mirror/openvpn3
0
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn3.git synced 2024-09-20 04:02:15 +02:00
Code

Added client hooks for DCO (Data Channel offload).

Browse Source 
Updated tun implementation on Linux.
This commit is contained in:
James Yonan 2015-06-17 01:48:33 -06:00
parent d2ddc82bca
commit 496e797a21
20 changed files with 534 additions and 147 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
client/ovpncli.cpp
View File

@ -304,6 +304,7 @@ namespace openvpn {
google_dns_fallback(false), disable_client_cert(false),
default_key_direction(-1), force_aes_cbc_ciphersuites(false),
alt_proxy(false),
dco(false),
io_service(nullptr) {}
OptionList options;
@ -331,6 +332,7 @@ namespace openvpn {
ProtoContextOptions::Ptr proto_context_options;
HTTPProxyTransport::Options::Ptr http_proxy_options;
bool alt_proxy;
bool dco;
asio::io_service* io_service;
@ -454,6 +456,7 @@ namespace openvpn {
state->tls_version_min_override = config.tlsVersionMinOverride;
state->gui_version = config.guiVersion;
state->alt_proxy = config.altProxy;
state->dco = config.dco;
if (!config.proxyHost.empty())
{
HTTPProxyTransport::Options::Ptr ho(new HTTPProxyTransport::Options());
@ -630,6 +633,7 @@ namespace openvpn {
cc.proto_context_options = state->proto_context_options;
cc.http_proxy_options = state->http_proxy_options;
cc.alt_proxy = state->alt_proxy;
cc.dco = state->dco;
cc.reconnect_notify = &state->reconnect_notify;
cc.private_key_password = state->private_key_password;
cc.disable_client_cert = state->disable_client_cert;

3
client/ovpncli.hpp
View File

@ -234,6 +234,9 @@ namespace openvpn {
// Custom proxy implementation
bool altProxy;
// Custom Data Channel Offload implementation
bool dco;
};
// used to communicate VPN events such as connect, disconnect, etc.

175
openvpn/client/cliopt.hpp
View File

@ -46,6 +46,7 @@
#include <openvpn/transport/client/tcpcli.hpp>
#include <openvpn/transport/client/httpcli.hpp>
#include <openvpn/transport/altproxy.hpp>
#include <openvpn/transport/dco.hpp>
#include <openvpn/client/cliproto.hpp>
#include <openvpn/client/cliopthelper.hpp>
#include <openvpn/client/optfilt.hpp>
@ -80,6 +81,10 @@
#include <openvpn/pt/ptproxy.hpp>
#endif
#if defined(ENABLE_DCO)
#include <openvpn/dco/dcocli.hpp>
#endif
namespace openvpn {
class ClientOptions : public RC<thread_unsafe_refcount>
@ -97,6 +102,7 @@ namespace openvpn {
reconnect_notify = nullptr;
conn_timeout = 0;
alt_proxy = false;
dco = false;
tun_persist = false;
google_dns_fallback = false;
disable_client_cert = false;
@ -116,6 +122,7 @@ namespace openvpn {
ProtoContextOptions::Ptr proto_context_options;
HTTPProxyTransport::Options::Ptr http_proxy_options;
bool alt_proxy;
bool dco;
bool tun_persist;
bool google_dns_fallback;
std::string private_key_password;
@ -167,6 +174,11 @@ namespace openvpn {
prng.reset(new SSLLib::RandomAPI(true));
#endif
#if defined(ENABLE_DCO) && !defined(OPENVPN_FORCE_TUN_NULL) && !defined(OPENVPN_CUSTOM_TUN_FACTORY)
if (config.dco)
dco = DCOTransport::new_controller();
#endif
// frame
const MSSCtrlParms mc(opt);
frame = frame_init(true, mc.mssfix_ctrl, true);
@ -208,7 +220,7 @@ namespace openvpn {
cp->prng = prng;
#ifdef PRIVATE_TUNNEL_PROXY
if (config.alt_proxy)
if (config.alt_proxy && !dco)
alt_proxy = PTProxy::new_proxy(opt, *rng);
#endif
@ -274,78 +286,112 @@ namespace openvpn {
#endif
// initialize tun/tap
if (dco)
{
DCO::TunConfig tunconf;
tunconf.layer = cp->layer;
tunconf.tun_prop.session_name = session_name;
if (tun_mtu)
tunconf.tun_prop.mtu = tun_mtu;
tunconf.tun_prop.google_dns_fallback = config.google_dns_fallback;
tunconf.tun_prop.remote_list = remote_list;
tun_factory = dco->new_tun_factory(tunconf, opt);
}
else
{
#if defined(OPENVPN_CUSTOM_TUN_FACTORY)
OPENVPN_CUSTOM_TUN_FACTORY::Ptr tunconf = OPENVPN_CUSTOM_TUN_FACTORY::new_obj();
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->tun_prop.remote_list = remote_list;
{
OPENVPN_CUSTOM_TUN_FACTORY::Ptr tunconf = OPENVPN_CUSTOM_TUN_FACTORY::new_obj();
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->tun_prop.remote_list = remote_list;
tun_factory = tunconf;
}
#elif defined(USE_TUN_BUILDER)
TunBuilderClient::ClientConfig::Ptr tunconf = TunBuilderClient::ClientConfig::new_obj();
tunconf->builder = config.builder;
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->tun_prop.remote_list = remote_list;
{
TunBuilderClient::ClientConfig::Ptr tunconf = TunBuilderClient::ClientConfig::new_obj();
tunconf->builder = config.builder;
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->tun_prop.remote_list = remote_list;
tun_factory = tunconf;
#if defined(OPENVPN_PLATFORM_IPHONE)
tunconf->retain_sd = true;
tunconf->tun_prefix = true;
if (config.tun_persist)
tunconf->tun_prop.remote_bypass = true;
tunconf->retain_sd = true;
tunconf->tun_prefix = true;
if (config.tun_persist)
tunconf->tun_prop.remote_bypass = true;
#endif
#if defined(OPENVPN_PLATFORM_ANDROID)
// Android VPN API doesn't support excluded routes, so we must emulate them
tunconf->eer_factory.reset(new EmulateExcludeRouteFactoryImpl(false));
// Android VPN API doesn't support excluded routes, so we must emulate them
tunconf->eer_factory.reset(new EmulateExcludeRouteFactoryImpl(false));
#endif
if (config.tun_persist)
tunconf->tun_persist.reset(new TunBuilderClient::TunPersist(true, tunconf->retain_sd, config.builder));
if (config.tun_persist)
tunconf->tun_persist.reset(new TunBuilderClient::TunPersist(true, tunconf->retain_sd, config.builder));
tun_factory = tunconf;
}
#elif defined(OPENVPN_PLATFORM_LINUX) && !defined(OPENVPN_FORCE_TUN_NULL)
TunLinux::ClientConfig::Ptr tunconf = TunLinux::ClientConfig::new_obj();
tunconf->layer = cp->layer;
tunconf->frame = frame;
tunconf->stats = cli_stats;
if (tun_mtu)
tunconf->mtu = tun_mtu;
{
TunLinux::ClientConfig::Ptr tunconf = TunLinux::ClientConfig::new_obj();
tunconf->layer = cp->layer;
tunconf->tun_prop.session_name = session_name;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
tunconf->tun_prop.remote_list = remote_list;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->load(opt);
tun_factory = tunconf;
}
#elif defined(OPENVPN_PLATFORM_MAC) && !defined(OPENVPN_FORCE_TUN_NULL)
TunMac::ClientConfig::Ptr tunconf = TunMac::ClientConfig::new_obj();
tunconf->layer = cp->layer;
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->enable_failsafe_block = config.tun_persist;
client_lifecycle.reset(new MacLifeCycle);
{
TunMac::ClientConfig::Ptr tunconf = TunMac::ClientConfig::new_obj();
tunconf->layer = cp->layer;
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
tunconf->enable_failsafe_block = config.tun_persist;
client_lifecycle.reset(new MacLifeCycle);
tun_factory = tunconf;
}
#elif defined(OPENVPN_PLATFORM_WIN) && !defined(OPENVPN_FORCE_TUN_NULL)
TunWin::ClientConfig::Ptr tunconf = TunWin::ClientConfig::new_obj();
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
if (config.tun_persist)
tunconf->tun_persist.reset(new TunWin::TunPersist(true, false, nullptr));
{
TunWin::ClientConfig::Ptr tunconf = TunWin::ClientConfig::new_obj();
tunconf->tun_prop.session_name = session_name;
tunconf->tun_prop.google_dns_fallback = config.google_dns_fallback;
if (tun_mtu)
tunconf->tun_prop.mtu = tun_mtu;
tunconf->frame = frame;
tunconf->stats = cli_stats;
if (config.tun_persist)
tunconf->tun_persist.reset(new TunWin::TunPersist(true, false, nullptr));
tun_factory = tunconf;
}
#else
TunNull::ClientConfig::Ptr tunconf = TunNull::ClientConfig::new_obj();
tunconf->frame = frame;
tunconf->stats = cli_stats;
{
TunNull::ClientConfig::Ptr tunconf = TunNull::ClientConfig::new_obj();
tunconf->frame = frame;
tunconf->stats = cli_stats;
tun_factory = tunconf;
}
#endif
}
// verify that tun implementation can handle OSI layer declared by config
if (cp->layer == Layer(Layer::OSI_LAYER_2) && !tunconf->layer_2_supported())
if (cp->layer == Layer(Layer::OSI_LAYER_2) && !tun_factory->layer_2_supported())
throw ErrorCode(Error::TAP_NOT_SUPPORTED, true, "OSI layer 2 tunnels are not currently supported");
// save tun factory
tun_factory = tunconf;
// server-poll-timeout
{
const Option *o = opt.get_ptr("server-poll-timeout");
@ -507,7 +553,17 @@ namespace openvpn {
// should have been caught earlier in RemoteList::handle_proto_override.
// construct transport object
if (alt_proxy)
if (dco)
{
DCO::TransportConfig transconf;
transconf.protocol = transport_protocol;
transconf.remote_list = remote_list;
transconf.frame = frame;
transconf.stats = cli_stats;
transconf.server_addr_float = server_addr_float;
transport_factory = dco->new_transport_factory(transconf);
}
else if (alt_proxy)
{
if (alt_proxy->requires_tcp() && !transport_protocol.is_tcp())
throw option_error("internal error: no TCP server entries for " + alt_proxy->name() + " transport");
@ -596,6 +652,7 @@ namespace openvpn {
OptionList::FilterBase::Ptr pushed_options_filter;
ClientLifeCycle::Ptr client_lifecycle;
AltProxy::Ptr alt_proxy;
DCO::Ptr dco;
};
}

29
openvpn/client/cliproto.hpp
View File

@ -175,8 +175,8 @@ namespace openvpn {
housekeeping_schedule.init(Time::Duration::binary_ms(512), Time::Duration::binary_ms(1024));
// initialize transport-layer packet handler
transport = transport_factory->new_client_obj(io_service, *this);
transport->start();
transport = transport_factory->new_transport_client_obj(io_service, *this);
transport->transport_start();
}
}
@ -350,6 +350,14 @@ namespace openvpn {
}
}
// Disable keepalive for rest of session, but fetch
// the keepalive parameters (in seconds).
virtual void disable_keepalive(unsigned int& keepalive_ping,
unsigned int& keepalive_timeout)
{
Base::disable_keepalive(keepalive_ping, keepalive_timeout);
}
virtual void ip_hole_punch(const IP::Addr& addr)
{
tun_factory->ip_hole_punch(addr);
@ -477,16 +485,19 @@ namespace openvpn {
// modify proto config (cipher, auth, and compression methods)
Base::process_push(received_options, *proto_context_options);
// initialize tun/routing
tun = tun_factory->new_tun_client_obj(io_service, *this, transport.get());
tun->tun_start(received_options, *transport, Base::dc_settings());
// initialize data channel after pushed options have been processed
Base::init_data_channel();
// Allow ProtoContext to suggest an alignment adjustment
// hint for transport layer.
transport->reset_align_adjust(Base::align_adjust_hint());
// initialize tun/routing
tun = tun_factory->new_client_obj(io_service, *this);
tun->client_start(received_options, *transport);
// process "inactive" directive
extract_inactive(received_options);
process_inactive(received_options);
}
else
OPENVPN_LOG("Options continuation...");
@ -697,7 +708,7 @@ namespace openvpn {
}
}
void extract_inactive(const OptionList& opt)
void process_inactive(const OptionList& opt)
{
try {
const Option *o = load_duration_parm(inactive_duration, "inactive", opt, 1, false);
@ -720,7 +731,7 @@ namespace openvpn {
inactive_timer.async_wait(asio_dispatch_timer(&Session::inactive_callback, this));
}
void inactive_callback(const asio::error_code& e)
void inactive_callback(const asio::error_code& e) // fixme for DCO
{
try {
if (!e && !halt)

2
openvpn/server/servproto.hpp
View File

@ -257,7 +257,7 @@ namespace openvpn {
// override the data channel factory
virtual void override_dc_factory(const CryptoDCFactory::Ptr& dc_factory)
{
Base::override_dc_factory(dc_factory);
Base::dc_settings().set_factory(dc_factory);
}
virtual ~Session()

8
openvpn/ssl/proto.hpp
View File

@ -2479,7 +2479,6 @@ namespace openvpn {
{
// modify config with pushed options
config->process_push(opt, pco);
init_data_channel();
// in case keepalive parms were modified by push
keepalive_parms_modified();
@ -2503,10 +2502,10 @@ namespace openvpn {
keepalive_parms_modified();
}
// override the data channel factory
void override_dc_factory(const CryptoDCFactory::Ptr& dc_factory)
// access the data channel settings
CryptoDCSettings& dc_settings()
{
config->dc.set_factory(dc_factory);
return config->dc;
}
// reset the data channel factory
@ -2540,6 +2539,7 @@ namespace openvpn {
// configuration
const Config& conf() const { return *config; }
Config& conf() { return *config; }
const Config::Ptr& conf_ptr() const { return config; }
// stats

8
openvpn/transport/client/httpcli.hpp
View File

@ -199,8 +199,8 @@ namespace openvpn {
return new ClientConfig;
}
virtual TransportClient::Ptr new_client_obj(asio::io_service& io_service,
TransportClientParent& parent);
virtual TransportClient::Ptr new_transport_client_obj(asio::io_service& io_service,
TransportClientParent& parent);
private:
ClientConfig()
@ -223,7 +223,7 @@ namespace openvpn {
asio::ip::tcp::resolver::iterator> AsioDispatchResolveTCP;
public:
virtual void start()
virtual void transport_start()
{
if (!impl)
{
@ -997,7 +997,7 @@ namespace openvpn {
std::unique_ptr<HTTP::HTMLSkip> html_skip;
};
inline TransportClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service, TransportClientParent& parent)
inline TransportClient::Ptr ClientConfig::new_transport_client_obj(asio::io_service& io_service, TransportClientParent& parent)
{
return TransportClient::Ptr(new Client(io_service, this, parent));
}

10
openvpn/transport/client/tcpcli.hpp
View File

@ -54,8 +54,8 @@ namespace openvpn {
return new ClientConfig;
}
virtual TransportClient::Ptr new_client_obj(asio::io_service& io_service,
TransportClientParent& parent);
virtual TransportClient::Ptr new_transport_client_obj(asio::io_service& io_service,
TransportClientParent& parent);
private:
ClientConfig()
@ -78,7 +78,7 @@ namespace openvpn {
asio::ip::tcp::resolver::iterator> AsioDispatchResolveTCP;
public:
virtual void start()
virtual void transport_start()
{
if (!impl)
{
@ -298,8 +298,8 @@ namespace openvpn {
bool halt;
};
inline TransportClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TransportClientParent& parent)
inline TransportClient::Ptr ClientConfig::new_transport_client_obj(asio::io_service& io_service,
TransportClientParent& parent)
{
return TransportClient::Ptr(new Client(io_service, this, parent));
}

16
openvpn/transport/client/transbase.hpp
View File

@ -34,15 +34,16 @@
#include <openvpn/buffer/buffer.hpp>
#include <openvpn/addr/ip.hpp>
#include <openvpn/error/error.hpp>
#include <openvpn/crypto/cryptodc.hpp>
namespace openvpn {
// Base class for client transport object.
struct TransportClient : public RC<thread_unsafe_refcount>
struct TransportClient : public virtual RC<thread_unsafe_refcount>
{
typedef RCPtr<TransportClient> Ptr;
virtual void start() = 0;
virtual void transport_start() = 0;
virtual void stop() = 0;
virtual bool transport_send_const(const Buffer& buf) = 0;
virtual bool transport_send(BufferAllocated& buf) = 0;
@ -75,15 +76,20 @@ namespace openvpn {
virtual void transport_wait_proxy() = 0;
virtual void transport_wait() = 0;
virtual void transport_connecting() = 0;
// Disable keepalive for rest of session, but fetch
// the keepalive parameters (in seconds).
virtual void disable_keepalive(unsigned int& keepalive_ping,
unsigned int& keepalive_timeout) = 0;
};
// Factory for client transport object.
struct TransportClientFactory : public RC<thread_unsafe_refcount>
struct TransportClientFactory : public virtual RC<thread_unsafe_refcount>
{
typedef RCPtr<TransportClientFactory> Ptr;
virtual TransportClient::Ptr new_client_obj(asio::io_service& io_service,
TransportClientParent& parent) = 0;
virtual TransportClient::Ptr new_transport_client_obj(asio::io_service& io_service,
TransportClientParent& parent) = 0;
};
} // namespace openvpn

10
openvpn/transport/client/udpcli.hpp
View File

@ -56,8 +56,8 @@ namespace openvpn {
return new ClientConfig;
}
virtual TransportClient::Ptr new_client_obj(asio::io_service& io_service,
TransportClientParent& parent);
virtual TransportClient::Ptr new_transport_client_obj(asio::io_service& io_service,
TransportClientParent& parent);
private:
ClientConfig()
@ -80,7 +80,7 @@ namespace openvpn {
asio::ip::udp::resolver::iterator> AsioDispatchResolveUDP;
public:
virtual void start()
virtual void transport_start()
{
if (!impl)
{
@ -280,8 +280,8 @@ namespace openvpn {
bool halt;
};
inline TransportClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TransportClientParent& parent)
inline TransportClient::Ptr ClientConfig::new_transport_client_obj(asio::io_service& io_service,
TransportClientParent& parent)
{
return TransportClient::Ptr(new Client(io_service, this, parent));
}

72
openvpn/transport/dco.hpp Normal file
View File

@ -0,0 +1,72 @@
// OpenVPN -- An application to securely tunnel IP networks
// over a single port, with support for SSL/TLS-based
// session authentication and key exchange,
// packet encryption, packet authentication, and
// packet compression.
//
// Copyright (C) 2012-2015 OpenVPN Technologies, Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License Version 3
// as published by the Free Software Foundation.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program in the COPYING file.
// If not, see <http://www.gnu.org/licenses/>.
#ifndef OPENVPN_TRANSPORT_DCO_H
#define OPENVPN_TRANSPORT_DCO_H
#include <string>
#include <openvpn/common/rc.hpp>
#include <openvpn/common/options.hpp>
#include <openvpn/client/remotelist.hpp>
#include <openvpn/frame/frame.hpp>
#include <openvpn/log/sessionstats.hpp>
#include <openvpn/transport/protocol.hpp>
#include <openvpn/transport/client/transbase.hpp>
#include <openvpn/tun/layer.hpp>
#include <openvpn/tun/client/tunbase.hpp>
#include <openvpn/tun/client/tunprop.hpp>
namespace openvpn {
struct DCO : public virtual RC<thread_unsafe_refcount>
{
typedef RCPtr<DCO> Ptr;
struct TransportConfig
{
TransportConfig()
: server_addr_float(false)
{
}
Protocol protocol;
RemoteList::Ptr remote_list;
bool server_addr_float;
Frame::Ptr frame;
SessionStats::Ptr stats;
};
struct TunConfig
{
TunConfig()
{
}
Layer layer;
TunProp::Config tun_prop;
};
virtual TunClientFactory::Ptr new_tun_factory(const TunConfig& conf, const OptionList& opt) = 0;
virtual TransportClientFactory::Ptr new_transport_factory(const TransportConfig& conf) = 0;
};
}
#endif

12
openvpn/tun/builder/client.hpp
View File

@ -97,8 +97,9 @@ namespace openvpn {
return new ClientConfig;
}
virtual TunClient::Ptr new_client_obj(asio::io_service& io_service,
TunClientParent& parent);
virtual TunClient::Ptr new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli);
virtual void finalize(const bool disconnected)
{
@ -120,7 +121,7 @@ namespace openvpn {
typedef Tun<Client*> TunImpl;
public:
virtual void client_start(const OptionList& opt, TransportClient& transcli)
virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&)
{
if (!impl)
{
@ -287,8 +288,9 @@ namespace openvpn {
TunProp::State::Ptr state;
};
inline TunClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TunClientParent& parent)
inline TunClient::Ptr ClientConfig::new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli)
{
return TunClient::Ptr(new Client(io_service, this, parent));
}

11
openvpn/tun/client/tunbase.hpp
View File

@ -36,11 +36,11 @@
namespace openvpn {
// Base class for objects that implement a client tun interface.
struct TunClient : public RC<thread_unsafe_refcount>
struct TunClient : public virtual RC<thread_unsafe_refcount>
{
typedef RCPtr<TunClient> Ptr;
virtual void client_start(const OptionList&, TransportClient&) = 0;
virtual void tun_start(const OptionList&, TransportClient&, CryptoDCSettings&) = 0;
virtual void stop() = 0;
virtual void set_disconnect() = 0;
virtual bool tun_send(BufferAllocated& buf) = 0; // return true if send succeeded
@ -64,12 +64,13 @@ namespace openvpn {
};
// Factory for tun interface objects.
struct TunClientFactory : public RC<thread_unsafe_refcount>
struct TunClientFactory : public virtual RC<thread_unsafe_refcount>
{
typedef RCPtr<TunClientFactory> Ptr;
virtual TunClient::Ptr new_client_obj(asio::io_service& io_service,
TunClientParent& parent) = 0;
virtual TunClient::Ptr new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli) = 0;
// return true if layer 2 tunnels are supported
virtual bool layer_2_supported() const { return false; }

12
openvpn/tun/client/tunnull.hpp
View File

@ -42,8 +42,9 @@ namespace openvpn {
return new ClientConfig;
}
virtual TunClient::Ptr new_client_obj(asio::io_service& io_service,
TunClientParent& parent);
virtual TunClient::Ptr new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli);
private:
ClientConfig() {}
};
@ -53,7 +54,7 @@ namespace openvpn {
friend class ClientConfig; // calls constructor
public:
virtual void client_start(const OptionList& opt, TransportClient& transcli)
virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&)
{
#ifdef TUN_NULL_EXIT
throw ErrorCode(Error::TUN_SETUP_FAILED, true, "TUN_NULL_EXIT");
@ -106,8 +107,9 @@ namespace openvpn {
TunClientParent& parent;
};
inline TunClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TunClientParent& parent)
inline TunClient::Ptr ClientConfig::new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli)
{
return TunClient::Ptr(new Client(io_service, this, parent));
}

262
openvpn/tun/linux/client/tuncli.hpp
View File

@ -24,38 +24,219 @@
#ifndef OPENVPN_TUN_LINUX_CLIENT_TUNCLI_H
#define OPENVPN_TUN_LINUX_CLIENT_TUNCLI_H
#include <openvpn/common/exception.hpp>
#include <openvpn/common/file.hpp>
#include <openvpn/common/split.hpp>
#include <openvpn/common/splitlines.hpp>
#include <openvpn/common/hexstr.hpp>
#include <openvpn/common/format.hpp>
#include <openvpn/common/process.hpp>
#include <openvpn/common/action.hpp>
#include <openvpn/addr/route.hpp>
#include <openvpn/tun/builder/capture.hpp>
#include <openvpn/tun/linux/tun.hpp>
#include <openvpn/tun/client/tunbase.hpp>
#include <openvpn/netconf/linux/route.hpp>
#include <openvpn/tun/client/tunprop.hpp>
namespace openvpn {
namespace TunLinux {
OPENVPN_EXCEPTION(tun_linux_error);
enum { // add_del_route flags
R_IPv6=(1<<0),
R_ADD_ALL=(1<<1),
R_ADD_DCO=(1<<2),
};
inline IP::Addr cvt_pnr_ip_v4(const std::string& hexaddr)
{
BufferAllocated v(4, BufferAllocated::CONSTRUCT_ZERO);
parse_hex(v, hexaddr);
if (v.size() != 4)
throw tun_linux_error("bad hex address");
IPv4::Addr ret = IPv4::Addr::from_bytes(v.data());
return IP::Addr::from_ipv4(ret);
}
inline IP::Addr get_default_gateway_v4()
{
typedef std::vector<std::string> strvec;
const std::string proc_net_route = read_text_simple("/proc/net/route");
SplitLines in(proc_net_route, 0);
while (in(true))
{
const std::string& line = in.line_ref();
strvec v = Split::by_space<strvec, StandardLex, SpaceMatch, Split::NullLimit>(line);
if (v.size() >= 8)
{
if (v[1] == "00000000" && v[7] == "00000000")
{
const IP::Addr gw = cvt_pnr_ip_v4(v[2]);
return gw;
}
}
}
throw tun_linux_error("can't determine default gateway");
}
inline void add_del_route(const std::string& addr_str,
const int prefix_len,
const std::string& gateway_str,
const unsigned int flags,
std::vector<IP::Route>& rtvec,
Action::Ptr& create,
Action::Ptr& destroy)
{
if (flags & R_IPv6)
{
OPENVPN_LOG("NOTE: route IPv6 not implemented yet"); // fixme
}
else
{
const IPv4::Addr addr = IPv4::Addr::from_string(addr_str);
const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(prefix_len);
const IPv4::Addr net = addr & netmask;
if (flags & R_ADD_ALL)
{
Command::Ptr add(new Command);
add->argv.push_back("/sbin/route");
add->argv.push_back("add");
add->argv.push_back("-net");
add->argv.push_back(net.to_string());
add->argv.push_back("netmask");
add->argv.push_back(netmask.to_string());
add->argv.push_back("gw");
add->argv.push_back(gateway_str);
create = add;
// for the destroy command, copy the add command but replace "add" with "delete"
Command::Ptr del(add->copy());
del->argv[1] = "del";
destroy = del;
}
if (flags & (R_ADD_ALL|R_ADD_DCO))
rtvec.emplace_back(IP::Addr::from_ipv4(net), prefix_len);
}
}
inline void add_del_route(const std::string& addr_str,
const int prefix_len,
const std::string& gateway_str,
const unsigned int flags,
std::vector<IP::Route>& rtvec,
ActionList& create,
ActionList& destroy)
{
Action::Ptr c, d;
add_del_route(addr_str, prefix_len, gateway_str, flags, rtvec, c, d);
create.add(c);
destroy.add(d);
}
inline void tun_config(const std::string& iface_name,
const TunBuilderCapture& pull,
std::vector<IP::Route>& rtvec,
ActionList& create,
ActionList& destroy)
{
// set local4 and local6 to point to IPv4/6 route configurations
const TunBuilderCapture::Route* local4 = pull.vpn_ipv4();
const TunBuilderCapture::Route* local6 = pull.vpn_ipv6();
// Set IPv4 Interface
if (local4)
{
const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(local4->prefix_length);
Command::Ptr cmd(new Command);
cmd->argv.push_back("/sbin/ifconfig");
cmd->argv.push_back(iface_name);
cmd->argv.push_back(local4->address);
cmd->argv.push_back("netmask");
cmd->argv.push_back(netmask.to_string());
cmd->argv.push_back("mtu");
cmd->argv.push_back(to_string(pull.mtu));
create.add(cmd);
add_del_route(local4->address, local4->prefix_length, local4->address, R_ADD_DCO, rtvec, create, destroy);
}
if (local6)
OPENVPN_LOG("NOTE: ifconfig IPv6 not implemented yet"); // fixme
// Process Routes
{
for (auto i = pull.add_routes.begin(); i != pull.add_routes.end(); ++i)
{
const TunBuilderCapture::Route& route = *i;
if (route.ipv6)
add_del_route(route.address, route.prefix_length, local6->gateway, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
else
{
if (local4 && !local4->gateway.empty())
add_del_route(route.address, route.prefix_length, local4->gateway, R_ADD_ALL, rtvec, create, destroy);
else
OPENVPN_LOG("ERROR: IPv4 route pushed without IPv4 ifconfig and/or route-gateway");
}
}
}
// Process IPv4 redirect-gateway
if (pull.reroute_gw.ipv4)
{
if (!pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
add_del_route(pull.remote_address.address, 32, get_default_gateway_v4().to_string(), R_ADD_ALL, rtvec, create, destroy);
add_del_route("0.0.0.0", 1, local4->gateway, R_ADD_ALL, rtvec, create, destroy);
add_del_route("128.0.0.0", 1, local4->gateway, R_ADD_ALL, rtvec, create, destroy);
}
// fixme -- handled pushed DNS servers
}
class ClientConfig : public TunClientFactory
{
public:
typedef RCPtr<ClientConfig> Ptr;
std::string name;
bool ipv6;
std::string dev_name;
Layer layer;
int txqueuelen;
unsigned int mtu;
TunProp::Config tun_prop;
int n_parallel;
Frame::Ptr frame;
SessionStats::Ptr stats;
void load(const OptionList& opt)
{
// set a default MTU
if (!tun_prop.mtu)
tun_prop.mtu = 1500;
// parse "dev" option
if (dev_name.empty())
{
const Option* dev = opt.get_ptr("dev");
if (dev)
dev_name = dev->get(1, 64);
}
}
static Ptr new_obj()
{
return new ClientConfig;
}
virtual TunClient::Ptr new_client_obj(asio::io_service& io_service,
TunClientParent& parent);
virtual TunClient::Ptr new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli);
private:
ClientConfig()
: ipv6(false), txqueuelen(200), mtu(1500), n_parallel(8) {}
: txqueuelen(200), n_parallel(8) {}
};
class Client : public TunClient
@ -66,31 +247,54 @@ namespace openvpn {
typedef Tun<Client*> TunImpl;
public:
virtual void client_start(const OptionList& opt, TransportClient& transcli)
virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&)
{
if (!impl)
{
halt = false;
try {
const IP::Addr server_addr = transcli.server_endpoint_addr();
// notify parent
parent.tun_pre_tun_config();
// parse pushed options
TunBuilderCapture::Ptr po(new TunBuilderCapture());
TunProp::configure_builder(po.get(),
state.get(),
config->stats.get(),
server_addr,
config->tun_prop,
opt,
nullptr,
false);
OPENVPN_LOG("CAPTURED OPTIONS:" << std::endl << po->to_string());
// configure tun/tap interface properties
ActionList::Ptr add_cmds = new ActionList();
remove_cmds.reset(new ActionList());
// start tun
impl.reset(new TunImpl(io_service,
this,
config->frame,
config->stats,
config->name,
config->ipv6,
config->dev_name,
config->layer,
config->txqueuelen
));
impl->start(config->n_parallel);
// do ifconfig
parent.tun_pre_tun_config();
vpn_ip_addr = impl->ifconfig(opt, config->mtu);
// get the iface name
state->iface_name = impl->name();
// add routes
parent.tun_pre_route_config();
route_list.reset(new RouteListLinux(opt, transcli.server_endpoint_addr()));
// configure tun properties
std::vector<IP::Route> rtvec;
TunLinux::tun_config(state->iface_name, *po, rtvec, *add_cmds, *remove_cmds);
// execute commands to bring up interface
add_cmds->execute();
// signal that we are connected
parent.tun_connected();
@ -118,12 +322,18 @@ namespace openvpn {
virtual std::string vpn_ip4() const
{
return vpn_ip_addr;
if (state->vpn_ip4_addr.specified())
return state->vpn_ip4_addr.to_string();
else
return "";
}
virtual std::string vpn_ip6() const // fixme ipv6
virtual std::string vpn_ip6() const
{
return "";
if (state->vpn_ip6_addr.specified())
return state->vpn_ip6_addr.to_string();
else
return "";
}
virtual void set_disconnect()
@ -140,6 +350,7 @@ namespace openvpn {
: io_service(io_service_arg),
config(config_arg),
parent(parent_arg),
state(new TunProp::State()),
halt(false)
{
}
@ -169,8 +380,8 @@ namespace openvpn {
halt = true;
// remove added routes
if (route_list)
route_list->stop();
if (remove_cmds)
remove_cmds->execute();
// stop tun
if (impl)
@ -182,13 +393,14 @@ namespace openvpn {
ClientConfig::Ptr config;
TunClientParent& parent;
TunImpl::Ptr impl;
RouteListLinux::Ptr route_list;
std::string vpn_ip_addr;
TunProp::State::Ptr state;
ActionList::Ptr remove_cmds;
bool halt;
};
inline TunClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TunClientParent& parent)
inline TunClient::Ptr ClientConfig::new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli)
{
return TunClient::Ptr(new Client(io_service, this, parent));
}

6
openvpn/tun/linux/tun.hpp
View File

@ -71,7 +71,6 @@ namespace openvpn {
const Frame::Ptr& frame_arg,
const SessionStats::Ptr& stats_arg,
const std::string name,
const bool ipv6,
const Layer& layer,
const int txqueuelen)
: Base(read_handler_arg, frame_arg, stats_arg)
@ -84,8 +83,7 @@ namespace openvpn {
struct ifreq ifr;
std::memset(&ifr, 0, sizeof(ifr));
ifr.ifr_flags = IFF_ONE_QUEUE;
if (!ipv6)
ifr.ifr_flags |= IFF_NO_PI;
ifr.ifr_flags |= IFF_NO_PI;
if (layer() == Layer::OSI_LAYER_3)
ifr.ifr_flags |= IFF_TUN;
else if (layer() == Layer::OSI_LAYER_2)
@ -126,7 +124,7 @@ namespace openvpn {
Base::name_ = ifr.ifr_name;
Base::stream = new asio::posix::stream_descriptor(io_service, fd.release());
OPENVPN_LOG_TUN(Base::name_ << " opened for " << (ipv6 ? "IPv6" : "IPv4"));
OPENVPN_LOG_TUN(Base::name_ << " opened");
}
std::string ifconfig(const OptionList& opt, const unsigned int mtu)

12
openvpn/tun/mac/client/tuncli.hpp
View File

@ -455,8 +455,9 @@ namespace openvpn {
return new ClientConfig;
}
virtual TunClient::Ptr new_client_obj(asio::io_service& io_service,
TunClientParent& parent);
virtual TunClient::Ptr new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli);
// return true if layer 2 tunnels are supported
virtual bool layer_2_supported() const
@ -498,7 +499,7 @@ namespace openvpn {
typedef Tun<Client*, TunWrap> TunImpl;
public:
virtual void client_start(const OptionList& opt, TransportClient& transcli)
virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&)
{
if (!impl)
{
@ -893,8 +894,9 @@ namespace openvpn {
ActionList::Ptr remove_cmds;
};
inline TunClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TunClientParent& parent)
inline TunClient::Ptr ClientConfig::new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli)
{
return TunClient::Ptr(new Client(io_service, this, parent));
}

12
openvpn/tun/win/client/tuncli.hpp
View File

@ -97,8 +97,9 @@ namespace openvpn {
return new ClientConfig;
}
virtual TunClient::Ptr new_client_obj(asio::io_service& io_service,
TunClientParent& parent);
virtual TunClient::Ptr new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli);
virtual void finalize(const bool disconnected)
{
@ -118,7 +119,7 @@ namespace openvpn {
typedef Tun<Client*, TunPersist> TunImpl;
public:
virtual void client_start(const OptionList& opt, TransportClient& transcli)
virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&)
{
if (!impl)
{
@ -575,8 +576,9 @@ namespace openvpn {
ActionList::Ptr remove_cmds;
};
inline TunClient::Ptr ClientConfig::new_client_obj(asio::io_service& io_service,
TunClientParent& parent)
inline TunClient::Ptr ClientConfig::new_tun_client_obj(asio::io_service& io_service,
TunClientParent& parent,
TransportClient* transcli)
{
return TunClient::Ptr(new Client(io_service, this, parent));
}

9
test/ovpncli/cli.cpp
View File

@ -216,6 +216,7 @@ int main(int argc, char *argv[])
{ "proxy-password", required_argument, nullptr, 'W' },
{ "proxy-basic", no_argument, nullptr, 'B' },
{ "alt-proxy", no_argument, nullptr, 'A' },
{ "dco", no_argument, nullptr, 'd' },
{ "eval", no_argument, nullptr, 'e' },
{ "self-test", no_argument, nullptr, 'T' },
{ "cache-password", no_argument, nullptr, 'C' },
@ -262,10 +263,11 @@ int main(int argc, char *argv[])
bool merge = false;
bool version = false;
bool altProxy = false;
bool dco = false;
int ch;
while ((ch = getopt_long(argc, argv, "BAeTCxfgjmvu:p:r:D:P:s:t:c:z:M:h:q:U:W:k:", longopts, nullptr)) != -1)
while ((ch = getopt_long(argc, argv, "BAdeTCxfgjmvu:p:r:D:P:s:t:c:z:M:h:q:U:W:k:", longopts, nullptr)) != -1)
{
switch (ch)
{
@ -326,6 +328,9 @@ int main(int argc, char *argv[])
case 'A':
altProxy = true;
break;
case 'd':
dco = true;
break;
case 'f':
forceAesCbcCiphersuites = true;
break;
@ -413,6 +418,7 @@ int main(int argc, char *argv[])
config.proxyPassword = proxyPassword;
config.proxyAllowCleartextAuth = proxyAllowCleartextAuth;
config.altProxy = altProxy;
config.dco = dco;
config.defaultKeyDirection = defaultKeyDirection;
config.forceAesCbcCiphersuites = forceAesCbcCiphersuites;
config.googleDnsFallback = googleDnsFallback;
@ -580,6 +586,7 @@ int main(int argc, char *argv[])
std::cout << "--proxy-password, -W : HTTP proxy password" << std::endl;
std::cout << "--proxy-basic, -B : allow HTTP basic auth" << std::endl;
std::cout << "--alt-proxy, -A : enable alternative proxy module" << std::endl;
std::cout << "--dco, -d : enable data channel offload" << std::endl;
std::cout << "--cache-password, -C : cache password" << std::endl;
std::cout << "--no-cert, -x : disable client certificate" << std::endl;
std::cout << "--def-keydir, -k : default key direction ('bi', '0', or '1')" << std::endl;

8
test/ovpncli/gok Executable file
View File

@ -0,0 +1,8 @@
#!/bin/bash
GCC_EXTRA="$GCC_EXTRA -DOPENVPN_SHOW_SESSION_TOKEN"
export GCC_EXTRA
cd $O3/core
. vars/vars-linux
. vars/setpath
cd test/ovpncli
PSSL=1 LZ4=1 NOSSL=1 PTPROXY=1 DCO=1 build cli