OpenVPN的广播问题以及tun和tap设备的深层次挖掘

static inline unsigned int mroute_extract_addr_from_packet (struct mroute_addr *src,
                 struct mroute_addr *dest,
                 struct mroute_addr *esrc,
                 struct mroute_addr *edest,
                 const struct buffer *buf,
                 int tunnel_type)
{
...
  unsigned int ret = 0;
  verify_align_4 (buf);
  if (tunnel_type == DEV_TYPE_TUN) //如果是tun模式，那么直接处理ipv4包头，不再处理广播的情况，但是可以处理ip多播
    ret = mroute_extract_addr_ipv4 (src, dest, buf);
  else if (tunnel_type == DEV_TYPE_TAP)  //只有在tap的情况下才解析二层地址。
    ret = mroute_extract_addr_ether (src, dest, esrc, edest, buf);
  return ret;
}

if (is_mac_mcast_addr (eth->dest))
    ret |= MROUTE_EXTRACT_BCAST;

while (true) {
...
    multi_process_io_udp (&multi);
...
}
static void multi_process_io_udp (struct multi_context *m)
{
...
    if (status & SOCKET_WRITE) //写入socket
              multi_process_outgoing_link (m, mpp_flags);
      else if (status & TUN_WRITE) //写入虚拟网卡字符设备
              multi_process_outgoing_tun (m, mpp_flags);
      else if (status & SOCKET_READ) { //读取socket
              read_incoming_link (&m->top);
              multi_release_io_lock (m);
              if (!IS_SIG (&m->top))
            multi_process_incoming_link (m, NULL, mpp_flags);
        }
      else if (status & TUN_READ) { //读取虚拟网卡字符设备
        read_incoming_tun (&m->top);
        multi_release_io_lock (m);
        if (!IS_SIG (&m->top))
            multi_process_incoming_tun (m, mpp_flags);
        }
}

multi_process_incoming_link：
if (BLEN (&c->c2.buf) > 0){
    process_incoming_link (c); 

    if (TUNNEL_TYPE (m->top.c1.tuntap) == DEV_TYPE_TUN) {
        mroute_flags = mroute_extract_addr_from_packet (...);
...
        else if (m->enable_c2c) { //如果c2c启用的话
            if (mroute_flags & MROUTE_EXTRACT_MCAST) ...//组播
              else {
                      mi = multi_get_instance_by_virtual_addr (m, &dest, true); //server作为“路由器”找到目的client的socket
                  if (mi) {
                multi_unicast (m, &c->c2.to_tun, mi);  //单播发送，实际上就是放入了队列，中转源client到目的client的通信
                register_activity (c, BLEN(&c->c2.to_tun));
                  c->c2.to_tun.len = 0; //凡是有这个语句的表示数据已经处理过了，不需要to-tun了，或者数据出错
            }
            }
        }
...

static void tun_net_init(struct net_device *dev)
{
    struct tun_struct *tun = netdev_priv(dev);
    switch (tun->flags & TUN_TYPE_MASK) {
    case TUN_TUN_DEV:  //下面设置tun设备的点对点模式
        dev->hard_header_len = 0;
        dev->addr_len = 0;
        dev->mtu = 1500;
        dev->type = ARPHRD_NONE; //没有arp，就是一个点对点的连接，路由时直接从出口发出，不再arp
        dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
        dev->tx_queue_len = 10;
        break;
    case TUN_TAP_DEV:
        dev->set_multicast_list = tun_net_mclist;
        *(u16 *)dev->dev_addr = htons(0x00FF);
        get_random_bytes(dev->dev_addr + sizeof(u16), 4);
        ether_setup(dev);
        break;
    }
}

CompleteIRP：
if (p_PacketBuffer->m_SizeFlags & TP_TUN) { //如果是tun设备模式的话就不将以太头传输给用户空间
      offset = ETHERNET_HEADER_SIZE;
      len = (int) (p_PacketBuffer->m_SizeFlags & TP_SIZE_MASK) - ETHERNET_HEADER_SIZE;
} else {
      offset = 0;
      len = (p_PacketBuffer->m_SizeFlags & TP_SIZE_MASK);
}

DriverEntry：
l_Properties->SendHandler = AdapterTransmit;
NDIS_STATUS
AdapterTransmit (IN NDIS_HANDLE p_AdapterContext,
         IN PNDIS_PACKET p_Packet,
         IN UINT p_Flags)
{
...            
    if (l_Adapter->m_tun) {
        ETH_HEADER *e;
        if (l_PacketLength < ETHERNET_HEADER_SIZE)
              goto no_queue;

        e = (ETH_HEADER *) l_PacketBuffer->m_Data;
        switch (ntohs (e->proto)) {
          case ETH_P_ARP:
...   //由于tap-win32必然要实现以太网卡的标准，实际上它就是一个以太网卡，从而arp也是必须要处理的，然而tun模式下的arp是没有意义的，于是tap-win32不得不采用一种自问自答的方式来自圆其说。
                ProcessARP (l_Adapter, 
                (PARP_PACKET) l_PacketBuffer->m_Data,
                l_Adapter->m_localIP,
                l_Adapter->m_remoteNetwork,
                l_Adapter->m_remoteNetmask,
                l_Adapter->m_TapToUser.dest); //此处自答自己发出的arp请求。
          default: 
                goto no_queue;
          case ETH_P_IP:
...
          }
    if (IS_UP (l_Adapter)) //以下将数据包push到一个读队列，以便从用户空间ReadFile读取
              result = QueuePush (l_Adapter->m_Extension.m_PacketQueue, l_PacketBuffer);
...
}
BOOLEAN
ProcessARP (TapAdapterPointer p_Adapter,
        const PARP_PACKET src,
        const IPADDR adapter_ip,
        const IPADDR ip_network,
        const IPADDR ip_netmask,
        const MACADDR mac)
{
  if (src->m_Proto == htons (ETH_P_ARP)
      && MAC_EQUAL (src->m_MAC_Source, p_Adapter->m_MAC)
      ...//检查确认这个arp是发送给自己的
      && src->m_ARP_IP_Destination != adapter_ip) {
      ARP_PACKET *arp = (ARP_PACKET *) MemAlloc (sizeof (ARP_PACKET), TRUE);
      if (arp) {
      // Initialize ARP reply fields
      arp->m_Proto = htons (ETH_P_ARP);
      arp->m_MAC_AddressType = htons (MAC_ADDR_TYPE);
      arp->m_PROTO_AddressType = htons (ETH_P_IP);
      arp->m_MAC_AddressSize = sizeof (MACADDR);
      arp->m_PROTO_AddressSize = sizeof (IPADDR);
      arp->m_ARP_Operation = htons (ARP_REPLY);
      // ARP addresses 
      COPY_MAC (arp->m_MAC_Source, mac);  //mac实际上第3个字节比p_Adapter->m_MAC要大1，这里谎称mac是从“远端”过来的
      COPY_MAC (arp->m_MAC_Destination, p_Adapter->m_MAC); //“远道而来”的arp-reply的目的地显然是p_Adapter->m_MAC，也就是自己
      COPY_MAC (arp->m_ARP_MAC_Source, mac);
      COPY_MAC (arp->m_ARP_MAC_Destination, p_Adapter->m_MAC);
      arp->m_ARP_IP_Source = src->m_ARP_IP_Destination;
      arp->m_ARP_IP_Destination = adapter_ip;
      InjectPacket (p_Adapter, (UCHAR *) arp, sizeof (ARP_PACKET)); //模拟接收arp-reply数据帧
      MemFree (arp, sizeof (ARP_PACKET));
    }
      return TRUE;
    }
  else
    return FALSE;
}