mainloop.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <errno.h>
  26 #include <poll.h>
  27 #include <limits.h>
  28 #include <sys/select.h>
  29 #include <signal.h>
  30 #include <arpa/inet.h>
  31 #include <unistd.h>
  32 #include <string.h>
  33
  34 #include <openssl/ssl.h>
  35
  36 #include "openconnect.h"
  37
  38 void queue_packet(struct pkt **q, struct pkt *new)
  39 {
  40         while (*q)
  41                 q = &(*q)->next;
  42
  43         new->next = NULL;
  44         *q = new;
  45 }
  46
  47 int queue_new_packet(struct pkt **q, int type, void *buf, int len)
  48 {
  49         struct pkt *new = malloc(sizeof(struct pkt) + len);
  50         if (!new)
  51                 return -ENOMEM;
  52
  53         new->type = type;
  54         new->len = len;
  55         new->next = NULL;
  56         memcpy(new->data, buf, len);
  57         queue_packet(q, new);
  58         return 0;
  59 }
  60
  61 int killed;
  62
  63 static void handle_sigint(int sig)
  64 {
  65         killed = sig;
  66 }
  67
  68 int vpn_mainloop(struct openconnect_info *vpninfo)
  69 {
  70         struct sigaction sa;
  71         memset(&sa, 0, sizeof(sa));
  72         sa.sa_handler = handle_sigint;
  73
  74         sigaction(SIGINT, &sa, NULL);
  75         sigaction(SIGHUP, &sa, NULL);
  76
  77         while (!vpninfo->quit_reason) {
  78                 int did_work = 0;
  79                 int timeout = INT_MAX;
  80                 struct timeval tv;
  81                 fd_set rfds, wfds, efds;
  82
  83 #ifdef SSL_F_DTLS1_CONNECT
  84                 if (vpninfo->new_dtls_ssl)
  85                         dtls_try_handshake(vpninfo);
  86
  87                 if (vpninfo->dtls_attempt_period && !vpninfo->dtls_ssl && !vpninfo->new_dtls_ssl &&
  88                     vpninfo->new_dtls_started + vpninfo->dtls_attempt_period < time(NULL)) {
  89                         vpninfo->progress(vpninfo, PRG_TRACE, "Attempt new DTLS connection\n");
  90                         connect_dtls_socket(vpninfo);
  91                 }
  92                 if (vpninfo->dtls_ssl)
  93                         did_work += dtls_mainloop(vpninfo, &timeout);
  94 #endif
  95                 if (vpninfo->quit_reason)
  96                         break;
  97
  98                 did_work += cstp_mainloop(vpninfo, &timeout);
  99                 if (vpninfo->quit_reason)
 100                         break;
 101
 102                 /* Tun must be last because it will set/clear its bit
 103                    in the select_rfds according to the queue length */
 104                 did_work += tun_mainloop(vpninfo, &timeout);
 105                 if (vpninfo->quit_reason)
 106                         break;
 107
 108                 if (killed) {
 109                         if (killed == SIGHUP)
 110                                 vpninfo->quit_reason = "Client received SIGHUP";
 111                         else if (killed == SIGINT)
 112                                 vpninfo->quit_reason = "Client received SIGINT";
 113                         else
 114                                 vpninfo->quit_reason = "Client killed";
 115                         break;
 116                 }
 117
 118                 if (did_work)
 119                         continue;
 120
 121                 vpninfo->progress(vpninfo, PRG_TRACE,
 122                                   "Did no work; sleeping for %d ms...\n", timeout);
 123                 memcpy(&rfds, &vpninfo->select_rfds, sizeof(rfds));
 124                 memcpy(&wfds, &vpninfo->select_wfds, sizeof(wfds));
 125                 memcpy(&efds, &vpninfo->select_efds, sizeof(efds));
 126
 127                 tv.tv_sec = timeout / 1000;
 128                 tv.tv_usec = (timeout % 1000) * 1000;
 129                 if (select(vpninfo->select_nfds, &rfds, &wfds, &efds, &tv) >= 0
 130                     && FD_ISSET(vpninfo->ssl_fd, &rfds)) {
 131                         char b;
 132                         if (recv(vpninfo->ssl_fd, &b, 1, MSG_PEEK) == 0) {
 133                                 /* Zero indicates EOF, which OpenSSL won't handle on read() */
 134                                 vpninfo->progress(vpninfo, PRG_ERR, "Server closed connection!\n");
 135                                 exit(1);
 136                         }
 137                 }
 138         }
 139
 140         cstp_bye(vpninfo, vpninfo->quit_reason);
 141
 142         if (vpninfo->vpnc_script) {
 143                 if (vpninfo->script_tun) {
 144                         kill(vpninfo->script_tun, SIGHUP);
 145                         close(vpninfo->tun_fd);
 146                 } else {
 147                         setenv("TUNDEV", vpninfo->ifname, 1);
 148                         setenv("reason", "disconnect", 1);
 149                         system(vpninfo->vpnc_script);
 150                 }
 151         }
 152
 153         return 0;
 154 }
 155
 156 /* Called when the socket is unwritable, to get the deadline for DPD.
 157    Returns 1 if DPD deadline has already arrived. */
 158 int ka_stalled_dpd_time(struct keepalive_info *ka, int *timeout)
 159 {
 160         time_t now, due;
 161
 162         if (!ka->dpd)
 163                 return 0;
 164
 165         time(&now);
 166         due = ka->last_rx + (2 * ka->dpd);
 167
 168         if (now > due)
 169                 return 1;
 170
 171         if (*timeout > (due - now) * 1000)
 172                 *timeout = (due - now) * 1000;
 173
 174         return 0;
 175 }
 176
 177
 178 int keepalive_action(struct keepalive_info *ka, int *timeout)
 179 {
 180         time_t now = time(NULL);
 181
 182         if (ka->rekey) {
 183                 time_t due = ka->last_rekey + ka->rekey;
 184
 185                 if (now >= due)
 186                         return KA_REKEY;
 187
 188                 if (*timeout > (due - now) * 1000)
 189                         *timeout = (due - now) * 1000;
 190         }
 191
 192         /* DPD is bidirectional -- PKT 3 out, PKT 4 back */
 193         if (ka->dpd) {
 194                 time_t due = ka->last_rx + ka->dpd;
 195                 time_t overdue = ka->last_rx + (2 * ka->dpd);
 196
 197                 /* Peer didn't respond */
 198                 if (now > overdue)
 199                         return KA_DPD_DEAD;
 200
 201                 /* If we already have DPD outstanding, don't flood. Repeat by
 202                    all means, but only after half the DPD period. */
 203                 if (ka->last_dpd > ka->last_rx)
 204                         due = ka->last_dpd + ka->dpd / 2;
 205
 206                 /* We haven't seen a packet from this host for $DPD seconds.
 207                    Prod it to see if it's still alive */
 208                 if (now >= due) {
 209                         ka->last_dpd = now;
 210                         return KA_DPD;
 211                 }
 212                 if (*timeout > (due - now) * 1000)
 213                         *timeout = (due - now) * 1000;
 214         }
 215
 216         /* Keepalive is just client -> server */
 217         if (ka->keepalive) {
 218                 time_t due = ka->last_tx + ka->keepalive;
 219
 220                 /* If we haven't sent anything for $KEEPALIVE seconds, send a
 221                    dummy packet (which the server will discard) */
 222                 if (now >= due)
 223                         return KA_KEEPALIVE;
 224
 225                 if (*timeout > (due - now) * 1000)
 226                         *timeout = (due - now) * 1000;
 227         }
 228
 229         return KA_NONE;
 230 }