Enable TCP non-linear packet ID

Implementation with multiple threads needs that to be able run encryption
in parallel. Tested with James' OpenVPN 3 server.

Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1474121738-19420-1-git-send-email-arne@rfc2549.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12513.html

Signed-off-by: Gert Doering <gert@greenie.muc.de>

diff --git a/src/openvpn/comp.c b/src/openvpn/comp.c
index 3a32c62814df497591f9be9d734f09193ba248be..499fef98d861be239a0fd5e65c45ace215c70852 100644 (file)
--- a/src/openvpn/comp.c
+++ b/src/openvpn/comp.c
@@ -160,6 +160,7 @@ comp_generate_peer_info_string(const struct compress_options *opt, struct buffer
        buf_printf (out, "IV_LZO_STUB=1\n");
       buf_printf (out, "IV_COMP_STUB=1\n");
       buf_printf (out, "IV_COMP_STUBv2=1\n");
+      buf_printf (out, "IV_TCPNL=1\n");
     }
 }
 

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index e3206b05e9bc730a49c859b134d0da3f5eb8fd5f..af5d49130668082a83e794e7bb4759b3cf34cb4c 100644 (file)
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -2140,7 +2140,6 @@ do_init_crypto_static (struct context *c, const unsigned int flags)
   if (options->replay)
     {
       packet_id_init (&c->c2.crypto_options.packet_id,
-                     link_socket_proto_connection_oriented (options->ce.proto),
                      options->replay_window,
                      options->replay_time,
                      "STATIC", 0);

diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index e1ff5849074ea935f7bac72531b86f409417104e..2998f06ed62f782563b25053b5058ac8d5c9442f 100644 (file)
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -2211,11 +2211,6 @@ options_postprocess_verify_ce (const struct options *options, const struct conne
   /*
    * Check consistency of replay options
    */
-  if ((!proto_is_udp(ce->proto))
-      && (options->replay_window != defaults.replay_window
-         || options->replay_time != defaults.replay_time))
-    msg (M_USAGE, "--replay-window only makes sense with --proto udp");
-
   if (!options->replay
       && (options->replay_window != defaults.replay_window
          || options->replay_time != defaults.replay_time))

diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c
index baa496643c2e091f9dddde3979d256d0340f5a3e..987451929c78cf4461d59f311af82243a6d0a806 100644 (file)
--- a/src/openvpn/packet_id.c
+++ b/src/openvpn/packet_id.c
@@ -76,10 +76,9 @@ packet_id_debug (int msglevel,
 }
 
 void
-packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_backtrack, const char *name, int unit)
+packet_id_init (struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit)
 {
-  dmsg (D_PID_DEBUG, "PID packet_id_init tcp_mode=%d seq_backtrack=%d time_backtrack=%d",
-       tcp_mode,
+  dmsg (D_PID_DEBUG, "PID packet_id_init seq_backtrack=%d time_backtrack=%d",
        seq_backtrack,
        time_backtrack);
 
@@ -88,7 +87,7 @@ packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_
 
   p->rec.name = name;
   p->rec.unit = unit;
-  if (seq_backtrack && !tcp_mode)
+  if (seq_backtrack)
     {
       ASSERT (MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK);
       ASSERT (MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK);

diff --git a/src/openvpn/packet_id.h b/src/openvpn/packet_id.h
index 5eb501d10843a26acbbebe0f673b0489e6e5090c..fb059b7d16fa12dba9ac2731058125ab917de646 100644 (file)
--- a/src/openvpn/packet_id.h
+++ b/src/openvpn/packet_id.h
@@ -210,7 +210,7 @@ struct packet_id
   struct packet_id_rec rec;
 };
 
-void packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_backtrack, const char *name, int unit);
+void packet_id_init (struct packet_id *p, int seq_backtrack, int time_backtrack, const char *name, int unit);
 void packet_id_free (struct packet_id *p);
 
 /* should we accept an incoming packet id ? */

diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index caf3b1f6264c0926610101f5a370962dcbeb9b80..420164e7726bc1723790b8f3ca88a4f4406e4f07 100644 (file)
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -799,7 +799,7 @@ key_state_init (struct tls_session *session, struct key_state *ks)
   /* init packet ID tracker */
   if (session->opt->replay)
     {
-      packet_id_init (&ks->crypto_options.packet_id, session->opt->tcp_mode,
+      packet_id_init (&ks->crypto_options.packet_id,
          session->opt->replay_window, session->opt->replay_time, "SSL",
          ks->key_id);
     }
@@ -948,7 +948,6 @@ tls_session_init (struct tls_multi *multi, struct tls_session *session)
 
   /* initialize packet ID replay window for --tls-auth */
   packet_id_init (&session->tls_auth.packet_id,
-                 session->opt->tcp_mode,
                  session->opt->replay_window,
                  session->opt->replay_time,
                  "TLS_AUTH", session->key_id);