2 * OpenConnect (SSL + DTLS) VPN client
4 * Copyright © 2008-2012 Intel Corporation.
5 * Copyright © 2008 Nick Andrew <nick@nick-andrew.net>
7 * Author: David Woodhouse <dwmw2@infradead.org>
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public License
11 * version 2.1, as published by the Free Software Foundation.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, write to:
21 * Free Software Foundation, Inc.
22 * 51 Franklin Street, Fifth Floor,
23 * Boston, MA 02110-1301 USA
26 #ifndef __OPENCONNECT_INTERNAL_H__
27 #define __OPENCONNECT_INTERNAL_H__
29 #include "openconnect.h"
31 #if defined (OPENCONNECT_OPENSSL) || defined(DTLS_OPENSSL)
32 #include <openssl/ssl.h>
33 #include <openssl/err.h>
35 #if OPENSSL_VERSION_NUMBER >= 0x00909000L
36 #define method_const const
42 #if defined (OPENCONNECT_GNUTLS)
43 #include <gnutls/gnutls.h>
44 #include <gnutls/abstract.h>
45 #include <gnutls/x509.h>
47 #include <trousers/tss.h>
48 #include <trousers/trousers.h>
54 #include <sys/socket.h>
55 #include <sys/select.h>
57 #include <sys/types.h>
67 #define _(s) dgettext("openconnect", s)
76 /****************************************************************************/
88 struct vpn_option *next;
94 #define KA_KEEPALIVE 3
97 struct keepalive_info {
107 struct split_include {
109 struct split_include *next;
113 struct pin_cache *next;
118 #define RECONNECT_INTERVAL_MIN 10
119 #define RECONNECT_INTERVAL_MAX 100
121 #define CERT_TYPE_UNKNOWN 0
122 #define CERT_TYPE_PEM 1
123 #define CERT_TYPE_PKCS12 2
124 #define CERT_TYPE_TPM 3
126 struct openconnect_info {
136 char *csd_scriptname;
139 pxProxyFactory *proxy_factory;
145 const char *localname;
149 int cert_expire_warning;
155 const char *servercert;
156 const char *xmlconfig;
157 char xmlsha1[(SHA1_SIZE * 2) + 1];
166 int no_http_keepalive;
168 OPENCONNECT_X509 *peer_cert;
170 char *cookie; /* Pointer to within cookies list */
171 struct vpn_option *cookies;
172 struct vpn_option *cstp_options;
173 struct vpn_option *dtls_options;
175 #if defined(OPENCONNECT_OPENSSL)
179 #elif defined(OPENCONNECT_GNUTLS)
180 gnutls_session_t https_sess;
181 gnutls_certificate_credentials_t https_cred;
182 struct pin_cache *pin_cache;
184 TSS_HCONTEXT tpm_context;
186 TSS_HPOLICY srk_policy;
188 TSS_HPOLICY tpm_key_policy;
190 #ifndef HAVE_GNUTLS_CERTIFICATE_SET_KEY
192 gnutls_pkcs11_privkey_t my_p11key;
194 gnutls_privkey_t my_pkey;
195 gnutls_x509_crt_t *my_certs;
196 unsigned int nr_my_certs;
198 #endif /* OPENCONNECT_GNUTLS */
199 struct keepalive_info ssl_times;
200 int owe_ssl_dpd_response;
201 struct pkt *deflate_pkt;
202 struct pkt *current_ssl_pkt;
203 struct pkt *pending_deflated_pkt;
205 z_stream inflate_strm;
206 uint32_t inflate_adler32;
207 z_stream deflate_strm;
208 uint32_t deflate_adler32;
211 int reconnect_timeout;
212 int reconnect_interval;
213 int dtls_attempt_period;
214 time_t new_dtls_started;
215 #if defined(DTLS_OPENSSL)
219 SSL_SESSION *dtls_session;
220 #elif defined(DTLS_GNUTLS)
221 /* Call these *_ssl rather than *_sess because they're just
222 pointers, and generic code (in mainloop.c for example)
223 wants to check if they're NULL or not. No point in being
224 differently named to the OpenSSL variant, and forcing us to
225 have ifdefs or accessor macros for them. */
226 gnutls_session_t dtls_ssl;
227 gnutls_session_t new_dtls_ssl;
229 struct keepalive_info dtls_times;
230 unsigned char dtls_session_id[32];
231 unsigned char dtls_secret[48];
234 const char *vpnc_script;
240 const char *vpn_addr;
241 const char *vpn_netmask;
242 const char *vpn_addr6;
243 const char *vpn_netmask6;
244 const char *vpn_dns[3];
245 const char *vpn_nbns[3];
246 const char *vpn_domain;
247 const char *vpn_proxy_pac;
248 struct split_include *split_dns;
249 struct split_include *split_includes;
250 struct split_include *split_excludes;
267 struct pkt *incoming_queue;
268 struct pkt *outgoing_queue;
272 socklen_t peer_addrlen;
273 struct sockaddr *peer_addr;
274 struct sockaddr *dtls_addr;
279 const char *quit_reason;
282 openconnect_validate_peer_cert_vfn validate_peer_cert;
283 openconnect_write_new_config_vfn write_new_config;
284 openconnect_process_auth_form_vfn process_auth_form;
285 openconnect_progress_vfn progress;
288 #if (defined (DTLS_OPENSSL) && defined (SSL_OP_CISCO_ANYCONNECT)) || \
289 (defined (DTLS_GNUTLS) && defined (HAVE_GNUTLS_SESSION_SET_PREMASTER))
295 #define AC_PKT_DATA 0 /* Uncompressed data */
296 #define AC_PKT_DPD_OUT 3 /* Dead Peer Detection */
297 #define AC_PKT_DPD_RESP 4 /* DPD response */
298 #define AC_PKT_DISCONN 5 /* Client disconnection notice */
299 #define AC_PKT_KEEPALIVE 7 /* Keepalive */
300 #define AC_PKT_COMPRESSED 8 /* Compressed data */
301 #define AC_PKT_TERM_SERVER 9 /* Server kick */
303 #define vpn_progress(vpninfo, ...) (vpninfo)->progress ((vpninfo)->cbdata, __VA_ARGS__)
305 /****************************************************************************/
306 /* Oh Solaris how we hate thee! */
308 #define time(x) openconnect__time(x)
309 time_t openconnect__time(time_t *t);
311 #ifndef HAVE_ASPRINTF
312 #define asprintf openconnect__asprintf
313 int openconnect__asprintf(char **strp, const char *fmt, ...);
316 #define getline openconnect__getline
317 ssize_t openconnect__getline(char **lineptr, size_t *n, FILE *stream);
320 /****************************************************************************/
323 int setup_tun(struct openconnect_info *vpninfo);
324 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout);
325 void shutdown_tun(struct openconnect_info *vpninfo);
326 int script_config_tun (struct openconnect_info *vpninfo, const char *reason);
329 unsigned char unhex(const char *data);
330 int setup_dtls(struct openconnect_info *vpninfo);
331 int dtls_mainloop(struct openconnect_info *vpninfo, int *timeout);
332 int dtls_try_handshake(struct openconnect_info *vpninfo);
333 int connect_dtls_socket(struct openconnect_info *vpninfo);
336 int make_cstp_connection(struct openconnect_info *vpninfo);
337 int cstp_mainloop(struct openconnect_info *vpninfo, int *timeout);
338 int cstp_bye(struct openconnect_info *vpninfo, const char *reason);
339 int cstp_reconnect(struct openconnect_info *vpninfo);
342 int connect_https_socket(struct openconnect_info *vpninfo);
343 int request_passphrase(struct openconnect_info *vpninfo, const char *label,
344 char **response, const char *fmt, ...);
345 int __attribute__ ((format (printf, 2, 3)))
346 openconnect_SSL_printf(struct openconnect_info *vpninfo, const char *fmt, ...);
347 int openconnect_print_err_cb(const char *str, size_t len, void *ptr);
348 #define openconnect_report_ssl_errors(v) ERR_print_errors_cb(openconnect_print_err_cb, (v))
350 /* ${SSL_LIBRARY}.c */
351 int openconnect_SSL_gets(struct openconnect_info *vpninfo, char *buf, size_t len);
352 int openconnect_SSL_write(struct openconnect_info *vpninfo, char *buf, size_t len);
353 int openconnect_SSL_read(struct openconnect_info *vpninfo, char *buf, size_t len);
354 int openconnect_open_https(struct openconnect_info *vpninfo);
355 void openconnect_close_https(struct openconnect_info *vpninfo, int final);
356 int get_cert_md5_fingerprint(struct openconnect_info *vpninfo, OPENCONNECT_X509 *cert,
358 int openconnect_sha1(unsigned char *result, void *data, int len);
359 int openconnect_random(void *bytes, int len);
360 int openconnect_local_cert_md5(struct openconnect_info *vpninfo,
364 int vpn_add_pollfd(struct openconnect_info *vpninfo, int fd, short events);
365 int vpn_mainloop(struct openconnect_info *vpninfo);
366 int queue_new_packet(struct pkt **q, void *buf, int len);
367 void queue_packet(struct pkt **q, struct pkt *new);
368 int keepalive_action(struct keepalive_info *ka, int *timeout);
369 int ka_stalled_dpd_time(struct keepalive_info *ka, int *timeout);
374 int config_lookup_host(struct openconnect_info *vpninfo, const char *host);
377 int parse_xml_response(struct openconnect_info *vpninfo, char *response,
378 char *request_body, int req_len, const char **method,
379 const char **request_body_type);
382 char *openconnect_create_useragent(const char *base);
383 int process_proxy(struct openconnect_info *vpninfo, int ssl_sock);
384 int internal_parse_url(char *url, char **res_proto, char **res_host,
385 int *res_port, char **res_path, int default_port);
388 int set_openssl_ui(void);
391 int generate_securid_tokencodes(struct openconnect_info *vpninfo);
392 int add_securid_pin(char *token, char *pin);
395 extern const char *openconnect_version_str;
397 #ifdef ANDROID_KEYSTORE
398 #include <keystore_get.h>
399 #elif defined (FAKE_ANDROID_KEYSTORE) /* For testing */
400 #define ANDROID_KEYSTORE
401 #define KEYSTORE_MESSAGE_SIZE 16384
402 #include <sys/types.h>
403 #include <sys/stat.h>
406 static inline int keystore_get(const char *p, int plen, char *content)
408 int fd = open(p, O_RDONLY);
412 len = read(fd, content, KEYSTORE_MESSAGE_SIZE);
418 #endif /* FAKE_ANDROID_KEYSTORE */
420 #endif /* __OPENCONNECT_INTERNAL_H__ */