Attachment #123242 for bug #183457




# $Id: CHANGES.IPv6,v 1.1.10.14 2005/06/22 16:01:10 jjo Exp $ #
* v0.3.12
  . merged payload conntrack fixes (EXPERIMENTAL code, disabled by default),
    almost no ipv6 related code changes.

* v0.3.11
  . woaooHOO: fixed udp6 MULTI (TLS server) !

* v0.3.10
  . stupid typo .... GRR

* v0.3.9
  . some MH code reorg., allow compilation with ./configure --disable-multihome

* v0.3.8
  . udp6 --multihome (MH) support fixed, tested OK! on GNU/Linux
 
* v0.3.7
  . udp6 MH support: compiles, not tested.

* v0.3.6
  . tested UDPv4 MH on GNU/Linux: works ok
  . fix incorrect addr printing in print_link_sockaddr() 

* v0.3.5
  . internals: kill print_link_sockaddr_ex(), just use print_propiate flags
   (just ~10lines change at all !)

* v0.3.4
  . make tcp4-client work against tcp6-server

* v0.3.3
  . freebsd: compute true addrlen for sendto() with af_addr_size()

* v0.3.2
  . minor changes to socket.[ch] (MH merge)

* v0.3.1
  . syshead.h MH changes were missing ; now it actually compiles MH support

* v0.3.0
  - tcp6-client, tcp6-server
  - MH patch included by default from now on

* v0.2.4-MH-0.0.6
  - account for !AF_INET in addr_host() 
  - removed S_IN, S_IN6 and S_UN casts; migrate last functions to openvpn_sockaddr: print*sockaddr*
  - more openvpn_sockaddr migration (polishing), almost ready
  - 3rd MH integration round

* v0.2.4
  - fix --route usage for udp6 (redirect-default-gateway semantics)

* v0.2.3
  - udp6 "correct" support for freebsd and openbsd
    cc and tested OK: freebsd-5.3,openbsd-3.6 against GNU/Linux

* v0.2.2
  - IPv6 (--proto udp6), unix-socket support selectable at configure-time 
    (all 4 combinations tested)
    ./configure --disable-ipv6        (enabled by default)
    ./configure --enable-unix-sockets (disabled by default)
    (internal) USE_PF_INET6, USE_PF_UNIX from autoconf
  - Change PROTO_x from #define to enum, to allow easier/cleaner support for
    optional protocols
  - Added IPV6_xxxx_HEADER_SIZE
  
* v0.2.1
  First public release, see README.IPv6

# vim: sw=2 

Lines 312-317 Link Here

(-)ChangeLog:1.4 (+3 lines)
312	* openvpn.spec workaround for SuSE confusion regarding	312	* openvpn.spec workaround for SuSE confusion regarding
313	/etc/init.d vs. /etc/rc.d/init.d (Stefan Engel).	313	/etc/init.d vs. /etc/rc.d/init.d (Stefan Engel).
314		314
		315	* Added IPv6 support (--udp6) and PF_UNIX (--unix-dgram)
		316	See README.IPv6 and CHANGES.IPv6 for details (Juanjo Ciarlante)
		317
315	2004.12.05 -- Version 2.0-beta20	318	2004.12.05 -- Version 2.0-beta20
316		319
317	* The ability to read --askpass and --auth-user-pass	320	* The ability to read --askpass and --auth-user-pass

Lines 86-92 Link Here

(-)Makefile.am:1.4 (-1 / +3 lines)
86	status.c status.h \	86	status.c status.h \
87	syshead.h \	87	syshead.h \
88	thread.c thread.h \	88	thread.c thread.h \
89	tun.c tun.h	89	tun.c tun.h \
		90	payload.c payload.h
		91
90		92
91	LDADD = @LIBOBJS@	93	LDADD = @LIBOBJS@
92		94




# Makefile.in generated by automake 1.9.2 from Makefile.am.
# @configure_input@

# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,

	$(ACLOCAL_M4)
am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \
 configure.lineno configure.status.lineno
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = config.h
CONFIG_CLEAN_FILES = openvpn.spec config-win32.h \
	install-win32/openvpn.nsi

	route.$(OBJEXT) schedule.$(OBJEXT) session_id.$(OBJEXT) \
	shaper.$(OBJEXT) sig.$(OBJEXT) socket.$(OBJEXT) \
	socks.$(OBJEXT) ssl.$(OBJEXT) status.$(OBJEXT) \
	thread.$(OBJEXT) tun.$(OBJEXT) payload.$(OBJEXT)
nodist_openvpn_OBJECTS =
openvpn_OBJECTS = $(am_openvpn_OBJECTS) $(nodist_openvpn_OBJECTS)
openvpn_LDADD = $(LDADD)

DEFAULT_INCLUDES = -I. -I$(srcdir) -I.
depcomp = $(SHELL) $(top_srcdir)/depcomp
am__depfiles_maybe = depfiles
@AMDEP_TRUE@DEP_FILES = $(DEPDIR)/memcmp.Po ./$(DEPDIR)/base64.Po \
@AMDEP_TRUE@	./$(DEPDIR)/buffer.Po ./$(DEPDIR)/crypto.Po \
@AMDEP_TRUE@	./$(DEPDIR)/error.Po ./$(DEPDIR)/event.Po \
@AMDEP_TRUE@	./$(DEPDIR)/fdmisc.Po ./$(DEPDIR)/forward.Po \
@AMDEP_TRUE@	./$(DEPDIR)/fragment.Po ./$(DEPDIR)/gremlin.Po \
@AMDEP_TRUE@	./$(DEPDIR)/helper.Po ./$(DEPDIR)/init.Po \
@AMDEP_TRUE@	./$(DEPDIR)/interval.Po ./$(DEPDIR)/list.Po \
@AMDEP_TRUE@	./$(DEPDIR)/lzo.Po ./$(DEPDIR)/manage.Po \
@AMDEP_TRUE@	./$(DEPDIR)/mbuf.Po ./$(DEPDIR)/misc.Po \
@AMDEP_TRUE@	./$(DEPDIR)/mroute.Po ./$(DEPDIR)/mss.Po \
@AMDEP_TRUE@	./$(DEPDIR)/mtcp.Po ./$(DEPDIR)/mtu.Po \
@AMDEP_TRUE@	./$(DEPDIR)/mudp.Po ./$(DEPDIR)/multi.Po \
@AMDEP_TRUE@	./$(DEPDIR)/ntlm.Po ./$(DEPDIR)/occ.Po \
@AMDEP_TRUE@	./$(DEPDIR)/openvpn.Po ./$(DEPDIR)/options.Po \
@AMDEP_TRUE@	./$(DEPDIR)/otime.Po ./$(DEPDIR)/packet_id.Po \
@AMDEP_TRUE@	./$(DEPDIR)/perf.Po ./$(DEPDIR)/ping.Po \
@AMDEP_TRUE@	./$(DEPDIR)/plugin.Po ./$(DEPDIR)/pool.Po \
@AMDEP_TRUE@	./$(DEPDIR)/proto.Po ./$(DEPDIR)/proxy.Po \
@AMDEP_TRUE@	./$(DEPDIR)/push.Po ./$(DEPDIR)/reliable.Po \
@AMDEP_TRUE@	./$(DEPDIR)/route.Po ./$(DEPDIR)/schedule.Po \
@AMDEP_TRUE@	./$(DEPDIR)/session_id.Po ./$(DEPDIR)/shaper.Po \
@AMDEP_TRUE@	./$(DEPDIR)/sig.Po ./$(DEPDIR)/socket.Po \
@AMDEP_TRUE@	./$(DEPDIR)/socks.Po ./$(DEPDIR)/ssl.Po \
@AMDEP_TRUE@	./$(DEPDIR)/status.Po ./$(DEPDIR)/thread.Po \
@AMDEP_TRUE@	./$(DEPDIR)/tun.Po
COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
CCLD = $(CC)

am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
build = @build@
build_alias = @build_alias@

	status.c status.h \
	syshead.h \
	thread.c thread.h \
	tun.c tun.h \
	payload.c payload.h

LDADD = @LIBOBJS@
man_MANS = openvpn.8

@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/options.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/otime.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/packet_id.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/payload.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/perf.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ping.Po@am__quote@
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/plugin.Po@am__quote@

@am__fastdepCC_TRUE@	if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@	$(COMPILE) -c $<

.c.obj:
@am__fastdepCC_TRUE@	if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ `$(CYGPATH_W) '$<'`; \
@am__fastdepCC_TRUE@	then mv -f "$(DEPDIR)/$*.Tpo" "$(DEPDIR)/$*.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
@am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
uninstall-info-am:
install-man8: $(man8_MANS) $(man_MANS)

	  done | \
	  $(AWK) '    { files[$$0] = 1; } \
	       END { for (i in files) print i; }'`; \
	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
	  test -n "$$unique" || unique=$$empty_fix; \
	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
	    $$tags $$unique; \
	fi
ctags: CTAGS
CTAGS:  $(HEADERS) $(SOURCES) config.h.in $(TAGS_DEPENDENCIES) \
		$(TAGS_FILES) $(LISP)

	  ! -type d ! -perm -444 -exec $(SHELL) $(install_sh) -c -m a+r {} {} \; \
	|| chmod -R a+r $(distdir)
dist-gzip: distdir
	tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
	$(am__remove_distdir)

dist-bzip2: distdir
	tardir=$(distdir) && $(am__tar) | bzip2 -9 -c >$(distdir).tar.bz2
	$(am__remove_distdir)

dist-tarZ: distdir
	tardir=$(distdir) && $(am__tar) | compress -c >$(distdir).tar.Z
	$(am__remove_distdir)

dist-shar: distdir

	$(am__remove_distdir)

dist dist-all: distdir
	tardir=$(distdir) && $(am__tar) | GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
	$(am__remove_distdir)

# This target untars the dist file and tries a VPATH configuration.  Then

distcheck: dist
	case '$(DIST_ARCHIVES)' in \
	*.tar.gz*) \
	  GZIP=$(GZIP_ENV) gunzip -c $(distdir).tar.gz | $(am__untar) ;;\
	*.tar.bz2*) \
	  bunzip2 -c $(distdir).tar.bz2 | $(am__untar) ;;\
	*.tar.Z*) \
	  uncompress -c $(distdir).tar.Z | $(am__untar) ;;\
	*.shar.gz*) \
	  GZIP=$(GZIP_ENV) gunzip -c $(distdir).shar.gz | unshar ;;\
	*.zip*) \
	  unzip $(distdir).zip ;;\
	esac

clean-generic:

distclean-generic:
	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)

maintainer-clean-generic:
	@echo "This command is intended for maintainers to use"


.PHONY: CTAGS GTAGS all all-am am--refresh check check-TESTS check-am \
	clean clean-generic clean-sbinPROGRAMS ctags dist dist-all \
	dist-bzip2 dist-gzip dist-hook dist-shar dist-tarZ dist-zip \
	distcheck distclean distclean-compile distclean-generic \
	distclean-hdr distclean-tags distcleancheck distdir \
	distuninstallcheck dvi dvi-am html html-am info info-am \
	install install-am install-data install-data-am install-exec \
	install-exec-am install-info install-info-am install-man \
	install-man8 install-sbinPROGRAMS install-strip installcheck \
	installcheck-am installdirs maintainer-clean \
	maintainer-clean-generic mostlyclean mostlyclean-compile \
	mostlyclean-generic pdf pdf-am ps ps-am tags uninstall \




# $Id: README.IPv6,v 1.1.10.5 2005/06/22 15:57:51 jjo Exp $ #

This README covers UDP/IPv6 v0.3.x ( --udp6 and --tcp6-xxxxxx  ) support for openvpn-2.0.

Also, with address family "generalization" changes came local AF_UNIX socket
support.

Available under GPLv2 from 
  http://www.irrigacion.gov.ar/juanjo/openvpn/

See "Examples" section below for usage.

* Working:
  - tcp6->tcp6; tested on GNU/Linux
  - upd6->upd6; tested on GNU/Linux, FreeBSD-5.3 and OpenBSD-3.6.
  - upd4->upd6 (ipv6 bound); shows correctly mapped address (requires --float for now)
  - unix-dgram->unix-dgram [AF_UNIX]
    useful for implementing local proxies that can take full advantage
    of POSIX filesystem permissions ( more powerfull access mechanisms
    than inet, even for localhost)
  - multihome [MH] for IPv4 and IPv6; compiles and works OK GNU/Linux
    ipv4 MH support taken and adapted from James' original MH patch 

* Experimental code (correctly #ifdef'd out):
  - payload conntrack: intended for filtering TCP retransmissions over reliable links
    1st tests indicate aprox ~20% speedups (very coarsly tested)

* Setup:
  ./configure --disable-ipv6        (enabled by default)
  ./configure --enable-unix-sockets (disabled by default)
  ./configure --enable-payload-conntrack (experimental code, not for production usage)
  :

* Usage:
  For IPv6 just specify "-p upd6" an proper IPv6 hostnames, adapting the example
  from man page ...

  On may:
    openvpn --proto udp6 --remote <june_IPv6_addr> --dev tun1 --ifconfig 10.4.0.1 10.4.0.2
    --verb 5 --secret key

  On june:
    openvpn --proto udp6 --remote <may_IPv6_addr>  --dev tun1 --ifconfig 10.4.0.2 10.4.0.1
    --verb 5 --secret key
  
  Same for --proto tcp6-client, tcp6-server.

* Examples: some succesfully tested command lines 
  BTW did you know that openvpn can succesfully negotiate to self
  with --remote localhost ? VERY useful for fast testing.
  
  - IPv6 "normal" usage (+succesfully tested tunnel traffic) 
    server# openvpn --proto udp6 ...
      :
      Thu Sep 23 22:15:48 2004 Peer Connection Initiated with [AF_INET6]fe80::205:5dff:fef1:1ceb%wlan0wds1:5000
      :
    client# openvpn --proto udp6 --remote fe80::240:5ff:feae:c851 ...
      :
      Thu Sep 23 22:13:19 2004 Peer Connection Initiated with [AF_INET6]fe80::240:5ff:feae:c851%wlan0wds0:5000
      :

  - IPv6 server, IPv4 client (more detailed)
    server# openvpn --proto udp6 ...
      :
      Thu Sep 23 22:28:36 2004 UDPv6 link local (bound): [AF_INET6][undef]:5000
      Thu Sep 23 22:28:36 2004 UDPv6 link remote: [AF_INET6][undef]
      Thu Sep 23 22:28:50 2004 Peer Connection Initiated with [AF_INET6]::ffff:10.55.14.253:5000
      Thu Sep 23 22:28:51 2004 Initialization Sequence Completed
      Thu Sep 23 22:28:56 2004 WARNING: Actual Remote Options ('... proto UDPv4 ... ') \
                               are inconsistent with Expected Remote Options ('... proto UDPv6 ...')

    client# openvpn  --remote 10.55.14.254 ...  ### same default as now: --udp
      :
      Thu Sep 23 22:26:11 2004 UDPv4 link local (bound): [AF_INET][undef]:5000
      Thu Sep 23 22:26:11 2004 UDPv4 link remote: [AF_INET]10.55.14.254:5000
      Thu Sep 23 22:26:21 2004 Peer Connection Initiated with [AF_INET]10.55.14.254:5000
      Thu Sep 23 22:26:21 2004 WARNING: Actual Remote Options ('... proto UDPv6 ...') \
                               are inconsistent with Expected Remote Options ('... proto UDPv4 ...')
      Thu Sep 23 22:26:22 2004 Initialization Sequence Completed

  - IPv6 loopback
    alone# openvpn --proto udp6 --remote ::1 ...
      :
      Wed Sep 22 13:03:07 2004 Peer Connection Initiated with [AF_INET6]::1:5000
      :

  - AF_UNIX toself
    alone# openvpn --proto unix-dgram --local /tmp/o.s --remote /tmp/o.s --dev tun  ...
      :
      Thu Sep 23 16:37:27 2004 Peer Connection Initiated with [AF_UNIX]/tmp/o.s
      :
  
  - AF_UNIX between to diff instances
    peer1# openvpn --proto unix-dgram --local /tmp/o1.s --remote /tmp/o2.s
    peer2# openvpn --proto unix-dgram --local /tmp/o2.s --remote /tmp/o1.s
      :
      Wed Sep 22 12:49:03 2004 Peer Connection Initiated with [AF_UNIX]/tmp/o1.s
      :
  

* Main code changes summary:
  - socket.h: New struct openvpn_sockaddr type that holds sockaddrs and pktinfo, 
    (here I omitted #ifdef USE_PF_xxxx, see socket.h )

    struct openvpn_sockaddr {
    	union {
    		struct sockaddr sa;
    		struct sockaddr_in in;
    		struct sockaddr_in6 in6;
    		struct sockaddr_un un;
    	} addr;
    	union {
    		struct in_pktinfo in;
    		struct in6_pktinfo in6;
    	} pi;	/* Multihome support for UDP */
    };
    
    struct link_socket_addr
    {
            struct openvpn_sockaddr local;
            struct openvpn_sockaddr remote;
            struct openvpn_sockaddr actual;
    };
    
    PRO: allows simple type overloading: local.addr.sa, local.addr.in, local.addr.in6 ... etc
    (also local.pi.in and local.pi.in6)

  - several function prototypes moved from sockaddr_in to openvpn_sockaddr 
  - several new sockaddr functions needed to "generalize" AF_xxxx operations:
    addr_copy(), addr_zero(), ...etc
    proto_is_udp(), proto_is_dgram(), proto_is_net()

* TODO: (!: fundamental, w: wanted, n: nah ... not critical, ?: need more thought)
  [!]-  Implement comparison for mapped addesses: server in dual stack listening
        IPv6 must permit incoming streams from allowed IPv4 peer (ie without --float).
  [!]-  IPv6 with actual host resolution, currently only numerical (AI_NUMERICHOST)
  [n]-  call socket() lately, after getaddrinfo() to decide IPv4 or IPv6 host 
        (hence socket()) instead of needing -p {udp|udp6}
        NOT ACTUALLY a big trouble, given that you _do_ setup both sides
        (keys, certs, etc), using udp or udp6 is actually _another_ setup bit.
  [?]-  integrate both IPv4 and IPv6 addr resolution with getaddrinfo instead of
        venerable gethostbyname&friends, problem: horizontal portability (across
        platforms) and vertical portab. (across versions)

  DONE:
     -  ./configure [ --disable-ipv6 ] [ --enable-unix-sockets ] 
        map to USE_PF_INET6 and USE_PF_UNIX
     -  merge MH patch
     -  -p tcp6-client, -p tcp6-server
     -  MH IPv6 support 
 
--
JuanJo Ciarlante   jjo|at|mendoza.gov.ar
:                                                                  :
.                                         Linux IP Aliasing author .
.   Modular algo (AES et all) support for FreeSWAN/OpenSWAN author .
:...       plus  other scattered free software bits in the wild ...:




# generated automatically by aclocal 1.9.2 -*- Autoconf -*-

# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
# Free Software Foundation, Inc.

# ----------------------------
# Automake X.Y traces this macro to ensure aclocal.m4 has been
# generated from the m4 files accompanying Automake X.Y.
AC_DEFUN([AM_AUTOMAKE_VERSION], [am__api_version="1.9"])

# AM_SET_CURRENT_AUTOMAKE_VERSION
# -------------------------------
# Call AM_AUTOMAKE_VERSION so it can be traced.
# This function is AC_REQUIREd by AC_INIT_AUTOMAKE.
AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
	 [AM_AUTOMAKE_VERSION([1.9.2])])

# AM_AUX_DIR_EXPAND



# AM_CONDITIONAL                                              -*- Autoconf -*-

# Copyright (C) 1997, 2000, 2001, 2003, 2004 Free Software Foundation, Inc.

# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

fi
AC_CONFIG_COMMANDS_PRE(
[if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then
  AC_MSG_ERROR([[conditional "$1" was never defined.
Usually this means the macro was only invoked conditionally.]])
fi])])

# serial 7						-*- Autoconf -*-

       grep sub/conftest.${OBJEXT-o} sub/conftest.Po > /dev/null 2>&1 &&
       ${MAKE-make} -s -f confmf > /dev/null 2>&1; then
      # icc doesn't choke on unknown options, it will just issue warnings
      # or remarks (even with -Werror).  So we grep stderr for any message
      # that says an option was ignored or not supported.
      # When given -MP, icc 7.0 and 7.1 complain thusly:
      #   icc: Command line warning: ignoring option '-M'; no argument required
      # The diagnosis changed in icc 8.0:
      #   icc: Command line remark: option '-MP' not supported
      if (grep 'ignoring option' conftest.err ||
          grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else
        am_cv_$1_dependencies_compiler_type=$depmode
        break
      fi


# Generate code to set up dependency tracking.   -*- Autoconf -*-

# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004
#   Free Software Foundation, Inc.

# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by

  else
    continue
  fi
  # Extract the definition of DEPDIR, am__include, and am__quote
  # from the Makefile without running `make'.
  # running `make'.
  DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
  test -z "$DEPDIR" && continue
  am__include=`sed -n 's/^am__include = //p' < "$mf"`
  test -z "am__include" && continue
  am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
  # When using ansi2knr, U may be empty or an underscore; expand it
  U=`sed -n 's/^U = //p' < "$mf"`
  # Find all dependency output files, they are included files with
  # $(DEPDIR) in their names.  We invoke sed twice because it is the
  # simplest approach to changing $(DEPDIR) to its actual value in the
  # expansion.
  for file in `sed -n "
    s/^$am__include $am__quote\(.*(DEPDIR).*\)$am__quote"'$/\1/p' <"$mf" | \
      :loop
	s/\\\\$//
	p
	n
	/\\\\$/ b loop
      p
    }
    /^DEP_FILES = / s/^DEP_FILES = //p' < "$mf" | \
       sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g' -e 's/\$U/'"$U"'/g'`; do
    # Make sure the directory exists.
    test -f "$dirpart/$file" && continue

# This macro actually does too much some checks are only needed if
# your package does certain things.  But this isn't really a big deal.

# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
# Free Software Foundation, Inc.

# This program is free software; you can redistribute it and/or modify

AM_MISSING_PROG(AUTOMAKE, automake-${am__api_version})
AM_MISSING_PROG(AUTOHEADER, autoheader)
AM_MISSING_PROG(MAKEINFO, makeinfo)
AM_MISSING_PROG(AMTAR, tar)
AM_PROG_INSTALL_SH
AM_PROG_INSTALL_STRIP
AC_REQUIRE([AM_PROG_MKDIR_P])dnl

AC_REQUIRE([AC_PROG_AWK])dnl
AC_REQUIRE([AC_PROG_MAKE_SET])dnl
AC_REQUIRE([AM_SET_LEADING_DOT])dnl
_AM_IF_OPTION([tar-ustar], [_AM_PROG_TAR([ustar])],
              [_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])],
	      		     [_AM_PROG_TAR([v7])])])
_AM_IF_OPTION([no-dependencies],,
[AC_PROVIDE_IFELSE([AC_PROG_CC],
                  [_AM_DEPENDENCIES(CC)],

# this.)
AC_DEFUN([AM_PROG_MKDIR_P],
[if mkdir -p --version . >/dev/null 2>&1 && test ! -d ./--version; then
  # We used to keeping the `.' as first argument, in order to
  # allow $(mkdir_p) to be used without argument.  As in
  #   $(mkdir_p) $(somedir)
  # where $(somedir) is conditionally defined.  However this is wrong
  # for two reasons:
  #  1. if the package is installed by a user who cannot write `.'
  #     make install will fail,
  #  2. the above comment should most certainly read
  #     $(mkdir_p) $(DESTDIR)$(somedir)
  #     so it does not work when $(somedir) is undefined and
  #     $(DESTDIR) is not.
  #  To support the latter case, we have to write
  #     test -z "$(somedir)" || $(mkdir_p) $(DESTDIR)$(somedir),
  #  so the `.' trick is pointless.
  mkdir_p='mkdir -p --'
else
  # On NextStep and OpenStep, the `mkdir' command does not
  # recognize any option.  It will interpret all options as

INSTALL_STRIP_PROGRAM="\${SHELL} \$(install_sh) -c -s"
AC_SUBST([INSTALL_STRIP_PROGRAM])])

# Check how to create a tarball.                            -*- Autoconf -*-

# Copyright (C) 2004  Free Software Foundation, Inc.

# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
# 02111-1307, USA.

# serial 1


# _AM_PROG_TAR(FORMAT)
# --------------------
# Check how to create a tarball in format FORMAT.
# FORMAT should be one of `v7', `ustar', or `pax'.
#
# Substitute a variable $(am__tar) that is a command
# writing to stdout a FORMAT-tarball containing the directory
# $tardir.
#     tardir=directory && $(am__tar) > result.tar
#
# Substitute a variable $(am__untar) that extract such
# a tarball read from stdin.
#     $(am__untar) < result.tar
AC_DEFUN([_AM_PROG_TAR],
[# Always define AMTAR for backward compatibility.
AM_MISSING_PROG([AMTAR], [tar])
m4_if([$1], [v7],
     [am__tar='${AMTAR} chof - "$$tardir"'; am__untar='${AMTAR} xf -'],
     [m4_case([$1], [ustar],, [pax],,
              [m4_fatal([Unknown tar format])])
AC_MSG_CHECKING([how to create a $1 tar archive])
# Loop over all known methods to create a tar archive until one works.
_am_tools='gnutar m4_if([$1], [ustar], [plaintar]) pax cpio none'
_am_tools=${am_cv_prog_tar_$1-$_am_tools}
# Do not fold the above two line into one, because Tru64 sh and
# Solaris sh will not grok spaces in the rhs of `-'.
for _am_tool in $_am_tools
do
  case $_am_tool in
  gnutar)
    for _am_tar in tar gnutar gtar;
    do
      AM_RUN_LOG([$_am_tar --version]) && break
    done
    am__tar="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$$tardir"'
    am__tar_="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$tardir"'
    am__untar="$_am_tar -xf -"
    ;;
  plaintar)
    # Must skip GNU tar: if it does not support --format= it doesn't create
    # ustar tarball either.
    (tar --version) >/dev/null 2>&1 && continue
    am__tar='tar chf - "$$tardir"'
    am__tar_='tar chf - "$tardir"'
    am__untar='tar xf -'
    ;;
  pax)
    am__tar='pax -L -x $1 -w "$$tardir"'
    am__tar_='pax -L -x $1 -w "$tardir"'
    am__untar='pax -r'
    ;;
  cpio)
    am__tar='find "$$tardir" -print | cpio -o -H $1 -L'
    am__tar_='find "$tardir" -print | cpio -o -H $1 -L'
    am__untar='cpio -i -H $1 -d'
    ;;
  none)
    am__tar=false
    am__tar_=false
    am__untar=false
    ;;
  esac

  # If the value was cached, stop now.  We just wanted to have am__tar
  # and am__untar set.
  test -n "${am_cv_prog_tar_$1}" && break

  # tar/untar a dummy directory, and stop if the command works
  rm -rf conftest.dir
  mkdir conftest.dir
  echo GrepMe > conftest.dir/file
  AM_RUN_LOG([tardir=conftest.dir && eval $am__tar_ >conftest.tar])
  rm -rf conftest.dir
  if test -s conftest.tar; then
    AM_RUN_LOG([$am__untar <conftest.tar])
    grep GrepMe conftest.dir/file >/dev/null 2>&1 && break
  fi
done
rm -rf conftest.dir

AC_CACHE_VAL([am_cv_prog_tar_$1], [am_cv_prog_tar_$1=$_am_tool])
AC_MSG_RESULT([$am_cv_prog_tar_$1])])
AC_SUBST([am__tar])
AC_SUBST([am__untar])
]) # _AM_PROG_TAR

m4_include([acinclude.m4])




	}
    }
}
void buf_puts(struct buffer *buf, const char *str)
{
  uint8_t *ptr = BEND (buf);
  int cap = buf_forward_capacity (buf);
  if (cap > 0)
    {
      strncpynt ((char *)ptr,str, cap);
      *(buf->data + buf->capacity - 1) = 0; /* windows vsnprintf needs this */
      buf->len += (int) strlen ((char *)ptr);
    }
}

/*
 * This is necessary due to certain buggy implementations of snprintf,

Lines 200-205 Link Here

(-)buffer.h:1.4 (+5 lines)
200	;	200	;
201		201
202	/*	202	/*
		203	* append str to a buffer with overflow check
		204	*/
		205	void buf_puts(struct buffer buf, const char str);
		206
		207	/*
203	* Like snprintf but guarantees null termination for size > 0	208	* Like snprintf but guarantees null termination for size > 0
204	*/	209	*/
205	int openvpn_snprintf(char str, size_t size, const char format, ...)	210	int openvpn_snprintf(char str, size_t size, const char format, ...)

Lines 30-35 Link Here

(-)config.h.in:1.1 (+21 lines)
30	/* Enable management server capability */	30	/* Enable management server capability */
31	#undef ENABLE_MANAGEMENT	31	#undef ENABLE_MANAGEMENT
32		32
		33	/* Enable multi-homed UDP server capability */
		34	#undef ENABLE_MULTIHOME
		35
33	/* Allow --askpass and --auth-user-pass passwords to be read from a file */	36	/* Allow --askpass and --auth-user-pass passwords to be read from a file */
34	#undef ENABLE_PASSWORD_SAVE	37	#undef ENABLE_PASSWORD_SAVE
35		38
Lines 147-152 Link Here
147	/* Define to 1 if you have the <inttypes.h> header file. */	150	/* Define to 1 if you have the <inttypes.h> header file. */
148	#undef HAVE_INTTYPES_H	151	#undef HAVE_INTTYPES_H
149		152
		153	/* struct in_pktinfo needed for IP_PKTINFO support */
		154	#undef HAVE_IN_PKTINFO
		155
150	/* struct iovec needed for IPv6 support */	156	/* struct iovec needed for IPv6 support */
151	#undef HAVE_IOVEC	157	#undef HAVE_IOVEC
152		158
Lines 234-239 Link Here
234	/* Define to 1 if you have the `recvfrom' function. */	240	/* Define to 1 if you have the `recvfrom' function. */
235	#undef HAVE_RECVFROM	241	#undef HAVE_RECVFROM
236		242
		243	/* Define to 1 if you have the `recvmsg' function. */
		244	#undef HAVE_RECVMSG
		245
237	/* Define to 1 if you have the <resolv.h> header file. */	246	/* Define to 1 if you have the <resolv.h> header file. */
238	#undef HAVE_RESOLV_H	247	#undef HAVE_RESOLV_H
239		248
Lines 243-248 Link Here
243	/* Define to 1 if you have the `send' function. */	252	/* Define to 1 if you have the `send' function. */
244	#undef HAVE_SEND	253	#undef HAVE_SEND
245		254
		255	/* Define to 1 if you have the `sendmsg' function. */
		256	#undef HAVE_SENDMSG
		257
246	/* Define to 1 if you have the `sendto' function. */	258	/* Define to 1 if you have the `sendto' function. */
247	#undef HAVE_SENDTO	259	#undef HAVE_SENDTO
248		260
Lines 451-456 Link Here
451	/* Use LZO compression library */	463	/* Use LZO compression library */
452	#undef USE_LZO	464	#undef USE_LZO
453		465
		466	/* Enable payload conntrack */
		467	#undef USE_PAYLOAD_CONNTRACK
		468
		469	/* struct sockaddr_in6 is needed for IPv6 peer support */
		470	#undef USE_PF_INET6
		471
		472	/* Compile support for PF_UNIX sockets */
		473	#undef USE_PF_UNIX
		474
454	/* Use pthread-based multithreading */	475	/* Use pthread-based multithreading */
455	#undef USE_PTHREAD	476	#undef USE_PTHREAD
456		477

Lines 311-317 Link Here

(-)configure:1.2 (-33 / +575 lines)
311	# include <unistd.h>	311	# include <unistd.h>
312	#endif"	312	#endif"
313		313
314	ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS IFCONFIG IPROUTE ROUTE build build_cpu build_vendor build_os host host_cpu host_vendor host_os target target_cpu target_vendor target_os INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA CYGPATH_W PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO AMTAR install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM mkdir_p AWK SET_MAKE am__leading_dot CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE am__fastdepCC_TRUE am__fastdepCC_FALSE CPP EGREP LIBOBJS PTHREAD_CC PTHREAD_LIBS PTHREAD_CFLAGS LTLIBOBJS'	314	ac_subst_vars='SHELL PATH_SEPARATOR PACKAGE_NAME PACKAGE_TARNAME PACKAGE_VERSION PACKAGE_STRING PACKAGE_BUGREPORT exec_prefix prefix program_transform_name bindir sbindir libexecdir datadir sysconfdir sharedstatedir localstatedir libdir includedir oldincludedir infodir mandir build_alias host_alias target_alias DEFS ECHO_C ECHO_N ECHO_T LIBS IFCONFIG IPROUTE ROUTE build build_cpu build_vendor build_os host host_cpu host_vendor host_os target target_cpu target_vendor target_os INSTALL_PROGRAM INSTALL_SCRIPT INSTALL_DATA CYGPATH_W PACKAGE VERSION ACLOCAL AUTOCONF AUTOMAKE AUTOHEADER MAKEINFO install_sh STRIP ac_ct_STRIP INSTALL_STRIP_PROGRAM mkdir_p AWK SET_MAKE am__leading_dot AMTAR am__tar am__untar CC CFLAGS LDFLAGS CPPFLAGS ac_ct_CC EXEEXT OBJEXT DEPDIR am__include am__quote AMDEP_TRUE AMDEP_FALSE AMDEPBACKSLASH CCDEPMODE am__fastdepCC_TRUE am__fastdepCC_FALSE CPP EGREP LIBOBJS PTHREAD_CC PTHREAD_LIBS PTHREAD_CFLAGS LTLIBOBJS'
315	ac_subst_files=''	315	ac_subst_files=''
316		316
317	# Initialize some variables set by options.	317	# Initialize some variables set by options.
Lines 864-869 Link Here
864	--disable-socks Disable Socks support	864	--disable-socks Disable Socks support
865	--disable-http Disable HTTP proxy support	865	--disable-http Disable HTTP proxy support
866	--disable-fragment Disable internal fragmentation support (--fragment)	866	--disable-fragment Disable internal fragmentation support (--fragment)
		867	--disable-multihome Disable multi-homed UDP server support (--multihome)
867	--disable-debug Disable debugging support (disable gremlin and verb 7+ messages)	868	--disable-debug Disable debugging support (disable gremlin and verb 7+ messages)
868	--enable-small Enable smaller executable size (disable OCC, usage message, and verb 4 parm list)	869	--enable-small Enable smaller executable size (disable OCC, usage message, and verb 4 parm list)
869	--enable-pthread Enable pthread support (Experimental for OpenVPN 2.0)	870	--enable-pthread Enable pthread support (Experimental for OpenVPN 2.0)
Lines 872-877 Link Here
872	--enable-strict Enable strict compiler warnings (debugging option)	873	--enable-strict Enable strict compiler warnings (debugging option)
873	--enable-profiling Enable profiling (debugging option)	874	--enable-profiling Enable profiling (debugging option)
874	--enable-strict-options Enable strict options check between peers (debugging option)	875	--enable-strict-options Enable strict options check between peers (debugging option)
		876	--disable-ipv6 Disable UDP/IPv6 support
		877	--enable-unix-sockets Enable PF_UNIX sockets links
		878	--enable-payload-conntrack Enable payload conntrack for eg. TCP retrans. dd for reliable links
875	--disable-dependency-tracking speeds up one-time build	879	--disable-dependency-tracking speeds up one-time build
876	--enable-dependency-tracking do not reject slow dependency extractors	880	--enable-dependency-tracking do not reject slow dependency extractors
877		881
Lines 1439-1444 Link Here
1439		1443
1440	fi;	1444	fi;
1441		1445
		1446	# Check whether --enable-multihome or --disable-multihome was given.
		1447	if test "${enable_multihome+set}" = set; then
		1448	enableval="$enable_multihome"
		1449	MULTIHOME="$enableval"
		1450	else
		1451	MULTIHOME="yes"
		1452
		1453	fi;
		1454
1442	# Check whether --enable-debug or --disable-debug was given.	1455	# Check whether --enable-debug or --disable-debug was given.
1443	if test "${enable_debug+set}" = set; then	1456	if test "${enable_debug+set}" = set; then
1444	enableval="$enable_debug"	1457	enableval="$enable_debug"
Lines 1513-1518 Link Here
1513		1526
1514	fi;	1527	fi;
1515		1528
		1529	# Check whether --enable-ipv6 or --disable-ipv6 was given.
		1530	if test "${enable_ipv6+set}" = set; then
		1531	enableval="$enable_ipv6"
		1532	PF_INET6="$enableval"
		1533	else
		1534	PF_INET6="yes"
		1535
		1536	fi;
		1537
		1538	# Check whether --enable-unix-sockets or --disable-unix-sockets was given.
		1539	if test "${enable_unix_sockets+set}" = set; then
		1540	enableval="$enable_unix_sockets"
		1541	PF_UNIX="$enableval"
		1542	else
		1543	PF_UNIX="no"
		1544
		1545	fi;
		1546
		1547	# Check whether --enable-payload-conntrack or --disable-payload-conntrack was given.
		1548	if test "${enable_payload_conntrack+set}" = set; then
		1549	enableval="$enable_payload_conntrack"
		1550	PAYLOAD_CONNTRACK="$enableval"
		1551	else
		1552	PAYLOAD_CONNTRACK="no"
		1553
		1554	fi;
		1555
1516		1556
1517	# Check whether --with-ssl-headers or --without-ssl-headers was given.	1557	# Check whether --with-ssl-headers or --without-ssl-headers was given.
1518	if test "${with_ssl_headers+set}" = set; then	1558	if test "${with_ssl_headers+set}" = set; then
Lines 1828-1834 Link Here
1828	test "$program_prefix$program_suffix$program_transform_name" = \	1868	test "$program_prefix$program_suffix$program_transform_name" = \
1829	NONENONEs,x,x, &&	1869	NONENONEs,x,x, &&
1830	program_prefix=${target_alias}-	1870	program_prefix=${target_alias}-
1831	am__api_version="1.8"	1871	am__api_version="1.9"
1832	# Find a good install program. We prefer a C program (faster),	1872	# Find a good install program. We prefer a C program (faster),
1833	# so one script is as good as another. But avoid the broken or	1873	# so one script is as good as another. But avoid the broken or
1834	# incompatible versions:	1874	# incompatible versions:
Lines 1980-1992 Link Here
1980	fi	2020	fi
1981		2021
1982	if mkdir -p --version . >/dev/null 2>&1 && test ! -d ./--version; then	2022	if mkdir -p --version . >/dev/null 2>&1 && test ! -d ./--version; then
1983	# Keeping the `.' argument allows $(mkdir_p) to be used without	2023	# We used to keeping the `.' as first argument, in order to
1984	# argument. Indeed, we sometimes output rules like	2024	# allow $(mkdir_p) to be used without argument. As in
1985	# $(mkdir_p) $(somedir)	2025	# $(mkdir_p) $(somedir)
1986	# where $(somedir) is conditionally defined.	2026	# where $(somedir) is conditionally defined. However this is wrong
1987	# (`test -n '$(somedir)' && $(mkdir_p) $(somedir)' is a more	2027	# for two reasons:
1988	# expensive solution, as it forces Make to start a sub-shell.)	2028	# 1. if the package is installed by a user who cannot write `.'
1989	mkdir_p='mkdir -p -- .'	2029	# make install will fail,
		2030	# 2. the above comment should most certainly read
		2031	# $(mkdir_p) $(DESTDIR)$(somedir)
		2032	# so it does not work when $(somedir) is undefined and
		2033	# $(DESTDIR) is not.
		2034	# To support the latter case, we have to write
		2035	# test -z "$(somedir)" \|\| $(mkdir_p) $(DESTDIR)$(somedir),
		2036	# so the `.' trick is pointless.
		2037	mkdir_p='mkdir -p --'
1990	else	2038	else
1991	# On NextStep and OpenStep, the `mkdir' command does not	2039	# On NextStep and OpenStep, the `mkdir' command does not
1992	# recognize any option. It will interpret all options as	2040	# recognize any option. It will interpret all options as
Lines 2130-2138 Link Here
2130		2178
2131	MAKEINFO=${MAKEINFO-"${am_missing_run}makeinfo"}	2179	MAKEINFO=${MAKEINFO-"${am_missing_run}makeinfo"}
2132		2180
2133
2134	AMTAR=${AMTAR-"${am_missing_run}tar"}
2135
2136	install_sh=${install_sh-"$am_aux_dir/install-sh"}	2181	install_sh=${install_sh-"$am_aux_dir/install-sh"}
2137		2182
2138	# Installed binaries are usually stripped using `strip' when the user	2183	# Installed binaries are usually stripped using `strip' when the user
Lines 2225-2230 Link Here
2225		2270
2226	# We need awk for the "check" target. The system "awk" is bad on	2271	# We need awk for the "check" target. The system "awk" is bad on
2227	# some platforms.	2272	# some platforms.
		2273	# Always define AMTAR for backward compatibility.
		2274
		2275	AMTAR=${AMTAR-"${am_missing_run}tar"}
		2276
		2277	am__tar='${AMTAR} chof - "$$tardir"'; am__untar='${AMTAR} xf -'
		2278
		2279
2228		2280
2229		2281
2230		2282
Lines 3368-3376 Link Here
3368	grep sub/conftest.${OBJEXT-o} sub/conftest.Po > /dev/null 2>&1 &&	3420	grep sub/conftest.${OBJEXT-o} sub/conftest.Po > /dev/null 2>&1 &&
3369	${MAKE-make} -s -f confmf > /dev/null 2>&1; then	3421	${MAKE-make} -s -f confmf > /dev/null 2>&1; then
3370	# icc doesn't choke on unknown options, it will just issue warnings	3422	# icc doesn't choke on unknown options, it will just issue warnings
3371	# (even with -Werror). So we grep stderr for any message	3423	# or remarks (even with -Werror). So we grep stderr for any message
3372	# that says an option was ignored.	3424	# that says an option was ignored or not supported.
3373	if grep 'ignoring option' conftest.err >/dev/null 2>&1; then :; else	3425	# When given -MP, icc 7.0 and 7.1 complain thusly:
		3426	# icc: Command line warning: ignoring option '-M'; no argument required
		3427	# The diagnosis changed in icc 8.0:
		3428	# icc: Command line remark: option '-MP' not supported
		3429	if (grep 'ignoring option' conftest.err \|\|
		3430	grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else
3374	am_cv_CC_dependencies_compiler_type=$depmode	3431	am_cv_CC_dependencies_compiler_type=$depmode
3375	break	3432	break
3376	fi	3433	fi
Lines 4980-4985 Link Here
4980	ac_header_preproc=yes	5037	ac_header_preproc=yes
4981	;;	5038	;;
4982	no:yes:* )	5039	no:yes:* )
		5040	{ echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
		5041	echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
		5042	{ echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
		5043	echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
		5044	{ echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
		5045	echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
		5046	{ echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
		5047	echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
		5048	{ echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
		5049	echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
		5050	{ echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
		5051	echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
		5052	(
		5053	cat <<\_ASBOX
		5054	## -------------------------------------------------- ##
		5055	## Report this to openvpn-users@lists.sourceforge.net ##
		5056	## -------------------------------------------------- ##
		5057	_ASBOX
		5058	) \|
		5059	sed "s/^/$as_me: WARNING: /" >&2
4983	;;	5060	;;
4984	esac	5061	esac
4985	echo "$as_me:$LINENO: checking for $ac_header" >&5	5062	echo "$as_me:$LINENO: checking for $ac_header" >&5
Lines 5718-5723 Link Here
5718		5795
5719	fi	5796	fi
5720		5797
		5798	echo "$as_me:$LINENO: checking for struct in_pktinfo" >&5
		5799	echo $ECHO_N "checking for struct in_pktinfo... $ECHO_C" >&6
		5800	if test "${ac_cv_type_struct_in_pktinfo+set}" = set; then
		5801	echo $ECHO_N "(cached) $ECHO_C" >&6
		5802	else
		5803	cat >conftest.$ac_ext <<_ACEOF
		5804	/* confdefs.h. */
		5805	_ACEOF
		5806	cat confdefs.h >>conftest.$ac_ext
		5807	cat >>conftest.$ac_ext <<_ACEOF
		5808	/* end confdefs.h. */
		5809	#include "syshead.h"
		5810
		5811	int
		5812	main ()
		5813	{
		5814	if ((struct in_pktinfo *) 0)
		5815	return 0;
		5816	if (sizeof (struct in_pktinfo))
		5817	return 0;
		5818	;
		5819	return 0;
		5820	}
		5821	_ACEOF
		5822	rm -f conftest.$ac_objext
		5823	if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
		5824	(eval $ac_compile) 2>conftest.er1
		5825	ac_status=$?
		5826	grep -v '^ *+' conftest.er1 >conftest.err
		5827	rm -f conftest.er1
		5828	cat conftest.err >&5
		5829	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		5830	(exit $ac_status); } &&
		5831	{ ac_try='test -z "$ac_c_werror_flag"
		5832	\|\| test ! -s conftest.err'
		5833	{ (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
		5834	(eval $ac_try) 2>&5
		5835	ac_status=$?
		5836	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		5837	(exit $ac_status); }; } &&
		5838	{ ac_try='test -s conftest.$ac_objext'
		5839	{ (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
		5840	(eval $ac_try) 2>&5
		5841	ac_status=$?
		5842	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		5843	(exit $ac_status); }; }; then
		5844	ac_cv_type_struct_in_pktinfo=yes
		5845	else
		5846	echo "$as_me: failed program was:" >&5
		5847	sed 's/^/\| /' conftest.$ac_ext >&5
		5848
		5849	ac_cv_type_struct_in_pktinfo=no
		5850	fi
		5851	rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
		5852	fi
		5853	echo "$as_me:$LINENO: result: $ac_cv_type_struct_in_pktinfo" >&5
		5854	echo "${ECHO_T}$ac_cv_type_struct_in_pktinfo" >&6
		5855	if test $ac_cv_type_struct_in_pktinfo = yes; then
		5856
		5857	cat >>confdefs.h <<\_ACEOF
		5858	#define HAVE_IN_PKTINFO 1
		5859	_ACEOF
		5860
		5861	fi
5862
5721		5863
5722	echo "$as_me:$LINENO: checking for unsigned int" >&5	5864	echo "$as_me:$LINENO: checking for unsigned int" >&5
5723	echo $ECHO_N "checking for unsigned int... $ECHO_C" >&6	5865	echo $ECHO_N "checking for unsigned int... $ECHO_C" >&6
Lines 7313-7318 Link Here
7313	ac_header_preproc=yes	7455	ac_header_preproc=yes
7314	;;	7456	;;
7315	no:yes:* )	7457	no:yes:* )
		7458	{ echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
		7459	echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
		7460	{ echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
		7461	echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
		7462	{ echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
		7463	echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
		7464	{ echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
		7465	echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
		7466	{ echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
		7467	echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
		7468	{ echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
		7469	echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
		7470	(
		7471	cat <<\_ASBOX
		7472	## -------------------------------------------------- ##
		7473	## Report this to openvpn-users@lists.sourceforge.net ##
		7474	## -------------------------------------------------- ##
		7475	_ASBOX
		7476	) \|
		7477	sed "s/^/$as_me: WARNING: /" >&2
7316	;;	7478	;;
7317	esac	7479	esac
7318	echo "$as_me:$LINENO: checking for $ac_header" >&5	7480	echo "$as_me:$LINENO: checking for $ac_header" >&5
Lines 7701-7707 Link Here
7701		7863
7702		7864
7703		7865
7704	for ac_func in daemon chroot getpwnam setuid nice system getpid dup dup2 getpass strerror syslog openlog mlockall getgrnam setgid setgroups stat flock readv writev setsockopt getsockopt setsid chdir gettimeofday putenv getpeername unlink poll chsize ftruncate	7866
		7867
		7868	for ac_func in daemon chroot getpwnam setuid nice system getpid dup dup2 getpass strerror syslog openlog mlockall getgrnam setgid setgroups stat flock readv writev setsockopt getsockopt setsid chdir gettimeofday putenv getpeername unlink poll chsize ftruncate sendmsg recvmsg
7705	do	7869	do
7706	as_ac_var=`echo "ac_cv_func_$ac_func" \| $as_tr_sh`	7870	as_ac_var=`echo "ac_cv_func_$ac_func" \| $as_tr_sh`
7707	echo "$as_me:$LINENO: checking for $ac_func" >&5	7871	echo "$as_me:$LINENO: checking for $ac_func" >&5
Lines 8281-8286 Link Here
8281	ac_header_preproc=yes	8445	ac_header_preproc=yes
8282	;;	8446	;;
8283	no:yes:* )	8447	no:yes:* )
		8448	{ echo "$as_me:$LINENO: WARNING: valgrind/memcheck.h: present but cannot be compiled" >&5
		8449	echo "$as_me: WARNING: valgrind/memcheck.h: present but cannot be compiled" >&2;}
		8450	{ echo "$as_me:$LINENO: WARNING: valgrind/memcheck.h: check for missing prerequisite headers?" >&5
		8451	echo "$as_me: WARNING: valgrind/memcheck.h: check for missing prerequisite headers?" >&2;}
		8452	{ echo "$as_me:$LINENO: WARNING: valgrind/memcheck.h: see the Autoconf documentation" >&5
		8453	echo "$as_me: WARNING: valgrind/memcheck.h: see the Autoconf documentation" >&2;}
		8454	{ echo "$as_me:$LINENO: WARNING: valgrind/memcheck.h: section \"Present But Cannot Be Compiled\"" >&5
		8455	echo "$as_me: WARNING: valgrind/memcheck.h: section \"Present But Cannot Be Compiled\"" >&2;}
		8456	{ echo "$as_me:$LINENO: WARNING: valgrind/memcheck.h: proceeding with the preprocessor's result" >&5
		8457	echo "$as_me: WARNING: valgrind/memcheck.h: proceeding with the preprocessor's result" >&2;}
		8458	{ echo "$as_me:$LINENO: WARNING: valgrind/memcheck.h: in the future, the compiler will take precedence" >&5
		8459	echo "$as_me: WARNING: valgrind/memcheck.h: in the future, the compiler will take precedence" >&2;}
		8460	(
		8461	cat <<\_ASBOX
		8462	## -------------------------------------------------- ##
		8463	## Report this to openvpn-users@lists.sourceforge.net ##
		8464	## -------------------------------------------------- ##
		8465	_ASBOX
		8466	) \|
		8467	sed "s/^/$as_me: WARNING: /" >&2
8284	;;	8468	;;
8285	esac	8469	esac
8286	echo "$as_me:$LINENO: checking for valgrind/memcheck.h" >&5	8470	echo "$as_me:$LINENO: checking for valgrind/memcheck.h" >&5
Lines 8863-8868 Link Here
8863	ac_header_preproc=yes	9047	ac_header_preproc=yes
8864	;;	9048	;;
8865	no:yes:* )	9049	no:yes:* )
		9050	{ echo "$as_me:$LINENO: WARNING: dmalloc.h: present but cannot be compiled" >&5
		9051	echo "$as_me: WARNING: dmalloc.h: present but cannot be compiled" >&2;}
		9052	{ echo "$as_me:$LINENO: WARNING: dmalloc.h: check for missing prerequisite headers?" >&5
		9053	echo "$as_me: WARNING: dmalloc.h: check for missing prerequisite headers?" >&2;}
		9054	{ echo "$as_me:$LINENO: WARNING: dmalloc.h: see the Autoconf documentation" >&5
		9055	echo "$as_me: WARNING: dmalloc.h: see the Autoconf documentation" >&2;}
		9056	{ echo "$as_me:$LINENO: WARNING: dmalloc.h: section \"Present But Cannot Be Compiled\"" >&5
		9057	echo "$as_me: WARNING: dmalloc.h: section \"Present But Cannot Be Compiled\"" >&2;}
		9058	{ echo "$as_me:$LINENO: WARNING: dmalloc.h: proceeding with the preprocessor's result" >&5
		9059	echo "$as_me: WARNING: dmalloc.h: proceeding with the preprocessor's result" >&2;}
		9060	{ echo "$as_me:$LINENO: WARNING: dmalloc.h: in the future, the compiler will take precedence" >&5
		9061	echo "$as_me: WARNING: dmalloc.h: in the future, the compiler will take precedence" >&2;}
		9062	(
		9063	cat <<\_ASBOX
		9064	## -------------------------------------------------- ##
		9065	## Report this to openvpn-users@lists.sourceforge.net ##
		9066	## -------------------------------------------------- ##
		9067	_ASBOX
		9068	) \|
		9069	sed "s/^/$as_me: WARNING: /" >&2
8866	;;	9070	;;
8867	esac	9071	esac
8868	echo "$as_me:$LINENO: checking for dmalloc.h" >&5	9072	echo "$as_me:$LINENO: checking for dmalloc.h" >&5
Lines 9082-9087 Link Here
9082	ac_header_preproc=yes	9286	ac_header_preproc=yes
9083	;;	9287	;;
9084	no:yes:* )	9288	no:yes:* )
		9289	{ echo "$as_me:$LINENO: WARNING: dlfcn.h: present but cannot be compiled" >&5
		9290	echo "$as_me: WARNING: dlfcn.h: present but cannot be compiled" >&2;}
		9291	{ echo "$as_me:$LINENO: WARNING: dlfcn.h: check for missing prerequisite headers?" >&5
		9292	echo "$as_me: WARNING: dlfcn.h: check for missing prerequisite headers?" >&2;}
		9293	{ echo "$as_me:$LINENO: WARNING: dlfcn.h: see the Autoconf documentation" >&5
		9294	echo "$as_me: WARNING: dlfcn.h: see the Autoconf documentation" >&2;}
		9295	{ echo "$as_me:$LINENO: WARNING: dlfcn.h: section \"Present But Cannot Be Compiled\"" >&5
		9296	echo "$as_me: WARNING: dlfcn.h: section \"Present But Cannot Be Compiled\"" >&2;}
		9297	{ echo "$as_me:$LINENO: WARNING: dlfcn.h: proceeding with the preprocessor's result" >&5
		9298	echo "$as_me: WARNING: dlfcn.h: proceeding with the preprocessor's result" >&2;}
		9299	{ echo "$as_me:$LINENO: WARNING: dlfcn.h: in the future, the compiler will take precedence" >&5
		9300	echo "$as_me: WARNING: dlfcn.h: in the future, the compiler will take precedence" >&2;}
		9301	(
		9302	cat <<\_ASBOX
		9303	## -------------------------------------------------- ##
		9304	## Report this to openvpn-users@lists.sourceforge.net ##
		9305	## -------------------------------------------------- ##
		9306	_ASBOX
		9307	) \|
		9308	sed "s/^/$as_me: WARNING: /" >&2
9085	;;	9309	;;
9086	esac	9310	esac
9087	echo "$as_me:$LINENO: checking for dlfcn.h" >&5	9311	echo "$as_me:$LINENO: checking for dlfcn.h" >&5
Lines 9393-9398 Link Here
9393	ac_header_preproc=yes	9617	ac_header_preproc=yes
9394	;;	9618	;;
9395	no:yes:* )	9619	no:yes:* )
		9620	{ echo "$as_me:$LINENO: WARNING: lzo1x.h: present but cannot be compiled" >&5
		9621	echo "$as_me: WARNING: lzo1x.h: present but cannot be compiled" >&2;}
		9622	{ echo "$as_me:$LINENO: WARNING: lzo1x.h: check for missing prerequisite headers?" >&5
		9623	echo "$as_me: WARNING: lzo1x.h: check for missing prerequisite headers?" >&2;}
		9624	{ echo "$as_me:$LINENO: WARNING: lzo1x.h: see the Autoconf documentation" >&5
		9625	echo "$as_me: WARNING: lzo1x.h: see the Autoconf documentation" >&2;}
		9626	{ echo "$as_me:$LINENO: WARNING: lzo1x.h: section \"Present But Cannot Be Compiled\"" >&5
		9627	echo "$as_me: WARNING: lzo1x.h: section \"Present But Cannot Be Compiled\"" >&2;}
		9628	{ echo "$as_me:$LINENO: WARNING: lzo1x.h: proceeding with the preprocessor's result" >&5
		9629	echo "$as_me: WARNING: lzo1x.h: proceeding with the preprocessor's result" >&2;}
		9630	{ echo "$as_me:$LINENO: WARNING: lzo1x.h: in the future, the compiler will take precedence" >&5
		9631	echo "$as_me: WARNING: lzo1x.h: in the future, the compiler will take precedence" >&2;}
		9632	(
		9633	cat <<\_ASBOX
		9634	## -------------------------------------------------- ##
		9635	## Report this to openvpn-users@lists.sourceforge.net ##
		9636	## -------------------------------------------------- ##
		9637	_ASBOX
		9638	) \|
		9639	sed "s/^/$as_me: WARNING: /" >&2
9396	;;	9640	;;
9397	esac	9641	esac
9398	echo "$as_me:$LINENO: checking for lzo1x.h" >&5	9642	echo "$as_me:$LINENO: checking for lzo1x.h" >&5
Lines 9613-9618 Link Here
9613	ac_header_preproc=yes	9857	ac_header_preproc=yes
9614	;;	9858	;;
9615	no:yes:* )	9859	no:yes:* )
		9860	{ echo "$as_me:$LINENO: WARNING: openssl/evp.h: present but cannot be compiled" >&5
		9861	echo "$as_me: WARNING: openssl/evp.h: present but cannot be compiled" >&2;}
		9862	{ echo "$as_me:$LINENO: WARNING: openssl/evp.h: check for missing prerequisite headers?" >&5
		9863	echo "$as_me: WARNING: openssl/evp.h: check for missing prerequisite headers?" >&2;}
		9864	{ echo "$as_me:$LINENO: WARNING: openssl/evp.h: see the Autoconf documentation" >&5
		9865	echo "$as_me: WARNING: openssl/evp.h: see the Autoconf documentation" >&2;}
		9866	{ echo "$as_me:$LINENO: WARNING: openssl/evp.h: section \"Present But Cannot Be Compiled\"" >&5
		9867	echo "$as_me: WARNING: openssl/evp.h: section \"Present But Cannot Be Compiled\"" >&2;}
		9868	{ echo "$as_me:$LINENO: WARNING: openssl/evp.h: proceeding with the preprocessor's result" >&5
		9869	echo "$as_me: WARNING: openssl/evp.h: proceeding with the preprocessor's result" >&2;}
		9870	{ echo "$as_me:$LINENO: WARNING: openssl/evp.h: in the future, the compiler will take precedence" >&5
		9871	echo "$as_me: WARNING: openssl/evp.h: in the future, the compiler will take precedence" >&2;}
		9872	(
		9873	cat <<\_ASBOX
		9874	## -------------------------------------------------- ##
		9875	## Report this to openvpn-users@lists.sourceforge.net ##
		9876	## -------------------------------------------------- ##
		9877	_ASBOX
		9878	) \|
		9879	sed "s/^/$as_me: WARNING: /" >&2
9616	;;	9880	;;
9617	esac	9881	esac
9618	echo "$as_me:$LINENO: checking for openssl/evp.h" >&5	9882	echo "$as_me:$LINENO: checking for openssl/evp.h" >&5
Lines 9930-9935 Link Here
9930	ac_header_preproc=yes	10194	ac_header_preproc=yes
9931	;;	10195	;;
9932	no:yes:* )	10196	no:yes:* )
		10197	{ echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
		10198	echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
		10199	{ echo "$as_me:$LINENO: WARNING: $ac_header: check for missing prerequisite headers?" >&5
		10200	echo "$as_me: WARNING: $ac_header: check for missing prerequisite headers?" >&2;}
		10201	{ echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
		10202	echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
		10203	{ echo "$as_me:$LINENO: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&5
		10204	echo "$as_me: WARNING: $ac_header: section \"Present But Cannot Be Compiled\"" >&2;}
		10205	{ echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
		10206	echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
		10207	{ echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
		10208	echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
		10209	(
		10210	cat <<\_ASBOX
		10211	## -------------------------------------------------- ##
		10212	## Report this to openvpn-users@lists.sourceforge.net ##
		10213	## -------------------------------------------------- ##
		10214	_ASBOX
		10215	) \|
		10216	sed "s/^/$as_me: WARNING: /" >&2
9933	;;	10217	;;
9934	esac	10218	esac
9935	echo "$as_me:$LINENO: checking for $ac_header" >&5	10219	echo "$as_me:$LINENO: checking for $ac_header" >&5
Lines 10392-10397 Link Here
10392	ac_header_preproc=yes	10676	ac_header_preproc=yes
10393	;;	10677	;;
10394	no:yes:* )	10678	no:yes:* )
		10679	{ echo "$as_me:$LINENO: WARNING: openssl/ssl.h: present but cannot be compiled" >&5
		10680	echo "$as_me: WARNING: openssl/ssl.h: present but cannot be compiled" >&2;}
		10681	{ echo "$as_me:$LINENO: WARNING: openssl/ssl.h: check for missing prerequisite headers?" >&5
		10682	echo "$as_me: WARNING: openssl/ssl.h: check for missing prerequisite headers?" >&2;}
		10683	{ echo "$as_me:$LINENO: WARNING: openssl/ssl.h: see the Autoconf documentation" >&5
		10684	echo "$as_me: WARNING: openssl/ssl.h: see the Autoconf documentation" >&2;}
		10685	{ echo "$as_me:$LINENO: WARNING: openssl/ssl.h: section \"Present But Cannot Be Compiled\"" >&5
		10686	echo "$as_me: WARNING: openssl/ssl.h: section \"Present But Cannot Be Compiled\"" >&2;}
		10687	{ echo "$as_me:$LINENO: WARNING: openssl/ssl.h: proceeding with the preprocessor's result" >&5
		10688	echo "$as_me: WARNING: openssl/ssl.h: proceeding with the preprocessor's result" >&2;}
		10689	{ echo "$as_me:$LINENO: WARNING: openssl/ssl.h: in the future, the compiler will take precedence" >&5
		10690	echo "$as_me: WARNING: openssl/ssl.h: in the future, the compiler will take precedence" >&2;}
		10691	(
		10692	cat <<\_ASBOX
		10693	## -------------------------------------------------- ##
		10694	## Report this to openvpn-users@lists.sourceforge.net ##
		10695	## -------------------------------------------------- ##
		10696	_ASBOX
		10697	) \|
		10698	sed "s/^/$as_me: WARNING: /" >&2
10395	;;	10699	;;
10396	esac	10700	esac
10397	echo "$as_me:$LINENO: checking for openssl/ssl.h" >&5	10701	echo "$as_me:$LINENO: checking for openssl/ssl.h" >&5
Lines 10584-10589 Link Here
10584	fi	10888	fi
10585	fi	10889	fi
10586		10890
		10891	if test "$PF_UNIX" = "yes"; then
		10892	{ echo "$as_me:$LINENO: checking for sys/un.h header file for PF_UNIX..." >&5
		10893	echo "$as_me: checking for sys/un.h header file for PF_UNIX..." >&6;}
		10894	if test "${ac_cv_header_sys_un_h+set}" = set; then
		10895	echo "$as_me:$LINENO: checking for sys/un.h" >&5
		10896	echo $ECHO_N "checking for sys/un.h... $ECHO_C" >&6
		10897	if test "${ac_cv_header_sys_un_h+set}" = set; then
		10898	echo $ECHO_N "(cached) $ECHO_C" >&6
		10899	fi
		10900	echo "$as_me:$LINENO: result: $ac_cv_header_sys_un_h" >&5
		10901	echo "${ECHO_T}$ac_cv_header_sys_un_h" >&6
		10902	else
		10903	# Is the header compilable?
		10904	echo "$as_me:$LINENO: checking sys/un.h usability" >&5
		10905	echo $ECHO_N "checking sys/un.h usability... $ECHO_C" >&6
		10906	cat >conftest.$ac_ext <<_ACEOF
		10907	/* confdefs.h. */
		10908	_ACEOF
		10909	cat confdefs.h >>conftest.$ac_ext
		10910	cat >>conftest.$ac_ext <<_ACEOF
		10911	/* end confdefs.h. */
		10912	$ac_includes_default
		10913	#include <sys/un.h>
		10914	_ACEOF
		10915	rm -f conftest.$ac_objext
		10916	if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
		10917	(eval $ac_compile) 2>conftest.er1
		10918	ac_status=$?
		10919	grep -v '^ *+' conftest.er1 >conftest.err
		10920	rm -f conftest.er1
		10921	cat conftest.err >&5
		10922	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		10923	(exit $ac_status); } &&
		10924	{ ac_try='test -z "$ac_c_werror_flag"
		10925	\|\| test ! -s conftest.err'
		10926	{ (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
		10927	(eval $ac_try) 2>&5
		10928	ac_status=$?
		10929	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		10930	(exit $ac_status); }; } &&
		10931	{ ac_try='test -s conftest.$ac_objext'
		10932	{ (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
		10933	(eval $ac_try) 2>&5
		10934	ac_status=$?
		10935	echo "$as_me:$LINENO: \$? = $ac_status" >&5
		10936	(exit $ac_status); }; }; then
		10937	ac_header_compiler=yes
		10938	else
		10939	echo "$as_me: failed program was:" >&5
		10940	sed 's/^/\| /' conftest.$ac_ext >&5
		10941
		10942	ac_header_compiler=no
		10943	fi
		10944	rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
		10945	echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
		10946	echo "${ECHO_T}$ac_header_compiler" >&6
		10947
		10948	# Is the header present?
		10949	echo "$as_me:$LINENO: checking sys/un.h presence" >&5
		10950	echo $ECHO_N "checking sys/un.h presence... $ECHO_C" >&6
		10951	cat >conftest.$ac_ext <<_ACEOF
		10952	/* confdefs.h. */
		10953	_ACEOF
		10954	cat confdefs.h >>conftest.$ac_ext
10955	cat >>conftest.$ac_ext <<_ACEOF
10956	/* end confdefs.h. */
10957	#include <sys/un.h>
10958	_ACEOF
10959	if { (eval echo "$as_me:$LINENO: \"$ac_cpp conftest.$ac_ext\"") >&5
10960	(eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
10961	ac_status=$?
10962	grep -v '^ *+' conftest.er1 >conftest.err
10963	rm -f conftest.er1
10964	cat conftest.err >&5
10965	echo "$as_me:$LINENO: \$? = $ac_status" >&5
10966	(exit $ac_status); } >/dev/null; then
10967	if test -s conftest.err; then
10968	ac_cpp_err=$ac_c_preproc_warn_flag
10969	ac_cpp_err=$ac_cpp_err$ac_c_werror_flag
10970	else
10971	ac_cpp_err=
10972	fi
10973	else
10974	ac_cpp_err=yes
10975	fi
10976	if test -z "$ac_cpp_err"; then
10977	ac_header_preproc=yes
10978	else
10979	echo "$as_me: failed program was:" >&5
10980	sed 's/^/\| /' conftest.$ac_ext >&5
10981
10982	ac_header_preproc=no
10983	fi
10984	rm -f conftest.err conftest.$ac_ext
10985	echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
10986	echo "${ECHO_T}$ac_header_preproc" >&6
10987
10988	# So? What about this header?
10989	case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
10990	yes:no: )
10991	{ echo "$as_me:$LINENO: WARNING: sys/un.h: accepted by the compiler, rejected by the preprocessor!" >&5
10992	echo "$as_me: WARNING: sys/un.h: accepted by the compiler, rejected by the preprocessor!" >&2;}
10993	{ echo "$as_me:$LINENO: WARNING: sys/un.h: proceeding with the compiler's result" >&5
10994	echo "$as_me: WARNING: sys/un.h: proceeding with the compiler's result" >&2;}
10995	ac_header_preproc=yes
10996	;;
10997	no:yes:* )
10998	{ echo "$as_me:$LINENO: WARNING: sys/un.h: present but cannot be compiled" >&5
10999	echo "$as_me: WARNING: sys/un.h: present but cannot be compiled" >&2;}
11000	{ echo "$as_me:$LINENO: WARNING: sys/un.h: check for missing prerequisite headers?" >&5
11001	echo "$as_me: WARNING: sys/un.h: check for missing prerequisite headers?" >&2;}
11002	{ echo "$as_me:$LINENO: WARNING: sys/un.h: see the Autoconf documentation" >&5
11003	echo "$as_me: WARNING: sys/un.h: see the Autoconf documentation" >&2;}
11004	{ echo "$as_me:$LINENO: WARNING: sys/un.h: section \"Present But Cannot Be Compiled\"" >&5
11005	echo "$as_me: WARNING: sys/un.h: section \"Present But Cannot Be Compiled\"" >&2;}
11006	{ echo "$as_me:$LINENO: WARNING: sys/un.h: proceeding with the preprocessor's result" >&5
11007	echo "$as_me: WARNING: sys/un.h: proceeding with the preprocessor's result" >&2;}
11008	{ echo "$as_me:$LINENO: WARNING: sys/un.h: in the future, the compiler will take precedence" >&5
11009	echo "$as_me: WARNING: sys/un.h: in the future, the compiler will take precedence" >&2;}
11010	(
11011	cat <<\_ASBOX
11012	## -------------------------------------------------- ##
11013	## Report this to openvpn-users@lists.sourceforge.net ##
11014	## -------------------------------------------------- ##
11015	_ASBOX
11016	) \|
11017	sed "s/^/$as_me: WARNING: /" >&2
11018	;;
11019	esac
11020	echo "$as_me:$LINENO: checking for sys/un.h" >&5
11021	echo $ECHO_N "checking for sys/un.h... $ECHO_C" >&6
11022	if test "${ac_cv_header_sys_un_h+set}" = set; then
11023	echo $ECHO_N "(cached) $ECHO_C" >&6
11024	else
11025	ac_cv_header_sys_un_h=$ac_header_preproc
11026	fi
11027	echo "$as_me:$LINENO: result: $ac_cv_header_sys_un_h" >&5
11028	echo "${ECHO_T}$ac_cv_header_sys_un_h" >&6
11029
11030	fi
11031	if test $ac_cv_header_sys_un_h = yes; then
11032
11033	cat >>confdefs.h <<\_ACEOF
11034	#define USE_PF_UNIX 1
11035	_ACEOF
11036
11037	else
11038	{ { echo "$as_me:$LINENO: error: sys/un.h header not found." >&5
11039	echo "$as_me: error: sys/un.h header not found." >&2;}
11040	{ (exit 1); exit 1; }; }
11041
11042	fi
11043
11044
11045	fi
11046
11047	if test "$PF_INET6" = "yes"; then
11048	{ echo "$as_me:$LINENO: checking for struct sockaddr_in6 for IPv6 support..." >&5
11049	echo "$as_me: checking for struct sockaddr_in6 for IPv6 support..." >&6;}
11050	echo "$as_me:$LINENO: checking for struct sockaddr_in6" >&5
11051	echo $ECHO_N "checking for struct sockaddr_in6... $ECHO_C" >&6
11052	if test "${ac_cv_type_struct_sockaddr_in6+set}" = set; then
11053	echo $ECHO_N "(cached) $ECHO_C" >&6
11054	else
11055	cat >conftest.$ac_ext <<_ACEOF
11056	/* confdefs.h. */
11057	_ACEOF
11058	cat confdefs.h >>conftest.$ac_ext
11059	cat >>conftest.$ac_ext <<_ACEOF
11060	/* end confdefs.h. */
11061	#include "syshead.h"
11062
11063	int
11064	main ()
11065	{
11066	if ((struct sockaddr_in6 *) 0)
11067	return 0;
11068	if (sizeof (struct sockaddr_in6))
11069	return 0;
11070	;
11071	return 0;
11072	}
11073	_ACEOF
11074	rm -f conftest.$ac_objext
11075	if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
11076	(eval $ac_compile) 2>conftest.er1
11077	ac_status=$?
11078	grep -v '^ *+' conftest.er1 >conftest.err
11079	rm -f conftest.er1
11080	cat conftest.err >&5
11081	echo "$as_me:$LINENO: \$? = $ac_status" >&5
11082	(exit $ac_status); } &&
11083	{ ac_try='test -z "$ac_c_werror_flag"
11084	\|\| test ! -s conftest.err'
11085	{ (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
11086	(eval $ac_try) 2>&5
11087	ac_status=$?
11088	echo "$as_me:$LINENO: \$? = $ac_status" >&5
11089	(exit $ac_status); }; } &&
11090	{ ac_try='test -s conftest.$ac_objext'
11091	{ (eval echo "$as_me:$LINENO: \"$ac_try\"") >&5
11092	(eval $ac_try) 2>&5
11093	ac_status=$?
11094	echo "$as_me:$LINENO: \$? = $ac_status" >&5
11095	(exit $ac_status); }; }; then
11096	ac_cv_type_struct_sockaddr_in6=yes
11097	else
11098	echo "$as_me: failed program was:" >&5
11099	sed 's/^/\| /' conftest.$ac_ext >&5
11100
11101	ac_cv_type_struct_sockaddr_in6=no
11102	fi
11103	rm -f conftest.err conftest.$ac_objext conftest.$ac_ext
11104	fi
11105	echo "$as_me:$LINENO: result: $ac_cv_type_struct_sockaddr_in6" >&5
11106	echo "${ECHO_T}$ac_cv_type_struct_sockaddr_in6" >&6
11107	if test $ac_cv_type_struct_sockaddr_in6 = yes; then
11108
11109	cat >>confdefs.h <<\_ACEOF
11110	#define USE_PF_INET6 1
11111	_ACEOF
11112
11113	fi
11114
11115	fi
11116
11117	if test "$PAYLOAD_CONNTRACK" = "yes"; then
11118
11119	cat >>confdefs.h <<\_ACEOF
11120	#define USE_PAYLOAD_CONNTRACK 1
11121	_ACEOF
11122
11123	fi
11124
10587	if test "$MULTI" = "yes"; then	11125	if test "$MULTI" = "yes"; then
10588		11126
10589	cat >>confdefs.h <<\_ACEOF	11127	cat >>confdefs.h <<\_ACEOF
Lines 10624-10629 Link Here
10624		11162
10625	fi	11163	fi
10626		11164
		11165	if test "$MULTIHOME" = "yes"; then
		11166
		11167	cat >>confdefs.h <<\_ACEOF
		11168	#define ENABLE_MULTIHOME 1
		11169	_ACEOF
		11170
		11171	fi
		11172
10627	if test "$DEBUG" = "yes"; then	11173	if test "$DEBUG" = "yes"; then
10628		11174
10629	cat >>confdefs.h <<\_ACEOF	11175	cat >>confdefs.h <<\_ACEOF
Lines 11339-11345 Link Here
11339	s,@AUTOMAKE@,$AUTOMAKE,;t t	11885	s,@AUTOMAKE@,$AUTOMAKE,;t t
11340	s,@AUTOHEADER@,$AUTOHEADER,;t t	11886	s,@AUTOHEADER@,$AUTOHEADER,;t t
11341	s,@MAKEINFO@,$MAKEINFO,;t t	11887	s,@MAKEINFO@,$MAKEINFO,;t t
11342	s,@AMTAR@,$AMTAR,;t t
11343	s,@install_sh@,$install_sh,;t t	11888	s,@install_sh@,$install_sh,;t t
11344	s,@STRIP@,$STRIP,;t t	11889	s,@STRIP@,$STRIP,;t t
11345	s,@ac_ct_STRIP@,$ac_ct_STRIP,;t t	11890	s,@ac_ct_STRIP@,$ac_ct_STRIP,;t t
Lines 11348-11353 Link Here
11348	s,@AWK@,$AWK,;t t	11893	s,@AWK@,$AWK,;t t
11349	s,@SET_MAKE@,$SET_MAKE,;t t	11894	s,@SET_MAKE@,$SET_MAKE,;t t
11350	s,@am__leading_dot@,$am__leading_dot,;t t	11895	s,@am__leading_dot@,$am__leading_dot,;t t
		11896	s,@AMTAR@,$AMTAR,;t t
		11897	s,@am__tar@,$am__tar,;t t
		11898	s,@am__untar@,$am__untar,;t t
11351	s,@CC@,$CC,;t t	11899	s,@CC@,$CC,;t t
11352	s,@CFLAGS@,$CFLAGS,;t t	11900	s,@CFLAGS@,$CFLAGS,;t t
11353	s,@LDFLAGS@,$LDFLAGS,;t t	11901	s,@LDFLAGS@,$LDFLAGS,;t t
Lines 11993-12019 Link Here
11993	else	12541	else
11994	continue	12542	continue
11995	fi	12543	fi
11996	grep '^DEP_FILES = [^ #]' < "$mf" > /dev/null \|\| continue	12544	# Extract the definition of DEPDIR, am__include, and am__quote
11997	# Extract the definition of DEP_FILES from the Makefile without	12545	# from the Makefile without running `make'.
11998	# running `make'.
11999	DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`	12546	DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
12000	test -z "$DEPDIR" && continue	12547	test -z "$DEPDIR" && continue
		12548	am__include=`sed -n 's/^am__include = //p' < "$mf"`
		12549	test -z "am__include" && continue
		12550	am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
12001	# When using ansi2knr, U may be empty or an underscore; expand it	12551	# When using ansi2knr, U may be empty or an underscore; expand it
12002	U=`sed -n 's/^U = //p' < "$mf"`	12552	U=`sed -n 's/^U = //p' < "$mf"`
12003	test -d "$dirpart/$DEPDIR" \|\| mkdir "$dirpart/$DEPDIR"	12553	# Find all dependency output files, they are included files with
12004	# We invoke sed twice because it is the simplest approach to	12554	# $(DEPDIR) in their names. We invoke sed twice because it is the
12005	# changing $(DEPDIR) to its actual value in the expansion.	12555	# simplest approach to changing $(DEPDIR) to its actual value in the
12006	for file in `sed -n '	12556	# expansion.
12007	/^DEP_FILES = .*\\\\$/ {	12557	for file in `sed -n "
12008	s/^DEP_FILES = //	12558	s/^$am__include $am__quote$.(DEPDIR).$$am__quote"'$/\1/p' <"$mf" \| \
12009	:loop
12010	s/\\\\$//
12011	p
12012	n
12013	/\\\\$/ b loop
12014	p
12015	}
12016	/^DEP_FILES = / s/^DEP_FILES = //p' < "$mf" \| \
12017	sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g' -e 's/\$U/'"$U"'/g'`; do	12559	sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g' -e 's/\$U/'"$U"'/g'`; do
12018	# Make sure the directory exists.	12560	# Make sure the directory exists.
12019	test -f "$dirpart/$file" && continue	12561	test -f "$dirpart/$file" && continue

Lines 89-94 Link Here

(-)configure.ac:1.4 (-1 / +57 lines)
89	[FRAGMENT="yes"]	89	[FRAGMENT="yes"]
90	)	90	)
91		91
		92	AC_ARG_ENABLE(multihome,
		93	[ --disable-multihome Disable multi-homed UDP server support (--multihome)],
		94	[MULTIHOME="$enableval"],
		95	[MULTIHOME="yes"]
		96	)
		97
92	AC_ARG_ENABLE(debug,	98	AC_ARG_ENABLE(debug,
93	[ --disable-debug Disable debugging support (disable gremlin and verb 7+ messages)],	99	[ --disable-debug Disable debugging support (disable gremlin and verb 7+ messages)],
94	[DEBUG="$enableval"],	100	[DEBUG="$enableval"],
Lines 136-141 Link Here
136	[STRICT_OPTIONS="no"]	142	[STRICT_OPTIONS="no"]
137	)	143	)
138		144
		145	AC_ARG_ENABLE(ipv6,
		146	[ --disable-ipv6 Disable UDP/IPv6 support],
		147	[PF_INET6="$enableval"],
		148	[PF_INET6="yes"]
		149	)
		150
		151	AC_ARG_ENABLE(unix-sockets,
		152	[ --enable-unix-sockets Enable PF_UNIX sockets links],
		153	[PF_UNIX="$enableval"],
		154	[PF_UNIX="no"]
		155	)
		156
		157	AC_ARG_ENABLE(payload-conntrack,
		158	[ --enable-payload-conntrack Enable payload conntrack for eg. TCP retrans. dd for reliable links],
		159	[PAYLOAD_CONNTRACK="$enableval"],
		160	[PAYLOAD_CONNTRACK="no"]
		161	)
		162
139	AC_ARG_WITH(ssl-headers,	163	AC_ARG_WITH(ssl-headers,
140	[ --with-ssl-headers=DIR Crypto/SSL Include files location],	164	[ --with-ssl-headers=DIR Crypto/SSL Include files location],
141	[CS_HDR_DIR="$withval"]	165	[CS_HDR_DIR="$withval"]
Lines 326-331 Link Here
326	[AC_DEFINE(HAVE_CMSGHDR, 1, [struct cmsghdr needed for extended socket error support])],	350	[AC_DEFINE(HAVE_CMSGHDR, 1, [struct cmsghdr needed for extended socket error support])],
327	[],	351	[],
328	[#include "syshead.h"])	352	[#include "syshead.h"])
		353	AC_CHECK_TYPE(
		354	[struct in_pktinfo],
		355	[AC_DEFINE(HAVE_IN_PKTINFO, 1, [struct in_pktinfo needed for IP_PKTINFO support])],
		356	[],
		357	[#include "syshead.h"])
329		358
330	AC_CHECK_SIZEOF(unsigned int)	359	AC_CHECK_SIZEOF(unsigned int)
331	AC_CHECK_SIZEOF(unsigned long)	360	AC_CHECK_SIZEOF(unsigned long)
Lines 351-357 Link Here
351	getpass strerror syslog openlog mlockall getgrnam setgid dnl	380	getpass strerror syslog openlog mlockall getgrnam setgid dnl
352	setgroups stat flock readv writev setsockopt getsockopt dnl	381	setgroups stat flock readv writev setsockopt getsockopt dnl
353	setsid chdir gettimeofday putenv getpeername unlink dnl	382	setsid chdir gettimeofday putenv getpeername unlink dnl
354	poll chsize ftruncate)	383	poll chsize ftruncate sendmsg recvmsg)
355	AC_CACHE_SAVE	384	AC_CACHE_SAVE
356		385
357	dnl Required library functions	386	dnl Required library functions
Lines 543-548 Link Here
543	fi	572	fi
544	fi	573	fi
545		574
		575	if test "$PF_UNIX" = "yes"; then
		576	AC_CHECKING([for sys/un.h header file for PF_UNIX])
		577	AC_CHECK_HEADER(sys/un.h,
		578	[AC_DEFINE(USE_PF_UNIX, 1, [Compile support for PF_UNIX sockets])],
		579	[AC_MSG_ERROR([sys/un.h header not found.])]
		580	)
		581	fi
		582
		583	if test "$PF_INET6" = "yes"; then
		584	AC_CHECKING([for struct sockaddr_in6 for IPv6 support])
		585	AC_CHECK_TYPE(
		586	[struct sockaddr_in6],
		587	[AC_DEFINE(USE_PF_INET6, 1, [struct sockaddr_in6 is needed for IPv6 peer support])],
		588	[],
		589	[#include "syshead.h"])
		590	fi
		591
		592	dnl enable payload-conntrack optimizations
		593	if test "$PAYLOAD_CONNTRACK" = "yes"; then
		594	AC_DEFINE(USE_PAYLOAD_CONNTRACK, 1, [Enable payload conntrack])
		595	fi
		596
546	dnl enable multi-client mode	597	dnl enable multi-client mode
547	if test "$MULTI" = "yes"; then	598	if test "$MULTI" = "yes"; then
548	AC_DEFINE(ENABLE_CLIENT_SERVER, 1, [Enable client/server capability])	599	AC_DEFINE(ENABLE_CLIENT_SERVER, 1, [Enable client/server capability])
Lines 568-573 Link Here
568	AC_DEFINE(ENABLE_HTTP_PROXY, 1, [Enable HTTP proxy support])	619	AC_DEFINE(ENABLE_HTTP_PROXY, 1, [Enable HTTP proxy support])
569	fi	620	fi
570		621
		622	dnl compile --multihome option
		623	if test "$MULTIHOME" = "yes"; then
		624	AC_DEFINE(ENABLE_MULTIHOME, 1, [Enable multi-homed UDP server capability])
		625	fi
		626
571	dnl enable debugging	627	dnl enable debugging
572	if test "$DEBUG" = "yes"; then	628	if test "$DEBUG" = "yes"; then
573	AC_DEFINE(ENABLE_DEBUG, 1, [Enable debugging support])	629	AC_DEFINE(ENABLE_DEBUG, 1, [Enable debugging support])

Lines 149-154 Link Here

(-)errlevel.h:1.4 (+4 lines)
149	#define D_STREAM_DEBUG LOGLEV(9, 70, M_DEBUG) /* show TCP stream debug info */	149	#define D_STREAM_DEBUG LOGLEV(9, 70, M_DEBUG) /* show TCP stream debug info */
150	#define D_WIN32_IO LOGLEV(9, 70, M_DEBUG) /* win32 I/O debugging info */	150	#define D_WIN32_IO LOGLEV(9, 70, M_DEBUG) /* win32 I/O debugging info */
151		151
		152	#ifdef USE_PAYLOAD_CONNTRACK
		153	#define D_PAYLOAD_CONNTRACK LOGLEV(9, 70, M_DEBUG) /* show payload conntrack debug info */
		154	#endif
		155
152	#define D_SHAPER_DEBUG LOGLEV(10, 70, M_DEBUG) /* show traffic shaper info */	156	#define D_SHAPER_DEBUG LOGLEV(10, 70, M_DEBUG) /* show traffic shaper info */
153		157
154	#define D_REGISTRY LOGLEV(11, 70, M_DEBUG) /* win32 registry debugging info */	158	#define D_REGISTRY LOGLEV(11, 70, M_DEBUG) /* win32 registry debugging info */

Lines 42-47 Link Here

(-)forward.c:1.4 (-8 / +24 lines)
42	#include "forward-inline.h"	42	#include "forward-inline.h"
43	#include "occ-inline.h"	43	#include "occ-inline.h"
44	#include "ping-inline.h"	44	#include "ping-inline.h"
		45	#include "payload-inline.h"
45		46
46	/* show event wait debugging info */	47	/* show event wait debugging info */
47		48
Lines 498-503 Link Here
498		499
499	/* Should we ping the remote? */	500	/* Should we ping the remote? */
500	check_ping_send (c);	501	check_ping_send (c);
		502
		503	#if USE_PAYLOAD_CONNTRACK
		504	check_payload_gc(c);
		505	#endif
501	}	506	}
502		507
503	static void	508	static void
Lines 557-573 Link Here
557	socks_postprocess_incoming_link (struct context *c)	562	socks_postprocess_incoming_link (struct context *c)
558	{	563	{
559	if (c->c2.link_socket->socks_proxy && c->c2.link_socket->info.proto == PROTO_UDPv4)	564	if (c->c2.link_socket->socks_proxy && c->c2.link_socket->info.proto == PROTO_UDPv4)
560	socks_process_incoming_udp (&c->c2.buf, &c->c2.from);	565	socks_process_incoming_udp (&c->c2.buf, &c->c2.from.addr.in);
561	}	566	}
562		567
563	static inline void	568	static inline void
564	socks_preprocess_outgoing_link (struct context *c,	569	socks_preprocess_outgoing_link (struct context *c,
565	struct sockaddr_in **to_addr,	570	struct openvpn_sockaddr **to_addr,
566	int *size_delta)	571	int *size_delta)
567	{	572	{
568	if (c->c2.link_socket->socks_proxy && c->c2.link_socket->info.proto == PROTO_UDPv4)	573	if (c->c2.link_socket->socks_proxy && c->c2.link_socket->info.proto == PROTO_UDPv4)
569	{	574	{
570	*size_delta += socks_process_outgoing_udp (&c->c2.to_link, &c->c2.to_link_addr);	575	*size_delta += socks_process_outgoing_udp (&c->c2.to_link, c->c2.to_link_addr);
571	*to_addr = &c->c2.link_socket->socks_relay;	576	*to_addr = &c->c2.link_socket->socks_relay;
572	}	577	}
573	}	578	}
Lines 879-890 Link Here
879	* us to examine the IPv4 header.	884	* us to examine the IPv4 header.
880	*/	885	*/
881	process_ipv4_header (c, PIPV4_PASSTOS\|PIPV4_MSSFIX, &c->c2.buf);	886	process_ipv4_header (c, PIPV4_PASSTOS\|PIPV4_MSSFIX, &c->c2.buf);
		887	#if USE_PAYLOAD_CONNTRACK
		888	if (c->c2.payload_context)
		889	{
		890	if (payload_tcp_retrans_drop(c, &c->c2.buf))
		891	{
		892	buf_reset (&c->c2.to_link);
		893	goto out;
		894	}
		895	}
		896	#endif
882	encrypt_sign (c, true);	897	encrypt_sign (c, true);
883	}	898	}
884	else	899	else
885	{	900	{
886	buf_reset (&c->c2.to_link);	901	buf_reset (&c->c2.to_link);
887	}	902	}
		903	out:
888	perf_pop ();	904	perf_pop ();
889	gc_free (&gc);	905	gc_free (&gc);
890	}	906	}
Lines 946-952 Link Here
946	* packet to remote over the TCP/UDP port.	962	* packet to remote over the TCP/UDP port.
947	*/	963	*/
948	int size = 0;	964	int size = 0;
949	ASSERT (addr_defined (&c->c2.to_link_addr));	965	ASSERT (link_addr_defined (c->c2.to_link_addr));
950		966
951	#ifdef ENABLE_DEBUG	967	#ifdef ENABLE_DEBUG
952	/* In gremlin-test mode, we may choose to drop this packet */	968	/* In gremlin-test mode, we may choose to drop this packet */
Lines 981-992 Link Here
981	msg (D_LINK_RW, "%s WRITE [%d] to %s: %s",	997	msg (D_LINK_RW, "%s WRITE [%d] to %s: %s",
982	proto2ascii (c->c2.link_socket->info.proto, true),	998	proto2ascii (c->c2.link_socket->info.proto, true),
983	BLEN (&c->c2.to_link),	999	BLEN (&c->c2.to_link),
984	print_sockaddr (&c->c2.to_link_addr, &gc),	1000	print_link_sockaddr (c->c2.to_link_addr, &gc),
985	PROTO_DUMP (&c->c2.to_link, &gc));	1001	PROTO_DUMP (&c->c2.to_link, &gc));
986		1002
987	/* Packet send complexified by possible Socks5 usage */	1003	/* Packet send complexified by possible Socks5 usage */
988	{	1004	{
989	struct sockaddr_in *to_addr = &c->c2.to_link_addr;	1005	struct openvpn_sockaddr *to_addr = c->c2.to_link_addr;
990	#ifdef ENABLE_SOCKS	1006	#ifdef ENABLE_SOCKS
991	int size_delta = 0;	1007	int size_delta = 0;
992	#endif	1008	#endif
Lines 1020-1026 Link Here
1020	if (size != BLEN (&c->c2.to_link))	1036	if (size != BLEN (&c->c2.to_link))
1021	msg (D_LINK_ERRORS,	1037	msg (D_LINK_ERRORS,
1022	"TCP/UDP packet was truncated/expanded on write to %s (tried=%d,actual=%d)",	1038	"TCP/UDP packet was truncated/expanded on write to %s (tried=%d,actual=%d)",
1023	print_sockaddr (&c->c2.to_link_addr, &gc),	1039	print_link_sockaddr (c->c2.to_link_addr, &gc),
1024	BLEN (&c->c2.to_link),	1040	BLEN (&c->c2.to_link),
1025	size);	1041	size);
1026	}	1042	}
Lines 1029-1035 Link Here
1029	{	1045	{
1030	if (c->c2.to_link.len > 0)	1046	if (c->c2.to_link.len > 0)
1031	msg (D_LINK_ERRORS, "TCP/UDP packet too large on write to %s (tried=%d,max=%d)",	1047	msg (D_LINK_ERRORS, "TCP/UDP packet too large on write to %s (tried=%d,max=%d)",
1032	print_sockaddr (&c->c2.to_link_addr, &gc),	1048	print_link_sockaddr (c->c2.to_link_addr, &gc),
1033	c->c2.to_link.len,	1049	c->c2.to_link.len,
1034	EXPANDED_SIZE (&c->c2.frame));	1050	EXPANDED_SIZE (&c->c2.frame));
1035	}	1051	}

Lines 674-680 Link Here

(-)init.c:1.4 (-16 / +59 lines)
674	addr_host (&c->c1.link_socket_addr.remote),	674	addr_host (&c->c1.link_socket_addr.remote),
675	!c->options.ifconfig_nowarn,	675	!c->options.ifconfig_nowarn,
676	c->c2.es);	676	c->c2.es);
677
678	init_tun_post (c->c1.tuntap,	677	init_tun_post (c->c1.tuntap,
679	&c->c2.frame,	678	&c->c2.frame,
680	&c->options.tuntap_options);	679	&c->options.tuntap_options);
Lines 1026-1040 Link Here
1026	switch (c->options.proto)	1025	switch (c->options.proto)
1027	{	1026	{
1028	case PROTO_UDPv4:	1027	case PROTO_UDPv4:
		1028	#ifdef USE_PF_INET6
		1029	case PROTO_UDPv6:
		1030	#endif
1029	if (proxy)	1031	if (proxy)
1030	sec = c->options.connect_retry_seconds;	1032	sec = c->options.connect_retry_seconds;
1031	break;	1033	break;
		1034	#ifdef USE_PF_INET6
		1035	case PROTO_TCPv6_SERVER:
		1036	#endif
1032	case PROTO_TCPv4_SERVER:	1037	case PROTO_TCPv4_SERVER:
1033	sec = 1;	1038	sec = 1;
1034	break;	1039	break;
		1040	#ifdef USE_PF_INET6
		1041	case PROTO_TCPv6_CLIENT:
		1042	#endif
1035	case PROTO_TCPv4_CLIENT:	1043	case PROTO_TCPv4_CLIENT:
1036	sec = c->options.connect_retry_seconds;	1044	sec = c->options.connect_retry_seconds;
1037	break;	1045	break;
		1046	#ifdef USE_PF_UNIX
		1047	case PROTO_UNIX_DGRAM:
		1048	sec = 2;
		1049	break;
		1050	#endif
1038	}	1051	}
1039		1052
1040	#ifdef ENABLE_DEBUG	1053	#ifdef ENABLE_DEBUG
Lines 1633-1638 Link Here
1633	}	1646	}
1634	}	1647	}
1635		1648
		1649	#ifdef USE_PAYLOAD_CONNTRACK
		1650	static void
		1651	do_init_payload(struct context *c)
		1652	{
		1653	if (c->options.tcp_retrans)
		1654	{
		1655	c->c2.payload_context = payload_new(c->options.tcp_retrans);
		1656	}
		1657	}
		1658
		1659	#endif
1636	/*	1660	/*
1637	* Allocate our socket object.	1661	* Allocate our socket object.
1638	*/	1662	*/
Lines 1650-1655 Link Here
1650	static void	1674	static void
1651	do_init_socket_1 (struct context *c, int mode)	1675	do_init_socket_1 (struct context *c, int mode)
1652	{	1676	{
		1677	unsigned int flags = 0;
		1678
		1679	#if ENABLE_IP_PKTINFO
		1680	if (c->options.multihome)
		1681	flags \|= SF_USE_IP_PKTINFO;
		1682	#endif
		1683
1653	link_socket_init_phase1 (c->c2.link_socket,	1684	link_socket_init_phase1 (c->c2.link_socket,
1654	c->options.local,	1685	c->options.local,
1655	c->c1.remote_list,	1686	c->c1.remote_list,
Lines 1676-1682 Link Here
1676	c->options.connect_retry_seconds,	1707	c->options.connect_retry_seconds,
1677	c->options.mtu_discover_type,	1708	c->options.mtu_discover_type,
1678	c->options.rcvbuf,	1709	c->options.rcvbuf,
1679	c->options.sndbuf);	1710	c->options.sndbuf,
		1711	flags);
1680	}	1712	}
1681		1713
1682	/*	1714	/*
Lines 1892-1897 Link Here
1892	}	1924	}
1893	#endif	1925	#endif
1894		1926
		1927	#ifdef USE_PAYLOAD_CONNTRACK
		1928	/*
		1929	* Close payload conn tracker
		1930	*/
		1931	static void
		1932	do_close_payload (struct context *c)
		1933	{
		1934	if (c->c2.payload_context)
		1935	{
		1936	payload_free (c->c2.payload_context);
		1937	c->c2.payload_context = NULL;
		1938	}
		1939	}
		1940	#endif
		1941
1895	/*	1942	/*
1896	* Open and close our event objects.	1943	* Open and close our event objects.
1897	*/	1944	*/
Lines 2015-2021 Link Here
2015	#ifdef WIN32	2062	#ifdef WIN32
2016	msg (M_INFO, "NOTE: --fast-io is disabled since we are running on Windows");	2063	msg (M_INFO, "NOTE: --fast-io is disabled since we are running on Windows");
2017	#else	2064	#else
2018	if (c->options.proto != PROTO_UDPv4)	2065	if (!proto_is_udp(c->options.proto))
2019	msg (M_INFO, "NOTE: --fast-io is disabled since we are not using UDP");	2066	msg (M_INFO, "NOTE: --fast-io is disabled since we are not using UDP");
2020	else	2067	else
2021	{	2068	{
Lines 2211-2217 Link Here
2211	/* link_socket_mode allows CM_CHILD_TCP	2258	/* link_socket_mode allows CM_CHILD_TCP
2212	instances to inherit acceptable fds	2259	instances to inherit acceptable fds
2213	from a top-level parent */	2260	from a top-level parent */
2214	if (c->options.proto == PROTO_TCPv4_SERVER)	2261	if (c->options.proto == PROTO_TCPv4_SERVER \|\| c->options.proto == PROTO_TCPv6_SERVER)
2215	{	2262	{
2216	if (c->mode == CM_TOP)	2263	if (c->mode == CM_TOP)
2217	link_socket_mode = LS_MODE_TCP_LISTEN;	2264	link_socket_mode = LS_MODE_TCP_LISTEN;
Lines 2324-2329 Link Here
2324	/* initialize dynamic MTU variable */	2371	/* initialize dynamic MTU variable */
2325	do_init_mssfix (c);	2372	do_init_mssfix (c);
2326		2373
		2374	#ifdef USE_PAYLOAD_CONNTRACK
		2375	do_init_payload(c);
		2376	#endif
2327	/* bind the TCP/UDP socket */	2377	/* bind the TCP/UDP socket */
2328	if (c->mode == CM_P2P \|\| c->mode == CM_TOP \|\| c->mode == CM_CHILD_TCP)	2378	if (c->mode == CM_P2P \|\| c->mode == CM_TOP \|\| c->mode == CM_CHILD_TCP)
2329	do_init_socket_1 (c, link_socket_mode);	2379	do_init_socket_1 (c, link_socket_mode);
Lines 2412-2417 Link Here
2412	/* close TUN/TAP device */	2462	/* close TUN/TAP device */
2413	do_close_tun (c, false);	2463	do_close_tun (c, false);
2414		2464
		2465	#ifdef USE_PAYLOAD_CONNTRACK
		2466	do_close_payload(c);
		2467	#endif
2415	/* call plugin close functions and unload */	2468	/* call plugin close functions and unload */
2416	do_close_plugins (c);	2469	do_close_plugins (c);
2417		2470
Lines 2440-2456 Link Here
2440	{	2493	{
2441	CLEAR (*dest);	2494	CLEAR (*dest);
2442		2495
2443	switch (src->options.proto)	2496	dest->mode = proto_is_dgram(src->options.proto)? CM_CHILD_UDP : CM_CHILD_TCP;
2444	{
2445	case PROTO_UDPv4:
2446	dest->mode = CM_CHILD_UDP;
2447	break;
2448	case PROTO_TCPv4_SERVER:
2449	dest->mode = CM_CHILD_TCP;
2450	break;
2451	default:
2452	ASSERT (0);
2453	}
2454		2497
2455	dest->first_time = false;	2498	dest->first_time = false;
2456		2499
Lines 2548-2554 Link Here
2548	dest->c2.buffers_owned = false;	2591	dest->c2.buffers_owned = false;
2549		2592
2550	dest->c2.event_set = NULL;	2593	dest->c2.event_set = NULL;
2551	if (src->options.proto == PROTO_UDPv4)	2594	if (proto_is_dgram(src->options.proto))
2552	do_event_set_init (dest, false);	2595	do_event_set_init (dest, false);
2553	}	2596	}
2554		2597

Lines 746-757 Link Here

(-)manage.c:1.2 (-6 / +9 lines)
746	{	746	{
747	struct gc_arena gc = gc_new ();	747	struct gc_arena gc = gc_new ();
748		748
		749	struct openvpn_sockaddr act;
749	/*	750	/*
750	* Accept the TCP client.	751	* Accept the TCP client.
751	*/	752	*/
752	man->connection.sd_cli = socket_do_accept (man->connection.sd_top, &man->connection.remote, false);	753	man->connection.sd_cli = socket_do_accept (man->connection.sd_top, &act, false);
753	if (socket_defined (man->connection.sd_cli))	754	if (socket_defined (man->connection.sd_cli))
754	{	755	{
		756	man->connection.remote = act;
		757
755	if (socket_defined (man->connection.sd_top))	758	if (socket_defined (man->connection.sd_top))
756	{	759	{
757	#ifdef WIN32	760	#ifdef WIN32
Lines 1120-1128 Link Here
1120	/*	1123	/*
1121	* Initialize socket address	1124	* Initialize socket address
1122	*/	1125	*/
1123	ms->local.sin_family = AF_INET;	1126	ms->local.addr.in.sin_family = AF_INET;
1124	ms->local.sin_addr.s_addr = 0;	1127	ms->local.addr.in.sin_addr.s_addr = 0;
1125	ms->local.sin_port = htons (port);	1128	ms->local.addr.in.sin_port = htons (port);
1126		1129
1127	/*	1130	/*
1128	* Run management over tunnel, or	1131	* Run management over tunnel, or
Lines 1134-1140 Link Here
1134	}	1137	}
1135	else	1138	else
1136	{	1139	{
1137	ms->local.sin_addr.s_addr = getaddr	1140	ms->local.addr.in.sin_addr.s_addr = getaddr
1138	(GETADDR_RESOLVE\|GETADDR_WARN_ON_SIGNAL\|GETADDR_FATAL, addr, 0, NULL, NULL);	1141	(GETADDR_RESOLVE\|GETADDR_WARN_ON_SIGNAL\|GETADDR_FATAL, addr, 0, NULL, NULL);
1139	}	1142	}
1140		1143
Lines 1381-1387 Link Here
1381	&& man->connection.state == MS_INITIAL)	1384	&& man->connection.state == MS_INITIAL)
1382	{	1385	{
1383	/* listen on our local TUN/TAP IP address */	1386	/* listen on our local TUN/TAP IP address */
1384	man->settings.local.sin_addr.s_addr = htonl (tun_local_ip);	1387	man->settings.local.addr.in.sin_addr.s_addr = htonl (tun_local_ip);
1385	man_connection_init (man);	1388	man_connection_init (man);
1386	}	1389	}
1387		1390

Lines 185-191 Link Here

(-)manage.h:1.2 (-2 / +2 lines)
185		185
186	struct man_settings {	186	struct man_settings {
187	bool defined;	187	bool defined;
188	struct sockaddr_in local;	188	struct openvpn_sockaddr local;
189	bool up_query_passwords;	189	bool up_query_passwords;
190	bool management_over_tunnel;	190	bool management_over_tunnel;
191	struct user_pass up;	191	struct user_pass up;
Lines 212-218 Link Here
212		212
213	socket_descriptor_t sd_top;	213	socket_descriptor_t sd_top;
214	socket_descriptor_t sd_cli;	214	socket_descriptor_t sd_cli;
215	struct sockaddr_in remote;	215	struct openvpn_sockaddr remote;
216		216
217	#ifdef WIN32	217	#ifdef WIN32
218	struct net_event_win32 ne32;	218	struct net_event_win32 ne32;




 * to a struct mroute_addr (addr).
 */
bool
mroute_extract_openvpn_sockaddr (struct mroute_addr *addr, const struct openvpn_sockaddr *osaddr, bool use_port)
{
  switch (osaddr->addr.sa.sa_family) 
  {
    case AF_INET:
      if (use_port)
	{
	  addr->type = MR_ADDR_IPV4 | MR_WITH_PORT;
	  addr->netbits = 0;
	  addr->len = 6;
	  memcpy (addr->addr, &osaddr->addr.in.sin_addr.s_addr, 4);
	  memcpy (addr->addr + 4, &osaddr->addr.in.sin_port, 2);
	}
      else
	{
	  addr->type = MR_ADDR_IPV4;
	  addr->netbits = 0;
	  addr->len = 4;
	  memcpy (addr->addr, &osaddr->addr.in.sin_addr.s_addr, 4);
	}
      return true;
    
#ifdef USE_PF_INET6
    case AF_INET6:
      if (use_port)
	{
	  addr->type = MR_ADDR_IPV6 | MR_WITH_PORT;
	  addr->netbits = 0;
	  addr->len = 18;
	  memcpy (addr->addr, &osaddr->addr.in6.sin6_addr, 16);
	  memcpy (addr->addr + 16, &osaddr->addr.in6.sin6_port, 2);
	}
      else
	{
	  addr->type = MR_ADDR_IPV6;
	  addr->netbits = 0;
	  addr->len = 16;
	  memcpy (addr->addr, &osaddr->addr.in6.sin6_addr, 16);
	}
      return true;
#endif
#ifdef USE_PF_UNIX
    case AF_UNIX:
      {
	struct stat st_buf;
	addr->type = MR_ADDR_UNIX;
	addr->netbits = 0;
	addr->len = 0 ;
	memset(addr->addr, 0, sizeof (addr->addr));
	if (stat(osaddr->addr.un.sun_path, &st_buf)<0)
	{
	  msg(M_WARN, "Could not stat(%s)", osaddr->addr.un.sun_path);
	  return false;
	}
	msg(M_INFO, "MR_ADDR_UNIX stat(\"%s\"): (0x%08lx, %lu)", osaddr->addr.un.sun_path, (unsigned long)st_buf.st_dev, (unsigned long)st_buf.st_ino);
	/* Put unix socket path {device,inode} numbers into addr (uniq and shorter that pathname */
	memcpy(addr->addr, &st_buf.st_dev, sizeof(st_buf.st_dev));
	memcpy(addr->addr+sizeof(st_buf.st_dev), &st_buf.st_ino, sizeof(st_buf.st_ino));
	addr->len = sizeof(st_buf.st_dev) + sizeof (st_buf.st_ino) ;
	return true;
      }
#endif
  }
  return false;
}


	  }
	  break;
	case MR_ADDR_IPV6:
#ifdef USE_PF_INET6
          {
	    struct buffer buf;
	    struct sockaddr_in6 sin6;
	    int port;
	    char buf6[INET6_ADDRSTRLEN] = "";
	    memset(&sin6, 0, sizeof sin6);
	    sin6.sin6_family = AF_INET6;
	    buf_set_read (&buf, maddr.addr, maddr.len);
            if (buf_read(&buf, &sin6.sin6_addr, sizeof (sin6.sin6_addr)))
            {
              if (getnameinfo((struct sockaddr *)&sin6, sizeof (struct sockaddr_in6),
                                      buf6, sizeof (buf6), NULL, 0, NI_NUMERICHOST) != 0)
                {
                  buf_printf (&out, "MR_ADDR_IPV6 getnameinfo() err");
                  break;
		}
              buf_puts (&out, buf6);
	      if (maddr.type & MR_WITH_NETBITS)
	        buf_printf (&out, "/%d", maddr.netbits);
              if (maddr.type & MR_WITH_PORT)
                {
                  port = buf_read_u16 (&buf);
                  if (port >= 0)
                    buf_printf (&out, ":%d", port);
                }
	    }
          }
#else /* old pre IPV6 1-line code: */
	  buf_printf (&out, "IPV6"); 
#endif
	  break;
#ifdef USE_PF_UNIX
	case MR_ADDR_UNIX:
          {
	    struct buffer buf;
	    dev_t path_dev;
	    ino_t path_ino;
	    buf_set_read (&buf, maddr.addr, maddr.len);
            if (!buf_read(&buf, &path_dev, sizeof path_dev))
	      {
		msg(M_WARN, "Error reading path_dev from MR_ADDR_UNIX addr");
		break;
	      }
            if (!buf_read(&buf, &path_ino, sizeof path_ino))
	      {
		msg(M_WARN, "Error reading path_ino from MR_ADDR_UNIX addr");
		break;
	      }
	    buf_printf (&out, "UNIX: (0x%08lx, %lu)", (unsigned long)path_dev, (unsigned long)path_ino);
          }
	  break;
#endif
	default:
	  buf_printf (&out, "UNKNOWN"); 
	  break;




#define MR_ADDR_ETHER            1
#define MR_ADDR_IPV4             2
#define MR_ADDR_IPV6             3
#define MR_ADDR_UNIX             4
#define MR_ADDR_MASK             7

/* Address type mask indicating that port # is part of address */
#define MR_WITH_PORT             8

/* Address type mask indicating that netbits is part of address */
#define MR_WITH_NETBITS          16

struct mroute_addr {
  uint8_t len;      /* length of address */

				 const struct sockaddr_in *saddr,
				 bool use_port);

struct openvpn_sockaddr;
int mroute_extract_openvpn_sockaddr(struct mroute_addr *addr, 
				 const struct openvpn_sockaddr *osaddr,
				 int use_port);

bool mroute_learnable_address (const struct mroute_addr *addr);

uint32_t mroute_addr_hash_function (const void *key, uint32_t iv);

Lines 159-165 Link Here

(-)mtcp.c:1.4 (-1 / +2 lines)
159	ASSERT (mi->context.c2.link_socket);	159	ASSERT (mi->context.c2.link_socket);
160	ASSERT (mi->context.c2.link_socket->info.lsa);	160	ASSERT (mi->context.c2.link_socket->info.lsa);
161	ASSERT (mi->context.c2.link_socket->mode == LS_MODE_TCP_ACCEPT_FROM);	161	ASSERT (mi->context.c2.link_socket->mode == LS_MODE_TCP_ACCEPT_FROM);
162	if (!mroute_extract_sockaddr_in (&mi->real, &mi->context.c2.link_socket->info.lsa->actual, true))	162	ASSERT (mi->context.c2.link_socket->info.lsa->actual.addr.sa.sa_family == AF_INET);
		163	if (!mroute_extract_openvpn_sockaddr (&mi->real, &mi->context.c2.link_socket->info.lsa->actual, true))
163	{	164	{
164	msg (D_MULTI_ERRORS, "MULTI TCP: TCP client address is undefined");	165	msg (D_MULTI_ERRORS, "MULTI TCP: TCP client address is undefined");
165	return false;	166	return false;

Lines 51-57 Link Here

(-)mudp.c:1.4 (-1 / +1 lines)
51	struct multi_instance *mi = NULL;	51	struct multi_instance *mi = NULL;
52	struct hash *hash = m->hash;	52	struct hash *hash = m->hash;
53		53
54	if (mroute_extract_sockaddr_in (&real, &m->top.c2.from, true))	54	if (mroute_extract_openvpn_sockaddr (&real, &m->top.c2.from, true))
55	{	55	{
56	struct hash_element *he;	56	struct hash_element *he;
57	const uint32_t hv = hash_value (hash, &real);	57	const uint32_t hv = hash_value (hash, &real);




		       in_addr_t a,
		       int netbits) /* -1 if host route, otherwise # of network bits in address */
{
  struct openvpn_sockaddr remote_si;
  struct mroute_addr addr;

  CLEAR (remote_si);
  remote_si.addr.in.sin_family = AF_INET;
  remote_si.addr.in.sin_addr.s_addr = htonl (a);
  ASSERT (mroute_extract_openvpn_sockaddr (&addr, &remote_si, false));

  if (netbits >= 0)
    {

  struct multi_context *m = (struct multi_context *) arg;
  struct hash_iterator hi;
  struct hash_element *he;
  struct openvpn_sockaddr saddr;
  struct mroute_addr maddr;
  int count = 0;

  CLEAR (saddr);
  saddr.addr.in.sin_family = AF_INET;
  saddr.addr.in.sin_addr.s_addr = htonl (addr);
  saddr.addr.in.sin_port = htons (port);
  if (mroute_extract_openvpn_sockaddr (&maddr, &saddr, true))
    {
      hash_iterator_init (m->iter, &hi, true);
      while ((he = hash_iterator_next (&hi)))

{
  ASSERT (top->options.mode == MODE_SERVER);

  if (proto_is_dgram(top->options.proto))
    tunnel_server_udp(top);
  else
    tunnel_server_tcp(top);
  case PROTO_TCPv4_SERVER:
    tunnel_server_tcp (top);
    break;
  default:
    ASSERT (0);
  }
}

#else

Lines 372-378 Link Here

(-)occ.c:1.4 (-1 / +1 lines)
372	c->c2.max_send_size_remote,	372	c->c2.max_send_size_remote,
373	c->c2.max_recv_size_local);	373	c->c2.max_recv_size_local);
374	if (!c->options.fragment	374	if (!c->options.fragment
375	&& c->options.proto == PROTO_UDPv4	375	&& (proto_is_dgram(c->options.proto))
376	&& c->c2.max_send_size_local > TUN_MTU_MIN	376	&& c->c2.max_send_size_local > TUN_MTU_MIN
377	&& (c->c2.max_recv_size_remote < c->c2.max_send_size_local	377	&& (c->c2.max_recv_size_remote < c->c2.max_send_size_local
378	\|\| c->c2.max_recv_size_local < c->c2.max_send_size_remote))	378	\|\| c->c2.max_recv_size_local < c->c2.max_send_size_remote))

Lines 46-51 Link Here

(-)openvpn.h:1.4 (-2 / +8 lines)
46	#include "pool.h"	46	#include "pool.h"
47	#include "plugin.h"	47	#include "plugin.h"
48	#include "manage.h"	48	#include "manage.h"
		49	#ifdef USE_PAYLOAD_CONNTRACK
		50	#include "payload.h"
		51	#endif
49		52
50	/*	53	/*
51	* Our global key schedules, packaged thusly	54	* Our global key schedules, packaged thusly
Lines 209-216 Link Here
209	struct link_socket_info *link_socket_info;	212	struct link_socket_info *link_socket_info;
210	const struct link_socket accept_from; / possibly do accept() on a parent link_socket */	213	const struct link_socket accept_from; / possibly do accept() on a parent link_socket */
211		214
212	struct sockaddr_in to_link_addr; /* IP address of remote */	215	struct openvpn_sockaddr to_link_addr; / IP address of remote */
213	struct sockaddr_in from; /* address of incoming datagram */	216	struct openvpn_sockaddr from; /* address of incoming datagram */
214		217
215	/* MTU frame parameters */	218	/* MTU frame parameters */
216	struct frame frame;	219	struct frame frame;
Lines 410-415 Link Here
410	struct event_timeout scheduled_exit;	413	struct event_timeout scheduled_exit;
411		414
412	#endif	415	#endif
		416	#ifdef USE_PAYLOAD_CONNTRACK
		417	struct payload_context *payload_context;
		418	#endif
413	};	419	};
414		420
415	/*	421	/*

Lines 72-77 Link Here

(-)options.c:1.4 (-16 / +69 lines)
72	#ifdef USE_PTHREAD	72	#ifdef USE_PTHREAD
73	" [PTHREAD]"	73	" [PTHREAD]"
74	#endif	74	#endif
		75	#ifdef ENABLE_IP_PKTINFO
		76	" [MH]"
		77	#endif
		78	#ifdef USE_PF_INET6
		79	" [PF_INET6]"
		80	#endif
		81	#ifdef USE_PF_UNIX
		82	" [PF_UNIX]"
		83	#endif
		84	#ifdef USE_PAYLOAD_CONNTRACK
		85	" [PAYLOAD_CONNTRACK]"
		86	#endif
75	" built on " __DATE__	87	" built on " __DATE__
76	;	88	;
77		89
Lines 92-97 Link Here
92	"--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"	104	"--mode m : Major mode, m = 'p2p' (default, point-to-point) or 'server'.\n"
93	"--proto p : Use protocol p for communicating with peer.\n"	105	"--proto p : Use protocol p for communicating with peer.\n"
94	" p = udp (default), tcp-server, or tcp-client\n"	106	" p = udp (default), tcp-server, or tcp-client\n"
		107	#ifdef USE_PF_INET6
		108	" p = udp6, tcp6-server, or tcp6-client (IPv6)\n"
		109	#endif
		110	#ifdef USE_PF_UNIX
		111	" also (experimental) p = unix-dgram\n"
		112	#endif
95	"--connect-retry n : For --proto tcp-client, number of seconds to wait\n"	113	"--connect-retry n : For --proto tcp-client, number of seconds to wait\n"
96	" between connection retries (default=%d).\n"	114	" between connection retries (default=%d).\n"
97	#ifdef ENABLE_HTTP_PROXY	115	#ifdef ENABLE_HTTP_PROXY
Lines 171-176 Link Here
171	"--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"	189	"--ping-timer-rem: Run the --ping-exit/--ping-restart timer only if we have a\n"
172	" remote address.\n"	190	" remote address.\n"
173	"--ping n : Ping remote once every n seconds over TCP/UDP port.\n"	191	"--ping n : Ping remote once every n seconds over TCP/UDP port.\n"
		192	#if ENABLE_IP_PKTINFO
		193	"--multihome : Configure a multi-homed UDP server.\n"
		194	#endif
174	"--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n"	195	"--fast-io : (experimental) Optimize TUN/TAP/UDP writes.\n"
175	#ifdef ENABLE_OCC	196	#ifdef ENABLE_OCC
176	"--explicit-exit-notify n : (experimental) on exit, send exit signal to remote.\n"	197	"--explicit-exit-notify n : (experimental) on exit, send exit signal to remote.\n"
Lines 204-209 Link Here
204	#endif	225	#endif
205	"--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"	226	"--mssfix [n] : Set upper bound on TCP MSS, default = tun-mtu size\n"
206	" or --fragment max value, whichever is lower.\n"	227	" or --fragment max value, whichever is lower.\n"
		228	#if USE_PAYLOAD_CONNTRACK
		229	"--tcp-retrans n : Drop TCP retransmissions for n seconds time span max\n"
		230	" (eg. n=60), useful for reliable links.\n"
		231	#endif
207	"--sndbuf size : Set the TCP/UDP send buffer size.\n"	232	"--sndbuf size : Set the TCP/UDP send buffer size.\n"
208	"--rcvbuf size : Set the TCP/UDP receive buffer size.\n"	233	"--rcvbuf size : Set the TCP/UDP receive buffer size.\n"
209	"--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"	234	"--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n"
Lines 531-536 Link Here
531	o->link_mtu = LINK_MTU_DEFAULT;	556	o->link_mtu = LINK_MTU_DEFAULT;
532	o->mtu_discover_type = -1;	557	o->mtu_discover_type = -1;
533	o->mssfix = MSSFIX_DEFAULT;	558	o->mssfix = MSSFIX_DEFAULT;
		559	#if USE_PAYLOAD_CONNTRACK
		560	o->tcp_retrans = 0;
		561	#endif
534	o->route_delay_window = 30;	562	o->route_delay_window = 30;
535	o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;	563	o->resolve_retry_seconds = RESOLV_RETRY_INFINITE;
536	#ifdef ENABLE_OCC	564	#ifdef ENABLE_OCC
Lines 995-1000 Link Here
995	SHOW_BOOL (persist_key);	1023	SHOW_BOOL (persist_key);
996		1024
997	SHOW_INT (mssfix);	1025	SHOW_INT (mssfix);
		1026	#if USE_PAYLOAD_CONNTRACK
		1027	SHOW_INT (tcp_retrans);
		1028	#endif
998		1029
999	#if PASSTOS_CAPABILITY	1030	#if PASSTOS_CAPABILITY
1000	SHOW_BOOL (passtos);	1031	SHOW_BOOL (passtos);
Lines 1033-1038 Link Here
1033	SHOW_INT (rcvbuf);	1064	SHOW_INT (rcvbuf);
1034	SHOW_INT (sndbuf);	1065	SHOW_INT (sndbuf);
1035		1066
		1067	#if ENABLE_IP_PKTINFO
		1068	SHOW_BOOL (multihome);
		1069	#endif
		1070
1036	#ifdef ENABLE_HTTP_PROXY	1071	#ifdef ENABLE_HTTP_PROXY
1037	if (o->http_proxy_options)	1072	if (o->http_proxy_options)
1038	show_http_proxy_options (o->http_proxy_options);	1073	show_http_proxy_options (o->http_proxy_options);
Lines 1252-1258 Link Here
1252	* Sanity check on TCP mode options	1287	* Sanity check on TCP mode options
1253	*/	1288	*/
1254		1289
1255	if (options->connect_retry_defined && options->proto != PROTO_TCPv4_CLIENT)	1290	if (options->connect_retry_defined && options->proto != PROTO_TCPv4_CLIENT && options->proto != PROTO_TCPv6_CLIENT)
1256	msg (M_USAGE, "--connect-retry doesn't make sense unless also used with --proto tcp-client");	1291	msg (M_USAGE, "--connect-retry doesn't make sense unless also used with --proto tcp-client");
1257		1292
1258	/*	1293	/*
Lines 1262-1269 Link Here
1262	msg (M_USAGE, "only one of --tun-mtu or --link-mtu may be defined (note that --ifconfig implies --link-mtu %d)", LINK_MTU_DEFAULT);	1297	msg (M_USAGE, "only one of --tun-mtu or --link-mtu may be defined (note that --ifconfig implies --link-mtu %d)", LINK_MTU_DEFAULT);
1263		1298
1264	#ifdef ENABLE_OCC	1299	#ifdef ENABLE_OCC
1265	if (options->proto != PROTO_UDPv4 && options->mtu_test)	1300	if (!proto_is_udp(options->proto) && options->mtu_test)
1266	msg (M_USAGE, "--mtu-test only makes sense with --proto udp");	1301	msg (M_USAGE, "Options error: --mtu-test only makes sense with --proto udp or --proto udp6");
1267	#endif	1302	#endif
1268		1303
1269	/*	1304	/*
Lines 1307-1313 Link Here
1307	const char *remote = l->array[i].hostname;	1342	const char *remote = l->array[i].hostname;
1308	const int remote_port = l->array[i].port;	1343	const int remote_port = l->array[i].port;
1309		1344
1310	if (string_defined_equal (options->local, remote)	1345	if (proto_is_net(options->proto)
		1346	&& string_defined_equal (options->local, remote)
1311	&& options->local_port == remote_port)	1347	&& options->local_port == remote_port)
1312	msg (M_USAGE, "--remote and --local addresses are the same");	1348	msg (M_USAGE, "--remote and --local addresses are the same");
1313		1349
Lines 1374-1389 Link Here
1374	*/	1410	*/
1375		1411
1376	#ifdef ENABLE_FRAGMENT	1412	#ifdef ENABLE_FRAGMENT
1377	if (options->proto != PROTO_UDPv4 && options->fragment)	1413	if (!proto_is_udp(options->proto) && options->fragment)
1378	msg (M_USAGE, "--fragment can only be used with --proto udp");	1414	msg (M_USAGE, "--fragment can only be used with --proto udp or --proto udp6");
1379	#endif	1415	#endif
		1416	if (!proto_is_net(options->proto) && !options->local)
		1417	msg (M_USAGE, "--local MUST be specified with --proto unix-dgram or --proto unix-stream");
1380		1418
1381	#ifdef ENABLE_OCC	1419	#ifdef ENABLE_OCC
1382	if (options->proto != PROTO_UDPv4 && options->explicit_exit_notification)	1420	if (!proto_is_udp(options->proto) && options->explicit_exit_notification)
1383	msg (M_USAGE, "--explicit-exit-notify can only be used with --proto udp");	1421	msg (M_USAGE, "--explicit-exit-notify can only be used with --proto udp");
1384	#endif	1422	#endif
1385		1423
1386	if (!options->remote_list && options->proto == PROTO_TCPv4_CLIENT)	1424	if (!options->remote_list && (options->proto == PROTO_TCPv4_CLIENT\|\|options->proto== PROTO_TCPv6_CLIENT))
1387	msg (M_USAGE, "--remote MUST be used in TCP Client mode");	1425	msg (M_USAGE, "--remote MUST be used in TCP Client mode");
1388		1426
1389	#ifdef ENABLE_HTTP_PROXY	1427	#ifdef ENABLE_HTTP_PROXY
Lines 1401-1407 Link Here
1401	msg (M_USAGE, "--socks-proxy can not be used in TCP Server mode");	1439	msg (M_USAGE, "--socks-proxy can not be used in TCP Server mode");
1402	#endif	1440	#endif
1403		1441
1404	if (options->proto == PROTO_TCPv4_SERVER && remote_list_len (options->remote_list) > 1)	1442	if ((options->proto == PROTO_TCPv4_SERVER\|\|options->proto == PROTO_TCPv6_SERVER) && remote_list_len (options->remote_list) > 1)
1405	msg (M_USAGE, "TCP server mode allows at most one --remote address");	1443	msg (M_USAGE, "TCP server mode allows at most one --remote address");
1406		1444
1407	#if P2MP_SERVER	1445	#if P2MP_SERVER
Lines 1426-1433 Link Here
1426	msg (M_USAGE, "--mode server only works with --dev tun or --dev tap");	1464	msg (M_USAGE, "--mode server only works with --dev tun or --dev tap");
1427	if (options->pull)	1465	if (options->pull)
1428	msg (M_USAGE, "--pull cannot be used with --mode server");	1466	msg (M_USAGE, "--pull cannot be used with --mode server");
1429	if (!(options->proto == PROTO_UDPv4 \|\| options->proto == PROTO_TCPv4_SERVER))	1467	if (!(proto_is_udp(options->proto) \|\| options->proto == PROTO_TCPv4_SERVER \|\| options->proto == PROTO_TCPv6_SERVER \|\| options->proto == PROTO_UNIX_DGRAM))
1430	msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server");	1468	msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server (also udp6/tcp6)");
1431	if (!options->tls_server)	1469	if (!options->tls_server)
1432	msg (M_USAGE, "--mode server requires --tls-server");	1470	msg (M_USAGE, "--mode server requires --tls-server");
1433	if (options->remote_list)	1471	if (options->remote_list)
Lines 1450-1458 Link Here
1450	msg (M_USAGE, "--inetd cannot be used with --mode server");	1488	msg (M_USAGE, "--inetd cannot be used with --mode server");
1451	if (options->ipchange)	1489	if (options->ipchange)
1452	msg (M_USAGE, "--ipchange cannot be used with --mode server (use --client-connect instead)");	1490	msg (M_USAGE, "--ipchange cannot be used with --mode server (use --client-connect instead)");
1453	if (!(options->proto == PROTO_UDPv4 \|\| options->proto == PROTO_TCPv4_SERVER))	1491	if (!(proto_is_dgram(options->proto) \|\| options->proto == PROTO_TCPv4_SERVER \|\| options->proto == PROTO_TCPv6_SERVER ))
1454	msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server");	1492	msg (M_USAGE, "--mode server currently only supports --proto udp or --proto tcp-server (also udp6/tcp6)");
1455	if (options->proto != PROTO_UDPv4 && (options->cf_max \|\| options->cf_per))	1493	if (!proto_is_udp(options->proto) && (options->cf_max \|\| options->cf_per))
1456	msg (M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");	1494	msg (M_USAGE, "--connect-freq only works with --mode server --proto udp. Try --max-clients instead.");
1457	if (dev != DEV_TYPE_TAP && options->ifconfig_pool_netmask)	1495	if (dev != DEV_TYPE_TAP && options->ifconfig_pool_netmask)
1458	msg (M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");	1496	msg (M_USAGE, "The third parameter to --ifconfig-pool (netmask) is only valid in --dev tap mode");
Lines 1526-1532 Link Here
1526	/*	1564	/*
1527	* Check consistency of replay options	1565	* Check consistency of replay options
1528	*/	1566	*/
1529	if ((options->proto != PROTO_UDPv4)	1567	if ((!proto_is_udp(options->proto))
1530	&& (options->replay_window != defaults.replay_window	1568	&& (options->replay_window != defaults.replay_window
1531	\|\| options->replay_time != defaults.replay_time))	1569	\|\| options->replay_time != defaults.replay_time))
1532	msg (M_USAGE, "--replay-window only makes sense with --proto udp");	1570	msg (M_USAGE, "--replay-window only makes sense with --proto udp");
Lines 1655-1661 Link Here
1655	*/	1693	*/
1656	if (options->pull	1694	if (options->pull
1657	&& options->ping_rec_timeout_action == PING_UNDEF	1695	&& options->ping_rec_timeout_action == PING_UNDEF
1658	&& options->proto == PROTO_UDPv4)	1696	&& proto_is_udp(options->proto))
1659	{	1697	{
1660	options->ping_rec_timeout = PRE_PULL_INITIAL_PING_RESTART;	1698	options->ping_rec_timeout = PRE_PULL_INITIAL_PING_RESTART;
1661	options->ping_rec_timeout_action = PING_RESTART;	1699	options->ping_rec_timeout_action = PING_RESTART;
Lines 2996-3001 Link Here
2996	VERIFY_PERMISSION (OPT_P_GENERAL);	3034	VERIFY_PERMISSION (OPT_P_GENERAL);
2997	options->mlock = true;	3035	options->mlock = true;
2998	}	3036	}
		3037	#if ENABLE_IP_PKTINFO
		3038	else if (streq (p[0], "multihome"))
		3039	{
		3040	VERIFY_PERMISSION (OPT_P_GENERAL);
		3041	options->multihome = true;
		3042	}
		3043	#endif
2999	else if (streq (p[0], "verb") && p[1])	3044	else if (streq (p[0], "verb") && p[1])
3000	{	3045	{
3001	++i;	3046	++i;
Lines 3500-3505 Link Here
3500	options->mssfix_default = true;	3545	options->mssfix_default = true;
3501		3546
3502	}	3547	}
		3548	#if USE_PAYLOAD_CONNTRACK
		3549	else if (streq (p[0], "tcp-retrans") && p[1])
		3550	{
		3551	++i;
		3552	VERIFY_PERMISSION (OPT_P_GENERAL);
		3553	options->tcp_retrans = positive_atoi (p[1]);
		3554	}
		3555	#endif
3503	#ifdef ENABLE_OCC	3556	#ifdef ENABLE_OCC
3504	else if (streq (p[0], "disable-occ"))	3557	else if (streq (p[0], "disable-occ"))
3505	{	3558	{

Lines 178-183 Link Here

(-)options.h:1.4 (+7 lines)
178		178
179	int mssfix; /* Upper bound on TCP MSS */	179	int mssfix; /* Upper bound on TCP MSS */
180	bool mssfix_default; /* true if --mssfix was supplied without a parameter */	180	bool mssfix_default; /* true if --mssfix was supplied without a parameter */
		181	#if USE_PAYLOAD_CONNTRACK
		182	int tcp_retrans; /* Drop TCP retransmissions for this time window [secs] */
		183	#endif
181		184
182	#if PASSTOS_CAPABILITY	185	#if PASSTOS_CAPABILITY
183	bool passtos;	186	bool passtos;
Lines 222-227 Link Here
222	/* optimize TUN/TAP/UDP writes */	225	/* optimize TUN/TAP/UDP writes */
223	bool fast_io;	226	bool fast_io;
224		227
		228	#if ENABLE_IP_PKTINFO
		229	bool multihome;
		230	#endif
		231
225	#ifdef USE_LZO	232	#ifdef USE_LZO
226	bool comp_lzo;	233	bool comp_lzo;
227	bool comp_lzo_adaptive;	234	bool comp_lzo_adaptive;




#ifndef _PAYLOAD_INLINE_H
#define _PAYLOAD_INLINE_H

#ifdef USE_PAYLOAD_CONNTRACK
/*
 * Should run conntrack GC?
 */
static inline void
check_payload_gc (struct context *c)
{
  void check_payload_gc_dowork (struct context *c);
  if (!c->c2.payload_context)
    return;
  if (!event_timeout_defined (&c->c2.payload_context->gc.wakeup))
    return;
  if (event_timeout_trigger (&c->c2.payload_context->gc.wakeup, &c->c2.timeval, ETT_DEFAULT))
    check_payload_gc_dowork (c);
}

#endif
#endif /* _PAYLOAD_INLINE_H */
/* 
vim: cino={.5s,\:.5s,+.5s,t0,g0,^-2,e-2,n-2,p2s,(0,=.5s:sw=4:ts=8:sts=4
 */




/*
 ***** THIS IS WORK IN PROGRESS (and correctly ifdef'd out) --jjo Jun/2005 *****
 * 
 *  Payload conntrack optimizations for OpenVPN
 *    Intended for filtering TCP retransmissions over reliable links
 *
 * QUICK copy-n-paste for jjo:
 * make payload.o CFLAGS="-D USE_PAYLOAD_CONNTRACK=1 -Wall "
 *
 *  Author: JuanJo Ciarlante <jjo@mendoza.gov.ar>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program (see the file COPYING included with this
 *  distribution); if not, write to the Free Software Foundation, Inc.,
 *  59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

#ifdef WIN32
#include "config-win32.h"
#else
#include "config.h"
#endif

#ifdef USE_PAYLOAD_CONNTRACK

#include "syshead.h"
#include "forward.h"
#include "memdbg.h"

#include "list.h"
#include "forward-inline.h"
#include "payload.h"
#define PAYLOAD_HASH_SIZE 256 /* Should be configurable by option */

#define PAYLOAD_N_TCPSEGS 8
/* 
 * struct payload_tuple_id : uniq 5-upla (proto==TCP is implicit)
 */
struct payload_tuple_id {
  /* BEGIN uniq TCP 5-upla id */
  uint32_t ip_saddr, ip_daddr;
  uint16_t tcp_sport, tcp_dport;
  /* END   uniq TCP 5-upla id */
};

/* 
 * payload_tuple: 1 per TCP connection, currently only TX side hook
 */
struct payload_tuple {
  struct payload_tuple_id id;
  /* round robin array with PAYLOAD_N_TCPSEGS latest tcp segments: */
  struct {
    struct openvpn_tcphdr tcph;
    int tcp_len;
    int hits;
  } tcp_seg[PAYLOAD_N_TCPSEGS];
  int tcp_seg_idx; 	/* next slot to use */
  time_t last_used;
  time_t expires;
  int conn_hits;
  int deleted;
};

/* shortcuts macros for easier printing */
#define PAYLOAD_FMT_MIN "0x%08x:%d -> 0x%08x:%d"
#define PAYLOAD_FMT_MIN_ARGS(pip, ptcp) \
					ntohl(pip->saddr), ntohs(ptcp->source),\
					ntohl(pip->daddr), ntohs(ptcp->dest)

#define PAYLOAD_FMT_MED PAYLOAD_FMT_MIN " (seq=%08x, ack_seq=%08x)"
#define PAYLOAD_FMT_MED_ARGS(pip, ptcp) PAYLOAD_FMT_MIN_ARGS(pip, ptcp) ,\
					ntohl(ptcp->seq),ntohl(ptcp->ack_seq)

#define PAYLOAD_FMT_FULL PAYLOAD_FMT_MED " w=%d [%c%c%c%c%c%c]" /* doesn't show WSCALE */
#define PAYLOAD_FMT_FULL_ARGS(pip, ptcp) PAYLOAD_FMT_MED_ARGS(pip,ptcp) ,\
					ntohs(ptcp->window), \
					OPENVPN_TCPH_FIN_MASK & ptcp->flags ? 'F' : '.', \
					OPENVPN_TCPH_SYN_MASK & ptcp->flags ? 'S' : '.', \
					OPENVPN_TCPH_RST_MASK & ptcp->flags ? 'R' : '.', \
					OPENVPN_TCPH_PSH_MASK & ptcp->flags ? 'P' : '.', \
					OPENVPN_TCPH_ACK_MASK & ptcp->flags ? 'A' : '.', \
					OPENVPN_TCPH_URG_MASK & ptcp->flags ? 'P' : '.' 
/* hash related functions */
static inline const uint8_t *
payload_tuple_hash_ptr (const struct payload_tuple *pt)
{
  return (uint8_t *) &pt->id;
}

static inline uint32_t
payload_tuple_hash_len (const struct payload_tuple *pt)
{
  return (uint32_t) sizeof (pt->id);
}

uint32_t 
payload_tuple_hash_func (const void *key, uint32_t iv)
{
  return hash_func(payload_tuple_hash_ptr((const struct payload_tuple *)key),
		   payload_tuple_hash_len((const struct payload_tuple *)key),
		   iv);
}

bool
payload_tuple_compare_func(const void *key1, const void *key2)
{
  return memcmp(&((const struct payload_tuple *)key1)->id, 
		&((const struct payload_tuple *)key2)->id, 
		sizeof ((const struct payload_tuple *)key1)->id) == 0;
}


/* create a new conntrack entry */
static struct payload_tuple *
payload_tuple_new(void)
{
  struct payload_tuple *pt;
  ALLOC_OBJ_CLEAR(pt, struct payload_tuple);
  return pt;
}
void
payload_tuple_delete(struct payload_tuple *pt)
{
  free(pt);
}

/* initialize conntrack entry with {ip,tcp} hdr data */
static void
payload_tuple_id_init(struct payload_tuple_id *pt_id, const struct openvpn_iphdr *pip, const struct openvpn_tcphdr *ptcp)
{
  ASSERT(pt_id);
  CLEAR(*pt_id);
  pt_id->ip_saddr=pip->saddr;
  pt_id->ip_daddr=pip->daddr;
  pt_id->tcp_sport=ptcp->source;
  pt_id->tcp_dport=ptcp->dest;
}

/*
 * How many buckets in hash to gc per pass. (shamelessly stolen from multi.c)
 */
#define PAYLOAD_GC_DIVISOR     256  /* How many passes to cover whole hash table */
#define PAYLOAD_GC_MIN          16  /* Minimum number of buckets per pass */
#define PAYLOAD_GC_MAX        1024  /* Maximum number of buckets per pass */
static int
payload_gc_buckets_per_pass (int n_buckets)
{
  return constrain_int (n_buckets / PAYLOAD_GC_DIVISOR, PAYLOAD_GC_MIN, PAYLOAD_GC_MAX);
}

/*
 * Adjust next event wakeup based on how many conntrack entries present
 * currently it programs
 */
static void
payload_gc_adjust_timers(struct context *c)
{
  struct payload_context *pc=c->c2.payload_context;
  int n=hash_n_elements(pc->hash);
  if (n>0)
    {
      if (pc->gc.wakeup.n != 1)
	event_timeout_init (&pc->gc.wakeup, 1, now);
      context_reschedule_sec(c, 1);
      reset_coarse_timers(c);
      dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_adjust_timers: n_elem=%d wakeup.n=%d", n, pc->gc.wakeup.n);
    }
  else
    {
      event_timeout_clear(&pc->gc.wakeup);
      dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_adjust_timers: n_elem=%d timeout_cleared", n);
    }
}
/*
 * garbage collect old (pt->deleted) entries
 */
int
payload_gc_run(struct payload_context *pc, int start_bucket, int end_bucket)
{
  int n_deleted=0, n_total=0, n_total_hits=0;
  struct hash_element *he;
  struct hash_iterator hi;
  if (start_bucket < 0)
    {
      start_bucket = 0;
      end_bucket = hash_n_buckets (pc->hash);
    }
  hash_iterator_init_range (pc->hash, &hi, true, start_bucket, end_bucket);
  while ((he = hash_iterator_next (&hi)) != NULL)
    {
      struct payload_tuple *pt = (struct payload_tuple *) he->value;
      n_total++;
      n_total_hits+=pt->conn_hits;
      if (now > pt->expires)
	pt->deleted++;
      /*
       * could have been marked syncronously (from payload_tcp_dd ...) or
       * async (here) by above check
       */
      if (pt->deleted)
	{
	  n_deleted++;
	  dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_run DELETED " PAYLOAD_FMT_MIN, 
	      ntohl(pt->id.ip_saddr), ntohs(pt->id.tcp_sport),
	      ntohl(pt->id.ip_daddr), ntohs(pt->id.tcp_dport));
	  payload_tuple_delete(pt);
	  hash_iterator_delete_element (&hi);
	}
    }
  hash_iterator_free (&hi);
  dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_run(%d,%d) DELETED %d/%d entries, n_elem=%d, total_hits=%d" , 
      start_bucket, end_bucket,
      n_deleted, n_total, hash_n_elements(pc->hash), n_total_hits);
  return n_deleted;
}

static void
payload_gc_dowork(struct payload_context *pc)
{
  if (pc->gc.bucket_base >= hash_n_buckets(pc->hash))
    pc->gc.bucket_base = 0;
  payload_gc_run(pc, pc->gc.bucket_base, pc->gc.bucket_base+pc->gc.buckets_per_pass);
  pc->gc.bucket_base+= pc->gc.buckets_per_pass;
}

/*
 * conntrack cleaner from event ticks
 */
void
check_payload_gc_dowork (struct context *c)
{
  struct payload_context *pc=c->c2.payload_context;
  ASSERT(pc);
  payload_gc_dowork(pc);
  payload_gc_adjust_timers(c);
}

/*
 * Loop over TCP options, call callback() if matches passed TCP opt  (wildcard: OPENVPN_TCPOPT_ANY)
 *
 * Some examples:
 * - is SACK present?
 *    if(tcp_opt_process(buf, OPENVPN_TCPOPT_SACK, NULL, NULL, pip, ptcp)) ...
 * - if SACK is present, call myfunc(..., myarg, ...)
 *    if(tcp_opt_process(buf, OPENVPN_TCPOPT_SACK, myfunc, myarg, pip, ptcp)) ...
 * - is any option present? (except EOL, NOP)
 *    if(tcp_opt_process(buf, OPENVPN_TCPOPT_ANY, NULL, NULL, pip, ptcp)) ...
 * - for each option (except EOL, NOP) call myfunc(..., myarg, ...)
 *    if(tcp_opt_process(buf, OPENVPN_TCPOPT_ANY, myfunc, myarg, pip, ptcp)) ...
 *    
 */
static inline bool
tcp_opt_process (struct buffer *buf, int optnum,  bool (*callback)(uint8_t *opt, int optlen, void *callback_arg), void *callback_arg)
{
  int hlen, olen, optlen;
  uint8_t *opt;
  struct openvpn_tcphdr *ptcp;

  ASSERT (BLEN (buf) >= (int) sizeof (struct openvpn_tcphdr));

  verify_align_4 (buf);

  ptcp = (struct openvpn_tcphdr *) BPTR (buf);
  hlen = OPENVPN_TCPH_GET_DOFF (ptcp->doff_res);

  /* Invalid header length or header without options. */
  if (hlen <= (int) sizeof (struct openvpn_tcphdr)
      || hlen > BLEN (buf))
    return false;

  for (olen = hlen - sizeof (struct openvpn_tcphdr),
	 opt = (uint8_t *)(ptcp + 1);
       olen > 0;
       olen -= optlen, opt += optlen) {
    if (*opt == OPENVPN_TCPOPT_EOL)
      break;
    else if (*opt == OPENVPN_TCPOPT_NOP)
      optlen = 1;
    else {
      optlen = *(opt + 1);
      if (optlen <= 0 || optlen > olen)
        break;
      /* 
       * TCP opt found, callback() passed function and return true if callback succeded 
       */

      if (optnum == OPENVPN_TCPOPT_ANY || optnum == *opt) {
	if (callback) {
	  if (callback(opt, optlen, callback_arg))
	    return true;
	} else 
	  /* if no callback function, just return true (opt found) */
	  return true;
      }
    }
  }
  return false;
}

static inline bool
tcp_dd_opt_skip_segment(uint8_t *opt, int optlen, void *arg)
{
  switch(*opt)
    {
    case OPENVPN_TCPOPT_SACK:
    case OPENVPN_TCPOPT_WSCALE:
      return true;
    }
  return false;
}
/*
 * careful logic: TCP may update window, probe 0-window and alike
 * yet could be seen as a retransmission
 */

static inline int
payload_tcp_dd_drop_hit(struct context *c, const struct openvpn_iphdr *pip, const struct openvpn_tcphdr *ptcp, struct buffer *buf)
{
  bool result=false;
  struct hash_element *he;
  uint32_t hv;
  struct hash_bucket *bucket;
  struct payload_context *pc=c->c2.payload_context;
  struct payload_tuple_id pt_id;
  struct payload_tuple *pt;
  struct openvpn_tcphdr tcph = *ptcp; /* local copy: stored tcph is NOT equal to sniffed one */
  int ip_totlen=ntohs(pip->tot_len);
  int tcp_len=ip_totlen-OPENVPN_IPH_GET_LEN (pip->version_len); /* tcphdr+DATA */

  ASSERT(pc);
  tcph.check=0; /* TCP chksum will vary with eg. tstamp */
  payload_tuple_id_init(&pt_id, pip, ptcp);

  hv= hash_value (pc->hash, &pt_id);
  bucket= hash_bucket (pc->hash, hv);
  hash_bucket_lock (bucket);
  he = hash_lookup_fast (pc->hash, bucket, &pt_id, hv);
  if (he)
    {
      int i;
      pt = (struct payload_tuple *) he->value;
      /*
       * Avoid filtering out if:
       * - SYN or FIN
       * - zero window 
       * - zero window probe (data size=1)
       * - SACK or WSCALE option present
       */
      if ( (ptcp->flags & (OPENVPN_TCPH_SYN_MASK|OPENVPN_TCPH_FIN_MASK))
	   || tcph.window == 0
	   || (ip_totlen-OPENVPN_TCPH_GET_DOFF(tcph.doff_res))==1
	   || tcp_opt_process(buf, OPENVPN_TCPOPT_ANY, tcp_dd_opt_skip_segment, NULL))
	{
	  dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_dd_drop_hit: SKIP segment " PAYLOAD_FMT_FULL, 
	      PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
	  goto done;
	}

      /* search for seen TCP header */
      for(i=0;i<PAYLOAD_N_TCPSEGS;i++)
	{
	  /* 
	   * if:
	   * 	same seq nums (optimization to avoid next checks if unequal)
	   * 	AND same tcp segment header (w/o options)
	   * 	AND same tcp header len (incl. options sizes)
	   *
	   */
	  if (pt->tcp_seg[i].tcph.seq==tcph.seq 
	      && memcmp(pt->tcp_seg+i, &tcph, sizeof tcph)==0
	      && pt->tcp_seg[i].tcp_len == tcp_len)
	    {
	      pt->tcp_seg[i].hits++;
	      pt->conn_hits++;
	      dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_dd_drop_hit HIT! conn_hits=%d timeleft=%ld " PAYLOAD_FMT_FULL, 
		  pt->conn_hits, pt->expires-now,
		  PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
	      result=true;	/* _IS_ a dup */
	      goto done;
	    }
	}
      if (pt->expires < now)
	{
	  pt->deleted=true;
	  goto out;
	}
    }
  else
    {
      dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_dd_drop_hit CREATED " PAYLOAD_FMT_FULL, PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
      pt = payload_tuple_new();
      pt->id = pt_id;
      hash_add_fast(pc->hash, bucket, &pt_id, hv, pt);
      payload_gc_adjust_timers(c);
    }

  /* Not found or new ... use next available slot */
  pt->tcp_seg[pt->tcp_seg_idx].tcph=tcph;
  pt->tcp_seg[pt->tcp_seg_idx].tcp_len=tcp_len;
  pt->tcp_seg[pt->tcp_seg_idx].hits=0;
  pt->tcp_seg_idx++;
  pt->tcp_seg_idx%=PAYLOAD_N_TCPSEGS;

done:
  /* refresh entry */
  pt->expires=now+pc->tcp_retrans;
  pt->last_used=now;

out:
  hash_bucket_unlock (bucket);
  return result;
}

/*
 * External interface: payload_tcp_retrans_drop() returns true
 * if this segment IS a dup (should be dropped by caller)
 */
bool
payload_tcp_retrans_drop (struct context *c, struct buffer *buf)
{
  const struct openvpn_iphdr *pip;
  int hlen;
  if (BLEN (buf) < (int) sizeof (struct openvpn_iphdr))
    return false;
  pip = (struct openvpn_iphdr *) BPTR (buf);

  hlen = OPENVPN_IPH_GET_LEN (pip->version_len);

  if (pip->protocol == OPENVPN_IPPROTO_TCP
      && ntohs (pip->tot_len) == BLEN (buf)
      && (ntohs (pip->frag_off) & OPENVPN_IP_OFFMASK) == 0
      && hlen <= BLEN (buf)
      && BLEN (buf) - hlen
      >= (int) sizeof (struct openvpn_tcphdr))
    {
      struct buffer newbuf = *buf;
      if (buf_advance (&newbuf, hlen))
	{
	  const struct openvpn_tcphdr *ptcp = (struct openvpn_tcphdr *) BPTR (&newbuf);
	  /*
	     dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_retrans_drop : " PAYLOAD_FMT_FULL, PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
	     */
	  if (c->c2.payload_context && payload_tcp_dd_drop_hit(c, pip, ptcp, buf))
	    return true;
	}
    }
  return false;

}
/* Initialize payload (conntrack) hash table */
struct payload_context *
payload_new(int tcp_retrans)
{
  struct payload_context *pc;
  ASSERT(tcp_retrans);

  ALLOC_OBJ_CLEAR(pc, struct payload_context);
  pc->tcp_retrans = tcp_retrans;
  pc->hash= hash_init(PAYLOAD_HASH_SIZE, payload_tuple_hash_func, payload_tuple_compare_func);
  pc->gc.buckets_per_pass = payload_gc_buckets_per_pass(PAYLOAD_HASH_SIZE);
#if 0+WIP
  pc->payload_context>schedule = schedule_init();
  pc->payload_context>max_tcp_conns = 64; /* XXX: obviously must be configurable, test 4now */
#endif
  event_timeout_clear(&pc->gc.wakeup);
  return pc;
}
void payload_free(struct payload_context *pc)
{
  struct hash_iterator hi;
  struct hash_element *he;
  ASSERT(pc);

  event_timeout_clear(&pc->gc.wakeup);
  hash_iterator_init (pc->hash, &hi, true);
  while ((he = hash_iterator_next (&hi)))
    {
      struct payload_tuple *pt = (struct payload_tuple *) he->value;
      pt->deleted++;
    }
  hash_iterator_free (&hi);
  payload_gc_run(pc, -1, 0);
  free(pc);
}

#endif
/* 
vim: cino={.5s,\:.5s,+.5s,t0,g0,^-2,e-2,n-2,p2s,(0,=.5s:sw=4:ts=8:sts=4
 */




#ifndef _PAYLOAD_H
#define _PAYLOAD_H
struct payload_context {
  struct hash *hash;
  struct schedule *schedule; /* unused by now */
  int max_tcp_conns; /* unused by now */
  int tcp_retrans;
  struct {
    time_t per_second_trigger;
    int bucket_base;
    int buckets_per_pass;
    struct event_timeout wakeup;
  } gc;
};

struct payload_context * payload_new(int tcp_retrans);
void payload_free(struct payload_context *);
int payload_tcp_retrans_drop(struct context *c, struct buffer *buf);
#endif /* _PAYLOAD_H */
/* 
vim: cino={.5s,\:.5s,+.5s,t0,g0,^-2,e-2,n-2,p2s,(0,=.5s:sw=4:ts=8:sts=4
 */

Lines 121-126 Link Here

(-)proto.h:1.3 (+5 lines)
121	#define OPENVPN_TCPOPT_MAXSEG 2	121	#define OPENVPN_TCPOPT_MAXSEG 2
122	#define OPENVPN_TCPOLEN_MAXSEG 4	122	#define OPENVPN_TCPOLEN_MAXSEG 4
123		123
		124	#define OPENVPN_TCPOPT_WSCALE 3
		125	#define OPENVPN_TCPOPT_SACK 5
		126	#define OPENVPN_TCPOPT_TIMESTAMP 8
		127	#define OPENVPN_TCPOPT_ANY 255
		128
124	/*	129	/*
125	* The following macro is used to update an	130	* The following macro is used to update an
126	* internet checksum. "acc" is a 32-bit	131	* internet checksum. "acc" is a 32-bit





static void
update_remote (const char* host,
	       struct openvpn_sockaddr *addr,
	       bool *changed)
{
  if (addr->addr.sa.sa_family == AF_INET) {
  if (host && addr)
    {
      const in_addr_t new_addr = getaddr (

					  1,
					  NULL,
					  NULL);
      if (new_addr && addr->addr.in.sin_addr.s_addr != new_addr)
	{
	  addr->addr.in.sin_addr.s_addr = new_addr;
	  *changed = true;
	}
    }
  }
}

static int

}

static socket_descriptor_t
create_socket_udp (const unsigned int flags)
{
  socket_descriptor_t sd;

  if ((sd = socket (PF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0)
    msg (M_SOCKERR, "UDP: Cannot create UDP socket");
#if ENABLE_IP_PKTINFO
  else if (flags & SF_USE_IP_PKTINFO)
    {
      int pad = 1;
      setsockopt (sd, SOL_IP, IP_PKTINFO, (void*)&pad, sizeof(pad));
    }
#endif
  return sd;
}

#ifdef USE_PF_INET6
static socket_descriptor_t
create_socket_udp6 (const unsigned int flags)
{
  socket_descriptor_t sd;

  if ((sd = socket (PF_INET6, SOCK_DGRAM, IPPROTO_UDP)) < 0)
    msg (M_SOCKERR, "UDP: Cannot create UDP6 socket");
#if ENABLE_IP_PKTINFO
  else if (flags & SF_USE_IP_PKTINFO)
    {
      int pad = 1;
      setsockopt (sd, IPPROTO_IPV6, IPV6_PKTINFO, (void*)&pad, sizeof(pad));
    }
#endif
  return sd;
}

static socket_descriptor_t
create_socket_tcp6 (void)
{
  socket_descriptor_t sd;

  if ((sd = socket (PF_INET6, SOCK_STREAM, IPPROTO_TCP)) < 0)
    msg (M_SOCKERR, "Cannot create TCP6 socket");

  /* set SO_REUSEADDR on socket */
  {
    int on = 1;
    if (setsockopt (sd, SOL_SOCKET, SO_REUSEADDR,
		    (void *) &on, sizeof (on)) < 0)
      msg (M_SOCKERR, "TCP: Cannot setsockopt SO_REUSEADDR on TCP6 socket");
  }

  return sd;
}

#endif
#ifdef USE_PF_UNIX
static socket_descriptor_t
create_socket_unix_dgram (void)
{
  socket_descriptor_t sd;

  if ((sd = socket (PF_UNIX, SOCK_DGRAM, 0)) < 0)
    msg (M_SOCKERR, "PF_UNIX: Cannot create datagram socket");
  return sd;
}
#endif

static void
create_socket (struct link_socket *sock)
{
  /* create socket */
  if (sock->info.proto == PROTO_UDPv4)
    {
      sock->sd = create_socket_udp (sock->socket_flags);

#ifdef ENABLE_SOCKS
      if (sock->socks_proxy)

    {
      sock->sd = create_socket_tcp ();
    }
#ifdef USE_PF_INET6
  else if (sock->info.proto == PROTO_TCPv6_SERVER
	   || sock->info.proto == PROTO_TCPv6_CLIENT)
    {
      sock->sd = create_socket_tcp6 ();
    }
  else if (sock->info.proto == PROTO_UDPv6)
    {
      sock->sd = create_socket_udp6 (sock->socket_flags);
    }
#endif
#ifdef USE_PF_UNIX
  else if (sock->info.proto == PROTO_UNIX_DGRAM)
    {
      sock->sd = create_socket_unix_dgram();
    }
#endif
  else
    {
      ASSERT (0);


static void
socket_do_listen (socket_descriptor_t sd,
		  const struct openvpn_sockaddr *local,
		  bool do_listen,
		  bool do_set_nonblock)
{

  if (do_listen)
    {
      msg (M_INFO, "Listening for incoming TCP connection on %s", 
	   print_link_sockaddr (local, &gc));
      if (listen (sd, 1))
	msg (M_SOCKERR, "TCP: listen() failed");
    }


socket_descriptor_t
socket_do_accept (socket_descriptor_t sd,
		  struct openvpn_sockaddr *act,
		  const bool nowait)
{
  /* af_addr_size WILL return 0 in this case if AFs other than AF_INET
   * are compiled because act is empty here.
   * could use getsockname() to support later remote_len check
   */
  socklen_t remote_len_af = af_addr_size(act->addr.sa.sa_family);
  socklen_t remote_len = sizeof(act->addr);
  socket_descriptor_t new_sd = SOCKET_UNDEFINED;

  CLEAR (*act);

#ifdef HAVE_GETPEERNAME
  if (nowait)
    {
      new_sd = getpeername (sd, &act->addr.sa, &remote_len);

      if (!socket_defined (new_sd))
	msg (D_LINK_ERRORS | M_ERRNO_SOCK, "TCP: getpeername() failed");

#endif
  else
    {
      new_sd = accept (sd, &act->addr.sa, &remote_len);
    }

#if 0 /* For debugging only, test the effect of accept() failures */

    {
      msg (D_LINK_ERRORS | M_ERRNO_SOCK, "TCP: accept(%d) failed", sd);
    }
  else if (remote_len_af && remote_len != remote_len_af) /* only check if we have remote_len_af!=0 */
    {
      msg (D_LINK_ERRORS, "TCP: Received strange incoming connection with unknown address length=%d", remote_len);
      openvpn_close_socket (new_sd);

}

static void
tcp_connection_established (const struct openvpn_sockaddr *remote)
{
  struct gc_arena gc = gc_new ();
  msg (M_INFO, "TCP connection established with %s", 
       print_link_sockaddr (remote, &gc));
  gc_free (&gc);
}

static int
socket_listen_accept (socket_descriptor_t sd,
		      struct openvpn_sockaddr *act,
		      const char *remote_dynamic,
		      bool *remote_changed,
		      const struct openvpn_sockaddr *local,
		      bool do_listen,
		      bool nowait,
		      volatile int *signal_received)
{
  struct gc_arena gc = gc_new ();
  struct openvpn_sockaddr remote_verify;
  int new_sd = SOCKET_UNDEFINED;
  addr_copy_sa(&remote_verify, act);
  CLEAR (*act);

  socket_do_listen (sd, local, do_listen, true);


	  continue;
	}

      new_sd = socket_do_accept (sd, act, nowait);

      if (socket_defined (new_sd))
	{
	  update_remote (remote_dynamic, &remote_verify, remote_changed);
	  if (addr_defined (&remote_verify)
	      && !addr_match (&remote_verify, act))
	    {
	      msg (M_WARN,
		   "TCP NOTE: Rejected connection attempt from %s due to --remote setting",
		   print_link_sockaddr (act, &gc));
	      if (openvpn_close_socket (new_sd))
		msg (M_SOCKERR, "TCP: close socket failed (new_sd)");
	    }

  if (!nowait && openvpn_close_socket (sd))
    msg (M_SOCKERR, "TCP: close socket failed (sd)");

  tcp_connection_established (act);

  gc_free (&gc);
  return new_sd;


static void
socket_connect (socket_descriptor_t *sd,
		struct openvpn_sockaddr *remote,
		struct remote_list *remote_list,
		const char *remote_dynamic,
		bool *remote_changed,

  struct gc_arena gc = gc_new ();

  msg (M_INFO, "Attempting to establish TCP connection with %s", 
       print_link_sockaddr (remote, &gc));
  while (true)
    {
      const int status = connect (*sd, &remote->addr.sa,
				  af_addr_size(remote->addr.sa.sa_family));

      get_signal (signal_received);
      if (*signal_received)


      msg (D_LINK_ERRORS | M_ERRNO_SOCK,
	   "TCP: connect to %s failed, will try again in %d seconds",
	   print_link_sockaddr (remote, &gc),
	   connect_retry_seconds);

      openvpn_close_socket (*sd);
      openvpn_sleep (connect_retry_seconds);

      switch(remote->addr.sa.sa_family) {
case AF_INET:
      if (remote_list)
	{
	  remote_list_next (remote_list);
	  remote_dynamic = remote_list_host (remote_list);
	  remote->addr.in.sin_port = htons (remote_list_port (remote_list));
	  *remote_changed = true;
	}

      *sd = create_socket_tcp ();
      update_remote (remote_dynamic, remote, remote_changed);
      break;
default:
      msg(M_FATAL, "Only TCP is supported for connection oriented, sa_family=%d", 
      	remote->addr.sa.sa_family);
    }
    }

  msg (M_INFO, "TCP connection established with %s", 
       print_link_sockaddr (remote, &gc));

 done:
  gc_free (&gc);

resolve_bind_local (struct link_socket *sock)
{
  struct gc_arena gc = gc_new ();
  int addrlen;

  /* resolve local address if undefined */
  if (!addr_defined (&sock->info.lsa->local))
    {
      switch(addr_guess_family(sock->info.proto, sock->local_host)) { /* may return AF_{INET|INET6|UNIX} guessed from local_host */
case AF_INET:
      sock->info.lsa->local.addr.in.sin_family = AF_INET;
      sock->info.lsa->local.addr.in.sin_addr.s_addr =
	(sock->local_host ? getaddr (GETADDR_RESOLVE | GETADDR_WARN_ON_SIGNAL | GETADDR_FATAL,
				     sock->local_host,
				     0,
				     NULL,
				     NULL)
	 : htonl (INADDR_ANY));
      sock->info.lsa->local.addr.in.sin_port = htons (sock->local_port);
      addrlen=sizeof(struct sockaddr_in);
      break;
#ifdef USE_PF_INET6
case AF_INET6:
{
      struct addrinfo hints , *ai;
      int err;
      memset(&hints, 0, sizeof hints);
      hints.ai_flags=AI_NUMERICHOST|AI_PASSIVE;
      hints.ai_family=AF_INET6;
      /* if no local_host provided, ask for IN6ADDR_ANY ... */
      if ((err=getaddrinfo(sock->local_host? sock->local_host : "::", 
	      NULL, &hints, &ai))==0) {
	sock->info.lsa->local.addr.in6 = *((struct sockaddr_in6*)(ai->ai_addr));
	freeaddrinfo(ai);
      } else {
	  msg (M_FATAL, "getaddrinfo() failed for local \"%s\": %s",
	  	sock->local_host,
		gai_strerror(err));
      }
      sock->info.lsa->local.addr.in6.sin6_port = htons (sock->local_port);
      addrlen=sizeof(struct sockaddr_in6);
      break;
}
#endif
#ifdef USE_PF_UNIX
case AF_UNIX:
      sock->info.lsa->local.addr.un.sun_family = AF_UNIX;
      strncpynt(sock->info.lsa->local.addr.un.sun_path, sock->local_host, sizeof(sock->info.lsa->local.addr.un.sun_path));
      addrlen=(offsetof (struct sockaddr_un, sun_path) + strlen (sock->info.lsa->local.addr.un.sun_path) + 1);

      break;
#endif
      }
    }
  
  /* bind to local address/port */
  if (sock->bind_local)
    {
      if (bind (sock->sd,  &sock->info.lsa->local.addr.sa, addrlen))
		sizeof (sock->info.lsa->local)))
	{
	  const int errnum = openvpn_errno_socket ();
	  msg (M_FATAL, "TCP/UDP: Socket bind failed on local address %s: %s",

      /* resolve remote address if undefined */
      if (!addr_defined (&sock->info.lsa->remote))
	{
	  switch(addr_guess_family(sock->info.proto, sock->remote_host)) 
	  {
case AF_INET:
	  sock->info.lsa->remote.addr.in.sin_family = AF_INET;
	  sock->info.lsa->remote.addr.in.sin_addr.s_addr = 0;

	  if (sock->remote_host)
	    {

		  ASSERT (0);
		}

	      sock->info.lsa->remote.addr.in.sin_addr.s_addr = getaddr (
		    flags,
		    sock->remote_host,
		    retry,

		}
	    }

	  sock->info.lsa->remote.addr.in.sin_port = htons (sock->remote_port);
	  break;
#ifdef USE_PF_INET6
case AF_INET6:
{
	  struct addrinfo hints , *ai;
	  int err;
	  memset(&hints, 0, sizeof hints);
	  hints.ai_flags=AI_NUMERICHOST;
	  hints.ai_family=AF_INET6;
	  if ((err=getaddrinfo(sock->remote_host? sock->remote_host : "::" , NULL, &hints, &ai))==0) {
	    sock->info.lsa->remote.addr.in6 = *((struct sockaddr_in6*)(ai->ai_addr));
	    freeaddrinfo(ai);
	  } else {
	    msg (M_FATAL, "getaddrinfo() failed for remote \"%s\": %s",
		sock->remote_host,
		gai_strerror(err));
	  }
	  sock->info.lsa->remote.addr.in6.sin6_port = htons (sock->remote_port);
	  break;
}
#endif
#ifdef USE_PF_UNIX
case AF_UNIX:
	sock->info.lsa->remote.addr.un.sun_family = AF_UNIX;
	if (sock->remote_host)
  	  strncpynt (sock->info.lsa->remote.addr.un.sun_path, sock->remote_host,
	     sizeof (sock->info.lsa->remote.addr.un.sun_path));
	else
  	  sock->info.lsa->remote.addr.un.sun_path[0] = 0;
	break;
#endif
	  }
	}
  
      /* should we re-use previous active remote address? */
      if (link_addr_defined (&sock->info.lsa->actual))
	{
	  msg (M_INFO, "TCP/UDP: Preserving recently used remote address: %s",
	       print_link_sockaddr (&sock->info.lsa->actual, &gc));
	  if (remote_dynamic)
	    *remote_dynamic = NULL;
	}

			 int connect_retry_seconds,
			 int mtu_discover_type,
			 int rcvbuf,
			 int sndbuf,
			 const unsigned int socket_flags)
{
  const char *remote_host;
  int remote_port;

  sock->socket_buffer_sizes.rcvbuf = rcvbuf;
  sock->socket_buffer_sizes.sndbuf = sndbuf;

  sock->socket_flags = socket_flags;

  sock->info.proto = proto;
  sock->info.remote_float = remote_float;
  sock->info.lsa = lsa;

	goto done;

      /* TCP client/server */
      if (sock->info.proto == PROTO_TCPv4_SERVER || sock->info.proto == PROTO_TCPv6_SERVER)
	{
	  switch (sock->mode)
	    {

	      ASSERT (0);
	    }
	}
      else if (sock->info.proto == PROTO_TCPv4_CLIENT || sock->info.proto == PROTO_TCPv6_CLIENT)
	{
	  socket_connect (&sock->sd,
			  &sock->info.lsa->actual,

	  sock->remote_host = sock->proxy_dest_host;
	  sock->remote_port = sock->proxy_dest_port;
	  sock->did_resolve_remote = false;
	  addr_zero_host(&sock->info.lsa->actual);
	  addr_zero_host(&sock->info.lsa->remote);

	  resolve_remote (sock, 1, NULL, signal_received);


      if (remote_changed)
	{
	  msg (M_INFO, "TCP/UDP: Dynamic remote address changed during TCP connection establishment");
	  addr_copy_host(&sock->info.lsa->remote, &sock->info.lsa->actual);
	}
    }



#if EXTENDED_SOCKET_ERROR_CAPABILITY
  /* if the OS supports it, enable extended error passing on the socket */
  if (addr_inet4or6(&sock->info.lsa->local.addr.sa))
	  set_sock_extended_error_passing (sock->sd);
#endif

  /* print local address */

    msg (M_INFO, "%s link local%s: %s",
	 proto2ascii (sock->info.proto, true),
	 (sock->bind_local ? " (bound)" : ""),
	 print_sockaddr_ex (&sock->info.lsa->local, ":", sock->bind_local ? PS_SHOW_PORT: 0, &gc));

  /* print active remote address */
  msg (M_INFO, "%s link remote: %s",
       proto2ascii (sock->info.proto, true),
       print_sockaddr_ex (&sock->info.lsa->actual, ":", PS_SHOW_PORT_IF_DEFINED|PS_SHOW_PKTINFO, &gc));

 done:
  if (sig_save && signal_received)

void
link_socket_connection_initiated (const struct buffer *buf,
				  struct link_socket_info *info,
				  const struct openvpn_sockaddr *act,
				  const char *common_name,
				  struct env_set *es)
{
  struct gc_arena gc = gc_new ();
  
  /* acquire script mutex */
  //mutex_lock_static (L_SCRIPT);

  //addr_copy(&info->lsa->actual.addr.sa, addr); /* Note: skip this line for --force-dest */
  info->lsa->actual = *act; /* Note: skip this line for --force-dest */
  setenv_trusted (es, info);
  info->connection_established = true;


    struct buffer out = alloc_buf_gc (256, &gc);
    if (common_name)
      buf_printf (&out, "[%s] ", common_name);
    buf_printf (&out, "Peer Connection Initiated with %s", print_link_sockaddr (&info->lsa->actual, &gc));
    msg (M_INFO, "%s", BSTR (&out));
  }


  /* Process --ipchange plugin */
  if (plugin_defined (info->plugins, OPENVPN_PLUGIN_IPCHANGE))
    {
      const char *addr_ascii = print_sockaddr_ex (&info->lsa->actual, " ", PS_SHOW_PORT, &gc);
      if (plugin_call (info->plugins, OPENVPN_PLUGIN_IPCHANGE, addr_ascii, es))
	msg (M_WARN, "WARNING: ipchange plugin call failed");
    }

      setenv_str (es, "script_type", "ipchange");
      buf_printf (&out, "%s %s",
		  info->ipchange_command,
		  print_sockaddr_ex (&info->lsa->actual, " ", PS_SHOW_PORT, &gc));
      system_check (BSTR (&out), es, S_SCRIPT, "ip-change command failed");
    }


void
link_socket_bad_incoming_addr (struct buffer *buf,
			       const struct link_socket_info *info,
			       const struct openvpn_sockaddr *from_addr)
{
  struct gc_arena gc = gc_new ();

  switch(from_addr->addr.sa.sa_family) {
case AF_INET:
  msg (D_LINK_ERRORS,
       "TCP/UDP: Incoming packet rejected from %s[%d], expected peer address: %s (allow this incoming source address/port by removing --remote or adding --float)",
       print_link_sockaddr (from_addr, &gc),
       (int)from_addr->addr.sa.sa_family,
       print_sockaddr (&info->lsa->remote, &gc));
  break;
#ifdef USE_PF_INET6
case AF_INET6:
  msg (D_LINK_ERRORS,
       "TCP/UDP: Incoming packet rejected from %s[%d], expected peer address: %s (allow this incoming source address/port by removing --remote or adding --float)",
       print_link_sockaddr (from_addr, &gc),
       (int)from_addr->addr.sa.sa_family,
       print_sockaddr (&info->lsa->remote, &gc));
  break;
#endif
#ifdef USE_PF_UNIX
case AF_UNIX:
  msg (D_LINK_ERRORS,
       "AF_UNIX: Incoming packet rejected from %s[%d], expected peer address: %s (allow this incoming source by removing --remote or adding --float)",
       print_sockaddr (from_addr, &gc),
       (int)from_addr->addr.sa.sa_family,
       print_sockaddr (&info->lsa->remote, &gc));
  break;
#endif
  }
  buf->len = 0;

  gc_free (&gc);
}


{
  const struct link_socket_addr *lsa = info->lsa;

/* 
 * This logic supports "redirect-gateway" semantic, which 
 * makes sense only for PF_INET routes over PF_INET endpoints
 *
 * Maybe in the future consider PF_INET6 endpoints also ...
 * by now just ignore it
 *
 */
#if defined ( USE_PF_INET6 ) || defined ( USE_PF_UNIX )
  if(lsa->actual.addr.sa.sa_family != AF_INET)
	  return 0;
#else
  ASSERT(lsa->actual.addr.sa.sa_family == AF_INET);
#endif
  if (addr_defined (&lsa->actual))
    return ntohl (lsa->actual.addr.in.sin_addr.s_addr);
  else if (addr_defined (&lsa->remote))
    return ntohl (lsa->remote.addr.in.sin_addr.s_addr);
  else
    return 0;
}

 */

const char *
print_sockaddr (const struct openvpn_sockaddr *addr, struct gc_arena *gc)
{
  return print_sockaddr_ex(addr, ":", PS_SHOW_PORT, gc);
}

const char *
print_sockaddr_ex (const struct openvpn_sockaddr *addr, const char* separator, int flags, struct gc_arena *gc)
{
  struct buffer out;
  bool addr_is_defined;
  
  if (!addr) {
    return "[NULL]";
  }
  addr_is_defined =  addr_defined (addr);
  switch(addr->addr.sa.sa_family) {
case AF_INET: {
  const int port= ntohs (addr->addr.in.sin_port);
  out = alloc_buf_gc (128, gc);
  buf_puts (&out, "[AF_INET]");
  mutex_lock_static (L_INET_NTOA);
  buf_puts (&out, (addr_is_defined ? inet_ntoa (addr->addr.in.sin_addr) : "[undef]"));
  mutex_unlock_static (L_INET_NTOA);

  if (((flags & PS_SHOW_PORT) || (addr_is_defined && (flags & PS_SHOW_PORT_IF_DEFINED)))
       && port)
    {
      if (separator)
	buf_printf (&out, "%s", separator);

      buf_printf (&out, "%d", port);
    }
#if ENABLE_IP_PKTINFO
  if ((flags & PS_SHOW_PKTINFO) && addr_defined_ipi(addr))
    {
      buf_printf (&out, " (via %s)", inet_ntoa (addr->pi.in.ipi_spec_dst));
    }
#endif
  }
  break;
#ifdef USE_PF_INET6
case AF_INET6: {
  const int port= ntohs (addr->addr.in6.sin6_port);
  char buf[INET6_ADDRSTRLEN] = "[undef]";
  out = alloc_buf_gc (128, gc);
  buf_puts (&out, "[AF_INET6]");
  if (addr_is_defined)
    {
      getnameinfo(&addr->addr.sa, sizeof (struct sockaddr_in6),
        buf, sizeof (buf), NULL, 0, NI_NUMERICHOST);
      buf_puts (&out, buf);
    }
  if (((flags & PS_SHOW_PORT) || (addr_is_defined && (flags & PS_SHOW_PORT_IF_DEFINED)))
       && port)
    {
      if (separator)
	buf_puts (&out, separator);

      buf_printf (&out, "%d", port);
    }
#if ENABLE_IP_PKTINFO
  if ((flags & PS_SHOW_PKTINFO) && addr_defined_ipi(addr))
    {
      struct sockaddr_in6 sin6;
      memset(&sin6, 0, sizeof sin6);
      sin6.sin6_family = AF_INET6;
      sin6.sin6_addr = addr->pi.in6.ipi6_addr;
      {
        if (getnameinfo((struct sockaddr *)&sin6, sizeof (struct sockaddr_in6),
				buf, sizeof (buf), NULL, 0, NI_NUMERICHOST) == 0)
      	  buf_printf (&out, " (via %s)", buf);
	else
      	  buf_printf (&out, " (via [getnameinfo() err])");
      }
    }
#endif
  }
  break;
#endif
#ifdef USE_PF_UNIX
case AF_UNIX: {
  out = alloc_buf_gc (sizeof (addr->addr.un.sun_path)+9 /* "[AF_UNIX]" */+1, gc);
  buf_puts (&out, "[AF_UNIX]");
  buf_puts (&out, addr->addr.un.sun_path);
  }
  break;
#endif
default: 
    return "[NO address family defined]";
  }
  return BSTR (&out);
}


  return BSTR (&out);
}

const char *
print_link_sockaddr (const struct openvpn_sockaddr *act, struct gc_arena *gc)
{
  return print_sockaddr_ex (act, ":", PS_SHOW_PORT|PS_SHOW_PKTINFO, gc);
}

/* set environmental variables for ip/port in *addr */
void
setenv_sockaddr (struct env_set *es, const char *name_prefix, const struct openvpn_sockaddr *addr, const bool flags)
{
  char name_buf[256];
  char buf[128];

  switch(addr->addr.sa.sa_family) {
case AF_INET:
  if (flags & SA_IP_PORT)
    openvpn_snprintf (name_buf, sizeof (name_buf), "%s_ip", name_prefix);
  else
    openvpn_snprintf (name_buf, sizeof (name_buf), "%s", name_prefix);

  mutex_lock_static (L_INET_NTOA);
  setenv_str (es, name_buf, inet_ntoa (addr->addr.in.sin_addr));
  mutex_unlock_static (L_INET_NTOA);

  if ((flags & SA_IP_PORT) && (addr->addr.in.sin_port))
    {
      openvpn_snprintf (name_buf, sizeof (name_buf), "%s_port", name_prefix);
      setenv_int (es, name_buf, ntohs (addr->addr.in.sin_port));
    }
  break;
#ifdef USE_PF_INET6
case AF_INET6:
  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_ip6", name_prefix);
  getnameinfo(&addr->addr.sa, sizeof (struct sockaddr_in6),
  	buf, sizeof(buf), NULL, 0, NI_NUMERICHOST);
  setenv_str (es, name_buf, buf);

  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_port", name_prefix);
  setenv_int (es, name_buf, ntohs (addr->addr.in6.sin6_port));
  break;
#endif
#ifdef USE_PF_UNIX
case AF_UNIX:
  openvpn_snprintf (name_buf, sizeof (name_buf), "%s_path", name_prefix);
  setenv_str (es, name_buf, addr->addr.un.sun_path);
  break;
#endif
  }
}

void

{
  if (addr || !(flags & SA_SET_IF_NONZERO))
    {
      struct openvpn_sockaddr osa;
      CLEAR (osa);
      osa.addr.in.sin_family = AF_INET;
      osa.addr.in.sin_addr.s_addr = htonl (addr);
      setenv_sockaddr (es, name_prefix, &osa, flags);
    }
}


/*
 * Convert protocol names between index and ascii form.
 */

struct proto_names {
  const char *short_form;
  const char *display_form;
  bool	is_dgram;
  bool	is_net;
  sa_family_t proto_af;
};

/* Indexed by PROTO_x */
static const struct proto_names proto_names[PROTO_N] = {
  {"proto-uninitialized",        "proto-NONE",0,0, AF_UNSPEC},
  {"udp",        "UDPv4",1,1, AF_INET},
  {"tcp-server", "TCPv4_SERVER",0,1, AF_INET},
  {"tcp-client", "TCPv4_CLIENT",0,1, AF_INET},
  {"tcp",        "TCPv4",0,1, AF_INET},
#ifdef USE_PF_INET6
  {"udp6"       ,"UDPv6",1,1, AF_INET6},
  {"tcp6-server","TCPv6_SERVER",0,1, AF_INET6},
  {"tcp6-client","TCPv6_CLIENT",0,1, AF_INET6},
  {"tcp6"       ,"TCPv6",0,1, AF_INET6},
#endif
#ifdef USE_PF_UNIX
  {"unix-dgram" ,"UNIX_DGRAM",1,0, AF_UNIX },
  {"unix-stream","UNIX_STREAM",1,0, AF_UNIX }
#endif
};

bool
proto_is_net(int proto)
{
  if (proto < 0 || proto >= PROTO_N)
    ASSERT(0);
  return proto_names[proto].is_net;
}
bool
proto_is_dgram(int proto)
{
  if (proto < 0 || proto >= PROTO_N)
    ASSERT(0);
  return proto_names[proto].is_dgram;
}
bool
proto_is_udp(int proto)
{
  if (proto < 0 || proto >= PROTO_N)
    ASSERT(0);
  return proto_names[proto].is_dgram&&proto_names[proto].is_net;
}
bool
proto_is_tcp(int proto)
{
  if (proto < 0 || proto >= PROTO_N)
    ASSERT(0);
  return (!proto_names[proto].is_dgram)&&proto_names[proto].is_net;
}

sa_family_t 
proto_sa_family(int proto)
{
  if (proto < 0 || proto >= PROTO_N)
    ASSERT(0);
  return proto_names[proto].proto_af;
}

int
ascii2proto (const char* proto_name)
{

  int i;

  ASSERT (PROTO_N == SIZE (proto_names));
  for (i = 1; i < PROTO_N; ++i) /* skip first slot */
    {
      if (i)
	buf_printf(&out, " ");

  return BSTR (&out);
}


int
addr_guess_family(int proto, const char *name) 
{
  sa_family_t ret;
  if (proto) {
    return proto_sa_family(proto);	/* already stamped */
  } 
#ifdef USE_PF_UNIX
  else if (name && name[0] == '/') {
    return AF_UNIX;
  }
#endif
#ifdef USE_PF_INET6
  else {
    struct addrinfo hints , *ai;
    int err;
    memset(&hints, 0, sizeof hints);
    hints.ai_flags=AI_NUMERICHOST;
    if ((err=getaddrinfo(name, NULL, &hints, &ai))==0) {
      ret=ai->ai_family;
      freeaddrinfo(ai);
      return ret;
    }
  }
#endif
  return AF_INET;	/* default */
}
const char *
addr_family_name (int af) 
{
  switch (af) {
    case AF_INET: return "AF_INET";
    case AF_INET6: return "AF_INET6";
#ifdef USE_PF_UNIX
    case AF_UNIX: return "AF_UNIX";
#endif
  }
  return "AF_UNSPEC";
}

/*
 * Given a local proto, return local proto
 * if !remote, or compatible remote proto


#ifndef WIN32

#if ENABLE_IP_PKTINFO

struct openvpn_in_pktinfo
{
  struct cmsghdr cmsghdr;
  struct in_pktinfo pi;
};
#ifdef USE_PF_INET6
struct openvpn_in6_pktinfo
{
  struct cmsghdr cmsghdr;
  struct in6_pktinfo pi6;
};
#endif

union openvpn_pktinfo {
	struct openvpn_in_pktinfo cmsgpi;
#ifdef USE_PF_INET6
	struct openvpn_in6_pktinfo cmsgpi6;
#endif
};

/* UDPv4 and UDPv6 */
static socklen_t
link_socket_read_udp_posix_recvmsg (struct link_socket *sock,
				    struct buffer *buf,
				    int maxsize,
				    struct openvpn_sockaddr *from)
{
  struct iovec iov;
  union openvpn_pktinfo opi;
  struct msghdr mesg;
  socklen_t fromlen = sizeof (from->addr);

  iov.iov_base = BPTR (buf);
  iov.iov_len = maxsize;
  mesg.msg_iov = &iov;
  mesg.msg_iovlen = 1;
  mesg.msg_name = &from->addr;
  mesg.msg_namelen = fromlen;
  mesg.msg_control = &opi;
  mesg.msg_controllen = sizeof (opi);
  buf->len = recvmsg (sock->sd, &mesg, 0);
  if (buf->len >= 0)
    {
      struct cmsghdr *cmsg;
      fromlen = mesg.msg_namelen;
      cmsg = CMSG_FIRSTHDR (&mesg);
      if (cmsg != NULL
	  && CMSG_NXTHDR (&mesg, cmsg) == NULL
	  && cmsg->cmsg_level == SOL_IP 
	  && cmsg->cmsg_type == IP_PKTINFO
	  && cmsg->cmsg_len >= sizeof (struct openvpn_in_pktinfo))
	{
	  struct in_pktinfo *pkti = (struct in_pktinfo *) CMSG_DATA (cmsg);
	  from->pi.in.ipi_ifindex = pkti->ipi_ifindex;
	  from->pi.in.ipi_spec_dst = pkti->ipi_spec_dst;
	}
#ifdef USE_PF_INET6
      else if (cmsg != NULL
	  && CMSG_NXTHDR (&mesg, cmsg) == NULL
	  && cmsg->cmsg_level == IPPROTO_IPV6 
	  && cmsg->cmsg_type == IPV6_PKTINFO
	  && cmsg->cmsg_len >= sizeof (struct openvpn_in6_pktinfo))
	{
	  struct in6_pktinfo *pkti6 = (struct in6_pktinfo *) CMSG_DATA (cmsg);
	  from->pi.in6.ipi6_ifindex = pkti6->ipi6_ifindex;
	  from->pi.in6.ipi6_addr = pkti6->ipi6_addr;
	}
#endif
    }
  return fromlen;
}
#endif

/* UDPv4 and UDPv6 */
int
link_socket_read_udp_posix (struct link_socket *sock,
			    struct buffer *buf,
			    int maxsize,
			    struct openvpn_sockaddr *from)
{
  socklen_t fromlen = sizeof (from->addr);
  socklen_t expectedlen = af_addr_size(proto_sa_family(sock->info.proto));
  CLEAR (*from);
  ASSERT (buf_safe (buf, maxsize));
#if ENABLE_IP_PKTINFO
  /* if (sock->info.proto == PROTO_UDPv4 && sock->socket_flags & SF_USE_IP_PKTINFO) */
  /* Both PROTO_UDPv4 and PROTO_UDPv6 */
  if (proto_is_udp(sock->info.proto) && sock->socket_flags & SF_USE_IP_PKTINFO)
    fromlen = link_socket_read_udp_posix_recvmsg (sock, buf, maxsize, from);
  else
#endif
    buf->len = recvfrom (sock->sd, BPTR (buf), maxsize, 0,
		       &from->addr.sa, &fromlen);
  if (buf->len >= 0 && expectedlen && fromlen != expectedlen)
    bad_address_length (fromlen, expectedlen);
  return buf->len;
}

#endif

#ifdef USE_PF_UNIX

int
link_socket_read_unix_dgram (struct link_socket *sock,
			    struct buffer *buf,
			    int maxsize,
			    struct sockaddr_un *from)
{
  socklen_t fromlen = sizeof (*from);
  CLEAR (*from);
  ASSERT (buf_safe (buf, maxsize));
  /* PF_UNIX DGRAM */
  buf->len = recvfrom (sock->sd, BPTR (buf), maxsize, 0,
		       (struct sockaddr *) from, &fromlen);
  if (fromlen > sizeof (*from))
    bad_address_length (fromlen, sizeof (*from)); /* jjo: XXX: actually excessive_addr_len() */
  return buf->len;
}

#endif

/*
 * Socket Write Routines
 */

int
link_socket_write_tcp (struct link_socket *sock,
		       struct buffer *buf,
		       struct openvpn_sockaddr *to)
{
  packet_size_type len = BLEN (buf);
  dmsg (D_STREAM_DEBUG, "STREAM: WRITE %d offset=%d", (int)len, buf->offset);

#endif
}

#if ENABLE_IP_PKTINFO

int
link_socket_write_udp_posix_sendmsg (struct link_socket *sock,
				     struct buffer *buf,
				     struct openvpn_sockaddr *to)
{
  struct iovec iov;
  struct msghdr mesg;
  struct cmsghdr *cmsg;

  /* ASSERT(sock->info.lsa->remote.addr.in.sin_family == AF_INET); */
  iov.iov_base = BPTR (buf);
  iov.iov_len = BLEN (buf);
  mesg.msg_iov = &iov;
  mesg.msg_iovlen = 1;
  switch (sock->info.lsa->remote.addr.sa.sa_family) {
    case AF_INET: {
	  struct openvpn_in_pktinfo opi;
	  struct in_pktinfo *pkti;
	  mesg.msg_name = &to->addr.sa;
	  mesg.msg_namelen = sizeof (struct sockaddr_in);
	  mesg.msg_control = &opi;
	  mesg.msg_controllen = sizeof (opi);
	  mesg.msg_flags = 0;
	  cmsg = CMSG_FIRSTHDR (&mesg);
	  cmsg->cmsg_len = sizeof (opi);
	  cmsg->cmsg_level = SOL_IP;
	  cmsg->cmsg_type = IP_PKTINFO;
	  pkti = (struct in_pktinfo *) CMSG_DATA (cmsg);
	  pkti->ipi_ifindex = to->pi.in.ipi_ifindex;
	  pkti->ipi_spec_dst = to->pi.in.ipi_spec_dst;
	  pkti->ipi_addr.s_addr = 0;
	  break;
    }
#ifdef USE_PF_INET6
    case AF_INET6: {
	  struct openvpn_in6_pktinfo opi6;
	  struct in6_pktinfo *pkti6;
	  mesg.msg_name = &to->addr.sa;
	  mesg.msg_namelen = sizeof (struct sockaddr_in6);
	  mesg.msg_control = &opi6;
	  mesg.msg_controllen = sizeof (opi6);
	  mesg.msg_flags = 0;
	  cmsg = CMSG_FIRSTHDR (&mesg);
	  cmsg->cmsg_len = sizeof (opi6);
	  cmsg->cmsg_level = IPPROTO_IPV6;
	  cmsg->cmsg_type = IPV6_PKTINFO;
	  pkti6 = (struct in6_pktinfo *) CMSG_DATA (cmsg);
	  pkti6->ipi6_ifindex = to->pi.in6.ipi6_ifindex;
	  pkti6->ipi6_addr = to->pi.in6.ipi6_addr;
	  break;
    }
#endif
    default: ASSERT(0);
  }
  return sendmsg (sock->sd, &mesg, 0);
}

#endif


/*
 * Win32 overlapped socket I/O functions.
 */




/* convert a packet_size_type from network to host order */
#define ntohps(x) ntohs(x)

struct openvpn_sockaddr {
	union {
		struct sockaddr sa;
		struct sockaddr_in in;
#ifdef USE_PF_INET6
		struct sockaddr_in6 in6;
#endif
#ifdef USE_PF_UNIX
		struct sockaddr_un un;
#endif
	} addr;
#if ENABLE_IP_PKTINFO
	union {
		struct in_pktinfo in;
#ifdef USE_PF_INET6
		struct in6_pktinfo in6;
#endif
	} pi;	/* Multihome support for UDP */
#endif
};
/* IP addresses which are persistant across SIGUSR1s */
struct link_socket_addr
{
	struct openvpn_sockaddr local;
	struct openvpn_sockaddr remote;
	struct openvpn_sockaddr actual;
};

struct link_socket_info

  struct stream_buf stream_buf;
  struct buffer stream_buf_data;
  bool stream_reset;
# define SF_USE_IP_PKTINFO (1<<0)
  unsigned int socket_flags;

#ifdef ENABLE_HTTP_PROXY
  /* HTTP proxy */

#ifdef ENABLE_SOCKS
  /* Socks proxy */
  struct socks_proxy_info *socks_proxy;
  struct openvpn_sockaddr  socks_relay; /* Socks UDP relay address */
#endif

#if defined(ENABLE_HTTP_PROXY) || defined(ENABLE_SOCKS)

			 int connect_retry_seconds,
			 int mtu_discover_type,
			 int rcvbuf,
			 int sndbuf,
			 const unsigned int flags);

void link_socket_init_phase2 (struct link_socket *sock,
			      const struct frame *frame,


void link_socket_close (struct link_socket *sock);

#define PS_SHOW_PORT_IF_DEFINED (1<<0)
#define PS_SHOW_PORT            (1<<1)
#define PS_SHOW_PKTINFO         (1<<2)
const char *print_sockaddr_ex (const struct openvpn_sockaddr *addr,
			       const char* separator,
			       int flags,
			       struct gc_arena *gc);

const char *print_sockaddr (const struct openvpn_sockaddr *addr,
			    struct gc_arena *gc);
const char *print_link_sockaddr (const struct openvpn_sockaddr *act,
				      struct gc_arena *gc);


int addr_guess_type(int proto, const char *name);
#define IA_EMPTY_IF_UNDEF (1<<0)
#define IA_NET_ORDER      (1<<1)
const char *print_in_addr_t (in_addr_t addr, unsigned int flags, struct gc_arena *gc);

#define SA_SET_IF_NONZERO (1<<1)
void setenv_sockaddr (struct env_set *es,
		      const char *name_prefix,
		      const struct openvpn_sockaddr *addr,
		      const bool flags);

void setenv_in_addr_t (struct env_set *es,
		       const char *name_prefix,
		       in_addr_t addr,
		       const bool flags);

void bad_address_length (int actual, int expected);

in_addr_t link_socket_current_remote (const struct link_socket_info *info);

void link_socket_connection_initiated (const struct buffer *buf,
				       struct link_socket_info *info,
				       const struct openvpn_sockaddr *addr,
				       const char *common_name,
				       struct env_set *es);

void link_socket_bad_incoming_addr (struct buffer *buf,
				    const struct link_socket_info *info,
				    const struct openvpn_sockaddr *from_addr);

void link_socket_bad_outgoing_addr (void);


socket_descriptor_t create_socket_tcp (void);

socket_descriptor_t socket_do_accept (socket_descriptor_t sd,
				      struct openvpn_sockaddr *act,
				      const bool nowait);

/*
 * proto related
 */
bool proto_is_net(int proto);
bool proto_is_dgram(int proto);
bool proto_is_udp(int proto);
bool proto_is_tcp(int proto);


/*
 * DNS resolution
 */


 * Transport protocol naming and other details.
 */

#if 0 /* PRE UDPv6/TCPv6 code */
#define PROTO_NONE         0 /* catch for uninitialized */
#define PROTO_UDPv4        1
#define PROTO_TCPv4_SERVER 2
#define PROTO_TCPv4_CLIENT 3
#define PROTO_TCPv4        4
#define PROTO_UDPv6        5
#define PROTO_TCPv6_SERVER 6
#define PROTO_TCPv6_CLIENT 7
#define PROTO_TCPv6        8
#define PROTO_UNIX_DGRAM   9
#define PROTO_UNIX_STREAM  10
#define PROTO_N            11
#endif

/* 
 * Use enum's instead of #define to allow for easier
 * optional proto support
 */
enum proto_num {
	PROTO_NONE, /* catch for uninitialized */
	PROTO_UDPv4,
	PROTO_TCPv4_SERVER,
	PROTO_TCPv4_CLIENT,
	PROTO_TCPv4,
	PROTO_UDPv6,
	PROTO_TCPv6_SERVER,
	PROTO_TCPv6_CLIENT,
	PROTO_TCPv6,
	PROTO_UNIX_DGRAM,
	PROTO_UNIX_STREAM,
	PROTO_N
};

int ascii2proto (const char* proto_name);
const char *proto2ascii (int proto, bool display_form);
const char *proto2ascii_all (struct gc_arena *gc);
int proto_remote (int proto, bool remote);
const char *addr_family_name(int af);

/*
 * Overhead added to packets by various protocols.
 */
#define IPv4_UDP_HEADER_SIZE              28
#define IPv4_TCP_HEADER_SIZE              40
#define IPv6_UDP_HEADER_SIZE              48
#define IPv6_TCP_HEADER_SIZE              60

static const int proto_overhead[PROTO_N] = { /* indexed by PROTO_x */
  0,
  IPv4_UDP_HEADER_SIZE, /* IPv4 */
  IPv4_TCP_HEADER_SIZE,
  IPv4_TCP_HEADER_SIZE,
  IPv4_TCP_HEADER_SIZE,
#ifdef USE_PF_INET6
  IPv6_UDP_HEADER_SIZE, /* IPv6 */
  IPv6_TCP_HEADER_SIZE,
  IPv6_TCP_HEADER_SIZE,
  IPv6_TCP_HEADER_SIZE,
#endif
#ifdef USE_PF_UNIX
  0,			/* AF_UNIX proxies, assume no overhead */
  0,
#endif
};

static inline int

static inline bool
link_socket_proto_connection_oriented (int proto)
{
  return !proto_is_dgram(proto);
}

static inline bool

  else
    return false;
}

static inline bool
addr_defined (const struct openvpn_sockaddr *addr)
{
  if (!addr) return 0;
  switch (addr->addr.sa.sa_family) {
    case AF_INET: return addr->addr.in.sin_addr.s_addr != 0;
#ifdef USE_PF_UNIX
    case AF_UNIX: return addr->addr.un.sun_path[0] != 0;
#endif
#ifdef USE_PF_INET6
    case AF_INET6: return !IN6_IS_ADDR_UNSPECIFIED(&addr->addr.in6.sin6_addr);
#endif
    default: return 0;
  }
}
static inline bool
addr_defined_ipi (const struct openvpn_sockaddr *addr)
{
#if ENABLE_IP_PKTINFO
  if (!addr) return 0;
  switch (addr->addr.sa.sa_family) {
    case AF_INET: return addr->pi.in.ipi_spec_dst.s_addr != 0;
#ifdef USE_PF_UNIX
    case AF_UNIX: ASSERT(0);
#endif
#ifdef USE_PF_INET6
    case AF_INET6: return !IN6_IS_ADDR_UNSPECIFIED(&addr->pi.in6.ipi6_addr);
#endif
    default: return 0;
  }
#else
  ASSERT(0);
#endif
}
static inline bool
addr_defined_sa (const struct sockaddr *addr)
{
	struct openvpn_sockaddr osa;
	memcpy(&osa.addr.sa, addr, sizeof (osa.addr));
	return addr_defined(&osa);
}

static inline bool
link_addr_defined (const struct openvpn_sockaddr *act)
{
  return addr_defined (act);
}
static inline bool
addr_match (const struct openvpn_sockaddr *a1, const struct openvpn_sockaddr *a2)
{
  switch(a1->addr.sa.sa_family) {
    case AF_INET:
      return a1->addr.in.sin_addr.s_addr == a2->addr.in.sin_addr.s_addr;
#ifdef USE_PF_UNIX
    case AF_UNIX:
      return strncmp(a1->addr.un.sun_path, a2->addr.un.sun_path, sizeof (a1->addr.un.sun_path)) == 0;
#endif
#ifdef USE_PF_INET6
    case AF_INET6:
      return IN6_ARE_ADDR_EQUAL(&a1->addr.in6.sin6_addr, &a2->addr.in6.sin6_addr);
#endif
  }
  ASSERT(0);
  return false;
}

static inline in_addr_t
addr_host (const struct openvpn_sockaddr *addr)
{
  /* 
   * "public" addr returned is checked against ifconfig for
   * possible clash: non sense for now given
   * that we do ifconfig only IPv4
   */
#if defined(USE_PF_INET6) || defined(USE_PF_UNIX)
  if(addr->addr.sa.sa_family != AF_INET)
    return 0;
#else 
  ASSERT(addr->addr.sa.sa_family == AF_INET);
#endif
  return ntohl (addr->addr.in.sin_addr.s_addr);
}

static inline bool
addr_port_match (const struct openvpn_sockaddr *a1, const struct openvpn_sockaddr *a2)
{
  switch(a1->addr.sa.sa_family) {
    case AF_INET:
      return a1->addr.in.sin_addr.s_addr == a2->addr.in.sin_addr.s_addr
	&& a1->addr.in.sin_port == a2->addr.in.sin_port;
#ifdef USE_PF_UNIX
    case AF_UNIX:
      return strncmp(a1->addr.un.sun_path, a2->addr.un.sun_path, sizeof (a1->addr.un.sun_path)) == 0;
#endif
#ifdef USE_PF_INET6
    case AF_INET6:
      return IN6_ARE_ADDR_EQUAL(&a1->addr.in6.sin6_addr, &a2->addr.in6.sin6_addr) 
	&& a1->addr.in6.sin6_port == a2->addr.in6.sin6_port;
#endif
  }
  ASSERT(0);
  return false;
}

static inline bool
addr_match_proto (const struct openvpn_sockaddr *a1,
		  const struct openvpn_sockaddr *a2,
		  const int proto)
{
  return link_socket_proto_connection_oriented (proto)

    : addr_port_match (a1, a2);
}

static inline void
addr_copy_sa(struct openvpn_sockaddr *dst, const struct openvpn_sockaddr *src)
{
  dst->addr = src->addr;
}

static inline void
addr_copy_host(struct openvpn_sockaddr *dst, const struct openvpn_sockaddr *src)
{
   switch(src->addr.sa.sa_family) {
     case AF_INET:
       dst->addr.in.sin_addr.s_addr = src->addr.in.sin_addr.s_addr;
       break;
#ifdef USE_PF_UNIX
     case AF_UNIX:
       strncpynt(dst->addr.un.sun_path, src->addr.un.sun_path, sizeof dst->addr.un.sun_path);
       break;
#endif
#ifdef USE_PF_INET6
     case AF_INET6: 
       dst->addr.in6.sin6_addr = src->addr.in6.sin6_addr;
       break;
#endif
   }
}


static inline void
addr_zero_host(struct openvpn_sockaddr *addr)
{
   switch(addr->addr.sa.sa_family) {
     case AF_INET:
       addr->addr.in.sin_addr.s_addr = 0;
       break;
#ifdef USE_PF_UNIX
     case AF_UNIX:
       *addr->addr.un.sun_path=0;
       break;
#endif
#ifdef USE_PF_INET6
     case AF_INET6: 
       memset(&addr->addr.in6.sin6_addr, 0, sizeof (struct in6_addr));
       break;
#endif
   }
}

static inline bool
addr_inet4or6(struct sockaddr *addr)
{
	return addr->sa_family == AF_INET || addr->sa_family == AF_INET6;
}
int
addr_guess_family(int proto, const char *name);

static inline int
af_addr_size(sa_family_t af)
{
#if defined(USE_PF_INET6) || defined (USE_PF_UNIX)
   switch(af) {
     case AF_INET: return sizeof (struct sockaddr_in);
#ifdef USE_PF_UNIX
     case AF_UNIX: return sizeof (struct sockaddr_un);
#endif
#ifdef USE_PF_INET6
     case AF_INET6: return sizeof (struct sockaddr_in6);
#endif
     default: 
#if 0
      /* could be called from socket_do_accept() with empty addr */
      msg (M_ERR, "Bad address family: %d\n", addr->sa_family);
      ASSERT(0);
#endif
     	return 0;
   }
#else /* only AF_INET */
   return sizeof(struct sockaddr_in);
#endif
}


static inline bool
link_addr_port_match (const struct openvpn_sockaddr *a1, const struct openvpn_sockaddr *a2)
{
  return addr_port_match (a1, a2);
}

static inline bool
socket_connection_reset (const struct link_socket *sock, int status)
{

static inline bool
link_socket_verify_incoming_addr (struct buffer *buf,
				  const struct link_socket_info *info,
				  const struct openvpn_sockaddr *from_addr)
{
  if (buf->len > 0)
    {
      switch (from_addr->addr.sa.sa_family) {
#ifdef USE_PF_UNIX
	case AF_UNIX:
#endif
#ifdef USE_PF_INET6
	case AF_INET6:
#endif
	case AF_INET:
	  if (!addr_defined (from_addr))
	    return false;
	  if (info->remote_float || !addr_defined (&info->lsa->remote))
	    return true;
	  if (addr_match_proto (from_addr, &info->lsa->remote, info->proto))
	    return true;
      }
    }
  return false;
}

static inline void
link_socket_get_outgoing_addr (struct buffer *buf,
			      const struct link_socket_info *info,
			      struct openvpn_sockaddr **act)
{
  if (buf->len > 0)
    {
      struct link_socket_addr *lsa = info->lsa;
      if (link_addr_defined (&lsa->actual))
	{
	  //addr_copy(addr, &lsa->actual.addr);
	  *act = &lsa->actual;
	  addr->sin_port = lsa->actual.sin_port;
	}
      else
	{

static inline void
link_socket_set_outgoing_addr (const struct buffer *buf,
			       struct link_socket_info *info,
			       const struct openvpn_sockaddr *addr,
			       const char *common_name,
			       struct env_set *es)
{

int link_socket_read_udp_posix (struct link_socket *sock,
				struct buffer *buf,
				int maxsize,
				struct openvpn_sockaddr *from);

#endif
#ifdef USE_PF_UNIX
int link_socket_read_unix_dgram (struct link_socket *sock,
				struct buffer *buf,
				int maxsize,
				struct sockaddr_un *from);
#endif

/* read a TCP or UDP packet from link */
static inline int
link_socket_read (struct link_socket *sock,
		  struct buffer *buf,
		  int maxsize,
		  struct openvpn_sockaddr *from)
{
  if (proto_is_udp(sock->info.proto)) /* unified UDPv4 and UDPv6 */
    {
      int res;

#ifdef WIN32
      res = link_socket_read_udp_win32 (sock, buf, from->in);
#else
      res = link_socket_read_udp_posix (sock, buf, maxsize, from);
#endif
      return res;
    }
  else if (proto_is_tcp(sock->info.proto)) /* unified TCPv4 and TCPv6 */
    {
      /* from address was returned by accept */
      addr_copy_sa(from, &sock->info.lsa->actual);
      return link_socket_read_tcp (sock, buf);
    }
#ifdef USE_PF_UNIX
  else if (sock->info.proto == PROTO_UNIX_DGRAM)
    {
      int res;
      res = link_socket_read_unix_dgram (sock, buf, maxsize, &from->addr.un);
      return res;
    }
#endif
  else
    {
      ASSERT (0);


int link_socket_write_tcp (struct link_socket *sock,
			   struct buffer *buf,
			   struct openvpn_sockaddr *to);

#ifdef WIN32

static inline int
link_socket_write_win32 (struct link_socket *sock,
			 struct buffer *buf,
			 struct openvpn_sockaddr *to)
{
  int err = 0;
  int status = 0;

      if (status < 0)
	err = WSAGetLastError ();
    }
  socket_send_queue (sock, buf, to->addr);
  if (status < 0)
    {
      WSASetLastError (err);

static inline int
link_socket_write_udp_posix (struct link_socket *sock,
			     struct buffer *buf,
			     struct openvpn_sockaddr *to)
{
#if ENABLE_IP_PKTINFO
  int link_socket_write_udp_posix_sendmsg (struct link_socket *sock,
					   struct buffer *buf,
					   struct openvpn_sockaddr *to);

  /*
  if (sock->info.proto == PROTO_UDPv4 && (sock->socket_flags & SF_USE_IP_PKTINFO)
	  && to->pi.in.ipi_spec_dst.s_addr)

  */
  if (proto_is_udp(sock->info.proto) && (sock->socket_flags & SF_USE_IP_PKTINFO)
	  && addr_defined_ipi(to))
    return link_socket_write_udp_posix_sendmsg (sock, buf, to);
  else
#endif
    return sendto (sock->sd, BPTR (buf), BLEN (buf), 0,
		   &to->addr.sa,
		   (socklen_t) af_addr_size(to->addr.sa.sa_family));
}

static inline int
link_socket_write_tcp_posix (struct link_socket *sock,
			     struct buffer *buf,
			     struct openvpn_sockaddr *to)
{
  return send (sock->sd, BPTR (buf), BLEN (buf), MSG_NOSIGNAL);
}

#endif
#ifdef USE_PF_UNIX
static inline int
link_socket_write_unix_dgram (struct link_socket *sock,
			     struct buffer *buf,
			     struct sockaddr_un *to)
{
  return sendto (sock->sd, BPTR (buf), BLEN (buf), 0,
		 (struct sockaddr *) to,
		 (socklen_t) sizeof (*to));
}
#endif


static inline int
link_socket_write_udp (struct link_socket *sock,
		       struct buffer *buf,
		       struct openvpn_sockaddr *to)
{
#ifdef WIN32
  return link_socket_write_win32 (sock, buf, to->in);
#else
  return link_socket_write_udp_posix (sock, buf, to);
#endif

static inline int
link_socket_write (struct link_socket *sock,
		   struct buffer *buf,
		   struct openvpn_sockaddr *to)
{
  if (proto_is_udp(sock->info.proto)) /* unified UDPv4 and UDPv6 */
    {
      return link_socket_write_udp (sock, buf, to);
    }
  else if (proto_is_tcp(sock->info.proto)) /* unified TCPv4 and TCPv6 */
    {
      return link_socket_write_tcp (sock, buf, to);
    }
#ifdef USE_PF_UNIX
  else if (sock->info.proto == PROTO_UNIX_DGRAM)
    {
      return link_socket_write_unix_dgram (sock, buf, &to->addr.un);
    }
#endif
  else
    {
      ASSERT (0);




}

static bool
recv_socks_reply (socket_descriptor_t sd, struct openvpn_sockaddr *addr,
		  volatile int *signal_received)
{
  char atyp = '\0';


  if (addr != NULL)
    {
      addr->addr.in.sin_family = AF_INET;
      addr->addr.in.sin_addr.s_addr = htonl (INADDR_ANY);
      addr->addr.in.sin_port = htons (0);
    }

  while (len < 4 + alen + 2)

  /* ATYP == 1 (IP V4 address) */
  if (atyp == '\x01' && addr != NULL)
    {
      memcpy (&addr->addr.in.sin_addr, buf + 4, sizeof (addr->addr.in.sin_addr));
      memcpy (&addr->addr.in.sin_port, buf + 8, sizeof (addr->addr.in.sin_port));
    }



establish_socks_proxy_udpassoc (struct socks_proxy_info *p,
			        socket_descriptor_t ctrl_sd, /* already open to proxy */
				socket_descriptor_t udp_sd,
				struct openvpn_sockaddr *relay_addr,
			        volatile int *signal_received)
{
  if (!socks_handshake (ctrl_sd, signal_received))

 */
int
socks_process_outgoing_udp (struct buffer *buf,
			    struct openvpn_sockaddr *to)
{
  /* 
   * Get a 10 byte subset buffer prepended to buf --

  buf_write_u16 (&head, 0);	/* RSV = 0 */
  buf_write_u8 (&head, 0);	/* FRAG = 0 */
  buf_write_u8 (&head, '\x01'); /* ATYP = 1 (IP V4) */
  buf_write (&head, &to->addr.in.sin_addr, sizeof (to->addr.in.sin_addr));
  buf_write (&head, &to->addr.in.sin_port, sizeof (to->addr.in.sin_port));

  return 10;
}





#include "buffer.h"

struct openvpn_sockaddr;

struct socks_proxy_info {
  bool defined;
  bool retry;

void establish_socks_proxy_udpassoc (struct socks_proxy_info *p,
				     socket_descriptor_t ctrl_sd, /* already open to proxy */
				     socket_descriptor_t udp_sd,
				     struct openvpn_sockaddr *relay_addr,
				     volatile int *signal_received);

void socks_process_incoming_udp (struct buffer *buf,
				struct sockaddr_in *from);

int socks_process_outgoing_udp (struct buffer *buf,
				struct openvpn_sockaddr *to);

#endif
#endif




static void
setenv_untrusted (struct tls_session *session)
{
  setenv_sockaddr (session->opt->es, "untrusted", &session->untrusted_addr, SA_IP_PORT);
}

static void

write_control_auth (struct tls_session *session,
		    struct key_state *ks,
		    struct buffer *buf,
		    struct openvpn_sockaddr **to_link_addr,
		    int opcode,
		    int max_ack,
		    bool prepend_ack)

  uint8_t *header;
  struct buffer null = clear_buf ();

  ASSERT (link_addr_defined (&ks->remote_addr));
  ASSERT (reliable_ack_write
	  (ks->rec_ack, buf, &ks->session_id_remote, max_ack, prepend_ack));
  ASSERT (session_id_write_prepend (&session->session_id, buf));

      openvpn_encrypt (buf, null, &session->tls_auth, NULL);
      ASSERT (swap_hmac (buf, &session->tls_auth, false));
    }
  *to_link_addr = &ks->remote_addr;
}

/*

static bool
read_control_auth (struct buffer *buf,
		   const struct crypto_options *co,
		   const struct openvpn_sockaddr *from)
{
  struct gc_arena gc = gc_new ();


	{
	  msg (D_TLS_ERRORS,
	       "TLS Error: cannot locate HMAC in incoming packet from %s",
	       print_link_sockaddr (from, &gc));
	  gc_free (&gc);
	  return false;
	}

	{
	  msg (D_TLS_ERRORS,
	       "TLS Error: incoming packet authentication failed from %s",
	       print_link_sockaddr (from, &gc));
	  gc_free (&gc);
	  return false;
	}

tls_process (struct tls_multi *multi,
	     struct tls_session *session,
	     struct buffer *to_link,
	     struct openvpn_sockaddr **to_link_addr,
	     struct link_socket_info *to_link_socket_info,
	     interval_t *wakeup)
{

bool
tls_multi_process (struct tls_multi *multi,
		   struct buffer *to_link,
		   struct openvpn_sockaddr **to_link_addr,
		   struct link_socket_info *to_link_socket_info,
		   interval_t *wakeup)
{


      /* set initial remote address */
      if (i == TM_ACTIVE && ks->state == S_INITIAL &&
	  link_addr_defined (&to_link_socket_info->lsa->actual))
	ks->remote_addr = to_link_socket_info->lsa->actual;

      dmsg (D_TLS_DEBUG,

	   state_name (ks->state),
	   session_id_print (&session->session_id, &gc),
	   session_id_print (&ks->session_id_remote, &gc),
	   print_link_sockaddr (&ks->remote_addr, &gc));

      if (ks->state >= S_INITIAL && link_addr_defined (&ks->remote_addr))
	{
	  struct openvpn_sockaddr *tla = NULL;

	  update_time ();

	  if (tls_process (multi, session, to_link, &tla,
			   to_link_socket_info, wakeup))
	    active = true;

	  /*
	   * If tls_process produced an outgoing packet,
	   * return the openvpn_sockaddr object (which
	   * contains the outgoing address).
	   */
	  if (tla)
	    {
	      multi->to_link_addr = *tla;
	      *to_link_addr = &multi->to_link_addr;
	    }

	  /*
	   * If tls_process hits an error:
	   * (1) If the session has an unexpired lame duck key, preserve it.
	   * (2) Reinitialize the session.


bool
tls_pre_decrypt (struct tls_multi *multi,
		 const struct openvpn_sockaddr *from,
		 struct buffer *buf,
		 struct crypto_options *opt)
{

	      if (DECRYPT_KEY_ENABLED (multi, ks)
		  && key_id == ks->key_id
		  && ks->authenticated
		  && link_addr_port_match(from, &ks->remote_addr))
		{
		  /* return appropriate data channel decrypt key in opt */
		  opt->key_ctx_bi = &ks->key;

		  ks->n_bytes += buf->len;
		  dmsg (D_TLS_DEBUG,
		       "TLS: data channel, key_id=%d, IP=%s",
		       key_id, print_link_sockaddr (from, &gc));
		  gc_free (&gc);
		  return ret;
		}


	  msg (D_TLS_ERRORS,
	       "TLS Error: local/remote TLS keys are out of sync: %s [%d]",
	       print_link_sockaddr (from, &gc), key_id);
	  goto error;
	}
      else			  /* control channel packet */

	    {
	      msg (D_TLS_ERRORS,
		   "TLS Error: unknown opcode received from %s op=%d",
		   print_link_sockaddr (from, &gc), op);
	      goto error;
	    }


		{
		  msg (D_TLS_ERRORS,
		       "TLS Error: client->client or server->server connection attempted from %s",
		       print_link_sockaddr (from, &gc));
		  goto error;
		}
	    }

	   * Authenticate Packet
	   */
	  dmsg (D_TLS_DEBUG, "TLS: control channel, op=%s, IP=%s",
	       packet_opcode_name (op), print_link_sockaddr (from, &gc));

	  /* get remote session-id */
	  {

	      {
		msg (D_TLS_ERRORS,
		     "TLS Error: session-id not found in packet from %s",
		     print_link_sockaddr (from, &gc));
		goto error;
	      }
	  }

		   state_name (ks->state),
		   session_id_print (&session->session_id, &gc),
		   session_id_print (&sid, &gc),
		   print_link_sockaddr (from, &gc),
		   session_id_print (&ks->session_id_remote, &gc),
		   print_link_sockaddr (&ks->remote_addr, &gc));

	      if (session_id_equal (&ks->session_id_remote, &sid))
		/* found a match */

		    {
		      msg (D_TLS_ERRORS,
			   "TLS Error: Cannot accept new session request from %s due to session context expire or --single-session [1]",
			   print_link_sockaddr (from, &gc));
		      goto error;
		    }



		  msg (D_TLS_DEBUG_LOW,
		       "TLS: Initial packet from %s, sid=%s",
		       print_link_sockaddr (from, &gc),
		       session_id_print (&sid, &gc));

		  do_burst = true;
		  new_link = true;
		  i = TM_ACTIVE;
		  session->untrusted_addr = *from;
		}
	    }


		{
		  msg (D_TLS_ERRORS,
		       "TLS Error: Cannot accept new session request from %s due to session context expire or --single-session [2]",
		       print_link_sockaddr (from, &gc));
		  goto error;
		}
	      

	       */
	      msg (D_TLS_DEBUG_LOW,
		   "TLS: new session incoming connection from %s",
		   print_link_sockaddr (from, &gc));

	      new_link = true;
	      i = TM_UNTRUSTED;
	      session->untrusted_addr = *from;
	    }
	  else
	    {

		{
		  msg (D_TLS_ERRORS,
		       "TLS Error: Unroutable control packet received from %s (si=%d op=%s)",
		       print_link_sockaddr (from, &gc),
		       i,
		       packet_opcode_name (op));
		  goto error;

	      /*
	       * Verify remote IP address
	       */
	      if (!new_link && !link_addr_port_match (&ks->remote_addr, from))
		{
		  msg (D_TLS_ERRORS, "TLS Error: Received control packet from unexpected IP addr: %s",
		      print_link_sockaddr (from, &gc));
		  goto error;
		}


		ks->remote_addr = *from;
		++multi->n_sessions;
	      }
	    else if (!link_addr_port_match (&ks->remote_addr, from))
	      {
		msg (D_TLS_ERRORS,
		     "TLS Error: Existing session control channel packet from unknown IP address: %s",
		     print_link_sockaddr (from, &gc));
		goto error;
	      }


 */
bool
tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,
		      const struct openvpn_sockaddr *from,
		      const struct buffer *buf)
{
  struct gc_arena gc = gc_new ();

	   */
	  dmsg (D_TLS_STATE_ERRORS,
	       "TLS State Error: No TLS state for client %s, opcode=%d",
	       print_link_sockaddr (from, &gc),
	       op);
	  goto error;
	}

	  dmsg (D_TLS_STATE_ERRORS,
	       "TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected",
	       key_id,
	       print_link_sockaddr (from, &gc));
	  goto error;
	}


	  dmsg (D_TLS_STATE_ERRORS,
	       "TLS State Error: Large packet (size %d) received from %s -- a packet no larger than %d bytes was expected",
	       buf->len,
	       print_link_sockaddr (from, &gc),
	       EXPANDED_SIZE_DYNAMIC (&tas->frame));
	  goto error;
	}

Lines 345-351 Link Here

(-)ssl.h:1.4 (-5 / +11 lines)
345		345
346	int initial_opcode; /* our initial P_ opcode */	346	int initial_opcode; /* our initial P_ opcode */
347	struct session_id session_id_remote; /* peer's random session ID */	347	struct session_id session_id_remote; /* peer's random session ID */
348	struct sockaddr_in remote_addr; /* peer's IP addr */	348	struct openvpn_sockaddr remote_addr; /* peer's IP addr */
349	struct packet_id packet_id; /* for data channel, to prevent replay attacks */	349	struct packet_id packet_id; /* for data channel, to prevent replay attacks */
350		350
351	struct key_ctx_bi key; /* data channel keys for encrypt/decrypt/hmac */	351	struct key_ctx_bi key; /* data channel keys for encrypt/decrypt/hmac */
Lines 488-494 Link Here
488	bool verified; /* true if peer certificate was verified against CA */	488	bool verified; /* true if peer certificate was verified against CA */
489		489
490	/* not-yet-authenticated incoming client */	490	/* not-yet-authenticated incoming client */
491	struct sockaddr_in untrusted_sockaddr;	491	struct openvpn_sockaddr untrusted_addr;
492		492
493	struct key_state key[KS_SIZE];	493	struct key_state key[KS_SIZE];
494	};	494	};
Lines 535-540 Link Here
535	struct key_state save_ks; / temporary pointer used between pre/post routines */	535	struct key_state save_ks; / temporary pointer used between pre/post routines */
536		536
537	/*	537	/*
		538	* Used to return outgoing address from
		539	* tls_multi_process.
		540	*/
		541	struct openvpn_sockaddr to_link_addr;
		542
		543	/*
538	* Number of sessions negotiated thus far.	544	* Number of sessions negotiated thus far.
539	*/	545	*/
540	int n_sessions;	546	int n_sessions;
Lines 590-608 Link Here
590		596
591	bool tls_multi_process (struct tls_multi *multi,	597	bool tls_multi_process (struct tls_multi *multi,
592	struct buffer *to_link,	598	struct buffer *to_link,
593	struct sockaddr_in *to_link_addr,	599	struct openvpn_sockaddr **to_link_addr,
594	struct link_socket_info *to_link_socket_info,	600	struct link_socket_info *to_link_socket_info,
595	interval_t *wakeup);	601	interval_t *wakeup);
596		602
597	void tls_multi_free (struct tls_multi *multi, bool clear);	603	void tls_multi_free (struct tls_multi *multi, bool clear);
598		604
599	bool tls_pre_decrypt (struct tls_multi *multi,	605	bool tls_pre_decrypt (struct tls_multi *multi,
600	struct sockaddr_in *from,	606	const struct openvpn_sockaddr *from,
601	struct buffer *buf,	607	struct buffer *buf,
602	struct crypto_options *opt);	608	struct crypto_options *opt);
603		609
604	bool tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,	610	bool tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,
605	const struct sockaddr_in *from,	611	const struct openvpn_sockaddr *from,
606	const struct buffer *buf);	612	const struct buffer *buf);
607		613
608	void tls_pre_encrypt (struct tls_multi *multi,	614	void tls_pre_encrypt (struct tls_multi *multi,

Lines 57-62 Link Here

(-)syshead.h:1.4 (+17 lines)
57	#include <sys/socket.h>	57	#include <sys/socket.h>
58	#endif	58	#endif
59		59
		60	#ifdef USE_PF_UNIX
		61	#include <sys/un.h>
		62	#endif
		63
		64	#ifdef USE_PF_INET6
		65	#include <netinet/in.h>
		66	#endif
		67
60	#ifdef HAVE_SYS_IOCTL_H	68	#ifdef HAVE_SYS_IOCTL_H
61	#include <sys/ioctl.h>	69	#include <sys/ioctl.h>
62	#endif	70	#endif
Lines 290-295 Link Here
290	#endif	298	#endif
291		299
292	/*	300	/*
		301	* Does this platform support linux-style IP_PKTINFO?
		302	*/
		303	#if defined(ENABLE_MULTIHOME) && defined(HAVE_IN_PKTINFO) && defined(IP_PKTINFO) && defined(HAVE_MSGHDR) && defined(HAVE_CMSGHDR) && defined(HAVE_IOVEC) && defined(CMSG_FIRSTHDR) && defined(CMSG_NXTHDR) && defined(HAVE_RECVMSG) && defined(HAVE_SENDMSG)
		304	#define ENABLE_IP_PKTINFO 1
		305	#else
		306	#define ENABLE_IP_PKTINFO 0
		307	#endif
		308
		309	/*
293	* Disable ESEC	310	* Disable ESEC
294	*/	311	*/
295	#if 0	312	#if 0

Return to bug 183457

Added Link Here

(-)/dev/null (+71 lines)
1	# $Id: CHANGES.IPv6,v 1.1.10.14 2005/06/22 16:01:10 jjo Exp $ #
2	* v0.3.12
3	. merged payload conntrack fixes (EXPERIMENTAL code, disabled by default),
4	almost no ipv6 related code changes.
5
6	* v0.3.11
7	. woaooHOO: fixed udp6 MULTI (TLS server) !
8
9	* v0.3.10
10	. stupid typo .... GRR
11
12	* v0.3.9
13	. some MH code reorg., allow compilation with ./configure --disable-multihome
14
15	* v0.3.8
16	. udp6 --multihome (MH) support fixed, tested OK! on GNU/Linux
17
18	* v0.3.7
19	. udp6 MH support: compiles, not tested.
20
21	* v0.3.6
22	. tested UDPv4 MH on GNU/Linux: works ok
23	. fix incorrect addr printing in print_link_sockaddr()
24
25	* v0.3.5
26	. internals: kill print_link_sockaddr_ex(), just use print_propiate flags
27	(just ~10lines change at all !)
28
29	* v0.3.4
30	. make tcp4-client work against tcp6-server
31
32	* v0.3.3
33	. freebsd: compute true addrlen for sendto() with af_addr_size()
34
35	* v0.3.2
36	. minor changes to socket.[ch] (MH merge)
37
38	* v0.3.1
39	. syshead.h MH changes were missing ; now it actually compiles MH support
40
41	* v0.3.0
42	- tcp6-client, tcp6-server
43	- MH patch included by default from now on
44
45	* v0.2.4-MH-0.0.6
46	- account for !AF_INET in addr_host()
47	- removed S_IN, S_IN6 and S_UN casts; migrate last functions to openvpn_sockaddr: printsockaddr
48	- more openvpn_sockaddr migration (polishing), almost ready
49	- 3rd MH integration round
50
51	* v0.2.4
52	- fix --route usage for udp6 (redirect-default-gateway semantics)
53
54	* v0.2.3
55	- udp6 "correct" support for freebsd and openbsd
56	cc and tested OK: freebsd-5.3,openbsd-3.6 against GNU/Linux
57
58	* v0.2.2
59	- IPv6 (--proto udp6), unix-socket support selectable at configure-time
60	(all 4 combinations tested)
61	./configure --disable-ipv6 (enabled by default)
62	./configure --enable-unix-sockets (disabled by default)
63	(internal) USE_PF_INET6, USE_PF_UNIX from autoconf
64	- Change PROTO_x from #define to enum, to allow easier/cleaner support for
65	optional protocols
66	- Added IPV6_xxxx_HEADER_SIZE
67
68	* v0.2.1
69	First public release, see README.IPv6
70
71	# vim: sw=2

Lines 1-4 Link Here

(-)Makefile.in:1.2 (-52 / +31 lines)
1	# Makefile.in generated by automake 1.8.3 from Makefile.am.	1	# Makefile.in generated by automake 1.9.2 from Makefile.am.
2	# @configure_input@	2	# @configure_input@
3		3
4	# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,	4	# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
Lines 79-85 Link Here
79	$(ACLOCAL_M4)	79	$(ACLOCAL_M4)
80	am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \	80	am__CONFIG_DISTCLEAN_FILES = config.status config.cache config.log \
81	configure.lineno configure.status.lineno	81	configure.lineno configure.status.lineno
82	mkinstalldirs = $(mkdir_p)	82	mkinstalldirs = $(install_sh) -d
83	CONFIG_HEADER = config.h	83	CONFIG_HEADER = config.h
84	CONFIG_CLEAN_FILES = openvpn.spec config-win32.h \	84	CONFIG_CLEAN_FILES = openvpn.spec config-win32.h \
85	install-win32/openvpn.nsi	85	install-win32/openvpn.nsi
Lines 101-107 Link Here
101	route.$(OBJEXT) schedule.$(OBJEXT) session_id.$(OBJEXT) \	101	route.$(OBJEXT) schedule.$(OBJEXT) session_id.$(OBJEXT) \
102	shaper.$(OBJEXT) sig.$(OBJEXT) socket.$(OBJEXT) \	102	shaper.$(OBJEXT) sig.$(OBJEXT) socket.$(OBJEXT) \
103	socks.$(OBJEXT) ssl.$(OBJEXT) status.$(OBJEXT) \	103	socks.$(OBJEXT) ssl.$(OBJEXT) status.$(OBJEXT) \
104	thread.$(OBJEXT) tun.$(OBJEXT)	104	thread.$(OBJEXT) tun.$(OBJEXT) payload.$(OBJEXT)
105	nodist_openvpn_OBJECTS =	105	nodist_openvpn_OBJECTS =
106	openvpn_OBJECTS = $(am_openvpn_OBJECTS) $(nodist_openvpn_OBJECTS)	106	openvpn_OBJECTS = $(am_openvpn_OBJECTS) $(nodist_openvpn_OBJECTS)
107	openvpn_LDADD = $(LDADD)	107	openvpn_LDADD = $(LDADD)
Lines 109-139 Link Here
109	DEFAULT_INCLUDES = -I. -I$(srcdir) -I.	109	DEFAULT_INCLUDES = -I. -I$(srcdir) -I.
110	depcomp = $(SHELL) $(top_srcdir)/depcomp	110	depcomp = $(SHELL) $(top_srcdir)/depcomp
111	am__depfiles_maybe = depfiles	111	am__depfiles_maybe = depfiles
112	@AMDEP_TRUE@DEP_FILES = $(DEPDIR)/memcmp.Po ./$(DEPDIR)/base64.Po \
113	@AMDEP_TRUE@ ./$(DEPDIR)/buffer.Po ./$(DEPDIR)/crypto.Po \
114	@AMDEP_TRUE@ ./$(DEPDIR)/error.Po ./$(DEPDIR)/event.Po \
115	@AMDEP_TRUE@ ./$(DEPDIR)/fdmisc.Po ./$(DEPDIR)/forward.Po \
116	@AMDEP_TRUE@ ./$(DEPDIR)/fragment.Po ./$(DEPDIR)/gremlin.Po \
117	@AMDEP_TRUE@ ./$(DEPDIR)/helper.Po ./$(DEPDIR)/init.Po \
118	@AMDEP_TRUE@ ./$(DEPDIR)/interval.Po ./$(DEPDIR)/list.Po \
119	@AMDEP_TRUE@ ./$(DEPDIR)/lzo.Po ./$(DEPDIR)/manage.Po \
120	@AMDEP_TRUE@ ./$(DEPDIR)/mbuf.Po ./$(DEPDIR)/misc.Po \
121	@AMDEP_TRUE@ ./$(DEPDIR)/mroute.Po ./$(DEPDIR)/mss.Po \
122	@AMDEP_TRUE@ ./$(DEPDIR)/mtcp.Po ./$(DEPDIR)/mtu.Po \
123	@AMDEP_TRUE@ ./$(DEPDIR)/mudp.Po ./$(DEPDIR)/multi.Po \
124	@AMDEP_TRUE@ ./$(DEPDIR)/ntlm.Po ./$(DEPDIR)/occ.Po \
125	@AMDEP_TRUE@ ./$(DEPDIR)/openvpn.Po ./$(DEPDIR)/options.Po \
126	@AMDEP_TRUE@ ./$(DEPDIR)/otime.Po ./$(DEPDIR)/packet_id.Po \
127	@AMDEP_TRUE@ ./$(DEPDIR)/perf.Po ./$(DEPDIR)/ping.Po \
128	@AMDEP_TRUE@ ./$(DEPDIR)/plugin.Po ./$(DEPDIR)/pool.Po \
129	@AMDEP_TRUE@ ./$(DEPDIR)/proto.Po ./$(DEPDIR)/proxy.Po \
130	@AMDEP_TRUE@ ./$(DEPDIR)/push.Po ./$(DEPDIR)/reliable.Po \
131	@AMDEP_TRUE@ ./$(DEPDIR)/route.Po ./$(DEPDIR)/schedule.Po \
132	@AMDEP_TRUE@ ./$(DEPDIR)/session_id.Po ./$(DEPDIR)/shaper.Po \
133	@AMDEP_TRUE@ ./$(DEPDIR)/sig.Po ./$(DEPDIR)/socket.Po \
134	@AMDEP_TRUE@ ./$(DEPDIR)/socks.Po ./$(DEPDIR)/ssl.Po \
135	@AMDEP_TRUE@ ./$(DEPDIR)/status.Po ./$(DEPDIR)/thread.Po \
136	@AMDEP_TRUE@ ./$(DEPDIR)/tun.Po
137	COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \	112	COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
138	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)	113	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
139	CCLD = $(CC)	114	CCLD = $(CC)
Lines 211-216 Link Here
211	am__include = @am__include@	186	am__include = @am__include@
212	am__leading_dot = @am__leading_dot@	187	am__leading_dot = @am__leading_dot@
213	am__quote = @am__quote@	188	am__quote = @am__quote@
		189	am__tar = @am__tar@
		190	am__untar = @am__untar@
214	bindir = @bindir@	191	bindir = @bindir@
215	build = @build@	192	build = @build@
216	build_alias = @build_alias@	193	build_alias = @build_alias@
Lines 304-310 Link Here
304	status.c status.h \	281	status.c status.h \
305	syshead.h \	282	syshead.h \
306	thread.c thread.h \	283	thread.c thread.h \
307	tun.c tun.h	284	tun.c tun.h \
		285	payload.c payload.h
308		286
309	LDADD = @LIBOBJS@	287	LDADD = @LIBOBJS@
310	man_MANS = openvpn.8	288	man_MANS = openvpn.8
Lines 461-466 Link Here
461	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/options.Po@am__quote@	439	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/options.Po@am__quote@
462	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/otime.Po@am__quote@	440	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/otime.Po@am__quote@
463	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/packet_id.Po@am__quote@	441	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/packet_id.Po@am__quote@
		442	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/payload.Po@am__quote@
464	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/perf.Po@am__quote@	443	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/perf.Po@am__quote@
465	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ping.Po@am__quote@	444	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ping.Po@am__quote@
466	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/plugin.Po@am__quote@	445	@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/plugin.Po@am__quote@
Lines 485-500 Link Here
485	@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \	464	@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ $<; \
486	@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$.Tpo" "$(DEPDIR)/$.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi	465	@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$.Tpo" "$(DEPDIR)/$.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
487	@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@	466	@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
488	@AMDEP_TRUE@@am__fastdepCC_FALSE@ depfile='$(DEPDIR)/$.Po' tmpdepfile='$(DEPDIR)/$.TPo' @AMDEPBACKSLASH@	467	@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
489	@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
490	@am__fastdepCC_FALSE@ $(COMPILE) -c $<	468	@am__fastdepCC_FALSE@ $(COMPILE) -c $<
491		469
492	.c.obj:	470	.c.obj:
493	@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ `$(CYGPATH_W) '$<'`; \	471	@am__fastdepCC_TRUE@ if $(COMPILE) -MT $@ -MD -MP -MF "$(DEPDIR)/$*.Tpo" -c -o $@ `$(CYGPATH_W) '$<'`; \
494	@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$.Tpo" "$(DEPDIR)/$.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi	472	@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/$.Tpo" "$(DEPDIR)/$.Po"; else rm -f "$(DEPDIR)/$*.Tpo"; exit 1; fi
495	@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@	473	@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
496	@AMDEP_TRUE@@am__fastdepCC_FALSE@ depfile='$(DEPDIR)/$.Po' tmpdepfile='$(DEPDIR)/$.TPo' @AMDEPBACKSLASH@	474	@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
497	@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
498	@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`	475	@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'`
499	uninstall-info-am:	476	uninstall-info-am:
500	install-man8: $(man8_MANS) $(man_MANS)	477	install-man8: $(man8_MANS) $(man_MANS)
Lines 563-571 Link Here
563	done \| \	540	done \| \
564	$(AWK) ' { files[$$0] = 1; } \	541	$(AWK) ' { files[$$0] = 1; } \
565	END { for (i in files) print i; }'`; \	542	END { for (i in files) print i; }'`; \
566	test -z "$(ETAGS_ARGS)$$tags$$unique" \	543	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
567	\|\| $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \	544	test -n "$$unique" \|\| unique=$$empty_fix; \
568	$$tags $$unique	545	$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
		546	$$tags $$unique; \
		547	fi
569	ctags: CTAGS	548	ctags: CTAGS
570	CTAGS: $(HEADERS) $(SOURCES) config.h.in $(TAGS_DEPENDENCIES) \	549	CTAGS: $(HEADERS) $(SOURCES) config.h.in $(TAGS_DEPENDENCIES) \
571	$(TAGS_FILES) $(LISP)	550	$(TAGS_FILES) $(LISP)
Lines 628-642 Link Here
628	! -type d ! -perm -444 -exec $(SHELL) $(install_sh) -c -m a+r {} {} \; \	607	! -type d ! -perm -444 -exec $(SHELL) $(install_sh) -c -m a+r {} {} \; \
629	\|\| chmod -R a+r $(distdir)	608	\|\| chmod -R a+r $(distdir)
630	dist-gzip: distdir	609	dist-gzip: distdir
631	$(AMTAR) chof - $(distdir) \| GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz	610	tardir=$(distdir) && $(am__tar) \| GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
632	$(am__remove_distdir)	611	$(am__remove_distdir)
633		612
634	dist-bzip2: distdir	613	dist-bzip2: distdir
635	$(AMTAR) chof - $(distdir) \| bzip2 -9 -c >$(distdir).tar.bz2	614	tardir=$(distdir) && $(am__tar) \| bzip2 -9 -c >$(distdir).tar.bz2
636	$(am__remove_distdir)	615	$(am__remove_distdir)
637		616
638	dist-tarZ: distdir	617	dist-tarZ: distdir
639	$(AMTAR) chof - $(distdir) \| compress -c >$(distdir).tar.Z	618	tardir=$(distdir) && $(am__tar) \| compress -c >$(distdir).tar.Z
640	$(am__remove_distdir)	619	$(am__remove_distdir)
641		620
642	dist-shar: distdir	621	dist-shar: distdir
Lines 649-655 Link Here
649	$(am__remove_distdir)	628	$(am__remove_distdir)
650		629
651	dist dist-all: distdir	630	dist dist-all: distdir
652	$(AMTAR) chof - $(distdir) \| GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz	631	tardir=$(distdir) && $(am__tar) \| GZIP=$(GZIP_ENV) gzip -c >$(distdir).tar.gz
653	$(am__remove_distdir)	632	$(am__remove_distdir)
654		633
655	# This target untars the dist file and tries a VPATH configuration. Then	634	# This target untars the dist file and tries a VPATH configuration. Then
Lines 658-670 Link Here
658	distcheck: dist	637	distcheck: dist
659	case '$(DIST_ARCHIVES)' in \	638	case '$(DIST_ARCHIVES)' in \
660	.tar.gz) \	639	.tar.gz) \
661	GZIP=$(GZIP_ENV) gunzip -c $(distdir).tar.gz \| $(AMTAR) xf - ;;\	640	GZIP=$(GZIP_ENV) gunzip -c $(distdir).tar.gz \| $(am__untar) ;;\
662	.tar.bz2) \	641	.tar.bz2) \
663	bunzip2 -c $(distdir).tar.bz2 \| $(AMTAR) xf - ;;\	642	bunzip2 -c $(distdir).tar.bz2 \| $(am__untar) ;;\
664	.tar.Z) \	643	.tar.Z) \
665	uncompress -c $(distdir).tar.Z \| $(AMTAR) xf - ;;\	644	uncompress -c $(distdir).tar.Z \| $(am__untar) ;;\
666	.shar.gz) \	645	.shar.gz) \
667	GZIP=$(GZIP_ENV) gunzip -c $(distdir).tar.gz \| unshar ;;\	646	GZIP=$(GZIP_ENV) gunzip -c $(distdir).shar.gz \| unshar ;;\
668	.zip) \	647	.zip) \
669	unzip $(distdir).zip ;;\	648	unzip $(distdir).zip ;;\
670	esac	649	esac
Lines 745-751 Link Here
745	clean-generic:	724	clean-generic:
746		725
747	distclean-generic:	726	distclean-generic:
748	-rm -f $(CONFIG_CLEAN_FILES)	727	-test -z "$(CONFIG_CLEAN_FILES)" \|\| rm -f $(CONFIG_CLEAN_FILES)
749		728
750	maintainer-clean-generic:	729	maintainer-clean-generic:
751	@echo "This command is intended for maintainers to use"	730	@echo "This command is intended for maintainers to use"
Lines 806-818 Link Here
806		785
807	.PHONY: CTAGS GTAGS all all-am am--refresh check check-TESTS check-am \	786	.PHONY: CTAGS GTAGS all all-am am--refresh check check-TESTS check-am \
808	clean clean-generic clean-sbinPROGRAMS ctags dist dist-all \	787	clean clean-generic clean-sbinPROGRAMS ctags dist dist-all \
809	dist-bzip2 dist-gzip dist-shar dist-tarZ dist-zip distcheck \	788	dist-bzip2 dist-gzip dist-hook dist-shar dist-tarZ dist-zip \
810	distclean distclean-compile distclean-generic distclean-hdr \	789	distcheck distclean distclean-compile distclean-generic \
811	distclean-tags distcleancheck distdir distuninstallcheck dvi \	790	distclean-hdr distclean-tags distcleancheck distdir \
812	dvi-am html html-am info info-am install install-am \	791	distuninstallcheck dvi dvi-am html html-am info info-am \
813	install-data install-data-am install-exec install-exec-am \	792	install install-am install-data install-data-am install-exec \
814	install-info install-info-am install-man install-man8 \	793	install-exec-am install-info install-info-am install-man \
815	install-sbinPROGRAMS install-strip installcheck \	794	install-man8 install-sbinPROGRAMS install-strip installcheck \
816	installcheck-am installdirs maintainer-clean \	795	installcheck-am installdirs maintainer-clean \
817	maintainer-clean-generic mostlyclean mostlyclean-compile \	796	maintainer-clean-generic mostlyclean mostlyclean-compile \
818	mostlyclean-generic pdf pdf-am ps ps-am tags uninstall \	797	mostlyclean-generic pdf pdf-am ps ps-am tags uninstall \

Added Link Here

(-)/dev/null (+157 lines)
1	# $Id: README.IPv6,v 1.1.10.5 2005/06/22 15:57:51 jjo Exp $ #
2
3	This README covers UDP/IPv6 v0.3.x ( --udp6 and --tcp6-xxxxxx ) support for openvpn-2.0.
4
5	Also, with address family "generalization" changes came local AF_UNIX socket
6	support.
7
8	Available under GPLv2 from
9	http://www.irrigacion.gov.ar/juanjo/openvpn/
10
11	See "Examples" section below for usage.
12
13	* Working:
14	- tcp6->tcp6; tested on GNU/Linux
15	- upd6->upd6; tested on GNU/Linux, FreeBSD-5.3 and OpenBSD-3.6.
16	- upd4->upd6 (ipv6 bound); shows correctly mapped address (requires --float for now)
17	- unix-dgram->unix-dgram [AF_UNIX]
18	useful for implementing local proxies that can take full advantage
19	of POSIX filesystem permissions ( more powerfull access mechanisms
20	than inet, even for localhost)
21	- multihome [MH] for IPv4 and IPv6; compiles and works OK GNU/Linux
22	ipv4 MH support taken and adapted from James' original MH patch
23
24	* Experimental code (correctly #ifdef'd out):
25	- payload conntrack: intended for filtering TCP retransmissions over reliable links
26	1st tests indicate aprox ~20% speedups (very coarsly tested)
27
28	* Setup:
29	./configure --disable-ipv6 (enabled by default)
30	./configure --enable-unix-sockets (disabled by default)
31	./configure --enable-payload-conntrack (experimental code, not for production usage)
32	:
33
34	* Usage:
35	For IPv6 just specify "-p upd6" an proper IPv6 hostnames, adapting the example
36	from man page ...
37
38	On may:
39	openvpn --proto udp6 --remote <june_IPv6_addr> --dev tun1 --ifconfig 10.4.0.1 10.4.0.2
40	--verb 5 --secret key
41
42	On june:
43	openvpn --proto udp6 --remote <may_IPv6_addr> --dev tun1 --ifconfig 10.4.0.2 10.4.0.1
44	--verb 5 --secret key
45
46	Same for --proto tcp6-client, tcp6-server.
47
48	* Examples: some succesfully tested command lines
49	BTW did you know that openvpn can succesfully negotiate to self
50	with --remote localhost ? VERY useful for fast testing.
51
52	- IPv6 "normal" usage (+succesfully tested tunnel traffic)
53	server# openvpn --proto udp6 ...
54	:
55	Thu Sep 23 22:15:48 2004 Peer Connection Initiated with [AF_INET6]fe80::205:5dff:fef1:1ceb%wlan0wds1:5000
56	:
57	client# openvpn --proto udp6 --remote fe80::240:5ff:feae:c851 ...
58	:
59	Thu Sep 23 22:13:19 2004 Peer Connection Initiated with [AF_INET6]fe80::240:5ff:feae:c851%wlan0wds0:5000
60	:
61
62	- IPv6 server, IPv4 client (more detailed)
63	server# openvpn --proto udp6 ...
64	:
65	Thu Sep 23 22:28:36 2004 UDPv6 link local (bound): [AF_INET6][undef]:5000
66	Thu Sep 23 22:28:36 2004 UDPv6 link remote: [AF_INET6][undef]
67	Thu Sep 23 22:28:50 2004 Peer Connection Initiated with [AF_INET6]::ffff:10.55.14.253:5000
68	Thu Sep 23 22:28:51 2004 Initialization Sequence Completed
69	Thu Sep 23 22:28:56 2004 WARNING: Actual Remote Options ('... proto UDPv4 ... ') \
70	are inconsistent with Expected Remote Options ('... proto UDPv6 ...')
71
72	client# openvpn --remote 10.55.14.254 ... ### same default as now: --udp
73	:
74	Thu Sep 23 22:26:11 2004 UDPv4 link local (bound): [AF_INET][undef]:5000
75	Thu Sep 23 22:26:11 2004 UDPv4 link remote: [AF_INET]10.55.14.254:5000
76	Thu Sep 23 22:26:21 2004 Peer Connection Initiated with [AF_INET]10.55.14.254:5000
77	Thu Sep 23 22:26:21 2004 WARNING: Actual Remote Options ('... proto UDPv6 ...') \
78	are inconsistent with Expected Remote Options ('... proto UDPv4 ...')
79	Thu Sep 23 22:26:22 2004 Initialization Sequence Completed
80
81	- IPv6 loopback
82	alone# openvpn --proto udp6 --remote ::1 ...
83	:
84	Wed Sep 22 13:03:07 2004 Peer Connection Initiated with [AF_INET6]::1:5000
85	:
86
87	- AF_UNIX toself
88	alone# openvpn --proto unix-dgram --local /tmp/o.s --remote /tmp/o.s --dev tun ...
89	:
90	Thu Sep 23 16:37:27 2004 Peer Connection Initiated with [AF_UNIX]/tmp/o.s
91	:
92
93	- AF_UNIX between to diff instances
94	peer1# openvpn --proto unix-dgram --local /tmp/o1.s --remote /tmp/o2.s
95	peer2# openvpn --proto unix-dgram --local /tmp/o2.s --remote /tmp/o1.s
96	:
97	Wed Sep 22 12:49:03 2004 Peer Connection Initiated with [AF_UNIX]/tmp/o1.s
98	:
99
100
101	* Main code changes summary:
102	- socket.h: New struct openvpn_sockaddr type that holds sockaddrs and pktinfo,
103	(here I omitted #ifdef USE_PF_xxxx, see socket.h )
104
105	struct openvpn_sockaddr {
106	union {
107	struct sockaddr sa;
108	struct sockaddr_in in;
109	struct sockaddr_in6 in6;
110	struct sockaddr_un un;
111	} addr;
112	union {
113	struct in_pktinfo in;
114	struct in6_pktinfo in6;
115	} pi; /* Multihome support for UDP */
116	};
117
118	struct link_socket_addr
119	{
120	struct openvpn_sockaddr local;
121	struct openvpn_sockaddr remote;
122	struct openvpn_sockaddr actual;
123	};
124
125	PRO: allows simple type overloading: local.addr.sa, local.addr.in, local.addr.in6 ... etc
126	(also local.pi.in and local.pi.in6)
127
128	- several function prototypes moved from sockaddr_in to openvpn_sockaddr
129	- several new sockaddr functions needed to "generalize" AF_xxxx operations:
130	addr_copy(), addr_zero(), ...etc
131	proto_is_udp(), proto_is_dgram(), proto_is_net()
132
133	* TODO: (!: fundamental, w: wanted, n: nah ... not critical, ?: need more thought)
134	[!]- Implement comparison for mapped addesses: server in dual stack listening
135	IPv6 must permit incoming streams from allowed IPv4 peer (ie without --float).
136	[!]- IPv6 with actual host resolution, currently only numerical (AI_NUMERICHOST)
137	[n]- call socket() lately, after getaddrinfo() to decide IPv4 or IPv6 host
138	(hence socket()) instead of needing -p {udp\|udp6}
139	NOT ACTUALLY a big trouble, given that you _do_ setup both sides
140	(keys, certs, etc), using udp or udp6 is actually _another_ setup bit.
141	[?]- integrate both IPv4 and IPv6 addr resolution with getaddrinfo instead of
142	venerable gethostbyname&friends, problem: horizontal portability (across
143	platforms) and vertical portab. (across versions)
144
145	DONE:
146	- ./configure [ --disable-ipv6 ] [ --enable-unix-sockets ]
147	map to USE_PF_INET6 and USE_PF_UNIX
148	- merge MH patch
149	- -p tcp6-client, -p tcp6-server
150	- MH IPv6 support
151
152	--
153	JuanJo Ciarlante jjo\|at\|mendoza.gov.ar
154	: :
155	. Linux IP Aliasing author .
156	. Modular algo (AES et all) support for FreeSWAN/OpenSWAN author .
157	:... plus other scattered free software bits in the wild ...:

Lines 1-4 Link Here

(-)aclocal.m4:1.1 (-36 / +153 lines)
1	# generated automatically by aclocal 1.8.3 -- Autoconf --	1	# generated automatically by aclocal 1.9.2 -- Autoconf --
2		2
3	# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004	3	# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
4	# Free Software Foundation, Inc.	4	# Free Software Foundation, Inc.
Lines 33-46 Link Here
33	# ----------------------------	33	# ----------------------------
34	# Automake X.Y traces this macro to ensure aclocal.m4 has been	34	# Automake X.Y traces this macro to ensure aclocal.m4 has been
35	# generated from the m4 files accompanying Automake X.Y.	35	# generated from the m4 files accompanying Automake X.Y.
36	AC_DEFUN([AM_AUTOMAKE_VERSION], [am__api_version="1.8"])	36	AC_DEFUN([AM_AUTOMAKE_VERSION], [am__api_version="1.9"])
37		37
38	# AM_SET_CURRENT_AUTOMAKE_VERSION	38	# AM_SET_CURRENT_AUTOMAKE_VERSION
39	# -------------------------------	39	# -------------------------------
40	# Call AM_AUTOMAKE_VERSION so it can be traced.	40	# Call AM_AUTOMAKE_VERSION so it can be traced.
41	# This function is AC_REQUIREd by AC_INIT_AUTOMAKE.	41	# This function is AC_REQUIREd by AC_INIT_AUTOMAKE.
42	AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],	42	AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
43	[AM_AUTOMAKE_VERSION([1.8.3])])	43	[AM_AUTOMAKE_VERSION([1.9.2])])
44		44
45	# AM_AUX_DIR_EXPAND	45	# AM_AUX_DIR_EXPAND
46		46
Lines 108-114 Link Here
108		108
109	# AM_CONDITIONAL -- Autoconf --	109	# AM_CONDITIONAL -- Autoconf --
110		110
111	# Copyright (C) 1997, 2000, 2001, 2003 Free Software Foundation, Inc.	111	# Copyright (C) 1997, 2000, 2001, 2003, 2004 Free Software Foundation, Inc.
112		112
113	# This program is free software; you can redistribute it and/or modify	113	# This program is free software; you can redistribute it and/or modify
114	# it under the terms of the GNU General Public License as published by	114	# it under the terms of the GNU General Public License as published by
Lines 145-152 Link Here
145	fi	145	fi
146	AC_CONFIG_COMMANDS_PRE(	146	AC_CONFIG_COMMANDS_PRE(
147	[if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then	147	[if test -z "${$1_TRUE}" && test -z "${$1_FALSE}"; then
148	AC_MSG_ERROR([conditional "$1" was never defined.	148	AC_MSG_ERROR([[conditional "$1" was never defined.
149	Usually this means the macro was only invoked conditionally.])	149	Usually this means the macro was only invoked conditionally.]])
150	fi])])	150	fi])])
151		151
152	# serial 7 -- Autoconf --	152	# serial 7 -- Autoconf --
Lines 266-274 Link Here
266	grep sub/conftest.${OBJEXT-o} sub/conftest.Po > /dev/null 2>&1 &&	266	grep sub/conftest.${OBJEXT-o} sub/conftest.Po > /dev/null 2>&1 &&
267	${MAKE-make} -s -f confmf > /dev/null 2>&1; then	267	${MAKE-make} -s -f confmf > /dev/null 2>&1; then
268	# icc doesn't choke on unknown options, it will just issue warnings	268	# icc doesn't choke on unknown options, it will just issue warnings
269	# (even with -Werror). So we grep stderr for any message	269	# or remarks (even with -Werror). So we grep stderr for any message
270	# that says an option was ignored.	270	# that says an option was ignored or not supported.
271	if grep 'ignoring option' conftest.err >/dev/null 2>&1; then :; else	271	# When given -MP, icc 7.0 and 7.1 complain thusly:
		272	# icc: Command line warning: ignoring option '-M'; no argument required
		273	# The diagnosis changed in icc 8.0:
		274	# icc: Command line remark: option '-MP' not supported
		275	if (grep 'ignoring option' conftest.err \|\|
		276	grep 'not supported' conftest.err) >/dev/null 2>&1; then :; else
272	am_cv_$1_dependencies_compiler_type=$depmode	277	am_cv_$1_dependencies_compiler_type=$depmode
273	break	278	break
274	fi	279	fi
Lines 314-320 Link Here
314		319
315	# Generate code to set up dependency tracking. -- Autoconf --	320	# Generate code to set up dependency tracking. -- Autoconf --
316		321
317	# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004 Free Software Foundation, Inc.	322	# Copyright (C) 1999, 2000, 2001, 2002, 2003, 2004
		323	# Free Software Foundation, Inc.
318		324
319	# This program is free software; you can redistribute it and/or modify	325	# This program is free software; you can redistribute it and/or modify
320	# it under the terms of the GNU General Public License as published by	326	# it under the terms of the GNU General Public License as published by
Lines 350-376 Link Here
350	else	356	else
351	continue	357	continue
352	fi	358	fi
353	grep '^DEP_FILES = [[^ @%:@]]' < "$mf" > /dev/null \|\| continue	359	# Extract the definition of DEPDIR, am__include, and am__quote
354	# Extract the definition of DEP_FILES from the Makefile without	360	# from the Makefile without running `make'.
355	# running `make'.
356	DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`	361	DEPDIR=`sed -n 's/^DEPDIR = //p' < "$mf"`
357	test -z "$DEPDIR" && continue	362	test -z "$DEPDIR" && continue
		363	am__include=`sed -n 's/^am__include = //p' < "$mf"`
		364	test -z "am__include" && continue
		365	am__quote=`sed -n 's/^am__quote = //p' < "$mf"`
358	# When using ansi2knr, U may be empty or an underscore; expand it	366	# When using ansi2knr, U may be empty or an underscore; expand it
359	U=`sed -n 's/^U = //p' < "$mf"`	367	U=`sed -n 's/^U = //p' < "$mf"`
360	test -d "$dirpart/$DEPDIR" \|\| mkdir "$dirpart/$DEPDIR"	368	# Find all dependency output files, they are included files with
361	# We invoke sed twice because it is the simplest approach to	369	# $(DEPDIR) in their names. We invoke sed twice because it is the
362	# changing $(DEPDIR) to its actual value in the expansion.	370	# simplest approach to changing $(DEPDIR) to its actual value in the
363	for file in `sed -n '	371	# expansion.
364	/^DEP_FILES = .*\\\\$/ {	372	for file in `sed -n "
365	s/^DEP_FILES = //	373	s/^$am__include $am__quote\(.(DEPDIR).\)$am__quote"'$/\1/p' <"$mf" \| \
366	:loop
367	s/\\\\$//
368	p
369	n
370	/\\\\$/ b loop
371	p
372	}
373	/^DEP_FILES = / s/^DEP_FILES = //p' < "$mf" \| \
374	sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g' -e 's/\$U/'"$U"'/g'`; do	374	sed -e 's/\$(DEPDIR)/'"$DEPDIR"'/g' -e 's/\$U/'"$U"'/g'`; do
375	# Make sure the directory exists.	375	# Make sure the directory exists.
376	test -f "$dirpart/$file" && continue	376	test -f "$dirpart/$file" && continue
Lines 425-431 Link Here
425	# This macro actually does too much some checks are only needed if	425	# This macro actually does too much some checks are only needed if
426	# your package does certain things. But this isn't really a big deal.	426	# your package does certain things. But this isn't really a big deal.
427		427
428	# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003	428	# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
429	# Free Software Foundation, Inc.	429	# Free Software Foundation, Inc.
430		430
431	# This program is free software; you can redistribute it and/or modify	431	# This program is free software; you can redistribute it and/or modify
Lines 501-507 Link Here
501	AM_MISSING_PROG(AUTOMAKE, automake-${am__api_version})	501	AM_MISSING_PROG(AUTOMAKE, automake-${am__api_version})
502	AM_MISSING_PROG(AUTOHEADER, autoheader)	502	AM_MISSING_PROG(AUTOHEADER, autoheader)
503	AM_MISSING_PROG(MAKEINFO, makeinfo)	503	AM_MISSING_PROG(MAKEINFO, makeinfo)
504	AM_MISSING_PROG(AMTAR, tar)
505	AM_PROG_INSTALL_SH	504	AM_PROG_INSTALL_SH
506	AM_PROG_INSTALL_STRIP	505	AM_PROG_INSTALL_STRIP
507	AC_REQUIRE([AM_PROG_MKDIR_P])dnl	506	AC_REQUIRE([AM_PROG_MKDIR_P])dnl
Lines 510-516 Link Here
510	AC_REQUIRE([AC_PROG_AWK])dnl	509	AC_REQUIRE([AC_PROG_AWK])dnl
511	AC_REQUIRE([AC_PROG_MAKE_SET])dnl	510	AC_REQUIRE([AC_PROG_MAKE_SET])dnl
512	AC_REQUIRE([AM_SET_LEADING_DOT])dnl	511	AC_REQUIRE([AM_SET_LEADING_DOT])dnl
513		512	_AM_IF_OPTION([tar-ustar], [_AM_PROG_TAR([ustar])],
		513	[_AM_IF_OPTION([tar-pax], [_AM_PROG_TAR([pax])],
		514	[_AM_PROG_TAR([v7])])])
514	_AM_IF_OPTION([no-dependencies],,	515	_AM_IF_OPTION([no-dependencies],,
515	[AC_PROVIDE_IFELSE([AC_PROG_CC],	516	[AC_PROVIDE_IFELSE([AC_PROG_CC],
516	[_AM_DEPENDENCIES(CC)],	517	[_AM_DEPENDENCIES(CC)],
Lines 753-765 Link Here
753	# this.)	754	# this.)
754	AC_DEFUN([AM_PROG_MKDIR_P],	755	AC_DEFUN([AM_PROG_MKDIR_P],
755	[if mkdir -p --version . >/dev/null 2>&1 && test ! -d ./--version; then	756	[if mkdir -p --version . >/dev/null 2>&1 && test ! -d ./--version; then
756	# Keeping the `.' argument allows $(mkdir_p) to be used without	757	# We used to keeping the `.' as first argument, in order to
757	# argument. Indeed, we sometimes output rules like	758	# allow $(mkdir_p) to be used without argument. As in
758	# $(mkdir_p) $(somedir)	759	# $(mkdir_p) $(somedir)
759	# where $(somedir) is conditionally defined.	760	# where $(somedir) is conditionally defined. However this is wrong
760	# (`test -n '$(somedir)' && $(mkdir_p) $(somedir)' is a more	761	# for two reasons:
761	# expensive solution, as it forces Make to start a sub-shell.)	762	# 1. if the package is installed by a user who cannot write `.'
762	mkdir_p='mkdir -p -- .'	763	# make install will fail,
		764	# 2. the above comment should most certainly read
		765	# $(mkdir_p) $(DESTDIR)$(somedir)
		766	# so it does not work when $(somedir) is undefined and
		767	# $(DESTDIR) is not.
		768	# To support the latter case, we have to write
		769	# test -z "$(somedir)" \|\| $(mkdir_p) $(DESTDIR)$(somedir),
		770	# so the `.' trick is pointless.
		771	mkdir_p='mkdir -p --'
763	else	772	else
764	# On NextStep and OpenStep, the `mkdir' command does not	773	# On NextStep and OpenStep, the `mkdir' command does not
765	# recognize any option. It will interpret all options as	774	# recognize any option. It will interpret all options as
Lines 925-928 Link Here
925	INSTALL_STRIP_PROGRAM="\${SHELL} \$(install_sh) -c -s"	934	INSTALL_STRIP_PROGRAM="\${SHELL} \$(install_sh) -c -s"
926	AC_SUBST([INSTALL_STRIP_PROGRAM])])	935	AC_SUBST([INSTALL_STRIP_PROGRAM])])
927		936
		937	# Check how to create a tarball. -- Autoconf --
		938
		939	# Copyright (C) 2004 Free Software Foundation, Inc.
		940
		941	# This program is free software; you can redistribute it and/or modify
		942	# it under the terms of the GNU General Public License as published by
		943	# the Free Software Foundation; either version 2, or (at your option)
		944	# any later version.
		945
		946	# This program is distributed in the hope that it will be useful,
		947	# but WITHOUT ANY WARRANTY; without even the implied warranty of
		948	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
		949	# GNU General Public License for more details.
		950
		951	# You should have received a copy of the GNU General Public License
		952	# along with this program; if not, write to the Free Software
		953	# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
		954	# 02111-1307, USA.
		955
		956	# serial 1
		957
		958
		959	# _AM_PROG_TAR(FORMAT)
		960	# --------------------
		961	# Check how to create a tarball in format FORMAT.
		962	# FORMAT should be one of `v7', `ustar', or `pax'.
		963	#
		964	# Substitute a variable $(am__tar) that is a command
		965	# writing to stdout a FORMAT-tarball containing the directory
		966	# $tardir.
		967	# tardir=directory && $(am__tar) > result.tar
		968	#
		969	# Substitute a variable $(am__untar) that extract such
		970	# a tarball read from stdin.
		971	# $(am__untar) < result.tar
		972	AC_DEFUN([_AM_PROG_TAR],
		973	[# Always define AMTAR for backward compatibility.
		974	AM_MISSING_PROG([AMTAR], [tar])
		975	m4_if([$1], [v7],
		976	[am__tar='${AMTAR} chof - "$$tardir"'; am__untar='${AMTAR} xf -'],
		977	[m4_case([$1], [ustar],, [pax],,
		978	[m4_fatal([Unknown tar format])])
		979	AC_MSG_CHECKING([how to create a $1 tar archive])
		980	# Loop over all known methods to create a tar archive until one works.
		981	_am_tools='gnutar m4_if([$1], [ustar], [plaintar]) pax cpio none'
		982	_am_tools=${am_cv_prog_tar_$1-$_am_tools}
		983	# Do not fold the above two line into one, because Tru64 sh and
		984	# Solaris sh will not grok spaces in the rhs of `-'.
		985	for _am_tool in $_am_tools
		986	do
		987	case $_am_tool in
		988	gnutar)
		989	for _am_tar in tar gnutar gtar;
		990	do
		991	AM_RUN_LOG([$_am_tar --version]) && break
		992	done
		993	am__tar="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$$tardir"'
		994	am__tar_="$_am_tar --format=m4_if([$1], [pax], [posix], [$1]) -chf - "'"$tardir"'
		995	am__untar="$_am_tar -xf -"
		996	;;
		997	plaintar)
		998	# Must skip GNU tar: if it does not support --format= it doesn't create
		999	# ustar tarball either.
		1000	(tar --version) >/dev/null 2>&1 && continue
1001	am__tar='tar chf - "$$tardir"'
1002	am__tar_='tar chf - "$tardir"'
1003	am__untar='tar xf -'
1004	;;
1005	pax)
1006	am__tar='pax -L -x $1 -w "$$tardir"'
1007	am__tar_='pax -L -x $1 -w "$tardir"'
1008	am__untar='pax -r'
1009	;;
1010	cpio)
1011	am__tar='find "$$tardir" -print \| cpio -o -H $1 -L'
1012	am__tar_='find "$tardir" -print \| cpio -o -H $1 -L'
1013	am__untar='cpio -i -H $1 -d'
1014	;;
1015	none)
1016	am__tar=false
1017	am__tar_=false
1018	am__untar=false
1019	;;
1020	esac
1021
1022	# If the value was cached, stop now. We just wanted to have am__tar
1023	# and am__untar set.
1024	test -n "${am_cv_prog_tar_$1}" && break
1025
1026	# tar/untar a dummy directory, and stop if the command works
1027	rm -rf conftest.dir
1028	mkdir conftest.dir
1029	echo GrepMe > conftest.dir/file
1030	AM_RUN_LOG([tardir=conftest.dir && eval $am__tar_ >conftest.tar])
1031	rm -rf conftest.dir
1032	if test -s conftest.tar; then
1033	AM_RUN_LOG([$am__untar <conftest.tar])
1034	grep GrepMe conftest.dir/file >/dev/null 2>&1 && break
1035	fi
1036	done
1037	rm -rf conftest.dir
1038
1039	AC_CACHE_VAL([am_cv_prog_tar_$1], [am_cv_prog_tar_$1=$_am_tool])
1040	AC_MSG_RESULT([$am_cv_prog_tar_$1])])
1041	AC_SUBST([am__tar])
1042	AC_SUBST([am__untar])
1043	]) # _AM_PROG_TAR
1044
928	m4_include([acinclude.m4])	1045	m4_include([acinclude.m4])

Lines 197-202 Link Here

(-)buffer.c:1.4 (+11 lines)
197	}	197	}
198	}	198	}
199	}	199	}
		200	void buf_puts(struct buffer buf, const char str)
		201	{
		202	uint8_t *ptr = BEND (buf);
		203	int cap = buf_forward_capacity (buf);
		204	if (cap > 0)
		205	{
		206	strncpynt ((char *)ptr,str, cap);
		207	(buf->data + buf->capacity - 1) = 0; / windows vsnprintf needs this */
		208	buf->len += (int) strlen ((char *)ptr);
		209	}
		210	}
200		211
201	/*	212	/*
202	* This is necessary due to certain buggy implementations of snprintf,	213	* This is necessary due to certain buggy implementations of snprintf,

Lines 172-198 Link Here

(-)mroute.c:1.4 (-7 / +100 lines)
172	* to a struct mroute_addr (addr).	172	* to a struct mroute_addr (addr).
173	*/	173	*/
174	bool	174	bool
175	mroute_extract_sockaddr_in (struct mroute_addr addr, const struct sockaddr_in saddr, bool use_port)	175	mroute_extract_openvpn_sockaddr (struct mroute_addr addr, const struct openvpn_sockaddr osaddr, bool use_port)
176	{	176	{
177	if (saddr->sin_family == AF_INET)	177	switch (osaddr->addr.sa.sa_family)
178	{	178	{
		179	case AF_INET:
179	if (use_port)	180	if (use_port)
180	{	181	{
181	addr->type = MR_ADDR_IPV4 \| MR_WITH_PORT;	182	addr->type = MR_ADDR_IPV4 \| MR_WITH_PORT;
182	addr->netbits = 0;	183	addr->netbits = 0;
183	addr->len = 6;	184	addr->len = 6;
184	memcpy (addr->addr, &saddr->sin_addr.s_addr, 4);	185	memcpy (addr->addr, &osaddr->addr.in.sin_addr.s_addr, 4);
185	memcpy (addr->addr + 4, &saddr->sin_port, 2);	186	memcpy (addr->addr + 4, &osaddr->addr.in.sin_port, 2);
186	}	187	}
187	else	188	else
188	{	189	{
189	addr->type = MR_ADDR_IPV4;	190	addr->type = MR_ADDR_IPV4;
190	addr->netbits = 0;	191	addr->netbits = 0;
191	addr->len = 4;	192	addr->len = 4;
192	memcpy (addr->addr, &saddr->sin_addr.s_addr, 4);	193	memcpy (addr->addr, &osaddr->addr.in.sin_addr.s_addr, 4);
193	}	194	}
194	return true;	195	return true;
195	}	196
		197	#ifdef USE_PF_INET6
		198	case AF_INET6:
		199	if (use_port)
		200	{
		201	addr->type = MR_ADDR_IPV6 \| MR_WITH_PORT;
		202	addr->netbits = 0;
		203	addr->len = 18;
		204	memcpy (addr->addr, &osaddr->addr.in6.sin6_addr, 16);
		205	memcpy (addr->addr + 16, &osaddr->addr.in6.sin6_port, 2);
		206	}
		207	else
		208	{
		209	addr->type = MR_ADDR_IPV6;
		210	addr->netbits = 0;
		211	addr->len = 16;
		212	memcpy (addr->addr, &osaddr->addr.in6.sin6_addr, 16);
		213	}
		214	return true;
		215	#endif
		216	#ifdef USE_PF_UNIX
		217	case AF_UNIX:
		218	{
		219	struct stat st_buf;
		220	addr->type = MR_ADDR_UNIX;
		221	addr->netbits = 0;
		222	addr->len = 0 ;
		223	memset(addr->addr, 0, sizeof (addr->addr));
		224	if (stat(osaddr->addr.un.sun_path, &st_buf)<0)
		225	{
		226	msg(M_WARN, "Could not stat(%s)", osaddr->addr.un.sun_path);
		227	return false;
		228	}
		229	msg(M_INFO, "MR_ADDR_UNIX stat(\"%s\"): (0x%08lx, %lu)", osaddr->addr.un.sun_path, (unsigned long)st_buf.st_dev, (unsigned long)st_buf.st_ino);
		230	/* Put unix socket path {device,inode} numbers into addr (uniq and shorter that pathname */
		231	memcpy(addr->addr, &st_buf.st_dev, sizeof(st_buf.st_dev));
		232	memcpy(addr->addr+sizeof(st_buf.st_dev), &st_buf.st_ino, sizeof(st_buf.st_ino));
		233	addr->len = sizeof(st_buf.st_dev) + sizeof (st_buf.st_ino) ;
		234	return true;
		235	}
		236	#endif
		237	}
196	return false;	238	return false;
197	}	239	}
198		240
Lines 267-274 Link Here
267	}	309	}
268	break;	310	break;
269	case MR_ADDR_IPV6:	311	case MR_ADDR_IPV6:
		312	#ifdef USE_PF_INET6
		313	{
		314	struct buffer buf;
		315	struct sockaddr_in6 sin6;
		316	int port;
		317	char buf6[INET6_ADDRSTRLEN] = "";
		318	memset(&sin6, 0, sizeof sin6);
		319	sin6.sin6_family = AF_INET6;
		320	buf_set_read (&buf, maddr.addr, maddr.len);
		321	if (buf_read(&buf, &sin6.sin6_addr, sizeof (sin6.sin6_addr)))
		322	{
		323	if (getnameinfo((struct sockaddr *)&sin6, sizeof (struct sockaddr_in6),
		324	buf6, sizeof (buf6), NULL, 0, NI_NUMERICHOST) != 0)
		325	{
		326	buf_printf (&out, "MR_ADDR_IPV6 getnameinfo() err");
		327	break;
		328	}
		329	buf_puts (&out, buf6);
		330	if (maddr.type & MR_WITH_NETBITS)
		331	buf_printf (&out, "/%d", maddr.netbits);
		332	if (maddr.type & MR_WITH_PORT)
		333	{
		334	port = buf_read_u16 (&buf);
		335	if (port >= 0)
		336	buf_printf (&out, ":%d", port);
		337	}
		338	}
		339	}
		340	#else /* old pre IPV6 1-line code: */
270	buf_printf (&out, "IPV6");	341	buf_printf (&out, "IPV6");
		342	#endif
271	break;	343	break;
		344	#ifdef USE_PF_UNIX
		345	case MR_ADDR_UNIX:
		346	{
		347	struct buffer buf;
		348	dev_t path_dev;
		349	ino_t path_ino;
		350	buf_set_read (&buf, maddr.addr, maddr.len);
		351	if (!buf_read(&buf, &path_dev, sizeof path_dev))
		352	{
		353	msg(M_WARN, "Error reading path_dev from MR_ADDR_UNIX addr");
		354	break;
		355	}
		356	if (!buf_read(&buf, &path_ino, sizeof path_ino))
		357	{
		358	msg(M_WARN, "Error reading path_ino from MR_ADDR_UNIX addr");
		359	break;
		360	}
		361	buf_printf (&out, "UNIX: (0x%08lx, %lu)", (unsigned long)path_dev, (unsigned long)path_ino);
		362	}
		363	break;
		364	#endif
272	default:	365	default:
273	buf_printf (&out, "UNKNOWN");	366	buf_printf (&out, "UNKNOWN");
274	break;	367	break;

Lines 54-66 Link Here

(-)mroute.h:1.4 (-3 / +9 lines)
54	#define MR_ADDR_ETHER 1	54	#define MR_ADDR_ETHER 1
55	#define MR_ADDR_IPV4 2	55	#define MR_ADDR_IPV4 2
56	#define MR_ADDR_IPV6 3	56	#define MR_ADDR_IPV6 3
57	#define MR_ADDR_MASK 3	57	#define MR_ADDR_UNIX 4
		58	#define MR_ADDR_MASK 7
58		59
59	/* Address type mask indicating that port # is part of address */	60	/* Address type mask indicating that port # is part of address */
60	#define MR_WITH_PORT 4	61	#define MR_WITH_PORT 8
61		62
62	/* Address type mask indicating that netbits is part of address */	63	/* Address type mask indicating that netbits is part of address */
63	#define MR_WITH_NETBITS 8	64	#define MR_WITH_NETBITS 16
64		65
65	struct mroute_addr {	66	struct mroute_addr {
66	uint8_t len; /* length of address */	67	uint8_t len; /* length of address */
Lines 98-103 Link Here
98	const struct sockaddr_in *saddr,	99	const struct sockaddr_in *saddr,
99	bool use_port);	100	bool use_port);
100		101
		102	struct openvpn_sockaddr;
		103	int mroute_extract_openvpn_sockaddr(struct mroute_addr *addr,
		104	const struct openvpn_sockaddr *osaddr,
		105	int use_port);
		106
101	bool mroute_learnable_address (const struct mroute_addr *addr);	107	bool mroute_learnable_address (const struct mroute_addr *addr);
102		108
103	uint32_t mroute_addr_hash_function (const void *key, uint32_t iv);	109	uint32_t mroute_addr_hash_function (const void *key, uint32_t iv);

Lines 938-950 Link Here

(-)multi.c:1.4 (-19 / +13 lines)
938	in_addr_t a,	938	in_addr_t a,
939	int netbits) /* -1 if host route, otherwise # of network bits in address */	939	int netbits) /* -1 if host route, otherwise # of network bits in address */
940	{	940	{
941	struct sockaddr_in remote_si;	941	struct openvpn_sockaddr remote_si;
942	struct mroute_addr addr;	942	struct mroute_addr addr;
943		943
944	CLEAR (remote_si);	944	CLEAR (remote_si);
945	remote_si.sin_family = AF_INET;	945	remote_si.addr.in.sin_family = AF_INET;
946	remote_si.sin_addr.s_addr = htonl (a);	946	remote_si.addr.in.sin_addr.s_addr = htonl (a);
947	ASSERT (mroute_extract_sockaddr_in (&addr, &remote_si, false));	947	ASSERT (mroute_extract_openvpn_sockaddr (&addr, &remote_si, false));
948		948
949	if (netbits >= 0)	949	if (netbits >= 0)
950	{	950	{
Lines 2008-2022 Link Here
2008	struct multi_context m = (struct multi_context ) arg;	2008	struct multi_context m = (struct multi_context ) arg;
2009	struct hash_iterator hi;	2009	struct hash_iterator hi;
2010	struct hash_element *he;	2010	struct hash_element *he;
2011	struct sockaddr_in saddr;	2011	struct openvpn_sockaddr saddr;
2012	struct mroute_addr maddr;	2012	struct mroute_addr maddr;
2013	int count = 0;	2013	int count = 0;
2014		2014
2015	CLEAR (saddr);	2015	CLEAR (saddr);
2016	saddr.sin_family = AF_INET;	2016	saddr.addr.in.sin_family = AF_INET;
2017	saddr.sin_addr.s_addr = htonl (addr);	2017	saddr.addr.in.sin_addr.s_addr = htonl (addr);
2018	saddr.sin_port = htons (port);	2018	saddr.addr.in.sin_port = htons (port);
2019	if (mroute_extract_sockaddr_in (&maddr, &saddr, true))	2019	if (mroute_extract_openvpn_sockaddr (&maddr, &saddr, true))
2020	{	2020	{
2021	hash_iterator_init (m->iter, &hi, true);	2021	hash_iterator_init (m->iter, &hi, true);
2022	while ((he = hash_iterator_next (&hi)))	2022	while ((he = hash_iterator_next (&hi)))
Lines 2076-2091 Link Here
2076	{	2076	{
2077	ASSERT (top->options.mode == MODE_SERVER);	2077	ASSERT (top->options.mode == MODE_SERVER);
2078		2078
2079	switch (top->options.proto) {	2079	if (proto_is_dgram(top->options.proto))
2080	case PROTO_UDPv4:	2080	tunnel_server_udp(top);
2081	tunnel_server_udp (top);	2081	else
2082	break;	2082	tunnel_server_tcp(top);
2083	case PROTO_TCPv4_SERVER:
2084	tunnel_server_tcp (top);
2085	break;
2086	default:
2087	ASSERT (0);
2088	}
2089	}	2083	}
2090		2084
2091	#else	2085	#else

Added Link Here

(-)/dev/null (+24 lines)
1	#ifndef _PAYLOAD_INLINE_H
2	#define _PAYLOAD_INLINE_H
3
4	#ifdef USE_PAYLOAD_CONNTRACK
5	/*
6	* Should run conntrack GC?
7	*/
8	static inline void
9	check_payload_gc (struct context *c)
10	{
11	void check_payload_gc_dowork (struct context *c);
12	if (!c->c2.payload_context)
13	return;
14	if (!event_timeout_defined (&c->c2.payload_context->gc.wakeup))
15	return;
16	if (event_timeout_trigger (&c->c2.payload_context->gc.wakeup, &c->c2.timeval, ETT_DEFAULT))
17	check_payload_gc_dowork (c);
18	}
19
20	#endif
21	#endif /* _PAYLOAD_INLINE_H */
22	/*
23	vim: cino={.5s,\:.5s,+.5s,t0,g0,^-2,e-2,n-2,p2s,(0,=.5s:sw=4:ts=8:sts=4
24	*/

Added Link Here

(-)/dev/null (+499 lines)
1	/*
2	*** THIS IS WORK IN PROGRESS (and correctly ifdef'd out) --jjo Jun/2005 ***
3	*
4	* Payload conntrack optimizations for OpenVPN
5	* Intended for filtering TCP retransmissions over reliable links
6	*
7	* QUICK copy-n-paste for jjo:
8	* make payload.o CFLAGS="-D USE_PAYLOAD_CONNTRACK=1 -Wall "
9	*
10	* Author: JuanJo Ciarlante <jjo@mendoza.gov.ar>
11	*
12	* This program is free software; you can redistribute it and/or modify
13	* it under the terms of the GNU General Public License as published by
14	* the Free Software Foundation; either version 2 of the License, or
15	* (at your option) any later version.
16	*
17	* This program is distributed in the hope that it will be useful,
18	* but WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20	* GNU General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program (see the file COPYING included with this
24	* distribution); if not, write to the Free Software Foundation, Inc.,
25	* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26	*/
27
28	#ifdef WIN32
29	#include "config-win32.h"
30	#else
31	#include "config.h"
32	#endif
33
34	#ifdef USE_PAYLOAD_CONNTRACK
35
36	#include "syshead.h"
37	#include "forward.h"
38	#include "memdbg.h"
39
40	#include "list.h"
41	#include "forward-inline.h"
42	#include "payload.h"
43	#define PAYLOAD_HASH_SIZE 256 /* Should be configurable by option */
44
45	#define PAYLOAD_N_TCPSEGS 8
46	/*
47	* struct payload_tuple_id : uniq 5-upla (proto==TCP is implicit)
48	*/
49	struct payload_tuple_id {
50	/* BEGIN uniq TCP 5-upla id */
51	uint32_t ip_saddr, ip_daddr;
52	uint16_t tcp_sport, tcp_dport;
53	/* END uniq TCP 5-upla id */
54	};
55
56	/*
57	* payload_tuple: 1 per TCP connection, currently only TX side hook
58	*/
59	struct payload_tuple {
60	struct payload_tuple_id id;
61	/* round robin array with PAYLOAD_N_TCPSEGS latest tcp segments: */
62	struct {
63	struct openvpn_tcphdr tcph;
64	int tcp_len;
65	int hits;
66	} tcp_seg[PAYLOAD_N_TCPSEGS];
67	int tcp_seg_idx; /* next slot to use */
68	time_t last_used;
69	time_t expires;
70	int conn_hits;
71	int deleted;
72	};
73
74	/* shortcuts macros for easier printing */
75	#define PAYLOAD_FMT_MIN "0x%08x:%d -> 0x%08x:%d"
76	#define PAYLOAD_FMT_MIN_ARGS(pip, ptcp) \
77	ntohl(pip->saddr), ntohs(ptcp->source),\
78	ntohl(pip->daddr), ntohs(ptcp->dest)
79
80	#define PAYLOAD_FMT_MED PAYLOAD_FMT_MIN " (seq=%08x, ack_seq=%08x)"
81	#define PAYLOAD_FMT_MED_ARGS(pip, ptcp) PAYLOAD_FMT_MIN_ARGS(pip, ptcp) ,\
82	ntohl(ptcp->seq),ntohl(ptcp->ack_seq)
83
84	#define PAYLOAD_FMT_FULL PAYLOAD_FMT_MED " w=%d [%c%c%c%c%c%c]" /* doesn't show WSCALE */
85	#define PAYLOAD_FMT_FULL_ARGS(pip, ptcp) PAYLOAD_FMT_MED_ARGS(pip,ptcp) ,\
86	ntohs(ptcp->window), \
87	OPENVPN_TCPH_FIN_MASK & ptcp->flags ? 'F' : '.', \
88	OPENVPN_TCPH_SYN_MASK & ptcp->flags ? 'S' : '.', \
89	OPENVPN_TCPH_RST_MASK & ptcp->flags ? 'R' : '.', \
90	OPENVPN_TCPH_PSH_MASK & ptcp->flags ? 'P' : '.', \
91	OPENVPN_TCPH_ACK_MASK & ptcp->flags ? 'A' : '.', \
92	OPENVPN_TCPH_URG_MASK & ptcp->flags ? 'P' : '.'
93	/* hash related functions */
94	static inline const uint8_t *
95	payload_tuple_hash_ptr (const struct payload_tuple *pt)
96	{
97	return (uint8_t *) &pt->id;
98	}
99
100	static inline uint32_t
101	payload_tuple_hash_len (const struct payload_tuple *pt)
102	{
103	return (uint32_t) sizeof (pt->id);
104	}
105
106	uint32_t
107	payload_tuple_hash_func (const void *key, uint32_t iv)
108	{
109	return hash_func(payload_tuple_hash_ptr((const struct payload_tuple *)key),
110	payload_tuple_hash_len((const struct payload_tuple *)key),
111	iv);
112	}
113
114	bool
115	payload_tuple_compare_func(const void key1, const void key2)
116	{
117	return memcmp(&((const struct payload_tuple *)key1)->id,
118	&((const struct payload_tuple *)key2)->id,
119	sizeof ((const struct payload_tuple *)key1)->id) == 0;
120	}
121
122
123	/* create a new conntrack entry */
124	static struct payload_tuple *
125	payload_tuple_new(void)
126	{
127	struct payload_tuple *pt;
128	ALLOC_OBJ_CLEAR(pt, struct payload_tuple);
129	return pt;
130	}
131	void
132	payload_tuple_delete(struct payload_tuple *pt)
133	{
134	free(pt);
135	}
136
137	/* initialize conntrack entry with {ip,tcp} hdr data */
138	static void
139	payload_tuple_id_init(struct payload_tuple_id pt_id, const struct openvpn_iphdr pip, const struct openvpn_tcphdr *ptcp)
140	{
141	ASSERT(pt_id);
142	CLEAR(*pt_id);
143	pt_id->ip_saddr=pip->saddr;
144	pt_id->ip_daddr=pip->daddr;
145	pt_id->tcp_sport=ptcp->source;
146	pt_id->tcp_dport=ptcp->dest;
147	}
148
149	/*
150	* How many buckets in hash to gc per pass. (shamelessly stolen from multi.c)
151	*/
152	#define PAYLOAD_GC_DIVISOR 256 /* How many passes to cover whole hash table */
153	#define PAYLOAD_GC_MIN 16 /* Minimum number of buckets per pass */
154	#define PAYLOAD_GC_MAX 1024 /* Maximum number of buckets per pass */
155	static int
156	payload_gc_buckets_per_pass (int n_buckets)
157	{
158	return constrain_int (n_buckets / PAYLOAD_GC_DIVISOR, PAYLOAD_GC_MIN, PAYLOAD_GC_MAX);
159	}
160
161	/*
162	* Adjust next event wakeup based on how many conntrack entries present
163	* currently it programs
164	*/
165	static void
166	payload_gc_adjust_timers(struct context *c)
167	{
168	struct payload_context *pc=c->c2.payload_context;
169	int n=hash_n_elements(pc->hash);
170	if (n>0)
171	{
172	if (pc->gc.wakeup.n != 1)
173	event_timeout_init (&pc->gc.wakeup, 1, now);
174	context_reschedule_sec(c, 1);
175	reset_coarse_timers(c);
176	dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_adjust_timers: n_elem=%d wakeup.n=%d", n, pc->gc.wakeup.n);
177	}
178	else
179	{
180	event_timeout_clear(&pc->gc.wakeup);
181	dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_adjust_timers: n_elem=%d timeout_cleared", n);
182	}
183	}
184	/*
185	* garbage collect old (pt->deleted) entries
186	*/
187	int
188	payload_gc_run(struct payload_context *pc, int start_bucket, int end_bucket)
189	{
190	int n_deleted=0, n_total=0, n_total_hits=0;
191	struct hash_element *he;
192	struct hash_iterator hi;
193	if (start_bucket < 0)
194	{
195	start_bucket = 0;
196	end_bucket = hash_n_buckets (pc->hash);
197	}
198	hash_iterator_init_range (pc->hash, &hi, true, start_bucket, end_bucket);
199	while ((he = hash_iterator_next (&hi)) != NULL)
200	{
201	struct payload_tuple pt = (struct payload_tuple ) he->value;
202	n_total++;
203	n_total_hits+=pt->conn_hits;
204	if (now > pt->expires)
205	pt->deleted++;
206	/*
207	* could have been marked syncronously (from payload_tcp_dd ...) or
208	* async (here) by above check
209	*/
210	if (pt->deleted)
211	{
212	n_deleted++;
213	dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_run DELETED " PAYLOAD_FMT_MIN,
214	ntohl(pt->id.ip_saddr), ntohs(pt->id.tcp_sport),
215	ntohl(pt->id.ip_daddr), ntohs(pt->id.tcp_dport));
216	payload_tuple_delete(pt);
217	hash_iterator_delete_element (&hi);
218	}
219	}
220	hash_iterator_free (&hi);
221	dmsg(D_PAYLOAD_CONNTRACK, "payload_gc_run(%d,%d) DELETED %d/%d entries, n_elem=%d, total_hits=%d" ,
222	start_bucket, end_bucket,
223	n_deleted, n_total, hash_n_elements(pc->hash), n_total_hits);
224	return n_deleted;
225	}
226
227	static void
228	payload_gc_dowork(struct payload_context *pc)
229	{
230	if (pc->gc.bucket_base >= hash_n_buckets(pc->hash))
231	pc->gc.bucket_base = 0;
232	payload_gc_run(pc, pc->gc.bucket_base, pc->gc.bucket_base+pc->gc.buckets_per_pass);
233	pc->gc.bucket_base+= pc->gc.buckets_per_pass;
234	}
235
236	/*
237	* conntrack cleaner from event ticks
238	*/
239	void
240	check_payload_gc_dowork (struct context *c)
241	{
242	struct payload_context *pc=c->c2.payload_context;
243	ASSERT(pc);
244	payload_gc_dowork(pc);
245	payload_gc_adjust_timers(c);
246	}
247
248	/*
249	* Loop over TCP options, call callback() if matches passed TCP opt (wildcard: OPENVPN_TCPOPT_ANY)
250	*
251	* Some examples:
252	* - is SACK present?
253	* if(tcp_opt_process(buf, OPENVPN_TCPOPT_SACK, NULL, NULL, pip, ptcp)) ...
254	* - if SACK is present, call myfunc(..., myarg, ...)
255	* if(tcp_opt_process(buf, OPENVPN_TCPOPT_SACK, myfunc, myarg, pip, ptcp)) ...
256	* - is any option present? (except EOL, NOP)
257	* if(tcp_opt_process(buf, OPENVPN_TCPOPT_ANY, NULL, NULL, pip, ptcp)) ...
258	* - for each option (except EOL, NOP) call myfunc(..., myarg, ...)
259	* if(tcp_opt_process(buf, OPENVPN_TCPOPT_ANY, myfunc, myarg, pip, ptcp)) ...
260	*
261	*/
262	static inline bool
263	tcp_opt_process (struct buffer buf, int optnum, bool (callback)(uint8_t opt, int optlen, void callback_arg), void *callback_arg)
264	{
265	int hlen, olen, optlen;
266	uint8_t *opt;
267	struct openvpn_tcphdr *ptcp;
268
269	ASSERT (BLEN (buf) >= (int) sizeof (struct openvpn_tcphdr));
270
271	verify_align_4 (buf);
272
273	ptcp = (struct openvpn_tcphdr *) BPTR (buf);
274	hlen = OPENVPN_TCPH_GET_DOFF (ptcp->doff_res);
275
276	/* Invalid header length or header without options. */
277	if (hlen <= (int) sizeof (struct openvpn_tcphdr)
278	\|\| hlen > BLEN (buf))
279	return false;
280
281	for (olen = hlen - sizeof (struct openvpn_tcphdr),
282	opt = (uint8_t *)(ptcp + 1);
283	olen > 0;
284	olen -= optlen, opt += optlen) {
285	if (*opt == OPENVPN_TCPOPT_EOL)
286	break;
287	else if (*opt == OPENVPN_TCPOPT_NOP)
288	optlen = 1;
289	else {
290	optlen = *(opt + 1);
291	if (optlen <= 0 \|\| optlen > olen)
292	break;
293	/*
294	* TCP opt found, callback() passed function and return true if callback succeded
295	*/
296
297	if (optnum == OPENVPN_TCPOPT_ANY \|\| optnum == *opt) {
298	if (callback) {
299	if (callback(opt, optlen, callback_arg))
300	return true;
301	} else
302	/* if no callback function, just return true (opt found) */
303	return true;
304	}
305	}
306	}
307	return false;
308	}
309
310	static inline bool
311	tcp_dd_opt_skip_segment(uint8_t opt, int optlen, void arg)
312	{
313	switch(*opt)
314	{
315	case OPENVPN_TCPOPT_SACK:
316	case OPENVPN_TCPOPT_WSCALE:
317	return true;
318	}
319	return false;
320	}
321	/*
322	* careful logic: TCP may update window, probe 0-window and alike
323	* yet could be seen as a retransmission
324	*/
325
326	static inline int
327	payload_tcp_dd_drop_hit(struct context c, const struct openvpn_iphdr pip, const struct openvpn_tcphdr ptcp, struct buffer buf)
328	{
329	bool result=false;
330	struct hash_element *he;
331	uint32_t hv;
332	struct hash_bucket *bucket;
333	struct payload_context *pc=c->c2.payload_context;
334	struct payload_tuple_id pt_id;
335	struct payload_tuple *pt;
336	struct openvpn_tcphdr tcph = ptcp; / local copy: stored tcph is NOT equal to sniffed one */
337	int ip_totlen=ntohs(pip->tot_len);
338	int tcp_len=ip_totlen-OPENVPN_IPH_GET_LEN (pip->version_len); /* tcphdr+DATA */
339
340	ASSERT(pc);
341	tcph.check=0; /* TCP chksum will vary with eg. tstamp */
342	payload_tuple_id_init(&pt_id, pip, ptcp);
343
344	hv= hash_value (pc->hash, &pt_id);
345	bucket= hash_bucket (pc->hash, hv);
346	hash_bucket_lock (bucket);
347	he = hash_lookup_fast (pc->hash, bucket, &pt_id, hv);
348	if (he)
349	{
350	int i;
351	pt = (struct payload_tuple *) he->value;
352	/*
353	* Avoid filtering out if:
354	* - SYN or FIN
355	* - zero window
356	* - zero window probe (data size=1)
357	* - SACK or WSCALE option present
358	*/
359	if ( (ptcp->flags & (OPENVPN_TCPH_SYN_MASK\|OPENVPN_TCPH_FIN_MASK))
360	\|\| tcph.window == 0
361	\|\| (ip_totlen-OPENVPN_TCPH_GET_DOFF(tcph.doff_res))==1
362	\|\| tcp_opt_process(buf, OPENVPN_TCPOPT_ANY, tcp_dd_opt_skip_segment, NULL))
363	{
364	dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_dd_drop_hit: SKIP segment " PAYLOAD_FMT_FULL,
365	PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
366	goto done;
367	}
368
369	/* search for seen TCP header */
370	for(i=0;i<PAYLOAD_N_TCPSEGS;i++)
371	{
372	/*
373	* if:
374	* same seq nums (optimization to avoid next checks if unequal)
375	* AND same tcp segment header (w/o options)
376	* AND same tcp header len (incl. options sizes)
377	*
378	*/
379	if (pt->tcp_seg[i].tcph.seq==tcph.seq
380	&& memcmp(pt->tcp_seg+i, &tcph, sizeof tcph)==0
381	&& pt->tcp_seg[i].tcp_len == tcp_len)
382	{
383	pt->tcp_seg[i].hits++;
384	pt->conn_hits++;
385	dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_dd_drop_hit HIT! conn_hits=%d timeleft=%ld " PAYLOAD_FMT_FULL,
386	pt->conn_hits, pt->expires-now,
387	PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
388	result=true; /* _IS_ a dup */
389	goto done;
390	}
391	}
392	if (pt->expires < now)
393	{
394	pt->deleted=true;
395	goto out;
396	}
397	}
398	else
399	{
400	dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_dd_drop_hit CREATED " PAYLOAD_FMT_FULL, PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
401	pt = payload_tuple_new();
402	pt->id = pt_id;
403	hash_add_fast(pc->hash, bucket, &pt_id, hv, pt);
404	payload_gc_adjust_timers(c);
405	}
406
407	/* Not found or new ... use next available slot */
408	pt->tcp_seg[pt->tcp_seg_idx].tcph=tcph;
409	pt->tcp_seg[pt->tcp_seg_idx].tcp_len=tcp_len;
410	pt->tcp_seg[pt->tcp_seg_idx].hits=0;
411	pt->tcp_seg_idx++;
412	pt->tcp_seg_idx%=PAYLOAD_N_TCPSEGS;
413
414	done:
415	/* refresh entry */
416	pt->expires=now+pc->tcp_retrans;
417	pt->last_used=now;
418
419	out:
420	hash_bucket_unlock (bucket);
421	return result;
422	}
423
424	/*
425	* External interface: payload_tcp_retrans_drop() returns true
426	* if this segment IS a dup (should be dropped by caller)
427	*/
428	bool
429	payload_tcp_retrans_drop (struct context c, struct buffer buf)
430	{
431	const struct openvpn_iphdr *pip;
432	int hlen;
433	if (BLEN (buf) < (int) sizeof (struct openvpn_iphdr))
434	return false;
435	pip = (struct openvpn_iphdr *) BPTR (buf);
436
437	hlen = OPENVPN_IPH_GET_LEN (pip->version_len);
438
439	if (pip->protocol == OPENVPN_IPPROTO_TCP
440	&& ntohs (pip->tot_len) == BLEN (buf)
441	&& (ntohs (pip->frag_off) & OPENVPN_IP_OFFMASK) == 0
442	&& hlen <= BLEN (buf)
443	&& BLEN (buf) - hlen
444	>= (int) sizeof (struct openvpn_tcphdr))
445	{
446	struct buffer newbuf = *buf;
447	if (buf_advance (&newbuf, hlen))
448	{
449	const struct openvpn_tcphdr ptcp = (struct openvpn_tcphdr ) BPTR (&newbuf);
450	/*
451	dmsg(D_PAYLOAD_CONNTRACK, "payload_tcp_retrans_drop : " PAYLOAD_FMT_FULL, PAYLOAD_FMT_FULL_ARGS(pip, ptcp));
452	*/
453	if (c->c2.payload_context && payload_tcp_dd_drop_hit(c, pip, ptcp, buf))
454	return true;
455	}
456	}
457	return false;
458
459	}
460	/* Initialize payload (conntrack) hash table */
461	struct payload_context *
462	payload_new(int tcp_retrans)
463	{
464	struct payload_context *pc;
465	ASSERT(tcp_retrans);
466
467	ALLOC_OBJ_CLEAR(pc, struct payload_context);
468	pc->tcp_retrans = tcp_retrans;
469	pc->hash= hash_init(PAYLOAD_HASH_SIZE, payload_tuple_hash_func, payload_tuple_compare_func);
470	pc->gc.buckets_per_pass = payload_gc_buckets_per_pass(PAYLOAD_HASH_SIZE);
471	#if 0+WIP
472	pc->payload_context>schedule = schedule_init();
473	pc->payload_context>max_tcp_conns = 64; /* XXX: obviously must be configurable, test 4now */
474	#endif
475	event_timeout_clear(&pc->gc.wakeup);
476	return pc;
477	}
478	void payload_free(struct payload_context *pc)
479	{
480	struct hash_iterator hi;
481	struct hash_element *he;
482	ASSERT(pc);
483
484	event_timeout_clear(&pc->gc.wakeup);
485	hash_iterator_init (pc->hash, &hi, true);
486	while ((he = hash_iterator_next (&hi)))
487	{
488	struct payload_tuple pt = (struct payload_tuple ) he->value;
489	pt->deleted++;
490	}
491	hash_iterator_free (&hi);
492	payload_gc_run(pc, -1, 0);
493	free(pc);
494	}
495
496	#endif
497	/*
498	vim: cino={.5s,\:.5s,+.5s,t0,g0,^-2,e-2,n-2,p2s,(0,=.5s:sw=4:ts=8:sts=4
499	*/

Added Link Here

(-)/dev/null (+22 lines)
1	#ifndef _PAYLOAD_H
2	#define _PAYLOAD_H
3	struct payload_context {
4	struct hash *hash;
5	struct schedule schedule; / unused by now */
6	int max_tcp_conns; /* unused by now */
7	int tcp_retrans;
8	struct {
9	time_t per_second_trigger;
10	int bucket_base;
11	int buckets_per_pass;
12	struct event_timeout wakeup;
13	} gc;
14	};
15
16	struct payload_context * payload_new(int tcp_retrans);
17	void payload_free(struct payload_context *);
18	int payload_tcp_retrans_drop(struct context c, struct buffer buf);
19	#endif /* _PAYLOAD_H */
20	/*
21	vim: cino={.5s,\:.5s,+.5s,t0,g0,^-2,e-2,n-2,p2s,(0,=.5s:sw=4:ts=8:sts=4
22	*/

Lines 148-154 Link Here

(-)socks.c:1.4 (-10 / +10 lines)
148	}	148	}
149		149
150	static bool	150	static bool
151	recv_socks_reply (socket_descriptor_t sd, struct sockaddr_in *addr,	151	recv_socks_reply (socket_descriptor_t sd, struct openvpn_sockaddr *addr,
152	volatile int *signal_received)	152	volatile int *signal_received)
153	{	153	{
154	char atyp = '\0';	154	char atyp = '\0';
Lines 159-167 Link Here
159		159
160	if (addr != NULL)	160	if (addr != NULL)
161	{	161	{
162	addr->sin_family = AF_INET;	162	addr->addr.in.sin_family = AF_INET;
163	addr->sin_addr.s_addr = htonl (INADDR_ANY);	163	addr->addr.in.sin_addr.s_addr = htonl (INADDR_ANY);
164	addr->sin_port = htons (0);	164	addr->addr.in.sin_port = htons (0);
165	}	165	}
166		166
167	while (len < 4 + alen + 2)	167	while (len < 4 + alen + 2)
Lines 248-255 Link Here
248	/* ATYP == 1 (IP V4 address) */	248	/* ATYP == 1 (IP V4 address) */
249	if (atyp == '\x01' && addr != NULL)	249	if (atyp == '\x01' && addr != NULL)
250	{	250	{
251	memcpy (&addr->sin_addr, buf + 4, sizeof (addr->sin_addr));	251	memcpy (&addr->addr.in.sin_addr, buf + 4, sizeof (addr->addr.in.sin_addr));
252	memcpy (&addr->sin_port, buf + 8, sizeof (addr->sin_port));	252	memcpy (&addr->addr.in.sin_port, buf + 8, sizeof (addr->addr.in.sin_port));
253	}	253	}
254		254
255		255
Lines 310-316 Link Here
310	establish_socks_proxy_udpassoc (struct socks_proxy_info *p,	310	establish_socks_proxy_udpassoc (struct socks_proxy_info *p,
311	socket_descriptor_t ctrl_sd, /* already open to proxy */	311	socket_descriptor_t ctrl_sd, /* already open to proxy */
312	socket_descriptor_t udp_sd,	312	socket_descriptor_t udp_sd,
313	struct sockaddr_in *relay_addr,	313	struct openvpn_sockaddr *relay_addr,
314	volatile int *signal_received)	314	volatile int *signal_received)
315	{	315	{
316	if (!socks_handshake (ctrl_sd, signal_received))	316	if (!socks_handshake (ctrl_sd, signal_received))
Lines 385-391 Link Here
385	*/	385	*/
386	int	386	int
387	socks_process_outgoing_udp (struct buffer *buf,	387	socks_process_outgoing_udp (struct buffer *buf,
388	struct sockaddr_in *to)	388	struct openvpn_sockaddr *to)
389	{	389	{
390	/*	390	/*
391	* Get a 10 byte subset buffer prepended to buf --	391	* Get a 10 byte subset buffer prepended to buf --
Lines 400-407 Link Here
400	buf_write_u16 (&head, 0); /* RSV = 0 */	400	buf_write_u16 (&head, 0); /* RSV = 0 */
401	buf_write_u8 (&head, 0); /* FRAG = 0 */	401	buf_write_u8 (&head, 0); /* FRAG = 0 */
402	buf_write_u8 (&head, '\x01'); /* ATYP = 1 (IP V4) */	402	buf_write_u8 (&head, '\x01'); /* ATYP = 1 (IP V4) */
403	buf_write (&head, &to->sin_addr, sizeof (to->sin_addr));	403	buf_write (&head, &to->addr.in.sin_addr, sizeof (to->addr.in.sin_addr));
404	buf_write (&head, &to->sin_port, sizeof (to->sin_port));	404	buf_write (&head, &to->addr.in.sin_port, sizeof (to->addr.in.sin_port));
405		405
406	return 10;	406	return 10;
407	}	407	}

Lines 34-39 Link Here

(-)socks.h:1.4 (-2 / +4 lines)
34		34
35	#include "buffer.h"	35	#include "buffer.h"
36		36
		37	struct openvpn_sockaddr;
		38
37	struct socks_proxy_info {	39	struct socks_proxy_info {
38	bool defined;	40	bool defined;
39	bool retry;	41	bool retry;
Lines 58-71 Link Here
58	void establish_socks_proxy_udpassoc (struct socks_proxy_info *p,	60	void establish_socks_proxy_udpassoc (struct socks_proxy_info *p,
59	socket_descriptor_t ctrl_sd, /* already open to proxy */	61	socket_descriptor_t ctrl_sd, /* already open to proxy */
60	socket_descriptor_t udp_sd,	62	socket_descriptor_t udp_sd,
61	struct sockaddr_in *relay_addr,	63	struct openvpn_sockaddr *relay_addr,
62	volatile int *signal_received);	64	volatile int *signal_received);
63		65
64	void socks_process_incoming_udp (struct buffer *buf,	66	void socks_process_incoming_udp (struct buffer *buf,
65	struct sockaddr_in *from);	67	struct sockaddr_in *from);
66		68
67	int socks_process_outgoing_udp (struct buffer *buf,	69	int socks_process_outgoing_udp (struct buffer *buf,
68	struct sockaddr_in *to);	70	struct openvpn_sockaddr *to);
69		71
70	#endif	72	#endif
71	#endif	73	#endif

Lines 361-367 Link Here

(-)ssl.c:1.4 (-38 / +51 lines)
361	static void	361	static void
362	setenv_untrusted (struct tls_session *session)	362	setenv_untrusted (struct tls_session *session)
363	{	363	{
364	setenv_sockaddr (session->opt->es, "untrusted", &session->untrusted_sockaddr, SA_IP_PORT);	364	setenv_sockaddr (session->opt->es, "untrusted", &session->untrusted_addr, SA_IP_PORT);
365	}	365	}
366		366
367	static void	367	static void
Lines 1783-1789 Link Here
1783	write_control_auth (struct tls_session *session,	1783	write_control_auth (struct tls_session *session,
1784	struct key_state *ks,	1784	struct key_state *ks,
1785	struct buffer *buf,	1785	struct buffer *buf,
1786	struct sockaddr_in *to_link_addr,	1786	struct openvpn_sockaddr **to_link_addr,
1787	int opcode,	1787	int opcode,
1788	int max_ack,	1788	int max_ack,
1789	bool prepend_ack)	1789	bool prepend_ack)
Lines 1791-1797 Link Here
1791	uint8_t *header;	1791	uint8_t *header;
1792	struct buffer null = clear_buf ();	1792	struct buffer null = clear_buf ();
1793		1793
1794	ASSERT (addr_defined (&ks->remote_addr));	1794	ASSERT (link_addr_defined (&ks->remote_addr));
1795	ASSERT (reliable_ack_write	1795	ASSERT (reliable_ack_write
1796	(ks->rec_ack, buf, &ks->session_id_remote, max_ack, prepend_ack));	1796	(ks->rec_ack, buf, &ks->session_id_remote, max_ack, prepend_ack));
1797	ASSERT (session_id_write_prepend (&session->session_id, buf));	1797	ASSERT (session_id_write_prepend (&session->session_id, buf));
Lines 1803-1809 Link Here
1803	openvpn_encrypt (buf, null, &session->tls_auth, NULL);	1803	openvpn_encrypt (buf, null, &session->tls_auth, NULL);
1804	ASSERT (swap_hmac (buf, &session->tls_auth, false));	1804	ASSERT (swap_hmac (buf, &session->tls_auth, false));
1805	}	1805	}
1806	*to_link_addr = ks->remote_addr;	1806	*to_link_addr = &ks->remote_addr;
1807	}	1807	}
1808		1808
1809	/*	1809	/*
Lines 1812-1818 Link Here
1812	static bool	1812	static bool
1813	read_control_auth (struct buffer *buf,	1813	read_control_auth (struct buffer *buf,
1814	const struct crypto_options *co,	1814	const struct crypto_options *co,
1815	const struct sockaddr_in *from)	1815	const struct openvpn_sockaddr *from)
1816	{	1816	{
1817	struct gc_arena gc = gc_new ();	1817	struct gc_arena gc = gc_new ();
1818		1818
Lines 1825-1831 Link Here
1825	{	1825	{
1826	msg (D_TLS_ERRORS,	1826	msg (D_TLS_ERRORS,
1827	"TLS Error: cannot locate HMAC in incoming packet from %s",	1827	"TLS Error: cannot locate HMAC in incoming packet from %s",
1828	print_sockaddr (from, &gc));	1828	print_link_sockaddr (from, &gc));
1829	gc_free (&gc);	1829	gc_free (&gc);
1830	return false;	1830	return false;
1831	}	1831	}
Lines 1837-1843 Link Here
1837	{	1837	{
1838	msg (D_TLS_ERRORS,	1838	msg (D_TLS_ERRORS,
1839	"TLS Error: incoming packet authentication failed from %s",	1839	"TLS Error: incoming packet authentication failed from %s",
1840	print_sockaddr (from, &gc));	1840	print_link_sockaddr (from, &gc));
1841	gc_free (&gc);	1841	gc_free (&gc);
1842	return false;	1842	return false;
1843	}	1843	}
Lines 2719-2725 Link Here
2719	tls_process (struct tls_multi *multi,	2719	tls_process (struct tls_multi *multi,
2720	struct tls_session *session,	2720	struct tls_session *session,
2721	struct buffer *to_link,	2721	struct buffer *to_link,
2722	struct sockaddr_in *to_link_addr,	2722	struct openvpn_sockaddr **to_link_addr,
2723	struct link_socket_info *to_link_socket_info,	2723	struct link_socket_info *to_link_socket_info,
2724	interval_t *wakeup)	2724	interval_t *wakeup)
2725	{	2725	{
Lines 3112-3118 Link Here
3112	bool	3112	bool
3113	tls_multi_process (struct tls_multi *multi,	3113	tls_multi_process (struct tls_multi *multi,
3114	struct buffer *to_link,	3114	struct buffer *to_link,
3115	struct sockaddr_in *to_link_addr,	3115	struct openvpn_sockaddr **to_link_addr,
3116	struct link_socket_info *to_link_socket_info,	3116	struct link_socket_info *to_link_socket_info,
3117	interval_t *wakeup)	3117	interval_t *wakeup)
3118	{	3118	{
Lines 3136-3142 Link Here
3136		3136
3137	/* set initial remote address */	3137	/* set initial remote address */
3138	if (i == TM_ACTIVE && ks->state == S_INITIAL &&	3138	if (i == TM_ACTIVE && ks->state == S_INITIAL &&
3139	addr_defined (&to_link_socket_info->lsa->actual))	3139	link_addr_defined (&to_link_socket_info->lsa->actual))
3140	ks->remote_addr = to_link_socket_info->lsa->actual;	3140	ks->remote_addr = to_link_socket_info->lsa->actual;
3141		3141
3142	dmsg (D_TLS_DEBUG,	3142	dmsg (D_TLS_DEBUG,
Lines 3145-3161 Link Here
3145	state_name (ks->state),	3145	state_name (ks->state),
3146	session_id_print (&session->session_id, &gc),	3146	session_id_print (&session->session_id, &gc),
3147	session_id_print (&ks->session_id_remote, &gc),	3147	session_id_print (&ks->session_id_remote, &gc),
3148	print_sockaddr (&ks->remote_addr, &gc));	3148	print_link_sockaddr (&ks->remote_addr, &gc));
3149		3149
3150	if (ks->state >= S_INITIAL && addr_defined (&ks->remote_addr))	3150	if (ks->state >= S_INITIAL && link_addr_defined (&ks->remote_addr))
3151	{	3151	{
		3152	struct openvpn_sockaddr *tla = NULL;
		3153
3152	update_time ();	3154	update_time ();
3153		3155
3154	if (tls_process (multi, session, to_link, to_link_addr,	3156	if (tls_process (multi, session, to_link, &tla,
3155	to_link_socket_info, wakeup))	3157	to_link_socket_info, wakeup))
3156	active = true;	3158	active = true;
3157		3159
3158	/*	3160	/*
		3161	* If tls_process produced an outgoing packet,
		3162	* return the openvpn_sockaddr object (which
		3163	* contains the outgoing address).
		3164	*/
		3165	if (tla)
		3166	{
		3167	multi->to_link_addr = *tla;
		3168	*to_link_addr = &multi->to_link_addr;
		3169	}
		3170
		3171	/*
3159	* If tls_process hits an error:	3172	* If tls_process hits an error:
3160	* (1) If the session has an unexpired lame duck key, preserve it.	3173	* (1) If the session has an unexpired lame duck key, preserve it.
3161	* (2) Reinitialize the session.	3174	* (2) Reinitialize the session.
Lines 3274-3280 Link Here
3274		3287
3275	bool	3288	bool
3276	tls_pre_decrypt (struct tls_multi *multi,	3289	tls_pre_decrypt (struct tls_multi *multi,
3277	struct sockaddr_in *from,	3290	const struct openvpn_sockaddr *from,
3278	struct buffer *buf,	3291	struct buffer *buf,
3279	struct crypto_options *opt)	3292	struct crypto_options *opt)
3280	{	3293	{
Lines 3316-3322 Link Here
3316	if (DECRYPT_KEY_ENABLED (multi, ks)	3329	if (DECRYPT_KEY_ENABLED (multi, ks)
3317	&& key_id == ks->key_id	3330	&& key_id == ks->key_id
3318	&& ks->authenticated	3331	&& ks->authenticated
3319	&& addr_port_match(from, &ks->remote_addr))	3332	&& link_addr_port_match(from, &ks->remote_addr))
3320	{	3333	{
3321	/* return appropriate data channel decrypt key in opt */	3334	/* return appropriate data channel decrypt key in opt */
3322	opt->key_ctx_bi = &ks->key;	3335	opt->key_ctx_bi = &ks->key;
Lines 3329-3335 Link Here
3329	ks->n_bytes += buf->len;	3342	ks->n_bytes += buf->len;
3330	dmsg (D_TLS_DEBUG,	3343	dmsg (D_TLS_DEBUG,
3331	"TLS: data channel, key_id=%d, IP=%s",	3344	"TLS: data channel, key_id=%d, IP=%s",
3332	key_id, print_sockaddr (from, &gc));	3345	key_id, print_link_sockaddr (from, &gc));
3333	gc_free (&gc);	3346	gc_free (&gc);
3334	return ret;	3347	return ret;
3335	}	3348	}
Lines 3349-3355 Link Here
3349		3362
3350	msg (D_TLS_ERRORS,	3363	msg (D_TLS_ERRORS,
3351	"TLS Error: local/remote TLS keys are out of sync: %s [%d]",	3364	"TLS Error: local/remote TLS keys are out of sync: %s [%d]",
3352	print_sockaddr (from, &gc), key_id);	3365	print_link_sockaddr (from, &gc), key_id);
3353	goto error;	3366	goto error;
3354	}	3367	}
3355	else /* control channel packet */	3368	else /* control channel packet */
Lines 3363-3369 Link Here
3363	{	3376	{
3364	msg (D_TLS_ERRORS,	3377	msg (D_TLS_ERRORS,
3365	"TLS Error: unknown opcode received from %s op=%d",	3378	"TLS Error: unknown opcode received from %s op=%d",
3366	print_sockaddr (from, &gc), op);	3379	print_link_sockaddr (from, &gc), op);
3367	goto error;	3380	goto error;
3368	}	3381	}
3369		3382
Lines 3378-3384 Link Here
3378	{	3391	{
3379	msg (D_TLS_ERRORS,	3392	msg (D_TLS_ERRORS,
3380	"TLS Error: client->client or server->server connection attempted from %s",	3393	"TLS Error: client->client or server->server connection attempted from %s",
3381	print_sockaddr (from, &gc));	3394	print_link_sockaddr (from, &gc));
3382	goto error;	3395	goto error;
3383	}	3396	}
3384	}	3397	}
Lines 3387-3393 Link Here
3387	* Authenticate Packet	3400	* Authenticate Packet
3388	*/	3401	*/
3389	dmsg (D_TLS_DEBUG, "TLS: control channel, op=%s, IP=%s",	3402	dmsg (D_TLS_DEBUG, "TLS: control channel, op=%s, IP=%s",
3390	packet_opcode_name (op), print_sockaddr (from, &gc));	3403	packet_opcode_name (op), print_link_sockaddr (from, &gc));
3391		3404
3392	/* get remote session-id */	3405	/* get remote session-id */
3393	{	3406	{
Lines 3397-3403 Link Here
3397	{	3410	{
3398	msg (D_TLS_ERRORS,	3411	msg (D_TLS_ERRORS,
3399	"TLS Error: session-id not found in packet from %s",	3412	"TLS Error: session-id not found in packet from %s",
3400	print_sockaddr (from, &gc));	3413	print_link_sockaddr (from, &gc));
3401	goto error;	3414	goto error;
3402	}	3415	}
3403	}	3416	}
Lines 3414-3422 Link Here
3414	state_name (ks->state),	3427	state_name (ks->state),
3415	session_id_print (&session->session_id, &gc),	3428	session_id_print (&session->session_id, &gc),
3416	session_id_print (&sid, &gc),	3429	session_id_print (&sid, &gc),
3417	print_sockaddr (from, &gc),	3430	print_link_sockaddr (from, &gc),
3418	session_id_print (&ks->session_id_remote, &gc),	3431	session_id_print (&ks->session_id_remote, &gc),
3419	print_sockaddr (&ks->remote_addr, &gc));	3432	print_link_sockaddr (&ks->remote_addr, &gc));
3420		3433
3421	if (session_id_equal (&ks->session_id_remote, &sid))	3434	if (session_id_equal (&ks->session_id_remote, &sid))
3422	/* found a match */	3435	/* found a match */
Lines 3461-3467 Link Here
3461	{	3474	{
3462	msg (D_TLS_ERRORS,	3475	msg (D_TLS_ERRORS,
3463	"TLS Error: Cannot accept new session request from %s due to session context expire or --single-session [1]",	3476	"TLS Error: Cannot accept new session request from %s due to session context expire or --single-session [1]",
3464	print_sockaddr (from, &gc));	3477	print_link_sockaddr (from, &gc));
3465	goto error;	3478	goto error;
3466	}	3479	}
3467		3480
Lines 3477-3489 Link Here
3477		3490
3478	msg (D_TLS_DEBUG_LOW,	3491	msg (D_TLS_DEBUG_LOW,
3479	"TLS: Initial packet from %s, sid=%s",	3492	"TLS: Initial packet from %s, sid=%s",
3480	print_sockaddr (from, &gc),	3493	print_link_sockaddr (from, &gc),
3481	session_id_print (&sid, &gc));	3494	session_id_print (&sid, &gc));
3482		3495
3483	do_burst = true;	3496	do_burst = true;
3484	new_link = true;	3497	new_link = true;
3485	i = TM_ACTIVE;	3498	i = TM_ACTIVE;
3486	session->untrusted_sockaddr = *from;	3499	session->untrusted_addr = *from;
3487	}	3500	}
3488	}	3501	}
3489		3502
Lines 3503-3509 Link Here
3503	{	3516	{
3504	msg (D_TLS_ERRORS,	3517	msg (D_TLS_ERRORS,
3505	"TLS Error: Cannot accept new session request from %s due to session context expire or --single-session [2]",	3518	"TLS Error: Cannot accept new session request from %s due to session context expire or --single-session [2]",
3506	print_sockaddr (from, &gc));	3519	print_link_sockaddr (from, &gc));
3507	goto error;	3520	goto error;
3508	}	3521	}
3509		3522
Lines 3526-3536 Link Here
3526	*/	3539	*/
3527	msg (D_TLS_DEBUG_LOW,	3540	msg (D_TLS_DEBUG_LOW,
3528	"TLS: new session incoming connection from %s",	3541	"TLS: new session incoming connection from %s",
3529	print_sockaddr (from, &gc));	3542	print_link_sockaddr (from, &gc));
3530		3543
3531	new_link = true;	3544	new_link = true;
3532	i = TM_UNTRUSTED;	3545	i = TM_UNTRUSTED;
3533	session->untrusted_sockaddr = *from;	3546	session->untrusted_addr = *from;
3534	}	3547	}
3535	else	3548	else
3536	{	3549	{
Lines 3544-3550 Link Here
3544	{	3557	{
3545	msg (D_TLS_ERRORS,	3558	msg (D_TLS_ERRORS,
3546	"TLS Error: Unroutable control packet received from %s (si=%d op=%s)",	3559	"TLS Error: Unroutable control packet received from %s (si=%d op=%s)",
3547	print_sockaddr (from, &gc),	3560	print_link_sockaddr (from, &gc),
3548	i,	3561	i,
3549	packet_opcode_name (op));	3562	packet_opcode_name (op));
3550	goto error;	3563	goto error;
Lines 3553-3562 Link Here
3553	/*	3566	/*
3554	* Verify remote IP address	3567	* Verify remote IP address
3555	*/	3568	*/
3556	if (!new_link && !addr_port_match (&ks->remote_addr, from))	3569	if (!new_link && !link_addr_port_match (&ks->remote_addr, from))
3557	{	3570	{
3558	msg (D_TLS_ERRORS, "TLS Error: Received control packet from unexpected IP addr: %s",	3571	msg (D_TLS_ERRORS, "TLS Error: Received control packet from unexpected IP addr: %s",
3559	print_sockaddr (from, &gc));	3572	print_link_sockaddr (from, &gc));
3560	goto error;	3573	goto error;
3561	}	3574	}
3562		3575
Lines 3618-3628 Link Here
3618	ks->remote_addr = *from;	3631	ks->remote_addr = *from;
3619	++multi->n_sessions;	3632	++multi->n_sessions;
3620	}	3633	}
3621	else if (!addr_port_match (&ks->remote_addr, from))	3634	else if (!link_addr_port_match (&ks->remote_addr, from))
3622	{	3635	{
3623	msg (D_TLS_ERRORS,	3636	msg (D_TLS_ERRORS,
3624	"TLS Error: Existing session control channel packet from unknown IP address: %s",	3637	"TLS Error: Existing session control channel packet from unknown IP address: %s",
3625	print_sockaddr (from, &gc));	3638	print_link_sockaddr (from, &gc));
3626	goto error;	3639	goto error;
3627	}	3640	}
3628		3641
Lines 3719-3725 Link Here
3719	*/	3732	*/
3720	bool	3733	bool
3721	tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,	3734	tls_pre_decrypt_lite (const struct tls_auth_standalone *tas,
3722	const struct sockaddr_in *from,	3735	const struct openvpn_sockaddr *from,
3723	const struct buffer *buf)	3736	const struct buffer *buf)
3724	{	3737	{
3725	struct gc_arena gc = gc_new ();	3738	struct gc_arena gc = gc_new ();
Lines 3747-3753 Link Here
3747	*/	3760	*/
3748	dmsg (D_TLS_STATE_ERRORS,	3761	dmsg (D_TLS_STATE_ERRORS,
3749	"TLS State Error: No TLS state for client %s, opcode=%d",	3762	"TLS State Error: No TLS state for client %s, opcode=%d",
3750	print_sockaddr (from, &gc),	3763	print_link_sockaddr (from, &gc),
3751	op);	3764	op);
3752	goto error;	3765	goto error;
3753	}	3766	}
Lines 3757-3763 Link Here
3757	dmsg (D_TLS_STATE_ERRORS,	3770	dmsg (D_TLS_STATE_ERRORS,
3758	"TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected",	3771	"TLS State Error: Unknown key ID (%d) received from %s -- 0 was expected",
3759	key_id,	3772	key_id,
3760	print_sockaddr (from, &gc));	3773	print_link_sockaddr (from, &gc));
3761	goto error;	3774	goto error;
3762	}	3775	}
3763		3776
Lines 3766-3772 Link Here
3766	dmsg (D_TLS_STATE_ERRORS,	3779	dmsg (D_TLS_STATE_ERRORS,
3767	"TLS State Error: Large packet (size %d) received from %s -- a packet no larger than %d bytes was expected",	3780	"TLS State Error: Large packet (size %d) received from %s -- a packet no larger than %d bytes was expected",
3768	buf->len,	3781	buf->len,
3769	print_sockaddr (from, &gc),	3782	print_link_sockaddr (from, &gc),
3770	EXPANDED_SIZE_DYNAMIC (&tas->frame));	3783	EXPANDED_SIZE_DYNAMIC (&tas->frame));
3771	goto error;	3784	goto error;
3772	}	3785	}