mirror of
https://github.com/deneraraujo/OpenVPNAdapter.git
synced 2026-04-24 00:00:05 +08:00
8e87aecebf
7db7a009b0 proto: Client complains about stub compressors 390154d0e4 Update Build instructions for OSX 1b92069834 deps: Update to mbedtls-2.7.12 8cab79540d compression: Extend compression alert to include server pushes 67b4641a99 CompressContext: Add is_any_stub() method cdf9e7bece compression: Issue an Event if compression is activated fa38064403 build script: added a new PROF type "auto" that tries to automatically determine the local platform 7ce7b52b7c MTRand: added OPENVPN_INSECURE_RANDOM compile flag that allows MTRand to masquerade as a secure RNG 85e7e49f72 MTRand: added constructor accepting an initialization seed 1fa3229a10 IPv4, IPv6: added #include <openvpn/common/hash.hpp> 48e9217d26 vcxproj: add missing header file d2a2601b2f Wintun: unmap ring buffers e320bc63ff openssl: Improve OpenSSLContext fencing against multiple declarations 2f8fe2d318 openssl: Missing inline keyword in a couple of compat functions 32b984c0ff enum_dir: use a function template 725ee04593 VPNServerNetblock::Netblock::to_string(): show prefix_len 409d1c52b8 ManClientInstance::Send::describe_user(): added bool show_userprop parameter e05fc16b20 string::indent(): try to fix all the corner cases 4e1645ea80 RunContext: mark virtual Stop* async_stop() with override attribute e8b31c5454 cli: advertise "openurl" as supported SSO method 80b45731eb ICMPv6: added DEST_UNREACH code 679003094d AsioTimerSafe: refactor to allow as drop-in replacement for AsioTimer f7845578f1 RunContext: check for halt in timer closure 84483eda25 AsioPolySock: add support for socket shutdown 1b3402aec3 tcplinkcommon.hpp: added missing include 2e26c7565c time: added nanotime_t typedef c3c8ab7f6b string: added additional detail to split() comment 95ce4f22c8 string: added to_delim() method then redefined first_line() method to use it 448218b1e1 string: added add_leading() method e3b0bf4f5c MSF iterator: allow conversion from ordinary iterator and added exists() method 11412ac50a AsioPolySock: in remote_endpoint_str() method, test for alt_routing_enabled() 9fb4e705f9 Added TimeSkew to skew a time duration by a random flux 7496383002 write_binary_atomic: reduce the length of the temporary filename b31d9c0191 auth-token-user: increase size limit to 340 chars c82644c03a Added BufferLineIterator 115cb656b6 RandomAPI: added randbyte() and randbool() methods 4fa8348689 RunContext: ASIO SIGNAL message now shows signal name rather than number ebfce58513 Added StaticBuffer, a constant-length Buffer for writing that cannot be extended c8f9cb88a4 string::split(): call reserve() on return vector f15e566065 read_binary_unix_fast: should return an int (i.e. errno), not a bool 60501b4513 random: factor out rand32_distribute() from RandomAPI::randrange32() 90123495a5 wintun: get device interfaces list only once ec790df73b wintun: read packets in bulk 0f85d3f729 wintun: use correct io_context when performing initial read a6151cdeab wintun: use auto-reset events 29acfd95f3 libs: update ASIO to 1.14.0 438a0ef287 Remove outdated and unused android build files e9df57969f Merge remote-tracking branch 'origin/released' 44725ad094 ssl: Fix building with OpenSSL 1.0.2 efe3f1f635 version: Reset version reference for git master 8c79c06d94 Make tls-crypt/tls-cryptv2 compile with multiple compilation units 4d18aaeb88 Fix LLVM warnings reported during OS X build 8c9496bb4d Use const_cast for SSL_session_reused 33be562a39 Add missing override keywords to openssl/sslctx.hpp 2c5435a000 dcocli: use compile time define for Tun methods instead of hardcoded iproute 7c39088f00 Allow overriding reported HW_ADDR and support IV_PLAT_VER 7bb1ea19ee Move sending IV_UI_VER and IV_SSO to build_peer_info 23959fa705 Add reporting of IV_SSL_VER 63ab5b5e46 Only initialise static member in OpenSSLContext once ecebb40304 Merge remote-tracking branch 'origin/qa' 52c9702502 wintun: replace volatiles with atomics d720c7104c appveyor: install Strawberry perl 60a253a7ef appveyor: update to VS2019 48f2b5100b wintun: support for privilege separation 6f266be3d8 wintun: ring buffers support baa1ce2ccf vcxproj: bump VS version to 2019 98bfd037e3 tun/win: factor out ClientConfig into separate header aeb5ce0ad7 wintun: open device with SetupAPI 3998d303ce Finalizing the OpenVPN 3 Core library 3.3 release 728733aee7 deps/mbedtls: rebase "enable unsupported critical extensions" patch 43e36ca45a lib-version: update to mbedtls-2.7.11 4dbcd85e50 openssl/cipher.hpp: add missing include <compat.hpp> 69d72ed64f DCOTransport: Fix server side specific trunk handling ff732e3b5d Fix OpenVPN Core build with OpenSSL 1.1.0 0da42f393f Do not use deprecated OpenSSL 1.1.0 methods 35062c0b60 travis.yml: update environment 47046cf6d2 Merge branch 'qa' 6933c395a4 [OVPN3-423] cliconnect.hpp: fix reconnect on Windows after sleep 462c36c813 random_subnet(): added comment ac1d447156 IP::Addr::from_byte_string(): fixed bug for IPv6 case d6eaea3468 string::split(): minor implementation tweaks ca15b7cdf4 hexstr: added dump_hex() variant accepting void * 0e61a2afd7 SessionIDType::find_weak: added conflict parameter 089aec00b1 DCOTransport: new routing code for trunk links 5befbd430f build: added CAP=1 -- build with libcap eb85ada21e signals: added trivial signal_name() function f89013ef92 RunContext: don't try to catch SIGQUIT by default e0ee540135 SessionIDType: added hash() method f0e1f8aa42 logging: added basic components for logrotate fbb0c81f29 UMask: added UMaskDaemon, a umask context object appropriate for daemons 1c7bac90d9 build script: when building with DEBUG=1 on Linux, use -ggdb instead of -g 73cce80e43 OpenSSL: added openssl_reseed_rng() function 25780cf798 OpenSSL: fixed some memory leaks in CipherContextGCM and TokenEncrypt 168dba95f5 OpenSSL: define OPENSSL_SERVER_SNI when OpenSSL version is at least 1.1 84e78d8fed SNI: added OpenVPN client support for SNI (currently OpenSSL only) 310766b270 build: added MTLS_DIST setting 4eaa46a879 MbedTLS: added MBEDTLS_DISABLE_NAME_CONSTRAINTS preprocessor flag 16226d1b05 OpenSSLSign: updated for OpenSSL 1.1 aed0678c96 SSL: added SNI::Metadata, an abstract base class for packaging app-specific SNI metadata in AuthCert 001b731fe2 SNI: create SNI namespace and rename SNIHandlerBase -> SNI::HandlerBase 4bd5869305 README.rst: Make Windows-specific build steps up to date. ac365ee977 wintun: support for 0.4 9245056a2a wintun: support for 0.3 b73d484950 mbedtls: throw exception on unsupported SSL:Const::PEER_CERT_OPTIONAL option 1d6bae4b5b tcplinkcommon: bubble up real exception error c18c8bd156 tcpcli: ensure SSL Factory survives as long as TLS link 4192193087 tls: parse and load TLS specific CA 2a19b7fcff win/tuncli.hpp: fix Wintun padding calculation 44cb9f44da appveyor: make ReleaseOpenSSL default configuration 5485de19a2 win/impersonate: refactor impersonate logic 29a655147b win/tunsetup.hpp: remove unneeded parameter 61794b0efd win: link OpenSSL dynamically e569b84465 win/tuncli.hpp: fix indentation 374c57e708 frame_init.hpp: tweak wintun read buf size c3c45c9b38 tun: added Error::TUN_HALT for tun_error() signaling acd7af5e9a RandomAPI: added randrange32() method c1a7f8cc68 std::clamp() is useful but only available in C++17 and up, so we add our own clamp() f8c71ef1ce Minor change to Error::INACTIVE_TIMEOUT handler 3202ab5fce OpenSSLSign: renamed OpenSSLPKI::X509Base to OpenSSLPKI::X509 to conform to changes in OpenSSLPKI 8d767febb5 ReachabilityBase: added virtual destructor 6a4826965f MbedTLS: update json_override() prototype bee0d8d187 SSL: added SSLConst::SEND_CLIENT_CA_LIST server-side flag and implemented for OpenSSL 5eb39c1dea AuthCert: save the SNI name 3b34449d0e SSLAPI: auth_cert() can now be const a672e91631 SNI server-side: support additional JSON configuration settings 95e761f3cc OpenSSL PKI cleanup d5eb77c53c AuthCert::Fail cleanup 6e98b9aadc SSLAPI: move PKType from SSLConfigAPI into standalone header to avoid dependency inversion bbae814864 OpenSSL: added SNI implementation 5def1d23ab OpenSSLContext: in constructor, removed redundant if statement 1a0747e783 OpenSSLContext: in constructor, consolidate sslopt fixed flags eef9868816 OpenSSLContext::SSL::ssl_handshake_details(): include leaf-cert CN in details f9631cd90f AuthCert::Fail: use std::string for the reason string (instead of const char *) a17b77641f OpenSSLPKI::X509: copy constructor doesn't need erase() and define X509::Ptr 78cae5bb52 OpenSSLPKI::DH: copy constructor doesn't need erase() c0d43a4153 RCPtr: added static_pointer_cast() method 34a3f264f5 [OVPN-314] Add support for signalling SSO support via IV_SSO 7d112eb3e5 cli: enable utf8 console output 980ef1eff8 win/call.hpp: re-encode command output to utf8 fddb440e99 unicode.hpp: customize utf16 conversion routine 4d7c12ac4d [OVPN3-405] Support for non-ASCII profile path on Windows git-subtree-dir: Sources/OpenVPNAdapter/Libraries/Vendors/openvpn git-subtree-split: 7db7a009b0b4eca0fc3733c99c50aff7f7c2556f
310 lines
8.8 KiB
C++
310 lines
8.8 KiB
C++
// OpenVPN -- An application to securely tunnel IP networks
|
|
// over a single port, with support for SSL/TLS-based
|
|
// session authentication and key exchange,
|
|
// packet encryption, packet authentication, and
|
|
// packet compression.
|
|
//
|
|
// Copyright (C) 2012-2017 OpenVPN Inc.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License Version 3
|
|
// as published by the Free Software Foundation.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program in the COPYING file.
|
|
// If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
// Define Frame classes. These classes act as a factory for standard protocol
|
|
// buffers and also try to optimize the buffers for alignment.
|
|
|
|
#ifndef OPENVPN_FRAME_FRAME_H
|
|
#define OPENVPN_FRAME_FRAME_H
|
|
|
|
#include <openvpn/common/size.hpp>
|
|
#include <openvpn/common/exception.hpp>
|
|
#include <openvpn/common/rc.hpp>
|
|
#include <openvpn/buffer/buffer.hpp>
|
|
|
|
namespace openvpn {
|
|
|
|
class Frame : public RC<thread_unsafe_refcount>
|
|
{
|
|
public:
|
|
typedef RCPtr<Frame> Ptr;
|
|
|
|
// Frame context types -- we maintain a Context object for each context type
|
|
enum {
|
|
ENCRYPT_WORK=0,
|
|
DECRYPT_WORK,
|
|
COMPRESS_WORK,
|
|
DECOMPRESS_WORK,
|
|
READ_LINK_UDP,
|
|
READ_LINK_TCP,
|
|
READ_TUN,
|
|
READ_BIO_MEMQ_DGRAM,
|
|
READ_BIO_MEMQ_STREAM,
|
|
READ_SSL_CLEARTEXT,
|
|
WRITE_SSL_INIT,
|
|
WRITE_SSL_CLEARTEXT,
|
|
WRITE_ACK_STANDALONE,
|
|
WRITE_DC_MSG,
|
|
WRITE_HTTP,
|
|
READ_HTTP,
|
|
|
|
N_ALIGN_CONTEXTS
|
|
};
|
|
|
|
OPENVPN_SIMPLE_EXCEPTION(frame_context_index);
|
|
|
|
// We manage an array of Context objects, one for each
|
|
// Frame context above.
|
|
class Context
|
|
{
|
|
public:
|
|
Context()
|
|
{
|
|
headroom_ = 0;
|
|
payload_ = 0;
|
|
tailroom_ = 0;
|
|
buffer_flags_ = 0;
|
|
align_adjust_ = 0;
|
|
|
|
adj_headroom_ = 0;
|
|
adj_capacity_ = 0;
|
|
}
|
|
|
|
Context(const size_t headroom,
|
|
const size_t payload,
|
|
const size_t tailroom,
|
|
const size_t align_adjust, // length of leading prefix data before the data that needs to be aligned on a size_t boundary
|
|
const size_t align_block, // size of alignment block, usually sizeof(size_t) but sometimes the cipher block size
|
|
const unsigned int buffer_flags) // flags passed to BufferAllocated constructor
|
|
{
|
|
headroom_ = headroom;
|
|
payload_ = payload;
|
|
tailroom_ = tailroom;
|
|
buffer_flags_ = buffer_flags;
|
|
align_adjust_ = align_adjust;
|
|
align_block_ = align_block;
|
|
recalc_derived();
|
|
}
|
|
|
|
void reset_align_adjust(const size_t align_adjust)
|
|
{
|
|
align_adjust_ = align_adjust;
|
|
}
|
|
|
|
size_t headroom() const { return adj_headroom_; }
|
|
size_t payload() const { return payload_; }
|
|
size_t tailroom() const { return tailroom_; }
|
|
size_t capacity() const { return adj_capacity_; }
|
|
unsigned int buffer_flags() const { return buffer_flags_; }
|
|
|
|
// Calculate a starting offset into a buffer object, dealing with
|
|
// headroom and alignment issues.
|
|
size_t prepare(Buffer& buf) const
|
|
{
|
|
buf.reset(capacity(), buffer_flags());
|
|
buf.init_headroom(actual_headroom(buf.c_data_raw()));
|
|
return payload();
|
|
}
|
|
|
|
// Realign a buffer to headroom
|
|
void realign(Buffer& buf) const
|
|
{
|
|
buf.realign(actual_headroom(buf.c_data_raw()));
|
|
}
|
|
|
|
// Return a new BufferAllocated object initialized with the given data.
|
|
BufferPtr copy(const unsigned char *data, const size_t size) const
|
|
{
|
|
const size_t cap = size + headroom() + tailroom();
|
|
BufferPtr b = new BufferAllocated(cap, buffer_flags());
|
|
b->init_headroom(actual_headroom(b->c_data_raw()));
|
|
b->write(data, size);
|
|
return b;
|
|
}
|
|
|
|
// Return a new BufferAllocated object by value initialized with the given data.
|
|
BufferAllocated copy_by_value(const unsigned char *data, const size_t size) const
|
|
{
|
|
const size_t cap = size + headroom() + tailroom();
|
|
BufferAllocated b(cap, buffer_flags());
|
|
b.init_headroom(actual_headroom(b.c_data_raw()));
|
|
b.write(data, size);
|
|
return b;
|
|
}
|
|
|
|
// Return a new BufferAllocated object initialized with
|
|
// the data in given buffer. buf may be empty or undefined.
|
|
BufferPtr copy(const BufferPtr& buf) const
|
|
{
|
|
const size_t size = buf ? buf->size() : 0;
|
|
const size_t cap = size + headroom() + tailroom();
|
|
BufferPtr b = new BufferAllocated(cap, buffer_flags());
|
|
b->init_headroom(actual_headroom(b->c_data_raw()));
|
|
if (size)
|
|
b->write(buf->c_data(), size);
|
|
return b;
|
|
}
|
|
|
|
// How much payload space left in buffer
|
|
size_t remaining_payload(const Buffer& buf) const
|
|
{
|
|
if (payload() > buf.size())
|
|
return payload() - buf.size();
|
|
else
|
|
return 0;
|
|
}
|
|
|
|
// Used to set the capacity of a group of Context objects
|
|
// to the highest capacity of any one of the members.
|
|
void standardize_capacity(const size_t newcap)
|
|
{
|
|
if (newcap > adj_capacity_)
|
|
adj_capacity_ = newcap;
|
|
}
|
|
|
|
#ifndef OPENVPN_NO_IO
|
|
// return a openvpn_io::mutable_buffer object used by
|
|
// asio read methods.
|
|
openvpn_io::mutable_buffer mutable_buffer(Buffer& buf) const
|
|
{
|
|
return openvpn_io::mutable_buffer(buf.data(), remaining_payload(buf));
|
|
}
|
|
|
|
// clamped version of mutable_buffer
|
|
openvpn_io::mutable_buffer mutable_buffer_clamp(Buffer& buf) const
|
|
{
|
|
return openvpn_io::mutable_buffer(buf.data(), buf_clamp_read(remaining_payload(buf)));
|
|
}
|
|
#endif
|
|
|
|
std::string info() const
|
|
{
|
|
std::ostringstream info;
|
|
info << "head=" << headroom_ << "[" << adj_headroom_ << "] "
|
|
<< "pay=" << payload_ << ' '
|
|
<< "tail=" << tailroom_ << ' '
|
|
<< "cap=" << adj_capacity_ << ' '
|
|
<< "bf=" << buffer_flags_ << ' '
|
|
<< "align_adj=" << align_adjust_ << ' '
|
|
<< "align_block=" << align_block_;
|
|
return info.str();
|
|
}
|
|
|
|
private:
|
|
// recalculate derived values when object parameters are modified
|
|
void recalc_derived()
|
|
{
|
|
// calculate adjusted headroom due to worst-case alignment loss
|
|
adj_headroom_ = headroom_ + align_block_;
|
|
|
|
// calculate capacity
|
|
adj_capacity_ = adj_headroom_ + payload_ + tailroom_;
|
|
}
|
|
|
|
// add a small delta ( < align_block) to headroom so that the point
|
|
// after the first align_adjust bytes of the buffer starting at base
|
|
// will be aligned on an align_block boundary
|
|
size_t actual_headroom(const void *base) const
|
|
{
|
|
return headroom_ + (-(size_t(base) + headroom_ + align_adjust_) & (align_block_ - 1));
|
|
}
|
|
|
|
// parameters
|
|
size_t headroom_;
|
|
size_t payload_;
|
|
size_t tailroom_;
|
|
size_t align_adjust_;
|
|
size_t align_block_;
|
|
unsigned int buffer_flags_;
|
|
|
|
// derived
|
|
size_t adj_headroom_;
|
|
size_t adj_capacity_;
|
|
};
|
|
|
|
Frame() {}
|
|
|
|
explicit Frame(const Context& c) { set_default_context(c); }
|
|
|
|
// set the default context
|
|
void set_default_context(const Context& c)
|
|
{
|
|
for (int i = 0; i < N_ALIGN_CONTEXTS; ++i)
|
|
contexts[i] = c;
|
|
}
|
|
|
|
// Calculate a starting offset into a buffer object, dealing with
|
|
// headroom and alignment issues. context should be one of
|
|
// the context types above. Returns payload size of buffer.
|
|
size_t prepare(const unsigned int context, Buffer& buf) const
|
|
{
|
|
return (*this)[context].prepare(buf);
|
|
}
|
|
|
|
BufferPtr prepare(const unsigned int context) const
|
|
{
|
|
BufferPtr buf(new BufferAllocated());
|
|
prepare(context, *buf);
|
|
return buf;
|
|
}
|
|
|
|
size_t n_contexts() const { return N_ALIGN_CONTEXTS; }
|
|
|
|
Context& operator[](const size_t i)
|
|
{
|
|
if (i >= N_ALIGN_CONTEXTS)
|
|
throw frame_context_index();
|
|
return contexts[i];
|
|
}
|
|
|
|
const Context& operator[](const size_t i) const
|
|
{
|
|
if (i >= N_ALIGN_CONTEXTS)
|
|
throw frame_context_index();
|
|
return contexts[i];
|
|
}
|
|
|
|
void standardize_capacity(const unsigned int context_mask)
|
|
{
|
|
size_t i;
|
|
size_t max_cap = 0;
|
|
unsigned int mask = context_mask;
|
|
|
|
// find the largest capacity in the group
|
|
for (i = 0; i < N_ALIGN_CONTEXTS; ++i)
|
|
{
|
|
if (mask & 1)
|
|
{
|
|
const size_t cap = contexts[i].capacity();
|
|
if (cap > max_cap)
|
|
max_cap = cap;
|
|
}
|
|
mask >>= 1;
|
|
}
|
|
|
|
// set all members of group to largest capacity found
|
|
mask = context_mask;
|
|
for (i = 0; i < N_ALIGN_CONTEXTS; ++i)
|
|
{
|
|
if (mask & 1)
|
|
contexts[i].standardize_capacity(max_cap);
|
|
mask >>= 1;
|
|
}
|
|
}
|
|
|
|
private:
|
|
Context contexts[N_ALIGN_CONTEXTS];
|
|
};
|
|
|
|
} // namespace openvpn
|
|
|
|
#endif // OPENVPN_FRAME_FRAME_H
|