Attention is currently required from: cron2, flichtenheld, ordex, plaisthos.
Hello cron2, flichtenheld, plaisthos,
I'd like you to reexamine a change. Please visit
http://gerrit.openvpn.net/c/openvpn/+/765?usp=email
to look at the new patch set (#14).
Change subject: mroute: adapt to new protocol handling and hashing improvements
......................................................................
mroute: adapt to new protocol handling and hashing improvements
Repurposing an unused field and renaming it to 'proto'
instead of introducing a new field. The hashing now
begins at the 'proto' field rather than the 'type'
field. Additionally, the changes ensure that the
correct protocol is consistently used with virtual
addresses ensuring alignment.
Change-Id: Ic66eccb5058fe9c0fae64d8e2ca88728068a92ab
Signed-off-by: Gianmarco De Gregori <gianma...@mandelbit.com>
---
M src/openvpn/forward.c
M src/openvpn/mroute.c
M src/openvpn/mroute.h
M src/openvpn/mtcp.c
M src/openvpn/mudp.c
M src/openvpn/multi.c
6 files changed, 28 insertions(+), 10 deletions(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/65/765/14
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index f3f3503..38ea9c3 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -1129,13 +1129,16 @@
decrypt_status = openvpn_decrypt(&c->c2.buf,
c->c2.buffers->decrypt_buf,
co, &c->c2.frame, ad_start);
- if (!decrypt_status
- /* on the instance context we have only one socket, so just check
the first one */
- && link_socket_connection_oriented(c->c2.link_sockets[0]))
+ for (int i = 0; i < c->c1.link_sockets_num; i++)
{
- /* decryption errors are fatal in TCP mode */
- register_signal(c->sig, SIGUSR1, "decryption-error"); /*
SOFT-SIGUSR1 -- decryption error in TCP mode */
- msg(D_STREAM_ERRORS, "Fatal decryption error
(process_incoming_link), restarting");
+ if (!decrypt_status
+ /* on the instance context we have only one socket, so just
check the first one */
+ && link_socket_connection_oriented(c->c2.link_sockets[i]))
+ {
+ /* decryption errors are fatal in TCP mode */
+ register_signal(c->sig, SIGUSR1, "decryption-error"); /*
SOFT-SIGUSR1 -- decryption error in TCP mode */
+ msg(D_STREAM_ERRORS, "Fatal decryption error
(process_incoming_link), restarting");
+ }
}
}
else
diff --git a/src/openvpn/mroute.c b/src/openvpn/mroute.c
index 80e18b7..74923cf 100644
--- a/src/openvpn/mroute.c
+++ b/src/openvpn/mroute.c
@@ -454,6 +454,7 @@
buf_printf(&out, "UNKNOWN");
break;
}
+ buf_printf(&out, "|%d", maddr.proto);
return BSTR(&out);
}
else
diff --git a/src/openvpn/mroute.h b/src/openvpn/mroute.h
index 8b457d4..570ccaa 100644
--- a/src/openvpn/mroute.h
+++ b/src/openvpn/mroute.h
@@ -74,7 +74,7 @@
struct mroute_addr {
uint8_t len; /* length of address */
- uint8_t unused;
+ uint8_t proto;
uint8_t type; /* MR_ADDR/MR_WITH flags */
uint8_t netbits; /* number of bits in network part of address,
* valid if MR_WITH_NETBITS is set */
@@ -216,7 +216,7 @@
mroute_addr_hash_ptr(const struct mroute_addr *a)
{
/* NOTE: depends on ordering of struct mroute_addr */
- return (uint8_t *) &a->type;
+ return (uint8_t *) &a->proto;
}
static inline uint32_t
diff --git a/src/openvpn/mtcp.c b/src/openvpn/mtcp.c
index 6d1d5a0..62ed044 100644
--- a/src/openvpn/mtcp.c
+++ b/src/openvpn/mtcp.c
@@ -56,6 +56,7 @@
mi = multi_create_instance(m, NULL, ls);
if (mi)
{
+ mi->real.proto = ls->info.proto;
struct hash_element *he;
const uint32_t hv = hash_value(hash, &mi->real);
struct hash_bucket *bucket = hash_bucket(hash, hv);
diff --git a/src/openvpn/mudp.c b/src/openvpn/mudp.c
index 6137578..f0b5142 100644
--- a/src/openvpn/mudp.c
+++ b/src/openvpn/mudp.c
@@ -192,6 +192,8 @@
struct mroute_addr real = {0};
struct multi_instance *mi = NULL;
struct hash *hash = m->hash;
+ real.proto = ls->info.proto;
+ m->local.proto = real.proto;
if (mroute_extract_openvpn_sockaddr(&real, &m->top.c2.from.dest, true)
&& m->top.c2.buf.len > 0)
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 3f55dd7..2adea7f 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -1153,11 +1153,12 @@
*/
static struct multi_instance *
multi_get_instance_by_virtual_addr(struct multi_context *m,
- const struct mroute_addr *addr,
+ struct mroute_addr *addr,
bool cidr_routing)
{
struct multi_route *route;
struct multi_instance *ret = NULL;
+ addr->proto = 0;
/* check for local address */
if (mroute_addr_equal(addr, &m->local))
@@ -1243,6 +1244,7 @@
CLEAR(remote_si);
remote_si.addr.in4.sin_family = AF_INET;
remote_si.addr.in4.sin_addr.s_addr = htonl(a);
+ addr.proto = 0;
ASSERT(mroute_extract_openvpn_sockaddr(&addr, &remote_si, false));
if (netbits >= 0)
@@ -3344,6 +3346,14 @@
bool ret = true;
bool floated = false;
+ /*
+ * Since we don't really need the protocol on vaddresses for internal VPN
+ * payload packets, make sure we have the same value to void hashing insert
+ * and search issues.
+ */
+ src.proto = 0;
+ dest.proto = src.proto;
+
if (m->pending)
{
return true;
@@ -3410,7 +3420,6 @@
0,
&c->c2.to_tun,
DEV_TYPE_TUN);
-
/* drop packet if extract failed */
if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED))
{
@@ -3548,6 +3557,8 @@
const int dev_type = TUNNEL_TYPE(m->top.c1.tuntap);
int16_t vid = 0;
+ src.proto = 0;
+ dest.proto = src.proto;
#ifdef MULTI_DEBUG_EVENT_LOOP
printf("TUN -> TCP/UDP [%d]\n", BLEN(&m->top.c2.buf));
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/765?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: Ic66eccb5058fe9c0fae64d8e2ca88728068a92ab
Gerrit-Change-Number: 765
Gerrit-PatchSet: 14
Gerrit-Owner: its_Giaan <gianma...@mandelbit.com>
Gerrit-Reviewer: cron2 <g...@greenie.muc.de>
Gerrit-Reviewer: flichtenheld <fr...@lichtenheld.com>
Gerrit-Reviewer: plaisthos <arne-open...@rfc2549.org>
Gerrit-CC: openvpn-devel <openvpn-devel@lists.sourceforge.net>
Gerrit-CC: ordex <a...@unstable.cc>
Gerrit-Attention: plaisthos <arne-open...@rfc2549.org>
Gerrit-Attention: cron2 <g...@greenie.muc.de>
Gerrit-Attention: flichtenheld <fr...@lichtenheld.com>
Gerrit-Attention: ordex <a...@unstable.cc>
Gerrit-MessageType: newpatchset
_______________________________________________
Openvpn-devel mailing list
Openvpn-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
