diff options
Diffstat (limited to 'src/openvpn/multi.c')
| -rw-r--r-- | src/openvpn/multi.c | 4813 |
1 files changed, 2492 insertions, 2321 deletions
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index 4fc8b02..f6f3f5d 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net> + * Copyright (C) 2002-2017 OpenVPN Technologies, Inc. <sales@openvpn.net> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 @@ -55,22 +55,28 @@ #ifdef MULTI_DEBUG_EVENT_LOOP static const char * -id (struct multi_instance *mi) +id(struct multi_instance *mi) { - if (mi) - return tls_common_name (mi->context.c2.tls_multi, false); - else - return "NULL"; + if (mi) + { + return tls_common_name(mi->context.c2.tls_multi, false); + } + else + { + return "NULL"; + } } #endif #ifdef MANAGEMENT_DEF_AUTH static void -set_cc_config (struct multi_instance *mi, struct buffer_list *cc_config) +set_cc_config(struct multi_instance *mi, struct buffer_list *cc_config) { - if (mi->cc_config) - buffer_list_free (mi->cc_config); - mi->cc_config = cc_config; + if (mi->cc_config) + { + buffer_list_free(mi->cc_config); + } + mi->cc_config = cc_config; } #endif @@ -78,170 +84,188 @@ static inline void update_mstat_n_clients(const int n_clients) { #ifdef ENABLE_MEMSTATS - if (mmap_stats) - mmap_stats->n_clients = n_clients; + if (mmap_stats) + { + mmap_stats->n_clients = n_clients; + } #endif } static bool -learn_address_script (const struct multi_context *m, - const struct multi_instance *mi, - const char *op, - const struct mroute_addr *addr) -{ - struct gc_arena gc = gc_new (); - struct env_set *es; - bool ret = true; - struct plugin_list *plugins; - - /* get environmental variable source */ - if (mi && mi->context.c2.es) - es = mi->context.c2.es; - else - es = env_set_create (&gc); - - /* get plugin source */ - if (mi) - plugins = mi->context.plugins; - else - plugins = m->top.plugins; - - if (plugin_defined (plugins, OPENVPN_PLUGIN_LEARN_ADDRESS)) - { - struct argv argv = argv_new (); - argv_printf (&argv, "%s %s", - op, - mroute_addr_print (addr, &gc)); - if (mi) - argv_printf_cat (&argv, "%s", tls_common_name (mi->context.c2.tls_multi, false)); - if (plugin_call (plugins, OPENVPN_PLUGIN_LEARN_ADDRESS, &argv, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS) - { - msg (M_WARN, "WARNING: learn-address plugin call failed"); - ret = false; - } - argv_reset (&argv); - } - - if (m->top.options.learn_address_script) - { - struct argv argv = argv_new (); - setenv_str (es, "script_type", "learn-address"); - argv_parse_cmd (&argv, m->top.options.learn_address_script); - argv_printf_cat (&argv, "%s %s", op, mroute_addr_print (addr, &gc)); - if (mi) - argv_printf_cat (&argv, "%s", tls_common_name (mi->context.c2.tls_multi, false)); - if (!openvpn_run_script (&argv, es, 0, "--learn-address")) - ret = false; - argv_reset (&argv); - } - - gc_free (&gc); - return ret; +learn_address_script(const struct multi_context *m, + const struct multi_instance *mi, + const char *op, + const struct mroute_addr *addr) +{ + struct gc_arena gc = gc_new(); + struct env_set *es; + bool ret = true; + struct plugin_list *plugins; + + /* get environmental variable source */ + if (mi && mi->context.c2.es) + { + es = mi->context.c2.es; + } + else + { + es = env_set_create(&gc); + } + + /* get plugin source */ + if (mi) + { + plugins = mi->context.plugins; + } + else + { + plugins = m->top.plugins; + } + + if (plugin_defined(plugins, OPENVPN_PLUGIN_LEARN_ADDRESS)) + { + struct argv argv = argv_new(); + argv_printf(&argv, "%s %s", + op, + mroute_addr_print(addr, &gc)); + if (mi) + { + argv_printf_cat(&argv, "%s", tls_common_name(mi->context.c2.tls_multi, false)); + } + if (plugin_call(plugins, OPENVPN_PLUGIN_LEARN_ADDRESS, &argv, NULL, es) != OPENVPN_PLUGIN_FUNC_SUCCESS) + { + msg(M_WARN, "WARNING: learn-address plugin call failed"); + ret = false; + } + argv_reset(&argv); + } + + if (m->top.options.learn_address_script) + { + struct argv argv = argv_new(); + setenv_str(es, "script_type", "learn-address"); + argv_parse_cmd(&argv, m->top.options.learn_address_script); + argv_printf_cat(&argv, "%s %s", op, mroute_addr_print(addr, &gc)); + if (mi) + { + argv_printf_cat(&argv, "%s", tls_common_name(mi->context.c2.tls_multi, false)); + } + if (!openvpn_run_script(&argv, es, 0, "--learn-address")) + { + ret = false; + } + argv_reset(&argv); + } + + gc_free(&gc); + return ret; } void -multi_ifconfig_pool_persist (struct multi_context *m, bool force) +multi_ifconfig_pool_persist(struct multi_context *m, bool force) { - /* write pool data to file */ - if (m->ifconfig_pool - && m->top.c1.ifconfig_pool_persist - && (force || ifconfig_pool_write_trigger (m->top.c1.ifconfig_pool_persist))) + /* write pool data to file */ + if (m->ifconfig_pool + && m->top.c1.ifconfig_pool_persist + && (force || ifconfig_pool_write_trigger(m->top.c1.ifconfig_pool_persist))) { - ifconfig_pool_write (m->top.c1.ifconfig_pool_persist, m->ifconfig_pool); + ifconfig_pool_write(m->top.c1.ifconfig_pool_persist, m->ifconfig_pool); } } static void -multi_reap_range (const struct multi_context *m, - int start_bucket, - int end_bucket) +multi_reap_range(const struct multi_context *m, + int start_bucket, + int end_bucket) { - struct gc_arena gc = gc_new (); - struct hash_iterator hi; - struct hash_element *he; + struct gc_arena gc = gc_new(); + struct hash_iterator hi; + struct hash_element *he; - if (start_bucket < 0) + if (start_bucket < 0) { - start_bucket = 0; - end_bucket = hash_n_buckets (m->vhash); + start_bucket = 0; + end_bucket = hash_n_buckets(m->vhash); } - dmsg (D_MULTI_DEBUG, "MULTI: REAP range %d -> %d", start_bucket, end_bucket); - hash_iterator_init_range (m->vhash, &hi, start_bucket, end_bucket); - while ((he = hash_iterator_next (&hi)) != NULL) + dmsg(D_MULTI_DEBUG, "MULTI: REAP range %d -> %d", start_bucket, end_bucket); + hash_iterator_init_range(m->vhash, &hi, start_bucket, end_bucket); + while ((he = hash_iterator_next(&hi)) != NULL) { - struct multi_route *r = (struct multi_route *) he->value; - if (!multi_route_defined (m, r)) - { - dmsg (D_MULTI_DEBUG, "MULTI: REAP DEL %s", - mroute_addr_print (&r->addr, &gc)); - learn_address_script (m, NULL, "delete", &r->addr); - multi_route_del (r); - hash_iterator_delete_element (&hi); - } + struct multi_route *r = (struct multi_route *) he->value; + if (!multi_route_defined(m, r)) + { + dmsg(D_MULTI_DEBUG, "MULTI: REAP DEL %s", + mroute_addr_print(&r->addr, &gc)); + learn_address_script(m, NULL, "delete", &r->addr); + multi_route_del(r); + hash_iterator_delete_element(&hi); + } } - hash_iterator_free (&hi); - gc_free (&gc); + hash_iterator_free(&hi); + gc_free(&gc); } static void -multi_reap_all (const struct multi_context *m) +multi_reap_all(const struct multi_context *m) { - multi_reap_range (m, -1, 0); + multi_reap_range(m, -1, 0); } static struct multi_reap * -multi_reap_new (int buckets_per_pass) +multi_reap_new(int buckets_per_pass) { - struct multi_reap *mr; - ALLOC_OBJ (mr, struct multi_reap); - mr->bucket_base = 0; - mr->buckets_per_pass = buckets_per_pass; - mr->last_call = now; - return mr; + struct multi_reap *mr; + ALLOC_OBJ(mr, struct multi_reap); + mr->bucket_base = 0; + mr->buckets_per_pass = buckets_per_pass; + mr->last_call = now; + return mr; } void -multi_reap_process_dowork (const struct multi_context *m) +multi_reap_process_dowork(const struct multi_context *m) { - struct multi_reap *mr = m->reaper; - if (mr->bucket_base >= hash_n_buckets (m->vhash)) - mr->bucket_base = 0; - multi_reap_range (m, mr->bucket_base, mr->bucket_base + mr->buckets_per_pass); - mr->bucket_base += mr->buckets_per_pass; - mr->last_call = now; + struct multi_reap *mr = m->reaper; + if (mr->bucket_base >= hash_n_buckets(m->vhash)) + { + mr->bucket_base = 0; + } + multi_reap_range(m, mr->bucket_base, mr->bucket_base + mr->buckets_per_pass); + mr->bucket_base += mr->buckets_per_pass; + mr->last_call = now; } static void -multi_reap_free (struct multi_reap *mr) +multi_reap_free(struct multi_reap *mr) { - free (mr); + free(mr); } /* * How many buckets in vhash to reap per pass. */ static int -reap_buckets_per_pass (int n_buckets) +reap_buckets_per_pass(int n_buckets) { - return constrain_int (n_buckets / REAP_DIVISOR, REAP_MIN, REAP_MAX); + return constrain_int(n_buckets / REAP_DIVISOR, REAP_MIN, REAP_MAX); } #ifdef MANAGEMENT_DEF_AUTH static uint32_t -cid_hash_function (const void *key, uint32_t iv) +cid_hash_function(const void *key, uint32_t iv) { - const unsigned long *k = (const unsigned long *)key; - return (uint32_t) *k; + const unsigned long *k = (const unsigned long *)key; + return (uint32_t) *k; } static bool -cid_compare_function (const void *key1, const void *key2) +cid_compare_function(const void *key1, const void *key2) { - const unsigned long *k1 = (const unsigned long *)key1; - const unsigned long *k2 = (const unsigned long *)key2; - return *k1 == *k2; + const unsigned long *k1 = (const unsigned long *)key1; + const unsigned long *k2 = (const unsigned long *)key2; + return *k1 == *k2; } #endif @@ -251,15 +275,15 @@ static uint32_t /* * inotify watcher descriptors are used as hash value */ -int_hash_function (const void *key, uint32_t iv) +int_hash_function(const void *key, uint32_t iv) { - return (unsigned long)key; + return (unsigned long)key; } static bool -int_compare_function (const void *key1, const void *key2) +int_compare_function(const void *key1, const void *key2) { - return (unsigned long)key1 == (unsigned long)key2; + return (unsigned long)key1 == (unsigned long)key2; } #endif @@ -267,216 +291,236 @@ int_compare_function (const void *key1, const void *key2) * Main initialization function, init multi_context object. */ void -multi_init (struct multi_context *m, struct context *t, bool tcp_mode, int thread_mode) -{ - int dev = DEV_TYPE_UNDEF; - - msg (D_MULTI_LOW, "MULTI: multi_init called, r=%d v=%d", - t->options.real_hash_size, - t->options.virtual_hash_size); - - /* - * Get tun/tap/null device type - */ - dev = dev_type_enum (t->options.dev, t->options.dev_type); - - /* - * Init our multi_context object. - */ - CLEAR (*m); - - m->thread_mode = thread_mode; - - /* - * Real address hash table (source port number is - * considered to be part of the address). Used - * to determine which client sent an incoming packet - * which is seen on the TCP/UDP socket. - */ - m->hash = hash_init (t->options.real_hash_size, - get_random (), - mroute_addr_hash_function, - mroute_addr_compare_function); - - /* - * Virtual address hash table. Used to determine - * which client to route a packet to. - */ - m->vhash = hash_init (t->options.virtual_hash_size, - get_random (), - mroute_addr_hash_function, - mroute_addr_compare_function); - - /* - * This hash table is a clone of m->hash but with a - * bucket size of one so that it can be used - * for fast iteration through the list. - */ - m->iter = hash_init (1, - get_random (), - mroute_addr_hash_function, - mroute_addr_compare_function); +multi_init(struct multi_context *m, struct context *t, bool tcp_mode, int thread_mode) +{ + int dev = DEV_TYPE_UNDEF; + + msg(D_MULTI_LOW, "MULTI: multi_init called, r=%d v=%d", + t->options.real_hash_size, + t->options.virtual_hash_size); + + /* + * Get tun/tap/null device type + */ + dev = dev_type_enum(t->options.dev, t->options.dev_type); + + /* + * Init our multi_context object. + */ + CLEAR(*m); + + m->thread_mode = thread_mode; + + /* + * Real address hash table (source port number is + * considered to be part of the address). Used + * to determine which client sent an incoming packet + * which is seen on the TCP/UDP socket. + */ + m->hash = hash_init(t->options.real_hash_size, + get_random(), + mroute_addr_hash_function, + mroute_addr_compare_function); + + /* + * Virtual address hash table. Used to determine + * which client to route a packet to. + */ + m->vhash = hash_init(t->options.virtual_hash_size, + get_random(), + mroute_addr_hash_function, + mroute_addr_compare_function); + + /* + * This hash table is a clone of m->hash but with a + * bucket size of one so that it can be used + * for fast iteration through the list. + */ + m->iter = hash_init(1, + get_random(), + mroute_addr_hash_function, + mroute_addr_compare_function); #ifdef MANAGEMENT_DEF_AUTH - m->cid_hash = hash_init (t->options.real_hash_size, - 0, - cid_hash_function, - cid_compare_function); + m->cid_hash = hash_init(t->options.real_hash_size, + 0, + cid_hash_function, + cid_compare_function); #endif #ifdef ENABLE_ASYNC_PUSH - /* - * Mapping between inotify watch descriptors and - * multi_instances. - */ - m->inotify_watchers = hash_init (t->options.real_hash_size, - get_random(), - int_hash_function, - int_compare_function); + /* + * Mapping between inotify watch descriptors and + * multi_instances. + */ + m->inotify_watchers = hash_init(t->options.real_hash_size, + get_random(), + int_hash_function, + int_compare_function); #endif - /* - * This is our scheduler, for time-based wakeup - * events. - */ - m->schedule = schedule_init (); - - /* - * Limit frequency of incoming connections to control - * DoS. - */ - m->new_connection_limiter = frequency_limit_init (t->options.cf_max, - t->options.cf_per); - - /* - * Allocate broadcast/multicast buffer list - */ - m->mbuf = mbuf_init (t->options.n_bcast_buf); - - /* - * Different status file format options are available - */ - m->status_file_version = t->options.status_file_version; - - /* - * Possibly allocate an ifconfig pool, do it - * differently based on whether a tun or tap style - * tunnel. - */ - if (t->options.ifconfig_pool_defined) - { - int pool_type = IFCONFIG_POOL_INDIV; - - if ( dev == DEV_TYPE_TUN && t->options.topology == TOP_NET30 ) - pool_type = IFCONFIG_POOL_30NET; - - m->ifconfig_pool = ifconfig_pool_init (pool_type, - t->options.ifconfig_pool_start, - t->options.ifconfig_pool_end, - t->options.duplicate_cn, - t->options.ifconfig_ipv6_pool_defined, - t->options.ifconfig_ipv6_pool_base, - t->options.ifconfig_ipv6_pool_netbits ); - - /* reload pool data from file */ - if (t->c1.ifconfig_pool_persist) - ifconfig_pool_read (t->c1.ifconfig_pool_persist, m->ifconfig_pool); - } - - /* - * Help us keep track of routing table. - */ - m->route_helper = mroute_helper_init (MULTI_CACHE_ROUTE_TTL); - - /* - * Initialize route and instance reaper. - */ - m->reaper = multi_reap_new (reap_buckets_per_pass (t->options.virtual_hash_size)); - - /* - * Get local ifconfig address - */ - CLEAR (m->local); - ASSERT (t->c1.tuntap); - mroute_extract_in_addr_t (&m->local, t->c1.tuntap->local); - - /* - * Per-client limits - */ - m->max_clients = t->options.max_clients; - - m->instances = calloc(m->max_clients, sizeof(struct multi_instance*)); - - /* - * Initialize multi-socket TCP I/O wait object - */ - if (tcp_mode) - m->mtcp = multi_tcp_init (t->options.max_clients, &m->max_clients); - m->tcp_queue_limit = t->options.tcp_queue_limit; - - /* - * Allow client <-> client communication, without going through - * tun/tap interface and network stack? - */ - m->enable_c2c = t->options.enable_c2c; - - /* initialize stale routes check timer */ - if (t->options.stale_routes_check_interval > 0) - { - msg (M_INFO, "Initializing stale route check timer to run every %i seconds and to removing routes with activity timeout older than %i seconds", - t->options.stale_routes_check_interval, t->options.stale_routes_ageing_time); - event_timeout_init (&m->stale_routes_check_et, t->options.stale_routes_check_interval, 0); - } - - m->deferred_shutdown_signal.signal_received = 0; + /* + * This is our scheduler, for time-based wakeup + * events. + */ + m->schedule = schedule_init(); + + /* + * Limit frequency of incoming connections to control + * DoS. + */ + m->new_connection_limiter = frequency_limit_init(t->options.cf_max, + t->options.cf_per); + + /* + * Allocate broadcast/multicast buffer list + */ + m->mbuf = mbuf_init(t->options.n_bcast_buf); + + /* + * Different status file format options are available + */ + m->status_file_version = t->options.status_file_version; + + /* + * Possibly allocate an ifconfig pool, do it + * differently based on whether a tun or tap style + * tunnel. + */ + if (t->options.ifconfig_pool_defined) + { + int pool_type = IFCONFIG_POOL_INDIV; + + if (dev == DEV_TYPE_TUN && t->options.topology == TOP_NET30) + { + pool_type = IFCONFIG_POOL_30NET; + } + + m->ifconfig_pool = ifconfig_pool_init(pool_type, + t->options.ifconfig_pool_start, + t->options.ifconfig_pool_end, + t->options.duplicate_cn, + t->options.ifconfig_ipv6_pool_defined, + t->options.ifconfig_ipv6_pool_base, + t->options.ifconfig_ipv6_pool_netbits ); + + /* reload pool data from file */ + if (t->c1.ifconfig_pool_persist) + { + ifconfig_pool_read(t->c1.ifconfig_pool_persist, m->ifconfig_pool); + } + } + + /* + * Help us keep track of routing table. + */ + m->route_helper = mroute_helper_init(MULTI_CACHE_ROUTE_TTL); + + /* + * Initialize route and instance reaper. + */ + m->reaper = multi_reap_new(reap_buckets_per_pass(t->options.virtual_hash_size)); + + /* + * Get local ifconfig address + */ + CLEAR(m->local); + ASSERT(t->c1.tuntap); + mroute_extract_in_addr_t(&m->local, t->c1.tuntap->local); + + /* + * Per-client limits + */ + m->max_clients = t->options.max_clients; + + m->instances = calloc(m->max_clients, sizeof(struct multi_instance *)); + + /* + * Initialize multi-socket TCP I/O wait object + */ + if (tcp_mode) + { + m->mtcp = multi_tcp_init(t->options.max_clients, &m->max_clients); + } + m->tcp_queue_limit = t->options.tcp_queue_limit; + + /* + * Allow client <-> client communication, without going through + * tun/tap interface and network stack? + */ + m->enable_c2c = t->options.enable_c2c; + + /* initialize stale routes check timer */ + if (t->options.stale_routes_check_interval > 0) + { + msg(M_INFO, "Initializing stale route check timer to run every %i seconds and to removing routes with activity timeout older than %i seconds", + t->options.stale_routes_check_interval, t->options.stale_routes_ageing_time); + event_timeout_init(&m->stale_routes_check_et, t->options.stale_routes_check_interval, 0); + } + + m->deferred_shutdown_signal.signal_received = 0; } const char * -multi_instance_string (const struct multi_instance *mi, bool null, struct gc_arena *gc) +multi_instance_string(const struct multi_instance *mi, bool null, struct gc_arena *gc) { - if (mi) + if (mi) { - struct buffer out = alloc_buf_gc (MULTI_PREFIX_MAX_LENGTH, gc); - const char *cn = tls_common_name (mi->context.c2.tls_multi, true); + struct buffer out = alloc_buf_gc(MULTI_PREFIX_MAX_LENGTH, gc); + const char *cn = tls_common_name(mi->context.c2.tls_multi, true); - if (cn) - buf_printf (&out, "%s/", cn); - buf_printf (&out, "%s", mroute_addr_print (&mi->real, gc)); - return BSTR (&out); + if (cn) + { + buf_printf(&out, "%s/", cn); + } + buf_printf(&out, "%s", mroute_addr_print(&mi->real, gc)); + return BSTR(&out); + } + else if (null) + { + return NULL; + } + else + { + return "UNDEF"; } - else if (null) - return NULL; - else - return "UNDEF"; } void -generate_prefix (struct multi_instance *mi) +generate_prefix(struct multi_instance *mi) { - struct gc_arena gc = gc_new(); - const char *prefix = multi_instance_string (mi, true, &gc); - if (prefix) - strncpynt(mi->msg_prefix, prefix, sizeof(mi->msg_prefix)); - else - mi->msg_prefix[0] = '\0'; - set_prefix (mi); - gc_free(&gc); + struct gc_arena gc = gc_new(); + const char *prefix = multi_instance_string(mi, true, &gc); + if (prefix) + { + strncpynt(mi->msg_prefix, prefix, sizeof(mi->msg_prefix)); + } + else + { + mi->msg_prefix[0] = '\0'; + } + set_prefix(mi); + gc_free(&gc); } void -ungenerate_prefix (struct multi_instance *mi) +ungenerate_prefix(struct multi_instance *mi) { - mi->msg_prefix[0] = '\0'; - set_prefix (mi); + mi->msg_prefix[0] = '\0'; + set_prefix(mi); } static const char * -mi_prefix (const struct multi_instance *mi) +mi_prefix(const struct multi_instance *mi) { - if (mi && mi->msg_prefix[0]) - return mi->msg_prefix; - else - return "UNDEF_I"; + if (mi && mi->msg_prefix[0]) + { + return mi->msg_prefix; + } + else + { + return "UNDEF_I"; + } } /* @@ -485,219 +529,233 @@ mi_prefix (const struct multi_instance *mi) * CIDR netlengths. */ static void -multi_del_iroutes (struct multi_context *m, - struct multi_instance *mi) +multi_del_iroutes(struct multi_context *m, + struct multi_instance *mi) { - const struct iroute *ir; - const struct iroute_ipv6 *ir6; - if (TUNNEL_TYPE (mi->context.c1.tuntap) == DEV_TYPE_TUN) + const struct iroute *ir; + const struct iroute_ipv6 *ir6; + if (TUNNEL_TYPE(mi->context.c1.tuntap) == DEV_TYPE_TUN) { - for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next) - mroute_helper_del_iroute46 (m->route_helper, ir->netbits); + for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next) + mroute_helper_del_iroute46(m->route_helper, ir->netbits); - for ( ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next ) - mroute_helper_del_iroute46 (m->route_helper, ir6->netbits); + for (ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next) + mroute_helper_del_iroute46(m->route_helper, ir6->netbits); } } static void -setenv_stats (struct context *c) +setenv_stats(struct context *c) { - setenv_counter (c->c2.es, "bytes_received", c->c2.link_read_bytes); - setenv_counter (c->c2.es, "bytes_sent", c->c2.link_write_bytes); + setenv_counter(c->c2.es, "bytes_received", c->c2.link_read_bytes); + setenv_counter(c->c2.es, "bytes_sent", c->c2.link_write_bytes); } static void -multi_client_disconnect_setenv (struct multi_context *m, - struct multi_instance *mi) +multi_client_disconnect_setenv(struct multi_context *m, + struct multi_instance *mi) { - /* setenv client real IP address */ - setenv_trusted (mi->context.c2.es, get_link_socket_info (&mi->context)); + /* setenv client real IP address */ + setenv_trusted(mi->context.c2.es, get_link_socket_info(&mi->context)); - /* setenv stats */ - setenv_stats (&mi->context); + /* setenv stats */ + setenv_stats(&mi->context); - /* setenv connection duration */ - { - const unsigned int duration = (unsigned int) now - mi->created; - setenv_unsigned (mi->context.c2.es, "time_duration", duration); - } + /* setenv connection duration */ + { + const unsigned int duration = (unsigned int) now - mi->created; + setenv_unsigned(mi->context.c2.es, "time_duration", duration); + } } static void -multi_client_disconnect_script (struct multi_context *m, - struct multi_instance *mi) -{ - if ((mi->context.c2.context_auth == CAS_SUCCEEDED && mi->connection_established_flag) - || mi->context.c2.context_auth == CAS_PARTIAL) - { - multi_client_disconnect_setenv (m, mi); - - if (plugin_defined (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_DISCONNECT)) - { - if (plugin_call (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_DISCONNECT, NULL, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) - msg (M_WARN, "WARNING: client-disconnect plugin call failed"); - } - - if (mi->context.options.client_disconnect_script) - { - struct argv argv = argv_new (); - setenv_str (mi->context.c2.es, "script_type", "client-disconnect"); - argv_parse_cmd (&argv, mi->context.options.client_disconnect_script); - openvpn_run_script (&argv, mi->context.c2.es, 0, "--client-disconnect"); - argv_reset (&argv); - } +multi_client_disconnect_script(struct multi_context *m, + struct multi_instance *mi) +{ + if ((mi->context.c2.context_auth == CAS_SUCCEEDED && mi->connection_established_flag) + || mi->context.c2.context_auth == CAS_PARTIAL) + { + multi_client_disconnect_setenv(m, mi); + + if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_DISCONNECT)) + { + if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_DISCONNECT, NULL, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) + { + msg(M_WARN, "WARNING: client-disconnect plugin call failed"); + } + } + + if (mi->context.options.client_disconnect_script) + { + struct argv argv = argv_new(); + setenv_str(mi->context.c2.es, "script_type", "client-disconnect"); + argv_parse_cmd(&argv, mi->context.options.client_disconnect_script); + openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-disconnect"); + argv_reset(&argv); + } #ifdef MANAGEMENT_DEF_AUTH - if (management) - management_notify_client_close (management, &mi->context.c2.mda_context, mi->context.c2.es); + if (management) + { + management_notify_client_close(management, &mi->context.c2.mda_context, mi->context.c2.es); + } #endif } } void -multi_close_instance (struct multi_context *m, - struct multi_instance *mi, - bool shutdown) -{ - perf_push (PERF_MULTI_CLOSE_INSTANCE); - - ASSERT (!mi->halt); - mi->halt = true; - - dmsg (D_MULTI_DEBUG, "MULTI: multi_close_instance called"); - - /* adjust current client connection count */ - m->n_clients += mi->n_clients_delta; - update_mstat_n_clients(m->n_clients); - mi->n_clients_delta = 0; - - /* prevent dangling pointers */ - if (m->pending == mi) - multi_set_pending (m, NULL); - if (m->earliest_wakeup == mi) - m->earliest_wakeup = NULL; - - if (!shutdown) - { - if (mi->did_real_hash) - { - ASSERT (hash_remove (m->hash, &mi->real)); - } - if (mi->did_iter) - { - ASSERT (hash_remove (m->iter, &mi->real)); - } +multi_close_instance(struct multi_context *m, + struct multi_instance *mi, + bool shutdown) +{ + perf_push(PERF_MULTI_CLOSE_INSTANCE); + + ASSERT(!mi->halt); + mi->halt = true; + + dmsg(D_MULTI_DEBUG, "MULTI: multi_close_instance called"); + + /* adjust current client connection count */ + m->n_clients += mi->n_clients_delta; + update_mstat_n_clients(m->n_clients); + mi->n_clients_delta = 0; + + /* prevent dangling pointers */ + if (m->pending == mi) + { + multi_set_pending(m, NULL); + } + if (m->earliest_wakeup == mi) + { + m->earliest_wakeup = NULL; + } + + if (!shutdown) + { + if (mi->did_real_hash) + { + ASSERT(hash_remove(m->hash, &mi->real)); + } + if (mi->did_iter) + { + ASSERT(hash_remove(m->iter, &mi->real)); + } #ifdef MANAGEMENT_DEF_AUTH - if (mi->did_cid_hash) - { - ASSERT (hash_remove (m->cid_hash, &mi->context.c2.mda_context.cid)); - } + if (mi->did_cid_hash) + { + ASSERT(hash_remove(m->cid_hash, &mi->context.c2.mda_context.cid)); + } #endif #ifdef ENABLE_ASYNC_PUSH - if (mi->inotify_watch != -1) - { - hash_remove(m->inotify_watchers, (void*) (unsigned long)mi->inotify_watch); - mi->inotify_watch = -1; - } + if (mi->inotify_watch != -1) + { + hash_remove(m->inotify_watchers, (void *) (unsigned long)mi->inotify_watch); + mi->inotify_watch = -1; + } #endif - if (mi->context.c2.tls_multi->peer_id != MAX_PEER_ID) - m->instances[mi->context.c2.tls_multi->peer_id] = NULL; + if (mi->context.c2.tls_multi->peer_id != MAX_PEER_ID) + { + m->instances[mi->context.c2.tls_multi->peer_id] = NULL; + } - schedule_remove_entry (m->schedule, (struct schedule_entry *) mi); + schedule_remove_entry(m->schedule, (struct schedule_entry *) mi); - ifconfig_pool_release (m->ifconfig_pool, mi->vaddr_handle, false); - - if (mi->did_iroutes) + ifconfig_pool_release(m->ifconfig_pool, mi->vaddr_handle, false); + + if (mi->did_iroutes) { - multi_del_iroutes (m, mi); - mi->did_iroutes = false; + multi_del_iroutes(m, mi); + mi->did_iroutes = false; } - if (m->mtcp) - multi_tcp_dereference_instance (m->mtcp, mi); + if (m->mtcp) + { + multi_tcp_dereference_instance(m->mtcp, mi); + } - mbuf_dereference_instance (m->mbuf, mi); + mbuf_dereference_instance(m->mbuf, mi); } #ifdef MANAGEMENT_DEF_AUTH - set_cc_config (mi, NULL); + set_cc_config(mi, NULL); #endif - multi_client_disconnect_script (m, mi); + multi_client_disconnect_script(m, mi); - if (mi->did_open_context) - close_context (&mi->context, SIGTERM, CC_GC_FREE); + if (mi->did_open_context) + { + close_context(&mi->context, SIGTERM, CC_GC_FREE); + } - multi_tcp_instance_specific_free (mi); + multi_tcp_instance_specific_free(mi); - ungenerate_prefix (mi); + ungenerate_prefix(mi); - /* - * Don't actually delete the instance memory allocation yet, - * because virtual routes may still point to it. Let the - * vhash reaper deal with it. - */ - multi_instance_dec_refcount (mi); + /* + * Don't actually delete the instance memory allocation yet, + * because virtual routes may still point to it. Let the + * vhash reaper deal with it. + */ + multi_instance_dec_refcount(mi); - perf_pop (); + perf_pop(); } /* * Called on shutdown or restart. */ void -multi_uninit (struct multi_context *m) +multi_uninit(struct multi_context *m) { - if (m->thread_mode & MC_WORK_THREAD) + if (m->thread_mode & MC_WORK_THREAD) { - multi_top_free (m); - m->thread_mode = MC_UNDEF; + multi_top_free(m); + m->thread_mode = MC_UNDEF; } - else if (m->thread_mode) + else if (m->thread_mode) { - if (m->hash) - { - struct hash_iterator hi; - struct hash_element *he; - - hash_iterator_init (m->iter, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct multi_instance *mi = (struct multi_instance *) he->value; - mi->did_iter = false; - multi_close_instance (m, mi, true); - } - hash_iterator_free (&hi); - - multi_reap_all (m); - - hash_free (m->hash); - hash_free (m->vhash); - hash_free (m->iter); + if (m->hash) + { + struct hash_iterator hi; + struct hash_element *he; + + hash_iterator_init(m->iter, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct multi_instance *mi = (struct multi_instance *) he->value; + mi->did_iter = false; + multi_close_instance(m, mi, true); + } + hash_iterator_free(&hi); + + multi_reap_all(m); + + hash_free(m->hash); + hash_free(m->vhash); + hash_free(m->iter); #ifdef MANAGEMENT_DEF_AUTH - hash_free (m->cid_hash); + hash_free(m->cid_hash); #endif - m->hash = NULL; + m->hash = NULL; - free(m->instances); + free(m->instances); #ifdef ENABLE_ASYNC_PUSH - hash_free (m->inotify_watchers); - m->inotify_watchers = NULL; + hash_free(m->inotify_watchers); + m->inotify_watchers = NULL; #endif - schedule_free (m->schedule); - mbuf_free (m->mbuf); - ifconfig_pool_free (m->ifconfig_pool); - frequency_limit_free (m->new_connection_limiter); - multi_reap_free (m->reaper); - mroute_helper_free (m->route_helper); - multi_tcp_free (m->mtcp); - m->thread_mode = MC_UNDEF; - } + schedule_free(m->schedule); + mbuf_free(m->mbuf); + ifconfig_pool_free(m->ifconfig_pool); + frequency_limit_free(m->new_connection_limiter); + multi_reap_free(m->reaper); + mroute_helper_free(m->route_helper); + multi_tcp_free(m->mtcp); + m->thread_mode = MC_UNDEF; + } } } @@ -705,86 +763,90 @@ multi_uninit (struct multi_context *m) * Create a client instance object for a newly connected client. */ struct multi_instance * -multi_create_instance (struct multi_context *m, const struct mroute_addr *real) +multi_create_instance(struct multi_context *m, const struct mroute_addr *real) { - struct gc_arena gc = gc_new (); - struct multi_instance *mi; + struct gc_arena gc = gc_new(); + struct multi_instance *mi; - perf_push (PERF_MULTI_CREATE_INSTANCE); + perf_push(PERF_MULTI_CREATE_INSTANCE); - msg (D_MULTI_MEDIUM, "MULTI: multi_create_instance called"); + msg(D_MULTI_MEDIUM, "MULTI: multi_create_instance called"); - ALLOC_OBJ_CLEAR (mi, struct multi_instance); + ALLOC_OBJ_CLEAR(mi, struct multi_instance); - mi->gc = gc_new (); - multi_instance_inc_refcount (mi); - mi->vaddr_handle = -1; - mi->created = now; - mroute_addr_init (&mi->real); + mi->gc = gc_new(); + multi_instance_inc_refcount(mi); + mi->vaddr_handle = -1; + mi->created = now; + mroute_addr_init(&mi->real); - if (real) + if (real) { - mi->real = *real; - generate_prefix (mi); + mi->real = *real; + generate_prefix(mi); } - mi->did_open_context = true; - inherit_context_child (&mi->context, &m->top); - if (IS_SIG (&mi->context)) - goto err; + mi->did_open_context = true; + inherit_context_child(&mi->context, &m->top); + if (IS_SIG(&mi->context)) + { + goto err; + } - mi->context.c2.context_auth = CAS_PENDING; + mi->context.c2.context_auth = CAS_PENDING; - if (hash_n_elements (m->hash) >= m->max_clients) + if (hash_n_elements(m->hash) >= m->max_clients) { - msg (D_MULTI_ERRORS, "MULTI: new incoming connection would exceed maximum number of clients (%d)", m->max_clients); - goto err; + msg(D_MULTI_ERRORS, "MULTI: new incoming connection would exceed maximum number of clients (%d)", m->max_clients); + goto err; } - if (!real) /* TCP mode? */ + if (!real) /* TCP mode? */ { - if (!multi_tcp_instance_specific_init (m, mi)) - goto err; - generate_prefix (mi); + if (!multi_tcp_instance_specific_init(m, mi)) + { + goto err; + } + generate_prefix(mi); } - if (!hash_add (m->iter, &mi->real, mi, false)) + if (!hash_add(m->iter, &mi->real, mi, false)) { - msg (D_MULTI_LOW, "MULTI: unable to add real address [%s] to iterator hash table", - mroute_addr_print (&mi->real, &gc)); - goto err; + msg(D_MULTI_LOW, "MULTI: unable to add real address [%s] to iterator hash table", + mroute_addr_print(&mi->real, &gc)); + goto err; } - mi->did_iter = true; + mi->did_iter = true; #ifdef MANAGEMENT_DEF_AUTH - do { - mi->context.c2.mda_context.cid = m->cid_counter++; - } while (!hash_add (m->cid_hash, &mi->context.c2.mda_context.cid, mi, false)); - mi->did_cid_hash = true; + do { + mi->context.c2.mda_context.cid = m->cid_counter++; + } while (!hash_add(m->cid_hash, &mi->context.c2.mda_context.cid, mi, false)); + mi->did_cid_hash = true; #endif - mi->context.c2.push_reply_deferred = true; + mi->context.c2.push_reply_deferred = true; #ifdef ENABLE_ASYNC_PUSH - mi->context.c2.push_request_received = false; - mi->inotify_watch = -1; + mi->context.c2.push_request_received = false; + mi->inotify_watch = -1; #endif - if (!multi_process_post (m, mi, MPP_PRE_SELECT)) + if (!multi_process_post(m, mi, MPP_PRE_SELECT)) { - msg (D_MULTI_ERRORS, "MULTI: signal occurred during client instance initialization"); - goto err; + msg(D_MULTI_ERRORS, "MULTI: signal occurred during client instance initialization"); + goto err; } - perf_pop (); - gc_free (&gc); - return mi; + perf_pop(); + gc_free(&gc); + return mi; - err: - multi_close_instance (m, mi, false); - perf_pop (); - gc_free (&gc); - return NULL; +err: + multi_close_instance(m, mi, false); + perf_pop(); + gc_free(&gc); + return NULL; } /* @@ -793,194 +855,202 @@ multi_create_instance (struct multi_context *m, const struct mroute_addr *real) * If status file is NULL, write to syslog. */ void -multi_print_status (struct multi_context *m, struct status_output *so, const int version) -{ - if (m->hash) - { - struct gc_arena gc_top = gc_new (); - struct hash_iterator hi; - const struct hash_element *he; - - status_reset (so); - - if (version == 1) /* WAS: m->status_file_version */ - { - /* - * Status file version 1 - */ - status_printf (so, "OpenVPN CLIENT LIST"); - status_printf (so, "Updated,%s", time_string (0, 0, false, &gc_top)); - status_printf (so, "Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since"); - hash_iterator_init (m->hash, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct gc_arena gc = gc_new (); - const struct multi_instance *mi = (struct multi_instance *) he->value; - - if (!mi->halt) - { - status_printf (so, "%s,%s," counter_format "," counter_format ",%s", - tls_common_name (mi->context.c2.tls_multi, false), - mroute_addr_print (&mi->real, &gc), - mi->context.c2.link_read_bytes, - mi->context.c2.link_write_bytes, - time_string (mi->created, 0, false, &gc)); - } - gc_free (&gc); - } - hash_iterator_free (&hi); - - status_printf (so, "ROUTING TABLE"); - status_printf (so, "Virtual Address,Common Name,Real Address,Last Ref"); - hash_iterator_init (m->vhash, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct gc_arena gc = gc_new (); - const struct multi_route *route = (struct multi_route *) he->value; - - if (multi_route_defined (m, route)) - { - const struct multi_instance *mi = route->instance; - const struct mroute_addr *ma = &route->addr; - char flags[2] = {0, 0}; - - if (route->flags & MULTI_ROUTE_CACHE) - flags[0] = 'C'; - status_printf (so, "%s%s,%s,%s,%s", - mroute_addr_print (ma, &gc), - flags, - tls_common_name (mi->context.c2.tls_multi, false), - mroute_addr_print (&mi->real, &gc), - time_string (route->last_reference, 0, false, &gc)); - } - gc_free (&gc); - } - hash_iterator_free (&hi); - - status_printf (so, "GLOBAL STATS"); - if (m->mbuf) - status_printf (so, "Max bcast/mcast queue length,%d", - mbuf_maximum_queued (m->mbuf)); - - status_printf (so, "END"); - } - else if (version == 2 || version == 3) - { - const char sep = (version == 3) ? '\t' : ','; - - /* - * Status file version 2 and 3 - */ - status_printf (so, "TITLE%c%s", sep, title_string); - status_printf (so, "TIME%c%s%c%u", sep, time_string (now, 0, false, &gc_top), sep, (unsigned int)now); - status_printf (so, "HEADER%cCLIENT_LIST%cCommon Name%cReal Address%cVirtual Address%cVirtual IPv6 Address%cBytes Received%cBytes Sent%cConnected Since%cConnected Since (time_t)%cUsername%cClient ID%cPeer ID", - sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep); - hash_iterator_init (m->hash, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct gc_arena gc = gc_new (); - const struct multi_instance *mi = (struct multi_instance *) he->value; - - if (!mi->halt) - { - status_printf (so, "CLIENT_LIST%c%s%c%s%c%s%c%s%c" counter_format "%c" counter_format "%c%s%c%u%c%s%c" +multi_print_status(struct multi_context *m, struct status_output *so, const int version) +{ + if (m->hash) + { + struct gc_arena gc_top = gc_new(); + struct hash_iterator hi; + const struct hash_element *he; + + status_reset(so); + + if (version == 1) /* WAS: m->status_file_version */ + { + /* + * Status file version 1 + */ + status_printf(so, "OpenVPN CLIENT LIST"); + status_printf(so, "Updated,%s", time_string(0, 0, false, &gc_top)); + status_printf(so, "Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since"); + hash_iterator_init(m->hash, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct gc_arena gc = gc_new(); + const struct multi_instance *mi = (struct multi_instance *) he->value; + + if (!mi->halt) + { + status_printf(so, "%s,%s," counter_format "," counter_format ",%s", + tls_common_name(mi->context.c2.tls_multi, false), + mroute_addr_print(&mi->real, &gc), + mi->context.c2.link_read_bytes, + mi->context.c2.link_write_bytes, + time_string(mi->created, 0, false, &gc)); + } + gc_free(&gc); + } + hash_iterator_free(&hi); + + status_printf(so, "ROUTING TABLE"); + status_printf(so, "Virtual Address,Common Name,Real Address,Last Ref"); + hash_iterator_init(m->vhash, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct gc_arena gc = gc_new(); + const struct multi_route *route = (struct multi_route *) he->value; + + if (multi_route_defined(m, route)) + { + const struct multi_instance *mi = route->instance; + const struct mroute_addr *ma = &route->addr; + char flags[2] = {0, 0}; + + if (route->flags & MULTI_ROUTE_CACHE) + { + flags[0] = 'C'; + } + status_printf(so, "%s%s,%s,%s,%s", + mroute_addr_print(ma, &gc), + flags, + tls_common_name(mi->context.c2.tls_multi, false), + mroute_addr_print(&mi->real, &gc), + time_string(route->last_reference, 0, false, &gc)); + } + gc_free(&gc); + } + hash_iterator_free(&hi); + + status_printf(so, "GLOBAL STATS"); + if (m->mbuf) + { + status_printf(so, "Max bcast/mcast queue length,%d", + mbuf_maximum_queued(m->mbuf)); + } + + status_printf(so, "END"); + } + else if (version == 2 || version == 3) + { + const char sep = (version == 3) ? '\t' : ','; + + /* + * Status file version 2 and 3 + */ + status_printf(so, "TITLE%c%s", sep, title_string); + status_printf(so, "TIME%c%s%c%u", sep, time_string(now, 0, false, &gc_top), sep, (unsigned int)now); + status_printf(so, "HEADER%cCLIENT_LIST%cCommon Name%cReal Address%cVirtual Address%cVirtual IPv6 Address%cBytes Received%cBytes Sent%cConnected Since%cConnected Since (time_t)%cUsername%cClient ID%cPeer ID", + sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep, sep); + hash_iterator_init(m->hash, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct gc_arena gc = gc_new(); + const struct multi_instance *mi = (struct multi_instance *) he->value; + + if (!mi->halt) + { + status_printf(so, "CLIENT_LIST%c%s%c%s%c%s%c%s%c" counter_format "%c" counter_format "%c%s%c%u%c%s%c" #ifdef MANAGEMENT_DEF_AUTH - "%lu" + "%lu" #else - "" + "" #endif - "%c%"PRIu32, - sep, tls_common_name (mi->context.c2.tls_multi, false), - sep, mroute_addr_print (&mi->real, &gc), - sep, print_in_addr_t (mi->reporting_addr, IA_EMPTY_IF_UNDEF, &gc), - sep, print_in6_addr (mi->reporting_addr_ipv6, IA_EMPTY_IF_UNDEF, &gc), - sep, mi->context.c2.link_read_bytes, - sep, mi->context.c2.link_write_bytes, - sep, time_string (mi->created, 0, false, &gc), - sep, (unsigned int)mi->created, - sep, tls_username (mi->context.c2.tls_multi, false), + "%c%" PRIu32, + sep, tls_common_name(mi->context.c2.tls_multi, false), + sep, mroute_addr_print(&mi->real, &gc), + sep, print_in_addr_t(mi->reporting_addr, IA_EMPTY_IF_UNDEF, &gc), + sep, print_in6_addr(mi->reporting_addr_ipv6, IA_EMPTY_IF_UNDEF, &gc), + sep, mi->context.c2.link_read_bytes, + sep, mi->context.c2.link_write_bytes, + sep, time_string(mi->created, 0, false, &gc), + sep, (unsigned int)mi->created, + sep, tls_username(mi->context.c2.tls_multi, false), #ifdef MANAGEMENT_DEF_AUTH - sep, mi->context.c2.mda_context.cid, + sep, mi->context.c2.mda_context.cid, #else - sep, + sep, #endif - sep, mi->context.c2.tls_multi ? mi->context.c2.tls_multi->peer_id : UINT32_MAX); - } - gc_free (&gc); - } - hash_iterator_free (&hi); - - status_printf (so, "HEADER%cROUTING_TABLE%cVirtual Address%cCommon Name%cReal Address%cLast Ref%cLast Ref (time_t)", - sep, sep, sep, sep, sep, sep); - hash_iterator_init (m->vhash, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct gc_arena gc = gc_new (); - const struct multi_route *route = (struct multi_route *) he->value; - - if (multi_route_defined (m, route)) - { - const struct multi_instance *mi = route->instance; - const struct mroute_addr *ma = &route->addr; - char flags[2] = {0, 0}; - - if (route->flags & MULTI_ROUTE_CACHE) - flags[0] = 'C'; - status_printf (so, "ROUTING_TABLE%c%s%s%c%s%c%s%c%s%c%u", - sep, mroute_addr_print (ma, &gc), flags, - sep, tls_common_name (mi->context.c2.tls_multi, false), - sep, mroute_addr_print (&mi->real, &gc), - sep, time_string (route->last_reference, 0, false, &gc), - sep, (unsigned int)route->last_reference); - } - gc_free (&gc); - } - hash_iterator_free (&hi); - - if (m->mbuf) - status_printf (so, "GLOBAL_STATS%cMax bcast/mcast queue length%c%d", - sep, sep, mbuf_maximum_queued (m->mbuf)); - - status_printf (so, "END"); - } - else - { - status_printf (so, "ERROR: bad status format version number"); - } + sep, mi->context.c2.tls_multi ? mi->context.c2.tls_multi->peer_id : UINT32_MAX); + } + gc_free(&gc); + } + hash_iterator_free(&hi); + + status_printf(so, "HEADER%cROUTING_TABLE%cVirtual Address%cCommon Name%cReal Address%cLast Ref%cLast Ref (time_t)", + sep, sep, sep, sep, sep, sep); + hash_iterator_init(m->vhash, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct gc_arena gc = gc_new(); + const struct multi_route *route = (struct multi_route *) he->value; + + if (multi_route_defined(m, route)) + { + const struct multi_instance *mi = route->instance; + const struct mroute_addr *ma = &route->addr; + char flags[2] = {0, 0}; + + if (route->flags & MULTI_ROUTE_CACHE) + { + flags[0] = 'C'; + } + status_printf(so, "ROUTING_TABLE%c%s%s%c%s%c%s%c%s%c%u", + sep, mroute_addr_print(ma, &gc), flags, + sep, tls_common_name(mi->context.c2.tls_multi, false), + sep, mroute_addr_print(&mi->real, &gc), + sep, time_string(route->last_reference, 0, false, &gc), + sep, (unsigned int)route->last_reference); + } + gc_free(&gc); + } + hash_iterator_free(&hi); + + if (m->mbuf) + { + status_printf(so, "GLOBAL_STATS%cMax bcast/mcast queue length%c%d", + sep, sep, mbuf_maximum_queued(m->mbuf)); + } + + status_printf(so, "END"); + } + else + { + status_printf(so, "ERROR: bad status format version number"); + } #ifdef PACKET_TRUNCATION_CHECK - { - status_printf (so, "HEADER,ERRORS,Common Name,TUN Read Trunc,TUN Write Trunc,Pre-encrypt Trunc,Post-decrypt Trunc"); - hash_iterator_init (m->hash, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct gc_arena gc = gc_new (); - const struct multi_instance *mi = (struct multi_instance *) he->value; - - if (!mi->halt) - { - status_printf (so, "ERRORS,%s," counter_format "," counter_format "," counter_format "," counter_format, - tls_common_name (mi->context.c2.tls_multi, false), - m->top.c2.n_trunc_tun_read, - mi->context.c2.n_trunc_tun_write, - mi->context.c2.n_trunc_pre_encrypt, - mi->context.c2.n_trunc_post_decrypt); - } - gc_free (&gc); - } - hash_iterator_free (&hi); - } -#endif + { + status_printf(so, "HEADER,ERRORS,Common Name,TUN Read Trunc,TUN Write Trunc,Pre-encrypt Trunc,Post-decrypt Trunc"); + hash_iterator_init(m->hash, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct gc_arena gc = gc_new(); + const struct multi_instance *mi = (struct multi_instance *) he->value; + + if (!mi->halt) + { + status_printf(so, "ERRORS,%s," counter_format "," counter_format "," counter_format "," counter_format, + tls_common_name(mi->context.c2.tls_multi, false), + m->top.c2.n_trunc_tun_read, + mi->context.c2.n_trunc_tun_write, + mi->context.c2.n_trunc_pre_encrypt, + mi->context.c2.n_trunc_post_decrypt); + } + gc_free(&gc); + } + hash_iterator_free(&hi); + } +#endif /* ifdef PACKET_TRUNCATION_CHECK */ - status_flush (so); - gc_free (&gc_top); + status_flush(so); + gc_free(&gc_top); } #ifdef ENABLE_ASYNC_PUSH - if (m->inotify_watchers) - { - msg (D_MULTI_DEBUG, "inotify watchers count: %d\n", hash_n_elements(m->inotify_watchers)); - } + if (m->inotify_watchers) + { + msg(D_MULTI_DEBUG, "inotify watchers count: %d\n", hash_n_elements(m->inotify_watchers)); + } #endif } @@ -993,229 +1063,243 @@ multi_print_status (struct multi_context *m, struct status_output *so, const int * or NULL if none. */ static struct multi_instance * -multi_learn_addr (struct multi_context *m, - struct multi_instance *mi, - const struct mroute_addr *addr, - const unsigned int flags) -{ - struct hash_element *he; - const uint32_t hv = hash_value (m->vhash, addr); - struct hash_bucket *bucket = hash_bucket (m->vhash, hv); - struct multi_route *oldroute = NULL; - struct multi_instance *owner = NULL; - - /* if route currently exists, get the instance which owns it */ - he = hash_lookup_fast (m->vhash, bucket, addr, hv); - if (he) - oldroute = (struct multi_route *) he->value; - if (oldroute && multi_route_defined (m, oldroute)) - owner = oldroute->instance; - - /* do we need to add address to hash table? */ - if ((!owner || owner != mi) - && mroute_learnable_address (addr) - && !mroute_addr_equal (addr, &m->local)) - { - struct gc_arena gc = gc_new (); - struct multi_route *newroute; - bool learn_succeeded = false; - - ALLOC_OBJ (newroute, struct multi_route); - newroute->addr = *addr; - newroute->instance = mi; - newroute->flags = flags; - newroute->last_reference = now; - newroute->cache_generation = 0; - - /* The cache is invalidated when cache_generation is incremented */ - if (flags & MULTI_ROUTE_CACHE) - newroute->cache_generation = m->route_helper->cache_generation; - - if (oldroute) /* route already exists? */ - { - if (route_quota_test (m, mi) && learn_address_script (m, mi, "update", &newroute->addr)) - { - learn_succeeded = true; - owner = mi; - multi_instance_inc_refcount (mi); - route_quota_inc (mi); - - /* delete old route */ - multi_route_del (oldroute); - - /* modify hash table entry, replacing old route */ - he->key = &newroute->addr; - he->value = newroute; - } - } - else - { - if (route_quota_test (m, mi) && learn_address_script (m, mi, "add", &newroute->addr)) - { - learn_succeeded = true; - owner = mi; - multi_instance_inc_refcount (mi); - route_quota_inc (mi); - - /* add new route */ - hash_add_fast (m->vhash, bucket, &newroute->addr, hv, newroute); - } - } - - msg (D_MULTI_LOW, "MULTI: Learn%s: %s -> %s", - learn_succeeded ? "" : " FAILED", - mroute_addr_print (&newroute->addr, &gc), - multi_instance_string (mi, false, &gc)); - - if (!learn_succeeded) - free (newroute); - - gc_free (&gc); - } - - return owner; +multi_learn_addr(struct multi_context *m, + struct multi_instance *mi, + const struct mroute_addr *addr, + const unsigned int flags) +{ + struct hash_element *he; + const uint32_t hv = hash_value(m->vhash, addr); + struct hash_bucket *bucket = hash_bucket(m->vhash, hv); + struct multi_route *oldroute = NULL; + struct multi_instance *owner = NULL; + + /* if route currently exists, get the instance which owns it */ + he = hash_lookup_fast(m->vhash, bucket, addr, hv); + if (he) + { + oldroute = (struct multi_route *) he->value; + } + if (oldroute && multi_route_defined(m, oldroute)) + { + owner = oldroute->instance; + } + + /* do we need to add address to hash table? */ + if ((!owner || owner != mi) + && mroute_learnable_address(addr) + && !mroute_addr_equal(addr, &m->local)) + { + struct gc_arena gc = gc_new(); + struct multi_route *newroute; + bool learn_succeeded = false; + + ALLOC_OBJ(newroute, struct multi_route); + newroute->addr = *addr; + newroute->instance = mi; + newroute->flags = flags; + newroute->last_reference = now; + newroute->cache_generation = 0; + + /* The cache is invalidated when cache_generation is incremented */ + if (flags & MULTI_ROUTE_CACHE) + { + newroute->cache_generation = m->route_helper->cache_generation; + } + + if (oldroute) /* route already exists? */ + { + if (route_quota_test(m, mi) && learn_address_script(m, mi, "update", &newroute->addr)) + { + learn_succeeded = true; + owner = mi; + multi_instance_inc_refcount(mi); + route_quota_inc(mi); + + /* delete old route */ + multi_route_del(oldroute); + + /* modify hash table entry, replacing old route */ + he->key = &newroute->addr; + he->value = newroute; + } + } + else + { + if (route_quota_test(m, mi) && learn_address_script(m, mi, "add", &newroute->addr)) + { + learn_succeeded = true; + owner = mi; + multi_instance_inc_refcount(mi); + route_quota_inc(mi); + + /* add new route */ + hash_add_fast(m->vhash, bucket, &newroute->addr, hv, newroute); + } + } + + msg(D_MULTI_LOW, "MULTI: Learn%s: %s -> %s", + learn_succeeded ? "" : " FAILED", + mroute_addr_print(&newroute->addr, &gc), + multi_instance_string(mi, false, &gc)); + + if (!learn_succeeded) + { + free(newroute); + } + + gc_free(&gc); + } + + return owner; } /* * Get client instance based on virtual address. */ static struct multi_instance * -multi_get_instance_by_virtual_addr (struct multi_context *m, - const struct mroute_addr *addr, - bool cidr_routing) +multi_get_instance_by_virtual_addr(struct multi_context *m, + const struct mroute_addr *addr, + bool cidr_routing) { - struct multi_route *route; - struct multi_instance *ret = NULL; + struct multi_route *route; + struct multi_instance *ret = NULL; - /* check for local address */ - if (mroute_addr_equal (addr, &m->local)) - return NULL; + /* check for local address */ + if (mroute_addr_equal(addr, &m->local)) + { + return NULL; + } - route = (struct multi_route *) hash_lookup (m->vhash, addr); + route = (struct multi_route *) hash_lookup(m->vhash, addr); - /* does host route (possible cached) exist? */ - if (route && multi_route_defined (m, route)) + /* does host route (possible cached) exist? */ + if (route && multi_route_defined(m, route)) { - struct multi_instance *mi = route->instance; - route->last_reference = now; - ret = mi; + struct multi_instance *mi = route->instance; + route->last_reference = now; + ret = mi; } - else if (cidr_routing) /* do we need to regenerate a host route cache entry? */ + else if (cidr_routing) /* do we need to regenerate a host route cache entry? */ { - struct mroute_helper *rh = m->route_helper; - struct mroute_addr tryaddr; - int i; - - /* cycle through each CIDR length */ - for (i = 0; i < rh->n_net_len; ++i) - { - tryaddr = *addr; - tryaddr.type |= MR_WITH_NETBITS; - tryaddr.netbits = rh->net_len[i]; - mroute_addr_mask_host_bits (&tryaddr); + struct mroute_helper *rh = m->route_helper; + struct mroute_addr tryaddr; + int i; - /* look up a possible route with netbits netmask */ - route = (struct multi_route *) hash_lookup (m->vhash, &tryaddr); - - if (route && multi_route_defined (m, route)) - { - /* found an applicable route, cache host route */ - struct multi_instance *mi = route->instance; - multi_learn_addr (m, mi, addr, MULTI_ROUTE_CACHE|MULTI_ROUTE_AGEABLE); - ret = mi; - break; - } - } + /* cycle through each CIDR length */ + for (i = 0; i < rh->n_net_len; ++i) + { + tryaddr = *addr; + tryaddr.type |= MR_WITH_NETBITS; + tryaddr.netbits = rh->net_len[i]; + mroute_addr_mask_host_bits(&tryaddr); + + /* look up a possible route with netbits netmask */ + route = (struct multi_route *) hash_lookup(m->vhash, &tryaddr); + + if (route && multi_route_defined(m, route)) + { + /* found an applicable route, cache host route */ + struct multi_instance *mi = route->instance; + multi_learn_addr(m, mi, addr, MULTI_ROUTE_CACHE|MULTI_ROUTE_AGEABLE); + ret = mi; + break; + } + } } - + #ifdef ENABLE_DEBUG - if (check_debug_level (D_MULTI_DEBUG)) - { - struct gc_arena gc = gc_new (); - const char *addr_text = mroute_addr_print (addr, &gc); - if (ret) - { - dmsg (D_MULTI_DEBUG, "GET INST BY VIRT: %s -> %s via %s", - addr_text, - multi_instance_string (ret, false, &gc), - mroute_addr_print (&route->addr, &gc)); - } - else - { - dmsg (D_MULTI_DEBUG, "GET INST BY VIRT: %s [failed]", - addr_text); - } - gc_free (&gc); + if (check_debug_level(D_MULTI_DEBUG)) + { + struct gc_arena gc = gc_new(); + const char *addr_text = mroute_addr_print(addr, &gc); + if (ret) + { + dmsg(D_MULTI_DEBUG, "GET INST BY VIRT: %s -> %s via %s", + addr_text, + multi_instance_string(ret, false, &gc), + mroute_addr_print(&route->addr, &gc)); + } + else + { + dmsg(D_MULTI_DEBUG, "GET INST BY VIRT: %s [failed]", + addr_text); + } + gc_free(&gc); } #endif - ASSERT (!(ret && ret->halt)); - return ret; + ASSERT(!(ret && ret->halt)); + return ret; } /* * Helper function to multi_learn_addr(). */ static struct multi_instance * -multi_learn_in_addr_t (struct multi_context *m, - struct multi_instance *mi, - in_addr_t a, - int netbits, /* -1 if host route, otherwise # of network bits in address */ - bool primary) +multi_learn_in_addr_t(struct multi_context *m, + struct multi_instance *mi, + in_addr_t a, + int netbits, /* -1 if host route, otherwise # of network bits in address */ + bool primary) { - struct openvpn_sockaddr remote_si; - struct mroute_addr addr; + struct openvpn_sockaddr remote_si; + struct mroute_addr addr; - CLEAR (remote_si); - remote_si.addr.in4.sin_family = AF_INET; - remote_si.addr.in4.sin_addr.s_addr = htonl (a); - ASSERT (mroute_extract_openvpn_sockaddr (&addr, &remote_si, false)); + CLEAR(remote_si); + remote_si.addr.in4.sin_family = AF_INET; + remote_si.addr.in4.sin_addr.s_addr = htonl(a); + ASSERT(mroute_extract_openvpn_sockaddr(&addr, &remote_si, false)); - if (netbits >= 0) + if (netbits >= 0) { - addr.type |= MR_WITH_NETBITS; - addr.netbits = (uint8_t) netbits; + addr.type |= MR_WITH_NETBITS; + addr.netbits = (uint8_t) netbits; } - { - struct multi_instance *owner = multi_learn_addr (m, mi, &addr, 0); + { + struct multi_instance *owner = multi_learn_addr(m, mi, &addr, 0); #ifdef MANAGEMENT_DEF_AUTH - if (management && owner) - management_learn_addr (management, &mi->context.c2.mda_context, &addr, primary); + if (management && owner) + { + management_learn_addr(management, &mi->context.c2.mda_context, &addr, primary); + } #endif - return owner; - } + return owner; + } } static struct multi_instance * -multi_learn_in6_addr (struct multi_context *m, - struct multi_instance *mi, - struct in6_addr a6, - int netbits, /* -1 if host route, otherwise # of network bits in address */ - bool primary) +multi_learn_in6_addr(struct multi_context *m, + struct multi_instance *mi, + struct in6_addr a6, + int netbits, /* -1 if host route, otherwise # of network bits in address */ + bool primary) { - struct mroute_addr addr; + struct mroute_addr addr; - addr.len = 16; - addr.type = MR_ADDR_IPV6; - addr.netbits = 0; - addr.v6.addr = a6; + addr.len = 16; + addr.type = MR_ADDR_IPV6; + addr.netbits = 0; + addr.v6.addr = a6; - if (netbits >= 0) + if (netbits >= 0) { - addr.type |= MR_WITH_NETBITS; - addr.netbits = (uint8_t) netbits; - mroute_addr_mask_host_bits( &addr ); + addr.type |= MR_WITH_NETBITS; + addr.netbits = (uint8_t) netbits; + mroute_addr_mask_host_bits( &addr ); } - { - struct multi_instance *owner = multi_learn_addr (m, mi, &addr, 0); + { + struct multi_instance *owner = multi_learn_addr(m, mi, &addr, 0); #ifdef MANAGEMENT_DEF_AUTH - if (management && owner) - management_learn_addr (management, &mi->context.c2.mda_context, &addr, primary); + if (management && owner) + { + management_learn_addr(management, &mi->context.c2.mda_context, &addr, primary); + } #endif - return owner; - } + return owner; + } } /* @@ -1223,44 +1307,48 @@ multi_learn_in6_addr (struct multi_context *m, * to internal routing table. */ static void -multi_add_iroutes (struct multi_context *m, - struct multi_instance *mi) -{ - struct gc_arena gc = gc_new (); - const struct iroute *ir; - const struct iroute_ipv6 *ir6; - if (TUNNEL_TYPE (mi->context.c1.tuntap) == DEV_TYPE_TUN) - { - mi->did_iroutes = true; - for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next) - { - if (ir->netbits >= 0) - msg (D_MULTI_LOW, "MULTI: internal route %s/%d -> %s", - print_in_addr_t (ir->network, 0, &gc), - ir->netbits, - multi_instance_string (mi, false, &gc)); - else - msg (D_MULTI_LOW, "MULTI: internal route %s -> %s", - print_in_addr_t (ir->network, 0, &gc), - multi_instance_string (mi, false, &gc)); - - mroute_helper_add_iroute46 (m->route_helper, ir->netbits); - - multi_learn_in_addr_t (m, mi, ir->network, ir->netbits, false); - } - for ( ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next ) - { - msg (D_MULTI_LOW, "MULTI: internal route %s/%d -> %s", - print_in6_addr (ir6->network, 0, &gc), - ir6->netbits, - multi_instance_string (mi, false, &gc)); - - mroute_helper_add_iroute46 (m->route_helper, ir6->netbits); - - multi_learn_in6_addr (m, mi, ir6->network, ir6->netbits, false); - } - } - gc_free (&gc); +multi_add_iroutes(struct multi_context *m, + struct multi_instance *mi) +{ + struct gc_arena gc = gc_new(); + const struct iroute *ir; + const struct iroute_ipv6 *ir6; + if (TUNNEL_TYPE(mi->context.c1.tuntap) == DEV_TYPE_TUN) + { + mi->did_iroutes = true; + for (ir = mi->context.options.iroutes; ir != NULL; ir = ir->next) + { + if (ir->netbits >= 0) + { + msg(D_MULTI_LOW, "MULTI: internal route %s/%d -> %s", + print_in_addr_t(ir->network, 0, &gc), + ir->netbits, + multi_instance_string(mi, false, &gc)); + } + else + { + msg(D_MULTI_LOW, "MULTI: internal route %s -> %s", + print_in_addr_t(ir->network, 0, &gc), + multi_instance_string(mi, false, &gc)); + } + + mroute_helper_add_iroute46(m->route_helper, ir->netbits); + + multi_learn_in_addr_t(m, mi, ir->network, ir->netbits, false); + } + for (ir6 = mi->context.options.iroutes_ipv6; ir6 != NULL; ir6 = ir6->next) + { + msg(D_MULTI_LOW, "MULTI: internal route %s/%d -> %s", + print_in6_addr(ir6->network, 0, &gc), + ir6->netbits, + multi_instance_string(mi, false, &gc)); + + mroute_helper_add_iroute46(m->route_helper, ir6->netbits); + + multi_learn_in6_addr(m, mi, ir6->network, ir6->netbits, false); + } + } + gc_free(&gc); } /* @@ -1268,65 +1356,67 @@ multi_add_iroutes (struct multi_context *m, * same common name. */ static void -multi_delete_dup (struct multi_context *m, struct multi_instance *new_mi) -{ - if (new_mi) - { - const char *new_cn = tls_common_name (new_mi->context.c2.tls_multi, true); - if (new_cn) - { - struct hash_iterator hi; - struct hash_element *he; - int count = 0; - - hash_iterator_init (m->iter, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct multi_instance *mi = (struct multi_instance *) he->value; - if (mi != new_mi && !mi->halt) - { - const char *cn = tls_common_name (mi->context.c2.tls_multi, true); - if (cn && !strcmp (cn, new_cn)) - { - mi->did_iter = false; - multi_close_instance (m, mi, false); - hash_iterator_delete_element (&hi); - ++count; - } - } - } - hash_iterator_free (&hi); - - if (count) - msg (D_MULTI_LOW, "MULTI: new connection by client '%s' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.", new_cn); - } +multi_delete_dup(struct multi_context *m, struct multi_instance *new_mi) +{ + if (new_mi) + { + const char *new_cn = tls_common_name(new_mi->context.c2.tls_multi, true); + if (new_cn) + { + struct hash_iterator hi; + struct hash_element *he; + int count = 0; + + hash_iterator_init(m->iter, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct multi_instance *mi = (struct multi_instance *) he->value; + if (mi != new_mi && !mi->halt) + { + const char *cn = tls_common_name(mi->context.c2.tls_multi, true); + if (cn && !strcmp(cn, new_cn)) + { + mi->did_iter = false; + multi_close_instance(m, mi, false); + hash_iterator_delete_element(&hi); + ++count; + } + } + } + hash_iterator_free(&hi); + + if (count) + { + msg(D_MULTI_LOW, "MULTI: new connection by client '%s' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.", new_cn); + } + } } } static void -check_stale_routes (struct multi_context *m) +check_stale_routes(struct multi_context *m) { - struct gc_arena gc = gc_new (); - struct hash_iterator hi; - struct hash_element *he; + struct gc_arena gc = gc_new(); + struct hash_iterator hi; + struct hash_element *he; - dmsg (D_MULTI_DEBUG, "MULTI: Checking stale routes"); - hash_iterator_init_range (m->vhash, &hi, 0, hash_n_buckets (m->vhash)); - while ((he = hash_iterator_next (&hi)) != NULL) + dmsg(D_MULTI_DEBUG, "MULTI: Checking stale routes"); + hash_iterator_init_range(m->vhash, &hi, 0, hash_n_buckets(m->vhash)); + while ((he = hash_iterator_next(&hi)) != NULL) { - struct multi_route *r = (struct multi_route *) he->value; - if (multi_route_defined (m, r) && difftime(now, r->last_reference) >= m->top.options.stale_routes_ageing_time) + struct multi_route *r = (struct multi_route *) he->value; + if (multi_route_defined(m, r) && difftime(now, r->last_reference) >= m->top.options.stale_routes_ageing_time) { - dmsg (D_MULTI_DEBUG, "MULTI: Deleting stale route for address '%s'", - mroute_addr_print (&r->addr, &gc)); - learn_address_script (m, NULL, "delete", &r->addr); - multi_route_del (r); - hash_iterator_delete_element (&hi); + dmsg(D_MULTI_DEBUG, "MULTI: Deleting stale route for address '%s'", + mroute_addr_print(&r->addr, &gc)); + learn_address_script(m, NULL, "delete", &r->addr); + multi_route_del(r); + hash_iterator_delete_element(&hi); } } - hash_iterator_free (&hi); - gc_free (&gc); + hash_iterator_free(&hi); + gc_free(&gc); } /* @@ -1334,192 +1424,208 @@ check_stale_routes (struct multi_context *m) * complies with --ifconfig-push-constraint directive. */ static bool -ifconfig_push_constraint_satisfied (const struct context *c) +ifconfig_push_constraint_satisfied(const struct context *c) { - const struct options *o = &c->options; - if (o->push_ifconfig_constraint_defined && c->c2.push_ifconfig_defined) - return (o->push_ifconfig_constraint_netmask & c->c2.push_ifconfig_local) == o->push_ifconfig_constraint_network; - else - return true; + const struct options *o = &c->options; + if (o->push_ifconfig_constraint_defined && c->c2.push_ifconfig_defined) + { + return (o->push_ifconfig_constraint_netmask & c->c2.push_ifconfig_local) == o->push_ifconfig_constraint_network; + } + else + { + return true; + } } /* * Select a virtual address for a new client instance. * Use an --ifconfig-push directive, if given (static IP). - * Otherwise use an --ifconfig-pool address (dynamic IP). + * Otherwise use an --ifconfig-pool address (dynamic IP). */ static void -multi_select_virtual_addr (struct multi_context *m, struct multi_instance *mi) -{ - struct gc_arena gc = gc_new (); - - /* - * If ifconfig addresses were set by dynamic config file, - * release pool addresses, otherwise keep them. - */ - if (mi->context.options.push_ifconfig_defined) - { - /* ifconfig addresses were set statically, - release dynamic allocation */ - if (mi->vaddr_handle >= 0) - { - ifconfig_pool_release (m->ifconfig_pool, mi->vaddr_handle, true); - mi->vaddr_handle = -1; - } - - mi->context.c2.push_ifconfig_defined = true; - mi->context.c2.push_ifconfig_local = mi->context.options.push_ifconfig_local; - mi->context.c2.push_ifconfig_remote_netmask = mi->context.options.push_ifconfig_remote_netmask; - mi->context.c2.push_ifconfig_local_alias = mi->context.options.push_ifconfig_local_alias; - - /* the current implementation does not allow "static IPv4, pool IPv6", - * (see below) so issue a warning if that happens - don't break the - * session, though, as we don't even know if this client WANTS IPv6 - */ - if ( mi->context.options.ifconfig_ipv6_pool_defined && - ! mi->context.options.push_ifconfig_ipv6_defined ) - { - msg( M_INFO, "MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." ); - } - } - else if (m->ifconfig_pool && mi->vaddr_handle < 0) /* otherwise, choose a pool address */ - { - in_addr_t local=0, remote=0; - struct in6_addr remote_ipv6; - const char *cn = NULL; - - if (!mi->context.options.duplicate_cn) - cn = tls_common_name (mi->context.c2.tls_multi, true); - - CLEAR(remote_ipv6); - mi->vaddr_handle = ifconfig_pool_acquire (m->ifconfig_pool, &local, &remote, &remote_ipv6, cn); - if (mi->vaddr_handle >= 0) - { - const int tunnel_type = TUNNEL_TYPE (mi->context.c1.tuntap); - const int tunnel_topology = TUNNEL_TOPOLOGY (mi->context.c1.tuntap); - - msg( M_INFO, "MULTI_sva: pool returned IPv4=%s, IPv6=%s", - print_in_addr_t( remote, 0, &gc ), - (mi->context.options.ifconfig_ipv6_pool_defined - ? print_in6_addr( remote_ipv6, 0, &gc ) - : "(Not enabled)") ); - - /* set push_ifconfig_remote_netmask from pool ifconfig address(es) */ - mi->context.c2.push_ifconfig_local = remote; - if (tunnel_type == DEV_TYPE_TAP || (tunnel_type == DEV_TYPE_TUN && tunnel_topology == TOP_SUBNET)) - { - mi->context.c2.push_ifconfig_remote_netmask = mi->context.options.ifconfig_pool_netmask; - if (!mi->context.c2.push_ifconfig_remote_netmask) - mi->context.c2.push_ifconfig_remote_netmask = mi->context.c1.tuntap->remote_netmask; - } - else if (tunnel_type == DEV_TYPE_TUN) - { - if (tunnel_topology == TOP_P2P) - mi->context.c2.push_ifconfig_remote_netmask = mi->context.c1.tuntap->local; - else if (tunnel_topology == TOP_NET30) - mi->context.c2.push_ifconfig_remote_netmask = local; - } - - if (mi->context.c2.push_ifconfig_remote_netmask) - mi->context.c2.push_ifconfig_defined = true; - else - msg (D_MULTI_ERRORS, "MULTI: no --ifconfig-pool netmask parameter is available to push to %s", - multi_instance_string (mi, false, &gc)); - - if ( mi->context.options.ifconfig_ipv6_pool_defined ) - { - mi->context.c2.push_ifconfig_ipv6_local = remote_ipv6; - mi->context.c2.push_ifconfig_ipv6_remote = - mi->context.c1.tuntap->local_ipv6; - mi->context.c2.push_ifconfig_ipv6_netbits = - mi->context.options.ifconfig_ipv6_netbits; - mi->context.c2.push_ifconfig_ipv6_defined = true; - } - } - else - { - msg (D_MULTI_ERRORS, "MULTI: no free --ifconfig-pool addresses are available"); - } - } - - /* IPv6 push_ifconfig is a bit problematic - since IPv6 shares the - * pool handling with IPv4, the combination "static IPv4, dynamic IPv6" - * will fail (because no pool will be allocated in this case). - * OTOH, this doesn't make too much sense in reality - and the other - * way round ("dynamic IPv4, static IPv6") or "both static" makes sense - * -> and so it's implemented right now - */ - if ( mi->context.options.push_ifconfig_ipv6_defined ) - { - mi->context.c2.push_ifconfig_ipv6_local = - mi->context.options.push_ifconfig_ipv6_local; - mi->context.c2.push_ifconfig_ipv6_remote = - mi->context.options.push_ifconfig_ipv6_remote; - mi->context.c2.push_ifconfig_ipv6_netbits = - mi->context.options.push_ifconfig_ipv6_netbits; - mi->context.c2.push_ifconfig_ipv6_defined = true; - - msg( M_INFO, "MULTI_sva: push_ifconfig_ipv6 %s/%d", - print_in6_addr( mi->context.c2.push_ifconfig_ipv6_local, 0, &gc ), - mi->context.c2.push_ifconfig_ipv6_netbits ); - } - - gc_free (&gc); +multi_select_virtual_addr(struct multi_context *m, struct multi_instance *mi) +{ + struct gc_arena gc = gc_new(); + + /* + * If ifconfig addresses were set by dynamic config file, + * release pool addresses, otherwise keep them. + */ + if (mi->context.options.push_ifconfig_defined) + { + /* ifconfig addresses were set statically, + * release dynamic allocation */ + if (mi->vaddr_handle >= 0) + { + ifconfig_pool_release(m->ifconfig_pool, mi->vaddr_handle, true); + mi->vaddr_handle = -1; + } + + mi->context.c2.push_ifconfig_defined = true; + mi->context.c2.push_ifconfig_local = mi->context.options.push_ifconfig_local; + mi->context.c2.push_ifconfig_remote_netmask = mi->context.options.push_ifconfig_remote_netmask; + mi->context.c2.push_ifconfig_local_alias = mi->context.options.push_ifconfig_local_alias; + + /* the current implementation does not allow "static IPv4, pool IPv6", + * (see below) so issue a warning if that happens - don't break the + * session, though, as we don't even know if this client WANTS IPv6 + */ + if (mi->context.options.ifconfig_ipv6_pool_defined + && !mi->context.options.push_ifconfig_ipv6_defined) + { + msg( M_INFO, "MULTI_sva: WARNING: if --ifconfig-push is used for IPv4, automatic IPv6 assignment from --ifconfig-ipv6-pool does not work. Use --ifconfig-ipv6-push for IPv6 then." ); + } + } + else if (m->ifconfig_pool && mi->vaddr_handle < 0) /* otherwise, choose a pool address */ + { + in_addr_t local = 0, remote = 0; + struct in6_addr remote_ipv6; + const char *cn = NULL; + + if (!mi->context.options.duplicate_cn) + { + cn = tls_common_name(mi->context.c2.tls_multi, true); + } + + CLEAR(remote_ipv6); + mi->vaddr_handle = ifconfig_pool_acquire(m->ifconfig_pool, &local, &remote, &remote_ipv6, cn); + if (mi->vaddr_handle >= 0) + { + const int tunnel_type = TUNNEL_TYPE(mi->context.c1.tuntap); + const int tunnel_topology = TUNNEL_TOPOLOGY(mi->context.c1.tuntap); + + msg( M_INFO, "MULTI_sva: pool returned IPv4=%s, IPv6=%s", + print_in_addr_t( remote, 0, &gc ), + (mi->context.options.ifconfig_ipv6_pool_defined + ? print_in6_addr( remote_ipv6, 0, &gc ) + : "(Not enabled)") ); + + /* set push_ifconfig_remote_netmask from pool ifconfig address(es) */ + mi->context.c2.push_ifconfig_local = remote; + if (tunnel_type == DEV_TYPE_TAP || (tunnel_type == DEV_TYPE_TUN && tunnel_topology == TOP_SUBNET)) + { + mi->context.c2.push_ifconfig_remote_netmask = mi->context.options.ifconfig_pool_netmask; + if (!mi->context.c2.push_ifconfig_remote_netmask) + { + mi->context.c2.push_ifconfig_remote_netmask = mi->context.c1.tuntap->remote_netmask; + } + } + else if (tunnel_type == DEV_TYPE_TUN) + { + if (tunnel_topology == TOP_P2P) + { + mi->context.c2.push_ifconfig_remote_netmask = mi->context.c1.tuntap->local; + } + else if (tunnel_topology == TOP_NET30) + { + mi->context.c2.push_ifconfig_remote_netmask = local; + } + } + + if (mi->context.c2.push_ifconfig_remote_netmask) + { + mi->context.c2.push_ifconfig_defined = true; + } + else + { + msg(D_MULTI_ERRORS, "MULTI: no --ifconfig-pool netmask parameter is available to push to %s", + multi_instance_string(mi, false, &gc)); + } + + if (mi->context.options.ifconfig_ipv6_pool_defined) + { + mi->context.c2.push_ifconfig_ipv6_local = remote_ipv6; + mi->context.c2.push_ifconfig_ipv6_remote = + mi->context.c1.tuntap->local_ipv6; + mi->context.c2.push_ifconfig_ipv6_netbits = + mi->context.options.ifconfig_ipv6_netbits; + mi->context.c2.push_ifconfig_ipv6_defined = true; + } + } + else + { + msg(D_MULTI_ERRORS, "MULTI: no free --ifconfig-pool addresses are available"); + } + } + + /* IPv6 push_ifconfig is a bit problematic - since IPv6 shares the + * pool handling with IPv4, the combination "static IPv4, dynamic IPv6" + * will fail (because no pool will be allocated in this case). + * OTOH, this doesn't make too much sense in reality - and the other + * way round ("dynamic IPv4, static IPv6") or "both static" makes sense + * -> and so it's implemented right now + */ + if (mi->context.options.push_ifconfig_ipv6_defined) + { + mi->context.c2.push_ifconfig_ipv6_local = + mi->context.options.push_ifconfig_ipv6_local; + mi->context.c2.push_ifconfig_ipv6_remote = + mi->context.options.push_ifconfig_ipv6_remote; + mi->context.c2.push_ifconfig_ipv6_netbits = + mi->context.options.push_ifconfig_ipv6_netbits; + mi->context.c2.push_ifconfig_ipv6_defined = true; + + msg( M_INFO, "MULTI_sva: push_ifconfig_ipv6 %s/%d", + print_in6_addr( mi->context.c2.push_ifconfig_ipv6_local, 0, &gc ), + mi->context.c2.push_ifconfig_ipv6_netbits ); + } + + gc_free(&gc); } /* * Set virtual address environmental variables. */ static void -multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi) -{ - setenv_del (mi->context.c2.es, "ifconfig_pool_local_ip"); - setenv_del (mi->context.c2.es, "ifconfig_pool_remote_ip"); - setenv_del (mi->context.c2.es, "ifconfig_pool_netmask"); - - if (mi->context.c2.push_ifconfig_defined) - { - const int tunnel_type = TUNNEL_TYPE (mi->context.c1.tuntap); - const int tunnel_topology = TUNNEL_TOPOLOGY (mi->context.c1.tuntap); - - setenv_in_addr_t (mi->context.c2.es, - "ifconfig_pool_remote_ip", - mi->context.c2.push_ifconfig_local, - SA_SET_IF_NONZERO); - - if (tunnel_type == DEV_TYPE_TAP || (tunnel_type == DEV_TYPE_TUN && tunnel_topology == TOP_SUBNET)) - { - setenv_in_addr_t (mi->context.c2.es, - "ifconfig_pool_netmask", - mi->context.c2.push_ifconfig_remote_netmask, - SA_SET_IF_NONZERO); - } - else if (tunnel_type == DEV_TYPE_TUN) - { - setenv_in_addr_t (mi->context.c2.es, - "ifconfig_pool_local_ip", - mi->context.c2.push_ifconfig_remote_netmask, - SA_SET_IF_NONZERO); - } - } - - setenv_del (mi->context.c2.es, "ifconfig_pool_local_ip6"); - setenv_del (mi->context.c2.es, "ifconfig_pool_remote_ip6"); - setenv_del (mi->context.c2.es, "ifconfig_pool_ip6_netbits"); - - if (mi->context.c2.push_ifconfig_ipv6_defined) - { - setenv_in6_addr (mi->context.c2.es, - "ifconfig_pool_remote", - &mi->context.c2.push_ifconfig_ipv6_local, - SA_SET_IF_NONZERO); - setenv_in6_addr (mi->context.c2.es, - "ifconfig_pool_local", - &mi->context.c2.push_ifconfig_ipv6_remote, - SA_SET_IF_NONZERO); - setenv_int (mi->context.c2.es, - "ifconfig_pool_ip6_netbits", - mi->context.c2.push_ifconfig_ipv6_netbits); +multi_set_virtual_addr_env(struct multi_context *m, struct multi_instance *mi) +{ + setenv_del(mi->context.c2.es, "ifconfig_pool_local_ip"); + setenv_del(mi->context.c2.es, "ifconfig_pool_remote_ip"); + setenv_del(mi->context.c2.es, "ifconfig_pool_netmask"); + + if (mi->context.c2.push_ifconfig_defined) + { + const int tunnel_type = TUNNEL_TYPE(mi->context.c1.tuntap); + const int tunnel_topology = TUNNEL_TOPOLOGY(mi->context.c1.tuntap); + + setenv_in_addr_t(mi->context.c2.es, + "ifconfig_pool_remote_ip", + mi->context.c2.push_ifconfig_local, + SA_SET_IF_NONZERO); + + if (tunnel_type == DEV_TYPE_TAP || (tunnel_type == DEV_TYPE_TUN && tunnel_topology == TOP_SUBNET)) + { + setenv_in_addr_t(mi->context.c2.es, + "ifconfig_pool_netmask", + mi->context.c2.push_ifconfig_remote_netmask, + SA_SET_IF_NONZERO); + } + else if (tunnel_type == DEV_TYPE_TUN) + { + setenv_in_addr_t(mi->context.c2.es, + "ifconfig_pool_local_ip", + mi->context.c2.push_ifconfig_remote_netmask, + SA_SET_IF_NONZERO); + } + } + + setenv_del(mi->context.c2.es, "ifconfig_pool_local_ip6"); + setenv_del(mi->context.c2.es, "ifconfig_pool_remote_ip6"); + setenv_del(mi->context.c2.es, "ifconfig_pool_ip6_netbits"); + + if (mi->context.c2.push_ifconfig_ipv6_defined) + { + setenv_in6_addr(mi->context.c2.es, + "ifconfig_pool_remote", + &mi->context.c2.push_ifconfig_ipv6_local, + SA_SET_IF_NONZERO); + setenv_in6_addr(mi->context.c2.es, + "ifconfig_pool_local", + &mi->context.c2.push_ifconfig_ipv6_remote, + SA_SET_IF_NONZERO); + setenv_int(mi->context.c2.es, + "ifconfig_pool_ip6_netbits", + mi->context.c2.push_ifconfig_ipv6_netbits); } } @@ -1527,30 +1633,30 @@ multi_set_virtual_addr_env (struct multi_context *m, struct multi_instance *mi) * Called after client-connect script is called */ static void -multi_client_connect_post (struct multi_context *m, - struct multi_instance *mi, - const char *dc_file, - unsigned int option_permissions_mask, - unsigned int *option_types_found) +multi_client_connect_post(struct multi_context *m, + struct multi_instance *mi, + const char *dc_file, + unsigned int option_permissions_mask, + unsigned int *option_types_found) { - /* Did script generate a dynamic config file? */ - if (test_file (dc_file)) + /* Did script generate a dynamic config file? */ + if (test_file(dc_file)) { - options_server_import (&mi->context.options, - dc_file, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - option_types_found, - mi->context.c2.es); + options_server_import(&mi->context.options, + dc_file, + D_IMPORT_ERRORS|M_OPTERR, + option_permissions_mask, + option_types_found, + mi->context.c2.es); - /* - * If the --client-connect script generates a config file - * with an --ifconfig-push directive, it will override any - * --ifconfig-push directive from the --client-config-dir - * directory or any --ifconfig-pool dynamic address. - */ - multi_select_virtual_addr (m, mi); - multi_set_virtual_addr_env (m, mi); + /* + * If the --client-connect script generates a config file + * with an --ifconfig-push directive, it will override any + * --ifconfig-push directive from the --client-config-dir + * directory or any --ifconfig-pool dynamic address. + */ + multi_select_virtual_addr(m, mi); + multi_set_virtual_addr_env(m, mi); } } @@ -1560,43 +1666,45 @@ multi_client_connect_post (struct multi_context *m, * Called after client-connect plug-in is called */ static void -multi_client_connect_post_plugin (struct multi_context *m, - struct multi_instance *mi, - const struct plugin_return *pr, - unsigned int option_permissions_mask, - unsigned int *option_types_found) -{ - struct plugin_return config; - - plugin_return_get_column (pr, &config, "config"); - - /* Did script generate a dynamic config file? */ - if (plugin_return_defined (&config)) - { - int i; - for (i = 0; i < config.n; ++i) - { - if (config.list[i] && config.list[i]->value) - options_string_import (&mi->context.options, - config.list[i]->value, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - option_types_found, - mi->context.c2.es); - } - - /* - * If the --client-connect script generates a config file - * with an --ifconfig-push directive, it will override any - * --ifconfig-push directive from the --client-config-dir - * directory or any --ifconfig-pool dynamic address. - */ - multi_select_virtual_addr (m, mi); - multi_set_virtual_addr_env (m, mi); +multi_client_connect_post_plugin(struct multi_context *m, + struct multi_instance *mi, + const struct plugin_return *pr, + unsigned int option_permissions_mask, + unsigned int *option_types_found) +{ + struct plugin_return config; + + plugin_return_get_column(pr, &config, "config"); + + /* Did script generate a dynamic config file? */ + if (plugin_return_defined(&config)) + { + int i; + for (i = 0; i < config.n; ++i) + { + if (config.list[i] && config.list[i]->value) + { + options_string_import(&mi->context.options, + config.list[i]->value, + D_IMPORT_ERRORS|M_OPTERR, + option_permissions_mask, + option_types_found, + mi->context.c2.es); + } + } + + /* + * If the --client-connect script generates a config file + * with an --ifconfig-push directive, it will override any + * --ifconfig-push directive from the --client-config-dir + * directory or any --ifconfig-pool dynamic address. + */ + multi_select_virtual_addr(m, mi); + multi_set_virtual_addr_env(m, mi); } } -#endif +#endif /* ifdef ENABLE_PLUGIN */ #ifdef MANAGEMENT_DEF_AUTH @@ -1604,63 +1712,63 @@ multi_client_connect_post_plugin (struct multi_context *m, * Called to load management-derived client-connect config */ static void -multi_client_connect_mda (struct multi_context *m, - struct multi_instance *mi, - const struct buffer_list *config, - unsigned int option_permissions_mask, - unsigned int *option_types_found) -{ - if (config) - { - struct buffer_entry *be; - - for (be = config->head; be != NULL; be = be->next) - { - const char *opt = BSTR(&be->buf); - options_string_import (&mi->context.options, - opt, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - option_types_found, - mi->context.c2.es); - } - - /* - * If the --client-connect script generates a config file - * with an --ifconfig-push directive, it will override any - * --ifconfig-push directive from the --client-config-dir - * directory or any --ifconfig-pool dynamic address. - */ - multi_select_virtual_addr (m, mi); - multi_set_virtual_addr_env (m, mi); +multi_client_connect_mda(struct multi_context *m, + struct multi_instance *mi, + const struct buffer_list *config, + unsigned int option_permissions_mask, + unsigned int *option_types_found) +{ + if (config) + { + struct buffer_entry *be; + + for (be = config->head; be != NULL; be = be->next) + { + const char *opt = BSTR(&be->buf); + options_string_import(&mi->context.options, + opt, + D_IMPORT_ERRORS|M_OPTERR, + option_permissions_mask, + option_types_found, + mi->context.c2.es); + } + + /* + * If the --client-connect script generates a config file + * with an --ifconfig-push directive, it will override any + * --ifconfig-push directive from the --client-config-dir + * directory or any --ifconfig-pool dynamic address. + */ + multi_select_virtual_addr(m, mi); + multi_set_virtual_addr_env(m, mi); } } -#endif +#endif /* ifdef MANAGEMENT_DEF_AUTH */ static void -multi_client_connect_setenv (struct multi_context *m, - struct multi_instance *mi) +multi_client_connect_setenv(struct multi_context *m, + struct multi_instance *mi) { - struct gc_arena gc = gc_new (); + struct gc_arena gc = gc_new(); - /* setenv incoming cert common name for script */ - setenv_str (mi->context.c2.es, "common_name", tls_common_name (mi->context.c2.tls_multi, true)); + /* setenv incoming cert common name for script */ + setenv_str(mi->context.c2.es, "common_name", tls_common_name(mi->context.c2.tls_multi, true)); - /* setenv client real IP address */ - setenv_trusted (mi->context.c2.es, get_link_socket_info (&mi->context)); + /* setenv client real IP address */ + setenv_trusted(mi->context.c2.es, get_link_socket_info(&mi->context)); - /* setenv client virtual IP address */ - multi_set_virtual_addr_env (m, mi); + /* setenv client virtual IP address */ + multi_set_virtual_addr_env(m, mi); - /* setenv connection time */ - { - const char *created_ascii = time_string (mi->created, 0, false, &gc); - setenv_str (mi->context.c2.es, "time_ascii", created_ascii); - setenv_unsigned (mi->context.c2.es, "time_unix", (unsigned int)mi->created); - } + /* setenv connection time */ + { + const char *created_ascii = time_string(mi->created, 0, false, &gc); + setenv_str(mi->context.c2.es, "time_ascii", created_ascii); + setenv_unsigned(mi->context.c2.es, "time_unix", (unsigned int)mi->created); + } - gc_free (&gc); + gc_free(&gc); } /* @@ -1673,316 +1781,328 @@ multi_client_connect_setenv (struct multi_context *m, * push */ static void -multi_connection_established (struct multi_context *m, struct multi_instance *mi) -{ - if (tls_authentication_status (mi->context.c2.tls_multi, 0) == TLS_AUTHENTICATION_SUCCEEDED) - { - struct gc_arena gc = gc_new (); - unsigned int option_types_found = 0; - - const unsigned int option_permissions_mask = - OPT_P_INSTANCE - | OPT_P_INHERIT - | OPT_P_PUSH - | OPT_P_TIMER - | OPT_P_CONFIG - | OPT_P_ECHO - | OPT_P_COMP - | OPT_P_SOCKFLAGS; - - int cc_succeeded = true; /* client connect script status */ - int cc_succeeded_count = 0; - - ASSERT (mi->context.c1.tuntap); - - /* lock down the common name and cert hashes so they can't change during future TLS renegotiations */ - tls_lock_common_name (mi->context.c2.tls_multi); - tls_lock_cert_hash_set (mi->context.c2.tls_multi); - - /* generate a msg() prefix for this client instance */ - generate_prefix (mi); - - /* delete instances of previous clients with same common-name */ - if (!mi->context.options.duplicate_cn) - multi_delete_dup (m, mi); - - /* reset pool handle to null */ - mi->vaddr_handle = -1; - - /* - * Try to source a dynamic config file from the - * --client-config-dir directory. - */ - if (mi->context.options.client_config_dir) - { - const char *ccd_file; - - ccd_file = gen_path (mi->context.options.client_config_dir, - tls_common_name (mi->context.c2.tls_multi, false), - &gc); - - /* try common-name file */ - if (test_file (ccd_file)) - { - options_server_import (&mi->context.options, - ccd_file, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - &option_types_found, - mi->context.c2.es); - } - else /* try default file */ - { - ccd_file = gen_path (mi->context.options.client_config_dir, - CCD_DEFAULT, - &gc); - - if (test_file (ccd_file)) - { - options_server_import (&mi->context.options, - ccd_file, - D_IMPORT_ERRORS|M_OPTERR, - option_permissions_mask, - &option_types_found, - mi->context.c2.es); - } - } - } - - /* - * Select a virtual address from either --ifconfig-push in --client-config-dir file - * or --ifconfig-pool. - */ - multi_select_virtual_addr (m, mi); - - /* do --client-connect setenvs */ - multi_client_connect_setenv (m, mi); +multi_connection_established(struct multi_context *m, struct multi_instance *mi) +{ + if (tls_authentication_status(mi->context.c2.tls_multi, 0) == TLS_AUTHENTICATION_SUCCEEDED) + { + struct gc_arena gc = gc_new(); + unsigned int option_types_found = 0; -#ifdef ENABLE_PLUGIN - /* - * Call client-connect plug-in. - */ + const unsigned int option_permissions_mask = + OPT_P_INSTANCE + | OPT_P_INHERIT + | OPT_P_PUSH + | OPT_P_TIMER + | OPT_P_CONFIG + | OPT_P_ECHO + | OPT_P_COMP + | OPT_P_SOCKFLAGS; - /* deprecated callback, use a file for passing back return info */ - if (plugin_defined (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT)) - { - struct argv argv = argv_new (); - const char *dc_file = create_temp_file (mi->context.options.tmp_dir, "cc", &gc); + int cc_succeeded = true; /* client connect script status */ + int cc_succeeded_count = 0; - if( !dc_file ) { - cc_succeeded = false; - goto script_depr_failed; - } - - argv_printf (&argv, "%s", dc_file); - if (plugin_call (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, &argv, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) - { - msg (M_WARN, "WARNING: client-connect plugin call failed"); - cc_succeeded = false; - } - else - { - multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } - - if (!platform_unlink (dc_file)) - msg (D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", - dc_file); - - script_depr_failed: - argv_reset (&argv); - } - - /* V2 callback, use a plugin_return struct for passing back return info */ - if (plugin_defined (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2)) - { - struct plugin_return pr; - - plugin_return_init (&pr); - - if (plugin_call (mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2, NULL, &pr, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) - { - msg (M_WARN, "WARNING: client-connect-v2 plugin call failed"); - cc_succeeded = false; - } - else - { - multi_client_connect_post_plugin (m, mi, &pr, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } - - plugin_return_free (&pr); - } -#endif + ASSERT(mi->context.c1.tuntap); - /* - * Run --client-connect script. - */ - if (mi->context.options.client_connect_script && cc_succeeded) - { - struct argv argv = argv_new (); - const char *dc_file = NULL; + /* lock down the common name and cert hashes so they can't change during future TLS renegotiations */ + tls_lock_common_name(mi->context.c2.tls_multi); + tls_lock_cert_hash_set(mi->context.c2.tls_multi); - setenv_str (mi->context.c2.es, "script_type", "client-connect"); + /* generate a msg() prefix for this client instance */ + generate_prefix(mi); - dc_file = create_temp_file (mi->context.options.tmp_dir, "cc", &gc); - if( !dc_file ) { - cc_succeeded = false; - goto script_failed; - } - - argv_parse_cmd (&argv, mi->context.options.client_connect_script); - argv_printf_cat (&argv, "%s", dc_file); - - if (openvpn_run_script (&argv, mi->context.c2.es, 0, "--client-connect")) - { - multi_client_connect_post (m, mi, dc_file, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } - else - cc_succeeded = false; - - if (!platform_unlink (dc_file)) - msg (D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", - dc_file); - - script_failed: - argv_reset (&argv); - } - - /* - * Check for client-connect script left by management interface client - */ + /* delete instances of previous clients with same common-name */ + if (!mi->context.options.duplicate_cn) + { + multi_delete_dup(m, mi); + } + + /* reset pool handle to null */ + mi->vaddr_handle = -1; + + /* + * Try to source a dynamic config file from the + * --client-config-dir directory. + */ + if (mi->context.options.client_config_dir) + { + const char *ccd_file; + + ccd_file = gen_path(mi->context.options.client_config_dir, + tls_common_name(mi->context.c2.tls_multi, false), + &gc); + + /* try common-name file */ + if (test_file(ccd_file)) + { + options_server_import(&mi->context.options, + ccd_file, + D_IMPORT_ERRORS|M_OPTERR, + option_permissions_mask, + &option_types_found, + mi->context.c2.es); + } + else /* try default file */ + { + ccd_file = gen_path(mi->context.options.client_config_dir, + CCD_DEFAULT, + &gc); + + if (test_file(ccd_file)) + { + options_server_import(&mi->context.options, + ccd_file, + D_IMPORT_ERRORS|M_OPTERR, + option_permissions_mask, + &option_types_found, + mi->context.c2.es); + } + } + } + + /* + * Select a virtual address from either --ifconfig-push in --client-config-dir file + * or --ifconfig-pool. + */ + multi_select_virtual_addr(m, mi); + + /* do --client-connect setenvs */ + multi_client_connect_setenv(m, mi); + +#ifdef ENABLE_PLUGIN + /* + * Call client-connect plug-in. + */ + + /* deprecated callback, use a file for passing back return info */ + if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT)) + { + struct argv argv = argv_new(); + const char *dc_file = create_temp_file(mi->context.options.tmp_dir, "cc", &gc); + + if (!dc_file) + { + cc_succeeded = false; + goto script_depr_failed; + } + + argv_printf(&argv, "%s", dc_file); + if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT, &argv, NULL, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) + { + msg(M_WARN, "WARNING: client-connect plugin call failed"); + cc_succeeded = false; + } + else + { + multi_client_connect_post(m, mi, dc_file, option_permissions_mask, &option_types_found); + ++cc_succeeded_count; + } + + if (!platform_unlink(dc_file)) + { + msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", + dc_file); + } + +script_depr_failed: + argv_reset(&argv); + } + + /* V2 callback, use a plugin_return struct for passing back return info */ + if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2)) + { + struct plugin_return pr; + + plugin_return_init(&pr); + + if (plugin_call(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_CONNECT_V2, NULL, &pr, mi->context.c2.es) != OPENVPN_PLUGIN_FUNC_SUCCESS) + { + msg(M_WARN, "WARNING: client-connect-v2 plugin call failed"); + cc_succeeded = false; + } + else + { + multi_client_connect_post_plugin(m, mi, &pr, option_permissions_mask, &option_types_found); + ++cc_succeeded_count; + } + + plugin_return_free(&pr); + } +#endif /* ifdef ENABLE_PLUGIN */ + + /* + * Run --client-connect script. + */ + if (mi->context.options.client_connect_script && cc_succeeded) + { + struct argv argv = argv_new(); + const char *dc_file = NULL; + + setenv_str(mi->context.c2.es, "script_type", "client-connect"); + + dc_file = create_temp_file(mi->context.options.tmp_dir, "cc", &gc); + if (!dc_file) + { + cc_succeeded = false; + goto script_failed; + } + + argv_parse_cmd(&argv, mi->context.options.client_connect_script); + argv_printf_cat(&argv, "%s", dc_file); + + if (openvpn_run_script(&argv, mi->context.c2.es, 0, "--client-connect")) + { + multi_client_connect_post(m, mi, dc_file, option_permissions_mask, &option_types_found); + ++cc_succeeded_count; + } + else + { + cc_succeeded = false; + } + + if (!platform_unlink(dc_file)) + { + msg(D_MULTI_ERRORS, "MULTI: problem deleting temporary file: %s", + dc_file); + } + +script_failed: + argv_reset(&argv); + } + + /* + * Check for client-connect script left by management interface client + */ #ifdef MANAGEMENT_DEF_AUTH - if (cc_succeeded && mi->cc_config) - { - multi_client_connect_mda (m, mi, mi->cc_config, option_permissions_mask, &option_types_found); - ++cc_succeeded_count; - } + if (cc_succeeded && mi->cc_config) + { + multi_client_connect_mda(m, mi, mi->cc_config, option_permissions_mask, &option_types_found); + ++cc_succeeded_count; + } #endif - /* - * Check for "disable" directive in client-config-dir file - * or config file generated by --client-connect script. - */ - if (mi->context.options.disable) - { - msg (D_MULTI_ERRORS, "MULTI: client has been rejected due to 'disable' directive"); - cc_succeeded = false; - cc_succeeded_count = 0; - } - - if (cc_succeeded) - { - /* - * Process sourced options. - */ - do_deferred_options (&mi->context, option_types_found); - - /* - * make sure we got ifconfig settings from somewhere - */ - if (!mi->context.c2.push_ifconfig_defined) - { - msg (D_MULTI_ERRORS, "MULTI: no dynamic or static remote --ifconfig address is available for %s", - multi_instance_string (mi, false, &gc)); - } - - /* - * make sure that ifconfig settings comply with constraints - */ - if (!ifconfig_push_constraint_satisfied (&mi->context)) - { - /* JYFIXME -- this should cause the connection to fail */ - msg (D_MULTI_ERRORS, "MULTI ERROR: primary virtual IP for %s (%s) violates tunnel network/netmask constraint (%s/%s)", - multi_instance_string (mi, false, &gc), - print_in_addr_t (mi->context.c2.push_ifconfig_local, 0, &gc), - print_in_addr_t (mi->context.options.push_ifconfig_constraint_network, 0, &gc), - print_in_addr_t (mi->context.options.push_ifconfig_constraint_netmask, 0, &gc)); - } - - /* - * For routed tunnels, set up internal route to endpoint - * plus add all iroute routes. - */ - if (TUNNEL_TYPE (mi->context.c1.tuntap) == DEV_TYPE_TUN) - { - if (mi->context.c2.push_ifconfig_defined) - { - multi_learn_in_addr_t (m, mi, mi->context.c2.push_ifconfig_local, -1, true); - msg (D_MULTI_LOW, "MULTI: primary virtual IP for %s: %s", - multi_instance_string (mi, false, &gc), - print_in_addr_t (mi->context.c2.push_ifconfig_local, 0, &gc)); - } - - if (mi->context.c2.push_ifconfig_ipv6_defined) - { - multi_learn_in6_addr (m, mi, mi->context.c2.push_ifconfig_ipv6_local, -1, true); - /* TODO: find out where addresses are "unlearned"!! */ - msg (D_MULTI_LOW, "MULTI: primary virtual IPv6 for %s: %s", - multi_instance_string (mi, false, &gc), - print_in6_addr (mi->context.c2.push_ifconfig_ipv6_local, 0, &gc)); - } - - /* add routes locally, pointing to new client, if - --iroute options have been specified */ - multi_add_iroutes (m, mi); - - /* - * iroutes represent subnets which are "owned" by a particular - * client. Therefore, do not actually push a route to a client - * if it matches one of the client's iroutes. - */ - remove_iroutes_from_push_route_list (&mi->context.options); - } - else if (mi->context.options.iroutes) - { - msg (D_MULTI_ERRORS, "MULTI: --iroute options rejected for %s -- iroute only works with tun-style tunnels", - multi_instance_string (mi, false, &gc)); - } - - /* set our client's VPN endpoint for status reporting purposes */ - mi->reporting_addr = mi->context.c2.push_ifconfig_local; - mi->reporting_addr_ipv6 = mi->context.c2.push_ifconfig_ipv6_local; - - /* set context-level authentication flag */ - mi->context.c2.context_auth = CAS_SUCCEEDED; + /* + * Check for "disable" directive in client-config-dir file + * or config file generated by --client-connect script. + */ + if (mi->context.options.disable) + { + msg(D_MULTI_ERRORS, "MULTI: client has been rejected due to 'disable' directive"); + cc_succeeded = false; + cc_succeeded_count = 0; + } + + if (cc_succeeded) + { + /* + * Process sourced options. + */ + do_deferred_options(&mi->context, option_types_found); + + /* + * make sure we got ifconfig settings from somewhere + */ + if (!mi->context.c2.push_ifconfig_defined) + { + msg(D_MULTI_ERRORS, "MULTI: no dynamic or static remote --ifconfig address is available for %s", + multi_instance_string(mi, false, &gc)); + } + + /* + * make sure that ifconfig settings comply with constraints + */ + if (!ifconfig_push_constraint_satisfied(&mi->context)) + { + /* JYFIXME -- this should cause the connection to fail */ + msg(D_MULTI_ERRORS, "MULTI ERROR: primary virtual IP for %s (%s) violates tunnel network/netmask constraint (%s/%s)", + multi_instance_string(mi, false, &gc), + print_in_addr_t(mi->context.c2.push_ifconfig_local, 0, &gc), + print_in_addr_t(mi->context.options.push_ifconfig_constraint_network, 0, &gc), + print_in_addr_t(mi->context.options.push_ifconfig_constraint_netmask, 0, &gc)); + } + + /* + * For routed tunnels, set up internal route to endpoint + * plus add all iroute routes. + */ + if (TUNNEL_TYPE(mi->context.c1.tuntap) == DEV_TYPE_TUN) + { + if (mi->context.c2.push_ifconfig_defined) + { + multi_learn_in_addr_t(m, mi, mi->context.c2.push_ifconfig_local, -1, true); + msg(D_MULTI_LOW, "MULTI: primary virtual IP for %s: %s", + multi_instance_string(mi, false, &gc), + print_in_addr_t(mi->context.c2.push_ifconfig_local, 0, &gc)); + } + + if (mi->context.c2.push_ifconfig_ipv6_defined) + { + multi_learn_in6_addr(m, mi, mi->context.c2.push_ifconfig_ipv6_local, -1, true); + /* TODO: find out where addresses are "unlearned"!! */ + msg(D_MULTI_LOW, "MULTI: primary virtual IPv6 for %s: %s", + multi_instance_string(mi, false, &gc), + print_in6_addr(mi->context.c2.push_ifconfig_ipv6_local, 0, &gc)); + } + + /* add routes locally, pointing to new client, if + * --iroute options have been specified */ + multi_add_iroutes(m, mi); + + /* + * iroutes represent subnets which are "owned" by a particular + * client. Therefore, do not actually push a route to a client + * if it matches one of the client's iroutes. + */ + remove_iroutes_from_push_route_list(&mi->context.options); + } + else if (mi->context.options.iroutes) + { + msg(D_MULTI_ERRORS, "MULTI: --iroute options rejected for %s -- iroute only works with tun-style tunnels", + multi_instance_string(mi, false, &gc)); + } + + /* set our client's VPN endpoint for status reporting purposes */ + mi->reporting_addr = mi->context.c2.push_ifconfig_local; + mi->reporting_addr_ipv6 = mi->context.c2.push_ifconfig_ipv6_local; + + /* set context-level authentication flag */ + mi->context.c2.context_auth = CAS_SUCCEEDED; #ifdef ENABLE_ASYNC_PUSH - /* authentication complete, send push reply */ - if (mi->context.c2.push_request_received) - { - process_incoming_push_request(&mi->context); - } + /* authentication complete, send push reply */ + if (mi->context.c2.push_request_received) + { + process_incoming_push_request(&mi->context); + } #endif - } - else - { - /* set context-level authentication flag */ - mi->context.c2.context_auth = cc_succeeded_count ? CAS_PARTIAL : CAS_FAILED; - } + } + else + { + /* set context-level authentication flag */ + mi->context.c2.context_auth = cc_succeeded_count ? CAS_PARTIAL : CAS_FAILED; + } - /* set flag so we don't get called again */ - mi->connection_established_flag = true; + /* set flag so we don't get called again */ + mi->connection_established_flag = true; - /* increment number of current authenticated clients */ - ++m->n_clients; - update_mstat_n_clients(m->n_clients); - --mi->n_clients_delta; + /* increment number of current authenticated clients */ + ++m->n_clients; + update_mstat_n_clients(m->n_clients); + --mi->n_clients_delta; #ifdef MANAGEMENT_DEF_AUTH - if (management) - management_connection_established (management, &mi->context.c2.mda_context, mi->context.c2.es); + if (management) + { + management_connection_established(management, &mi->context.c2.mda_context, mi->context.c2.es); + } #endif - gc_free (&gc); + gc_free(&gc); } - /* - * Reply now to client's PUSH_REQUEST query - */ - mi->context.c2.push_reply_deferred = false; + /* + * Reply now to client's PUSH_REQUEST query + */ + mi->context.c2.push_reply_deferred = false; } #ifdef ENABLE_ASYNC_PUSH @@ -1991,71 +2111,71 @@ multi_connection_established (struct multi_context *m, struct multi_instance *mi * Continues authentication and sends push_reply. */ void -multi_process_file_closed (struct multi_context *m, const unsigned int mpp_flags) -{ - char buffer[INOTIFY_EVENT_BUFFER_SIZE]; - size_t buffer_i = 0; - int r = read (m->top.c2.inotify_fd, buffer, INOTIFY_EVENT_BUFFER_SIZE); - - while (buffer_i < r) - { - /* parse inotify events */ - struct inotify_event *pevent = (struct inotify_event *) &buffer[buffer_i]; - size_t event_size = sizeof (struct inotify_event) + pevent->len; - buffer_i += event_size; - - msg(D_MULTI_DEBUG, "MULTI: modified fd %d, mask %d", pevent->wd, pevent->mask); - - struct multi_instance* mi = hash_lookup(m->inotify_watchers, (void*) (unsigned long) pevent->wd); - - if (pevent->mask & IN_CLOSE_WRITE) - { - if (mi) - { - /* continue authentication and send push_reply */ - multi_process_post (m, mi, mpp_flags); - } - else - { - msg(D_MULTI_ERRORS, "MULTI: multi_instance not found!"); - } - } - else if (pevent->mask & IN_IGNORED) - { - /* this event is _always_ fired when watch is removed or file is deleted */ - if (mi) - { - hash_remove(m->inotify_watchers, (void*) (unsigned long) pevent->wd); - mi->inotify_watch = -1; - } - } - else - { - msg(D_MULTI_ERRORS, "MULTI: unknown mask %d", pevent->mask); - } +multi_process_file_closed(struct multi_context *m, const unsigned int mpp_flags) +{ + char buffer[INOTIFY_EVENT_BUFFER_SIZE]; + size_t buffer_i = 0; + int r = read(m->top.c2.inotify_fd, buffer, INOTIFY_EVENT_BUFFER_SIZE); + + while (buffer_i < r) + { + /* parse inotify events */ + struct inotify_event *pevent = (struct inotify_event *) &buffer[buffer_i]; + size_t event_size = sizeof(struct inotify_event) + pevent->len; + buffer_i += event_size; + + msg(D_MULTI_DEBUG, "MULTI: modified fd %d, mask %d", pevent->wd, pevent->mask); + + struct multi_instance *mi = hash_lookup(m->inotify_watchers, (void *) (unsigned long) pevent->wd); + + if (pevent->mask & IN_CLOSE_WRITE) + { + if (mi) + { + /* continue authentication and send push_reply */ + multi_process_post(m, mi, mpp_flags); + } + else + { + msg(D_MULTI_ERRORS, "MULTI: multi_instance not found!"); + } + } + else if (pevent->mask & IN_IGNORED) + { + /* this event is _always_ fired when watch is removed or file is deleted */ + if (mi) + { + hash_remove(m->inotify_watchers, (void *) (unsigned long) pevent->wd); + mi->inotify_watch = -1; + } + } + else + { + msg(D_MULTI_ERRORS, "MULTI: unknown mask %d", pevent->mask); + } } } -#endif +#endif /* ifdef ENABLE_ASYNC_PUSH */ /* * Add a mbuf buffer to a particular * instance. */ void -multi_add_mbuf (struct multi_context *m, - struct multi_instance *mi, - struct mbuf_buffer *mb) +multi_add_mbuf(struct multi_context *m, + struct multi_instance *mi, + struct mbuf_buffer *mb) { - if (multi_output_queue_ready (m, mi)) + if (multi_output_queue_ready(m, mi)) { - struct mbuf_item item; - item.buffer = mb; - item.instance = mi; - mbuf_add_item (m->mbuf, &item); + struct mbuf_item item; + item.buffer = mb; + item.instance = mi; + mbuf_add_item(m->mbuf, &item); } - else + else { - msg (D_MULTI_DROPPED, "MULTI: packet dropped due to output saturation (multi_add_mbuf)"); + msg(D_MULTI_DROPPED, "MULTI: packet dropped due to output saturation (multi_add_mbuf)"); } } @@ -2063,18 +2183,18 @@ multi_add_mbuf (struct multi_context *m, * Add a packet to a client instance output queue. */ static inline void -multi_unicast (struct multi_context *m, - const struct buffer *buf, - struct multi_instance *mi) +multi_unicast(struct multi_context *m, + const struct buffer *buf, + struct multi_instance *mi) { - struct mbuf_buffer *mb; + struct mbuf_buffer *mb; - if (BLEN (buf) > 0) + if (BLEN(buf) > 0) { - mb = mbuf_alloc_buf (buf); - mb->flags = MF_UNICAST; - multi_add_mbuf (m, mi, mb); - mbuf_free_buf (mb); + mb = mbuf_alloc_buf(buf); + mb->flags = MF_UNICAST; + multi_add_mbuf(m, mi, mb); + mbuf_free_buf(mb); } } @@ -2082,61 +2202,61 @@ multi_unicast (struct multi_context *m, * Broadcast a packet to all clients. */ static void -multi_bcast (struct multi_context *m, - const struct buffer *buf, - const struct multi_instance *sender_instance, - const struct mroute_addr *sender_addr) +multi_bcast(struct multi_context *m, + const struct buffer *buf, + const struct multi_instance *sender_instance, + const struct mroute_addr *sender_addr) { - struct hash_iterator hi; - struct hash_element *he; - struct multi_instance *mi; - struct mbuf_buffer *mb; + struct hash_iterator hi; + struct hash_element *he; + struct multi_instance *mi; + struct mbuf_buffer *mb; - if (BLEN (buf) > 0) + if (BLEN(buf) > 0) { - perf_push (PERF_MULTI_BCAST); + perf_push(PERF_MULTI_BCAST); #ifdef MULTI_DEBUG_EVENT_LOOP - printf ("BCAST len=%d\n", BLEN (buf)); + printf("BCAST len=%d\n", BLEN(buf)); #endif - mb = mbuf_alloc_buf (buf); - hash_iterator_init (m->iter, &hi); - - while ((he = hash_iterator_next (&hi))) - { - mi = (struct multi_instance *) he->value; - if (mi != sender_instance && !mi->halt) - { + mb = mbuf_alloc_buf(buf); + hash_iterator_init(m->iter, &hi); + + while ((he = hash_iterator_next(&hi))) + { + mi = (struct multi_instance *) he->value; + if (mi != sender_instance && !mi->halt) + { #ifdef ENABLE_PF - if (sender_instance) - { - if (!pf_c2c_test (&sender_instance->context, &mi->context, "bcast_c2c")) - { - msg (D_PF_DROPPED_BCAST, "PF: client[%s] -> client[%s] packet dropped by BCAST packet filter", - mi_prefix (sender_instance), - mi_prefix (mi)); - continue; - } - } - if (sender_addr) - { - if (!pf_addr_test (&mi->context, sender_addr, "bcast_src_addr")) - { - struct gc_arena gc = gc_new (); - msg (D_PF_DROPPED_BCAST, "PF: addr[%s] -> client[%s] packet dropped by BCAST packet filter", - mroute_addr_print_ex (sender_addr, MAPF_SHOW_ARP, &gc), - mi_prefix (mi)); - gc_free (&gc); - continue; - } - } -#endif - multi_add_mbuf (m, mi, mb); - } - } + if (sender_instance) + { + if (!pf_c2c_test(&sender_instance->context, &mi->context, "bcast_c2c")) + { + msg(D_PF_DROPPED_BCAST, "PF: client[%s] -> client[%s] packet dropped by BCAST packet filter", + mi_prefix(sender_instance), + mi_prefix(mi)); + continue; + } + } + if (sender_addr) + { + if (!pf_addr_test(&mi->context, sender_addr, "bcast_src_addr")) + { + struct gc_arena gc = gc_new(); + msg(D_PF_DROPPED_BCAST, "PF: addr[%s] -> client[%s] packet dropped by BCAST packet filter", + mroute_addr_print_ex(sender_addr, MAPF_SHOW_ARP, &gc), + mi_prefix(mi)); + gc_free(&gc); + continue; + } + } +#endif /* ifdef ENABLE_PF */ + multi_add_mbuf(m, mi, mb); + } + } - hash_iterator_free (&hi); - mbuf_free_buf (mb); - perf_pop (); + hash_iterator_free(&hi); + mbuf_free_buf(mb); + perf_pop(); } } @@ -2152,35 +2272,39 @@ multi_bcast (struct multi_context *m, * Sigma should be no larger than TV_WITHIN_SIGMA_MAX_USEC */ static inline unsigned int -compute_wakeup_sigma (const struct timeval *delta) +compute_wakeup_sigma(const struct timeval *delta) { - if (delta->tv_sec < 1) + if (delta->tv_sec < 1) { - /* if < 1 sec, fuzz = # of microseconds / 8 */ - return delta->tv_usec >> 3; + /* if < 1 sec, fuzz = # of microseconds / 8 */ + return delta->tv_usec >> 3; } - else + else { - /* if < 10 minutes, fuzz = 13.1% of timeout */ - if (delta->tv_sec < 600) - return delta->tv_sec << 17; - else - return 120000000; /* if >= 10 minutes, fuzz = 2 minutes */ + /* if < 10 minutes, fuzz = 13.1% of timeout */ + if (delta->tv_sec < 600) + { + return delta->tv_sec << 17; + } + else + { + return 120000000; /* if >= 10 minutes, fuzz = 2 minutes */ + } } } static void -multi_schedule_context_wakeup (struct multi_context *m, struct multi_instance *mi) +multi_schedule_context_wakeup(struct multi_context *m, struct multi_instance *mi) { - /* calculate an absolute wakeup time */ - ASSERT (!openvpn_gettimeofday (&mi->wakeup, NULL)); - tv_add (&mi->wakeup, &mi->context.c2.timeval); + /* calculate an absolute wakeup time */ + ASSERT(!openvpn_gettimeofday(&mi->wakeup, NULL)); + tv_add(&mi->wakeup, &mi->context.c2.timeval); - /* tell scheduler to wake us up at some point in the future */ - schedule_add_entry (m->schedule, - (struct schedule_entry *) mi, - &mi->wakeup, - compute_wakeup_sigma (&mi->context.c2.timeval)); + /* tell scheduler to wake us up at some point in the future */ + schedule_add_entry(m->schedule, + (struct schedule_entry *) mi, + &mi->wakeup, + compute_wakeup_sigma(&mi->context.c2.timeval)); } /* @@ -2191,139 +2315,146 @@ multi_schedule_context_wakeup (struct multi_context *m, struct multi_instance *m * Also close context on signal. */ bool -multi_process_post (struct multi_context *m, struct multi_instance *mi, const unsigned int flags) +multi_process_post(struct multi_context *m, struct multi_instance *mi, const unsigned int flags) { - bool ret = true; + bool ret = true; - if (!IS_SIG (&mi->context) && ((flags & MPP_PRE_SELECT) || ((flags & MPP_CONDITIONAL_PRE_SELECT) && !ANY_OUT (&mi->context)))) + if (!IS_SIG(&mi->context) && ((flags & MPP_PRE_SELECT) || ((flags & MPP_CONDITIONAL_PRE_SELECT) && !ANY_OUT(&mi->context)))) { #if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH) - bool was_authenticated = false; - struct key_state *ks = NULL; - if (mi->context.c2.tls_multi) + bool was_authenticated = false; + struct key_state *ks = NULL; + if (mi->context.c2.tls_multi) { - ks = &mi->context.c2.tls_multi->session[TM_ACTIVE].key[KS_PRIMARY]; - was_authenticated = ks->authenticated; + ks = &mi->context.c2.tls_multi->session[TM_ACTIVE].key[KS_PRIMARY]; + was_authenticated = ks->authenticated; } #endif - /* figure timeouts and fetch possible outgoing - to_link packets (such as ping or TLS control) */ - pre_select (&mi->context); + /* figure timeouts and fetch possible outgoing + * to_link packets (such as ping or TLS control) */ + pre_select(&mi->context); #if defined(ENABLE_ASYNC_PUSH) && defined(ENABLE_DEF_AUTH) - if (ks && ks->auth_control_file && ks->auth_deferred && !was_authenticated) - { - /* watch acf file */ - long watch_descriptor = inotify_add_watch(m->top.c2.inotify_fd, ks->auth_control_file, IN_CLOSE_WRITE | IN_ONESHOT); - if (watch_descriptor >= 0) - { - if (mi->inotify_watch != -1) - { - hash_remove(m->inotify_watchers, (void*) (unsigned long)mi->inotify_watch); - } - hash_add (m->inotify_watchers, (const uintptr_t*)watch_descriptor, mi, true); - mi->inotify_watch = watch_descriptor; - } - else - { - msg(M_NONFATAL, "MULTI: inotify_add_watch error: %s", strerror(errno)); - } - } + if (ks && ks->auth_control_file && ks->auth_deferred && !was_authenticated) + { + /* watch acf file */ + long watch_descriptor = inotify_add_watch(m->top.c2.inotify_fd, ks->auth_control_file, IN_CLOSE_WRITE | IN_ONESHOT); + if (watch_descriptor >= 0) + { + if (mi->inotify_watch != -1) + { + hash_remove(m->inotify_watchers, (void *) (unsigned long)mi->inotify_watch); + } + hash_add(m->inotify_watchers, (const uintptr_t *)watch_descriptor, mi, true); + mi->inotify_watch = watch_descriptor; + } + else + { + msg(M_NONFATAL, "MULTI: inotify_add_watch error: %s", strerror(errno)); + } + } #endif - if (!IS_SIG (&mi->context)) - { - /* connection is "established" when SSL/TLS key negotiation succeeds - and (if specified) auth user/pass succeeds */ - if (!mi->connection_established_flag && CONNECTION_ESTABLISHED (&mi->context)) - multi_connection_established (m, mi); - - /* tell scheduler to wake us up at some point in the future */ - multi_schedule_context_wakeup(m, mi); - } + if (!IS_SIG(&mi->context)) + { + /* connection is "established" when SSL/TLS key negotiation succeeds + * and (if specified) auth user/pass succeeds */ + if (!mi->connection_established_flag && CONNECTION_ESTABLISHED(&mi->context)) + { + multi_connection_established(m, mi); + } + + /* tell scheduler to wake us up at some point in the future */ + multi_schedule_context_wakeup(m, mi); + } } - if (IS_SIG (&mi->context)) + if (IS_SIG(&mi->context)) { - if (flags & MPP_CLOSE_ON_SIGNAL) - { - multi_close_instance_on_signal (m, mi); - ret = false; - } + if (flags & MPP_CLOSE_ON_SIGNAL) + { + multi_close_instance_on_signal(m, mi); + ret = false; + } } - else + else { - /* continue to pend on output? */ - multi_set_pending (m, ANY_OUT (&mi->context) ? mi : NULL); + /* continue to pend on output? */ + multi_set_pending(m, ANY_OUT(&mi->context) ? mi : NULL); #ifdef MULTI_DEBUG_EVENT_LOOP - printf ("POST %s[%d] to=%d lo=%d/%d w=%d/%d\n", - id(mi), - (int) (mi == m->pending), - mi ? mi->context.c2.to_tun.len : -1, - mi ? mi->context.c2.to_link.len : -1, - (mi && mi->context.c2.fragment) ? mi->context.c2.fragment->outgoing.len : -1, - (int)mi->context.c2.timeval.tv_sec, - (int)mi->context.c2.timeval.tv_usec); + printf("POST %s[%d] to=%d lo=%d/%d w=%d/%d\n", + id(mi), + (int) (mi == m->pending), + mi ? mi->context.c2.to_tun.len : -1, + mi ? mi->context.c2.to_link.len : -1, + (mi && mi->context.c2.fragment) ? mi->context.c2.fragment->outgoing.len : -1, + (int)mi->context.c2.timeval.tv_sec, + (int)mi->context.c2.timeval.tv_usec); #endif } - if ((flags & MPP_RECORD_TOUCH) && m->mpp_touched) - *m->mpp_touched = mi; + if ((flags & MPP_RECORD_TOUCH) && m->mpp_touched) + { + *m->mpp_touched = mi; + } - return ret; + return ret; } -void multi_process_float (struct multi_context* m, struct multi_instance* mi) +void +multi_process_float(struct multi_context *m, struct multi_instance *mi) { - struct mroute_addr real; - struct hash *hash = m->hash; - struct gc_arena gc = gc_new (); + struct mroute_addr real; + struct hash *hash = m->hash; + struct gc_arena gc = gc_new(); - if (!mroute_extract_openvpn_sockaddr (&real, &m->top.c2.from.dest, true)) - goto done; + if (!mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true)) + { + goto done; + } - const uint32_t hv = hash_value (hash, &real); - struct hash_bucket *bucket = hash_bucket (hash, hv); + const uint32_t hv = hash_value(hash, &real); + struct hash_bucket *bucket = hash_bucket(hash, hv); - /* make sure that we don't float to an address taken by another client */ - struct hash_element *he = hash_lookup_fast (hash, bucket, &real, hv); - if (he) + /* make sure that we don't float to an address taken by another client */ + struct hash_element *he = hash_lookup_fast(hash, bucket, &real, hv); + if (he) { - struct multi_instance *ex_mi = (struct multi_instance *) he->value; + struct multi_instance *ex_mi = (struct multi_instance *) he->value; - struct tls_multi *m1 = mi->context.c2.tls_multi; - struct tls_multi *m2 = ex_mi->context.c2.tls_multi; + struct tls_multi *m1 = mi->context.c2.tls_multi; + struct tls_multi *m2 = ex_mi->context.c2.tls_multi; - /* do not float if target address is taken by client with another cert */ - if (!cert_hash_compare(m1->locked_cert_hash_set, m2->locked_cert_hash_set)) - { - msg (D_MULTI_LOW, "Disallow float to an address taken by another client %s", - multi_instance_string (ex_mi, false, &gc)); + /* do not float if target address is taken by client with another cert */ + if (!cert_hash_compare(m1->locked_cert_hash_set, m2->locked_cert_hash_set)) + { + msg(D_MULTI_LOW, "Disallow float to an address taken by another client %s", + multi_instance_string(ex_mi, false, &gc)); - mi->context.c2.buf.len = 0; + mi->context.c2.buf.len = 0; - goto done; - } + goto done; + } - msg (D_MULTI_MEDIUM, "closing instance %s", multi_instance_string (ex_mi, false, &gc)); - multi_close_instance(m, ex_mi, false); + msg(D_MULTI_MEDIUM, "closing instance %s", multi_instance_string(ex_mi, false, &gc)); + multi_close_instance(m, ex_mi, false); } - msg (D_MULTI_MEDIUM, "peer %" PRIu32 " (%s) floated from %s to %s", - mi->context.c2.tls_multi->peer_id, - tls_common_name (mi->context.c2.tls_multi, false), - mroute_addr_print (&mi->real, &gc), - print_link_socket_actual (&m->top.c2.from, &gc)); + msg(D_MULTI_MEDIUM, "peer %" PRIu32 " (%s) floated from %s to %s", + mi->context.c2.tls_multi->peer_id, + tls_common_name(mi->context.c2.tls_multi, false), + mroute_addr_print(&mi->real, &gc), + print_link_socket_actual(&m->top.c2.from, &gc)); /* remove old address from hash table before changing address */ - ASSERT (hash_remove (m->hash, &mi->real)); - ASSERT (hash_remove (m->iter, &mi->real)); + ASSERT(hash_remove(m->hash, &mi->real)); + ASSERT(hash_remove(m->iter, &mi->real)); /* change external network address of the remote peer */ mi->real = real; - generate_prefix (mi); + generate_prefix(mi); mi->context.c2.from = m->top.c2.from; mi->context.c2.to_link_addr = &mi->context.c2.from; @@ -2332,17 +2463,17 @@ void multi_process_float (struct multi_context* m, struct multi_instance* mi) mi->context.c2.link_socket = m->top.c2.link_socket; mi->context.c2.link_socket_info->lsa->actual = m->top.c2.from; - tls_update_remote_addr (mi->context.c2.tls_multi, &mi->context.c2.from); + tls_update_remote_addr(mi->context.c2.tls_multi, &mi->context.c2.from); - ASSERT (hash_add (m->hash, &mi->real, mi, false)); - ASSERT (hash_add (m->iter, &mi->real, mi, false)); + ASSERT(hash_add(m->hash, &mi->real, mi, false)); + ASSERT(hash_add(m->iter, &mi->real, mi, false)); #ifdef MANAGEMENT_DEF_AUTH - ASSERT (hash_add (m->cid_hash, &mi->context.c2.mda_context.cid, mi, true)); + ASSERT(hash_add(m->cid_hash, &mi->context.c2.mda_context.cid, mi, true)); #endif done: - gc_free (&gc); + gc_free(&gc); } /* @@ -2350,224 +2481,230 @@ done: * i.e. client -> server direction. */ bool -multi_process_incoming_link (struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags) +multi_process_incoming_link(struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags) { - struct gc_arena gc = gc_new (); + struct gc_arena gc = gc_new(); - struct context *c; - struct mroute_addr src, dest; - unsigned int mroute_flags; - struct multi_instance *mi; - bool ret = true; - bool floated = false; + struct context *c; + struct mroute_addr src, dest; + unsigned int mroute_flags; + struct multi_instance *mi; + bool ret = true; + bool floated = false; - if (m->pending) - return true; + if (m->pending) + { + return true; + } - if (!instance) + if (!instance) { #ifdef MULTI_DEBUG_EVENT_LOOP - printf ("TCP/UDP -> TUN [%d]\n", BLEN (&m->top.c2.buf)); + printf("TCP/UDP -> TUN [%d]\n", BLEN(&m->top.c2.buf)); #endif - multi_set_pending (m, multi_get_create_instance_udp (m, &floated)); - } - else - multi_set_pending (m, instance); - - if (m->pending) - { - set_prefix (m->pending); - - /* get instance context */ - c = &m->pending->context; - - if (!instance) - { - /* transfer packet pointer from top-level context buffer to instance */ - c->c2.buf = m->top.c2.buf; - - /* transfer from-addr from top-level context buffer to instance */ - if (!floated) - c->c2.from = m->top.c2.from; - } - - if (BLEN (&c->c2.buf) > 0) - { - struct link_socket_info *lsi; - const uint8_t *orig_buf; - - /* decrypt in instance context */ - - perf_push (PERF_PROC_IN_LINK); - lsi = get_link_socket_info (c); - orig_buf = c->c2.buf.data; - if (process_incoming_link_part1(c, lsi, floated)) - { - if (floated) - { - multi_process_float (m, m->pending); - } - - process_incoming_link_part2(c, lsi, orig_buf); - } - perf_pop (); - - if (TUNNEL_TYPE (m->top.c1.tuntap) == DEV_TYPE_TUN) - { - /* extract packet source and dest addresses */ - mroute_flags = mroute_extract_addr_from_packet (&src, - &dest, - NULL, - NULL, - &c->c2.to_tun, - DEV_TYPE_TUN); - - /* drop packet if extract failed */ - if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED)) - { - c->c2.to_tun.len = 0; - } - /* make sure that source address is associated with this client */ - else if (multi_get_instance_by_virtual_addr (m, &src, true) != m->pending) - { - /* IPv6 link-local address (fe80::xxx)? */ - if ( (src.type & MR_ADDR_MASK) == MR_ADDR_IPV6 && - IN6_IS_ADDR_LINKLOCAL (&src.v6.addr) ) - { - /* do nothing, for now. TODO: add address learning */ - } - else - { - msg (D_MULTI_DROPPED, "MULTI: bad source address from client [%s], packet dropped", - mroute_addr_print (&src, &gc)); - } - c->c2.to_tun.len = 0; - } - /* client-to-client communication enabled? */ - else if (m->enable_c2c) - { - /* multicast? */ - if (mroute_flags & MROUTE_EXTRACT_MCAST) - { - /* for now, treat multicast as broadcast */ - multi_bcast (m, &c->c2.to_tun, m->pending, NULL); - } - else /* possible client to client routing */ - { - ASSERT (!(mroute_flags & MROUTE_EXTRACT_BCAST)); - mi = multi_get_instance_by_virtual_addr (m, &dest, true); - - /* if dest addr is a known client, route to it */ - if (mi) - { + multi_set_pending(m, multi_get_create_instance_udp(m, &floated)); + } + else + { + multi_set_pending(m, instance); + } + + if (m->pending) + { + set_prefix(m->pending); + + /* get instance context */ + c = &m->pending->context; + + if (!instance) + { + /* transfer packet pointer from top-level context buffer to instance */ + c->c2.buf = m->top.c2.buf; + + /* transfer from-addr from top-level context buffer to instance */ + if (!floated) + { + c->c2.from = m->top.c2.from; + } + } + + if (BLEN(&c->c2.buf) > 0) + { + struct link_socket_info *lsi; + const uint8_t *orig_buf; + + /* decrypt in instance context */ + + perf_push(PERF_PROC_IN_LINK); + lsi = get_link_socket_info(c); + orig_buf = c->c2.buf.data; + if (process_incoming_link_part1(c, lsi, floated)) + { + if (floated) + { + multi_process_float(m, m->pending); + } + + process_incoming_link_part2(c, lsi, orig_buf); + } + perf_pop(); + + if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TUN) + { + /* extract packet source and dest addresses */ + mroute_flags = mroute_extract_addr_from_packet(&src, + &dest, + NULL, + NULL, + &c->c2.to_tun, + DEV_TYPE_TUN); + + /* drop packet if extract failed */ + if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED)) + { + c->c2.to_tun.len = 0; + } + /* make sure that source address is associated with this client */ + else if (multi_get_instance_by_virtual_addr(m, &src, true) != m->pending) + { + /* IPv6 link-local address (fe80::xxx)? */ + if ( (src.type & MR_ADDR_MASK) == MR_ADDR_IPV6 + && IN6_IS_ADDR_LINKLOCAL(&src.v6.addr) ) + { + /* do nothing, for now. TODO: add address learning */ + } + else + { + msg(D_MULTI_DROPPED, "MULTI: bad source address from client [%s], packet dropped", + mroute_addr_print(&src, &gc)); + } + c->c2.to_tun.len = 0; + } + /* client-to-client communication enabled? */ + else if (m->enable_c2c) + { + /* multicast? */ + if (mroute_flags & MROUTE_EXTRACT_MCAST) + { + /* for now, treat multicast as broadcast */ + multi_bcast(m, &c->c2.to_tun, m->pending, NULL); + } + else /* possible client to client routing */ + { + ASSERT(!(mroute_flags & MROUTE_EXTRACT_BCAST)); + mi = multi_get_instance_by_virtual_addr(m, &dest, true); + + /* if dest addr is a known client, route to it */ + if (mi) + { #ifdef ENABLE_PF - if (!pf_c2c_test (c, &mi->context, "tun_c2c")) - { - msg (D_PF_DROPPED, "PF: client -> client[%s] packet dropped by TUN packet filter", - mi_prefix (mi)); - } - else + if (!pf_c2c_test(c, &mi->context, "tun_c2c")) + { + msg(D_PF_DROPPED, "PF: client -> client[%s] packet dropped by TUN packet filter", + mi_prefix(mi)); + } + else #endif - { - multi_unicast (m, &c->c2.to_tun, mi); - register_activity (c, BLEN(&c->c2.to_tun)); - } - c->c2.to_tun.len = 0; - } - } - } + { + multi_unicast(m, &c->c2.to_tun, mi); + register_activity(c, BLEN(&c->c2.to_tun)); + } + c->c2.to_tun.len = 0; + } + } + } #ifdef ENABLE_PF - if (c->c2.to_tun.len && !pf_addr_test (c, &dest, "tun_dest_addr")) - { - msg (D_PF_DROPPED, "PF: client -> addr[%s] packet dropped by TUN packet filter", - mroute_addr_print_ex (&dest, MAPF_SHOW_ARP, &gc)); - c->c2.to_tun.len = 0; - } + if (c->c2.to_tun.len && !pf_addr_test(c, &dest, "tun_dest_addr")) + { + msg(D_PF_DROPPED, "PF: client -> addr[%s] packet dropped by TUN packet filter", + mroute_addr_print_ex(&dest, MAPF_SHOW_ARP, &gc)); + c->c2.to_tun.len = 0; + } #endif - } - else if (TUNNEL_TYPE (m->top.c1.tuntap) == DEV_TYPE_TAP) - { + } + else if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TAP) + { #ifdef ENABLE_PF - struct mroute_addr edest; - mroute_addr_reset (&edest); + struct mroute_addr edest; + mroute_addr_reset(&edest); #endif - /* extract packet source and dest addresses */ - mroute_flags = mroute_extract_addr_from_packet (&src, - &dest, - NULL, + /* extract packet source and dest addresses */ + mroute_flags = mroute_extract_addr_from_packet(&src, + &dest, + NULL, #ifdef ENABLE_PF - &edest, + &edest, #else - NULL, + NULL, #endif - &c->c2.to_tun, - DEV_TYPE_TAP); - - if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED) - { - if (multi_learn_addr (m, m->pending, &src, 0) == m->pending) - { - /* check for broadcast */ - if (m->enable_c2c) - { - if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST)) - { - multi_bcast (m, &c->c2.to_tun, m->pending, NULL); - } - else /* try client-to-client routing */ - { - mi = multi_get_instance_by_virtual_addr (m, &dest, false); - - /* if dest addr is a known client, route to it */ - if (mi) - { + &c->c2.to_tun, + DEV_TYPE_TAP); + + if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED) + { + if (multi_learn_addr(m, m->pending, &src, 0) == m->pending) + { + /* check for broadcast */ + if (m->enable_c2c) + { + if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST)) + { + multi_bcast(m, &c->c2.to_tun, m->pending, NULL); + } + else /* try client-to-client routing */ + { + mi = multi_get_instance_by_virtual_addr(m, &dest, false); + + /* if dest addr is a known client, route to it */ + if (mi) + { #ifdef ENABLE_PF - if (!pf_c2c_test (c, &mi->context, "tap_c2c")) - { - msg (D_PF_DROPPED, "PF: client -> client[%s] packet dropped by TAP packet filter", - mi_prefix (mi)); - } - else + if (!pf_c2c_test(c, &mi->context, "tap_c2c")) + { + msg(D_PF_DROPPED, "PF: client -> client[%s] packet dropped by TAP packet filter", + mi_prefix(mi)); + } + else #endif - { - multi_unicast (m, &c->c2.to_tun, mi); - register_activity (c, BLEN(&c->c2.to_tun)); - } - c->c2.to_tun.len = 0; - } - } - } + { + multi_unicast(m, &c->c2.to_tun, mi); + register_activity(c, BLEN(&c->c2.to_tun)); + } + c->c2.to_tun.len = 0; + } + } + } #ifdef ENABLE_PF - if (c->c2.to_tun.len && !pf_addr_test (c, &edest, "tap_dest_addr")) - { - msg (D_PF_DROPPED, "PF: client -> addr[%s] packet dropped by TAP packet filter", - mroute_addr_print_ex (&edest, MAPF_SHOW_ARP, &gc)); - c->c2.to_tun.len = 0; - } + if (c->c2.to_tun.len && !pf_addr_test(c, &edest, "tap_dest_addr")) + { + msg(D_PF_DROPPED, "PF: client -> addr[%s] packet dropped by TAP packet filter", + mroute_addr_print_ex(&edest, MAPF_SHOW_ARP, &gc)); + c->c2.to_tun.len = 0; + } #endif - } - else - { - msg (D_MULTI_DROPPED, "MULTI: bad source address from client [%s], packet dropped", - mroute_addr_print (&src, &gc)); - c->c2.to_tun.len = 0; - } - } - else - { - c->c2.to_tun.len = 0; - } - } - } + } + else + { + msg(D_MULTI_DROPPED, "MULTI: bad source address from client [%s], packet dropped", + mroute_addr_print(&src, &gc)); + c->c2.to_tun.len = 0; + } + } + else + { + c->c2.to_tun.len = 0; + } + } + } - /* postprocess and set wakeup */ - ret = multi_process_post (m, m->pending, mpp_flags); + /* postprocess and set wakeup */ + ret = multi_process_post(m, m->pending, mpp_flags); - clear_prefix (); + clear_prefix(); } - gc_free (&gc); - return ret; + gc_free(&gc); + return ret; } /* @@ -2575,115 +2712,117 @@ multi_process_incoming_link (struct multi_context *m, struct multi_instance *ins * i.e. server -> client direction. */ bool -multi_process_incoming_tun (struct multi_context *m, const unsigned int mpp_flags) +multi_process_incoming_tun(struct multi_context *m, const unsigned int mpp_flags) { - struct gc_arena gc = gc_new (); - bool ret = true; + struct gc_arena gc = gc_new(); + bool ret = true; - if (BLEN (&m->top.c2.buf) > 0) + if (BLEN(&m->top.c2.buf) > 0) { - unsigned int mroute_flags; - struct mroute_addr src, dest; - const int dev_type = TUNNEL_TYPE (m->top.c1.tuntap); + unsigned int mroute_flags; + struct mroute_addr src, dest; + const int dev_type = TUNNEL_TYPE(m->top.c1.tuntap); #ifdef ENABLE_PF - struct mroute_addr esrc, *e1, *e2; - if (dev_type == DEV_TYPE_TUN) - { - e1 = NULL; - e2 = &src; - } - else - { - e1 = e2 = &esrc; - mroute_addr_reset (&esrc); - } + struct mroute_addr esrc, *e1, *e2; + if (dev_type == DEV_TYPE_TUN) + { + e1 = NULL; + e2 = &src; + } + else + { + e1 = e2 = &esrc; + mroute_addr_reset(&esrc); + } #endif #ifdef MULTI_DEBUG_EVENT_LOOP - printf ("TUN -> TCP/UDP [%d]\n", BLEN (&m->top.c2.buf)); + printf("TUN -> TCP/UDP [%d]\n", BLEN(&m->top.c2.buf)); #endif - if (m->pending) - return true; + if (m->pending) + { + return true; + } - /* - * Route an incoming tun/tap packet to - * the appropriate multi_instance object. - */ + /* + * Route an incoming tun/tap packet to + * the appropriate multi_instance object. + */ - mroute_flags = mroute_extract_addr_from_packet (&src, - &dest, + mroute_flags = mroute_extract_addr_from_packet(&src, + &dest, #ifdef ENABLE_PF - e1, + e1, #else - NULL, + NULL, #endif - NULL, - &m->top.c2.buf, - dev_type); - - if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED) - { - struct context *c; - - /* broadcast or multicast dest addr? */ - if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST)) - { - /* for now, treat multicast as broadcast */ + NULL, + &m->top.c2.buf, + dev_type); + + if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED) + { + struct context *c; + + /* broadcast or multicast dest addr? */ + if (mroute_flags & (MROUTE_EXTRACT_BCAST|MROUTE_EXTRACT_MCAST)) + { + /* for now, treat multicast as broadcast */ #ifdef ENABLE_PF - multi_bcast (m, &m->top.c2.buf, NULL, e2); + multi_bcast(m, &m->top.c2.buf, NULL, e2); #else - multi_bcast (m, &m->top.c2.buf, NULL, NULL); + multi_bcast(m, &m->top.c2.buf, NULL, NULL); #endif - } - else - { - multi_set_pending (m, multi_get_instance_by_virtual_addr (m, &dest, dev_type == DEV_TYPE_TUN)); - - if (m->pending) - { - /* get instance context */ - c = &m->pending->context; - - set_prefix (m->pending); + } + else + { + multi_set_pending(m, multi_get_instance_by_virtual_addr(m, &dest, dev_type == DEV_TYPE_TUN)); + + if (m->pending) + { + /* get instance context */ + c = &m->pending->context; + + set_prefix(m->pending); #ifdef ENABLE_PF - if (!pf_addr_test (c, e2, "tun_tap_src_addr")) - { - msg (D_PF_DROPPED, "PF: addr[%s] -> client packet dropped by packet filter", - mroute_addr_print_ex (&src, MAPF_SHOW_ARP, &gc)); - buf_reset_len (&c->c2.buf); - } - else + if (!pf_addr_test(c, e2, "tun_tap_src_addr")) + { + msg(D_PF_DROPPED, "PF: addr[%s] -> client packet dropped by packet filter", + mroute_addr_print_ex(&src, MAPF_SHOW_ARP, &gc)); + buf_reset_len(&c->c2.buf); + } + else #endif - { - if (multi_output_queue_ready (m, m->pending)) - { - /* transfer packet pointer from top-level context buffer to instance */ - c->c2.buf = m->top.c2.buf; - } - else - { - /* drop packet */ - msg (D_MULTI_DROPPED, "MULTI: packet dropped due to output saturation (multi_process_incoming_tun)"); - buf_reset_len (&c->c2.buf); - } - } - - /* encrypt in instance context */ - process_incoming_tun (c); - - /* postprocess and set wakeup */ - ret = multi_process_post (m, m->pending, mpp_flags); - - clear_prefix (); - } - } - } - } - gc_free (&gc); - return ret; + { + if (multi_output_queue_ready(m, m->pending)) + { + /* transfer packet pointer from top-level context buffer to instance */ + c->c2.buf = m->top.c2.buf; + } + else + { + /* drop packet */ + msg(D_MULTI_DROPPED, "MULTI: packet dropped due to output saturation (multi_process_incoming_tun)"); + buf_reset_len(&c->c2.buf); + } + } + + /* encrypt in instance context */ + process_incoming_tun(c); + + /* postprocess and set wakeup */ + ret = multi_process_post(m, m->pending, mpp_flags); + + clear_prefix(); + } + } + } + } + gc_free(&gc); + return ret; } /* @@ -2691,30 +2830,32 @@ multi_process_incoming_tun (struct multi_context *m, const unsigned int mpp_flag * queue. */ struct multi_instance * -multi_get_queue (struct mbuf_set *ms) +multi_get_queue(struct mbuf_set *ms) { - struct mbuf_item item; + struct mbuf_item item; - if (mbuf_extract_item (ms, &item)) /* cleartext IP packet */ + if (mbuf_extract_item(ms, &item)) /* cleartext IP packet */ { - unsigned int pip_flags = PIPV4_PASSTOS; + unsigned int pip_flags = PIPV4_PASSTOS; - set_prefix (item.instance); - item.instance->context.c2.buf = item.buffer->buf; - if (item.buffer->flags & MF_UNICAST) /* --mssfix doesn't make sense for broadcast or multicast */ - pip_flags |= PIP_MSSFIX; - process_ip_header (&item.instance->context, pip_flags, &item.instance->context.c2.buf); - encrypt_sign (&item.instance->context, true); - mbuf_free_buf (item.buffer); + set_prefix(item.instance); + item.instance->context.c2.buf = item.buffer->buf; + if (item.buffer->flags & MF_UNICAST) /* --mssfix doesn't make sense for broadcast or multicast */ + { + pip_flags |= PIP_MSSFIX; + } + process_ip_header(&item.instance->context, pip_flags, &item.instance->context.c2.buf); + encrypt_sign(&item.instance->context, true); + mbuf_free_buf(item.buffer); - dmsg (D_MULTI_DEBUG, "MULTI: C2C/MCAST/BCAST"); + dmsg(D_MULTI_DEBUG, "MULTI: C2C/MCAST/BCAST"); - clear_prefix (); - return item.instance; + clear_prefix(); + return item.instance; } - else + else { - return NULL; + return NULL; } } @@ -2723,52 +2864,52 @@ multi_get_queue (struct mbuf_set *ms) * client instance object needs timer-based service. */ bool -multi_process_timeout (struct multi_context *m, const unsigned int mpp_flags) +multi_process_timeout(struct multi_context *m, const unsigned int mpp_flags) { - bool ret = true; + bool ret = true; #ifdef MULTI_DEBUG_EVENT_LOOP - printf ("%s -> TIMEOUT\n", id(m->earliest_wakeup)); + printf("%s -> TIMEOUT\n", id(m->earliest_wakeup)); #endif - /* instance marked for wakeup? */ - if (m->earliest_wakeup) + /* instance marked for wakeup? */ + if (m->earliest_wakeup) { - if (m->earliest_wakeup == (struct multi_instance*)&m->deferred_shutdown_signal) - { - schedule_remove_entry(m->schedule, (struct schedule_entry*) &m->deferred_shutdown_signal); - throw_signal(m->deferred_shutdown_signal.signal_received); - } - else - { - set_prefix (m->earliest_wakeup); - ret = multi_process_post (m, m->earliest_wakeup, mpp_flags); - clear_prefix (); - } - m->earliest_wakeup = NULL; + if (m->earliest_wakeup == (struct multi_instance *)&m->deferred_shutdown_signal) + { + schedule_remove_entry(m->schedule, (struct schedule_entry *) &m->deferred_shutdown_signal); + throw_signal(m->deferred_shutdown_signal.signal_received); + } + else + { + set_prefix(m->earliest_wakeup); + ret = multi_process_post(m, m->earliest_wakeup, mpp_flags); + clear_prefix(); + } + m->earliest_wakeup = NULL; } - return ret; + return ret; } /* * Drop a TUN/TAP outgoing packet.. */ void -multi_process_drop_outgoing_tun (struct multi_context *m, const unsigned int mpp_flags) +multi_process_drop_outgoing_tun(struct multi_context *m, const unsigned int mpp_flags) { - struct multi_instance *mi = m->pending; + struct multi_instance *mi = m->pending; - ASSERT (mi); + ASSERT(mi); - set_prefix (mi); + set_prefix(mi); - msg (D_MULTI_ERRORS, "MULTI: Outgoing TUN queue full, dropped packet len=%d", - mi->context.c2.to_tun.len); + msg(D_MULTI_ERRORS, "MULTI: Outgoing TUN queue full, dropped packet len=%d", + mi->context.c2.to_tun.len); - buf_reset (&mi->context.c2.to_tun); + buf_reset(&mi->context.c2.to_tun); - multi_process_post (m, mi, mpp_flags); - clear_prefix (); + multi_process_post(m, mi, mpp_flags); + clear_prefix(); } /* @@ -2776,13 +2917,13 @@ multi_process_drop_outgoing_tun (struct multi_context *m, const unsigned int mpp */ void -route_quota_exceeded (const struct multi_context *m, const struct multi_instance *mi) +route_quota_exceeded(const struct multi_context *m, const struct multi_instance *mi) { - struct gc_arena gc = gc_new (); - msg (D_ROUTE_QUOTA, "MULTI ROUTE: route quota (%d) exceeded for %s (see --max-routes-per-client option)", - mi->context.options.max_routes_per_client, - multi_instance_string (mi, false, &gc)); - gc_free (&gc); + struct gc_arena gc = gc_new(); + msg(D_ROUTE_QUOTA, "MULTI ROUTE: route quota (%d) exceeded for %s (see --max-routes-per-client option)", + mi->context.options.max_routes_per_client, + multi_instance_string(mi, false, &gc)); + gc_free(&gc); } #ifdef ENABLE_DEBUG @@ -2790,124 +2931,128 @@ route_quota_exceeded (const struct multi_context *m, const struct multi_instance * Flood clients with random packets */ static void -gremlin_flood_clients (struct multi_context *m) +gremlin_flood_clients(struct multi_context *m) { - const int level = GREMLIN_PACKET_FLOOD_LEVEL (m->top.options.gremlin); - if (level) + const int level = GREMLIN_PACKET_FLOOD_LEVEL(m->top.options.gremlin); + if (level) { - struct gc_arena gc = gc_new (); - struct buffer buf = alloc_buf_gc (BUF_SIZE (&m->top.c2.frame), &gc); - struct packet_flood_parms parm = get_packet_flood_parms (level); - int i; + struct gc_arena gc = gc_new(); + struct buffer buf = alloc_buf_gc(BUF_SIZE(&m->top.c2.frame), &gc); + struct packet_flood_parms parm = get_packet_flood_parms(level); + int i; - ASSERT (buf_init (&buf, FRAME_HEADROOM (&m->top.c2.frame))); - parm.packet_size = min_int (parm.packet_size, MAX_RW_SIZE_TUN (&m->top.c2.frame)); + ASSERT(buf_init(&buf, FRAME_HEADROOM(&m->top.c2.frame))); + parm.packet_size = min_int(parm.packet_size, MAX_RW_SIZE_TUN(&m->top.c2.frame)); - msg (D_GREMLIN, "GREMLIN_FLOOD_CLIENTS: flooding clients with %d packets of size %d", - parm.n_packets, - parm.packet_size); + msg(D_GREMLIN, "GREMLIN_FLOOD_CLIENTS: flooding clients with %d packets of size %d", + parm.n_packets, + parm.packet_size); - for (i = 0; i < parm.packet_size; ++i) - ASSERT (buf_write_u8 (&buf, get_random () & 0xFF)); + for (i = 0; i < parm.packet_size; ++i) + ASSERT(buf_write_u8(&buf, get_random() & 0xFF)); - for (i = 0; i < parm.n_packets; ++i) - multi_bcast (m, &buf, NULL, NULL); + for (i = 0; i < parm.n_packets; ++i) + multi_bcast(m, &buf, NULL, NULL); - gc_free (&gc); + gc_free(&gc); } } -#endif +#endif /* ifdef ENABLE_DEBUG */ bool -stale_route_check_trigger (struct multi_context *m) +stale_route_check_trigger(struct multi_context *m) { - struct timeval null; - CLEAR (null); - return event_timeout_trigger (&m->stale_routes_check_et, &null, ETT_DEFAULT); + struct timeval null; + CLEAR(null); + return event_timeout_trigger(&m->stale_routes_check_et, &null, ETT_DEFAULT); } /* * Process timers in the top-level context */ void -multi_process_per_second_timers_dowork (struct multi_context *m) +multi_process_per_second_timers_dowork(struct multi_context *m) { - /* possibly reap instances/routes in vhash */ - multi_reap_process (m); + /* possibly reap instances/routes in vhash */ + multi_reap_process(m); - /* possibly print to status log */ - if (m->top.c1.status_output) + /* possibly print to status log */ + if (m->top.c1.status_output) { - if (status_trigger (m->top.c1.status_output)) - multi_print_status (m, m->top.c1.status_output, m->status_file_version); + if (status_trigger(m->top.c1.status_output)) + { + multi_print_status(m, m->top.c1.status_output, m->status_file_version); + } } - /* possibly flush ifconfig-pool file */ - multi_ifconfig_pool_persist (m, false); + /* possibly flush ifconfig-pool file */ + multi_ifconfig_pool_persist(m, false); #ifdef ENABLE_DEBUG - gremlin_flood_clients (m); + gremlin_flood_clients(m); #endif - /* Should we check for stale routes? */ - if (m->top.options.stale_routes_check_interval && stale_route_check_trigger (m)) - check_stale_routes (m); + /* Should we check for stale routes? */ + if (m->top.options.stale_routes_check_interval && stale_route_check_trigger(m)) + { + check_stale_routes(m); + } } void -multi_top_init (struct multi_context *m, const struct context *top) +multi_top_init(struct multi_context *m, const struct context *top) { - inherit_context_top (&m->top, top); - m->top.c2.buffers = init_context_buffers (&top->c2.frame); + inherit_context_top(&m->top, top); + m->top.c2.buffers = init_context_buffers(&top->c2.frame); } void -multi_top_free (struct multi_context *m) +multi_top_free(struct multi_context *m) { - close_context (&m->top, -1, CC_GC_FREE); - free_context_buffers (m->top.c2.buffers); + close_context(&m->top, -1, CC_GC_FREE); + free_context_buffers(m->top.c2.buffers); } static bool is_exit_restart(int sig) { - return (sig == SIGUSR1 || sig == SIGTERM || sig == SIGHUP || sig == SIGINT); + return (sig == SIGUSR1 || sig == SIGTERM || sig == SIGHUP || sig == SIGINT); } static void multi_push_restart_schedule_exit(struct multi_context *m, bool next_server) { - struct hash_iterator hi; - struct hash_element *he; - struct timeval tv; + struct hash_iterator hi; + struct hash_element *he; + struct timeval tv; - /* tell all clients to restart */ - hash_iterator_init (m->iter, &hi); - while ((he = hash_iterator_next (&hi))) + /* tell all clients to restart */ + hash_iterator_init(m->iter, &hi); + while ((he = hash_iterator_next(&hi))) { - struct multi_instance *mi = (struct multi_instance *) he->value; - if (!mi->halt) + struct multi_instance *mi = (struct multi_instance *) he->value; + if (!mi->halt) { - send_control_channel_string (&mi->context, next_server ? "RESTART,[N]" : "RESTART", D_PUSH); - multi_schedule_context_wakeup(m, mi); + send_control_channel_string(&mi->context, next_server ? "RESTART,[N]" : "RESTART", D_PUSH); + multi_schedule_context_wakeup(m, mi); } } - hash_iterator_free (&hi); + hash_iterator_free(&hi); - /* reschedule signal */ - ASSERT (!openvpn_gettimeofday (&m->deferred_shutdown_signal.wakeup, NULL)); - tv.tv_sec = 2; - tv.tv_usec = 0; - tv_add (&m->deferred_shutdown_signal.wakeup, &tv); + /* reschedule signal */ + ASSERT(!openvpn_gettimeofday(&m->deferred_shutdown_signal.wakeup, NULL)); + tv.tv_sec = 2; + tv.tv_usec = 0; + tv_add(&m->deferred_shutdown_signal.wakeup, &tv); - m->deferred_shutdown_signal.signal_received = m->top.sig->signal_received; + m->deferred_shutdown_signal.signal_received = m->top.sig->signal_received; - schedule_add_entry (m->schedule, - (struct schedule_entry *) &m->deferred_shutdown_signal, - &m->deferred_shutdown_signal.wakeup, - compute_wakeup_sigma (&m->deferred_shutdown_signal.wakeup)); + schedule_add_entry(m->schedule, + (struct schedule_entry *) &m->deferred_shutdown_signal, + &m->deferred_shutdown_signal.wakeup, + compute_wakeup_sigma(&m->deferred_shutdown_signal.wakeup)); - m->top.sig->signal_received = 0; + m->top.sig->signal_received = 0; } /* @@ -2915,25 +3060,25 @@ multi_push_restart_schedule_exit(struct multi_context *m, bool next_server) * false if it should continue. */ bool -multi_process_signal (struct multi_context *m) +multi_process_signal(struct multi_context *m) { - if (m->top.sig->signal_received == SIGUSR2) + if (m->top.sig->signal_received == SIGUSR2) { - struct status_output *so = status_open (NULL, 0, M_INFO, NULL, 0); - multi_print_status (m, so, m->status_file_version); - status_close (so); - m->top.sig->signal_received = 0; - return false; + struct status_output *so = status_open(NULL, 0, M_INFO, NULL, 0); + multi_print_status(m, so, m->status_file_version); + status_close(so); + m->top.sig->signal_received = 0; + return false; } - else if (proto_is_dgram(m->top.options.ce.proto) && - is_exit_restart(m->top.sig->signal_received) && - (m->deferred_shutdown_signal.signal_received == 0) && - m->top.options.ce.explicit_exit_notification != 0) + else if (proto_is_dgram(m->top.options.ce.proto) + && is_exit_restart(m->top.sig->signal_received) + && (m->deferred_shutdown_signal.signal_received == 0) + && m->top.options.ce.explicit_exit_notification != 0) { - multi_push_restart_schedule_exit(m, m->top.options.ce.explicit_exit_notification == 2); - return false; + multi_push_restart_schedule_exit(m, m->top.options.ce.explicit_exit_notification == 2); + return false; } - return true; + return true; } /* @@ -2941,20 +3086,20 @@ multi_process_signal (struct multi_context *m) * reception of a soft signal. */ void -multi_close_instance_on_signal (struct multi_context *m, struct multi_instance *mi) +multi_close_instance_on_signal(struct multi_context *m, struct multi_instance *mi) { - remap_signal (&mi->context); - set_prefix (mi); - print_signal (mi->context.sig, "client-instance", D_MULTI_LOW); - clear_prefix (); - multi_close_instance (m, mi, false); + remap_signal(&mi->context); + set_prefix(mi); + print_signal(mi->context.sig, "client-instance", D_MULTI_LOW); + clear_prefix(); + multi_close_instance(m, mi, false); } static void -multi_signal_instance (struct multi_context *m, struct multi_instance *mi, const int sig) +multi_signal_instance(struct multi_context *m, struct multi_instance *mi, const int sig) { - mi->context.sig->signal_received = sig; - multi_close_instance_on_signal (m, mi); + mi->context.sig->signal_received = sig; + multi_close_instance_on_signal(m, mi); } /* @@ -2964,246 +3109,272 @@ multi_signal_instance (struct multi_context *m, struct multi_instance *mi, const #ifdef ENABLE_MANAGEMENT static void -management_callback_status (void *arg, const int version, struct status_output *so) +management_callback_status(void *arg, const int version, struct status_output *so) { - struct multi_context *m = (struct multi_context *) arg; + struct multi_context *m = (struct multi_context *) arg; - if (!version) - multi_print_status (m, so, m->status_file_version); - else - multi_print_status (m, so, version); + if (!version) + { + multi_print_status(m, so, m->status_file_version); + } + else + { + multi_print_status(m, so, version); + } } static int -management_callback_n_clients (void *arg) +management_callback_n_clients(void *arg) { - struct multi_context *m = (struct multi_context *) arg; - return m->n_clients; + struct multi_context *m = (struct multi_context *) arg; + return m->n_clients; } static int -management_callback_kill_by_cn (void *arg, const char *del_cn) +management_callback_kill_by_cn(void *arg, const char *del_cn) { - struct multi_context *m = (struct multi_context *) arg; - struct hash_iterator hi; - struct hash_element *he; - int count = 0; + struct multi_context *m = (struct multi_context *) arg; + struct hash_iterator hi; + struct hash_element *he; + int count = 0; - hash_iterator_init (m->iter, &hi); - while ((he = hash_iterator_next (&hi))) + hash_iterator_init(m->iter, &hi); + while ((he = hash_iterator_next(&hi))) { - struct multi_instance *mi = (struct multi_instance *) he->value; - if (!mi->halt) - { - const char *cn = tls_common_name (mi->context.c2.tls_multi, false); - if (cn && !strcmp (cn, del_cn)) - { - multi_signal_instance (m, mi, SIGTERM); - ++count; - } - } + struct multi_instance *mi = (struct multi_instance *) he->value; + if (!mi->halt) + { + const char *cn = tls_common_name(mi->context.c2.tls_multi, false); + if (cn && !strcmp(cn, del_cn)) + { + multi_signal_instance(m, mi, SIGTERM); + ++count; + } + } } - hash_iterator_free (&hi); - return count; + hash_iterator_free(&hi); + return count; } static int -management_callback_kill_by_addr (void *arg, const in_addr_t addr, const int port) -{ - struct multi_context *m = (struct multi_context *) arg; - struct hash_iterator hi; - struct hash_element *he; - struct openvpn_sockaddr saddr; - struct mroute_addr maddr; - int count = 0; - - CLEAR (saddr); - saddr.addr.in4.sin_family = AF_INET; - saddr.addr.in4.sin_addr.s_addr = htonl (addr); - saddr.addr.in4.sin_port = htons (port); - if (mroute_extract_openvpn_sockaddr (&maddr, &saddr, true)) - { - hash_iterator_init (m->iter, &hi); - while ((he = hash_iterator_next (&hi))) - { - struct multi_instance *mi = (struct multi_instance *) he->value; - if (!mi->halt && mroute_addr_equal (&maddr, &mi->real)) - { - multi_signal_instance (m, mi, SIGTERM); - ++count; - } - } - hash_iterator_free (&hi); - } - return count; +management_callback_kill_by_addr(void *arg, const in_addr_t addr, const int port) +{ + struct multi_context *m = (struct multi_context *) arg; + struct hash_iterator hi; + struct hash_element *he; + struct openvpn_sockaddr saddr; + struct mroute_addr maddr; + int count = 0; + + CLEAR(saddr); + saddr.addr.in4.sin_family = AF_INET; + saddr.addr.in4.sin_addr.s_addr = htonl(addr); + saddr.addr.in4.sin_port = htons(port); + if (mroute_extract_openvpn_sockaddr(&maddr, &saddr, true)) + { + hash_iterator_init(m->iter, &hi); + while ((he = hash_iterator_next(&hi))) + { + struct multi_instance *mi = (struct multi_instance *) he->value; + if (!mi->halt && mroute_addr_equal(&maddr, &mi->real)) + { + multi_signal_instance(m, mi, SIGTERM); + ++count; + } + } + hash_iterator_free(&hi); + } + return count; } static void -management_delete_event (void *arg, event_t event) +management_delete_event(void *arg, event_t event) { - struct multi_context *m = (struct multi_context *) arg; - if (m->mtcp) - multi_tcp_delete_event (m->mtcp, event); + struct multi_context *m = (struct multi_context *) arg; + if (m->mtcp) + { + multi_tcp_delete_event(m->mtcp, event); + } } -#endif +#endif /* ifdef ENABLE_MANAGEMENT */ #ifdef MANAGEMENT_DEF_AUTH static struct multi_instance * -lookup_by_cid (struct multi_context *m, const unsigned long cid) +lookup_by_cid(struct multi_context *m, const unsigned long cid) { - if (m) + if (m) { - struct multi_instance *mi = (struct multi_instance *) hash_lookup (m->cid_hash, &cid); - if (mi && !mi->halt) - return mi; + struct multi_instance *mi = (struct multi_instance *) hash_lookup(m->cid_hash, &cid); + if (mi && !mi->halt) + { + return mi; + } } - return NULL; + return NULL; } static bool -management_kill_by_cid (void *arg, const unsigned long cid, const char *kill_msg) +management_kill_by_cid(void *arg, const unsigned long cid, const char *kill_msg) { - struct multi_context *m = (struct multi_context *) arg; - struct multi_instance *mi = lookup_by_cid (m, cid); - if (mi) + struct multi_context *m = (struct multi_context *) arg; + struct multi_instance *mi = lookup_by_cid(m, cid); + if (mi) { - send_restart (&mi->context, kill_msg); /* was: multi_signal_instance (m, mi, SIGTERM); */ - multi_schedule_context_wakeup(m, mi); - return true; + send_restart(&mi->context, kill_msg); /* was: multi_signal_instance (m, mi, SIGTERM); */ + multi_schedule_context_wakeup(m, mi); + return true; + } + else + { + return false; } - else - return false; } static bool -management_client_auth (void *arg, - const unsigned long cid, - const unsigned int mda_key_id, - const bool auth, - const char *reason, - const char *client_reason, - struct buffer_list *cc_config) /* ownership transferred */ -{ - struct multi_context *m = (struct multi_context *) arg; - struct multi_instance *mi = lookup_by_cid (m, cid); - bool cc_config_owned = true; - bool ret = false; - - if (mi) - { - ret = tls_authenticate_key (mi->context.c2.tls_multi, mda_key_id, auth, client_reason); - if (ret) - { - if (auth) - { - if (!mi->connection_established_flag) - { - set_cc_config (mi, cc_config); - cc_config_owned = false; - } - } - else - { - if (reason) - msg (D_MULTI_LOW, "MULTI: connection rejected: %s, CLI:%s", reason, np(client_reason)); - if (mi->connection_established_flag) - { - send_auth_failed (&mi->context, client_reason); /* mid-session reauth failed */ - multi_schedule_context_wakeup(m, mi); - } - } - } - } - if (cc_config_owned && cc_config) - buffer_list_free (cc_config); - return ret; +management_client_auth(void *arg, + const unsigned long cid, + const unsigned int mda_key_id, + const bool auth, + const char *reason, + const char *client_reason, + struct buffer_list *cc_config) /* ownership transferred */ +{ + struct multi_context *m = (struct multi_context *) arg; + struct multi_instance *mi = lookup_by_cid(m, cid); + bool cc_config_owned = true; + bool ret = false; + + if (mi) + { + ret = tls_authenticate_key(mi->context.c2.tls_multi, mda_key_id, auth, client_reason); + if (ret) + { + if (auth) + { + if (!mi->connection_established_flag) + { + set_cc_config(mi, cc_config); + cc_config_owned = false; + } + } + else + { + if (reason) + { + msg(D_MULTI_LOW, "MULTI: connection rejected: %s, CLI:%s", reason, np(client_reason)); + } + if (mi->connection_established_flag) + { + send_auth_failed(&mi->context, client_reason); /* mid-session reauth failed */ + multi_schedule_context_wakeup(m, mi); + } + } + } + } + if (cc_config_owned && cc_config) + { + buffer_list_free(cc_config); + } + return ret; } static char * -management_get_peer_info (void *arg, const unsigned long cid) +management_get_peer_info(void *arg, const unsigned long cid) { - struct multi_context *m = (struct multi_context *) arg; - struct multi_instance *mi = lookup_by_cid (m, cid); - char *ret = NULL; + struct multi_context *m = (struct multi_context *) arg; + struct multi_instance *mi = lookup_by_cid(m, cid); + char *ret = NULL; - if (mi) - ret = tls_get_peer_info (mi->context.c2.tls_multi); + if (mi) + { + ret = tls_get_peer_info(mi->context.c2.tls_multi); + } - return ret; + return ret; } -#endif +#endif /* ifdef MANAGEMENT_DEF_AUTH */ #ifdef MANAGEMENT_PF static bool -management_client_pf (void *arg, - const unsigned long cid, - struct buffer_list *pf_config) /* ownership transferred */ +management_client_pf(void *arg, + const unsigned long cid, + struct buffer_list *pf_config) /* ownership transferred */ { - struct multi_context *m = (struct multi_context *) arg; - struct multi_instance *mi = lookup_by_cid (m, cid); - bool ret = false; + struct multi_context *m = (struct multi_context *) arg; + struct multi_instance *mi = lookup_by_cid(m, cid); + bool ret = false; - if (mi && pf_config) - ret = pf_load_from_buffer_list (&mi->context, pf_config); + if (mi && pf_config) + { + ret = pf_load_from_buffer_list(&mi->context, pf_config); + } - if (pf_config) - buffer_list_free (pf_config); - return ret; + if (pf_config) + { + buffer_list_free(pf_config); + } + return ret; } -#endif +#endif /* ifdef MANAGEMENT_PF */ void -init_management_callback_multi (struct multi_context *m) +init_management_callback_multi(struct multi_context *m) { #ifdef ENABLE_MANAGEMENT - if (management) - { - struct management_callback cb; - CLEAR (cb); - cb.arg = m; - cb.flags = MCF_SERVER; - cb.status = management_callback_status; - cb.show_net = management_show_net_callback; - cb.kill_by_cn = management_callback_kill_by_cn; - cb.kill_by_addr = management_callback_kill_by_addr; - cb.delete_event = management_delete_event; - cb.n_clients = management_callback_n_clients; + if (management) + { + struct management_callback cb; + CLEAR(cb); + cb.arg = m; + cb.flags = MCF_SERVER; + cb.status = management_callback_status; + cb.show_net = management_show_net_callback; + cb.kill_by_cn = management_callback_kill_by_cn; + cb.kill_by_addr = management_callback_kill_by_addr; + cb.delete_event = management_delete_event; + cb.n_clients = management_callback_n_clients; #ifdef MANAGEMENT_DEF_AUTH - cb.kill_by_cid = management_kill_by_cid; - cb.client_auth = management_client_auth; - cb.get_peer_info = management_get_peer_info; + cb.kill_by_cid = management_kill_by_cid; + cb.client_auth = management_client_auth; + cb.get_peer_info = management_get_peer_info; #endif #ifdef MANAGEMENT_PF - cb.client_pf = management_client_pf; + cb.client_pf = management_client_pf; #endif - management_set_callback (management, &cb); + management_set_callback(management, &cb); } -#endif +#endif /* ifdef ENABLE_MANAGEMENT */ } void -uninit_management_callback_multi (struct multi_context *m) +uninit_management_callback_multi(struct multi_context *m) { - uninit_management_callback (); + uninit_management_callback(); } /* * Top level event loop. */ void -tunnel_server (struct context *top) +tunnel_server(struct context *top) { - ASSERT (top->options.mode == MODE_SERVER); + ASSERT(top->options.mode == MODE_SERVER); - if (proto_is_dgram(top->options.ce.proto)) - tunnel_server_udp(top); - else - tunnel_server_tcp(top); + if (proto_is_dgram(top->options.ce.proto)) + { + tunnel_server_udp(top); + } + else + { + tunnel_server_tcp(top); + } } -#else -static void dummy(void) {} +#else /* if P2MP_SERVER */ +static void +dummy(void) { +} #endif /* P2MP_SERVER */ |