Merge tag 'upstream/2.4.0'

Upstream version 2.4.0

1 files changed, 86 insertions, 79 deletions

diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h
index c971b75..ed1344e 100644
--- a/src/openvpn/ssl.h
+++ b/src/openvpn/ssl.h
@@ -5,8 +5,8 @@
  *             packet encryption, packet authentication, and
  *             packet compression.
  *
- *  Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
- *  Copyright (C) 2010 Fox Crypto B.V. <openvpn@fox-it.com>
+ *  Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net>
+ *  Copyright (C) 2010-2017 Fox Crypto B.V. <openvpn@fox-it.com>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2
@@ -87,7 +87,7 @@
  */
 #define TLS_MULTI_REFRESH 15    /* call tls_multi_process once every n seconds */
 #define TLS_MULTI_HORIZON 2     /* call tls_multi_process frequently for n seconds after
-				   every packet sent/received action */
+                                 * every packet sent/received action */
 
 /*
  * The SSL/TLS worker thread will wait at most this many seconds for the
@@ -129,25 +129,25 @@
  */
 struct tls_auth_standalone
 {
-  struct tls_wrap_ctx tls_wrap;
-  struct frame frame;
+    struct tls_wrap_ctx tls_wrap;
+    struct frame frame;
 };
 
 /*
  * Prepare the SSL library for use
  */
-void init_ssl_lib (void);
+void init_ssl_lib(void);
 
 /*
  * Free any internal state that the SSL library might have
  */
-void free_ssl_lib (void);
+void free_ssl_lib(void);
 
 /**
  * Build master SSL context object that serves for the whole of OpenVPN
  * instantiation
  */
-void init_ssl (const struct options *options, struct tls_root_ctx *ctx);
+void init_ssl(const struct options *options, struct tls_root_ctx *ctx);
 
 /** @addtogroup control_processor
  *  @{ */
@@ -169,7 +169,7 @@ void init_ssl (const struct options *options, struct tls_root_ctx *ctx);
  *
  * @return A newly allocated and initialized \c tls_multi structure.
  */
-struct tls_multi *tls_multi_init (struct tls_options *tls_options);
+struct tls_multi *tls_multi_init(struct tls_options *tls_options);
 
 /**
  * Finalize initialization of a \c tls_multi structure.
@@ -186,28 +186,28 @@ struct tls_multi *tls_multi_init (struct tls_options *tls_options);
  * @param frame        - The data channel's \c frame structure.
  */
 void tls_multi_init_finalize(struct tls_multi *multi,
-			     const struct frame *frame);
+                             const struct frame *frame);
 
 /*
  * Initialize a standalone tls-auth verification object.
  */
-struct tls_auth_standalone *tls_auth_standalone_init (struct tls_options *tls_options,
-						      struct gc_arena *gc);
+struct tls_auth_standalone *tls_auth_standalone_init(struct tls_options *tls_options,
+                                                     struct gc_arena *gc);
 
 /*
  * Finalize a standalone tls-auth verification object.
  */
-void tls_auth_standalone_finalize (struct tls_auth_standalone *tas,
-				   const struct frame *frame);
+void tls_auth_standalone_finalize(struct tls_auth_standalone *tas,
+                                  const struct frame *frame);
 
 /*
  * Set local and remote option compatibility strings.
  * Used to verify compatibility of local and remote option
  * sets.
  */
-void tls_multi_init_set_options(struct tls_multi* multi,
-				const char *local,
-				const char *remote);
+void tls_multi_init_set_options(struct tls_multi *multi,
+                                const char *local,
+                                const char *remote);
 
 /**
  * Cleanup a \c tls_multi structure and free associated memory
@@ -221,7 +221,7 @@ void tls_multi_init_set_options(struct tls_multi* multi,
  * @param clear        - Whether the memory allocated for the \a multi
  *                       object should be overwritten with 0s.
  */
-void tls_multi_free (struct tls_multi *multi, bool clear);
+void tls_multi_free(struct tls_multi *multi, bool clear);
 
 /** @} name Functions for initialization and cleanup of tls_multi structures */
 
@@ -237,11 +237,11 @@ void tls_multi_free (struct tls_multi *multi, bool clear);
  * Basically decides if we should call tls_process for
  * the active or untrusted sessions.
  */
-int tls_multi_process (struct tls_multi *multi,
-		       struct buffer *to_link,
-		       struct link_socket_actual **to_link_addr,
-		       struct link_socket_info *to_link_socket_info,
-		       interval_t *wakeup);
+int tls_multi_process(struct tls_multi *multi,
+                      struct buffer *to_link,
+                      struct link_socket_actual **to_link_addr,
+                      struct link_socket_info *to_link_socket_info,
+                      interval_t *wakeup);
 
 
 /**************************************************************************/
@@ -296,12 +296,12 @@ int tls_multi_process (struct tls_multi *multi,
  * @li False if the packet is a data channel packet, or if an error
  *     occurred during processing of a control channel packet.
  */
-bool tls_pre_decrypt (struct tls_multi *multi,
-		      const struct link_socket_actual *from,
-		      struct buffer *buf,
-		      struct crypto_options **opt,
-		      bool floated,
-		      const uint8_t **ad_start);
+bool tls_pre_decrypt(struct tls_multi *multi,
+                     const struct link_socket_actual *from,
+                     struct buffer *buf,
+                     struct crypto_options **opt,
+                     bool floated,
+                     const uint8_t **ad_start);
 
 
 /**************************************************************************/
@@ -339,9 +339,9 @@ bool tls_pre_decrypt (struct tls_multi *multi,
  * @li False if the packet is not valid, did not pass the HMAC firewall
  *     test, or some other error occurred.
  */
-bool tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,
-			   const struct link_socket_actual *from,
-			   const struct buffer *buf);
+bool tls_pre_decrypt_lite(const struct tls_auth_standalone *tas,
+                          const struct link_socket_actual *from,
+                          const struct buffer *buf);
 
 
 /**
@@ -357,8 +357,8 @@ bool tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,
  * @param buf - The buffer containing the outgoing packet.
  * @param opt - Returns a crypto options structure with the security parameters.
  */
-void tls_pre_encrypt (struct tls_multi *multi,
-		      struct buffer *buf, struct crypto_options **opt);
+void tls_pre_encrypt(struct tls_multi *multi,
+                     struct buffer *buf, struct crypto_options **opt);
 
 
 /**
@@ -374,7 +374,7 @@ void tls_pre_encrypt (struct tls_multi *multi,
  * @ingroup data_crypto
  */
 void
-tls_prepend_opcode_v1 (const struct tls_multi *multi, struct buffer *buf);
+tls_prepend_opcode_v1(const struct tls_multi *multi, struct buffer *buf);
 
 /**
  * Prepend an OpenVPN data channel P_DATA_V2 header to the packet.  The
@@ -393,7 +393,7 @@ tls_prepend_opcode_v1 (const struct tls_multi *multi, struct buffer *buf);
  * @ingroup data_crypto
  */
 void
-tls_prepend_opcode_v2 (const struct tls_multi *multi, struct buffer *buf);
+tls_prepend_opcode_v2(const struct tls_multi *multi, struct buffer *buf);
 
 /**
  * Perform some accounting for the key state used.
@@ -402,7 +402,7 @@ tls_prepend_opcode_v2 (const struct tls_multi *multi, struct buffer *buf);
  * @param multi - The TLS state for this packet's destination VPN tunnel.
  * @param buf - The buffer containing the outgoing packet.
  */
-void tls_post_encrypt (struct tls_multi *multi, struct buffer *buf);
+void tls_post_encrypt(struct tls_multi *multi, struct buffer *buf);
 
 /** @} name Functions for managing security parameter state for data channel packets */
 
@@ -410,26 +410,26 @@ void tls_post_encrypt (struct tls_multi *multi, struct buffer *buf);
  * Setup private key file password. If auth_file is given, use the
  * credentials stored in the file.
  */
-void pem_password_setup (const char *auth_file);
+void pem_password_setup(const char *auth_file);
 
 /*
  * Setup authentication username and password. If auth_file is given, use the
  * credentials stored in the file.
  */
-void auth_user_pass_setup (const char *auth_file, const struct static_challenge_info *sc_info);
+void auth_user_pass_setup(const char *auth_file, const struct static_challenge_info *sc_info);
 
 /*
  * Ensure that no caching is performed on authentication information
  */
-void ssl_set_auth_nocache (void);
+void ssl_set_auth_nocache(void);
 
 /*
  * Purge any stored authentication information, both for key files and tunnel
  * authentication. If PCKS #11 is enabled, purge authentication for that too.
  */
-void ssl_purge_auth (const bool auth_user_pass_only);
+void ssl_purge_auth(const bool auth_user_pass_only);
 
-void ssl_set_auth_token (const char *token);
+void ssl_set_auth_token(const char *token);
 
 #ifdef ENABLE_CLIENT_CR
 /*
@@ -437,8 +437,10 @@ void ssl_set_auth_token (const char *token);
  * reason string and return a dynamically allocated
  * auth_challenge_info struct.
  */
-void ssl_purge_auth_challenge (void);
-void ssl_put_auth_challenge (const char *cr_str);
+void ssl_purge_auth_challenge(void);
+
+void ssl_put_auth_challenge(const char *cr_str);
+
 #endif
 
 /*
@@ -449,15 +451,15 @@ void tls_adjust_frame_parameters(struct frame *frame);
 /*
  * Send a payload over the TLS control channel
  */
-bool tls_send_payload (struct tls_multi *multi,
-		       const uint8_t *data,
-		       int size);
+bool tls_send_payload(struct tls_multi *multi,
+                      const uint8_t *data,
+                      int size);
 
 /*
  * Receive a payload through the TLS control channel
  */
-bool tls_rec_payload (struct tls_multi *multi,
-		      struct buffer *buf);
+bool tls_rec_payload(struct tls_multi *multi,
+                     struct buffer *buf);
 
 /**
  * Updates remote address in TLS sessions.
@@ -465,22 +467,22 @@ bool tls_rec_payload (struct tls_multi *multi,
  * @param multi - Tunnel to update
  * @param addr - new address
  */
-void tls_update_remote_addr (struct tls_multi *multi,
-			     const struct link_socket_actual *addr);
+void tls_update_remote_addr(struct tls_multi *multi,
+                            const struct link_socket_actual *addr);
 
 /**
  * Update TLS session crypto parameters (cipher and auth) and derive data
  * channel keys based on the supplied options.
  *
- * @param session	The TLS session to update.
- * @param options	The options to use when updating session.
- * @param frame		The frame options for this session (frame overhead is
- * 			adjusted based on the selected cipher/auth).
+ * @param session       The TLS session to update.
+ * @param options       The options to use when updating session.
+ * @param frame         The frame options for this session (frame overhead is
+ *                      adjusted based on the selected cipher/auth).
  *
  * @return true if updating succeeded, false otherwise.
  */
 bool tls_session_update_crypto_params(struct tls_session *session,
-    const struct options *options, struct frame *frame);
+                                      const struct options *options, struct frame *frame);
 
 /**
  * "Poor man's NCP": Use peer cipher if it is an allowed (NCP) cipher.
@@ -495,7 +497,7 @@ void tls_poor_mans_ncp(struct options *o, const char *remote_ciphername);
 static inline char *
 tls_get_peer_info(const struct tls_multi *multi)
 {
-  return multi->peer_info;
+    return multi->peer_info;
 }
 #endif
 
@@ -508,7 +510,7 @@ int tls_peer_info_ncp_ver(const char *peer_info);
 /**
  * Check whether the ciphers in the supplied list are supported.
  *
- * @param list		Colon-separated list of ciphers
+ * @param list          Colon-separated list of ciphers
  *
  * @returns true iff all ciphers in list are supported.
  */
@@ -526,39 +528,43 @@ bool tls_item_in_cipher_list(const char *item, const char *list);
  */
 
 static inline bool
-tls_initial_packet_received (const struct tls_multi *multi)
+tls_initial_packet_received(const struct tls_multi *multi)
 {
-  return multi->n_sessions > 0;
+    return multi->n_sessions > 0;
 }
 
 static inline bool
-tls_test_auth_deferred_interval (const struct tls_multi *multi)
+tls_test_auth_deferred_interval(const struct tls_multi *multi)
 {
-  if (multi)
+    if (multi)
     {
-      const struct key_state *ks = &multi->session[TM_ACTIVE].key[KS_PRIMARY];
-      return now < ks->auth_deferred_expire;
+        const struct key_state *ks = &multi->session[TM_ACTIVE].key[KS_PRIMARY];
+        return now < ks->auth_deferred_expire;
     }
-  return false;
+    return false;
 }
 
 static inline int
-tls_test_payload_len (const struct tls_multi *multi)
+tls_test_payload_len(const struct tls_multi *multi)
 {
-  if (multi)
+    if (multi)
     {
-      const struct key_state *ks = &multi->session[TM_ACTIVE].key[KS_PRIMARY];
-      if (ks->state >= S_ACTIVE)
-	return BLEN (&ks->plaintext_read_buf);
+        const struct key_state *ks = &multi->session[TM_ACTIVE].key[KS_PRIMARY];
+        if (ks->state >= S_ACTIVE)
+        {
+            return BLEN(&ks->plaintext_read_buf);
+        }
     }
-  return 0;
+    return 0;
 }
 
 static inline void
-tls_set_single_session (struct tls_multi *multi)
+tls_set_single_session(struct tls_multi *multi)
 {
-  if (multi)
-    multi->opt.single_session = true;
+    if (multi)
+    {
+        multi->opt.single_session = true;
+    }
 }
 
 /*
@@ -569,9 +575,9 @@ tls_set_single_session (struct tls_multi *multi)
 #define PD_TLS                     (1<<9)
 #define PD_VERBOSE                 (1<<10)
 
-const char *protocol_dump (struct buffer *buffer,
-			   unsigned int flags,
-			   struct gc_arena *gc);
+const char *protocol_dump(struct buffer *buffer,
+                          unsigned int flags,
+                          struct gc_arena *gc);
 
 /*
  * debugging code
@@ -579,11 +585,12 @@ const char *protocol_dump (struct buffer *buffer,
 
 #ifdef MEASURE_TLS_HANDSHAKE_STATS
 void show_tls_performance_stats(void);
+
 #endif
 
 /*#define EXTRACT_X509_FIELD_TEST*/
-void extract_x509_field_test (void);
+void extract_x509_field_test(void);
 
 #endif /* ENABLE_CRYPTO */
 
-#endif
+#endif /* ifndef OPENVPN_SSL_H */