Attention is currently required from: cron2, flichtenheld, ordex, plaisthos.
Hello cron2, flichtenheld, plaisthos,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/765?usp=email
to look at the new patch set (#3).
Change subject: mroute: adapt to new protocol handling and hashing improvements
......................................................................
mroute: adapt to new protocol handling and hashing improvements
Repurposing an unused field and renaming it to 'proto'
instead of introducing a new field. The hashing now
begins at the 'proto' field rather than the 'type'
field. Additionally, the changes ensure that the
correct protocol is consistently used with virtual
addresses ensuring alignment.
Change-Id: Ic66eccb5058fe9c0fae64d8e2ca88728068a92ab
Signed-off-by: Gianmarco De Gregori <gianma...@mandelbit.com>
---
M src/openvpn/forward.c
M src/openvpn/mroute.c
M src/openvpn/mroute.h
M src/openvpn/mtcp.c
M src/openvpn/mudp.c
M src/openvpn/multi.c
6 files changed, 28 insertions(+), 10 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/65/765/3
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index e7518e7..04f2075 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -1130,13 +1130,16 @@
decrypt_status = openvpn_decrypt(&c->c2.buf,
c->c2.buffers->decrypt_buf,
co, &c->c2.frame, ad_start);
- if (!decrypt_status
- /* all sockets are of the same type, so just check the first one */
- && link_socket_connection_oriented(c->c2.link_sockets[0]))
+ for (int i = 0; i < c->c1.link_sockets_num; i++)
{
- /* decryption errors are fatal in TCP mode */
- register_signal(c->sig, SIGUSR1, "decryption-error"); /*
SOFT-SIGUSR1 -- decryption error in TCP mode */
- msg(D_STREAM_ERRORS, "Fatal decryption error
(process_incoming_link), restarting");
+ if (!decrypt_status
+ /* all sockets are of the same type, so just check the first
one (not anymore!) */
+ && link_socket_connection_oriented(c->c2.link_sockets[i]))
+ {
+ /* decryption errors are fatal in TCP mode */
+ register_signal(c->sig, SIGUSR1, "decryption-error"); /*
SOFT-SIGUSR1 -- decryption error in TCP mode */
+ msg(D_STREAM_ERRORS, "Fatal decryption error
(process_incoming_link), restarting");
+ }
}
}
else
diff --git a/src/openvpn/mroute.c b/src/openvpn/mroute.c
index f4539dc..3a0224e 100644
--- a/src/openvpn/mroute.c
+++ b/src/openvpn/mroute.c
@@ -453,6 +453,7 @@
buf_printf(&out, "UNKNOWN");
break;
}
+ buf_printf(&out, "|%d", maddr.proto);
return BSTR(&out);
}
else
diff --git a/src/openvpn/mroute.h b/src/openvpn/mroute.h
index 8b457d4..570ccaa 100644
--- a/src/openvpn/mroute.h
+++ b/src/openvpn/mroute.h
@@ -74,7 +74,7 @@
struct mroute_addr {
uint8_t len; /* length of address */
- uint8_t unused;
+ uint8_t proto;
uint8_t type; /* MR_ADDR/MR_WITH flags */
uint8_t netbits; /* number of bits in network part of address,
* valid if MR_WITH_NETBITS is set */
@@ -216,7 +216,7 @@
mroute_addr_hash_ptr(const struct mroute_addr *a)
{
/* NOTE: depends on ordering of struct mroute_addr */
- return (uint8_t *) &a->type;
+ return (uint8_t *) &a->proto;
}
static inline uint32_t
diff --git a/src/openvpn/mtcp.c b/src/openvpn/mtcp.c
index 1dae184..e173b80 100644
--- a/src/openvpn/mtcp.c
+++ b/src/openvpn/mtcp.c
@@ -56,6 +56,7 @@
mi = multi_create_instance(m, NULL, sock);
if (mi)
{
+ mi->real.proto = sock->info.proto;
struct hash_element *he;
const uint32_t hv = hash_value(hash, &mi->real);
struct hash_bucket *bucket = hash_bucket(hash, hv);
diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index 6a5f4a3..f300b17 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -192,6 +192,8 @@
struct mroute_addr real = {0};
struct multi_instance *mi = NULL;
struct hash *hash = m->hash;
+ real.proto = sock->info.proto;
+ m->local.proto = real.proto;
if (mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true)
&& m->top.c2.buf.len > 0)
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index fc700de..4d7b5e6 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -1157,11 +1157,12 @@
*/
static struct multi_instance *
multi_get_instance_by_virtual_addr(struct multi_context *m,
- const struct mroute_addr *addr,
+ struct mroute_addr *addr,
bool cidr_routing)
{
struct multi_route *route;
struct multi_instance *ret = NULL;
+ addr->proto = 0;
/* check for local address */
if (mroute_addr_equal(addr, &m->local))
@@ -1247,6 +1248,7 @@
CLEAR(remote_si);
remote_si.addr.in4.sin_family = AF_INET;
remote_si.addr.in4.sin_addr.s_addr = htonl(a);
+ addr.proto = 0;
ASSERT(mroute_extract_openvpn_sockaddr(&addr, &remote_si, false));
if (netbits >= 0)
@@ -3347,6 +3349,14 @@
bool ret = true;
bool floated = false;
+ /*
+ * Since we don't really need the protocol on vaddresses for internal VPN
+ * payload packets, make sure we have the same value to void hashing insert
+ * and search issues.
+ */
+ src.proto = 0;
+ dest.proto = src.proto;
+
if (m->pending)
{
return true;
@@ -3413,7 +3423,6 @@
0,
&c->c2.to_tun,
DEV_TYPE_TUN);
-
/* drop packet if extract failed */
if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED))
{
@@ -3551,6 +3560,8 @@
const int dev_type = TUNNEL_TYPE(m->top.c1.tuntap);
int16_t vid = 0;
+ src.proto = 0;
+ dest.proto = src.proto;
#ifdef MULTI_DEBUG_EVENT_LOOP
printf("TUN -> TCP/UDP [%d]\n", BLEN(&m->top.c2.buf));
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/765?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ic66eccb5058fe9c0fae64d8e2ca88728068a92ab
Gerrit-Change-Number: 765
Gerrit-PatchSet: 3
Gerrit-Owner: its_Giaan <gianma...@mandelbit.com>
Gerrit-Reviewer: cron2 <g...@greenie.muc.de>
Gerrit-Reviewer: flichtenheld <fr...@lichtenheld.com>
Gerrit-Reviewer: plaisthos <arne-open...@rfc2549.org>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-CC: ordex <a...@unstable.cc>
Gerrit-Attention: plaisthos <arne-open...@rfc2549.org>
Gerrit-Attention: cron2 <g...@greenie.muc.de>
Gerrit-Attention: flichtenheld <fr...@lichtenheld.com>
Gerrit-Attention: ordex <a...@unstable.cc>
Gerrit-MessageType: newpatchset
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
