/*
* OpenVPN -- An application to securely tunnel IP networks
* over a single UDP port, with support for SSL/TLS-based
* session authentication and key exchange,
* packet encryption, packet authentication, and
* packet compression.
*
* Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#ifdef HAVE_CONFIG_H
#include "config.h"
#elif defined(_MSC_VER)
#include "config-msvc.h"
#endif
#include "syshead.h"
#if PORT_SHARE
#include "event.h"
#include "socket.h"
#include "fdmisc.h"
#include "crypto.h"
#include "ps.h"
#include "memdbg.h"
struct port_share *port_share = NULL; /* GLOBAL */
/* size of i/o buffers */
#define PROXY_CONNECTION_BUFFER_SIZE 1500
/* Command codes for foreground -> background communication */
#define COMMAND_REDIRECT 10
#define COMMAND_EXIT 11
/* Response codes for background -> foreground communication */
#define RESPONSE_INIT_SUCCEEDED 20
#define RESPONSE_INIT_FAILED 21
/*
* Return values for proxy_connection_io functions
*/
#define IOSTAT_EAGAIN_ON_READ 0 /* recv returned EAGAIN */
#define IOSTAT_EAGAIN_ON_WRITE 1 /* send returned EAGAIN */
#define IOSTAT_READ_ERROR 2 /* the other end of our read socket (pc) was closed */
#define IOSTAT_WRITE_ERROR 3 /* the other end of our write socket (pc->counterpart) was closed */
#define IOSTAT_GOOD 4 /* nothing to report */
/*
* A foreign (non-OpenVPN) connection we are proxying,
* usually HTTPS
*/
struct proxy_connection {
bool defined;
struct proxy_connection *next;
struct proxy_connection *counterpart;
struct buffer buf;
bool buffer_initial;
int rwflags;
int sd;
char *jfn;
};
#if 0
static const char *
headc(const struct buffer *buf)
{
static char foo[16];
strncpy(foo, BSTR(buf), 15);
foo[15] = 0;
return foo;
}
#endif
static inline void
close_socket_if_defined(const socket_descriptor_t sd)
{
if (socket_defined(sd))
{
openvpn_close_socket(sd);
}
}
/*
* Close most of parent's fds.
* Keep stdin/stdout/stderr, plus one
* other fd which is presumed to be
* our pipe back to parent.
* Admittedly, a bit of a kludge,
* but posix doesn't give us a kind
* of FD_CLOEXEC which will stop
* fds from crossing a fork().
*/
static void
close_fds_except(int keep)
{
socket_descriptor_t i;
closelog();
for (i = 3; i <= 100; ++i)
{
if (i != keep)
{
openvpn_close_socket(i);
}
}
}
/*
* Usually we ignore signals, because our parent will
* deal with them.
*/
static void
set_signals(void)
{
signal(SIGTERM, SIG_DFL);
signal(SIGINT, SIG_IGN);
signal(SIGHUP, SIG_IGN);
signal(SIGUSR1, SIG_IGN);
signal(SIGUSR2, SIG_IGN);
signal(SIGPIPE, SIG_IGN);
}
/*
* Socket read/write functions.
*/
static int
recv_control(const socket_descriptor_t fd)
{
unsigned char c;
const ssize_t size = read(fd, &c, sizeof(c));
if (size == sizeof(c))
{
return c;
}
else
{
return -1;
}
}
static int
send_control(const socket_descriptor_t fd, int code)
{
unsigned char c = (unsigned char) code;
const ssize_t size = write(fd, &c, sizeof(c));
if (size == sizeof(c))
{
return (int) size;
}
else
{
return -1;
}
}
static int
cmsg_size(void)
{
return CMSG_SPACE(sizeof(socket_descriptor_t));
}
/*
* Send a command (char), data (head), and a file descriptor (sd_send) to a local process
* over unix socket sd. Unfortunately, there's no portable way to send file descriptors
* to other processes, so this code, as well as its analog (control_message_from_parent below),
* is Linux-specific. This function runs in the context of the main process and is used to
* send commands, data, and file descriptors to the background process.
*/
static void
port_share_sendmsg(const socket_descriptor_t sd,
const char command,
const struct buffer *head,
const socket_descriptor_t sd_send)
{
if (socket_defined(sd))
{
struct msghdr mesg;
struct cmsghdr *h;
struct iovec iov[2];
socket_descriptor_t sd_null[2] = { SOCKET_UNDEFINED, SOCKET_UNDEFINED };
char cmd;
ssize_t status;
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE: sendmsg sd=%d len=%d",
(int)sd_send,
head ? BLEN(head) : -1);
CLEAR(mesg);
cmd = command;
iov[0].iov_base = &cmd;
iov[0].iov_len = sizeof(cmd);
mesg.msg_iovlen = 1;
if (head)
{
iov[1].iov_base = BPTR(head);
iov[1].iov_len = BLEN(head);
mesg.msg_iovlen = 2;
}
mesg.msg_iov = iov;
mesg.msg_controllen = cmsg_size();
mesg.msg_control = (char *) malloc(mesg.msg_controllen);
check_malloc_return(mesg.msg_control);
mesg.msg_flags = 0;
h = CMSG_FIRSTHDR(&mesg);
h->cmsg_level = SOL_SOCKET;
h->cmsg_type = SCM_RIGHTS;
h->cmsg_len = CMSG_LEN(sizeof(socket_descriptor_t));
if (socket_defined(sd_send))
{
memcpy(CMSG_DATA(h), &sd_send, sizeof(sd_send));
}
else
{
socketpair(PF_UNIX, SOCK_DGRAM, 0, sd_null);
memcpy(CMSG_DATA(h), &sd_null[0], sizeof(sd_null[0]));
}
status = sendmsg(sd, &mesg, MSG_NOSIGNAL);
if (status == -1)
{
msg(M_WARN|M_ERRNO, "PORT SHARE: sendmsg failed -- unable to communicate with background process (%d,%d,%d,%d)",
sd, sd_send, sd_null[0], sd_null[1]
);
}
close_socket_if_defined(sd_null[0]);
close_socket_if_defined(sd_null[1]);
free(mesg.msg_control);
}
}
static void
proxy_entry_close_sd(struct proxy_connection *pc, struct event_set *es)
{
if (pc->defined && socket_defined(pc->sd))
{
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: delete sd=%d", (int)pc->sd);
if (es)
{
event_del(es, pc->sd);
}
openvpn_close_socket(pc->sd);
pc->sd = SOCKET_UNDEFINED;
}
}
/*
* Mark a proxy entry and its counterpart for close.
*/
static void
proxy_entry_mark_for_close(struct proxy_connection *pc, struct event_set *es)
{
if (pc->defined)
{
struct proxy_connection *cp = pc->counterpart;
proxy_entry_close_sd(pc, es);
free_buf(&pc->buf);
pc->buffer_initial = false;
pc->rwflags = 0;
pc->defined = false;
if (pc->jfn)
{
unlink(pc->jfn);
free(pc->jfn);
pc->jfn = NULL;
}
if (cp && cp->defined && cp->counterpart == pc)
{
proxy_entry_mark_for_close(cp, es);
}
}
}
/*
* Run through the proxy entry list and delete all entries marked
* for close.
*/
static void
proxy_list_housekeeping(struct proxy_connection **list)
{
if (list)
{
struct proxy_connection *prev = NULL;
struct proxy_connection *pc = *list;
while (pc)
{
struct proxy_connection *next = pc->next;
if (!pc->defined)
{
free(pc);
if (prev)
{
prev->next = next;
}
else
{
*list = next;
}
}
else
{
prev = pc;
}
pc = next;
}
}
}
/*
* Record IP/port of client in filesystem, so that server receiving
* the proxy can determine true client origin.
*/
static void
journal_add(const char *journal_dir, struct proxy_connection *pc, struct proxy_connection *cp)
{
struct gc_arena gc = gc_new();
struct openvpn_sockaddr from, to;
socklen_t slen, dlen;
int fnlen;
char *jfn;
int fd;
slen = sizeof(from.addr.sa);
dlen = sizeof(to.addr.sa);
if (!getpeername(pc->sd, (struct sockaddr *) &from.addr.sa, &slen)
&& !getsockname(cp->sd, (struct sockaddr *) &to.addr.sa, &dlen))
{
const char *f = print_openvpn_sockaddr(&from, &gc);
const char *t = print_openvpn_sockaddr(&to, &gc);
fnlen = strlen(journal_dir) + strlen(t) + 2;
jfn = (char *) malloc(fnlen);
check_malloc_return(jfn);
openvpn_snprintf(jfn, fnlen, "%s/%s", journal_dir, t);
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: client origin %s -> %s", jfn, f);
fd = platform_open(jfn, O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR | S_IRGRP);
if (fd != -1)
{
if (write(fd, f, strlen(f)) != strlen(f))
{
msg(M_WARN, "PORT SHARE: writing to journal file (%s) failed", jfn);
}
close(fd);
cp->jfn = jfn;
}
else
{
msg(M_WARN|M_ERRNO, "PORT SHARE: unable to write journal file in %s", jfn);
free(jfn);
}
}
gc_free(&gc);
}
/*
* Cleanup function, on proxy process exit.
*/
static void
proxy_list_close(struct proxy_connection **list)
{
if (list)
{
struct proxy_connection *pc = *list;
while (pc)
{
proxy_entry_mark_for_close(pc, NULL);
pc = pc->next;
}
proxy_list_housekeeping(list);
}
}
static inline void
proxy_connection_io_requeue(struct proxy_connection *pc, const int rwflags_new, struct event_set *es)
{
if (socket_defined(pc->sd) && pc->rwflags != rwflags_new)
{
/*dmsg (D_PS_PROXY_DEBUG, "PORT SHARE PROXY: requeue[%d] rwflags=%d", (int)pc->sd, rwflags_new);*/
event_ctl(es, pc->sd, rwflags_new, (void *)pc);
pc->rwflags = rwflags_new;
}
}
/*
* Create a new pair of proxy_connection entries, one for each
* socket file descriptor involved in the proxy. We are given
* the client fd, and we should derive our own server fd by connecting
* to the server given by server_addr/server_port. Return true
* on success and false on failure to connect to server.
*/
static bool
proxy_entry_new(struct proxy_connection **list,
struct event_set *es,
const struct sockaddr_in server_addr,
const socket_descriptor_t sd_client,
struct buffer *initial_data,
const char *journal_dir)
{
socket_descriptor_t sd_server;
int status;
struct proxy_connection *pc;
struct proxy_connection *cp;
/* connect to port share server */
if ((sd_server = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
{
msg(M_WARN|M_ERRNO, "PORT SHARE PROXY: cannot create socket");
return false;
}
status = openvpn_connect(sd_server,(const struct sockaddr *) &server_addr, 5, NULL);
if (status)
{
msg(M_WARN, "PORT SHARE PROXY: connect to port-share server failed");
openvpn_close_socket(sd_server);
return false;
}
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: connect to port-share server succeeded");
set_nonblock(sd_client);
set_nonblock(sd_server);
/* allocate 2 new proxy_connection objects */
ALLOC_OBJ_CLEAR(pc, struct proxy_connection);
ALLOC_OBJ_CLEAR(cp, struct proxy_connection);
/* client object */
pc->defined = true;
pc->next = cp;
pc->counterpart = cp;
pc->buf = *initial_data;
pc->buffer_initial = true;
pc->rwflags = EVENT_UNDEF;
pc->sd = sd_client;
/* server object */
cp->defined = true;
cp->next = *list;
cp->counterpart = pc;
cp->buf = alloc_buf(PROXY_CONNECTION_BUFFER_SIZE);
cp->buffer_initial = false;
cp->rwflags = EVENT_UNDEF;
cp->sd = sd_server;
/* add to list */
*list = pc;
/* add journal entry */
if (journal_dir)
{
journal_add(journal_dir, pc, cp);
}
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: NEW CONNECTION [c=%d s=%d]", (int)sd_client, (int)sd_server);
/* set initial i/o states */
proxy_connection_io_requeue(pc, EVENT_READ, es);
proxy_connection_io_requeue(cp, EVENT_READ|EVENT_WRITE, es);
return true;
}
/*
* This function runs in the context of the background proxy process.
* Receive a control message from the parent (sent by the port_share_sendmsg
* function above) and act on it. Return false if the proxy process should
* exit, true otherwise.
*/
static bool
control_message_from_parent(const socket_descriptor_t sd_control,
struct proxy_connection **list,
struct event_set *es,
const struct sockaddr_in server_addr,
const int max_initial_buf,
const char *journal_dir)
{
/* this buffer needs to be large enough to handle the largest buffer
* that might be returned by the link_socket_read call in read_incoming_link. */
struct buffer buf = alloc_buf(max_initial_buf);
struct msghdr mesg;
struct cmsghdr *h;
struct iovec iov[2];
char command = 0;
ssize_t status;
int ret = true;
CLEAR(mesg);
iov[0].iov_base = &command;
iov[0].iov_len = sizeof(command);
iov[1].iov_base = BPTR(&buf);
iov[1].iov_len = BCAP(&buf);
mesg.msg_iov = iov;
mesg.msg_iovlen = 2;
mesg.msg_controllen = cmsg_size();
mesg.msg_control = (char *) malloc(mesg.msg_controllen);
check_malloc_return(mesg.msg_control);
mesg.msg_flags = 0;
h = CMSG_FIRSTHDR(&mesg);
h->cmsg_len = CMSG_LEN(sizeof(socket_descriptor_t));
h->cmsg_level = SOL_SOCKET;
h->cmsg_type = SCM_RIGHTS;
static const socket_descriptor_t socket_undefined = SOCKET_UNDEFINED;
memcpy(CMSG_DATA(h), &socket_undefined, sizeof(socket_undefined));
status = recvmsg(sd_control, &mesg, MSG_NOSIGNAL);
if (status != -1)
{
if (h == NULL
|| h->cmsg_len != CMSG_LEN(sizeof(socket_descriptor_t))
|| h->cmsg_level != SOL_SOCKET
|| h->cmsg_type != SCM_RIGHTS)
{
msg(M_WARN, "PORT SHARE PROXY: received unknown message");
}
else
{
socket_descriptor_t received_fd;
memcpy(&received_fd, CMSG_DATA(h), sizeof(received_fd));
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: RECEIVED sd=%d", (int)received_fd);
if (status >= 2 && command == COMMAND_REDIRECT)
{
buf.len = status - 1;
if (proxy_entry_new(list,
es,
server_addr,
received_fd,
&buf,
journal_dir))
{
CLEAR(buf); /* we gave the buffer to proxy_entry_new */
}
else
{
openvpn_close_socket(received_fd);
}
}
else if (status >= 1 && command == COMMAND_EXIT)
{
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: RECEIVED COMMAND_EXIT");
openvpn_close_socket(received_fd); /* null socket */
ret = false;
}
}
}
free(mesg.msg_control);
free_buf(&buf);
return ret;
}
static int
proxy_connection_io_recv(struct proxy_connection *pc)
{
/* recv data from socket */
const int status = recv(pc->sd, BPTR(&pc->buf), BCAP(&pc->buf), MSG_NOSIGNAL);
if (status < 0)
{
return (errno == EAGAIN) ? IOSTAT_EAGAIN_ON_READ : IOSTAT_READ_ERROR;
}
else
{
if (!status)
{
return IOSTAT_READ_ERROR;
}
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: read[%d] %d", (int)pc->sd, status);
pc->buf.len = status;
}
return IOSTAT_GOOD;
}
static int
proxy_connection_io_send(struct proxy_connection *pc, int *bytes_sent)
{
const socket_descriptor_t sd = pc->counterpart->sd;
const int status = send(sd, BPTR(&pc->buf), BLEN(&pc->buf), MSG_NOSIGNAL);
if (status < 0)
{
const int e = errno;
return (e == EAGAIN) ? IOSTAT_EAGAIN_ON_WRITE : IOSTAT_WRITE_ERROR;
}
else
{
*bytes_sent += status;
if (status != pc->buf.len)
{
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: partial write[%d], tried=%d got=%d", (int)sd, pc->buf.len, status);
buf_advance(&pc->buf, status);
return IOSTAT_EAGAIN_ON_WRITE;
}
else
{
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: wrote[%d] %d", (int)sd, status);
pc->buf.len = 0;
pc->buf.offset = 0;
}
}
/* realloc send buffer after initial send */
if (pc->buffer_initial)
{
free_buf(&pc->buf);
pc->buf = alloc_buf(PROXY_CONNECTION_BUFFER_SIZE);
pc->buffer_initial = false;
}
return IOSTAT_GOOD;
}
/*
* Forward data from pc to pc->counterpart.
*/
static int
proxy_connection_io_xfer(struct proxy_connection *pc, const int max_transfer)
{
int transferred = 0;
while (transferred < max_transfer)
{
if (!BLEN(&pc->buf))
{
const int status = proxy_connection_io_recv(pc);
if (status != IOSTAT_GOOD)
{
return status;
}
}
if (BLEN(&pc->buf))
{
const int status = proxy_connection_io_send(pc, &transferred);
if (status != IOSTAT_GOOD)
{
return status;
}
}
}
return IOSTAT_EAGAIN_ON_READ;
}
/*
* Decide how the receipt of an EAGAIN status should affect our next IO queueing.
*/
static bool
proxy_connection_io_status(const int status, int *rwflags_pc, int *rwflags_cp)
{
switch (status)
{
case IOSTAT_EAGAIN_ON_READ:
*rwflags_pc |= EVENT_READ;
*rwflags_cp &= ~EVENT_WRITE;
return true;
case IOSTAT_EAGAIN_ON_WRITE:
*rwflags_pc &= ~EVENT_READ;
*rwflags_cp |= EVENT_WRITE;
return true;
case IOSTAT_READ_ERROR:
return false;
case IOSTAT_WRITE_ERROR:
return false;
default:
msg(M_FATAL, "PORT SHARE PROXY: unexpected status=%d", status);
}
return false; /* NOTREACHED */
}
/*
* Dispatch function for forwarding data between the two socket fds involved
* in the proxied connection.
*/
static int
proxy_connection_io_dispatch(struct proxy_connection *pc,
const int rwflags,
struct event_set *es)
{
const int max_transfer_per_iteration = 10000;
struct proxy_connection *cp = pc->counterpart;
int rwflags_pc = pc->rwflags;
int rwflags_cp = cp->rwflags;
ASSERT(pc->defined && cp->defined && cp->counterpart == pc);
if (rwflags & EVENT_READ)
{
const int status = proxy_connection_io_xfer(pc, max_transfer_per_iteration);
if (!proxy_connection_io_status(status, &rwflags_pc, &rwflags_cp))
{
goto bad;
}
}
if (rwflags & EVENT_WRITE)
{
const int status = proxy_connection_io_xfer(cp, max_transfer_per_iteration);
if (!proxy_connection_io_status(status, &rwflags_cp, &rwflags_pc))
{
goto bad;
}
}
proxy_connection_io_requeue(pc, rwflags_pc, es);
proxy_connection_io_requeue(cp, rwflags_cp, es);
return true;
bad:
proxy_entry_mark_for_close(pc, es);
return false;
}
/*
* This is the main function for the port share proxy background process.
*/
static void
port_share_proxy(const struct sockaddr_in hostaddr,
const socket_descriptor_t sd_control,
const int max_initial_buf,
const char *journal_dir)
{
if (send_control(sd_control, RESPONSE_INIT_SUCCEEDED) >= 0)
{
void *sd_control_marker = (void *)1;
int maxevents = 256;
struct event_set *es;
struct event_set_return esr[64];
struct proxy_connection *list = NULL;
time_t last_housekeeping = 0;
msg(D_PS_PROXY, "PORT SHARE PROXY: proxy starting");
es = event_set_init(&maxevents, 0);
event_ctl(es, sd_control, EVENT_READ, sd_control_marker);
while (true)
{
int n_events;
struct timeval tv;
time_t current;
tv.tv_sec = 10;
tv.tv_usec = 0;
n_events = event_wait(es, &tv, esr, SIZE(esr));
/*dmsg (D_PS_PROXY_DEBUG, "PORT SHARE PROXY: event_wait returned %d", n_events);*/
current = time(NULL);
if (n_events > 0)
{
int i;
for (i = 0; i < n_events; ++i)
{
const struct event_set_return *e = &esr[i];
if (e->arg == sd_control_marker)
{
if (!control_message_from_parent(sd_control, &list, es, hostaddr, max_initial_buf, journal_dir))
{
goto done;
}
}
else
{
struct proxy_connection *pc = (struct proxy_connection *)e->arg;
if (pc->defined)
{
proxy_connection_io_dispatch(pc, e->rwflags, es);
}
}
}
}
else if (n_events < 0)
{
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE PROXY: event_wait failed");
}
if (current > last_housekeeping)
{
proxy_list_housekeeping(&list);
last_housekeeping = current;
}
}
done:
proxy_list_close(&list);
event_free(es);
}
msg(M_INFO, "PORT SHARE PROXY: proxy exiting");
}
/*
* Called from the main OpenVPN process to enable the port
* share proxy.
*/
struct port_share *
port_share_open(const char *host,
const char *port,
const int max_initial_buf,
const char *journal_dir)
{
pid_t pid;
socket_descriptor_t fd[2];
struct sockaddr_in hostaddr;
struct port_share *ps;
int status;
struct addrinfo *ai;
ALLOC_OBJ_CLEAR(ps, struct port_share);
ps->foreground_fd = -1;
ps->background_pid = -1;
/*
* Get host's IP address
*/
status = openvpn_getaddrinfo(GETADDR_RESOLVE|GETADDR_FATAL,
host, port, 0, NULL, AF_INET, &ai);
ASSERT(status==0);
hostaddr = *((struct sockaddr_in *) ai->ai_addr);
freeaddrinfo(ai);
/*
* Make a socket for foreground and background processes
* to communicate.
*/
if (socketpair(PF_UNIX, SOCK_DGRAM, 0, fd) == -1)
{
msg(M_WARN, "PORT SHARE: socketpair call failed");
goto error;
}
/*
* Fork off background proxy process.
*/
pid = fork();
if (pid)
{
int status;
/*
* Foreground Process
*/
ps->background_pid = pid;
/* close our copy of child's socket */
openvpn_close_socket(fd[1]);
/* don't let future subprocesses inherit child socket */
set_cloexec(fd[0]);
/* wait for background child process to initialize */
status = recv_control(fd[0]);
if (status == RESPONSE_INIT_SUCCEEDED)
{
/* note that this will cause possible EAGAIN when writing to
* control socket if proxy process is backlogged */
set_nonblock(fd[0]);
ps->foreground_fd = fd[0];
return ps;
}
else
{
msg(M_ERR, "PORT SHARE: unexpected init recv_control status=%d", status);
}
}
else
{
/*
* Background Process
*/
/* Ignore most signals (the parent will receive them) */
set_signals();
/* Let msg know that we forked */
msg_forked();
#ifdef ENABLE_MANAGEMENT
/* Don't interact with management interface */
management = NULL;
#endif
/* close all parent fds except our socket back to parent */
close_fds_except(fd[1]);
/* no blocking on control channel back to parent */
set_nonblock(fd[1]);
/* initialize prng */
prng_init(NULL, 0);
/* execute the event loop */
port_share_proxy(hostaddr, fd[1], max_initial_buf, journal_dir);
openvpn_close_socket(fd[1]);
exit(0);
return NULL; /* NOTREACHED */
}
error:
port_share_close(ps);
return NULL;
}
void
port_share_close(struct port_share *ps)
{
if (ps)
{
if (ps->foreground_fd >= 0)
{
/* tell background process to exit */
port_share_sendmsg(ps->foreground_fd, COMMAND_EXIT, NULL, SOCKET_UNDEFINED);
/* wait for background process to exit */
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE: waiting for background process to exit");
if (ps->background_pid > 0)
{
waitpid(ps->background_pid, NULL, 0);
}
dmsg(D_PS_PROXY_DEBUG, "PORT SHARE: background process exited");
openvpn_close_socket(ps->foreground_fd);
ps->foreground_fd = -1;
}
free(ps);
}
}
void
port_share_abort(struct port_share *ps)
{
if (ps)
{
/* tell background process to exit */
if (ps->foreground_fd >= 0)
{
send_control(ps->foreground_fd, COMMAND_EXIT);
openvpn_close_socket(ps->foreground_fd);
ps->foreground_fd = -1;
}
}
}
/*
* Given either the first 2 or 3 bytes of an initial client -> server
* data payload, return true if the protocol is that of an OpenVPN
* client attempting to connect with an OpenVPN server.
*/
bool
is_openvpn_protocol(const struct buffer *buf)
{
const unsigned char *p = (const unsigned char *) BSTR(buf);
const int len = BLEN(buf);
if (len >= 3)
{
return p[0] == 0
&& p[1] >= 14
&& p[2] == (P_CONTROL_HARD_RESET_CLIENT_V2<<P_OPCODE_SHIFT);
}
else if (len >= 2)
{
return p[0] == 0 && p[1] >= 14;
}
else
{
return true;
}
}
/*
* Called from the foreground process. Send a message to the background process that it
* should proxy the TCP client on sd to the host/port defined in the initial port_share_open
* call.
*/
void
port_share_redirect(struct port_share *ps, const struct buffer *head, socket_descriptor_t sd)
{
if (ps)
{
port_share_sendmsg(ps->foreground_fd, COMMAND_REDIRECT, head, sd);
}
}
#endif /* if PORT_SHARE */