Skip to contentSkip to conversation

Enable TCP non-linear packet ID

PATCH Superseded Arne Schwabe 2 participants 2 messages Sep 17, 2016

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Arne Schwabe

author
#0 lore raw

PATCH 1/1 Enable TCP non-linear packet ID

Implementation with multiple threads needs that to be able run encryption in parallel. Tested with James' OpenVPN 3 server.

---
 src/openvpn/comp.c      | 1 +
 src/openvpn/forward.c   | 2 +-
 src/openvpn/init.c      | 1 -
 src/openvpn/options.c   | 5 -----
 src/openvpn/packet_id.c | 7 +++----
 src/openvpn/packet_id.h | 2 +-
 src/openvpn/ssl.c       | 3 +--
 7 files changed, 7 insertions(+), 14 deletions(-)
src/openvpn/comp.c +1 -0
index 3a32c62..61f6f08 100644
@@ -160,6 +160,7 @@ comp_generate_peer_info_string(const struct compress_options *opt, struct buffer
 	buf_printf (out, "IV_LZO_STUB=1\n");
       buf_printf (out, "IV_COMP_STUB=1\n");
       buf_printf (out, "IV_COMP_STUBv2=1\n");
+    buf_printf (out, "IV_TCPNL=1\n");
     }
 }
src/openvpn/forward.c +1 -1
index 6c11439..b3077ed 100644
@@ -391,7 +391,7 @@ check_fragment_dowork (struct context *c)
   struct link_socket_info *lsi = get_link_socket_info (c);
 
   /* OS MTU Hint? */
-  if (lsi->mtu_changed && c->c2.ipv4_tun)
+  if (lsi->mtu_changed)
     {
       frame_adjust_path_mtu (&c->c2.frame_fragment, c->c2.link_socket->mtu,
 			     c->options.ce.proto);
src/openvpn/init.c +0 -1
index 9cd3d9f..fdeaf95 100644
@@ -2143,7 +2143,6 @@ do_init_crypto_static (struct context *c, const unsigned int flags)
   if (options->replay)
     {
       packet_id_init (&c->c2.crypto_options.packet_id,
-		      link_socket_proto_connection_oriented (options->ce.proto),
 		      options->replay_window,
 		      options->replay_time,
 		      "STATIC", 0);
src/openvpn/options.c +0 -5
index dd7d461..1be32ff 100644
@@ -2215,11 +2215,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
   /*
    * Check consistency of replay options
    */
-  if ((!proto_is_udp(ce->proto))
-      && (options->replay_window != defaults.replay_window
-	  || options->replay_time != defaults.replay_time))
-    msg (M_USAGE, "--replay-window only makes sense with --proto udp");
-
   if (!options->replay
       && (options->replay_window != defaults.replay_window
 	  || options->replay_time != defaults.replay_time))
src/openvpn/packet_id.c +3 -4
index baa4966..9874519 100644
@@ -76,10 +76,9 @@ packet_id_debug (int msglevel,
 }
 
 void
-packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_backtrack, const char *name, int unit)
+packet_id_init (struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
 {
-  dmsg (D_PID_DEBUG, "PID packet_id_init tcp_mode=%d seq_backtrack=%d time_backtrack=%d",
-	tcp_mode,
+  dmsg (D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
 	seq_backtrack,
 	time_backtrack);
 

@@ -88,7 +87,7 @@ packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_
 
   p->rec.name = name;
   p->rec.unit = unit;
-  if (seq_backtrack && !tcp_mode)
+  if (seq_backtrack)
     {
       ASSERT (MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
       ASSERT (MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);
src/openvpn/packet_id.h +1 -1
index 5eb501d..fb059b7 100644
@@ -210,7 +210,7 @@ struct packet_id
   struct packet_id_rec rec;
 };
 
-void packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_backtrack, const char *name, int unit);
+void packet_id_init (struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit);
 void packet_id_free (struct packet_id *p);
 
 /* should we accept an incoming packet id ? */
src/openvpn/ssl.c +1 -2
index 8717324..c7823b2 100644
@@ -799,7 +799,7 @@ key_state_init (struct tls_session *session, struct key_state *ks)
   /* init packet ID tracker */
   if (session->opt->replay)
     {
-      packet_id_init (&ks->crypto_options.packet_id, session->opt->tcp_mode,
+      packet_id_init (&ks->crypto_options.packet_id,
 	  session->opt->replay_window, session->opt->replay_time, "SSL",
 	  ks->key_id);
     }

@@ -948,7 +948,6 @@ tls_session_init (struct tls_multi *multi, struct tls_session *session)
 
   /* initialize packet ID replay window for --tls-auth */
   packet_id_init (&session->tls_auth.packet_id,
-		  session->opt->tcp_mode,
 		  session->opt->replay_window,
 		  session->opt->replay_time,
 		  "TLS_AUTH", session->key_id);
Signature · 1 line
2.8.4 (Apple Git-73)
#1 lore raw

Hi,

src/openvpn/forward.c check_fragment_dowork (struct context *c) · line 397

Quoted 11 lines · Arne Schwabe
src/openvpn/forward.c +1 -1
@@ -391,7 +391,7 @@ check_fragment_dowork (struct context *c)
   struct link_socket_info *lsi = get_link_socket_info (c);
 
   /* OS MTU Hint? */
-  if (lsi->mtu_changed && c->c2.ipv4_tun)
+  if (lsi->mtu_changed)
     {
       frame_adjust_path_mtu (&c->c2.frame_fragment, c->c2.link_socket->mtu,
 			     c->options.ce.proto);

I *think* this is part of the other patch...

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...