From patchwork Fri Jul 17 14:14:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5111 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:b0c1:b0:878:4d70:ff7f with SMTP id p1csp1240221maw; Fri, 17 Jul 2026 07:15:05 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rpd80+HMWBDK30D8J4NNu2ucXCJqdxpkhmjfncVWe5Kom9mj5FHbd6F8842BCxznrvG6qlyv8rrDjI=@openvpn.net X-Received: by 2002:a05:6820:16aa:b0:6a3:1556:7a5f with SMTP id 006d021491bc7-6a536892da7mr1050429eaf.58.1784297703281; Fri, 17 Jul 2026 07:15:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784297703; cv=none; d=google.com; s=arc-20260327; b=HoMfE+6qZAK7lO/CxBWD9Fb3r9pPzgMYsviSnA/N8Vk+BQD04vmH3X67WMGoLN0y83 Mq3yq1YWVxH7blsoqL8j3uKIaZTUUGncs8JJJ/IYn4ilmM2l/4mECb6hS67EOvB4R14/ 2BbmRMqg4s+eSKtCFLj7QoctXRSueW67PH/C3XXulyi2ZtMqSU5CLhfeSnM/smuzAtYS drxuyh0Lt/20KChlvdPmCbxlGpQl2NIo5K/+kki0r/enyCNcv7c3xPuav3kpJE/sE9QN J49hpatreL88lk2O8ZqdMdIN7AliyR/mMpQjHJISWz9Q8ATWZmUMhYC3793pWl1+LF1u Wuow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=7mAPv8WbXFynFwKrUyFPM7CwPrX9A/9iFwVYglXzT2I=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=P6EBCnuOZyIwOrh9GDXtn0g6zQ8WMUQuv8lkX0TBgFoRKYwhn1x1t7hngtxi5qcQta uM7ZExLGOHF/FdGmtfDoee54bqO0IN1uqXr4VKL94VErVr4ZnLdYVatAEVRYRtOfJEdi Ls79c8Ev08mb88hcmCTsDZUQHAZ3oh2YnLEc6dsa/aeTEl2UL3zbCYK831f1tsFS/t34 5B1MAKQDolbY0weOALOiD7PMexYkB6Dm+QYpis8ll1bPzq5p8SCYdPbfQd+rPw+coe9+ eIT7R4kxyp6yQPrSBUQzXJlG/tEJXEqczCTPMhMJlImmpFS3B8YpyNCVjsHhV19kNBcx 39Bg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="jj1rza/6"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=mFdmGVRu; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=K0iAxope; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4568e76580dsi1328919fac.240.2026.07.17.07.15.02 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Jul 2026 07:15:03 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="jj1rza/6"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=mFdmGVRu; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=K0iAxope; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=7mAPv8WbXFynFwKrUyFPM7CwPrX9A/9iFwVYglXzT2I=; b=jj1rza/6sSnYKk638+LDJb+Smy ikOBMDK3BzIR4JxYqSyty3DKL/nlfeDok5jbhJj42juVfC2BIEt++ZD6tUvDDu9E+j83aGNKN9Yrn m3LIywk/7tE7Ae/kqcc6U7+entQ5+FrG8X6BATCbD4qnkYdX8o59PEH74uidqbNNibvw=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wkjLA-0006xQ-8Z; Fri, 17 Jul 2026 14:14:57 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wkjL9-0006xJ-09 for openvpn-devel@lists.sourceforge.net; Fri, 17 Jul 2026 14:14:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=IjkiiJ81c0qC2mODC3DUHFtKeUbYL/E5flQwdqk84fY=; b=mFdmGVRua3hE3AjeZcmz7O+HiX S7UuTJq9xHErhsgWcBCj+zdFt1wx9u8q6hV+/2h6u6ag1Ii5lPYhpE5dQin4g+zIAz2ydYHbu0tb0 WQVCN92yoYCes4WxcZQteKF7JzhFJmqcPKIoBMC+VIFEgeCfKKUDKvJyXKFv+FuvSAIc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=IjkiiJ81c0qC2mODC3DUHFtKeUbYL/E5flQwdqk84fY=; b=K0iAxopeWFEWChAszTG51EWQsE qI6J/30MQVawUsJS+GRgAcMWUMYNXDSvCjM6CMI/rQJ6C67VY0wfM+wp1viLRu8e0jU0ehzPtcVgv gQR0P0rxCuSBSPPWFAf5t8UaP+129alEbHnQd2JelcNia+3LhE0+V6cSeax810nyhBCc=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wkjL4-0004PR-Rt for openvpn-devel@lists.sourceforge.net; Fri, 17 Jul 2026 14:14:56 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 66HEEgGf022966 for ; Fri, 17 Jul 2026 16:14:42 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 66HEEgdn022965 for openvpn-devel@lists.sourceforge.net; Fri, 17 Jul 2026 16:14:42 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Fri, 17 Jul 2026 16:14:37 +0200 Message-ID: <20260717141442.22943-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Arne Schwabe This extract a large chunk from multi_process_incoming_link into its own method multi_process_incoming_link_data This reduces the complexity of multi_process_incoming_link further. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1wkjL4-0004PR-Rt Subject: [Openvpn-devel] [PATCH v4] Move incoming data processing in its own method X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1870971748454793783 X-GMAIL-MSGID: 1870971748454793783 From: Arne Schwabe This extract a large chunk from multi_process_incoming_link into its own method multi_process_incoming_link_data This reduces the complexity of multi_process_incoming_link further. A few declarations were moved into a more logical place but otherwise this is just a simple move. Change-Id: I9f10d91407347faf32397535c95e2d80a1575bd5 Signed-off-by: Arne Schwabe Acked-by: Frank Lichtenheld Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1722 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1722 This mail reflects revision 4 of this Change. Acked-by according to Gerrit (reflected above): Frank Lichtenheld diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c index d70245f..7535797 100644 --- a/src/openvpn/multi.c +++ b/src/openvpn/multi.c @@ -3302,6 +3302,155 @@ } #endif /* if defined(ENABLE_DCO) */ +/** + * Process incoming data packet from clients. + * + * This tries to decrypt and then forward incoming + * data packets. + */ +static void +multi_process_incoming_link_data(struct multi_context *m, bool floated, struct link_socket *sock) +{ + struct link_socket_info *lsi = &sock->info; + const uint8_t *orig_buf; + + /* decrypt in instance context */ + struct context *c = &m->pending->context; + + orig_buf = c->c2.buf.data; + if (process_incoming_link_part1(c, lsi, floated)) + { + /* nonzero length means that we have a valid, decrypted packed */ + if (floated && c->c2.buf.len > 0) + { + multi_process_float(m, m->pending, sock); + } + + process_incoming_link_part2(c, lsi, orig_buf); + } + + if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TUN) + { + struct mroute_addr src, dest; + /* extract packet source and dest addresses */ + unsigned int mroute_flags = + mroute_extract_addr_from_packet(&src, &dest, 0, &c->c2.to_tun, DEV_TYPE_TUN); + + /* drop packet if extract failed */ + if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED)) + { + c->c2.to_tun.len = 0; + } + /* make sure that source address is associated with this client */ + else if (multi_get_instance_by_virtual_addr(m, &src, true) != m->pending) + { + /* IPv6 link-local address (fe80::xxx)? */ + if ((src.type & MR_ADDR_MASK) == MR_ADDR_IPV6 + && IN6_IS_ADDR_LINKLOCAL(&src.v6.addr)) + { + /* do nothing, for now. TODO: add address learning */ + } + else + { + struct gc_arena gc = gc_new(); + msg(D_MULTI_DROPPED, + "MULTI: bad source address from client [%s], packet dropped", + mroute_addr_print(&src, &gc)); + gc_free(&gc); + } + c->c2.to_tun.len = 0; + } + /* client-to-client communication enabled? */ + else if (m->enable_c2c) + { + /* multicast? */ + if (mroute_flags & MROUTE_EXTRACT_MCAST) + { + /* for now, treat multicast as broadcast */ + multi_bcast(m, &c->c2.to_tun, m->pending, 0); + } + else /* possible client to client routing */ + { + ASSERT(!(mroute_flags & MROUTE_EXTRACT_BCAST)); + struct multi_instance *mi = multi_get_instance_by_virtual_addr(m, &dest, true); + + /* if dest addr is a known client, route to it */ + if (mi) + { + { + multi_unicast(m, &c->c2.to_tun, mi); + register_activity(c, BLEN(&c->c2.to_tun)); + } + c->c2.to_tun.len = 0; + } + } + } + } + else if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TAP) + { + uint16_t vid = 0; + + if (m->top.options.vlan_tagging) + { + if (vlan_is_tagged(&c->c2.to_tun)) + { + /* Drop VLAN-tagged frame. */ + msg(D_VLAN_DEBUG, "dropping incoming VLAN-tagged frame"); + c->c2.to_tun.len = 0; + } + else + { + vid = c->options.vlan_pvid; + } + } + /* extract packet source and dest addresses */ + struct mroute_addr src, dest; + /* extract packet source and dest addresses */ + unsigned int mroute_flags = + mroute_extract_addr_from_packet(&src, &dest, vid, &c->c2.to_tun, DEV_TYPE_TAP); + + if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED) + { + if (multi_learn_addr(m, m->pending, &src, 0) == m->pending) + { + /* check for broadcast */ + if (m->enable_c2c) + { + if (mroute_flags & (MROUTE_EXTRACT_BCAST | MROUTE_EXTRACT_MCAST)) + { + multi_bcast(m, &c->c2.to_tun, m->pending, vid); + } + else /* try client-to-client routing */ + { + struct multi_instance *mi = multi_get_instance_by_virtual_addr(m, &dest, false); + + /* if dest addr is a known client, route to it */ + if (mi) + { + multi_unicast(m, &c->c2.to_tun, mi); + register_activity(c, BLEN(&c->c2.to_tun)); + c->c2.to_tun.len = 0; + } + } + } + } + else + { + struct gc_arena gc = gc_new(); + msg(D_MULTI_DROPPED, + "MULTI: bad source address from client [%s], packet dropped", + mroute_addr_print(&src, &gc)); + c->c2.to_tun.len = 0; + gc_free(&gc); + } + } + else + { + c->c2.to_tun.len = 0; + } + } +} + /* * Process packets in the TCP/UDP socket -> TUN/TAP interface direction, * i.e. client -> server direction. @@ -3311,9 +3460,6 @@ const unsigned int mpp_flags, struct link_socket *sock) { struct context *c; - struct mroute_addr src, dest; - unsigned int mroute_flags; - struct multi_instance *mi; bool ret = true; bool floated = false; @@ -3357,141 +3503,7 @@ if (BLEN(&c->c2.buf) > 0) { - struct link_socket_info *lsi; - const uint8_t *orig_buf; - - /* decrypt in instance context */ - - lsi = &sock->info; - orig_buf = c->c2.buf.data; - if (process_incoming_link_part1(c, lsi, floated)) - { - /* nonzero length means that we have a valid, decrypted packed */ - if (floated && c->c2.buf.len > 0) - { - multi_process_float(m, m->pending, sock); - } - - process_incoming_link_part2(c, lsi, orig_buf); - } - - if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TUN) - { - /* extract packet source and dest addresses */ - mroute_flags = - mroute_extract_addr_from_packet(&src, &dest, 0, &c->c2.to_tun, DEV_TYPE_TUN); - - /* drop packet if extract failed */ - if (!(mroute_flags & MROUTE_EXTRACT_SUCCEEDED)) - { - c->c2.to_tun.len = 0; - } - /* make sure that source address is associated with this client */ - else if (multi_get_instance_by_virtual_addr(m, &src, true) != m->pending) - { - /* IPv6 link-local address (fe80::xxx)? */ - if ((src.type & MR_ADDR_MASK) == MR_ADDR_IPV6 - && IN6_IS_ADDR_LINKLOCAL(&src.v6.addr)) - { - /* do nothing, for now. TODO: add address learning */ - } - else - { - struct gc_arena gc = gc_new(); - msg(D_MULTI_DROPPED, - "MULTI: bad source address from client [%s], packet dropped", - mroute_addr_print(&src, &gc)); - gc_free(&gc); - } - c->c2.to_tun.len = 0; - } - /* client-to-client communication enabled? */ - else if (m->enable_c2c) - { - /* multicast? */ - if (mroute_flags & MROUTE_EXTRACT_MCAST) - { - /* for now, treat multicast as broadcast */ - multi_bcast(m, &c->c2.to_tun, m->pending, 0); - } - else /* possible client to client routing */ - { - ASSERT(!(mroute_flags & MROUTE_EXTRACT_BCAST)); - mi = multi_get_instance_by_virtual_addr(m, &dest, true); - - /* if dest addr is a known client, route to it */ - if (mi) - { - { - multi_unicast(m, &c->c2.to_tun, mi); - register_activity(c, BLEN(&c->c2.to_tun)); - } - c->c2.to_tun.len = 0; - } - } - } - } - else if (TUNNEL_TYPE(m->top.c1.tuntap) == DEV_TYPE_TAP) - { - uint16_t vid = 0; - - if (m->top.options.vlan_tagging) - { - if (vlan_is_tagged(&c->c2.to_tun)) - { - /* Drop VLAN-tagged frame. */ - msg(D_VLAN_DEBUG, "dropping incoming VLAN-tagged frame"); - c->c2.to_tun.len = 0; - } - else - { - vid = c->options.vlan_pvid; - } - } - /* extract packet source and dest addresses */ - mroute_flags = - mroute_extract_addr_from_packet(&src, &dest, vid, &c->c2.to_tun, DEV_TYPE_TAP); - - if (mroute_flags & MROUTE_EXTRACT_SUCCEEDED) - { - if (multi_learn_addr(m, m->pending, &src, 0) == m->pending) - { - /* check for broadcast */ - if (m->enable_c2c) - { - if (mroute_flags & (MROUTE_EXTRACT_BCAST | MROUTE_EXTRACT_MCAST)) - { - multi_bcast(m, &c->c2.to_tun, m->pending, vid); - } - else /* try client-to-client routing */ - { - mi = multi_get_instance_by_virtual_addr(m, &dest, false); - - /* if dest addr is a known client, route to it */ - if (mi) - { - multi_unicast(m, &c->c2.to_tun, mi); - register_activity(c, BLEN(&c->c2.to_tun)); - c->c2.to_tun.len = 0; - } - } - } - } - else - { - struct gc_arena gc = gc_new(); - msg(D_MULTI_DROPPED, - "MULTI: bad source address from client [%s], packet dropped", - mroute_addr_print(&src, &gc)); - c->c2.to_tun.len = 0; - gc_free(&gc); - } - } - else - { - c->c2.to_tun.len = 0; - } - } + multi_process_incoming_link_data(m, floated, sock); } /* postprocess and set wakeup */