Updated version to 2.1_rc7e.

Added client authentication and packet filtering capability
to management interface.

Extended packet filtering capability to work on both --dev tun
and --dev tap tunnels.

Updated valgrind-suppress file.

Made "Linux ip addr del failed" error nonfatal.

Amplified --client-cert-not-required warning.

Added #pragma pack to proto.h.


git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@2991 e7ae566f-a301-0410-adde-c780ea21d3b5

1 files changed, 61 insertions, 12 deletions

diff --git a/mroute.h b/mroute.h
index 16d2add..4a6f458 100644
--- a/mroute.h
+++ b/mroute.h
@@ -35,10 +35,18 @@
 #define IP_MCAST_NETWORK      ((in_addr_t)224<<24)
 
 /* Return status values for mroute_extract_addr_from_packet */
-#define MROUTE_EXTRACT_SUCCEEDED (1<<1)
-#define MROUTE_EXTRACT_BCAST     (1<<2)
-#define MROUTE_EXTRACT_MCAST     (1<<3)
-#define MROUTE_EXTRACT_IGMP      (1<<4)
+
+#define MROUTE_EXTRACT_SUCCEEDED (1<<0)
+#define MROUTE_EXTRACT_BCAST     (1<<1)
+#define MROUTE_EXTRACT_MCAST     (1<<2)
+#define MROUTE_EXTRACT_IGMP      (1<<3)
+
+#define MROUTE_SEC_EXTRACT_SUCCEEDED (1<<(0+MROUTE_SEC_SHIFT))
+#define MROUTE_SEC_EXTRACT_BCAST     (1<<(1+MROUTE_SEC_SHIFT))
+#define MROUTE_SEC_EXTRACT_MCAST     (1<<(2+MROUTE_SEC_SHIFT))
+#define MROUTE_SEC_EXTRACT_IGMP      (1<<(3+MROUTE_SEC_SHIFT))
+
+#define MROUTE_SEC_SHIFT         4
 
 /*
  * Choose the largest address possible with
@@ -62,6 +70,9 @@
 /* Address type mask indicating that netbits is part of address */
 #define MR_WITH_NETBITS          8
 
+/* Indicates than IPv4 addr was extracted from ARP packet */
+#define MR_ARP                   16
+
 struct mroute_addr {
   uint8_t len;      /* length of address */
   uint8_t unused;
@@ -72,8 +83,7 @@ struct mroute_addr {
 };
 
 /*
- * Number of bits in an address.  Should be raised for
- * IPv6.
+ * Number of bits in an address.  Should be raised for IPv6.
  */
 #define MR_HELPER_NET_LEN 32
 
@@ -89,11 +99,6 @@ struct mroute_helper {
   int net_len_refcount[MR_HELPER_NET_LEN]; /* refcount of each netlength */
 };
 
-unsigned int mroute_extract_addr_from_packet (struct mroute_addr *src,
-					      struct mroute_addr *dest,
-					      struct buffer *buf,
-					      int tunnel_type);
-
 struct openvpn_sockaddr;
 
 bool mroute_extract_openvpn_sockaddr (struct mroute_addr *addr,
@@ -110,6 +115,13 @@ void mroute_addr_init (struct mroute_addr *addr);
 const char *mroute_addr_print (const struct mroute_addr *ma,
 			       struct gc_arena *gc);
 
+#define MAPF_SUBNET            (1<<0)
+#define MAPF_IA_EMPTY_IF_UNDEF (1<<1)
+#define MAPF_SHOW_ARP          (1<<2)
+const char *mroute_addr_print_ex (const struct mroute_addr *ma,
+				  const unsigned int flags,
+				  struct gc_arena *gc);
+
 void mroute_addr_mask_host_bits (struct mroute_addr *ma);
 
 struct mroute_helper *mroute_helper_init (int ageable_ttl_secs);
@@ -117,6 +129,36 @@ void mroute_helper_free (struct mroute_helper *mh);
 void mroute_helper_add_iroute (struct mroute_helper *mh, const struct iroute *ir);
 void mroute_helper_del_iroute (struct mroute_helper *mh, const struct iroute *ir);
 
+/*
+ * Given a raw packet in buf, return the src and dest
+ * addresses of the packet.
+ */
+static inline unsigned int
+mroute_extract_addr_from_packet (struct mroute_addr *src,
+				 struct mroute_addr *dest,
+				 struct mroute_addr *esrc,
+				 struct mroute_addr *edest,
+				 const struct buffer *buf,
+				 int tunnel_type)
+{
+  unsigned int mroute_extract_addr_ipv4 (struct mroute_addr *src,
+					 struct mroute_addr *dest,
+					 const struct buffer *buf);
+
+  unsigned int mroute_extract_addr_ether (struct mroute_addr *src,
+					  struct mroute_addr *dest,
+					  struct mroute_addr *esrc,
+					  struct mroute_addr *edest,
+					  const struct buffer *buf);
+  unsigned int ret = 0;
+  verify_align_4 (buf);
+  if (tunnel_type == DEV_TYPE_TUN)
+    ret = mroute_extract_addr_ipv4 (src, dest, buf);
+  else if (tunnel_type == DEV_TYPE_TAP)
+    ret = mroute_extract_addr_ether (src, dest, esrc, edest, buf);
+  return ret;
+}
+
 static inline void
 mroute_helper_lock (struct mroute_helper *mh)
 {
@@ -166,11 +208,18 @@ mroute_extract_in_addr_t (struct mroute_addr *dest, const in_addr_t src)
 static inline in_addr_t
 in_addr_t_from_mroute_addr (const struct mroute_addr *addr)
 {
-  if (addr->type == MR_ADDR_IPV4 && addr->netbits == 0 && addr->len == 4)
+  if ((addr->type & MR_ADDR_MASK) == MR_ADDR_IPV4 && addr->netbits == 0 && addr->len == 4)
     return ntohl(*(in_addr_t*)addr->addr);
   else
     return 0;
 }
 
+static inline void
+mroute_addr_reset (struct mroute_addr *ma)
+{
+  ma->len = 0;
+  ma->type = MR_ADDR_NONE;
+}
+
 #endif /* P2MP_SERVER */
 #endif /* MROUTE_H */