tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #ifdef __linux__
  31 #include <linux/if_tun.h>
  32 #endif
  33 #include <fcntl.h>
  34 #include <unistd.h>
  35 #include <netinet/in_systm.h>
  36 #include <netinet/in.h>
  37 #include <netinet/ip.h>
  38 #include <net/if.h>
  39 #include <arpa/inet.h>
  40 #include <errno.h>
  41
  42 #include "openconnect.h"
  43
  44 #ifdef BSD
  45 #define TUN_HAS_AF_PREFIX 1
  46 #endif
  47
  48 static int local_config_tun(struct openconnect_info *vpninfo, int mtu_only)
  49 {
  50         struct ifreq ifr;
  51         int net_fd;
  52
  53         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  54         if (net_fd < 0) {
  55                 perror("open net");
  56                 return -EINVAL;
  57         }
  58         memset(&ifr, 0, sizeof(ifr));
  59         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  60
  61         if (!mtu_only) {
  62                 struct sockaddr_in *addr = (struct sockaddr_in *) &ifr.ifr_addr;
  63
  64                 if (ioctl(net_fd, SIOCGIFFLAGS, &ifr) < 0)
  65                         perror("SIOCGIFFLAGS");
  66
  67                 ifr.ifr_flags |= IFF_UP | IFF_POINTOPOINT;
  68                 if (ioctl(net_fd, SIOCSIFFLAGS, &ifr) < 0)
  69                         perror("SIOCSIFFLAGS");
  70
  71                 addr->sin_family = AF_INET;
  72                 addr->sin_addr.s_addr = inet_addr(vpninfo->vpn_addr);
  73                 if (ioctl(net_fd, SIOCSIFADDR, &ifr) < 0)
  74                         perror("SIOCSIFADDR");
  75         }
  76
  77         ifr.ifr_mtu = vpninfo->mtu;
  78         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  79                 perror("SIOCSIFMTU");
  80
  81         close(net_fd);
  82
  83         return 0;
  84 }
  85
  86 static int setenv_int(const char *opt, int value)
  87 {
  88         char buf[16];
  89         sprintf(buf, "%d", value);
  90         return setenv(opt, buf, 1);
  91 }
  92
  93 static int process_split_xxclude(struct openconnect_info *vpninfo,
  94                                  char *in_ex, char *route, int *nr_incs)
  95 {
  96         struct in_addr addr;
  97         int masklen;
  98         char envname[80];
  99         char *slash;
 100
 101         slash = strchr(route, '/');
 102         if (!slash) {
 103         badinc:
 104                 vpninfo->progress(vpninfo, PRG_ERR,
 105                                   "Discard bad split %sclude: \"%s\"\n",
 106                                   in_ex, route);
 107                 return -EINVAL;
 108         }
 109
 110         *slash = 0;
 111         if (!inet_aton(route, &addr)) {
 112                 *slash = '/';
 113                 goto badinc;
 114         }
 115
 116         envname[79] = 0;
 117         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *nr_incs);
 118         setenv(envname, route, 1);
 119
 120         /* Put it back how we found it */
 121         *slash = '/';
 122
 123         if (!inet_aton(slash+1, &addr))
 124                 goto badinc;
 125
 126         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *nr_incs);
 127         setenv(envname, slash+1, 1);
 128
 129         for (masklen = 0; masklen < 32; masklen++) {
 130                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 131                         break;
 132         }
 133         masklen = 32 - masklen;
 134
 135         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *nr_incs);
 136         setenv_int(envname, masklen);
 137
 138         (*nr_incs)++;
 139         return 0;
 140 }
 141
 142 static int appendenv(const char *opt, const char *new)
 143 {
 144         char buf[1024];
 145         char *old = getenv(opt);
 146
 147         buf[1023] = 0;
 148         if (old)
 149                 snprintf(buf, 1023, "%s %s", old, new);
 150         else
 151                 snprintf(buf, 1023, "%s", new);
 152
 153         return setenv(opt, buf, 1);
 154 }
 155
 156 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 157 {
 158         char *env_buf;
 159         int buflen = 0;
 160         int bufofs = 0;
 161         struct vpn_option *opt;
 162
 163         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 164                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 165
 166         env_buf = malloc(buflen + 1);
 167         if (!env_buf)
 168                 return;
 169
 170         env_buf[buflen] = 0;
 171
 172         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 173                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 174                                    "%s=%s\n", opt->option, opt->value);
 175
 176         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 177         free(env_buf);
 178 }
 179
 180 static void set_script_env(struct openconnect_info *vpninfo)
 181 {
 182         struct sockaddr_in *sin = (void *)vpninfo->peer_addr;
 183
 184         setenv("VPNGATEWAY", inet_ntoa(sin->sin_addr), 1);
 185         setenv("TUNDEV", vpninfo->ifname, 1);
 186         setenv("reason", "connect", 1);
 187         unsetenv("CISCO_BANNER");
 188         unsetenv("CISCO_SPLIT_INC");
 189         unsetenv("CISCO_SPLIT_EXC");
 190
 191         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 192
 193         setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 194         setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 195
 196         if (vpninfo->vpn_dns[0])
 197                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 198         else
 199                 unsetenv("INTERNAL_IP4_DNS");
 200         if (vpninfo->vpn_dns[1])
 201                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 202         if (vpninfo->vpn_dns[2])
 203                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 204
 205         if (vpninfo->vpn_nbns[0])
 206                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 207         else
 208                 unsetenv("INTERNAL_IP4_NBNS");
 209         if (vpninfo->vpn_nbns[1])
 210                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 211         if (vpninfo->vpn_nbns[2])
 212                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 213
 214         if (vpninfo->vpn_domain)
 215                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 216         else unsetenv ("CISCO_DEF_DOMAIN");
 217
 218         if (vpninfo->vpn_proxy_pac)
 219                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 220
 221         if (vpninfo->split_includes) {
 222                 struct split_include *this = vpninfo->split_includes;
 223                 int nr_split_includes = 0;
 224
 225                 while (this) {
 226                         process_split_xxclude(vpninfo, "IN", this->route,
 227                                               &nr_split_includes);
 228                         this = this->next;
 229                 }
 230                 setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 231         }
 232         if (vpninfo->split_excludes) {
 233                 struct split_include *this = vpninfo->split_excludes;
 234                 int nr_split_excludes = 0;
 235
 236                 while (this) {
 237                         process_split_xxclude(vpninfo, "EX", this->route,
 238                                               &nr_split_excludes);
 239                         this = this->next;
 240                 }
 241                 setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 242         }
 243         setenv_cstp_opts(vpninfo);
 244 }
 245
 246 static int script_config_tun(struct openconnect_info *vpninfo)
 247 {
 248         if (vpninfo->peer_addr->sa_family != AF_INET) {
 249                 vpninfo->progress(vpninfo, PRG_ERR, "Script cannot handle anything but Legacy IP\n");
 250                 return -EINVAL;
 251         }
 252
 253         set_script_env(vpninfo);
 254
 255         system(vpninfo->vpnc_script);
 256         return 0;
 257 }
 258
 259
 260 /* Set up a tuntap device. */
 261 int setup_tun(struct openconnect_info *vpninfo)
 262 {
 263         int tun_fd;
 264
 265         if (vpninfo->script_tun) {
 266                 pid_t child;
 267                 int fds[2];
 268
 269                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 270                         perror("socketpair");
 271                         exit(1);
 272                 }
 273                 tun_fd = fds[0];
 274                 child = fork();
 275                 if (child < 0) {
 276                         perror("fork");
 277                         exit(1);
 278                 } else if (!child) {
 279                         close(tun_fd);
 280                         setenv_int("VPNFD", fds[1]);
 281                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 282                         perror("execl");
 283                         exit(1);
 284                 }
 285                 close(fds[1]);
 286                 vpninfo->script_tun = child;
 287                 vpninfo->ifname = "(script)";
 288         } else {
 289 #ifdef IFF_TUN /* Linux */
 290                 struct ifreq ifr;
 291
 292                 tun_fd = open("/dev/net/tun", O_RDWR);
 293                 if (tun_fd < 0) {
 294                         vpninfo->progress(vpninfo, PRG_ERR,
 295                                           "Failed to open tun device: %s\n",
 296                                           strerror(errno));
 297                         exit(1);
 298                 }
 299                 memset(&ifr, 0, sizeof(ifr));
 300                 ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 301                 if (vpninfo->ifname)
 302                         strncpy(ifr.ifr_name, vpninfo->ifname,
 303                                 sizeof(ifr.ifr_name) - 1);
 304                 if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 305                         vpninfo->progress(vpninfo, PRG_ERR,
 306                                           "TUNSETIFF failed: %s\n",
 307                                           strerror(errno));
 308                         exit(1);
 309                 }
 310                 if (!vpninfo->ifname)
 311                         vpninfo->ifname = strdup(ifr.ifr_name);
 312
 313 #else /* BSD et al have /dev/tun$x devices */
 314                 static char tun_name[80];
 315                 int i;
 316                 for (i = 0; i < 255; i++) {
 317                         sprintf(tun_name, "/dev/tun%d", i);
 318                         tun_fd = open(tun_name, O_RDWR);
 319                         if (tun_fd >= 0)
 320                                 break;
 321                 }
 322                 if (tun_fd < 0) {
 323                         perror("open tun");
 324                         exit(1);
 325                 }
 326                 vpninfo->ifname = tun_name + 5;
 327 #endif
 328                 if (vpninfo->vpnc_script) {
 329                         script_config_tun(vpninfo);
 330                         /* We have to set the MTU for ourselves, because the script doesn't */
 331                         local_config_tun(vpninfo, 1);
 332                 } else
 333                         local_config_tun(vpninfo, 0);
 334         }
 335
 336         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 337
 338         vpninfo->tun_fd = tun_fd;
 339
 340         if (vpninfo->select_nfds <= tun_fd)
 341                 vpninfo->select_nfds = tun_fd + 1;
 342
 343         FD_SET(tun_fd, &vpninfo->select_rfds);
 344
 345         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 346
 347         return 0;
 348 }
 349
 350 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 351 {
 352         unsigned char buf[2000];
 353         int len;
 354         int work_done = 0;
 355
 356         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 357                 while ((len = read(vpninfo->tun_fd, buf, sizeof(buf))) > 0) {
 358                         unsigned char *pkt = buf;
 359                         int type;
 360 #ifdef __OpenBSD__
 361                         type = ntohl(*(int *)buf);
 362                         if (type != AF_INET && type != AF_INET6)
 363                                 continue;
 364                         pkt += 4;
 365                         len -= 4;
 366 #else
 367                         struct ip *iph = (void *)buf;
 368                         if (iph->ip_v == 6)
 369                                 type = AF_INET6;
 370                         else if (iph->ip_v == 4)
 371                                 type = AF_INET;
 372                         else
 373                                 continue;
 374 #endif
 375                         if (queue_new_packet(&vpninfo->outgoing_queue, type,
 376                                              pkt, len))
 377                                 break;
 378
 379                         work_done = 1;
 380                         vpninfo->outgoing_qlen++;
 381                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 382                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 383                                 break;
 384                         }
 385                 }
 386         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 387                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 388         }
 389
 390         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 391            we could handle that and retry... but it doesn't let us poll() for
 392            the no-longer-full situation, so let's not bother. */
 393         while (vpninfo->incoming_queue) {
 394                 struct pkt *this = vpninfo->incoming_queue;
 395                 unsigned char *data = this->data;
 396                 int len = this->len;
 397
 398                 vpninfo->incoming_queue = this->next;
 399
 400 #ifdef __OpenBSD__
 401                 data -= 4;
 402                 len += 4;
 403                 *(int *)data = htonl(this->type);
 404 #endif
 405
 406                 if (write(vpninfo->tun_fd, data, len) < 0 &&
 407                     errno == ENOTCONN) {
 408                         vpninfo->quit_reason = "Client connection terminated";
 409                         return 1;
 410                 }
 411                 free(this);
 412         }
 413         /* Work is not done if we just got rid of packets off the queue */
 414         return work_done;
 415 }