/*
  *  OpenVPN -- An application to securely tunnel IP networks
  *             over a single TCP/UDP port, with support for SSL/TLS-based
  *             session authentication and key exchange,
  *             packet encryption, packet authentication, and
  *             packet compression.
  *

  *  Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>

  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
  *  as published by the Free Software Foundation.
  *
  *  This program is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
  *

  *  You should have received a copy of the GNU General Public License along
  *  with this program; if not, write to the Free Software Foundation, Inc.,
  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

  */
 
 #ifndef PROTO_H
 #define PROTO_H
 

 #include "common.h"

 #include "buffer.h"
 

 #pragma pack(1)
 

 /*
  * Tunnel types
  */
 #define DEV_TYPE_UNDEF 0
 #define DEV_TYPE_NULL  1
 #define DEV_TYPE_TUN   2    /* point-to-point IP tunnel */
 #define DEV_TYPE_TAP   3    /* ethernet (802.3) tunnel */
 

 /* TUN topologies */
 
 #define TOP_UNDEF   0
 #define TOP_NET30   1
 #define TOP_P2P     2
 #define TOP_SUBNET  3
 

 /*
  * IP and Ethernet protocol structs.  For portability,
  * OpenVPN needs its own definitions of these structs, and
  * names have been adjusted to avoid collisions with
  * native structs.
  */
 
 #define OPENVPN_ETH_ALEN 6            /* ethernet address length */

 struct openvpn_ethhdr

 {

     uint8_t dest[OPENVPN_ETH_ALEN];   /* destination ethernet addr */
     uint8_t source[OPENVPN_ETH_ALEN]; /* source ethernet addr   */

 #define OPENVPN_ETH_P_IPV4   0x0800   /* IPv4 protocol */
 #define OPENVPN_ETH_P_IPV6   0x86DD   /* IPv6 protocol */
 #define OPENVPN_ETH_P_ARP    0x0806   /* ARP protocol */
     uint16_t proto;                   /* packet type ID field */

 };
 

 struct openvpn_arp {

 #define ARP_MAC_ADDR_TYPE 0x0001
     uint16_t mac_addr_type;     /* 0x0001 */

     uint16_t proto_addr_type;   /* 0x0800 */
     uint8_t mac_addr_size;      /* 0x06 */
     uint8_t proto_addr_size;    /* 0x04 */

 #define ARP_REQUEST 0x0001
 #define ARP_REPLY   0x0002
     uint16_t arp_command;       /* 0x0001 for ARP request, 0x0002 for ARP reply */

     uint8_t mac_src[OPENVPN_ETH_ALEN];
     in_addr_t ip_src;
     uint8_t mac_dest[OPENVPN_ETH_ALEN];
     in_addr_t ip_dest;

 };
 

 struct openvpn_iphdr {

 #define OPENVPN_IPH_GET_VER(v) (((v) >> 4) & 0x0F)
 #define OPENVPN_IPH_GET_LEN(v) (((v) & 0x0F) << 2)
     uint8_t version_len;

     uint8_t tos;
     uint16_t tot_len;
     uint16_t id;

 #define OPENVPN_IP_OFFMASK 0x1fff
     uint16_t frag_off;

     uint8_t ttl;

 #define OPENVPN_IPPROTO_IGMP    2  /* IGMP protocol */
 #define OPENVPN_IPPROTO_TCP     6  /* TCP protocol */
 #define OPENVPN_IPPROTO_UDP    17  /* UDP protocol */
 #define OPENVPN_IPPROTO_ICMPV6 58 /* ICMPV6 protocol */

     uint8_t protocol;

     uint16_t check;
     uint32_t saddr;
     uint32_t daddr;
     /*The options start here. */

 };
 
 /*

  * IPv6 header
  */
 struct openvpn_ipv6hdr {

     uint8_t version_prio;
     uint8_t flow_lbl[3];
     uint16_t payload_len;
     uint8_t nexthdr;
     uint8_t hop_limit;
 
     struct  in6_addr saddr;
     struct  in6_addr daddr;

 };
 

 /*
  * ICMPv6 header
  */
 struct openvpn_icmp6hdr {
 #define OPENVPN_ICMP6_DESTINATION_UNREACHABLE       1
 #define OPENVPN_ND_ROUTER_SOLICIT                 133
 #define OPENVPN_ND_ROUTER_ADVERT                  134
 #define OPENVPN_ND_NEIGHBOR_SOLICIT               135
 #define OPENVPN_ND_NEIGHBOR_ADVERT                136
 #define OPENVPN_ND_INVERSE_SOLICIT                141
 #define OPENVPN_ND_INVERSE_ADVERT                 142
     uint8_t icmp6_type;
 #define OPENVPN_ICMP6_DU_NOROUTE                    0
 #define OPENVPN_ICMP6_DU_COMMUNICATION_PROHIBTED    1
     uint8_t icmp6_code;
     uint16_t icmp6_cksum;
     uint8_t icmp6_dataun[4];
 };

 
 /*

  * UDP header
  */
 struct openvpn_udphdr {

     uint16_t source;
     uint16_t dest;
     uint16_t len;
     uint16_t check;

 };
 
 /*
  * TCP header, per RFC 793.
  */
 struct openvpn_tcphdr {

     uint16_t source;       /* source port */
     uint16_t dest;         /* destination port */
     uint32_t seq;          /* sequence number */
     uint32_t ack_seq;      /* acknowledgement number */
 
 #define OPENVPN_TCPH_GET_DOFF(d) (((d) & 0xF0) >> 2)
     uint8_t doff_res;
 
 #define OPENVPN_TCPH_FIN_MASK (1<<0)
 #define OPENVPN_TCPH_SYN_MASK (1<<1)
 #define OPENVPN_TCPH_RST_MASK (1<<2)
 #define OPENVPN_TCPH_PSH_MASK (1<<3)
 #define OPENVPN_TCPH_ACK_MASK (1<<4)
 #define OPENVPN_TCPH_URG_MASK (1<<5)
 #define OPENVPN_TCPH_ECE_MASK (1<<6)
 #define OPENVPN_TCPH_CWR_MASK (1<<7)
     uint8_t flags;
 
     uint16_t window;
     uint16_t check;
     uint16_t urg_ptr;

 };
 

 #define OPENVPN_TCPOPT_EOL     0
 #define OPENVPN_TCPOPT_NOP     1
 #define OPENVPN_TCPOPT_MAXSEG  2

 #define OPENVPN_TCPOLEN_MAXSEG 4
 

 struct ip_tcp_udp_hdr {

     struct openvpn_iphdr ip;
     union {
         struct openvpn_tcphdr tcp;
         struct openvpn_udphdr udp;
     } u;

 };
 

 #pragma pack()
 

 /*
  * The following macro is used to update an
  * internet checksum.  "acc" is a 32-bit
  * accumulation of all the changes to the
  * checksum (adding in old 16-bit words and
  * subtracting out new words), and "cksum"
  * is the checksum value to be updated.
  */
 #define ADJUST_CHECKSUM(acc, cksum) { \

         int _acc = acc; \
         _acc += (cksum); \
         if (_acc < 0) { \
             _acc = -_acc; \
             _acc = (_acc >> 16) + (_acc & 0xffff); \
             _acc += _acc >> 16; \
             (cksum) = (uint16_t) ~_acc; \
         } else { \
             _acc = (_acc >> 16) + (_acc & 0xffff); \
             _acc += _acc >> 16; \
             (cksum) = (uint16_t) _acc; \
         } \

 }
 

 #define ADD_CHECKSUM_32(acc, u32) { \

         acc += (u32) & 0xffff; \
         acc += (u32) >> 16;    \

 }
 
 #define SUB_CHECKSUM_32(acc, u32) { \

         acc -= (u32) & 0xffff; \
         acc -= (u32) >> 16;    \

 }
 

 /*
  * We are in a "liberal" position with respect to MSS,
  * i.e. we assume that MSS can be calculated from MTU
  * by subtracting out only the IP and TCP header sizes
  * without options.
  *
  * (RFC 879, section 7).
  */
 #define MTU_TO_MSS(mtu) (mtu - sizeof(struct openvpn_iphdr) \

                          - sizeof(struct openvpn_tcphdr))

 
 /*

  * This returns an ip protocol version of packet inside tun
  * and offset of IP header (via parameter).
  */

 inline static int
 get_tun_ip_ver(int tunnel_type, struct buffer *buf, int *ip_hdr_offset)

 {

     int ip_ver = -1;

     /* for tun get ip version from ip header */
     if (tunnel_type == DEV_TYPE_TUN)

     {

         *ip_hdr_offset = 0;
         if (likely(BLEN(buf) >= (int) sizeof(struct openvpn_iphdr)))
         {
             ip_ver = OPENVPN_IPH_GET_VER(*BPTR(buf));
         }

     }

     else if (tunnel_type == DEV_TYPE_TAP)

     {

         *ip_hdr_offset = (int)(sizeof(struct openvpn_ethhdr));
         /* for tap get ip version from eth header */
         if (likely(BLEN(buf) >= *ip_hdr_offset))
         {
             const struct openvpn_ethhdr *eh = (const struct openvpn_ethhdr *) BPTR(buf);
             uint16_t proto = ntohs(eh->proto);
             if (proto == OPENVPN_ETH_P_IPV6)
             {
                 ip_ver = 6;
             }
             else if (proto == OPENVPN_ETH_P_IPV4)
             {
                 ip_ver = 4;
             }
         }

     }
 

     return ip_ver;

 }
 
 /*

  * If raw tunnel packet is IPv4 or IPv6, return true and increment

  * buffer offset to start of IP header.
  */

 bool is_ipv4(int tunnel_type, struct buffer *buf);
 
 bool is_ipv6(int tunnel_type, struct buffer *buf);

 /**
  *  Calculates an IP or IPv6 checksum with a pseudo header as required by
  *  TCP, UDP and ICMPv6
  *
  * @param af            - Address family for which the checksum is calculated
  *                        AF_INET or AF_INET6
  * @param payload       - the TCP, ICMPv6 or UDP packet
  * @param len_payload   - length of payload
  * @param src_addr      - Source address of the packet
  * @param dest_addr     - Destination address of the packet
  * @param proto next    - header or IP protocol of the packet
  * @return The calculated checksum in host order
  */
 uint16_t
 ip_checksum(const sa_family_t af, const uint8_t *payload, const int len_payload,
             const uint8_t *src_addr, const uint8_t *dest_addr,  const int proto);
 

 #ifdef PACKET_TRUNCATION_CHECK

 void ipv4_packet_size_verify(const uint8_t *data,
                              const int size,
                              const int tunnel_type,
                              const char
                              *prefix,
                              counter_type *errors);

 #endif

 
 #endif /* ifndef PROTO_H */