2
* OpenVPN -- An application to securely tunnel IP networks
3
* over a single TCP/UDP port, with support for SSL/TLS-based
4
* session authentication and key exchange,
5
* packet encryption, packet authentication, and
8
* Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
10
* This program is free software; you can redistribute it and/or modify
11
* it under the terms of the GNU General Public License version 2
12
* as published by the Free Software Foundation.
14
* This program is distributed in the hope that it will be useful,
15
* but WITHOUT ANY WARRANTY; without even the implied warranty of
16
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
* GNU General Public License for more details.
19
* You should have received a copy of the GNU General Public License
20
* along with this program (see the file COPYING included with this
21
* distribution); if not, write to the Free Software Foundation, Inc.,
22
* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26
* @file Header file for server-mode related structures and functions.
46
* Walk (don't run) through the routing table,
47
* deleting old entries, and possibly multi_instance
48
* structs as well which have been marked for deletion.
59
* Server-mode state structure for one single VPN tunnel.
61
* This structure is used by OpenVPN processes running in server-mode to
62
* store state information related to one single VPN tunnel.
64
* The @ref tunnel_state "Structure of VPN tunnel state storage" related
65
* page describes the role the structure plays when OpenVPN is running in
68
struct multi_instance {
69
struct schedule_entry se; /* this must be the first element of the structure */
74
int route_count; /* number of routes (including cached routes) owned by this instance */
75
time_t created; /**< Time at which a VPN tunnel instance
76
* was created. This parameter is set
77
* by the \c multi_create_instance()
79
struct timeval wakeup; /* absolute time */
80
struct mroute_addr real; /**< External network address of the
82
ifconfig_pool_handle vaddr_handle;
83
const char *msg_prefix;
85
/* queued outgoing data in Server/TCP mode */
86
unsigned int tcp_rwflags;
87
struct mbuf_set *tcp_link_out_deferred;
88
bool socket_set_called;
90
in_addr_t reporting_addr; /* IP address shown in status listing */
92
bool did_open_context;
95
#ifdef MANAGEMENT_DEF_AUTH
97
struct buffer_list *cc_config;
99
bool connection_established_flag;
101
int n_clients_delta; /* added to multi_context.n_clients when instance is closed */
103
struct context context; /**< The context structure storing state
104
* for this VPN tunnel. */
109
* Main OpenVPN server state structure.
111
* This structure is used by OpenVPN processes running in server-mode to
112
* store all the VPN tunnel and process-wide state.
114
* The @ref tunnel_state "Structure of VPN tunnel state storage" related
115
* page describes the role the structure plays when OpenVPN is running in
118
struct multi_context {
120
# define MC_SINGLE_THREADED (1<<0)
121
# define MC_MULTI_THREADED_MASTER (1<<1)
122
# define MC_MULTI_THREADED_WORKER (1<<2)
123
# define MC_MULTI_THREADED_SCHEDULER (1<<3)
124
# define MC_WORK_THREAD (MC_MULTI_THREADED_WORKER|MC_MULTI_THREADED_SCHEDULER)
127
struct hash *hash; /**< VPN tunnel instances indexed by real
128
* address of the remote peer. */
129
struct hash *vhash; /**< VPN tunnel instances indexed by
130
* virtual address of remote hosts. */
131
struct hash *iter; /**< VPN tunnel instances indexed by real
132
* address of the remote peer, optimized
134
struct schedule *schedule;
135
struct mbuf_set *mbuf; /**< Set of buffers for passing data
136
* channel packets between VPN tunnel
138
struct multi_tcp *mtcp; /**< State specific to OpenVPN using TCP
139
* as external transport. */
140
struct ifconfig_pool *ifconfig_pool;
141
struct frequency_limit *new_connection_limiter;
142
struct mroute_helper *route_helper;
143
struct multi_reap *reaper;
144
struct mroute_addr local;
148
int status_file_version;
149
int n_clients; /* current number of authenticated clients */
151
#ifdef MANAGEMENT_DEF_AUTH
152
struct hash *cid_hash;
153
unsigned long cid_counter;
156
struct multi_instance *pending;
157
struct multi_instance *earliest_wakeup;
158
struct multi_instance **mpp_touched;
159
struct context_buffers *context_buffers;
160
time_t per_second_trigger;
162
struct context top; /**< Storage structure for process-wide
166
* Timer object for stale route check
168
struct event_timeout stale_routes_check_et;
176
struct mroute_addr addr;
177
struct multi_instance *instance;
179
# define MULTI_ROUTE_CACHE (1<<0)
180
# define MULTI_ROUTE_AGEABLE (1<<1)
183
unsigned int cache_generation;
184
time_t last_reference;
188
/**************************************************************************/
190
* Main event loop for OpenVPN in server mode.
193
* This function calls the appropriate main event loop function depending
194
* on the transport protocol used:
195
* - \c tunnel_server_udp()
196
* - \c tunnel_server_tcp()
198
* @param top - Top-level context structure.
200
void tunnel_server (struct context *top);
203
const char *multi_instance_string (const struct multi_instance *mi, bool null, struct gc_arena *gc);
206
* Called by mtcp.c, mudp.c, or other (to be written) protocol drivers
209
void multi_init (struct multi_context *m, struct context *t, bool tcp_mode, int thread_mode);
210
void multi_uninit (struct multi_context *m);
212
void multi_top_init (struct multi_context *m, const struct context *top, const bool alloc_buffers);
213
void multi_top_free (struct multi_context *m);
215
struct multi_instance *multi_create_instance (struct multi_context *m, const struct mroute_addr *real);
216
void multi_close_instance (struct multi_context *m, struct multi_instance *mi, bool shutdown);
218
bool multi_process_timeout (struct multi_context *m, const unsigned int mpp_flags);
220
#define MPP_PRE_SELECT (1<<0)
221
#define MPP_CONDITIONAL_PRE_SELECT (1<<1)
222
#define MPP_CLOSE_ON_SIGNAL (1<<2)
223
#define MPP_RECORD_TOUCH (1<<3)
226
/**************************************************************************/
228
* Perform postprocessing of a VPN tunnel instance.
230
* After some VPN tunnel activity has taken place, the VPN tunnel's state
231
* may need updating and some follow-up action may be required. This
232
* function controls the necessary postprocessing. It is called by many
233
* other functions that handle VPN tunnel related activity, such as \c
234
* multi_process_incoming_link(), \c multi_process_outgoing_link(), \c
235
* multi_process_incoming_tun(), \c multi_process_outgoing_tun(), and \c
236
* multi_process_timeout(), among others.
238
* @param m - The single \c multi_context structure.
239
* @param mi - The \c multi_instance of the VPN tunnel to be
241
* @param flags - Fast I/O optimization flags.
244
* - True, if the VPN tunnel instance \a mi was not closed due to a
245
* signal during processing.
246
* - False, if the VPN tunnel instance \a mi was closed.
248
bool multi_process_post (struct multi_context *m, struct multi_instance *mi, const unsigned int flags);
251
/**************************************************************************/
253
* Demultiplex and process a packet received over the external network
255
* @ingroup external_multiplexer
257
* This function determines which VPN tunnel instance the incoming packet
258
* is associated with, and then calls \c process_incoming_link() to handle
259
* it. Afterwards, if the packet is destined for a broadcast/multicast
260
* address or a remote host reachable through a different VPN tunnel, this
261
* function takes care of sending it they are.
263
* @note This function is only used by OpenVPN processes which are running
264
* in server mode, and can therefore sustain multiple active VPN
267
* @param m - The single \c multi_context structure.
268
* @param instance - The VPN tunnel state structure associated with
269
* the incoming packet, if known, as is the case
270
* when using TCP transport. Otherwise NULL, as is
271
* the case when using UDP transport.
272
* @param mpp_flags - Fast I/O optimization flags.
274
bool multi_process_incoming_link (struct multi_context *m, struct multi_instance *instance, const unsigned int mpp_flags);
278
* Determine the destination VPN tunnel of a packet received over the
279
* virtual tun/tap network interface and then process it accordingly.
280
* @ingroup internal_multiplexer
282
* This function determines which VPN tunnel instance the packet is
283
* destined for, and then calls \c process_outgoing_tun() to handle it.
285
* @note This function is only used by OpenVPN processes which are running
286
* in server mode, and can therefore sustain multiple active VPN
289
* @param m - The single \c multi_context structure.
290
* @param mpp_flags - Fast I/O optimization flags.
292
bool multi_process_incoming_tun (struct multi_context *m, const unsigned int mpp_flags);
295
void multi_process_drop_outgoing_tun (struct multi_context *m, const unsigned int mpp_flags);
297
void multi_print_status (struct multi_context *m, struct status_output *so, const int version);
299
struct multi_instance *multi_get_queue (struct mbuf_set *ms);
301
void multi_add_mbuf (struct multi_context *m,
302
struct multi_instance *mi,
303
struct mbuf_buffer *mb);
305
void multi_ifconfig_pool_persist (struct multi_context *m, bool force);
307
bool multi_process_signal (struct multi_context *m);
309
void multi_close_instance_on_signal (struct multi_context *m, struct multi_instance *mi);
311
void init_management_callback_multi (struct multi_context *m);
312
void uninit_management_callback_multi (struct multi_context *m);
315
* Return true if our output queue is not full
318
multi_output_queue_ready (const struct multi_context *m,
319
const struct multi_instance *mi)
321
if (mi->tcp_link_out_deferred)
322
return mbuf_len (mi->tcp_link_out_deferred) <= m->tcp_queue_limit;
328
* Determine which instance has pending output
329
* and prepare the output for sending in
330
* the to_link buffer.
332
static inline struct multi_instance *
333
multi_process_outgoing_link_pre (struct multi_context *m)
335
struct multi_instance *mi = NULL;
339
else if (mbuf_defined (m->mbuf))
340
mi = multi_get_queue (m->mbuf);
345
* Per-client route quota management
348
void route_quota_exceeded (const struct multi_context *m, const struct multi_instance *mi);
351
route_quota_inc (struct multi_instance *mi)
357
route_quota_dec (struct multi_instance *mi)
362
/* can we add a new route? */
364
route_quota_test (const struct multi_context *m, const struct multi_instance *mi)
366
if (mi->route_count >= mi->context.options.max_routes_per_client)
368
route_quota_exceeded (m, mi);
376
* Instance reference counting
380
multi_instance_inc_refcount (struct multi_instance *mi)
386
multi_instance_dec_refcount (struct multi_instance *mi)
388
if (--mi->refcount <= 0)
396
multi_route_del (struct multi_route *route)
398
struct multi_instance *mi = route->instance;
399
route_quota_dec (mi);
400
multi_instance_dec_refcount (mi);
405
multi_route_defined (const struct multi_context *m,
406
const struct multi_route *r)
408
if (r->instance->halt)
410
else if ((r->flags & MULTI_ROUTE_CACHE)
411
&& r->cache_generation != m->route_helper->cache_generation)
413
else if ((r->flags & MULTI_ROUTE_AGEABLE)
414
&& r->last_reference + m->route_helper->ageable_ttl_secs < now)
421
* Set a msg() function prefix with our current client instance ID.
425
set_prefix (struct multi_instance *mi)
427
#ifdef MULTI_DEBUG_EVENT_LOOP
429
printf ("[%s]\n", mi->msg_prefix);
431
msg_set_prefix (mi->msg_prefix);
437
#ifdef MULTI_DEBUG_EVENT_LOOP
440
msg_set_prefix (NULL);
446
* Reaper constants. The reaper is the process where the virtual address
447
* and virtual route hash table is scanned for dead entries which are
448
* then removed. The hash table could potentially be quite large, so we
449
* don't want to reap in a single pass.
452
#define REAP_MAX_WAKEUP 10 /* Do reap pass at least once per n seconds */
453
#define REAP_DIVISOR 256 /* How many passes to cover whole hash table */
454
#define REAP_MIN 16 /* Minimum number of buckets per pass */
455
#define REAP_MAX 1024 /* Maximum number of buckets per pass */
458
* Mark a cached host route for deletion after this
459
* many seconds without any references.
461
#define MULTI_CACHE_ROUTE_TTL 60
464
multi_reap_process (const struct multi_context *m)
466
void multi_reap_process_dowork (const struct multi_context *m);
467
if (m->reaper->last_call != now)
468
multi_reap_process_dowork (m);
472
multi_process_per_second_timers (struct multi_context *m)
474
if (m->per_second_trigger != now)
476
void multi_process_per_second_timers_dowork (struct multi_context *m);
477
multi_process_per_second_timers_dowork (m);
478
m->per_second_trigger = now;
483
* Compute earliest timeout expiry from the set of
484
* all instances. Output:
486
* m->earliest_wakeup : instance needing the earliest service.
487
* dest : earliest timeout as a delta in relation
491
multi_get_timeout (struct multi_context *m, struct timeval *dest)
493
struct timeval tv, current;
496
m->earliest_wakeup = (struct multi_instance *) schedule_get_earliest_wakeup (m->schedule, &tv);
497
if (m->earliest_wakeup)
499
ASSERT (!openvpn_gettimeofday (¤t, NULL));
500
tv_delta (dest, ¤t, &tv);
501
if (dest->tv_sec >= REAP_MAX_WAKEUP)
503
m->earliest_wakeup = NULL;
504
dest->tv_sec = REAP_MAX_WAKEUP;
510
dest->tv_sec = REAP_MAX_WAKEUP;
517
* Send a packet over the virtual tun/tap network interface to its locally
518
* reachable destination.
519
* @ingroup internal_multiplexer
521
* This function calls \c process_outgoing_tun() to perform the actual
522
* sending of the packet. Afterwards, it calls \c multi_process_post() to
523
* perform server-mode postprocessing.
525
* @param m - The single \c multi_context structure.
526
* @param mpp_flags - Fast I/O optimization flags.
529
* - True, if the \c multi_instance associated with the packet sent was
530
* not closed due to a signal during processing.
531
* - Falls, if the \c multi_instance was closed.
534
multi_process_outgoing_tun (struct multi_context *m, const unsigned int mpp_flags)
536
struct multi_instance *mi = m->pending;
540
#ifdef MULTI_DEBUG_EVENT_LOOP
541
printf ("%s -> TUN len=%d\n",
543
mi->context.c2.to_tun.len);
546
process_outgoing_tun (&mi->context);
547
ret = multi_process_post (m, mi, mpp_flags);
555
multi_process_outgoing_link_dowork (struct multi_context *m, struct multi_instance *mi, const unsigned int mpp_flags)
559
process_outgoing_link (&mi->context);
560
ret = multi_process_post (m, mi, mpp_flags);
568
#define MULTI_CHECK_SIG(m) EVENT_LOOP_CHECK_SIGNAL (&(m)->top, multi_process_signal, (m))
571
multi_set_pending (struct multi_context *m, struct multi_instance *mi)
577
multi_release_io_lock (struct multi_context *m)
581
#endif /* P2MP_SERVER */
added
removed
src/openvpn/multi.h
