l->no_advance = false;
156 }
157 else
158 {
159 int i;
160 if (++l->current >= l->len)
161 l->current = 0;
162
163 dmsg (D_CONNECTION_LIST, "CONNECTION_LIST len=%d current=%d",
164 l->len, l->current);
165 for (i = 0; i < l->len; ++i)
166 {
167 dmsg (D_CONNECTION_LIST, "[%d] %s:%d",
168 i,
169 l->array[i]->remote,
170 l->array[i]->remote_port);
171 }
172 }
173 c->options.ce = *l->array[l->current];
174 }
175 #endif
176 update_options_ce_post (&c->options);
177 }
178
179 /*
180 * Query for private key and auth-user-pass username/passwords
181 */
182 static void
183 init_query_passwords (struct context *c)
184 {
185 #if defined(USE_CRYPTO) && defined(USE_SSL)
186 /* Certificate password input */
187 if (c->options.key_pass_file)
188 pem_password_setup (c->options.key_pass_file);
189 #endif
190
191 #if P2MP
192 /* Auth user/pass input */
193 if (c->options.auth_user_pass_file)
194 auth_user_pass_setup (c->options.auth_user_pass_file);
195 #endif
196 }
197
198 /*
199 * Initialize/Uninitialize HTTP or SOCKS proxy
200 */
201
202 #ifdef GENERAL_PROXY_SUPPORT
203
204 static int
205 proxy_scope (struct context *c)
206 {
207 return connection_list_defined (&c->options) ? 2 : 1;
208 }
209
210 static void
211 uninit_proxy_dowork (struct context *c)
212 {
213 #ifdef ENABLE_HTTP_PROXY
214 if (c->c1.http_proxy_owned && c->c1.http_proxy)
215 {
216 http_proxy_close (c->c1.http_proxy);
217 c->c1.http_proxy = NULL;
218 c->c1.http_proxy_owned = false;
219 }
220 #endif
221 #ifdef ENABLE_SOCKS
222 if (c->c1.socks_proxy_owned && c->c1.socks_proxy)
223 {
224 socks_proxy_close (c->c1.socks_proxy);
225 c->c1.socks_proxy = NULL;
226 c->c1.socks_proxy_owned = false;
227 }
228 #endif
229 }
230
231 static void
232 init_proxy_dowork (struct context *c)
233 {
234 #ifdef ENABLE_HTTP_PROXY
235 bool did_http = false;
236 #else
237 const bool did_http = false;
238 #endif
239
240 uninit_proxy_dowork (c);
241
242 #ifdef ENABLE_HTTP_PROXY
243 if (c->options.ce.http_proxy_options || c->options.auto_proxy_info)
244 {
245 /* Possible HTTP proxy user/pass input */
246 c->c1.http_proxy = http_proxy_new (c->options.ce.http_proxy_options,
247 c->options.auto_proxy_info);
248 if (c->c1.http_proxy)
249 {
250 did_http = true;
251 c->c1.http_proxy_owned = true;
252 }
253 }
254 #endif
255
256 #ifdef ENABLE_SOCKS
257 if (!did_http && (c->options.ce.socks_proxy_server || c->options.auto_proxy_info))
258 {
259 c->c1.socks_proxy = socks_proxy_new (c->options.ce.socks_proxy_server,
260 c->options.ce.socks_proxy_port,
261 c->options.ce.socks_proxy_retry,
262 c->options.auto_proxy_info);
263 if (c->c1.socks_proxy)
264 {
265 c->c1.socks_proxy_owned = true;
266 }
267 }
268 #endif
269 }
270
271 static void
272 init_proxy (struct context *c, const int scope)
273 {
274 if (scope == proxy_scope (c))
275 init_proxy_dowork (c);
276 }
277
278 static void
279 uninit_proxy (struct context *c)
280 {
281 if (c->sig->signal_received != SIGUSR1 || proxy_scope (c) == 2)
282 uninit_proxy_dowork (c);
283 }
284
285 #else
286
287 static inline void
288 init_proxy (struct context *c, const int scope)
289 {
290 }
291
292 static inline void
293 uninit_proxy (struct context *c)
294 {
295 }
296
297 #endif
298
299 void
300 context_init_1 (struct context *c)
301 {
302 context_clear_1 (c);
303
304 packet_id_persist_init (&c->c1.pid_persist);
305
306 init_connection_list (c);
307
308 init_query_passwords (c);
309
310 #if defined(ENABLE_PKCS11)
311 if (c->first_time) {
312 int i;
313 pkcs11_initialize (true, c->options.pkcs11_pin_cache_period);
314 for (i=0;i<MAX_PARMS && c->options.pkcs11_providers[i] != NULL;i++)
315 pkcs11_addProvider (c->options.pkcs11_providers[i], c->options.pkcs11_protected_authentication[i],
316 c->options.pkcs11_private_mode[i], c->options.pkcs11_cert_private[i]);
317 }
318 #endif
319
320 #if 0 /* test get_user_pass with GET_USER_PASS_NEED_OK flag */
321 {
322 /*
323 * In the management interface, you can okay the request by entering "needok token-insertion-request ok"
324 */
325 struct user_pass up;
326 CLEAR (up);
327 strcpy (up.username, "Please insert your cryptographic token"); /* put the high-level message in up.username */
328 get_user_pass (&up, NULL, "token-insertion-request", GET_USER_PASS_MANAGEMENT|GET_USER_PASS_NEED_OK);
329 msg (M_INFO, "RET:%s", up.password); /* will return the third argument to management interface
330 'needok' command, usually 'ok' or 'cancel'. */
331 }
332 #endif
333
334 /* initialize HTTP or SOCKS proxy object at scope level 1 */
335 init_proxy (c, 1);
336 }
337
338 void
339 context_gc_free (struct context *c)
340 {
341 gc_free (&c->c2.gc);
342 gc_free (&c->options.gc);
343 gc_free (&c->gc);
344 }
345
346 #if PORT_SHARE
347
348 static void
349 close_port_share (void)
350 {
351 if (port_share)
352 {
353 port_share_close (port_share);
354 port_share = NULL;
355 }
356 }
357
358 static void
359 init_port_share (struct context *c)
360 {
361 if (!port_share && (c->options.port_share_host && c->options.port_share_port))
362 {
363 port_share = port_share_open (c->options.port_share_host,
364 c->options.port_share_port);
365 if (port_share == NULL)
366 msg (M_FATAL, "Fatal error: Port sharing failed");
367 }
368 }
369
370 #endif
371
372 bool
373 init_static (void)
374 {
375 /* configure_path (); */
376
377 #if defined(USE_CRYPTO) && defined(DMALLOC)
378 openssl_dmalloc_init ();
379 #endif
380
381 init_random_seed (); /* init random() function, only used as
382 source for weak random numbers */
383 error_reset (); /* initialize error.c */
384 reset_check_status (); /* initialize status check code in socket.c */
385
386 #ifdef WIN32
387 init_win32 ();
388 #endif
389
390 #ifdef OPENVPN_DEBUG_COMMAND_LINE
391 {
392 int i;
393 for (i = 0; i < argc; ++i)
394 msg (M_INFO, "argv[%d] = '%s'", i, argv[i]);
395 }
396 #endif
397
398 update_time ();
399
400 #ifdef USE_CRYPTO
401 init_ssl_lib ();
402
403 /* init PRNG used for IV generation */
404 /* When forking, copy this to more places in the code to avoid fork
405 random-state predictability */
406 prng_init ();
407 #endif
408
409 #ifdef PID_TEST
410 packet_id_interactive_test (); /* test the sequence number code */
411 return false;
412 #endif
413
414 #ifdef SCHEDULE_TEST
415 schedule_test ();
416 return false;
417 #endif
418
419 #ifdef LIST_TEST
420 list_test ();
421 return false;
422 #endif
423
424 #ifdef IFCONFIG_POOL_TEST
425 ifconfig_pool_test (0x0A010004, 0x0A0100FF);
426 return false;
427 #endif
428
429 #ifdef CHARACTER_CLASS_DEBUG
430 character_class_debug ();
431 return false;
432 #endif
433
434 #ifdef EXTRACT_X509_FIELD_TEST
435 extract_x509_field_test ();
436 return false;
437 #endif
438
439 #ifdef TIME_TEST
440 time_test ();
441 return false;
442 #endif
443
444 #ifdef GEN_PATH_TEST
445 {
446 struct gc_arena gc = gc_new ();
447 const char *fn = gen_path ("foo",
448 "bar",
449 &gc);
450 printf ("%s\n", fn);
451 gc_free (&gc);
452 }
453 return false;
454 #endif
455
456 #ifdef STATUS_PRINTF_TEST
457 {
458 struct gc_arena gc = gc_new ();
459 const char *tmp_file = create_temp_filename ("/tmp", "foo", &gc);
460 struct status_output *so = status_open (tmp_file, 0, -1, NULL, STATUS_OUTPUT_WRITE);
461 status_printf (so, "%s", "foo");
462 status_printf (so, "%s", "bar");
463 if (!status_close (so))
464 msg (M_WARN, "STATUS_PRINTF_TEST: %s: write error", tmp_file);
465 gc_free (&gc);
466 }
467 return false;
468 #endif
469
470 #ifdef ARGV_TEST
471 {
472 void argv_test (void);
473 argv_test ();
474 return false;
475 }
476 #endif
477
478 return true;
479 }
480
481 void
482 uninit_static (void)
483 {
484 openvpn_thread_cleanup ();
485
486 #ifdef USE_CRYPTO
487 free_ssl_lib ();
488 #endif
489
490 #ifdef ENABLE_PKCS11
491 pkcs11_terminate ();
492 #endif
493
494 #if PORT_SHARE
495 close_port_share ();
496 #endif
497
498 #if defined(MEASURE_TLS_HANDSHAKE_STATS) && defined(USE_CRYPTO) && defined(USE_SSL)
499 show_tls_performance_stats ();
500 #endif
501 }
502
503 void
504 init_verb_mute (struct context *c, unsigned int flags)
505 {
506 if (flags & IVM_LEVEL_1)
507 {
508 /* set verbosity and mute levels */
509 set_check_status (D_LINK_ERRORS, D_READ_WRITE);
510 set_debug_level (c->options.verbosity, SDL_CONSTRAIN);
511 set_mute_cutoff (c->options.mute);
512 }
513
514 /* special D_LOG_RW mode */
515 if (flags & IVM_LEVEL_2)
516 c->c2.log_rw = (check_debug_level (D_LOG_RW) && !check_debug_level (D_LOG_RW + 1));
517 }
518
519 /*
520 * Possibly set --dev based on --dev-node.
521 * For example, if --dev-node /tmp/foo/tun, and --dev undefined,
522 * set --dev to tun.
523 */
524 void
525 init_options_dev (struct options *options)
526 {
527 if (!options->dev)
528 options->dev = dev_component_in_dev_node (options->dev_node);
529 }
530
531 bool
532 print_openssl_info (const struct options *options)
533 {
534 /*
535 * OpenSSL info print mode?
536 */
537 #ifdef USE_CRYPTO
538 if (options->show_ciphers || options->show_digests || options->show_engines
539 #ifdef USE_SSL
540 || options->show_tls_ciphers
541 #endif
542 )
543 {
544 if (options->show_ciphers)
545 show_available_ciphers ();
546 if (options->show_digests)
547 show_available_digests ();
548 if (options->show_engines)
549 show_available_engines ();
550 #ifdef USE_SSL
551 if (options->show_tls_ciphers)
552 show_available_tls_ciphers ();
553 #endif
554 return true;
555 }
556 #endif
557 return false;
558 }
559
560 /*
561 * Static pre-shared key generation mode?
562 */
563 bool
564 do_genkey (const struct options * options)
565 {
566 #ifdef USE_CRYPTO
567 if (options->genkey)
568 {
569 int nbits_written;
570
571 notnull (options->shared_secret_file,
572 "shared secret output file (--secret)");
573
574 if (options->mlock) /* should we disable paging? */
575 do_mlockall (true);
576
577 nbits_written = write_key_file (2, options->shared_secret_file);
578
579 msg (D_GENKEY | M_NOPREFIX,
580 "Randomly generated %d bit key written to %s", nbits_written,
581 options->shared_secret_file);
582 return true;
583 }
584 #endif
585 return false;
586 }
587
588 /*
589 * Persistent TUN/TAP device management mode?
590 */
591 bool
592 do_persist_tuntap (const struct options *options)
593 {
594 #ifdef TUNSETPERSIST
595 if (options->persist_config)
596 {
597 /* sanity check on options for --mktun or --rmtun */
598 notnull (options->dev, "TUN/TAP device (--dev)");
599 if (options->ce.remote || options->ifconfig_local
600 || options->ifconfig_remote_netmask
601 #ifdef USE_CRYPTO
602 || options->shared_secret_file
603 #ifdef USE_SSL
604 || options->tls_server || options->tls_client
605 #endif
606 #endif
607 )
608 msg (M_FATAL|M_OPTERR,
609 "options --mktun or --rmtun should only be used together with --dev");
610 tuncfg (options->dev, options->dev_type, options->dev_node,
611 options->tun_ipv6, options->persist_mode,
612 options->username, options->groupname, &options->tuntap_options);
613 if (options->persist_mode && options->lladdr)
614 set_lladdr(options->dev, options->lladdr, NULL);
615 return true;
616 }
617 #endif
618 return false;
619 }
620
621 /*
622 * Should we become a daemon?
623 * Return true if we did it.
624 */
625 static bool
626 possibly_become_daemon (const struct options *options, const bool first_time)
627 {
628 bool ret = false;
629 if (first_time && options->daemon)
630 {
631 ASSERT (!options->inetd);
632 if (daemon (options->cd_dir != NULL, options->log) < 0)
633 msg (M_ERR, "daemon() failed");
634 restore_signal_state ();
635 if (options->log)
636 set_std_files_to_null (true);
637
638 #if defined(ENABLE_PKCS11)
639 pkcs11_forkFixup ();
640 #endif
641
642 ret = true;
643 }
644 return ret;
645 }
646
647 /*
648 * Actually do UID/GID downgrade, and chroot, if requested.
649 */
650 static void
651 do_uid_gid_chroot (struct context *c, bool no_delay)
652 {
653 static const char why_not[] = "will be delayed because of --client, --pull, or --up-delay";
654 struct context_0 *c0 = c->c0;
655
656 if (c->first_time && c0 && !c0->uid_gid_set)
657 {
658 /* chroot if requested */
659 if (c->options.chroot_dir)
660 {
661 if (no_delay)
662 do_chroot (c->options.chroot_dir);
663 else
664 msg (M_INFO, "NOTE: chroot %s", why_not);
665 }
666
667 /* set user and/or group that we want to setuid/setgid to */
668 if (no_delay)
669 {
670 set_group (&c0->group_state);
671 set_user (&c0->user_state);
672 c0->uid_gid_set = true;
673 }
674 else if (c0->uid_gid_specified)
675 {
676 msg (M_INFO, "NOTE: UID/GID downgrade %s", why_not);
677 }
678 }
679 }
680
681 /*
682 * Return common name in a way that is formatted for
683 * prepending to msg() output.
684 */
685 const char *
686 format_common_name (struct context *c, struct gc_arena *gc)
687 {
688 struct buffer out = alloc_buf_gc (256, gc);
689 #if defined(USE_CRYPTO) && defined(USE_SSL)
690 if (c->c2.tls_multi)
691 {
692 buf_printf (&out, "[%s] ", tls_common_name (c->c2.tls_multi, false));
693 }
694 #endif
695 return BSTR (&out);
696 }
697
698 void
699 pre_setup (const struct options *options)
700 {
701 #ifdef WIN32
702 if (options->exit_event_name)
703 {
704 win32_signal_open (&win32_signal,
705 WSO_FORCE_SERVICE,
706 options->exit_event_name,
707 options->exit_event_initial_state);
708 }
709 else
710 {
711 win32_signal_open (&win32_signal,
712 WSO_FORCE_CONSOLE,
713 NULL,
714 false);
715
716 /* put a title on the top window bar */
717 if (win32_signal.mode == WSO_MODE_CONSOLE)
718 {
719 window_title_save (&window_title);
720 window_title_generate (options->config);
721 }
722 }
723 #endif
724 }
725
726 void
727 reset_coarse_timers (struct context *c)
728 {
729 c->c2.coarse_timer_wakeup = 0;
730 }
731
732 /*
733 * Initialize timers
734 */
735 static void
736 do_init_timers (struct context *c, bool deferred)
737 {
738 update_time ();
739 reset_coarse_timers (c);
740
741 /* initialize inactivity timeout */
742 if (c->options.inactivity_timeout)
743 event_timeout_init (&c->c2.inactivity_interval, c->options.inactivity_timeout, now);
744
745 /* initialize pings */
746
747 if (c->options.ping_send_timeout)
748 event_timeout_init (&c->c2.ping_send_interval, c->options.ping_send_timeout, 0);
749
750 if (c->options.ping_rec_timeout)
751 event_timeout_init (&c->c2.ping_rec_interval, c->options.ping_rec_timeout, now);
752
753 if (!deferred)
754 {
755 /* initialize connection establishment timer */
756 event_timeout_init (&c->c2.wait_for_connect, 1, now);
757
758 #ifdef ENABLE_OCC
759 /* initialize occ timers */
760
761 if (c->options.occ
762 && !TLS_MODE (c)
763 && c->c2.options_string_local && c->c2.options_string_remote)
764 event_timeout_init (&c->c2.occ_interval, OCC_INTERVAL_SECONDS, now);
765
766 if (c->options.mtu_test)
767 event_timeout_init (&c->c2.occ_mtu_load_test_interval, OCC_MTU_LOAD_INTERVAL_SECONDS, now);
768 #endif
769
770 /* initialize packet_id persistence timer */
771 #ifdef USE_CRYPTO
772 if (c->options.packet_id_file)
773 event_timeout_init (&c->c2.packet_id_persist_interval, 60, now);
774 #endif
775
776 #if defined(USE_CRYPTO) && defined(USE_SSL)
777 /* initialize tmp_int optimization that limits the number of times we call
778 tls_multi_process in the main event loop */
779 interval_init (&c->c2.tmp_int, TLS_MULTI_HORIZON, TLS_MULTI_REFRESH);
780 #endif
781 }
782 }
783
784 /*
785 * Initialize traffic shaper.
786 */
787 static void
788 do_init_traffic_shaper (struct context *c)
789 {
790 #ifdef HAVE_GETTIMEOFDAY
791 /* initialize traffic shaper (i.e. transmit bandwidth limiter) */
792 if (c->options.shaper)
793 {
794 shaper_init (&c->c2.shaper, c->options.shaper);
795 shaper_msg (&c->c2.shaper);
796 }
797 #endif
798 }
799
800 /*
801 * Allocate a route list structure if at least one
802 * --route option was specified.
803 */
804 static void
805 do_alloc_route_list (struct context *c)
806 {
807 if (c->options.routes && !c->c1.route_list)
808 c->c1.route_list = new_route_list (&c->gc);
809 }
810
811
812 /*
813 * Initialize the route list, resolving any DNS names in route
814 * options and saving routes in the environment.
815 */
816 static void
817 do_init_route_list (const struct options *options,
818 struct route_list *route_list,
819 const struct link_socket_info *link_socket_info,
820 bool fatal,
821 struct env_set *es)
822 {
823 const char *gw = NULL;
824 int dev = dev_type_enum (options->dev, options->dev_type);
825 int metric = 0;
826
827 if (dev == DEV_TYPE_TUN && (options->topology == TOP_NET30 || options->topology == TOP_P2P))
828 gw = options->ifconfig_remote_netmask;
829 if (options->route_default_gateway)
830 gw = options->route_default_gateway;
831 if (options->route_default_metric)
832 metric = options->route_default_metric;
833
834 if (!init_route_list (route_list,
835 options->routes,
836 gw,
837 metric,
838 link_socket_current_remote (link_socket_info),
839 es))
840 {
841 if (fatal)
842 openvpn_exit (OPENVPN_EXIT_STATUS_ERROR); /* exit point */
843 }
844 else
845 {
846 /* copy routes to environment */
847 setenv_routes (es, route_list);
848 }
849 }
850
851 /*
852 * Called after all initialization has been completed.
853 */
854 void
855 initialization_sequence_completed (struct context *c, const unsigned int flags)
856 {
857 static const char message[] = "Initialization Sequence Completed";
858
859 /* If we delayed UID/GID downgrade or chroot, do it now */
860 do_uid_gid_chroot (c, true);
861
862 /* Test if errors */
863 if (flags & ISC_ERRORS)
864 {
865 #ifdef WIN32
866 show_routes (M_INFO|M_NOPREFIX);
867 show_adapters (M_INFO|M_NOPREFIX);
868 msg (M_INFO, "%s With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )", message);
869 #else
870 msg (M_INFO, "%s With Errors", message);
871 #endif
872 }
873 else
874 msg (M_INFO, "%s", message);
875
876 /* Flag connection_list that we initialized */
877 if ((flags & (ISC_ERRORS|ISC_SERVER)) == 0 && connection_list_defined (&c->options))
878 connection_list_set_no_advance (&c->options);
879
880 #ifdef ENABLE_MANAGEMENT
881 /* Tell management interface that we initialized */
882 if (management)
883 {
884 in_addr_t tun_local = 0;
885 in_addr_t tun_remote = 0; /* FKS */
886 const char *detail = "SUCCESS";
887 if (c->c1.tuntap)
888 tun_local = c->c1.tuntap->local;
889 tun_remote = htonl (c->c1.link_socket_addr.actual.dest.sa.sin_addr.s_addr);
890 if (flags & ISC_ERRORS)
891 detail = "ERROR";
892 management_set_state (management,
893 OPENVPN_STATE_CONNECTED,
894 detail,
895 tun_local,
896 tun_remote);
897 if (tun_local)
898 management_post_tunnel_open (management, tun_local);
899 }
900 #endif
901
902 }
903
904 /*
905 * Possibly add routes and/or call route-up script
906 * based on options.
907 */
908 void
909 do_route (const struct options *options,
910 struct route_list *route_list,
911 const struct tuntap *tt,
912 const struct plugin_list *plugins,
913 struct env_set *es)
914 {
915 if (!options->route_noexec && route_list)
916 add_routes (route_list, tt, ROUTE_OPTION_FLAGS (options), es);
917
918 if (plugin_defined (plugins, OPENVPN_PLUGIN_ROUTE_UP))
919 {
920 if (plugin_call (plugins, OPENVPN_PLUGIN_ROUTE_UP, NULL, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS)
921 msg (M_WARN, "WARNING: route-up plugin call failed");
922 }
923
924 if (options->route_script)
925 {
926 struct argv argv = argv_new ();
927 setenv_str (es, "script_type", "route-up");
928 argv_printf (&argv, "%sc", options->route_script);
929 openvpn_execve_check (&argv, es, S_SCRIPT, "Route script failed");
930 argv_reset (&argv);
931 }
932
933 #ifdef WIN32
934 if (options->show_net_up)
935 {
936 show_routes (M_INFO|M_NOPREFIX);
937 show_adapters (M_INFO|M_NOPREFIX);
938 }
939 else if (check_debug_level (D_SHOW_NET))
940 {
941 show_routes (D_SHOW_NET|M_NOPREFIX);
942 show_adapters (D_SHOW_NET|M_NOPREFIX);
943 }
944 #endif
945 }
946
947 /*
948 * Save current pulled options string in the c1 context store, so we can
949 * compare against it after possible future restarts.
950 */
951 #if P2MP
952 static void
953 save_pulled_options_string (struct context *c, const char *newstring)
954 {
955 if (c->c1.pulled_options_string_save)
956 free (c->c1.pulled_options_string_save);
957
958 c->c1.pulled_options_string_save = NULL;
959
960 if (newstring)
961 c->c1.pulled_options_string_save = string_alloc (newstring, NULL);
962 }
963 #endif
964
965 /*
966 * initialize tun/tap device object
967 */
968 static void
969 do_init_tun (struct context *c)
970 {
971 c->c1.tuntap = init_tun (c->options.dev,
972 c->options.dev_type,
973 c->options.topology,
974 c->options.ifconfig_local,
975 c->options.ifconfig_remote_netmask,
976 addr_host (&c->c1.link_socket_addr.local),
977 addr_host (&c->c1.link_socket_addr.remote),
978 !c->options.ifconfig_nowarn,
979 c->c2.es);
980
981 init_tun_post (c->c1.tuntap,
982 &c->c2.frame,
983 &c->options.tuntap_options);
984
985 c->c1.tuntap_owned = true;
986 }
987
988 /*
989 * Open tun/tap device, ifconfig, call up script, etc.
990 */
991
992 static bool
993 do_open_tun (struct context *c)
994 {
995 struct gc_arena gc = gc_new ();
996 bool ret = false;
997
998 c->c2.ipv4_tun = (!c->options.tun_ipv6
999 && is_dev_type (c->options.dev, c->options.dev_type, "tun"));
1000
1001 if (!c->c1.tuntap)
1002 {
1003 /* initialize (but do not open) tun/tap object */
1004 do_init_tun (c);
1005
1006 /* allocate route list structure */
1007 do_alloc_route_list (c);
1008
1009 /* parse and resolve the route option list */
1010 if (c->options.routes && c->c1.route_list && c->c2.link_socket)
1011 do_init_route_list (&c->options, c->c1.route_list, &c->c2.link_socket->info, false, c->c2.es);
1012
1013 /* do ifconfig */
1014 if (!c->options.ifconfig_noexec
1015 && ifconfig_order () == IFCONFIG_BEFORE_TUN_OPEN)
1016 {
1017 /* guess actual tun/tap unit number that will be returned
1018 by open_tun */
1019 const char *guess = guess_tuntap_dev (c->options.dev,
1020 c->options.dev_type,
1021 c->options.dev_node,
1022 &gc);
1023 do_ifconfig (c->c1.tuntap, guess, TUN_MTU_SIZE (&c->c2.frame), c->c2.es);
1024 }
1025
1026 /* open the tun device */
1027 open_tun (c->options.dev, c->options.dev_type, c->options.dev_node,
1028 c->options.tun_ipv6, c->c1.tuntap);
1029
1030 /* set the hardware address */
1031 if (c->options.lladdr)
1032 set_lladdr(c->c1.tuntap->actual_name, c->options.lladdr, c->c2.es);
1033
1034 /* do ifconfig */
1035 if (!c->options.ifconfig_noexec
1036 && ifconfig_order () == IFCONFIG_AFTER_TUN_OPEN)
1037 {
1038 do_ifconfig (c->c1.tuntap, c->c1.tuntap->actual_name, TUN_MTU_SIZE (&c->c2.frame), c->c2.es);
1039 }
1040
1041 /* run the up script */
1042 run_up_down (c->options.up_script,
1043 c->plugins,
1044 OPENVPN_PLUGIN_UP,
1045 c->c1.tuntap->actual_name,
1046 TUN_MTU_SIZE (&c->c2.frame),
1047 EXPANDED_SIZE (&c->c2.frame),
1048 print_in_addr_t (c->c1.tuntap->local, IA_EMPTY_IF_UNDEF, &gc),
1049 print_in_addr_t (c->c1.tuntap->remote_netmask, IA_EMPTY_IF_UNDEF, &gc),
1050 "init",
1051 NULL,
1052 "up",
1053 c->c2.es);
1054
1055 /* possibly add routes */
1056 if (!c->options.route_delay_defined)
1057 do_route (&c->options, c->c1.route_list, c->c1.tuntap, c->plugins, c->c2.es);
1058
1059 /*
1060 * Did tun/tap driver give us an MTU?
1061 */
1062 if (c->c1.tuntap->post_open_mtu)
1063 frame_set_mtu_dynamic (&c->c2.frame,
1064 c->c1.tuntap->post_open_mtu,
1065 SET_MTU_TUN | SET_MTU_UPPER_BOUND);
1066
1067 ret = true;
1068 }
1069 else
1070 {
1071 msg (M_INFO, "Preserving previous TUN/TAP instance: %s",
1072 c->c1.tuntap->actual_name);
1073
1074 /* run the up script if user specified --up-restart */
1075 if (c->options.up_restart)
1076 run_up_down (c->options.up_script,
1077 c->plugins,
1078 OPENVPN_PLUGIN_UP,
1079 c->c1.tuntap->actual_name,
1080 TUN_MTU_SIZE (&c->c2.frame),
1081 EXPANDED_SIZE (&c->c2.frame),
1082 print_in_addr_t (c->c1.tuntap->local, IA_EMPTY_IF_UNDEF, &gc),
1083 print_in_addr_t (c->c1.tuntap->remote_netmask, IA_EMPTY_IF_UNDEF, &gc),
1084 "restart",
1085 NULL,
1086 "up",
1087 c->c2.es);
1088 }
1089 gc_free (&gc);
1090 return ret;
1091 }
1092
1093 /*
1094 * Close TUN/TAP device
1095 */
1096
1097 static void
1098 do_close_tun_simple (struct context *c)
1099 {
1100 msg (D_CLOSE, "Closing TUN/TAP interface");
1101 close_tun (c->c1.tuntap);
1102 c->c1.tuntap = NULL;
1103 c->c1.tuntap_owned = false;
1104 #if P2MP
1105 save_pulled_options_string (c, NULL); /* delete C1-saved pulled_options_string */
1106 #endif
1107 }
1108
1109 static void
1110 do_close_tun (struct context *c, bool force)
1111 {
1112 struct gc_arena gc = gc_new ();
1113 if (c->c1.tuntap && c->c1.tuntap_owned)
1114 {
1115 const char *tuntap_actual = string_alloc (c->c1.tuntap->actual_name, &gc);
1116 const in_addr_t local = c->c1.tuntap->local;
1117 const in_addr_t remote_netmask = c->c1.tuntap->remote_netmask;
1118
1119 if (force || !(c->sig->signal_received == SIGUSR1 && c->options.persist_tun))
1120 {
1121 #ifdef ENABLE_MANAGEMENT
1122 /* tell management layer we are about to close the TUN/TAP device */
1123 if (management)
1124 management_pre_tunnel_close (management);
1125 #endif
1126
1127 /* delete any routes we added */
1128 if (c->c1.route_list)
1129 delete_routes (c->c1.route_list, c->c1.tuntap, ROUTE_OPTION_FLAGS (&c->options), c->c2.es);
1130
1131 /* actually close tun/tap device based on --down-pre flag */
1132 if (!c->options.down_pre)
1133 do_close_tun_simple (c);
1134
1135 /* Run the down script -- note that it will run at reduced
1136 privilege if, for example, "--user nobody" was used. */
1137 run_up_down (c->options.down_script,
1138 c->plugins,
1139 OPENVPN_PLUGIN_DOWN,
1140 tuntap_actual,
1141 TUN_MTU_SIZE (&c->c2.frame),
1142 EXPANDED_SIZE (&c->c2.frame),
1143 print_in_addr_t (local, IA_EMPTY_IF_UNDEF, &gc),
1144 print_in_addr_t (remote_netmask, IA_EMPTY_IF_UNDEF, &gc),
1145 "init",
1146 signal_description (c->sig->signal_received,
1147 c->sig->signal_text),
1148 "down",
1149 c->c2.es);
1150
1151 /* actually close tun/tap device based on --down-pre flag */
1152 if (c->options.down_pre)
1153 do_close_tun_simple (c);
1154 }
1155 else
1156 {
1157 /* run the down script on this restart if --up-restart was specified */
1158 if (c->options.up_restart)
1159 run_up_down (c->options.down_script,
1160 c->plugins,
1161 OPENVPN_PLUGIN_DOWN,
1162 tuntap_actual,
1163 TUN_MTU_SIZE (&c->c2.frame),
1164 EXPANDED_SIZE (&c->c2.frame),
1165 print_in_addr_t (local, IA_EMPTY_IF_UNDEF, &gc),
1166 print_in_addr_t (remote_netmask, IA_EMPTY_IF_UNDEF, &gc),
1167 "restart",
1168 signal_description (c->sig->signal_received,
1169 c->sig->signal_text),
1170 "down",
1171 c->c2.es);
1172 }
1173 }
1174 gc_free (&gc);
1175 }
1176
1177 /*
1178 * Handle delayed tun/tap interface bringup due to --up-delay or --pull
1179 */
1180
1181 void
1182 do_up (struct context *c, bool pulled_options, unsigned int option_types_found)
1183 {
1184 if (!c->c2.do_up_ran)
1185 {
1186 reset_coarse_timers (c);
1187
1188 if (pulled_options && option_types_found)
1189 do_deferred_options (c, option_types_found);
1190
1191 /* if --up-delay specified, open tun, do ifconfig, and run up script now */
1192 if (c->options.up_delay || PULL_DEFINED (&c->options))
1193 {
1194 c->c2.did_open_tun = do_open_tun (c);
1195 update_time ();
1196
1197 #if P2MP
1198 /*
1199 * Was tun interface object persisted from previous restart iteration,
1200 * and if so did pulled options string change from previous iteration?
1201 */
1202 if (!c->c2.did_open_tun
1203 && PULL_DEFINED (&c->options)
1204 && c->c1.tuntap
1205 && (!c->c1.pulled_options_string_save || !c->c2.pulled_options_string
1206 || strcmp (c->c1.pulled_options_string_save, c->c2.pulled_options_string)))
1207 {
1208 /* if so, close tun, delete routes, then reinitialize tun and add routes */
1209 msg (M_INFO, "NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.");
1210 do_close_tun (c, true);
1211 openvpn_sleep (1);
1212 c->c2.did_open_tun = do_open_tun (c);
1213 update_time ();
1214 }
1215 #endif
1216 }
1217
1218 if (c->c2.did_open_tun)
1219 {
1220 #if P2MP
1221 save_pulled_options_string (c, c->c2.pulled_options_string);
1222 #endif
1223
1224 /* if --route-delay was specified, start timer */
1225 if (c->options.route_delay_defined)
1226 {
1227 event_timeout_init (&c->c2.route_wakeup, c->options.route_delay, now);
1228 event_timeout_init (&c->c2.route_wakeup_expire, c->options.route_delay + c->options.route_delay_window, now);
1229 if (c->c1.tuntap)
1230 tun_standby_init (c->c1.tuntap);
1231 }
1232 else
1233 {
1234 initialization_sequence_completed (c, 0); /* client/p2p --route-delay undefined */
1235 }
1236 }
1237 else if (c->options.mode == MODE_POINT_TO_POINT)
1238 {
1239 initialization_sequence_completed (c, 0); /* client/p2p restart with --persist-tun */
1240 }
1241
1242 c->c2.do_up_ran = true;
1243 }
1244 }
1245
1246 /*
1247 * These are the option categories which will be accepted by pull.
1248 */
1249 unsigned int
1250 pull_permission_mask (const struct context *c)
1251 {
1252 unsigned int flags =
1253 OPT_P_UP
1254 | OPT_P_ROUTE_EXTRAS
1255 | OPT_P_IPWIN32
1256 | OPT_P_SOCKBUF
1257 | OPT_P_SOCKFLAGS
1258 | OPT_P_SETENV
1259 | OPT_P_SHAPER
1260 | OPT_P_TIMER
1261 | OPT_P_COMP
1262 | OPT_P_PERSIST
1263 | OPT_P_MESSAGES
1264 | OPT_P_EXPLICIT_NOTIFY
1265 | OPT_P_ECHO
1266 | OPT_P_PULL_MODE;
1267
1268 if (!c->options.route_nopull)
1269 flags |= OPT_P_ROUTE;
1270
1271 return flags;
1272 }
1273
1274 /*
1275 * Handle non-tun-related pulled options.
1276 */
1277 void
1278 do_deferred_options (struct context *c, const unsigned int found)
1279 {
1280 if (found & OPT_P_MESSAGES)
1281 {
1282 init_verb_mute (c, IVM_LEVEL_1|IVM_LEVEL_2);
1283 msg (D_PUSH, "OPTIONS IMPORT: --verb and/or --mute level changed");
1284 }
1285 if (found & OPT_P_TIMER)
1286 {
1287 do_init_timers (c, true);
1288 msg (D_PUSH, "OPTIONS IMPORT: timers and/or timeouts modified");
1289 }
1290
1291 #ifdef ENABLE_OCC
1292 if (found & OPT_P_EXPLICIT_NOTIFY)
1293 {
1294 if (c->options.ce.proto != PROTO_UDPv4 && c->options.explicit_exit_notification)
1295 {
1296 msg (D_PUSH, "OPTIONS IMPORT: --explicit-exit-notify can only be used with --proto udp");
1297 c->options.explicit_exit_notification = 0;
1298 }
1299 else
1300 msg (D_PUSH, "OPTIONS IMPORT: explicit notify parm(s) modified");
1301 }
1302 #endif
1303
1304 #ifdef USE_LZO
1305 if (found & OPT_P_COMP)
1306 {
1307 if (lzo_defined (&c->c2.lzo_compwork))
1308 {
1309 msg (D_PUSH, "OPTIONS IMPORT: LZO parms modified");
1310 lzo_modify_flags (&c->c2.lzo_compwork, c->options.lzo);
1311 }
1312 }
1313 #endif
1314
1315 if (found & OPT_P_SHAPER)
1316 {
1317 msg (D_PUSH, "OPTIONS IMPORT: traffic shaper enabled");
1318 do_init_traffic_shaper (c);
1319 }
1320
1321 if (found & OPT_P_SOCKBUF)
1322 {
1323 msg (D_PUSH, "OPTIONS IMPORT: --sndbuf/--rcvbuf options modified");
1324 link_socket_update_buffer_sizes (c->c2.link_socket, c->options.rcvbuf, c->options.sndbuf);
1325 }
1326
1327 if (found & OPT_P_SOCKFLAGS)
1328 {
1329 msg (D_PUSH, "OPTIONS IMPORT: --socket-flags option modified");
1330 link_socket_update_flags (c->c2.link_socket, c->options.sockflags);
1331 }
1332
1333 if (found & OPT_P_PERSIST)
1334 msg (D_PUSH, "OPTIONS IMPORT: --persist options modified");
1335 if (found & OPT_P_UP)
1336 msg (D_PUSH, "OPTIONS IMPORT: --ifconfig/up options modified");
1337 if (found & OPT_P_ROUTE)
1338 msg (D_PUSH, "OPTIONS IMPORT: route options modified");
1339 if (found & OPT_P_ROUTE_EXTRAS)
1340 msg (D_PUSH, "OPTIONS IMPORT: route-related options modified");
1341 if (found & OPT_P_IPWIN32)
1342 msg (D_PUSH, "OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified");
1343 if (found & OPT_P_SETENV)
1344 msg (D_PUSH, "OPTIONS IMPORT: environment modified");
1345 }
1346
1347 /*
1348 * Possible hold on initialization
1349 */
1350 static bool
1351 do_hold (struct context *c)
1352 {
1353 #ifdef ENABLE_MANAGEMENT
1354 if (management)
1355 {
1356 /* if c is defined, daemonize before hold */
1357 if (c && c->options.daemon && management_should_daemonize (management))
1358 do_init_first_time (c);
1359
1360 /* block until management hold is released */
1361 if (management_hold (management))
1362 return true;
1363 }
1364 #endif
1365 return false;
1366 }
1367
1368 /*
1369 * Sleep before restart.
1370 */
1371 static void
1372 socket_restart_pause (struct context *c)
1373 {
1374 bool proxy = false;
1375 int sec = 2;
1376
1377 #ifdef ENABLE_HTTP_PROXY
1378 if (c->options.ce.http_proxy_options)
1379 proxy = true;
1380 #endif
1381 #ifdef ENABLE_SOCKS
1382 if (c->options.ce.socks_proxy_server)
1383 proxy = true;
1384 #endif
1385
1386 switch (c->options.ce.proto)
1387 {
1388 case PROTO_UDPv4:
1389 if (proxy)
1390 sec = c->options.ce.connect_retry_seconds;
1391 break;
1392 case PROTO_TCPv4_SERVER:
1393 sec = 1;
1394 break;
1395 case PROTO_TCPv4_CLIENT:
1396 sec = c->options.ce.connect_retry_seconds;
1397 break;
1398 }
1399
1400 #ifdef ENABLE_DEBUG
1401 if (GREMLIN_CONNECTION_FLOOD_LEVEL (c->options.gremlin))
1402 sec = 0;
1403 #endif
1404
1405 #if P2MP
1406 if (auth_retry_get () == AR_NOINTERACT)
1407 sec = 10;
1408 #endif
1409
1410 if (c->persist.restart_sleep_seconds > 0 && c->persist.restart_sleep_seconds > sec)
1411 sec = c->persist.restart_sleep_seconds;
1412 c->persist.restart_sleep_seconds = 0;
1413
1414 /* do managment hold on context restart, i.e. second, third, fourth, etc. initialization */
1415 if (do_hold (NULL))
1416 sec = 0;
1417
1418 if (sec)
1419 {
1420 msg (D_RESTART, "Restart pause, %d second(s)", sec);
1421 openvpn_sleep (sec);
1422 }
1423 }
1424
1425 /*
1426 * Do a possible pause on context_2 initialization.
1427 */
1428 static void
1429 do_startup_pause (struct context *c)
1430 {
1431 if (!c->first_time)
1432 socket_restart_pause (c);
1433 else
1434 do_hold (NULL); /* do management hold on first context initialization */
1435 }
1436
1437 /*
1438 * Finalize MTU parameters based on command line or config file options.
1439 */
1440 static void
1441 frame_finalize_options (struct context *c, const struct options *o)
1442 {
1443 if (!o)
1444 o = &c->options;
1445
1446 /*
1447 * Set adjustment factor for buffer alignment when no
1448 * cipher is used.
1449 */
1450 if (!CIPHER_ENABLED (c))
1451 {
1452 frame_align_to_extra_frame (&c->c2.frame);
1453 frame_or_align_flags (&c->c2.frame,
1454 FRAME_HEADROOM_MARKER_FRAGMENT
1455 |FRAME_HEADROOM_MARKER_READ_LINK
1456 |FRAME_HEADROOM_MARKER_READ_STREAM);
1457 }
1458
1459 frame_finalize (&c->c2.frame,
1460 o->link_mtu_defined,
1461 o->link_mtu,
1462 o->tun_mtu_defined,
1463 o->tun_mtu);
1464 }
1465
1466 /*
1467 * Free a key schedule, including OpenSSL components.
1468 */
1469 static void
1470 key_schedule_free (struct key_schedule *ks, bool free_ssl_ctx)
1471 {
1472 #ifdef USE_CRYPTO
1473 free_key_ctx_bi (&ks->static_key);
1474 #ifdef USE_SSL
1475 if (ks->ssl_ctx && free_ssl_ctx)
1476 {
1477 SSL_CTX_free (ks->ssl_ctx);
1478 free_key_ctx_bi (&ks->tls_auth_key);
1479 }
1480 #endif /* USE_SSL */
1481 #endif /* USE_CRYPTO */
1482 CLEAR (*ks);
1483 }
1484
1485 #ifdef USE_CRYPTO
1486
1487 static void
1488 init_crypto_pre (struct context *c, const unsigned int flags)
1489 {
1490 if (c->options.engine)
1491 init_crypto_lib_engine (c->options.engine);
1492
1493 if (flags & CF_LOAD_PERSISTED_PACKET_ID)
1494 {
1495 /* load a persisted packet-id for cross-session replay-protection */
1496 if (c->options.packet_id_file)
1497 packet_id_persist_load (&c->c1.pid_persist, c->options.packet_id_file);
1498 }
1499
1500 /* Initialize crypto options */
1501
1502 if (c->options.use_iv)
1503 c->c2.crypto_options.flags |= CO_USE_IV;
1504
1505 if (c->options.mute_replay_warnings)
1506 c->c2.crypto_options.flags |= CO_MUTE_REPLAY_WARNINGS;
1507 }
1508
1509 /*
1510 * Static Key Mode (using a pre-shared key)
1511 */
1512 static void
1513 do_init_crypto_static (struct context *c, const unsigned int flags)
1514 {
1515 const struct options *options = &c->options;
1516 ASSERT (options->shared_secret_file);
1517
1518 init_crypto_pre (c, flags);
1519
1520 /* Initialize packet ID tracking */
1521 if (options->replay)
1522 {
1523 packet_id_init (&c->c2.packet_id, options->replay_window,
1524 options->replay_time);
1525 c->c2.crypto_options.packet_id = &c->c2.packet_id;
1526 c->c2.crypto_options.pid_persist = &c->c1.pid_persist;
1527 c->c2.crypto_options.flags |= CO_PACKET_ID_LONG_FORM;
1528 packet_id_persist_load_obj (&c->c1.pid_persist,
1529 c->c2.crypto_options.packet_id);
1530 }
1531
1532 if (!key_ctx_bi_defined (&c->c1.ks.static_key))
1533 {
1534 struct key2 key2;
1535 struct key_direction_state kds;
1536
1537 /* Get cipher & hash algorithms */
1538 init_key_type (&c->c1.ks.key_type, options->ciphername,
1539 options->ciphername_defined, options->authname,
1540 options->authname_defined, options->keysize,
1541 options->test_crypto, true);
1542
1543 /* Read cipher and hmac keys from shared secret file */
1544 {
1545 unsigned int rkf_flags = RKF_MUST_SUCCEED;
1546 const char *rkf_file = options->shared_secret_file;
1547
1548 #if ENABLE_INLINE_FILES
1549 if (options->shared_secret_file_inline)
1550 {
1551 rkf_file = options->shared_secret_file_inline;
1552 rkf_flags |= RKF_INLINE;
1553 }
1554 #endif
1555 read_key_file (&key2, rkf_file, rkf_flags);
1556 }
1557
1558 /* Check for and fix highly unlikely key problems */
1559 verify_fix_key2 (&key2, &c->c1.ks.key_type,
1560 options->shared_secret_file);
1561
1562 /* Initialize OpenSSL key objects */
1563 key_direction_state_init (&kds, options->key_direction);
1564 must_have_n_keys (options->shared_secret_file, "secret", &key2,
1565 kds.need_keys);
1566 init_key_ctx (&c->c1.ks.static_key.encrypt, &key2.keys[kds.out_key],
1567 &c->c1.ks.key_type, DO_ENCRYPT, "Static Encrypt");
1568 init_key_ctx (&c->c1.ks.static_key.decrypt, &key2.keys[kds.in_key],
1569 &c->c1.ks.key_type, DO_DECRYPT, "Static Decrypt");
1570
1571 /* Erase the temporary copy of key */
1572 CLEAR (key2);
1573 }
1574 else
1575 {
1576 msg (M_INFO, "Re-using pre-shared static key");
1577 }
1578
1579 /* Get key schedule */
1580 c->c2.crypto_options.key_ctx_bi = &c->c1.ks.static_key;
1581
1582 /* Compute MTU parameters */
1583 crypto_adjust_frame_parameters (&c->c2.frame,
1584 &c->c1.ks.key_type,
1585 options->ciphername_defined,
1586 options->use_iv, options->replay, true);
1587
1588 /* Sanity check on IV, sequence number, and cipher mode options */
1589 check_replay_iv_consistency (&c->c1.ks.key_type, options->replay,
1590 options->use_iv);
1591 }
1592
1593 #ifdef USE_SSL
1594
1595 /*
1596 * Initialize the persistent component of OpenVPN's TLS mode,
1597 * which is preserved across SIGUSR1 resets.
1598 */
1599 static void
1600 do_init_crypto_tls_c1 (struct context *c)
1601 {
1602 const struct options *options = &c->options;
1603
1604 if (!c->c1.ks.ssl_ctx)
1605 {
1606 /*
1607 * Initialize the OpenSSL library's global
1608 * SSL context.
1609 */
1610 c->c1.ks.ssl_ctx = init_ssl (options);
1611 if (!c->c1.ks.ssl_ctx)
1612 {
1613 #if P2MP
1614 switch (auth_retry_get ())
1615 {
1616 case AR_NONE:
1617 msg (M_FATAL, "Error: private key password verification failed");
1618 break;
1619 case AR_INTERACT:
1620 ssl_purge_auth ();
1621 case AR_NOINTERACT:
1622 c->sig->signal_received = SIGUSR1; /* SOFT-SIGUSR1 -- Password failure error */
1623 break;
1624 default:
1625 ASSERT (0);
1626 }
1627 c->sig->signal_text = "private-key-password-failure";
1628 return;
1629 #else
1630 msg (M_FATAL, "Error: private key password verification failed");
1631 #endif
1632 }
1633
1634 /* Get cipher & hash algorithms */
1635 init_key_type (&c->c1.ks.key_type, options->ciphername,
1636 options->ciphername_defined, options->authname,
1637 options->authname_defined, options->keysize, true, true);
1638
1639 /* TLS handshake authentication (--tls-auth) */
1640 if (options->tls_auth_file)
1641 {
1642 unsigned int flags = 0;
1643 const char *file = options->tls_auth_file;
1644
1645 #if ENABLE_INLINE_FILES
1646 if (options->tls_auth_file_inline)
1647 {
1648 flags |= GHK_INLINE;
1649 file = options->tls_auth_file_inline;
1650 }
1651 #endif
1652 get_tls_handshake_key (&c->c1.ks.key_type,
1653 &c->c1.ks.tls_auth_key,
1654 file,
1655 options->key_direction,
1656 flags);
1657 }
1658
1659 #if ENABLE_INLINE_FILES
1660 if (options->priv_key_file_inline)
1661 {
1662 string_clear (c->options.priv_key_file_inline);
1663 c->options.priv_key_file_inline = NULL;
1664 }
1665 #endif
1666 }
1667 else
1668 {
1669 msg (M_INFO, "Re-using SSL/TLS context");
1670 }
1671 }
1672
1673 static void
1674 do_init_crypto_tls (struct context *c, const unsigned int flags)
1675 {
1676 const struct options *options = &c->options;
1677 struct tls_options to;
1678 bool packet_id_long_form;
1679
1680 ASSERT (options->tls_server || options->tls_client);
1681 ASSERT (!options->test_crypto);
1682
1683 init_crypto_pre (c, flags);
1684
1685 /* Make sure we are either a TLS client or server but not both */
1686 ASSERT (options->tls_server == !options->tls_client);
1687
1688 /* initialize persistent component */
1689 do_init_crypto_tls_c1 (c);
1690 if (IS_SIG (c))
1691 return;
1692
1693 /* Sanity check on IV, sequence number, and cipher mode options */
1694 check_replay_iv_consistency (&c->c1.ks.key_type, options->replay,
1695 options->use_iv);
1696
1697 /* In short form, unique datagram identifier is 32 bits, in long form 64 bits */
1698 packet_id_long_form = cfb_ofb_mode (&c->c1.ks.key_type);
1699
1700 /* Compute MTU parameters */
1701 crypto_adjust_frame_parameters (&c->c2.frame,
1702 &c->c1.ks.key_type,
1703 options->ciphername_defined,
1704 options->use_iv,
1705 options->replay, packet_id_long_form);
1706 tls_adjust_frame_parameters (&c->c2.frame);
1707
1708 /* Set all command-line TLS-related options */
1709 CLEAR (to);
1710
1711 to.crypto_flags_and = ~(CO_PACKET_ID_LONG_FORM);
1712 if (packet_id_long_form)
1713 to.crypto_flags_or = CO_PACKET_ID_LONG_FORM;
1714
1715 to.ssl_ctx = c->c1.ks.ssl_ctx;
1716 to.key_type = c->c1.ks.key_type;
1717 to.server = options->tls_server;
1718 to.key_method = options->key_method;
1719 to.replay = options->replay;
1720 to.replay_window = options->replay_window;
1721 to.replay_time = options->replay_time;
1722 to.transition_window = options->transition_window;
1723 to.handshake_window = options->handshake_window;
1724 to.packet_timeout = options->tls_timeout;
1725 to.renegotiate_bytes = options->renegotiate_bytes;
1726 to.renegotiate_packets = options->renegotiate_packets;
1727 to.renegotiate_seconds = options->renegotiate_seconds;
1728 to.single_session = options->single_session;
1729
1730 /* should we not xmit any packets until we get an initial
1731 response from client? */
1732 if (to.server && options->ce.proto == PROTO_TCPv4_SERVER)
1733 to.xmit_hold = true;
1734
1735 #ifdef ENABLE_OCC
1736 to.disable_occ = !options->occ;
1737 #endif
1738
1739 to.verify_command = options->tls_verify;
1740 to.verify_x509name = options->tls_remote;
1741 to.crl_file = options->crl_file;
1742 to.ns_cert_type = options->ns_cert_type;
1743 memmove (to.remote_cert_ku, options->remote_cert_ku, sizeof (to.remote_cert_ku));
1744 to.remote_cert_eku = options->remote_cert_eku;
1745 to.es = c->c2.es;
1746
1747 #ifdef ENABLE_DEBUG
1748 to.gremlin = c->options.gremlin;
1749 #endif
1750
1751 to.plugins = c->plugins;
1752
1753 #ifdef MANAGEMENT_DEF_AUTH
1754 to.mda_context = &c->c2.mda_context;
1755 #endif
1756
1757 #if P2MP_SERVER
1758 to.auth_user_pass_verify_script = options->auth_user_pass_verify_script;
1759 to.auth_user_pass_verify_script_via_file = options->auth_user_pass_verify_script_via_file;
1760 to.tmp_dir = options->tmp_dir;
1761 to.username_as_common_name = options->username_as_common_name;
1762 if (options->ccd_exclusive)
1763 to.client_config_dir_exclusive = options->client_config_dir;
1764 #endif
1765
1766 /* TLS handshake authentication (--tls-auth) */
1767 if (options->tls_auth_file)
1768 {
1769 to.tls_auth_key = c->c1.ks.tls_auth_key;
1770 to.tls_auth.pid_persist = &c->c1.pid_persist;
1771 to.tls_auth.flags |= CO_PACKET_ID_LONG_FORM;
1772 crypto_adjust_frame_parameters (&to.frame,
1773 &c->c1.ks.key_type,
1774 false, false, true, true);
1775 }
1776
1777 /* If we are running over TCP, allow for
1778 length prefix */
1779 socket_adjust_frame_parameters (&to.frame, options->ce.proto);
1780
1781 /*
1782 * Initialize OpenVPN's master TLS-mode object.
1783 */
1784 if (flags & CF_INIT_TLS_MULTI)
1785 c->c2.tls_multi = tls_multi_init (&to);
1786
1787 if (flags & CF_INIT_TLS_AUTH_STANDALONE)
1788 c->c2.tls_auth_standalone = tls_auth_standalone_init (&to, &c->c2.gc);
1789 }
1790
1791 static void
1792 do_init_finalize_tls_frame (struct context *c)
1793 {
1794 if (c->c2.tls_multi)
1795 {
1796 tls_multi_init_finalize (c->c2.tls_multi, &c->c2.frame);
1797 ASSERT (EXPANDED_SIZE (&c->c2.tls_multi->opt.frame) <=
1798 EXPANDED_SIZE (&c->c2.frame));
1799 frame_print (&c->c2.tls_multi->opt.frame, D_MTU_INFO,
1800 "Control Channel MTU parms");
1801 }
1802 if (c->c2.tls_auth_standalone)
1803 {
1804 tls_auth_standalone_finalize (c->c2.tls_auth_standalone, &c->c2.frame);
1805 frame_print (&c->c2.tls_auth_standalone->frame, D_MTU_INFO,
1806 "TLS-Auth MTU parms");
1807 }
1808 }
1809
1810 #endif /* USE_SSL */
1811 #endif /* USE_CRYPTO */
1812
1813 #ifdef USE_CRYPTO
1814 /*
1815 * No encryption or authentication.
1816 */
1817 static void
1818 do_init_crypto_none (const struct context *c)
1819 {
1820 ASSERT (!c->options.test_crypto);
1821 msg (M_WARN,
1822 "******* WARNING *******: all encryption and authentication features disabled -- all data will be tunnelled as cleartext");
1823 }
1824 #endif
1825
1826 static void
1827 do_init_crypto (struct context *c, const unsigned int flags)
1828 {
1829 #ifdef USE_CRYPTO
1830 if (c->options.shared_secret_file)
1831 do_init_crypto_static (c, flags);
1832 #ifdef USE_SSL
1833 else if (c->options.tls_server || c->options.tls_client)
1834 do_init_crypto_tls (c, flags);
1835 #endif
1836 else /* no encryption or authentication. */
1837 do_init_crypto_none (c);
1838 #else /* USE_CRYPTO */
1839 msg (M_WARN,
1840 "******* WARNING *******: " PACKAGE_NAME
1841 " built without OpenSSL -- encryption and authentication features disabled -- all data will be tunnelled as cleartext");
1842 #endif /* USE_CRYPTO */
1843 }
1844
1845 static void
1846 do_init_frame (struct context *c)
1847 {
1848 #ifdef USE_LZO
1849 /*
1850 * Initialize LZO compression library.
1851 */
1852 if (c->options.lzo & LZO_SELECTED)
1853 {
1854 lzo_adjust_frame_parameters (&c->c2.frame);
1855
1856 /*
1857 * LZO usage affects buffer alignment.
1858 */
1859 if (CIPHER_ENABLED (c))
1860 {
1861 frame_add_to_align_adjust (&c->c2.frame, LZO_PREFIX_LEN);
1862 frame_or_align_flags (&c->c2.frame,
1863 FRAME_HEADROOM_MARKER_FRAGMENT
1864 |FRAME_HEADROOM_MARKER_DECRYPT);
1865 }
1866
1867 #ifdef ENABLE_FRAGMENT
1868 lzo_adjust_frame_parameters (&c->c2.frame_fragment_omit); /* omit LZO frame delta from final frame_fragment */
1869 #endif
1870 }
1871 #endif /* USE_LZO */
1872
1873 #ifdef ENABLE_SOCKS
1874 /*
1875 * Adjust frame size for UDP Socks support.
1876 */
1877 if (c->options.ce.socks_proxy_server)
1878 socks_adjust_frame_parameters (&c->c2.frame, c->options.ce.proto);
1879 #endif
1880
1881 /*
1882 * Adjust frame size based on the --tun-mtu-extra parameter.
1883 */
1884 if (c->options.tun_mtu_extra_defined)
1885 tun_adjust_frame_parameters (&c->c2.frame, c->options.tun_mtu_extra);
1886
1887 /*
1888 * Adjust frame size based on link socket parameters.
1889 * (Since TCP is a stream protocol, we need to insert
1890 * a packet length uint16_t in the buffer.)
1891 */
1892 socket_adjust_frame_parameters (&c->c2.frame, c->options.ce.proto);
1893
1894 /*
1895 * Fill in the blanks in the frame parameters structure,
1896 * make sure values are rational, etc.
1897 */
1898 frame_finalize_options (c, NULL);
1899
1900 #ifdef ENABLE_FRAGMENT
1901 /*
1902 * Set frame parameter for fragment code. This is necessary because
1903 * the fragmentation code deals with payloads which have already been
1904 * passed through the compression code.
1905 */
1906 c->c2.frame_fragment = c->c2.frame;
1907 frame_subtract_extra (&c->c2.frame_fragment, &c->c2.frame_fragment_omit);
1908 #endif
1909
1910 #if defined(ENABLE_FRAGMENT) && defined(ENABLE_OCC)
1911 /*
1912 * MTU advisories
1913 */
1914 if (c->options.fragment && c->options.mtu_test)
1915 msg (M_WARN,
1916 "WARNING: using --fragment and --mtu-test together may produce an inaccurate MTU test result");
1917 #endif
1918
1919 #ifdef ENABLE_FRAGMENT
1920 if ((c->options.mssfix || c->options.fragment)
1921 && TUN_MTU_SIZE (&c->c2.frame_fragment) != ETHERNET_MTU)
1922 msg (M_WARN,
1923 "WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu %d (currently it is %d)",
1924 ETHERNET_MTU, TUN_MTU_SIZE (&c->c2.frame_fragment));
1925 #endif
1926 }
1927
1928 static void
1929 do_option_warnings (struct context *c)
1930 {
1931 const struct options *o = &c->options;
1932
1933 #if 1 /* JYFIXME -- port warning */
1934 if (!o->ce.port_option_used && (o->ce.local_port == OPENVPN_PORT && o->ce.remote_port == OPENVPN_PORT))
1935 msg (M_WARN, "IMPORTANT: OpenVPN's default port number is now %d, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.",
1936 OPENVPN_PORT);
1937 #endif
1938
1939 if (o->ping_send_timeout && !o->ping_rec_timeout)
1940 msg (M_WARN, "WARNING: --ping should normally be used with --ping-restart or --ping-exit");
1941
1942 if (o->username || o->groupname || o->chroot_dir)
1943 {
1944 if (!o->persist_tun)
1945 msg (M_WARN, "WARNING: you are using user/group/chroot without persist-tun -- this may cause restarts to fail");
1946 if (!o->persist_key
1947 #ifdef ENABLE_PKCS11
1948 && !o->pkcs11_id
1949 #endif
1950 )
1951 msg (M_WARN, "WARNING: you are using user/group/chroot without persist-key -- this may cause restarts to fail");
1952 }
1953
1954 if (o->chroot_dir && !(o->username && o->groupname))
1955 msg (M_WARN, "WARNING: you are using chroot without specifying user and group -- this may cause the chroot jail to be insecure");
1956
1957 #if P2MP
1958 if (o->pull && o->ifconfig_local && c->first_time)
1959 msg (M_WARN, "WARNING: using --pull/--client and --ifconfig together is probably not what you want");
1960
1961 #if P2MP_SERVER
1962 if (o->server_bridge_defined | o->server_bridge_proxy_dhcp)
1963 msg (M_WARN, "NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to");
1964
1965 if (o->mode == MODE_SERVER)
1966 {
1967 if (o->duplicate_cn && o->client_config_dir)
1968 msg (M_WARN, "WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want");
1969 if (o->duplicate_cn && o->ifconfig_pool_persist_filename)
1970 msg (M_WARN, "WARNING: --ifconfig-pool-persist will not work with --duplicate-cn");
1971 if (!o->keepalive_ping || !o->keepalive_timeout)
1972 msg (M_WARN, "WARNING: --keepalive option is missing from server config");
1973 }
1974 #endif
1975 #endif
1976
1977 #ifdef USE_CRYPTO
1978 if (!o->replay)
1979 msg (M_WARN, "WARNING: You have disabled Replay Protection (--no-replay) which may make " PACKAGE_NAME " less secure");
1980 if (!o->use_iv)
1981 msg (M_WARN, "WARNING: You have disabled Crypto IVs (--no-iv) which may make " PACKAGE_NAME " less secure");
1982
1983 #ifdef USE_SSL
1984 if (o->tls_server)
1985 warn_on_use_of_common_subnets ();
1986 if (o->tls_client
1987 && !o->tls_verify
1988 && !o->tls_remote
1989 && !(o->ns_cert_type & NS_SSL_SERVER)
1990 && !o->remote_cert_eku)
1991 msg (M_WARN, "WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.");
1992 if (o->tls_remote)
1993 msg (M_WARN, "WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).");
1994 #endif
1995 #endif
1996
1997 #ifndef CONNECT_NONBLOCK
1998 if (o->ce.connect_timeout_defined)
1999 msg (M_WARN, "NOTE: --connect-timeout option is not supported on this OS");
2000 #endif
2001
2002 if (script_security >= SSEC_SCRIPTS)
2003 msg (M_WARN, "NOTE: the current --script-security setting may allow this configuration to call user-defined scripts");
2004 if (script_security >= SSEC_PW_ENV)
2005 msg (M_WARN, "WARNING: the current --script-security setting may allow passwords to be passed to scripts via environmental variables");
2006 }
2007
2008 static void
2009 do_init_frame_tls (struct context *c)
2010 {
2011 #if defined(USE_CRYPTO) && defined(USE_SSL)
2012 do_init_finalize_tls_frame (c);
2013 #endif
2014 }
2015
2016 struct context_buffers *
2017 init_context_buffers (const struct frame *frame)
2018 {
2019 struct context_buffers *b;
2020
2021 ALLOC_OBJ_CLEAR (b, struct context_buffers);
2022
2023 b->read_link_buf = alloc_buf (BUF_SIZE (frame));
2024 b->read_tun_buf = alloc_buf (BUF_SIZE (frame));
2025
2026 b->aux_buf = alloc_buf (BUF_SIZE (frame));
2027
2028 #ifdef USE_CRYPTO
2029 b->encrypt_buf = alloc_buf (BUF_SIZE (frame));
2030 b->decrypt_buf = alloc_buf (BUF_SIZE (frame));
2031 #endif
2032
2033 #ifdef USE_LZO
2034 b->lzo_compress_buf = alloc_buf (BUF_SIZE (frame));
2035 b->lzo_decompress_buf = alloc_buf (BUF_SIZE (frame));
2036 #endif
2037
2038 return b;
2039 }
2040
2041 void
2042 free_context_buffers (struct context_buffers *b)
2043 {
2044 if (b)
2045 {
2046 free_buf (&b->read_link_buf);
2047 free_buf (&b->read_tun_buf);
2048 free_buf (&b->aux_buf);
2049
2050 #ifdef USE_LZO
2051 free_buf (&b->lzo_compress_buf);
2052 free_buf (&b->lzo_decompress_buf);
2053 #endif
2054
2055 #ifdef USE_CRYPTO
2056 free_buf (&b->encrypt_buf);
2057 free_buf (&b->decrypt_buf);
2058 #endif
2059
2060 free (b);
2061 }
2062 }
2063
2064 /*
2065 * Now that we know all frame parameters, initialize
2066 * our buffers.
2067 */
2068 static void
2069 do_init_buffers (struct context *c)
2070 {
2071 c->c2.buffers = init_context_buffers (&c->c2.frame);
2072 c->c2.buffers_owned = true;
2073 }
2074
2075 #ifdef ENABLE_FRAGMENT
2076 /*
2077 * Fragmenting code has buffers to initialize
2078 * once frame parameters are known.
2079 */
2080 static void
2081 do_init_fragment (struct context *c)
2082 {
2083 ASSERT (c->options.fragment);
2084 frame_set_mtu_dynamic (&c->c2.frame_fragment,
2085 c->options.fragment, SET_MTU_UPPER_BOUND);
2086 fragment_frame_init (c->c2.fragment, &c->c2.frame_fragment);
2087 }
2088 #endif
2089
2090 /*
2091 * Set the --mssfix option.
2092 */
2093 static void
2094 do_init_mssfix (struct context *c)
2095 {
2096 if (c->options.mssfix)
2097 {
2098 frame_set_mtu_dynamic (&c->c2.frame,
2099 c->options.mssfix, SET_MTU_UPPER_BOUND);
2100 }
2101 }
2102
2103 /*
2104 * Allocate our socket object.
2105 */
2106 static void
2107 do_link_socket_new (struct context *c)
2108 {
2109 ASSERT (!c->c2.link_socket);
2110 c->c2.link_socket = link_socket_new ();
2111 c->c2.link_socket_owned = true;
2112 }
2113
2114 /*
2115 * bind the TCP/UDP socket
2116 */
2117 static void
2118 do_init_socket_1 (struct context *c, const int mode)
2119 {
2120 unsigned int sockflags = c->options.sockflags;
2121
2122 #if PORT_SHARE
2123 if (c->options.port_share_host && c->options.port_share_port)
2124 sockflags |= SF_PORT_SHARE;
2125 #endif
2126
2127 link_socket_init_phase1 (c->c2.link_socket,
2128 connection_list_defined (&c->options),
2129 c->options.ce.local,
2130 c->options.ce.local_port,
2131 c->options.ce.remote,
2132 c->options.ce.remote_port,
2133 c->options.ce.proto,
2134 mode,
2135 c->c2.accept_from,
2136 #ifdef ENABLE_HTTP_PROXY
2137 c->c1.http_proxy,
2138 #endif
2139 #ifdef ENABLE_SOCKS
2140 c->c1.socks_proxy,
2141 #endif
2142 #ifdef ENABLE_DEBUG
2143 c->options.gremlin,
2144 #endif
2145 c->options.ce.bind_local,
2146 c->options.ce.remote_float,
2147 c->options.inetd,
2148 &c->c1.link_socket_addr,
2149 c->options.ipchange,
2150 c->plugins,
2151 c->options.resolve_retry_seconds,
2152 c->options.ce.connect_retry_seconds,
2153 c->options.ce.connect_timeout,
2154 c->options.ce.connect_retry_max,
2155 c->options.mtu_discover_type,
2156 c->options.rcvbuf,
2157 c->options.sndbuf,
2158 sockflags);
2159 }
2160
2161 /*
2162 * finalize the TCP/UDP socket
2163 */
2164 static void
2165 do_init_socket_2 (struct context *c)
2166 {
2167 link_socket_init_phase2 (c->c2.link_socket, &c->c2.frame,
2168 &c->sig->signal_received);
2169 }
2170
2171 /*
2172 * Print MTU INFO
2173 */
2174 static void
2175 do_print_data_channel_mtu_parms (struct context *c)
2176 {
2177 frame_print (&c->c2.frame, D_MTU_INFO, "Data Channel MTU parms");
2178 #ifdef ENABLE_FRAGMENT
2179 if (c->c2.fragment)
2180 frame_print (&c->c2.frame_fragment, D_MTU_INFO,
2181 "Fragmentation MTU parms");
2182 #endif
2183 }
2184
2185 #ifdef ENABLE_OCC
2186 /*
2187 * Get local and remote options compatibility strings.
2188 */
2189 static void
2190 do_compute_occ_strings (struct context *c)
2191 {
2192 struct gc_arena gc = gc_new ();
2193
2194 c->c2.options_string_local =
2195 options_string (&c->options, &c->c2.frame, c->c1.tuntap, false, &gc);
2196 c->c2.options_string_remote =
2197 options_string (&c->options, &c->c2.frame, c->c1.tuntap, true, &gc);
2198
2199 msg (D_SHOW_OCC, "Local Options String: '%s'", c->c2.options_string_local);
2200 msg (D_SHOW_OCC, "Expected Remote Options String: '%s'",
2201 c->c2.options_string_remote);
2202
2203 #ifdef USE_CRYPTO
2204 msg (D_SHOW_OCC_HASH, "Local Options hash (VER=%s): '%s'",
2205 options_string_version (c->c2.options_string_local, &gc),
2206 md5sum ((uint8_t*)c->c2.options_string_local,
2207 strlen (c->c2.options_string_local), 9, &gc));
2208 msg (D_SHOW_OCC_HASH, "Expected Remote Options hash (VER=%s): '%s'",
2209 options_string_version (c->c2.options_string_remote, &gc),
2210 md5sum ((uint8_t*)c->c2.options_string_remote,
2211 strlen (c->c2.options_string_remote), 9, &gc));
2212 #endif
2213
2214 #if defined(USE_CRYPTO) && defined(USE_SSL)
2215 if (c->c2.tls_multi)
2216 tls_multi_init_set_options (c->c2.tls_multi,
2217 c->c2.options_string_local,
2218 c->c2.options_string_remote);
2219 #endif
2220
2221 gc_free (&gc);
2222 }
2223 #endif
2224
2225 /*
2226 * These things can only be executed once per program instantiation.
2227 * Set up for possible UID/GID downgrade, but don't do it yet.
2228 * Daemonize if requested.
2229 */
2230 static void
2231 do_init_first_time (struct context *c)
2232 {
2233 if (c->first_time && !c->did_we_daemonize && !c->c0)
2234 {
2235 struct context_0 *c0;
2236
2237 ALLOC_OBJ_CLEAR_GC (c->c0, struct context_0, &c->gc);
2238 c0 = c->c0;
2239
2240 /* get user and/or group that we want to setuid/setgid to */
2241 c0->uid_gid_specified =
2242 get_group (c->options.groupname, &c0->group_state) |
2243 get_user (c->options.username, &c0->user_state);
2244
2245 /* get --writepid file descriptor */
2246 get_pid_file (c->options.writepid, &c0->pid_state);
2247
2248 /* become a daemon if --daemon */
2249 c->did_we_daemonize = possibly_become_daemon (&c->options, c->first_time);
2250
2251 /* should we disable paging? */
2252 if (c->options.mlock && c->did_we_daemonize)
2253 do_mlockall (true); /* call again in case we daemonized */
2254
2255 /* save process ID in a file */
2256 write_pid (&c0->pid_state);
2257
2258 /* should we change scheduling priority? */
2259 set_nice (c->options.nice);
2260 }
2261 }
2262
2263 /*
2264 * If xinetd/inetd mode, don't allow restart.
2265 */
2266 static void
2267 do_close_check_if_restart_permitted (struct context *c)
2268 {
2269 if (c->options.inetd
2270 && (c->sig->signal_received == SIGHUP
2271 || c->sig->signal_received == SIGUSR1))
2272 {
2273 c->sig->signal_received = SIGTERM;
2274 msg (M_INFO,
2275 PACKAGE_NAME
2276 " started by inetd/xinetd cannot restart... Exiting.");
2277 }
2278 }
2279
2280 /*
2281 * free buffers
2282 */
2283 static void
2284 do_close_free_buf (struct context *c)
2285 {
2286 if (c->c2.buffers_owned)
2287 {
2288 free_context_buffers (c->c2.buffers);
2289 c->c2.buffers = NULL;
2290 c->c2.buffers_owned = false;
2291 }
2292 }
2293
2294 /*
2295 * close TLS
2296 */
2297 static void
2298 do_close_tls (struct context *c)
2299 {
2300 #if defined(USE_CRYPTO) && defined(USE_SSL)
2301 if (c->c2.tls_multi)
2302 {
2303 tls_multi_free (c->c2.tls_multi, true);
2304 c->c2.tls_multi = NULL;
2305 }
2306
2307 #ifdef ENABLE_OCC
2308 /* free options compatibility strings */
2309 if (c->c2.options_string_local)
2310 free (c->c2.options_string_local);
2311 if (c->c2.options_string_remote)
2312 free (c->c2.options_string_remote);
2313 c->c2.options_string_local = c->c2.options_string_remote = NULL;
2314 #endif
2315 #endif
2316 }
2317
2318 /*
2319 * Free key schedules
2320 */
2321 static void
2322 do_close_free_key_schedule (struct context *c, bool free_ssl_ctx)
2323 {
2324 if (!(c->sig->signal_received == SIGUSR1 && c->options.persist_key))
2325 key_schedule_free (&c->c1.ks, free_ssl_ctx);
2326 }
2327
2328 /*
2329 * Close TCP/UDP connection
2330 */
2331 static void
2332 do_close_link_socket (struct context *c)
2333 {
2334 if (c->c2.link_socket && c->c2.link_socket_owned)
2335 {
2336 link_socket_close (c->c2.link_socket);
2337 c->c2.link_socket = NULL;
2338 }
2339
2340 if (!(c->sig->signal_received == SIGUSR1 && c->options.persist_remote_ip))
2341 {
2342 CLEAR (c->c1.link_socket_addr.remote);
2343 CLEAR (c->c1.link_socket_addr.actual);
2344 }
2345
2346 if (!(c->sig->signal_received == SIGUSR1 && c->options.persist_local_ip))
2347 CLEAR (c->c1.link_socket_addr.local);
2348 }
2349
2350 /*
2351 * Close packet-id persistance file
2352 */
2353 static void
2354 do_close_packet_id (struct context *c)
2355 {
2356 #ifdef USE_CRYPTO
2357 packet_id_free (&c->c2.packet_id);
2358 packet_id_persist_save (&c->c1.pid_persist);
2359 if (!(c->sig->signal_received == SIGUSR1))
2360 packet_id_persist_close (&c->c1.pid_persist);
2361 #endif
2362 }
2363
2364 #ifdef ENABLE_FRAGMENT
2365 /*
2366 * Close fragmentation handler.
2367 */
2368 static void
2369 do_close_fragment (struct context *c)
2370 {
2371 if (c->c2.fragment)
2372 {
2373 fragment_free (c->c2.fragment);
2374 c->c2.fragment = NULL;
2375 }
2376 }
2377 #endif
2378
2379 /*
2380 * Open and close our event objects.
2381 */
2382
2383 static void
2384 do_event_set_init (struct context *c,
2385 bool need_us_timeout)
2386 {
2387 unsigned int flags = 0;
2388
2389 c->c2.event_set_max = BASE_N_EVENTS;
2390
2391 flags |= EVENT_METHOD_FAST;
2392
2393 if (need_us_timeout)
2394 flags |= EVENT_METHOD_US_TIMEOUT;
2395
2396 c->c2.event_set = event_set_init (&c->c2.event_set_max, flags);
2397 c->c2.event_set_owned = true;
2398 }
2399
2400 static void
2401 do_close_event_set (struct context *c)
2402 {
2403 if (c->c2.event_set && c->c2.event_set_owned)
2404 {
2405 event_free (c->c2.event_set);
2406 c->c2.event_set = NULL;
2407 c->c2.event_set_owned = false;
2408 }
2409 }
2410
2411 /*
2412 * Open and close --status file
2413 */
2414
2415 static void
2416 do_open_status_output (struct context *c)
2417 {
2418 if (!c->c1.status_output)
2419 {
2420 c->c1.status_output = status_open (c->options.status_file,
2421 c->options.status_file_update_freq,
2422 -1,
2423 NULL,
2424 STATUS_OUTPUT_WRITE);
2425 c->c1.status_output_owned = true;
2426 }
2427 }
2428
2429 static void
2430 do_close_status_output (struct context *c)
2431 {
2432 if (!(c->sig->signal_received == SIGUSR1))
2433 {
2434 if (c->c1.status_output_owned && c->c1.status_output)
2435 {
2436 status_close (c->c1.status_output);
2437 c->c1.status_output = NULL;
2438 c->c1.status_output_owned = false;
2439 }
2440 }
2441 }
2442
2443 /*
2444 * Handle ifconfig-pool persistance object.
2445 */
2446 static void
2447 do_open_ifconfig_pool_persist (struct context *c)
2448 {
2449 #if P2MP_SERVER
2450 if (!c->c1.ifconfig_pool_persist && c->options.ifconfig_pool_persist_filename)
2451 {
2452 c->c1.ifconfig_pool_persist = ifconfig_pool_persist_init (c->options.ifconfig_pool_persist_filename,
2453 c->options.ifconfig_pool_persist_refresh_freq);
2454 c->c1.ifconfig_pool_persist_owned = true;
2455 }
2456 #endif
2457 }
2458
2459 static void
2460 do_close_ifconfig_pool_persist (struct context *c)
2461 {
2462 #if P2MP_SERVER
2463 if (!(c->sig->signal_received == SIGUSR1))
2464 {
2465 if (c->c1.ifconfig_pool_persist && c->c1.ifconfig_pool_persist_owned)
2466 {
2467 ifconfig_pool_persist_close (c->c1.ifconfig_pool_persist);
2468 c->c1.ifconfig_pool_persist = NULL;
2469 c->c1.ifconfig_pool_persist_owned = false;
2470 }
2471 }
2472 #endif
2473 }
2474
2475 /*
2476 * Inherit environmental variables
2477 */
2478
2479 static void
2480 do_inherit_env (struct context *c, const struct env_set *src)
2481 {
2482 c->c2.es = env_set_create (NULL);
2483 c->c2.es_owned = true;
2484 env_set_inherit (c->c2.es, src);
2485 }
2486
2487 static void
2488 do_env_set_destroy (struct context *c)
2489 {
2490 if (c->c2.es && c->c2.es_owned)
2491 {
2492 env_set_destroy (c->c2.es);
2493 c->c2.es = NULL;
2494 c->c2.es_owned = false;
2495 }
2496 }
2497
2498 /*
2499 * Fast I/O setup. Fast I/O is an optimization which only works
2500 * if all of the following are true:
2501 *
2502 * (1) The platform is not Windows
2503 * (2) --proto udp is enabled
2504 * (3) --shaper is disabled
2505 */
2506 static void
2507 do_setup_fast_io (struct context *c)
2508 {
2509 if (c->options.fast_io)
2510 {
2511 #ifdef WIN32
2512 msg (M_INFO, "NOTE: --fast-io is disabled since we are running on Windows");
2513 #else
2514 if (c->options.ce.proto != PROTO_UDPv4)
2515 msg (M_INFO, "NOTE: --fast-io is disabled since we are not using UDP");
2516 else
2517 {
2518 #ifdef HAVE_GETTIMEOFDAY
2519 if (c->options.shaper)
2520 msg (M_INFO, "NOTE: --fast-io is disabled since we are using --shaper");
2521 else
2522 #endif
2523 {
2524 c->c2.fast_io = true;
2525 }
2526 }
2527 #endif
2528 }
2529 }
2530
2531 static void
2532 do_signal_on_tls_errors (struct context *c)
2533 {
2534 #if defined(USE_CRYPTO) && defined(USE_SSL)
2535 if (c->options.tls_exit)
2536 c->c2.tls_exit_signal = SIGTERM;
2537 else
2538 c->c2.tls_exit_signal = SIGUSR1;
2539 #endif
2540 }
2541
2542 #ifdef ENABLE_PLUGIN
2543
2544 void
2545 init_plugins (struct context *c)
2546 {
2547 if (c->options.plugin_list && !c->plugins)
2548 {
2549 c->plugins = plugin_list_init (c->options.plugin_list);
2550 c->plugins_owned = true;
2551 }
2552 }
2553
2554 void
2555 open_plugins (struct context *c, const bool import_options, int init_point)
2556 {
2557 if (c->plugins && c->plugins_owned)
2558 {
2559 if (import_options)
2560 {
2561 struct plugin_return pr, config;
2562 plugin_return_init (&pr);
2563 plugin_list_open (c->plugins, c->options.plugin_list, &pr, c->c2.es, init_point);
2564 plugin_return_get_column (&pr, &config, "config");
2565 if (plugin_return_defined (&config))
2566 {
2567 int i;
2568 for (i = 0; i < config.n; ++i)
2569 {
2570 unsigned int option_types_found = 0;
2571 if (config.list[i] && config.list[i]->value)
2572 options_string_import (&c->options,
2573 config.list[i]->value,
2574 D_IMPORT_ERRORS|M_OPTERR,
2575 OPT_P_DEFAULT & ~OPT_P_PLUGIN,
2576 &option_types_found,
2577 c->es);
2578 }
2579 }
2580 plugin_return_free (&pr);
2581 }
2582 else
2583 {
2584 plugin_list_open (c->plugins, c->options.plugin_list, NULL, c->c2.es, init_point);
2585 }
2586 }
2587 }
2588
2589 static void
2590 do_close_plugins (struct context *c)
2591 {
2592 if (c->plugins && c->plugins_owned && !(c->sig->signal_received == SIGUSR1))
2593 {
2594 plugin_list_close (c->plugins);
2595 c->plugins = NULL;
2596 c->plugins_owned = false;
2597 }
2598 }
2599
2600 static void
2601 do_inherit_plugins (struct context *c, const struct context *src)
2602 {
2603 if (!c->plugins && src->plugins)
2604 {
2605 c->plugins = plugin_list_inherit (src->plugins);
2606 c->plugins_owned = true;
2607 }
2608 }
2609
2610 #endif
2611
2612 #ifdef ENABLE_MANAGEMENT
2613
2614 static void
2615 management_callback_status_p2p (void *arg, const int version, struct status_output *so)
2616 {
2617 struct context *c = (struct context *) arg;
2618 print_status (c, so);
2619 }
2620
2621 void
2622 management_show_net_callback (void *arg, const int msglevel)
2623 {
2624 #ifdef WIN32
2625 show_routes (msglevel);
2626 show_adapters (msglevel);
2627 msg (msglevel, "END");
2628 #else
2629 msg (msglevel, "ERROR: Sorry, this command is currently only implemented on Windows");
2630 #endif
2631 }
2632
2633 #endif
2634
2635 void
2636 init_management_callback_p2p (struct context *c)
2637 {
2638 #ifdef ENABLE_MANAGEMENT
2639 if (management)
2640 {
2641 struct management_callback cb;
2642 CLEAR (cb);
2643 cb.arg = c;
2644 cb.status = management_callback_status_p2p;
2645 cb.show_net = management_show_net_callback;
2646 management_set_callback (management, &cb);
2647 }
2648 #endif
2649 }
2650
2651 #ifdef ENABLE_MANAGEMENT
2652
2653 void
2654 init_management (struct context *c)
2655 {
2656 if (!management)
2657 management = management_init ();
2658 }
2659
2660 bool
2661 open_management (struct context *c)
2662 {
2663 /* initialize management layer */
2664 if (management)
2665 {
2666 if (c->options.management_addr)
2667 {
2668 unsigned int flags = c->options.management_flags;
2669 if (c->options.mode == MODE_SERVER)
2670 flags |= MF_SERVER;
2671 if (management_open (management,
2672 c->options.management_addr,
2673 c->options.management_port,
2674 c->options.management_user_pass,
2675 c->options.management_client_user,
2676 c->options.management_client_group,
2677 c->options.management_log_history_cache,
2678 c->options.management_echo_buffer_size,
2679 c->options.management_state_buffer_size,
2680 c->options.management_write_peer_info_file,
2681 c->options.remap_sigusr1,
2682 flags))
2683 {
2684 management_set_state (management,
2685 OPENVPN_STATE_CONNECTING,
2686 NULL,
2687 (in_addr_t)0,
2688 (in_addr_t)0);
2689 }
2690
2691 /* initial management hold, called early, before first context initialization */
2692 do_hold (c);
2693 if (IS_SIG (c))
2694 {
2695 msg (M_WARN, "Signal received from management interface, exiting");
2696 return false;
2697 }
2698 }
2699 else
2700 close_management ();
2701 }
2702 return true;
2703 }
2704
2705 void
2706 close_management (void)
2707 {
2708 if (management)
2709 {
2710 management_close (management);
2711 management = NULL;
2712 }
2713 }
2714
2715 #endif
2716
2717
2718 void
2719 uninit_management_callback (void)
2720 {
2721 #ifdef ENABLE_MANAGEMENT
2722 if (management)
2723 {
2724 management_clear_callback (management);
2725 }
2726 #endif
2727 }
2728
2729 /*
2730 * Initialize a tunnel instance, handle pre and post-init
2731 * signal settings.
2732 */
2733 void
2734 init_instance_handle_signals (struct context *c, const struct env_set *env, const unsigned int flags)
2735 {
2736 pre_init_signal_catch ();
2737 init_instance (c, env, flags);
2738 post_init_signal_catch ();
2739
2740 /*
2741 * This is done so that signals thrown during
2742 * initialization can bring us back to
2743 * a management hold.
2744 */
2745 if (IS_SIG (c))
2746 {
2747 remap_signal (c);
2748 uninit_management_callback ();
2749 }
2750 }
2751
2752 /*
2753 * Initialize a tunnel instance.
2754 */
2755 void
2756 init_instance (struct context *c, const struct env_set *env, const unsigned int flags)
2757 {
2758 const struct options *options = &c->options;
2759 const bool child = (c->mode == CM_CHILD_TCP || c->mode == CM_CHILD_UDP);
2760 int link_socket_mode = LS_MODE_DEFAULT;
2761
2762 /* init garbage collection level */
2763 gc_init (&c->c2.gc);
2764
2765 /* signals caught here will abort */
2766 c->sig->signal_received = 0;
2767 c->sig->signal_text = NULL;
2768 c->sig->hard = false;
2769
2770 /* map in current connection entry */
2771 next_connection_entry (c);
2772
2773 /* link_socket_mode allows CM_CHILD_TCP
2774 instances to inherit acceptable fds
2775 from a top-level parent */
2776 if (c->options.ce.proto == PROTO_TCPv4_SERVER)
2777 {
2778 if (c->mode == CM_TOP)
2779 link_socket_mode = LS_MODE_TCP_LISTEN;
2780 else if (c->mode == CM_CHILD_TCP)
2781 link_socket_mode = LS_MODE_TCP_ACCEPT_FROM;
2782 }
2783
2784 /* should we disable paging? */
2785 if (c->first_time && options->mlock)
2786 do_mlockall (true);
2787
2788 /* possible sleep or management hold if restart */
2789 if (c->mode == CM_P2P || c->mode == CM_TOP)
2790 {
2791 do_startup_pause (c);
2792 if (IS_SIG (c))
2793 goto sig;
2794 }
2795
2796 #if P2MP
2797 /* get passwords if undefined */
2798 if (auth_retry_get () == AR_INTERACT)
2799 init_query_passwords (c);
2800 #endif
2801
2802 /* initialize context level 2 --verb/--mute parms */
2803 init_verb_mute (c, IVM_LEVEL_2);
2804
2805 /* set error message delay for non-server modes */
2806 if (c->mode == CM_P2P)
2807 set_check_status_error_delay (P2P_ERROR_DELAY_MS);
2808
2809 /* warn about inconsistent options */
2810 if (c->mode == CM_P2P || c->mode == CM_TOP)
2811 do_option_warnings (c);
2812
2813 /* inherit environmental variables */
2814 if (env)
2815 do_inherit_env (c, env);
2816
2817 #ifdef ENABLE_PLUGIN
2818 /* initialize plugins */
2819 if (c->mode == CM_P2P || c->mode == CM_TOP)
2820 open_plugins (c, false, OPENVPN_PLUGIN_INIT_PRE_DAEMON);
2821 #endif
2822
2823 /* should we enable fast I/O? */
2824 if (c->mode == CM_P2P || c->mode == CM_TOP)
2825 do_setup_fast_io (c);
2826
2827 /* should we throw a signal on TLS errors? */
2828 do_signal_on_tls_errors (c);
2829
2830 /* open --status file */
2831 if (c->mode == CM_P2P || c->mode == CM_TOP)
2832 do_open_status_output (c);
2833
2834 /* open --ifconfig-pool-persist file */
2835 if (c->mode == CM_TOP)
2836 do_open_ifconfig_pool_persist (c);
2837
2838 #ifdef ENABLE_OCC
2839 /* reset OCC state */
2840 if (c->mode == CM_P2P || child)
2841 c->c2.occ_op = occ_reset_op ();
2842 #endif
2843
2844 /* our wait-for-i/o objects, different for posix vs. win32 */
2845 if (c->mode == CM_P2P)
2846 do_event_set_init (c, SHAPER_DEFINED (&c->options));
2847 else if (c->mode == CM_CHILD_TCP)
2848 do_event_set_init (c, false);
2849
2850 /* initialize HTTP or SOCKS proxy object at scope level 2 */
2851 init_proxy (c, 2);
2852
2853 /* allocate our socket object */
2854 if (c->mode == CM_P2P || c->mode == CM_TOP || c->mode == CM_CHILD_TCP)
2855 do_link_socket_new (c);
2856
2857 #ifdef ENABLE_FRAGMENT
2858 /* initialize internal fragmentation object */
2859 if (options->fragment && (c->mode == CM_P2P || child))
2860 c->c2.fragment = fragment_init (&c->c2.frame);
2861 #endif
2862
2863 /* init crypto layer */
2864 {
2865 unsigned int crypto_flags = 0;
2866 if (c->mode == CM_TOP)
2867 crypto_flags = CF_INIT_TLS_AUTH_STANDALONE;
2868 else if (c->mode == CM_P2P)
2869 crypto_flags = CF_LOAD_PERSISTED_PACKET_ID | CF_INIT_TLS_MULTI;
2870 else if (child)
2871 crypto_flags = CF_INIT_TLS_MULTI;
2872 do_init_crypto (c, crypto_flags);
2873 if (IS_SIG (c) && !child)
2874 goto sig;
2875 }
2876
2877 #ifdef USE_LZO
2878 /* initialize LZO compression library. */
2879 if ((options->lzo & LZO_SELECTED) && (c->mode == CM_P2P || child))
2880 lzo_compress_init (&c->c2.lzo_compwork, options->lzo);
2881 #endif
2882
2883 /* initialize MTU variables */
2884 do_init_frame (c);
2885
2886 /* initialize TLS MTU variables */
2887 do_init_frame_tls (c);
2888
2889 /* init workspace buffers whose size is derived from frame size */
2890 if (c->mode == CM_P2P || c->mode == CM_CHILD_TCP)
2891 do_init_buffers (c);
2892
2893 #ifdef ENABLE_FRAGMENT
2894 /* initialize internal fragmentation capability with known frame size */
2895 if (options->fragment && (c->mode == CM_P2P || child))
2896 do_init_fragment (c);
2897 #endif
2898
2899 /* initialize dynamic MTU variable */
2900 do_init_mssfix (c);
2901
2902 /* bind the TCP/UDP socket */
2903 if (c->mode == CM_P2P || c->mode == CM_TOP || c->mode == CM_CHILD_TCP)
2904 do_init_socket_1 (c, link_socket_mode);
2905
2906 /* initialize tun/tap device object,
2907 open tun/tap device, ifconfig, run up script, etc. */
2908 if (!(options->up_delay || PULL_DEFINED (options)) && (c->mode == CM_P2P || c->mode == CM_TOP))
2909 c->c2.did_open_tun = do_open_tun (c);
2910
2911 /* print MTU info */
2912 do_print_data_channel_mtu_parms (c);
2913
2914 #ifdef ENABLE_OCC
2915 /* get local and remote options compatibility strings */
2916 if (c->mode == CM_P2P || child)
2917 do_compute_occ_strings (c);
2918 #endif
2919
2920 /* initialize output speed limiter */
2921 if (c->mode == CM_P2P)
2922 do_init_traffic_shaper (c);
2923
2924 /* do one-time inits, and possibily become a daemon here */
2925 do_init_first_time (c);
2926
2927 #ifdef ENABLE_PLUGIN
2928 /* initialize plugins */
2929 if (c->mode == CM_P2P || c->mode == CM_TOP)
2930 open_plugins (c, false, OPENVPN_PLUGIN_INIT_POST_DAEMON);
2931 #endif
2932
2933 /*
2934 * Actually do UID/GID downgrade, and chroot, if requested.
2935 * May be delayed by --client, --pull, or --up-delay.
2936 */
2937 do_uid_gid_chroot (c, c->c2.did_open_tun);
2938
2939 /* finalize the TCP/UDP socket */
2940 if (c->mode == CM_P2P || c->mode == CM_TOP || c->mode == CM_CHILD_TCP)
2941 do_init_socket_2 (c);
2942
2943 /* initialize timers */
2944 if (c->mode == CM_P2P || child)
2945 do_init_timers (c, false);
2946
2947 #ifdef ENABLE_PLUGIN
2948 /* initialize plugins */
2949 if (c->mode == CM_P2P || c->mode == CM_TOP)
2950 open_plugins (c, false, OPENVPN_PLUGIN_INIT_POST_UID_CHANGE);
2951 #endif
2952
2953 #if PORT_SHARE
2954 /* share OpenVPN port with foreign (such as HTTPS) server */
2955 if (c->first_time && (c->mode == CM_P2P || c->mode == CM_TOP))
2956 init_port_share (c);
2957 #endif
2958
2959 #ifdef ENABLE_PF
2960 if (child)
2961 pf_init_context (c);
2962 #endif
2963
2964 /* Check for signals */
2965 if (IS_SIG (c))
2966 goto sig;
2967
2968 return;
2969
2970 sig:
2971 if (!c->sig->signal_text)
2972 c->sig->signal_text = "init_instance";
2973 close_context (c, -1, flags);
2974 return;
2975 }
2976
2977 /*
2978 * Close a tunnel instance.
2979 */
2980 void
2981 close_instance (struct context *c)
2982 {
2983 /* close event objects */
2984 do_close_event_set (c);
2985
2986 if (c->mode == CM_P2P
2987 || c->mode == CM_CHILD_TCP
2988 || c->mode == CM_CHILD_UDP
2989 || c->mode == CM_TOP)
2990 {
2991 /* if xinetd/inetd mode, don't allow restart */
2992 do_close_check_if_restart_permitted (c);
2993
2994 #ifdef USE_LZO
2995 if (lzo_defined (&c->c2.lzo_compwork))
2996 lzo_compress_uninit (&c->c2.lzo_compwork);
2997 #endif
2998
2999 /* free buffers */
3000 do_close_free_buf (c);
3001
3002 /* close TLS */
3003 do_close_tls (c);
3004
3005 /* free key schedules */
3006 do_close_free_key_schedule (c, (c->mode == CM_P2P || c->mode == CM_TOP));
3007
3008 /* close TCP/UDP connection */
3009 do_close_link_socket (c);
3010
3011 /* close TUN/TAP device */
3012 do_close_tun (c, false);
3013
3014 #ifdef MANAGEMENT_DEF_AUTH
3015 if (management)
3016 management_notify_client_close (management, &c->c2.mda_context, NULL);
3017 #endif
3018
3019 #ifdef ENABLE_PF
3020 pf_destroy_context (&c->c2.pf);
3021 #endif
3022
3023 #ifdef ENABLE_PLUGIN
3024 /* call plugin close functions and unload */
3025 do_close_plugins (c);
3026 #endif
3027
3028 /* close packet-id persistance file */
3029 do_close_packet_id (c);
3030
3031 /* close --status file */
3032 do_close_status_output (c);
3033
3034 #ifdef ENABLE_FRAGMENT
3035 /* close fragmentation handler */
3036 do_close_fragment (c);
3037 #endif
3038
3039 /* close --ifconfig-pool-persist obj */
3040 do_close_ifconfig_pool_persist (c);
3041
3042 /* free up environmental variable store */
3043 do_env_set_destroy (c);
3044
3045 /* close HTTP or SOCKS proxy */
3046 uninit_proxy (c);
3047
3048 /* garbage collect */
3049 gc_free (&c->c2.gc);
3050 }
3051 }
3052
3053 void
3054 inherit_context_child (struct context *dest,
3055 const struct context *src)
3056 {
3057 CLEAR (*dest);
3058
3059 switch (src->options.ce.proto)
3060 {
3061 case PROTO_UDPv4:
3062 dest->mode = CM_CHILD_UDP;
3063 break;
3064 case PROTO_TCPv4_SERVER:
3065 dest->mode = CM_CHILD_TCP;
3066 break;
3067 default:
3068 ASSERT (0);
3069 }
3070
3071 dest->gc = gc_new ();
3072
3073 ALLOC_OBJ_CLEAR_GC (dest->sig, struct signal_info, &dest->gc);
3074
3075 /* c1 init */
3076 packet_id_persist_init (&dest->c1.pid_persist);
3077
3078 #ifdef USE_CRYPTO
3079 dest->c1.ks.key_type = src->c1.ks.key_type;
3080 #ifdef USE_SSL
3081 /* inherit SSL context */
3082 dest->c1.ks.ssl_ctx = src->c1.ks.ssl_ctx;
3083 dest->c1.ks.tls_auth_key = src->c1.ks.tls_auth_key;
3084 #endif
3085 #endif
3086
3087 /* options */
3088 dest->options = src->options;
3089 options_detach (&dest->options);
3090
3091 if (dest->mode == CM_CHILD_TCP)
3092 {
3093 /*
3094 * The CM_TOP context does the socket listen(),
3095 * and the CM_CHILD_TCP context does the accept().
3096 */
3097 dest->c2.accept_from = src->c2.link_socket;
3098 }
3099
3100 #ifdef ENABLE_PLUGIN
3101 /* inherit plugins */
3102 do_inherit_plugins (dest, src);
3103 #endif
3104
3105 /* context init */
3106 init_instance (dest, src->c2.es, CC_NO_CLOSE | CC_USR1_TO_HUP);
3107 if (IS_SIG (dest))
3108 return;
3109
3110 /* inherit tun/tap interface object */
3111 dest->c1.tuntap = src->c1.tuntap;
3112
3113 /* UDP inherits some extra things which TCP does not */
3114 if (dest->mode == CM_CHILD_UDP)
3115 {
3116 /* inherit buffers */
3117 dest->c2.buffers = src->c2.buffers;
3118
3119 /* inherit parent link_socket and tuntap */
3120 dest->c2.link_socket = src->c2.link_socket;
3121
3122 ALLOC_OBJ_GC (dest->c2.link_socket_info, struct link_socket_info, &dest->gc);
3123 *dest->c2.link_socket_info = src->c2.link_socket->info;
3124
3125 /* locally override some link_socket_info fields */
3126 dest->c2.link_socket_info->lsa = &dest->c1.link_socket_addr;
3127 dest->c2.link_socket_info->connection_established = false;
3128 }
3129 }
3130
3131 void
3132 inherit_context_top (struct context *dest,
3133 const struct context *src)
3134 {
3135 /* copy parent */
3136 *dest = *src;
3137
3138 /*
3139 * CM_TOP_CLONE will prevent close_instance from freeing or closing
3140 * resources owned by the parent.
3141 *
3142 * Also note that CM_TOP_CLONE context objects are
3143 * closed by multi_top_free in multi.c.
3144 */
3145 dest->mode = CM_TOP_CLONE;
3146
3147 dest->first_time = false;
3148 dest->c0 = NULL;
3149
3150 options_detach (&dest->options);
3151 gc_detach (&dest->gc);
3152 gc_detach (&dest->c2.gc);
3153
3154 /* detach plugins */
3155 dest->plugins_owned = false;
3156
3157 #if defined(USE_CRYPTO) && defined(USE_SSL)
3158 dest->c2.tls_multi = NULL;
3159 #endif
3160
3161 /* detach c1 ownership */
3162 dest->c1.tuntap_owned = false;
3163 dest->c1.status_output_owned = false;
3164 #if P2MP_SERVER
3165 dest->c1.ifconfig_pool_persist_owned = false;
3166 #endif
3167
3168 /* detach c2 ownership */
3169 dest->c2.event_set_owned = false;
3170 dest->c2.link_socket_owned = false;
3171 dest->c2.buffers_owned = false;
3172 dest->c2.es_owned = false;
3173
3174 dest->c2.event_set = NULL;
3175 if (src->options.ce.proto == PROTO_UDPv4)
3176 do_event_set_init (dest, false);
3177 }
3178
3179 void
3180 close_context (struct context *c, int sig, unsigned int flags)
3181 {
3182 ASSERT (c);
3183 ASSERT (c->sig);
3184
3185 if (sig >= 0)
3186 c->sig->signal_received = sig;
3187
3188 if (c->sig->signal_received == SIGUSR1)
3189 {
3190 if ((flags & CC_USR1_TO_HUP)
3191 || (c->sig->hard && (flags & CC_HARD_USR1_TO_HUP)))
3192 c->sig->signal_received = SIGHUP;
3193 }
3194
3195 if (!(flags & CC_NO_CLOSE))
3196 close_instance (c);
3197
3198 if (flags & CC_GC_FREE)
3199 context_gc_free (c);
3200 }
3201
3202 #ifdef USE_CRYPTO
3203
3204 static void
3205 test_malloc (void)
3206 {
3207 int i, j;
3208 msg (M_INFO, "Multithreaded malloc test...");
3209 for (i = 0; i < 25; ++i)
3210 {
3211 struct gc_arena gc = gc_new ();
3212 const int limit = get_random () & 0x03FF;
3213 for (j = 0; j < limit; ++j)
3214 {
3215 gc_malloc (get_random () & 0x03FF, false, &gc);
3216 }
3217 gc_free (&gc);
3218 }
3219 }
3220
3221 /*
3222 * Do a loopback test
3223 * on the crypto subsystem.
3224 */
3225 static void *
3226 test_crypto_thread (void *arg)
3227 {
3228 struct context *c = (struct context *) arg;
3229 const struct options *options = &c->options;
3230 #if defined(USE_PTHREAD)
3231 struct context *child = NULL;
3232 openvpn_thread_t child_id = 0;
3233 #endif
3234
3235 ASSERT (options->test_crypto);
3236 init_verb_mute (c, IVM_LEVEL_1);
3237 context_init_1 (c);
3238 do_init_crypto_static (c, 0);
3239
3240 #if defined(USE_PTHREAD)
3241 {
3242 if (c->first_time && options->n_threads > 1)
3243 {
3244 if (options->n_threads > 2)
3245 msg (M_FATAL, "ERROR: --test-crypto option only works with --threads set to 1 or 2");
3246 openvpn_thread_init ();
3247 ALLOC_OBJ (child, struct context);
3248 context_clear (child);
3249 child->options = *options;
3250 options_detach (&child->options);
3251 child->first_time = false;
3252 child_id = openvpn_thread_create (test_crypto_thread, (void *) child);
3253 }
3254 }
3255 #endif
3256 frame_finalize_options (c, options);
3257
3258 #if defined(USE_PTHREAD)
3259 if (options->n_threads == 2)
3260 test_malloc ();
3261 #endif
3262
3263 test_crypto (&c->c2.crypto_options, &c->c2.frame);
3264
3265 key_schedule_free (&c->c1.ks, true);
3266 packet_id_free (&c->c2.packet_id);
3267
3268 #if defined(USE_PTHREAD)
3269 if (c->first_time && options->n_threads > 1)
3270 openvpn_thread_join (child_id);
3271 if (child)
3272 free (child);
3273 #endif
3274 context_gc_free (c);
3275 return NULL;
3276 }
3277
3278 #endif
3279
3280 bool
3281 do_test_crypto (const struct options *o)
3282 {
3283 #ifdef USE_CRYPTO
3284 if (o->test_crypto)
3285 {
3286 struct context c;
3287
3288 /* print version number */
3289 msg (M_INFO, "%s", title_string);
3290
3291 context_clear (&c);
3292 c.options = *o;
3293 options_detach (&c.options);
3294 c.first_time = true;
3295 test_crypto_thread ((void *) &c);
3296 return true;
3297 }
3298 #endif
3299 return false;
3300 }
Tomato firmware and modifications.