diff options
Diffstat (limited to 'forward.h')
| -rw-r--r-- | forward.h | 163 |
1 files changed, 159 insertions, 4 deletions
@@ -22,6 +22,13 @@ * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ + +/** + * @file + * Interface functions to the internal and external multiplexers. + */ + + #ifndef FORWARD_H #define FORWARD_H @@ -54,22 +61,170 @@ #define IOW_READ (IOW_READ_TUN|IOW_READ_LINK) -void pre_select (struct context *c); +void pre_select (struct context *c); void process_io (struct context *c); -void encrypt_sign (struct context *c, bool comp_frag); - const char *wait_status_string (struct context *c, struct gc_arena *gc); void show_wait_status (struct context *c); + +/**********************************************************************/ +/** + * Process a data channel packet that will be sent through a VPN tunnel. + * @ingroup data_control + * + * This function controls the processing of a data channel packet which + * will be sent through a VPN tunnel to a remote OpenVPN peer. It's + * general structure is as follows: + * - Check that the client authentication has succeeded; if not, drop the + * packet. + * - If the \a comp_frag argument is true: + * - Call \c lzo_compress() of the \link Data Channel Compression + * module\endlink to (possibly) compress the packet. + * - Call \c fragment_outgoing() of the \link Data Channel Fragmentation + * module\endlink to (possibly) fragment the packet. + * - Activate the \link Data Channel Crypto module\endlink to perform + * security operations on the packet. + * - Call \c tls_pre_encrypt() to choose the appropriate security + * parameters for this packet. + * - Call \c openvpn_encrypt() to encrypt and HMAC signed the packet. + * - Call \c tls_post_encrypt() to prepend the one-byte OpenVPN header + * and do some TLS accounting. + * - Place the resulting packet in \c c->c2.to_link so that it can be sent + * over the external network interface to its remote destination by the + * \link external_multiplexer External Multiplexer\endlink. + * + * @param c - The context structure of the VPN tunnel associated with this + * packet. + * @param comp_frag - Whether to do packet compression and fragmentation. + * This flag is set to true the first time a packet is processed. If + * the packet then gets fragmented, this function will be called again + * once for each remaining fragment with this parameter set to false. + */ +void encrypt_sign (struct context *c, bool comp_frag); + + +/**********************************************************************/ +/** + * Read a packet from the external network interface. + * @ingroup external_multiplexer + * + * The packet read from the external network interface is stored in \c + * c->c2.buf and its source address in \c c->c2.from. If an error + * occurred, the length of \c c->c2.buf will be 0. + * + * OpenVPN running as client or as UDP server only has a single external + * network socket, so this function can be called with the single (client + * mode) or top level (UDP server) context as its argument. OpenVPN + * running as TCP server, on the other hand, has a network socket for each + * active VPN tunnel. In that case this function must be called with the + * context associated with the appropriate VPN tunnel for which data is + * available to be read. + * + * @param c - The context structure which contains the external + * network socket from which to read incoming packets. + */ void read_incoming_link (struct context *c); + + +/** + * Process a packet read from the external network interface. + * @ingroup external_multiplexer + * + * This function controls the processing of a data channel packet which + * has come out of a VPN tunnel. It's high-level structure is as follows: + * - Verify that a nonzero length packet has been received from a valid + * source address for the given context \a c. + * - Call \c tls_pre_decrypt(), which splits data channel and control + * channel packets: + * - If a data channel packet, the appropriate security parameters are + * loaded. + * - If a control channel packet, this function process is it and + * afterwards sets the packet's buffer length to 0, so that the data + * channel processing steps below will ignore it. + * - Call \c openvpn_decrypt() of the \link data_crypto Data Channel + * Crypto module\endlink to authenticate and decrypt the packet using + * the security parameters loaded by \c tls_pre_decrypt() above. + * - Call \c fragment_incoming() of the \link fragmentation Data Channel + * Fragmentation module\endlink to reassemble the packet if it's + * fragmented. + * - Call \c lzo_decompress() of the \link compression Data Channel + * Compression module\endlink to decompress the packet if it's + * compressed. + * - Place the resulting packet in \c c->c2.to_tun so that it can be sent + * over the virtual tun/tap network interface to its local destination + * by the \link internal_multiplexer Internal Multiplexer\endlink. + * + * @param c - The context structure of the VPN tunnel associated with the + * packet. + */ void process_incoming_link (struct context *c); + + +/** + * Write a packet to the external network interface. + * @ingroup external_multiplexer + * + * This function writes the packet stored in \c c->c2.to_link to the + * external network device contained within \c c->c1.link_socket. + * + * If an error occurs, it is logged and the packet is dropped. + * + * @param c - The context structure of the VPN tunnel associated with the + * packet. + */ +void process_outgoing_link (struct context *c); + + +/**************************************************************************/ +/** + * Read a packet from the virtual tun/tap network interface. + * @ingroup internal_multiplexer + * + * This function reads a packet from the virtual tun/tap network device \c + * c->c1.tuntap and stores it in \c c->c2.buf. + * + * If an error occurs, it is logged and the packet is dropped. + * + * @param c - The context structure in which to store the received + * packet. + */ void read_incoming_tun (struct context *c); + + +/** + * Process a packet read from the virtual tun/tap network interface. + * @ingroup internal_multiplexer + * + * This function calls \c encrypt_sign() of the \link data_control Data + * Channel Control module\endlink to process the packet. + * + * If an error occurs, it is logged and the packet is dropped. + * + * @param c - The context structure of the VPN tunnel associated with the + * packet. + */ void process_incoming_tun (struct context *c); -void process_outgoing_link (struct context *c); + + +/** + * Write a packet to the virtual tun/tap network interface. + * @ingroup internal_multiplexer + * + * This function writes the packet stored in \c c->c2.to_tun to the + * virtual tun/tap network device \c c->c1.tuntap. + * + * If an error occurs, it is logged and the packet is dropped. + * + * @param c - The context structure of the VPN tunnel associated with + * the packet. + */ void process_outgoing_tun (struct context *c); + +/**************************************************************************/ + bool send_control_channel_string (struct context *c, const char *str, int msglevel); #define PIPV4_PASSTOS (1<<0) |