/*
  *  OpenVPN -- An application to securely tunnel IP networks
  *             over a single TCP/UDP port, with support for SSL/TLS-based
  *             session authentication and key exchange,
  *             packet encryption, packet authentication, and
  *             packet compression.
  *

  *  Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>

  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
  *  as published by the Free Software Foundation.
  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *

  *  You should have received a copy of the GNU General Public License along
  *  with this program; if not, write to the Free Software Foundation, Inc.,
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

  */
 

 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #elif defined(_MSC_VER)
 #include "config-msvc.h"
 #endif
 

 #include "syshead.h"
 
 #ifdef ENABLE_OCC
 
 #include "occ.h"
 
 #include "memdbg.h"
 
 #include "forward-inline.h"
 #include "occ-inline.h"
 
 /*
  * This random string identifies an OpenVPN
  * Configuration Control packet.
  * It should be of sufficient length and randomness
  * so as not to collide with other tunnel data.
  *
  * The OCC protocol is as follows:
  *
  * occ_magic -- (16 octets)
  *
  * type [OCC_REQUEST | OCC_REPLY] (1 octet)
  * null terminated options string if OCC_REPLY (variable)
  *
  * When encryption is used, the OCC packet
  * is encapsulated within the encrypted
  * envelope.
  *
  * OCC_STRING_SIZE must be set to sizeof (occ_magic)
  */
 
 const uint8_t occ_magic[] = {

     0x28, 0x7f, 0x34, 0x6b, 0xd4, 0xef, 0x7a, 0x81,
     0x2d, 0x56, 0xb8, 0xd3, 0xaf, 0xc5, 0x45, 0x9c

 };
 
 static const struct mtu_load_test mtu_load_test_sequence[] = {
 

     {OCC_MTU_LOAD_REQUEST, -1000},
     {OCC_MTU_LOAD, -1000},
     {OCC_MTU_LOAD_REQUEST, -1000},
     {OCC_MTU_LOAD, -1000},
     {OCC_MTU_LOAD_REQUEST, -1000},
     {OCC_MTU_LOAD, -1000},
 
     {OCC_MTU_LOAD_REQUEST, -750},
     {OCC_MTU_LOAD, -750},
     {OCC_MTU_LOAD_REQUEST, -750},
     {OCC_MTU_LOAD, -750},
     {OCC_MTU_LOAD_REQUEST, -750},
     {OCC_MTU_LOAD, -750},
 
     {OCC_MTU_LOAD_REQUEST, -500},
     {OCC_MTU_LOAD, -500},
     {OCC_MTU_LOAD_REQUEST, -500},
     {OCC_MTU_LOAD, -500},
     {OCC_MTU_LOAD_REQUEST, -500},
     {OCC_MTU_LOAD, -500},
 
     {OCC_MTU_LOAD_REQUEST, -400},
     {OCC_MTU_LOAD, -400},
     {OCC_MTU_LOAD_REQUEST, -400},
     {OCC_MTU_LOAD, -400},
     {OCC_MTU_LOAD_REQUEST, -400},
     {OCC_MTU_LOAD, -400},
 
     {OCC_MTU_LOAD_REQUEST, -300},
     {OCC_MTU_LOAD, -300},
     {OCC_MTU_LOAD_REQUEST, -300},
     {OCC_MTU_LOAD, -300},
     {OCC_MTU_LOAD_REQUEST, -300},
     {OCC_MTU_LOAD, -300},
 
     {OCC_MTU_LOAD_REQUEST, -200},
     {OCC_MTU_LOAD, -200},
     {OCC_MTU_LOAD_REQUEST, -200},
     {OCC_MTU_LOAD, -200},
     {OCC_MTU_LOAD_REQUEST, -200},
     {OCC_MTU_LOAD, -200},
 
     {OCC_MTU_LOAD_REQUEST, -150},
     {OCC_MTU_LOAD, -150},
     {OCC_MTU_LOAD_REQUEST, -150},
     {OCC_MTU_LOAD, -150},
     {OCC_MTU_LOAD_REQUEST, -150},
     {OCC_MTU_LOAD, -150},
 
     {OCC_MTU_LOAD_REQUEST, -100},
     {OCC_MTU_LOAD, -100},
     {OCC_MTU_LOAD_REQUEST, -100},
     {OCC_MTU_LOAD, -100},
     {OCC_MTU_LOAD_REQUEST, -100},
     {OCC_MTU_LOAD, -100},
 
     {OCC_MTU_LOAD_REQUEST, -50},
     {OCC_MTU_LOAD, -50},
     {OCC_MTU_LOAD_REQUEST, -50},
     {OCC_MTU_LOAD, -50},
     {OCC_MTU_LOAD_REQUEST, -50},
     {OCC_MTU_LOAD, -50},
 
     {OCC_MTU_LOAD_REQUEST, 0},
     {OCC_MTU_LOAD, 0},
     {OCC_MTU_LOAD_REQUEST, 0},
     {OCC_MTU_LOAD, 0},
     {OCC_MTU_LOAD_REQUEST, 0},
     {OCC_MTU_LOAD, 0},
 
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
     {OCC_MTU_REQUEST, 0},
 
     {-1, 0}

 };
 
 void

 check_send_occ_req_dowork(struct context *c)

 {

     if (++c->c2.occ_n_tries >= OCC_N_TRIES)

     {

         if (c->options.ce.remote)
         {
             /*
              * No OCC_REPLY from peer after repeated attempts.
              * Give up.
              */
             msg(D_SHOW_OCC,
                 "NOTE: failed to obtain options consistency info from peer -- "
                 "this could occur if the remote peer is running a version of "
                 PACKAGE_NAME
                 " before 1.5-beta8 or if there is a network connectivity problem, and will not necessarily prevent "
                 PACKAGE_NAME
                 " from running (" counter_format " bytes received from peer, " counter_format
                 " bytes authenticated data channel traffic) -- you can disable the options consistency "
                 "check with --disable-occ.",
                 c->c2.link_read_bytes,
                 c->c2.link_read_bytes_auth);
         }
         event_timeout_clear(&c->c2.occ_interval);

     }

     else

     {

         c->c2.occ_op = OCC_REQUEST;

         /*
          * If we don't hear back from peer, send another
          * OCC_REQUEST in OCC_INTERVAL_SECONDS.
          */
         event_timeout_reset(&c->c2.occ_interval);

     }
 }
 
 void

 check_send_occ_load_test_dowork(struct context *c)

 {

     if (CONNECTION_ESTABLISHED(c))

     {

         const struct mtu_load_test *entry;
 
         if (!c->c2.occ_mtu_load_n_tries)
         {
             msg(M_INFO,
                 "NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes.");
         }
 
         entry = &mtu_load_test_sequence[c->c2.occ_mtu_load_n_tries++];
         if (entry->op >= 0)
         {
             c->c2.occ_op = entry->op;
             c->c2.occ_mtu_load_size =
                 EXPANDED_SIZE(&c->c2.frame) + entry->delta;
         }
         else
         {
             msg(M_INFO,
                 "NOTE: failed to empirically measure MTU (requires " PACKAGE_NAME " 1.5 or higher at other end of connection).");
             event_timeout_clear(&c->c2.occ_mtu_load_test_interval);
             c->c2.occ_mtu_load_n_tries = 0;
         }

     }
 }
 
 void

 check_send_occ_msg_dowork(struct context *c)

 {

     bool doit = false;

     c->c2.buf = c->c2.buffers->aux_buf;
     ASSERT(buf_init(&c->c2.buf, FRAME_HEADROOM(&c->c2.frame)));
     ASSERT(buf_safe(&c->c2.buf, MAX_RW_SIZE_TUN(&c->c2.frame)));
     ASSERT(buf_write(&c->c2.buf, occ_magic, OCC_STRING_SIZE));

     switch (c->c2.occ_op)

     {

         case OCC_REQUEST:
             if (!buf_write_u8(&c->c2.buf, OCC_REQUEST))
             {
                 break;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_REQUEST");
             doit = true;
             break;
 
         case OCC_REPLY:
             if (!c->c2.options_string_local)
             {
                 break;
             }
             if (!buf_write_u8(&c->c2.buf, OCC_REPLY))
             {
                 break;
             }
             if (!buf_write(&c->c2.buf, c->c2.options_string_local,
                            strlen(c->c2.options_string_local) + 1))
             {
                 break;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_REPLY");
             doit = true;
             break;
 
         case OCC_MTU_REQUEST:
             if (!buf_write_u8(&c->c2.buf, OCC_MTU_REQUEST))
             {
                 break;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_REQUEST");
             doit = true;
             break;
 
         case OCC_MTU_REPLY:
             if (!buf_write_u8(&c->c2.buf, OCC_MTU_REPLY))
             {
                 break;
             }
             if (!buf_write_u16(&c->c2.buf, c->c2.max_recv_size_local))
             {
                 break;
             }
             if (!buf_write_u16(&c->c2.buf, c->c2.max_send_size_local))
             {
                 break;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_REPLY");
             doit = true;
             break;
 
         case OCC_MTU_LOAD_REQUEST:
             if (!buf_write_u8(&c->c2.buf, OCC_MTU_LOAD_REQUEST))
             {
                 break;
             }
             if (!buf_write_u16(&c->c2.buf, c->c2.occ_mtu_load_size))
             {
                 break;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_LOAD_REQUEST");
             doit = true;
             break;
 
         case OCC_MTU_LOAD:
         {
             int need_to_add;
 
             if (!buf_write_u8(&c->c2.buf, OCC_MTU_LOAD))
             {
                 break;
             }
             need_to_add = min_int(c->c2.occ_mtu_load_size, EXPANDED_SIZE(&c->c2.frame))
                           - OCC_STRING_SIZE
                           - sizeof(uint8_t)
                           - EXTRA_FRAME(&c->c2.frame);
 
             while (need_to_add > 0)
             {
                 /*
                  * Fill the load test packet with pseudo-random bytes.
                  */
                 if (!buf_write_u8(&c->c2.buf, get_random() & 0xFF))
                 {
                     break;
                 }
                 --need_to_add;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_LOAD min_int(%d-%d-%d-%d,%d) size=%d",
                  c->c2.occ_mtu_load_size,
                  OCC_STRING_SIZE,
                  (int) sizeof(uint8_t),
                  EXTRA_FRAME(&c->c2.frame),
                  MAX_RW_SIZE_TUN(&c->c2.frame),
                  BLEN(&c->c2.buf));
             doit = true;
         }
         break;
 
         case OCC_EXIT:
             if (!buf_write_u8(&c->c2.buf, OCC_EXIT))
             {
                 break;
             }
             dmsg(D_PACKET_CONTENT, "SENT OCC_EXIT");
             doit = true;
             break;

     }
 

     if (doit)

     {

         /*
          * We will treat the packet like any other outgoing packet,
          * compress, encrypt, sign, etc.
          */
         encrypt_sign(c, true);

     }
 

     c->c2.occ_op = -1;

 }
 
 void

 process_received_occ_msg(struct context *c)

 {

     ASSERT(buf_advance(&c->c2.buf, OCC_STRING_SIZE));
     switch (buf_read_u8(&c->c2.buf))

     {

         case OCC_REQUEST:
             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_REQUEST");
             c->c2.occ_op = OCC_REPLY;
             break;
 
         case OCC_MTU_REQUEST:
             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_MTU_REQUEST");
             c->c2.occ_op = OCC_MTU_REPLY;
             break;
 
         case OCC_MTU_LOAD_REQUEST:
             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_MTU_LOAD_REQUEST");
             c->c2.occ_mtu_load_size = buf_read_u16(&c->c2.buf);
             if (c->c2.occ_mtu_load_size >= 0)
             {
                 c->c2.occ_op = OCC_MTU_LOAD;
             }
             break;
 
         case OCC_REPLY:
             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_REPLY");
             if (c->options.occ && !TLS_MODE(c) && c->c2.options_string_remote)
             {
                 if (!options_cmp_equal_safe((char *) BPTR(&c->c2.buf),
                                             c->c2.options_string_remote,
                                             c->c2.buf.len))
                 {
                     options_warning_safe((char *) BPTR(&c->c2.buf),
                                          c->c2.options_string_remote,
                                          c->c2.buf.len);
                 }
             }
             event_timeout_clear(&c->c2.occ_interval);
             break;
 
         case OCC_MTU_REPLY:
             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_MTU_REPLY");
             c->c2.max_recv_size_remote = buf_read_u16(&c->c2.buf);
             c->c2.max_send_size_remote = buf_read_u16(&c->c2.buf);
             if (c->options.mtu_test
                 && c->c2.max_recv_size_remote > 0
                 && c->c2.max_send_size_remote > 0)
             {
                 msg(M_INFO, "NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[%d,%d] remote->local=[%d,%d]",
                     c->c2.max_send_size_local,
                     c->c2.max_recv_size_remote,
                     c->c2.max_send_size_remote,
                     c->c2.max_recv_size_local);
                 if (!c->options.ce.fragment
                     && (proto_is_dgram(c->options.ce.proto))
                     && c->c2.max_send_size_local > TUN_MTU_MIN
                     && (c->c2.max_recv_size_remote < c->c2.max_send_size_local
                         || c->c2.max_recv_size_local < c->c2.max_send_size_remote))
                 {
                     msg(M_INFO, "NOTE: This connection is unable to accommodate a UDP packet size of %d. Consider using --fragment or --mssfix options as a workaround.",
                         c->c2.max_send_size_local);
                 }
             }
             event_timeout_clear(&c->c2.occ_mtu_load_test_interval);
             break;
 
         case OCC_EXIT:
             dmsg(D_PACKET_CONTENT, "RECEIVED OCC_EXIT");
             c->sig->signal_received = SIGTERM;
             c->sig->signal_text = "remote-exit";
             break;

     }

     c->c2.buf.len = 0; /* don't pass packet on */

 }
 

 #else  /* ifdef ENABLE_OCC */
 static void

 dummy(void)
 {

 }
 #endif /* ifdef ENABLE_OCC */