/*
* OpenVPN -- An application to securely tunnel IP networks
* over a single TCP/UDP port, with support for SSL/TLS-based
* session authentication and key exchange,
* packet encryption, packet authentication, and
* packet compression.
*
* Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
/**
* @file
* Interface functions to the internal and external multiplexers.
*/
#ifndef FORWARD_H
#define FORWARD_H
/* the following macros must be defined before including any other header
* file
*/
#define TUN_OUT(c) (BLEN(&(c)->c2.to_tun) > 0)
#define LINK_OUT(c) (BLEN(&(c)->c2.to_link) > 0)
#define ANY_OUT(c) (TUN_OUT(c) || LINK_OUT(c))
#ifdef ENABLE_FRAGMENT
#define TO_LINK_FRAG(c) ((c)->c2.fragment && fragment_outgoing_defined((c)->c2.fragment))
#else
#define TO_LINK_FRAG(c) (false)
#endif
#define TO_LINK_DEF(c) (LINK_OUT(c) || TO_LINK_FRAG(c))
#include "openvpn.h"
#include "occ.h"
#include "ping.h"
#define IOW_TO_TUN (1<<0)
#define IOW_TO_LINK (1<<1)
#define IOW_READ_TUN (1<<2)
#define IOW_READ_LINK (1<<3)
#define IOW_SHAPER (1<<4)
#define IOW_CHECK_RESIDUAL (1<<5)
#define IOW_FRAG (1<<6)
#define IOW_MBUF (1<<7)
#define IOW_READ_TUN_FORCE (1<<8)
#define IOW_WAIT_SIGNAL (1<<9)
#define IOW_READ (IOW_READ_TUN|IOW_READ_LINK)
extern counter_type link_read_bytes_global;
extern counter_type link_write_bytes_global;
void check_tls_dowork(struct context *c);
void check_tls_errors_co(struct context *c);
void check_tls_errors_nco(struct context *c);
#if P2MP
void check_incoming_control_channel_dowork(struct context *c);
void check_scheduled_exit_dowork(struct context *c);
void check_push_request_dowork(struct context *c);
#endif /* P2MP */
#ifdef ENABLE_FRAGMENT
void check_fragment_dowork(struct context *c);
#endif /* ENABLE_FRAGMENT */
void check_connection_established_dowork(struct context *c);
void check_add_routes_dowork(struct context *c);
void check_inactivity_timeout_dowork(struct context *c);
void check_server_poll_timeout_dowork(struct context *c);
void check_status_file_dowork(struct context *c);
void io_wait_dowork(struct context *c, const unsigned int flags);
void pre_select(struct context *c);
void process_io(struct context *c);
const char *wait_status_string(struct context *c, struct gc_arena *gc);
void show_wait_status(struct context *c);
/**********************************************************************/
/**
* Process a data channel packet that will be sent through a VPN tunnel.
* @ingroup data_control
*
* This function controls the processing of a data channel packet which
* will be sent through a VPN tunnel to a remote OpenVPN peer. It's
* general structure is as follows:
* - Check that the client authentication has succeeded; if not, drop the
* packet.
* - If the \a comp_frag argument is true:
* - Call \c lzo_compress() of the \link Data Channel Compression
* module\endlink to (possibly) compress the packet.
* - Call \c fragment_outgoing() of the \link Data Channel Fragmentation
* module\endlink to (possibly) fragment the packet.
* - Activate the \link Data Channel Crypto module\endlink to perform
* security operations on the packet.
* - Call \c tls_pre_encrypt() to choose the appropriate security
* parameters for this packet.
* - Call \c openvpn_encrypt() to encrypt and HMAC signed the packet.
* - Call \c tls_post_encrypt() to prepend the one-byte OpenVPN header
* and do some TLS accounting.
* - Place the resulting packet in \c c->c2.to_link so that it can be sent
* over the external network interface to its remote destination by the
* \link external_multiplexer External Multiplexer\endlink.
*
* @param c - The context structure of the VPN tunnel associated with this
* packet.
* @param comp_frag - Whether to do packet compression and fragmentation.
* This flag is set to true the first time a packet is processed. If
* the packet then gets fragmented, this function will be called again
* once for each remaining fragment with this parameter set to false.
*/
void encrypt_sign(struct context *c, bool comp_frag);
int get_server_poll_remaining_time(struct event_timeout *server_poll_timeout);
/**********************************************************************/
/**
* Read a packet from the external network interface.
* @ingroup external_multiplexer
*
* The packet read from the external network interface is stored in \c
* c->c2.buf and its source address in \c c->c2.from. If an error
* occurred, the length of \c c->c2.buf will be 0.
*
* OpenVPN running as client or as UDP server only has a single external
* network socket, so this function can be called with the single (client
* mode) or top level (UDP server) context as its argument. OpenVPN
* running as TCP server, on the other hand, has a network socket for each
* active VPN tunnel. In that case this function must be called with the
* context associated with the appropriate VPN tunnel for which data is
* available to be read.
*
* @param c - The context structure which contains the external
* network socket from which to read incoming packets.
*/
void read_incoming_link(struct context *c);
/**
* Starts processing a packet read from the external network interface.
* @ingroup external_multiplexer
*
* This function starts the processing of a data channel packet which
* has come out of a VPN tunnel. It's high-level structure is as follows:
* - Verify that a nonzero length packet has been received from a valid
* source address for the given context \a c.
* - Call \c tls_pre_decrypt(), which splits data channel and control
* channel packets:
* - If a data channel packet, the appropriate security parameters are
* loaded.
* - If a control channel packet, this function process is it and
* afterwards sets the packet's buffer length to 0, so that the data
* channel processing steps below will ignore it.
* - Call \c openvpn_decrypt() of the \link data_crypto Data Channel
* Crypto module\endlink to authenticate and decrypt the packet using
* the security parameters loaded by \c tls_pre_decrypt() above.
*
* @param c - The context structure of the VPN tunnel associated with the
* packet.
* @param lsi - link_socket_info obtained from context before processing.
* @param floated - Flag indicates that peer has floated.
*
* @return true if packet is authenticated, false otherwise.
*/
bool process_incoming_link_part1(struct context *c, struct link_socket_info *lsi, bool floated);
/**
* Continues processing a packet read from the external network interface.
* @ingroup external_multiplexer
*
* This function continues the processing of a data channel packet which
* has come out of a VPN tunnel. It must be called after
* \c process_incoming_link_part1() function.
*
* It's high-level structure is as follows:
* - Call \c fragment_incoming() of the \link fragmentation Data Channel
* Fragmentation module\endlink to reassemble the packet if it's
* fragmented.
* - Call \c lzo_decompress() of the \link compression Data Channel
* Compression module\endlink to decompress the packet if it's
* compressed.
* - Place the resulting packet in \c c->c2.to_tun so that it can be sent
* over the virtual tun/tap network interface to its local destination
* by the \link internal_multiplexer Internal Multiplexer\endlink.
*
* @param c - The context structure of the VPN tunnel associated with the
* packet.
* @param lsi - link_socket_info obtained from context before processing.
* @param orig_buf - Pointer to a buffer data.
*
*/
void process_incoming_link_part2(struct context *c, struct link_socket_info *lsi, const uint8_t *orig_buf);
/**
* Write a packet to the external network interface.
* @ingroup external_multiplexer
*
* This function writes the packet stored in \c c->c2.to_link to the
* external network device contained within \c c->c1.link_socket.
*
* If an error occurs, it is logged and the packet is dropped.
*
* @param c - The context structure of the VPN tunnel associated with the
* packet.
*/
void process_outgoing_link(struct context *c);
/**************************************************************************/
/**
* Read a packet from the virtual tun/tap network interface.
* @ingroup internal_multiplexer
*
* This function reads a packet from the virtual tun/tap network device \c
* c->c1.tuntap and stores it in \c c->c2.buf.
*
* If an error occurs, it is logged and the packet is dropped.
*
* @param c - The context structure in which to store the received
* packet.
*/
void read_incoming_tun(struct context *c);
/**
* Process a packet read from the virtual tun/tap network interface.
* @ingroup internal_multiplexer
*
* This function calls \c encrypt_sign() of the \link data_control Data
* Channel Control module\endlink to process the packet.
*
* If an error occurs, it is logged and the packet is dropped.
*
* @param c - The context structure of the VPN tunnel associated with the
* packet.
*/
void process_incoming_tun(struct context *c);
/**
* Write a packet to the virtual tun/tap network interface.
* @ingroup internal_multiplexer
*
* This function writes the packet stored in \c c->c2.to_tun to the
* virtual tun/tap network device \c c->c1.tuntap.
*
* If an error occurs, it is logged and the packet is dropped.
*
* @param c - The context structure of the VPN tunnel associated with
* the packet.
*/
void process_outgoing_tun(struct context *c);
/**************************************************************************/
bool send_control_channel_string(struct context *c, const char *str, int msglevel);
#define PIPV4_PASSTOS (1<<0)
#define PIP_MSSFIX (1<<1) /* v4 and v6 */
#define PIP_OUTGOING (1<<2)
#define PIPV4_EXTRACT_DHCP_ROUTER (1<<3)
#define PIPV4_CLIENT_NAT (1<<4)
#define PIPV6_IMCP_NOHOST_CLIENT (1<<5)
#define PIPV6_IMCP_NOHOST_SERVER (1<<6)
void process_ip_header(struct context *c, unsigned int flags, struct buffer *buf);
#if P2MP
void schedule_exit(struct context *c, const int n_seconds, const int signal);
#endif
static inline struct link_socket_info *
get_link_socket_info(struct context *c)
{
if (c->c2.link_socket_info)
{
return c->c2.link_socket_info;
}
else
{
return &c->c2.link_socket->info;
}
}
static inline void
register_activity(struct context *c, const int size)
{
if (c->options.inactivity_timeout)
{
c->c2.inactivity_bytes += size;
if (c->c2.inactivity_bytes >= c->options.inactivity_minimum_bytes)
{
c->c2.inactivity_bytes = 0;
event_timeout_reset(&c->c2.inactivity_interval);
}
}
}
/*
* Return the io_wait() flags appropriate for
* a point-to-point tunnel.
*/
static inline unsigned int
p2p_iow_flags(const struct context *c)
{
unsigned int flags = (IOW_SHAPER|IOW_CHECK_RESIDUAL|IOW_FRAG|IOW_READ|IOW_WAIT_SIGNAL);
if (c->c2.to_link.len > 0)
{
flags |= IOW_TO_LINK;
}
if (c->c2.to_tun.len > 0)
{
flags |= IOW_TO_TUN;
}
return flags;
}
/*
* This is the core I/O wait function, used for all I/O waits except
* for TCP in server mode.
*/
static inline void
io_wait(struct context *c, const unsigned int flags)
{
void io_wait_dowork(struct context *c, const unsigned int flags);
if (c->c2.fast_io && (flags & (IOW_TO_TUN|IOW_TO_LINK|IOW_MBUF)))
{
/* fast path -- only for TUN/TAP/UDP writes */
unsigned int ret = 0;
if (flags & IOW_TO_TUN)
{
ret |= TUN_WRITE;
}
if (flags & (IOW_TO_LINK|IOW_MBUF))
{
ret |= SOCKET_WRITE;
}
c->c2.event_set_status = ret;
}
else
{
/* slow path */
io_wait_dowork(c, flags);
}
}
#define CONNECTION_ESTABLISHED(c) (get_link_socket_info(c)->connection_established)
#endif /* FORWARD_H */