/*
* OpenVPN -- An application to securely tunnel IP networks
* over a single TCP/UDP port, with support for SSL/TLS-based
* session authentication and key exchange,
* packet encryption, packet authentication, and
* packet compression.
*
* Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#ifdef HAVE_CONFIG_H
#include "config.h"
#elif defined(_MSC_VER)
#include "config-msvc.h"
#endif
#include "syshead.h"
#ifdef ENABLE_OCC
#include "occ.h"
#include "memdbg.h"
#include "forward-inline.h"
#include "occ-inline.h"
/*
* This random string identifies an OpenVPN
* Configuration Control packet.
* It should be of sufficient length and randomness
* so as not to collide with other tunnel data.
*
* The OCC protocol is as follows:
*
* occ_magic -- (16 octets)
*
* type [OCC_REQUEST | OCC_REPLY] (1 octet)
* null terminated options string if OCC_REPLY (variable)
*
* When encryption is used, the OCC packet
* is encapsulated within the encrypted
* envelope.
*
* OCC_STRING_SIZE must be set to sizeof (occ_magic)
*/
const uint8_t occ_magic[] = {
0x28, 0x7f, 0x34, 0x6b, 0xd4, 0xef, 0x7a, 0x81,
0x2d, 0x56, 0xb8, 0xd3, 0xaf, 0xc5, 0x45, 0x9c
};
static const struct mtu_load_test mtu_load_test_sequence[] = {
{OCC_MTU_LOAD_REQUEST, -1000},
{OCC_MTU_LOAD, -1000},
{OCC_MTU_LOAD_REQUEST, -1000},
{OCC_MTU_LOAD, -1000},
{OCC_MTU_LOAD_REQUEST, -1000},
{OCC_MTU_LOAD, -1000},
{OCC_MTU_LOAD_REQUEST, -750},
{OCC_MTU_LOAD, -750},
{OCC_MTU_LOAD_REQUEST, -750},
{OCC_MTU_LOAD, -750},
{OCC_MTU_LOAD_REQUEST, -750},
{OCC_MTU_LOAD, -750},
{OCC_MTU_LOAD_REQUEST, -500},
{OCC_MTU_LOAD, -500},
{OCC_MTU_LOAD_REQUEST, -500},
{OCC_MTU_LOAD, -500},
{OCC_MTU_LOAD_REQUEST, -500},
{OCC_MTU_LOAD, -500},
{OCC_MTU_LOAD_REQUEST, -400},
{OCC_MTU_LOAD, -400},
{OCC_MTU_LOAD_REQUEST, -400},
{OCC_MTU_LOAD, -400},
{OCC_MTU_LOAD_REQUEST, -400},
{OCC_MTU_LOAD, -400},
{OCC_MTU_LOAD_REQUEST, -300},
{OCC_MTU_LOAD, -300},
{OCC_MTU_LOAD_REQUEST, -300},
{OCC_MTU_LOAD, -300},
{OCC_MTU_LOAD_REQUEST, -300},
{OCC_MTU_LOAD, -300},
{OCC_MTU_LOAD_REQUEST, -200},
{OCC_MTU_LOAD, -200},
{OCC_MTU_LOAD_REQUEST, -200},
{OCC_MTU_LOAD, -200},
{OCC_MTU_LOAD_REQUEST, -200},
{OCC_MTU_LOAD, -200},
{OCC_MTU_LOAD_REQUEST, -150},
{OCC_MTU_LOAD, -150},
{OCC_MTU_LOAD_REQUEST, -150},
{OCC_MTU_LOAD, -150},
{OCC_MTU_LOAD_REQUEST, -150},
{OCC_MTU_LOAD, -150},
{OCC_MTU_LOAD_REQUEST, -100},
{OCC_MTU_LOAD, -100},
{OCC_MTU_LOAD_REQUEST, -100},
{OCC_MTU_LOAD, -100},
{OCC_MTU_LOAD_REQUEST, -100},
{OCC_MTU_LOAD, -100},
{OCC_MTU_LOAD_REQUEST, -50},
{OCC_MTU_LOAD, -50},
{OCC_MTU_LOAD_REQUEST, -50},
{OCC_MTU_LOAD, -50},
{OCC_MTU_LOAD_REQUEST, -50},
{OCC_MTU_LOAD, -50},
{OCC_MTU_LOAD_REQUEST, 0},
{OCC_MTU_LOAD, 0},
{OCC_MTU_LOAD_REQUEST, 0},
{OCC_MTU_LOAD, 0},
{OCC_MTU_LOAD_REQUEST, 0},
{OCC_MTU_LOAD, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{OCC_MTU_REQUEST, 0},
{-1, 0}
};
void
check_send_occ_req_dowork(struct context *c)
{
if (++c->c2.occ_n_tries >= OCC_N_TRIES)
{
if (c->options.ce.remote)
{
/*
* No OCC_REPLY from peer after repeated attempts.
* Give up.
*/
msg(D_SHOW_OCC,
"NOTE: failed to obtain options consistency info from peer -- "
"this could occur if the remote peer is running a version of "
PACKAGE_NAME
" before 1.5-beta8 or if there is a network connectivity problem, and will not necessarily prevent "
PACKAGE_NAME
" from running (" counter_format " bytes received from peer, " counter_format
" bytes authenticated data channel traffic) -- you can disable the options consistency "
"check with --disable-occ.",
c->c2.link_read_bytes,
c->c2.link_read_bytes_auth);
}
event_timeout_clear(&c->c2.occ_interval);
}
else
{
c->c2.occ_op = OCC_REQUEST;
/*
* If we don't hear back from peer, send another
* OCC_REQUEST in OCC_INTERVAL_SECONDS.
*/
event_timeout_reset(&c->c2.occ_interval);
}
}
void
check_send_occ_load_test_dowork(struct context *c)
{
if (CONNECTION_ESTABLISHED(c))
{
const struct mtu_load_test *entry;
if (!c->c2.occ_mtu_load_n_tries)
{
msg(M_INFO,
"NOTE: Beginning empirical MTU test -- results should be available in 3 to 4 minutes.");
}
entry = &mtu_load_test_sequence[c->c2.occ_mtu_load_n_tries++];
if (entry->op >= 0)
{
c->c2.occ_op = entry->op;
c->c2.occ_mtu_load_size =
EXPANDED_SIZE(&c->c2.frame) + entry->delta;
}
else
{
msg(M_INFO,
"NOTE: failed to empirically measure MTU (requires " PACKAGE_NAME " 1.5 or higher at other end of connection).");
event_timeout_clear(&c->c2.occ_mtu_load_test_interval);
c->c2.occ_mtu_load_n_tries = 0;
}
}
}
void
check_send_occ_msg_dowork(struct context *c)
{
bool doit = false;
c->c2.buf = c->c2.buffers->aux_buf;
ASSERT(buf_init(&c->c2.buf, FRAME_HEADROOM(&c->c2.frame)));
ASSERT(buf_safe(&c->c2.buf, MAX_RW_SIZE_TUN(&c->c2.frame)));
ASSERT(buf_write(&c->c2.buf, occ_magic, OCC_STRING_SIZE));
switch (c->c2.occ_op)
{
case OCC_REQUEST:
if (!buf_write_u8(&c->c2.buf, OCC_REQUEST))
{
break;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_REQUEST");
doit = true;
break;
case OCC_REPLY:
if (!c->c2.options_string_local)
{
break;
}
if (!buf_write_u8(&c->c2.buf, OCC_REPLY))
{
break;
}
if (!buf_write(&c->c2.buf, c->c2.options_string_local,
strlen(c->c2.options_string_local) + 1))
{
break;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_REPLY");
doit = true;
break;
case OCC_MTU_REQUEST:
if (!buf_write_u8(&c->c2.buf, OCC_MTU_REQUEST))
{
break;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_REQUEST");
doit = true;
break;
case OCC_MTU_REPLY:
if (!buf_write_u8(&c->c2.buf, OCC_MTU_REPLY))
{
break;
}
if (!buf_write_u16(&c->c2.buf, c->c2.max_recv_size_local))
{
break;
}
if (!buf_write_u16(&c->c2.buf, c->c2.max_send_size_local))
{
break;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_REPLY");
doit = true;
break;
case OCC_MTU_LOAD_REQUEST:
if (!buf_write_u8(&c->c2.buf, OCC_MTU_LOAD_REQUEST))
{
break;
}
if (!buf_write_u16(&c->c2.buf, c->c2.occ_mtu_load_size))
{
break;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_LOAD_REQUEST");
doit = true;
break;
case OCC_MTU_LOAD:
{
int need_to_add;
if (!buf_write_u8(&c->c2.buf, OCC_MTU_LOAD))
{
break;
}
need_to_add = min_int(c->c2.occ_mtu_load_size, EXPANDED_SIZE(&c->c2.frame))
- OCC_STRING_SIZE
- sizeof(uint8_t)
- EXTRA_FRAME(&c->c2.frame);
while (need_to_add > 0)
{
/*
* Fill the load test packet with pseudo-random bytes.
*/
if (!buf_write_u8(&c->c2.buf, get_random() & 0xFF))
{
break;
}
--need_to_add;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_MTU_LOAD min_int(%d-%d-%d-%d,%d) size=%d",
c->c2.occ_mtu_load_size,
OCC_STRING_SIZE,
(int) sizeof(uint8_t),
EXTRA_FRAME(&c->c2.frame),
MAX_RW_SIZE_TUN(&c->c2.frame),
BLEN(&c->c2.buf));
doit = true;
}
break;
case OCC_EXIT:
if (!buf_write_u8(&c->c2.buf, OCC_EXIT))
{
break;
}
dmsg(D_PACKET_CONTENT, "SENT OCC_EXIT");
doit = true;
break;
}
if (doit)
{
/*
* We will treat the packet like any other outgoing packet,
* compress, encrypt, sign, etc.
*/
encrypt_sign(c, true);
}
c->c2.occ_op = -1;
}
void
process_received_occ_msg(struct context *c)
{
ASSERT(buf_advance(&c->c2.buf, OCC_STRING_SIZE));
switch (buf_read_u8(&c->c2.buf))
{
case OCC_REQUEST:
dmsg(D_PACKET_CONTENT, "RECEIVED OCC_REQUEST");
c->c2.occ_op = OCC_REPLY;
break;
case OCC_MTU_REQUEST:
dmsg(D_PACKET_CONTENT, "RECEIVED OCC_MTU_REQUEST");
c->c2.occ_op = OCC_MTU_REPLY;
break;
case OCC_MTU_LOAD_REQUEST:
dmsg(D_PACKET_CONTENT, "RECEIVED OCC_MTU_LOAD_REQUEST");
c->c2.occ_mtu_load_size = buf_read_u16(&c->c2.buf);
if (c->c2.occ_mtu_load_size >= 0)
{
c->c2.occ_op = OCC_MTU_LOAD;
}
break;
case OCC_REPLY:
dmsg(D_PACKET_CONTENT, "RECEIVED OCC_REPLY");
if (c->options.occ && !TLS_MODE(c) && c->c2.options_string_remote)
{
if (!options_cmp_equal_safe((char *) BPTR(&c->c2.buf),
c->c2.options_string_remote,
c->c2.buf.len))
{
options_warning_safe((char *) BPTR(&c->c2.buf),
c->c2.options_string_remote,
c->c2.buf.len);
}
}
event_timeout_clear(&c->c2.occ_interval);
break;
case OCC_MTU_REPLY:
dmsg(D_PACKET_CONTENT, "RECEIVED OCC_MTU_REPLY");
c->c2.max_recv_size_remote = buf_read_u16(&c->c2.buf);
c->c2.max_send_size_remote = buf_read_u16(&c->c2.buf);
if (c->options.mtu_test
&& c->c2.max_recv_size_remote > 0
&& c->c2.max_send_size_remote > 0)
{
msg(M_INFO, "NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[%d,%d] remote->local=[%d,%d]",
c->c2.max_send_size_local,
c->c2.max_recv_size_remote,
c->c2.max_send_size_remote,
c->c2.max_recv_size_local);
if (!c->options.ce.fragment
&& (proto_is_dgram(c->options.ce.proto))
&& c->c2.max_send_size_local > TUN_MTU_MIN
&& (c->c2.max_recv_size_remote < c->c2.max_send_size_local
|| c->c2.max_recv_size_local < c->c2.max_send_size_remote))
{
msg(M_INFO, "NOTE: This connection is unable to accommodate a UDP packet size of %d. Consider using --fragment or --mssfix options as a workaround.",
c->c2.max_send_size_local);
}
}
event_timeout_clear(&c->c2.occ_mtu_load_test_interval);
break;
case OCC_EXIT:
dmsg(D_PACKET_CONTENT, "RECEIVED OCC_EXIT");
c->sig->signal_received = SIGTERM;
c->sig->signal_text = "remote-exit";
break;
}
c->c2.buf.len = 0; /* don't pass packet on */
}
#else /* ifdef ENABLE_OCC */
static void
dummy(void)
{
}
#endif /* ifdef ENABLE_OCC */