aboutsummaryrefslogtreecommitdiff
path: root/openvpn.8
diff options
context:
space:
mode:
authorDavide Brini <dave_br@gmx.com>2010-05-02 11:07:38 +0200
committerDavid Sommerseth <dazo@users.sourceforge.net>2010-10-21 11:40:36 +0200
commit639216502cc474fcc2526598680b2bcdbb35c0a1 (patch)
treec64d172489464a41bb4ddac0802858324720b71c /openvpn.8
parentFix errors in openvpn-plugin.h documentation (diff)
downloadopenvpn-639216502cc474fcc2526598680b2bcdbb35c0a1.tar.xz
Exclude ping and control packets from activity
Problem: using --ping and --inactive together partially defeats the point of using --inactive as periodic ping packets are counted as activity. Here is the original discussion: http://article.gmane.org/gmane.network.openvpn.devel/3676 It turns out that "activity" is detected and recorded in two places in the code, both in forward.c: in process_outgoing_tun() for received packets, after they've been decrypted and sent to the TUN device; and in process_outgoing_link(), after they've been encrypted and written to the network socket. In the first case we can be sure that packets that get so far are really due to user activity, whereas in the second case there can be non-user packets (like OpenVPN's internal ping packets, and TLS control packets), and those should not be counted as activity as they are not coming from the user. So a need arises to detect those control packets and not count them as activity for the purposes of --inactive. Unfortunately, at that stage packets are already compressed and encrypted, so it's not possible to look into them to see what they are. However, there seems to be a convention in the code that packets whose buffer length in the context_2 structure is 0 should be ignored for certain purposes. TLS control packets follow that convention already, so this patch makes a small change in the code that generates the ping packets to set their buffer length to 0 as well. Finally, the call to register_activity() in process_outgoing_link() is made conditional to the buffer length being > 0. According to my tests, now --inactive behaves correctly according to the configured parameters (time or time+bytes) even when --ping is being used. forward.c: Call register_activity() in process_outgoing_link() only if the packet is not a ping or TLS control packet. openvpn.8: Updated the description of --inactive to describe the new semantics. ping.c: Set c->c2.buf.len = 0 after the ping packet has been generated and encrypted. Test routine is described here: <https://community.openvpn.net/openvpn/wiki/PingInactivePatch?version=6> Signed-off-by: Davide Brini <dave_br@gmx.com> Acked-by: David Sommerseth <dazo@users.sourceforge.net> Signed-off-by: David Sommerseth <dazo@users.sourceforge.net>
Diffstat (limited to 'openvpn.8')
-rw-r--r--openvpn.820
1 files changed, 15 insertions, 5 deletions
diff --git a/openvpn.8 b/openvpn.8
index eb8fd42..8df9367 100644
--- a/openvpn.8
+++ b/openvpn.8
@@ -1372,15 +1372,25 @@ to be between 100 bytes/sec and 100 Mbytes/sec.
.B \-\-inactive n [bytes]
Causes OpenVPN to exit after
.B n
-seconds of inactivity on the TUN/TAP device. The time length
-of inactivity is measured since the last incoming tunnel packet.
+seconds of inactivity on the TUN/TAP device. The time length of
+inactivity is measured since the last incoming or outgoing tunnel
+packet.
If the optional
.B bytes
parameter is included,
-exit after n seconds of activity on tun/tap device
-produces a combined in/out byte count that is less than
-.B bytes.
+exit if less than
+.B bytes
+of combined in/out traffic are produced on the tun/tap device
+in
+.B n
+seconds.
+
+In any case, OpenVPN's internal ping packets (which are just
+keepalives) and TLS control packets are not considered
+"activity", nor are they counted as traffic, as they are used
+internally by OpenVPN and are not an indication of actual user
+activity.
.\"*********************************************************
.TP
.B \-\-ping n