dual mode

Author: Jon Chiappetta

src/openvpn/forward.c

@@ -292,7 +292,7 @@ check_incoming_control_channel(struct context *c)
 
     struct gc_arena gc = gc_new();
     struct buffer buf = alloc_buf_gc(len, &gc);
-    if (tls_rec_payload(c->c2.tls_multi, &buf))
+    while (tls_rec_payload(c->c2.tls_multi, &buf))
     {
         while (BLEN(&buf) > 1)
         {
@@ -304,10 +304,6 @@ check_incoming_control_channel(struct context *c)
             }
         }
     }
-    else
-    {
-        msg(D_PUSH_ERRORS, "WARNING: Receive control message failed");
-    }
 
     gc_free(&gc);
 }
@@ -376,14 +372,13 @@ check_connection_established(struct context *c)
 #endif
 
 bool
-send_control_channel_string_dowork(struct tls_session *session, const char *str,
+send_control_channel_string_dowork(struct tls_session *session, struct key_state *ks, const char *str,
                                    msglvl_t msglevel)
 {
     struct gc_arena gc = gc_new();
     bool stat;
 
     ASSERT(session);
-    struct key_state *ks = &session->key[KS_PRIMARY];
 
     /* buffered cleartext write onto TLS control channel */
     stat = tls_send_payload(ks, (uint8_t *)str, strlen(str) + 1);
@@ -409,9 +404,9 @@ send_control_channel_string(struct context *c, const char *str, msglvl_t msgleve
     if (c->c2.tls_multi)
     {
         struct tls_session *session = &c->c2.tls_multi->session[TM_ACTIVE];
-        bool ret = send_control_channel_string_dowork(session, str, msglevel);
+        struct key_state *ks = &session->key[KS_PRIMARY];
+        bool ret = send_control_channel_string_dowork(session, ks, str, msglevel);
         reschedule_multi_process(c);
-
         return ret;
     }
     return true;
@@ -2358,11 +2353,13 @@ get_io_flags_udp(struct context *c, struct multi_io *multi_io, const unsigned in
 }
 
 void
-io_wait_dowork(struct context *c, const unsigned int flags)
+io_wait_dowork(struct context *c, const unsigned int flags, int z)
 {
     unsigned int out_socket;
     unsigned int out_tuntap;
     struct event_set_return esr[4];
+    struct event_set *event_set = ((z & THREAD_RTWL) != 0) ? c->c2.event_set : c->c2.event_set2;
+    unsigned int *event_set_status = ((z & THREAD_RTWL) != 0) ? &(c->c2.event_set_status) : &(c->c2.event_set_status2);
 
     /* These shifts all depend on EVENT_READ and EVENT_WRITE */
     static uintptr_t socket_shift = SOCKET_SHIFT; /* depends on SOCKET_READ and SOCKET_WRITE */
@@ -2380,29 +2377,29 @@ io_wait_dowork(struct context *c, const unsigned int flags)
     /*
      * Decide what kind of events we want to wait for.
      */
-    event_reset(c->c2.event_set);
+    event_reset(event_set);
 
-    multi_io_process_flags(c, c->c2.event_set, flags, &out_socket, &out_tuntap);
+    multi_io_process_flags(c, event_set, flags, &out_socket, &out_tuntap);
 
 #if defined(TARGET_LINUX) || defined(TARGET_FREEBSD)
     if (out_socket & EVENT_READ && c->c2.did_open_tun)
     {
-        dco_event_set(&c->c1.tuntap->dco, c->c2.event_set, (void *)dco_shift);
+        dco_event_set(&c->c1.tuntap->dco, event_set, (void *)dco_shift);
     }
 #endif
 
 #ifdef ENABLE_MANAGEMENT
     if (management)
     {
-        management_socket_set(management, c->c2.event_set, (void *)management_shift, NULL);
+        management_socket_set(management, event_set, (void *)management_shift, NULL);
     }
 #endif
 
 #ifdef ENABLE_ASYNC_PUSH
     /* arm inotify watcher */
     if (c->options.mode == MODE_SERVER)
     {
-        event_ctl(c->c2.event_set, c->c2.inotify_fd, EVENT_READ, (void *)file_shift);
+        event_ctl(event_set, c->c2.inotify_fd, EVENT_READ, (void *)file_shift);
     }
 #endif
 
@@ -2416,7 +2413,7 @@ io_wait_dowork(struct context *c, const unsigned int flags)
      *  (6) timeout (tv) expired
      */
 
-    c->c2.event_set_status = ES_ERROR;
+    *event_set_status = ES_ERROR;
 
     if (!c->sig->signal_received)
     {
@@ -2434,14 +2431,14 @@ io_wait_dowork(struct context *c, const unsigned int flags)
             /*
              * Wait for something to happen.
              */
-            status = event_wait(c->c2.event_set, &c->c2.timeval, esr, SIZE(esr));
+            status = event_wait(event_set, &c->c2.timeval, esr, SIZE(esr));
 
             check_status(status, "event_wait", NULL, NULL);
 
             if (status > 0)
             {
                 int i;
-                c->c2.event_set_status = 0;
+                *event_set_status = 0;
                 for (i = 0; i < status; ++i)
                 {
                     const struct event_set_return *e = &esr[i];
@@ -2452,7 +2449,7 @@ io_wait_dowork(struct context *c, const unsigned int flags)
                         struct event_arg *ev_arg = (struct event_arg *)e->arg;
                         if (ev_arg->type != EVENT_ARG_LINK_SOCKET)
                         {
-                            c->c2.event_set_status = ES_ERROR;
+                            *event_set_status = ES_ERROR;
                             msg(D_LINK_ERRORS, "io_work: non socket event delivered");
                             return;
                         }
@@ -2464,30 +2461,30 @@ io_wait_dowork(struct context *c, const unsigned int flags)
                         shift = (uintptr_t)e->arg;
                     }
 
-                    c->c2.event_set_status |= ((e->rwflags & 3) << shift);
+                    *event_set_status |= ((e->rwflags & 3) << shift);
                 }
             }
             else if (status == 0)
             {
-                c->c2.event_set_status = ES_TIMEOUT;
+                *event_set_status = ES_TIMEOUT;
             }
         }
         else
         {
-            c->c2.event_set_status = SOCKET_READ;
+            *event_set_status = SOCKET_READ;
         }
     }
 
     /* 'now' should always be a reasonably up-to-date timestamp */
     update_time();
 
     /* set signal_received if a signal was received */
-    if (c->c2.event_set_status & ES_ERROR)
+    if (*event_set_status & ES_ERROR)
     {
         get_signal(&c->sig->signal_received);
     }
 
-    dmsg(D_EVENT_WAIT, "I/O WAIT status=0x%04x", c->c2.event_set_status);
+    dmsg(D_EVENT_WAIT, "I/O WAIT status=0x%04x", *event_set_status);
 }
 
 void threaded_fwd_inp_intf(struct context *c, struct link_socket *sock, struct thread_pointer *b)
@@ -2507,7 +2504,7 @@ void threaded_fwd_inp_intf(struct context *c, struct link_socket *sock, struct t
 }
 
 void
-process_io(struct context *c, struct link_socket *sock, struct thread_pointer *b)
+process_io(struct context *c, struct link_socket *sock, struct thread_pointer *b, int z)
 {
     const unsigned int status = c->c2.event_set_status;
 
@@ -2520,17 +2517,17 @@ process_io(struct context *c, struct link_socket *sock, struct thread_pointer *b
 #endif
 
     /* TCP/UDP port ready to accept write */
-    if (status & SOCKET_WRITE)
+    if ((status & SOCKET_WRITE) && ((z & THREAD_RTWL) != 0))
     {
         process_outgoing_link(c, sock);
     }
     /* TUN device ready to accept write */
-    else if (status & TUN_WRITE)
+    else if ((status & TUN_WRITE) && ((z & THREAD_RLWT) != 0))
     {
         process_outgoing_tun(c, sock);
     }
     /* Incoming data on TCP/UDP port */
-    else if (status & SOCKET_READ)
+    else if ((status & SOCKET_READ) && ((z & THREAD_RLWT) != 0))
     {
         read_incoming_link(c, sock);
         if (!IS_SIG(c))
@@ -2539,15 +2536,52 @@ process_io(struct context *c, struct link_socket *sock, struct thread_pointer *b
         }
     }
     /* Incoming data on TUN device */
-    else if (status & TUN_READ)
+    else if ((status & TUN_READ) && ((z & THREAD_RTWL) != 0))
     {
         threaded_fwd_inp_intf(c, sock, b);
     }
-    else if (status & DCO_READ)
+    else if ((status & DCO_READ) && ((z & THREAD_RTWL) != 0))
     {
         if (!IS_SIG(c))
         {
             process_incoming_dco(c);
         }
     }
 }
+
+void threaded_dual_init(struct dual_args *d)
+{
+    if ((d->a == 0) && (d->c->c2.buffers))
+    {
+        if ((d->z & THREAD_RLWT) != 0)
+        {
+            d->c->c2.buffers->read_link_buf.len = 0;
+            d->c->c2.buf2 = d->c->c2.buffers->read_link_buf;
+            d->a = 1;
+        }
+        if ((d->z & THREAD_RTWL) != 0)
+        {
+            d->c->c2.buffers->read_tun_buf.len = 0;
+            d->c->c2.buf = d->c->c2.buffers->read_tun_buf;
+            d->a = 1;
+        }
+    }
+}
+
+void *threaded_process_io(void *a)
+{
+    struct dual_args *d = (struct dual_args *)a;
+    while (true)
+    {
+        if (d->b->p->z != 1) { break; }
+        pthread_mutex_lock(&(d->i));
+        if (d->b->p->z != 1) { break; }
+        threaded_dual_init(d);
+        if (d->a == 1)
+        {
+            process_io(d->c, d->c->c2.link_sockets[0], d->b, d->z);
+        }
+        pthread_mutex_unlock(&(d->o));
+    }
+    return NULL;
+}

src/openvpn/forward.h

@@ -77,11 +77,15 @@ void get_io_flags_dowork_udp(struct context *c, struct multi_io *multi_io,
 
 void get_io_flags_udp(struct context *c, struct multi_io *multi_io, const unsigned int flags);
 
-void io_wait_dowork(struct context *c, const unsigned int flags);
+void io_wait_dowork(struct context *c, const unsigned int flags, int z);
 
 void pre_select(struct context *c);
 
-void process_io(struct context *c, struct link_socket *sock, struct thread_pointer *b);
+void process_io(struct context *c, struct link_socket *sock, struct thread_pointer *b, int z);
+
+void *threaded_process_io(void *a);
+
+void threaded_dual_init(struct dual_args *d);
 
 
 /**********************************************************************/
@@ -309,7 +313,7 @@ bool send_control_channel_string(struct context *c, const char *str, msglvl_t ms
  * @param msglevel   - Message level to use for logging
  */
 
-bool send_control_channel_string_dowork(struct tls_session *session, const char *str,
+bool send_control_channel_string_dowork(struct tls_session *session, struct key_state *ks, const char *str,
                                         msglvl_t msglevel);
 
 
@@ -386,7 +390,7 @@ p2p_iow_flags(const struct context *c)
  * for the top-level server sockets.
  */
 static inline void
-io_wait(struct context *c, const unsigned int flags)
+io_wait(struct context *c, const unsigned int flags, int z)
 {
     if (proto_is_dgram(c->c2.link_sockets[0]->info.proto) && c->c2.fast_io
         && (flags & (IOW_TO_TUN | IOW_TO_LINK | IOW_MBUF)))
@@ -406,7 +410,7 @@ io_wait(struct context *c, const unsigned int flags)
     else
     {
         /* slow path */
-        io_wait_dowork(c, flags);
+        io_wait_dowork(c, flags, z);
     }
 }
 

src/openvpn/init.c

@@ -2322,14 +2322,23 @@ do_deferred_options_part2(struct context *c)
 #endif
 
     struct tls_session *session = &c->c2.tls_multi->session[TM_ACTIVE];
-    if (!tls_session_update_crypto_params(c->c2.tls_multi, session, &c->options, &c->c2.frame,
+    struct key_state *ks = &session->key[KS_PRIMARY];
+    if (!tls_session_update_crypto_params(c->c2.tls_multi, session, ks, &c->options, &c->c2.frame,
                                           frame_fragment, get_link_socket_info(c),
                                           &c->c1.tuntap->dco))
     {
         msg(D_TLS_ERRORS, "OPTIONS ERROR: failed to import crypto options");
         return false;
     }
 
+    session = &c->c2.tls_multi->session[TM_THREADED];
+    ks = &session->key[KS_PRIMARY];
+    tls_session_update_crypto_params(c->c2.tls_multi, session, ks, &c->options, &c->c2.frame, frame_fragment, get_link_socket_info(c), &c->c1.tuntap->dco);
+
+    session = &c->c2.tls_multi->session[TM_REKEYS];
+    ks = &session->key[KS_PRIMARY];
+    tls_session_update_crypto_params(c->c2.tls_multi, session, ks, &c->options, &c->c2.frame, frame_fragment, get_link_socket_info(c), &c->c1.tuntap->dco);
+
     return true;
 }
 
@@ -2548,6 +2557,7 @@ do_deferred_p2p_ncp(struct context *c)
     c->options.use_peer_id = c->c2.tls_multi->use_peer_id;
 
     struct tls_session *session = &c->c2.tls_multi->session[TM_ACTIVE];
+    struct key_state *ks = &session->key[KS_PRIMARY];
 
     const char *ncp_cipher =
         get_p2p_ncp_cipher(session, c->c2.tls_multi->peer_info, &c->options.gc);
@@ -2572,13 +2582,22 @@ do_deferred_p2p_ncp(struct context *c)
     }
 #endif
 
-    if (!tls_session_update_crypto_params(c->c2.tls_multi, session, &c->options, &c->c2.frame,
+    if (!tls_session_update_crypto_params(c->c2.tls_multi, session, ks, &c->options, &c->c2.frame,
                                           frame_fragment, get_link_socket_info(c),
                                           &c->c1.tuntap->dco))
     {
         msg(D_TLS_ERRORS, "ERROR: failed to set crypto cipher");
         return false;
     }
+
+    session = &c->c2.tls_multi->session[TM_THREADED];
+    ks = &session->key[KS_PRIMARY];
+    tls_session_update_crypto_params(c->c2.tls_multi, session, ks, &c->options, &c->c2.frame, frame_fragment, get_link_socket_info(c), &c->c1.tuntap->dco);
+
+    session = &c->c2.tls_multi->session[TM_REKEYS];
+    ks = &session->key[KS_PRIMARY];
+    tls_session_update_crypto_params(c->c2.tls_multi, session, ks, &c->options, &c->c2.frame, frame_fragment, get_link_socket_info(c), &c->c1.tuntap->dco);
+
     return true;
 }
 
@@ -3438,6 +3457,8 @@ do_init_crypto_tls(struct context *c, const unsigned int flags)
     /* let the TLS engine know if keys have to be installed in DCO or not */
     to.dco_enabled = dco_enabled(options);
 
+    to.dual_mode = c->options.ce.dual_mode;
+
     /*
      * Initialize OpenVPN's master TLS-mode object.
      */
@@ -4111,6 +4132,7 @@ do_event_set_init(struct context *c, bool need_us_timeout)
     }
 
     c->c2.event_set = event_set_init(&c->c2.event_set_max, flags);
+    c->c2.event_set2 = event_set_init(&c->c2.event_set_max, flags);
     c->c2.event_set_owned = true;
 }
 
@@ -4120,7 +4142,9 @@ do_close_event_set(struct context *c)
     if (c->c2.event_set && c->c2.event_set_owned)
     {
         event_free(c->c2.event_set);
+        event_free(c->c2.event_set2);
         c->c2.event_set = NULL;
+        c->c2.event_set2 = NULL;
         c->c2.event_set_owned = false;
     }
 }
@@ -4925,6 +4949,7 @@ inherit_context_child(struct context *dest, const struct context *src, struct li
     options_detach(&dest->options);
 
     dest->c2.event_set = src->c2.event_set;
+    dest->c2.event_set2 = src->c2.event_set2;
 
     if (dest->mode == CM_CHILD_TCP)
     {
@@ -5016,6 +5041,7 @@ inherit_context_top(struct context *dest, const struct context *src)
     dest->c2.es_owned = false;
 
     dest->c2.event_set = NULL;
+    dest->c2.event_set2 = NULL;
     do_event_set_init(dest, false);
 
 #ifdef USE_COMP