openvpn

package module
v0.0.0-...-bd912fd Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 5, 2026 License: GPL-2.0 Imports: 60 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	MSSFixModeMTU   = "mtu"
	MSSFixModeFixed = "fixed"
)
View Source 
const (
	ModeTLS       = "tls"
	ModeStaticKey = "static_key"
)

Variables

View Source 
var (
	ErrMissingServer               = E.New("missing openvpn server")
	ErrMissingListenAddress        = E.New("missing openvpn listen address")
	ErrUnsupportedProtocol         = E.New("unsupported openvpn protocol")
	ErrUnsupportedMode             = E.New("unsupported openvpn mode")
	ErrHandshakeTimeout            = E.New("control handshake timeout")
	ErrNoPushReply                 = E.New("server did not reply to push requests")
	ErrDataChannelNotReady         = E.New("data channel is not ready")
	ErrClientClosed                = E.New("client is closed")
	ErrServerClosed                = E.New("server is closed")
	ErrPeerNotFound                = E.New("peer not found")
	ErrMissingStaticKey            = E.New("missing openvpn static key")
	ErrCompressionNotSupported     = E.New("unsupported compression option")
	ErrOptionNotSupported          = E.New("option is not supported yet")
	ErrAuthenticationFailed        = E.New("authentication failed")
	ErrServerRestart               = E.New("server requested restart")
	ErrServerHalt                  = E.New("server halted session")
	ErrServerExit                  = E.New("server exited")
	ErrPeerExit                    = E.New("peer exited")
	ErrPeerRestart                 = E.New("peer started a new hard-reset session")
	ErrPeerCertificateVerification = E.New("peer certificate verification failed")
	ErrPeerCertificateRevoked      = E.New("peer certificate is revoked")
	ErrPeerCertificateExtUsage     = E.New("peer certificate is missing required extended key usage")
	ErrPeerCertificateKeyUsage     = E.New("peer certificate is missing required key usage")
	ErrPeerCertificateNSCertType   = E.New("peer certificate fails ns-cert-type check")
	ErrPeerCertificateName         = E.New("peer certificate fails verify-x509-name check")
	ErrPeerCertificatePurpose      = E.New("unsuitable certificate purpose")
	ErrCRLSignatureInvalid         = E.New("CRL signature not issued by a trusted CA")
	ErrCRLExpired                  = E.New("CRL is outside its validity window")
	ErrCRLUnavailable              = E.New("no CRL in the --crl-verify file covers a certificate in the chain")
	ErrCRLIssuerKeyUsage           = E.New("CRL issuer certificate is not allowed to sign CRLs")
	ErrPullFilterRejected          = E.New("pushed option rejected by pull-filter")
	ErrCompressionPushRejected     = E.New("pushed compression rejected")
	ErrCipherNegotiationFailed     = E.New("cipher negotiation failed with peer")
	ErrRenegotiationRequired       = E.New("data channel reached renegotiation threshold")
	ErrIPPoolExhausted             = E.New("server ifconfig pool is exhausted")
	ErrRouteNotFound               = E.New("route not found")
	ErrInvalidIPPacket             = E.New("invalid ip packet")
	ErrPingRestartTimeout          = E.New("ping-restart timeout")
	ErrPingExitTimeout             = E.New("ping-exit timeout")
	ErrNoPendingChallenge          = E.New("no pending openvpn challenge")
	ErrChallengeNotAnswerable      = E.New("challenge does not accept a response")
	ErrChallengeCanceled           = E.New("authentication challenge canceled")
	ErrAuthPendingTimeout          = E.New("pending authentication timed out")
	ErrInactiveTimeout             = E.New("inactive timeout")
	ErrSessionTimeout              = E.New("session timeout")
	ErrRemoteAddressExhausted      = E.New("remote address list exhausted")
	ErrServerResourceLimit         = E.New("server resource limit reached")
	ErrFatalDecryption             = E.New("fatal decryption error")
)
View Source 
var ErrAllowCompressionConflict = E.New("allow-compression no conflicts with statically enabled compression")

Upstream options_postprocess_mutate (options.c) flags --allow-compression no with non-stub compression.

View Source 
var ErrInvalidAllowCompression = E.New("invalid allow-compression value")

Upstream options_postprocess_mutate (options.c) rejects bad --allow-compression tokens.

View Source 
var ErrMaterialSourceConflict = E.New("material path and content are both set")
View Source 
var ErrMissingCAOrPeerFingerprint = E.New("tls mode: either certificate-authority or peer-fingerprint must be configured")

Upstream options_postprocess_filechecks (options.c) rejects TLS without CA material or peer fingerprints.

Functions

This section is empty.

Types

type AuthChallengeError 

type AuthChallengeError struct {
	Challenge CRV1Challenge
}

func (*AuthChallengeError) Error 

func (authError *AuthChallengeError) Error() string

func (*AuthChallengeError) Unwrap 

func (authError *AuthChallengeError) Unwrap() error

type AuthFailedAdvance 

type AuthFailedAdvance int
const (
	AuthFailedAdvanceNextAddress AuthFailedAdvance = iota
	AuthFailedAdvanceNextRemote
	AuthFailedAdvanceStay
)

type AuthFailedTemporaryError 

type AuthFailedTemporaryError struct {
	BackoffSeconds uint32
	Advance        AuthFailedAdvance
	Reason         string
}

func (*AuthFailedTemporaryError) Error 

func (temporaryError *AuthFailedTemporaryError) Error() string

func (*AuthFailedTemporaryError) Unwrap 

func (temporaryError *AuthFailedTemporaryError) Unwrap() error

type AuthFailedTerminalError 

type AuthFailedTerminalError struct {
	Reason string
}

func (*AuthFailedTerminalError) Error 

func (terminalError *AuthFailedTerminalError) Error() string

func (*AuthFailedTerminalError) Terminal 

func (terminalError *AuthFailedTerminalError) Terminal() bool

func (*AuthFailedTerminalError) Unwrap 

func (terminalError *AuthFailedTerminalError) Unwrap() error

type AuthRetryMode 

type AuthRetryMode string
const (
	AuthRetryModeNone       AuthRetryMode = "none"
	AuthRetryModeNoInteract AuthRetryMode = "nointeract"
	AuthRetryModeInteract   AuthRetryMode = "interact"
)

type AuthTokenAuthenticationFailedError 

type AuthTokenAuthenticationFailedError struct {
	Reason string
}

func (*AuthTokenAuthenticationFailedError) Error 

func (tokenError *AuthTokenAuthenticationFailedError) Error() string

func (*AuthTokenAuthenticationFailedError) Unwrap 

func (tokenError *AuthTokenAuthenticationFailedError) Unwrap() error

type CRV1Challenge 

type CRV1Challenge struct {
	StateID       string
	Username      string
	ChallengeText string
	Echo          bool
}

type Challenge 

type Challenge struct {
	ID            string
	Kind          ChallengeKind
	Username      string
	Message       string
	URL           string
	SecretMessage string
	Echo          bool
	PreviousError string
	Deadline      time.Time
}

type ChallengeKind 

type ChallengeKind string
const (
	ChallengeCredentials ChallengeKind = "credentials"
	ChallengeSecret      ChallengeKind = "secret"
	ChallengeMessage     ChallengeKind = "message"
	ChallengeOpenURL     ChallengeKind = "open-url"
)

type ChallengeResponse 

type ChallengeResponse struct {
	Username string
	Password string
	Secret   string
}

type Client 

type Client struct {
	// contains filtered or unexported fields
}

func NewClient 

func NewClient(options ClientOptions) (*Client, error)

func (*Client) CancelChallenge 

func (c *Client) CancelChallenge(challengeID string) error

func (*Client) ChallengeUpdated 

func (c *Client) ChallengeUpdated() <-chan struct{}

func (*Client) Close 

func (c *Client) Close() error

func (*Client) CompleteChallenge 

func (c *Client) CompleteChallenge(challengeID string, response ChallengeResponse) error

func (*Client) CompressionPushRejection 

func (c *Client) CompressionPushRejection() string

func (*Client) DroppedIncomingDataPackets 

func (c *Client) DroppedIncomingDataPackets() uint64

func (*Client) PendingChallenge 

func (c *Client) PendingChallenge() *Challenge

func (*Client) PullFilterRejection 

func (c *Client) PullFilterRejection() string

func (*Client) ReadDataPacket 

func (c *Client) ReadDataPacket(ctx context.Context) ([]byte, error)

func (*Client) ReadDataPacketBuffer 

func (c *Client) ReadDataPacketBuffer(ctx context.Context) (*buf.Buffer, error)

func (*Client) ReadDataPackets 

func (c *Client) ReadDataPackets(ctx context.Context) ([]*buf.Buffer, error)

func (*Client) Ready 

func (c *Client) Ready() bool

func (*Client) RestartSession 

func (c *Client) RestartSession()

func (*Client) Start 

func (c *Client) Start() error

func (*Client) TunnelConfiguration 

func (c *Client) TunnelConfiguration() TunnelConfiguration

func (*Client) WriteDataPacket 

func (c *Client) WriteDataPacket(packet []byte) error

func (*Client) WriteDataPacketBuffers 

func (c *Client) WriteDataPacketBuffers(packetBuffers []*buf.Buffer) error

func (*Client) WriteDataPackets 

func (c *Client) WriteDataPackets(packets [][]byte) error

type ClientAuthenticationOptions 

type ClientAuthenticationOptions struct {
	Username            string
	Password            string
	AuthRetry           string
	StaticChallenge     string
	StaticChallengeEcho bool
}

type ClientDataChannelOptions 

type ClientDataChannelOptions struct {
	MTU              uint32
	MSSFix           uint32
	MSSFixDisabled   bool
	MSSFixMode       string
	Fragment         uint32
	Cipher           string
	Ciphers          []string
	FallbackCipher   string
	Auth             string
	Compression      string
	CompressionLZO   string
	AllowCompression string
	ReplayWindow     uint32
	ReplayWindowTime time.Duration
	PacketHeadroom   int
}

type ClientOptions 

type ClientOptions struct {
	Context               context.Context
	Mode                  string
	Transport             ClientTransportOptions
	DataChannel           ClientDataChannelOptions
	TLS                   ClientTLSOptions
	Authentication        ClientAuthenticationOptions
	Pull                  ClientPullOptions
	Tunnel                ClientTunnelOptions
	Timing                ClientTimingOptions
	StaticKey             Material
	KeyDirection          int
	OnTunnelConfiguration func(event TunnelConfigurationEvent) error
	Logger                logger.ContextLogger
}

type ClientPullOptions 

type ClientPullOptions struct {
	Enabled     bool
	Filters     []PullFilter
	RouteNoPull bool
}

type ClientTLSOptions 

type ClientTLSOptions struct {
	CertificateAuthority Material
	Certificate          Material
	Key                  Material
	Auth                 Material
	Crypt                Material
	CryptV2              Material
	VerifyX509Name       string
	VerifyX509Type       string
	PeerFingerprint      []string
	CRLVerify            string
	RemoteCertificateKU  []string
	RemoteCertificateEKU string
	RemoteCertificateTLS string
	NSCertificateType    string
	VersionMin           string
	VersionMax           string
	CertificateProfile   string
	Cipher               string
	Groups               string
}

type ClientTimingOptions 

type ClientTimingOptions struct {
	RenegotiationInterval time.Duration
	RenegotiationDisabled bool
	RenegotiationBytes    uint64
	RenegotiationPackets  uint64
	PingInterval          time.Duration
	PingRestart           time.Duration
	PingRestartDisabled   bool
	TLSTimeout            time.Duration
	HandWindow            time.Duration
}

type ClientTransportOptions 

type ClientTransportOptions struct {
	Remotes                     []Remote
	RemoteRandom                bool
	DialContext                 func(ctx context.Context, network string, address string) (net.Conn, error)
	DialContextWithAddressIndex func(ctx context.Context, network string, address string, addressIndex int) (net.Conn, error)
	Protocol                    string
	ExplicitExitNotify          uint32
}

type ClientTunnelOptions 

type ClientTunnelOptions struct {
	DevType              string
	Topology             string
	RedirectGateway      bool
	RedirectGatewayFlags []string
	RedirectPrivate      bool
	RouteMetric          int
	BlockIPv6            bool
	BlockOutsideDNS      bool
	RouteGateway         netip.Addr
	Routes               []TunnelRoute
	DHCPOptions          []string
	LocalAddress         []netip.Prefix
	VPNGateway           netip.Addr
	VPNGatewayIPv6       netip.Addr
}

type Material 

type Material struct {
	Path    string
	Content []byte
}

func (Material) IsSet 

func (m Material) IsSet() bool

func (Material) Validate 

func (m Material) Validate(name string) error

type PullFilter 

type PullFilter struct {
	Action string
	Text   string
}

type Remote 

type Remote struct {
	Host     string
	Port     uint16
	Protocol string
}

type RouteMissError 

type RouteMissError struct {
	Destination netip.Addr
	Packet      []byte
}

func (*RouteMissError) Error 

func (e *RouteMissError) Error() string

func (*RouteMissError) Unwrap 

func (e *RouteMissError) Unwrap() error

type Server 

type Server struct {
	// contains filtered or unexported fields
}

func NewServer 

func NewServer(options ServerOptions) (*Server, error)

func (*Server) Close 

func (s *Server) Close() error

func (*Server) DroppedIncomingDataPackets 

func (s *Server) DroppedIncomingDataPackets() uint64

func (*Server) ReadDataPacket 

func (s *Server) ReadDataPacket(ctx context.Context) (ServerDataPacket, error)

func (*Server) ReadDataPacketBuffer 

func (s *Server) ReadDataPacketBuffer(ctx context.Context) (ServerDataBuffer, error)

func (*Server) ReadDataPackets 

func (s *Server) ReadDataPackets(ctx context.Context) ([]ServerDataBuffer, error)

func (*Server) Start 

func (s *Server) Start() error

func (*Server) WriteDataPacket 

func (s *Server) WriteDataPacket(peerAddress string, packet []byte) error

func (*Server) WriteDataPacketBuffersByDestination 

func (s *Server) WriteDataPacketBuffersByDestination(packetBuffers []*buf.Buffer) ([]*RouteMissError, error)

func (*Server) WriteDataPacketByDestination 

func (s *Server) WriteDataPacketByDestination(packet []byte) error

func (*Server) WriteDataPackets 

func (s *Server) WriteDataPackets(peerAddress string, packets [][]byte) error

func (*Server) WriteDataPacketsByDestination 

func (s *Server) WriteDataPacketsByDestination(packets [][]byte) ([]*RouteMissError, error)

type ServerAuthenticationOptions 

type ServerAuthenticationOptions struct {
	Authenticator UserPassAuthenticator
	DuplicateCN   bool
}

type ServerDataBuffer 

type ServerDataBuffer struct {
	PeerAddress string
	Buffer      *buf.Buffer
}

type ServerDataChannelOptions 

type ServerDataChannelOptions struct {
	MTU              uint32
	MSSFix           uint32
	MSSFixDisabled   bool
	MSSFixMode       string
	Cipher           string
	Ciphers          []string
	FallbackCipher   string
	Auth             string
	ReplayWindow     uint32
	ReplayWindowTime time.Duration
	PacketHeadroom   int
}

type ServerDataPacket 

type ServerDataPacket struct {
	PeerAddress string
	Payload     []byte
}

type ServerOptions 

type ServerOptions struct {
	Context        context.Context
	Mode           string
	Transport      ServerTransportOptions
	Resources      ServerResourceOptions
	DataChannel    ServerDataChannelOptions
	TLS            ServerTLSOptions
	Authentication ServerAuthenticationOptions
	Timing         ServerTimingOptions
	Tunnel         ServerTunnelOptions
	Push           ServerPushOptions
	StaticKey      Material
	KeyDirection   int
	Logger         logger.ContextLogger
}

type ServerPushOptions 

type ServerPushOptions struct {
	Routes               []netip.Prefix
	DNS                  []netip.Addr
	DNSServers           []TunnelDNSServer
	SearchDomains        []string
	DHCPOptions          []string
	BlockOutsideDNS      bool
	PingInterval         time.Duration
	PingIntervalEnabled  bool
	PingRestart          time.Duration
	PingRestartEnabled   bool
	RedirectGateway      bool
	RedirectGatewayFlags []string
}

type ServerResourceOptions 

type ServerResourceOptions struct {
	MaxClients                    int
	ConnectFrequency              int
	ConnectFrequencyPeriod        time.Duration
	InitialConnectFrequency       int
	InitialConnectFrequencyPeriod time.Duration
}

type ServerTLSOptions 

type ServerTLSOptions struct {
	CertificateAuthority    Material
	Certificate             Material
	Key                     Material
	Auth                    Material
	Crypt                   Material
	CryptV2                 Material
	CryptV2ForceCookie      bool
	VerifyClientCertificate string
	VerifyX509Name          string
	VerifyX509Type          string
	PeerFingerprint         []string
	CRLVerify               string
	RemoteCertificateKU     []string
	RemoteCertificateEKU    string
	RemoteCertificateTLS    string
	NSCertificateType       string
	VersionMin              string
	VersionMax              string
	CertificateProfile      string
	Cipher                  string
	Groups                  string
}

type ServerTimingOptions 

type ServerTimingOptions struct {
	RenegotiationInterval time.Duration
	RenegotiationDisabled bool
	RenegotiationBytes    uint64
	RenegotiationPackets  uint64
	HandWindow            time.Duration
	PingInterval          time.Duration
	PingRestart           time.Duration
}

type ServerTransportOptions 

type ServerTransportOptions struct {
	ListenAddress string
	RemoteAddress string
	Listener      net.Listener
	PacketConn    net.PacketConn
	Protocol      string
}

type ServerTunnelOptions 

type ServerTunnelOptions struct {
	AddressPools   []netip.Prefix
	Topology       string
	LocalAddress   []netip.Prefix
	VPNGateway     netip.Addr
	VPNGatewayIPv6 netip.Addr
}

type TunnelConfiguration 

type TunnelConfiguration struct {
	DevType              string
	Topology             string
	TunMTU               uint32
	LocalIPv4            []netip.Prefix
	LocalIPv6            []netip.Prefix
	VPNGateway           netip.Addr
	VPNGatewayIPv6       netip.Addr
	IPv4Routes           []TunnelRoute
	IPv6Routes           []TunnelRoute
	ExcludedIPv4Routes   []TunnelRoute
	ExcludedIPv6Routes   []TunnelRoute
	DNS                  []netip.Addr
	DNSServers           []TunnelDNSServer
	DHCPOptions          []string
	SearchDomains        []string
	DNSRoutes            []string
	BlockIPv6            bool
	BlockOutsideDNS      bool
	RedirectGateway      bool
	RedirectGatewayFlags []string
	RedirectPrivate      bool
	RouteMetric          int
	RouteGateway         netip.Addr
	PingInterval         time.Duration
	PingRestart          time.Duration
	AuthToken            string
	AuthTokenUser        string
	ExplicitExitNotify   uint32
	PeerID               *uint32
	SelectedCipher       string
	SelectedAuth         string
	ProtocolFlags        []string
	KeyDerivation        string
	InactiveTimeout      time.Duration
	InactiveMinimumBytes uint64
	SessionTimeout       time.Duration
	PingExit             time.Duration
	PingTimerRemote      bool
}

type TunnelConfigurationEvent 

type TunnelConfigurationEvent struct {
	Reason        TunnelConfigurationEventReason
	Configuration TunnelConfiguration
}

type TunnelConfigurationEventReason 

type TunnelConfigurationEventReason string
const (
	TunnelConfigurationEventInitial       TunnelConfigurationEventReason = "initial"
	TunnelConfigurationEventPushUpdate    TunnelConfigurationEventReason = "push_update"
	TunnelConfigurationEventRenegotiation TunnelConfigurationEventReason = "renegotiation"
)

type TunnelDNSServer 

type TunnelDNSServer struct {
	Priority       int
	Addresses      []netip.AddrPort
	ResolveDomains []string
	DNSSEC         string
	Transport      string
	SNI            string
}

type TunnelRoute 

type TunnelRoute struct {
	Prefix  netip.Prefix
	Gateway netip.Addr
	Metric  int
}

type UserPassAuthenticator 

type UserPassAuthenticator func(ctx context.Context, username string, password string) error

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.