tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008-2012 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #include <signal.h>
  31 #include <fcntl.h>
  32 #include <unistd.h>
  33 #include <netdb.h>
  34 #include <netinet/in_systm.h>
  35 #include <netinet/in.h>
  36 #include <netinet/ip.h>
  37 #include <net/if.h>
  38 #include <arpa/inet.h>
  39 #include <errno.h>
  40 #include <ctype.h>
  41 #include <stdio.h>
  42 #include <stdlib.h>
  43 #if defined(__sun__)
  44 #include <stropts.h>
  45 #include <sys/sockio.h>
  46 #include <net/if_tun.h>
  47 #ifndef TUNNEWPPA
  48 #error "Install TAP driver from http://www.whiteboard.ne.jp/~admin2/tuntap/"
  49 #endif
  50 #endif
  51
  52 #include "openconnect-internal.h"
  53
  54 /*
  55  * If an if_tun.h include file was found anywhere (by the Makefile), it's
  56  * included. Else, we end up assuming that we have BSD-style devices such
  57  * as /dev/tun0 etc.
  58  */
  59 #ifdef IF_TUN_HDR
  60 #include IF_TUN_HDR
  61 #endif
  62
  63 /*
  64  * The OS X tun/tap driver doesn't provide a header file; you're expected
  65  * to define this for yourself.
  66  */
  67 #ifdef __APPLE__
  68 #define TUNSIFHEAD  _IOW('t', 96, int)
  69 #endif
  70
  71 /*
  72  * OpenBSD always puts the protocol family prefix onto packets. Other
  73  * systems let us enable that with the TUNSIFHEAD ioctl, and some of them
  74  * (e.g. FreeBSD) _need_ it otherwise they'll interpret IPv6 packets as IPv4.
  75  */
  76 #if defined(__OpenBSD__) || defined(TUNSIFHEAD)
  77 #define TUN_HAS_AF_PREFIX 1
  78 #endif
  79
  80 static int set_tun_mtu(struct openconnect_info *vpninfo)
  81 {
  82 #ifndef __sun__ /* We don't know how to do this on Solaris */
  83         struct ifreq ifr;
  84         int net_fd;
  85
  86         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  87         if (net_fd < 0) {
  88                 perror(_("open net"));
  89                 return -EINVAL;
  90         }
  91
  92         memset(&ifr, 0, sizeof(ifr));
  93         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  94         ifr.ifr_mtu = vpninfo->mtu;
  95
  96         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  97                 perror(_("SIOCSIFMTU"));
  98
  99         close(net_fd);
 100 #endif
 101         return 0;
 102 }
 103
 104
 105 static int setenv_int(const char *opt, int value)
 106 {
 107         char buf[16];
 108         sprintf(buf, "%d", value);
 109         return setenv(opt, buf, 1);
 110 }
 111
 112 static int netmasklen(struct in_addr addr)
 113 {
 114         int masklen;
 115
 116         for (masklen = 0; masklen < 32; masklen++) {
 117                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 118                         break;
 119         }
 120         return 32 - masklen;
 121 }
 122
 123 static int process_split_xxclude(struct openconnect_info *vpninfo,
 124                                  int include, const char *route, int *v4_incs,
 125                                  int *v6_incs)
 126 {
 127         struct in_addr addr;
 128         const char *in_ex = include?"IN":"EX";
 129         char envname[80];
 130         char *slash;
 131
 132         slash = strchr(route, '/');
 133         if (!slash) {
 134         badinc:
 135                 if (include)
 136                         vpn_progress(vpninfo, PRG_ERR,
 137                                      _("Discard bad split include: \"%s\"\n"),
 138                                      route);
 139                 else
 140                         vpn_progress(vpninfo, PRG_ERR,
 141                                      _("Discard bad split exclude: \"%s\"\n"),
 142                                      route);
 143                 return -EINVAL;
 144         }
 145
 146         *slash = 0;
 147
 148         if (strchr(route, ':')) {
 149                 snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_ADDR", in_ex,
 150                          *v6_incs);
 151                 setenv(envname, route, 1);
 152
 153                 snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_MASKLEN", in_ex,
 154                          *v6_incs);
 155                 setenv(envname, slash+1, 1);
 156
 157                 (*v6_incs)++;
 158                 return 0;
 159         }
 160
 161         if (!inet_aton(route, &addr)) {
 162                 *slash = '/';
 163                 goto badinc;
 164         }
 165
 166         envname[79] = 0;
 167         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *v4_incs);
 168         setenv(envname, route, 1);
 169
 170         /* Put it back how we found it */
 171         *slash = '/';
 172
 173         if (!inet_aton(slash+1, &addr))
 174                 goto badinc;
 175
 176         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *v4_incs);
 177         setenv(envname, slash+1, 1);
 178
 179         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *v4_incs);
 180         setenv_int(envname, netmasklen(addr));
 181
 182         (*v4_incs)++;
 183         return 0;
 184 }
 185
 186 static int appendenv(const char *opt, const char *new)
 187 {
 188         char buf[1024];
 189         char *old = getenv(opt);
 190
 191         buf[1023] = 0;
 192         if (old)
 193                 snprintf(buf, 1023, "%s %s", old, new);
 194         else
 195                 snprintf(buf, 1023, "%s", new);
 196
 197         return setenv(opt, buf, 1);
 198 }
 199
 200 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 201 {
 202         char *env_buf;
 203         int buflen = 0;
 204         int bufofs = 0;
 205         struct vpn_option *opt;
 206
 207         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 208                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 209
 210         env_buf = malloc(buflen + 1);
 211         if (!env_buf)
 212                 return;
 213
 214         env_buf[buflen] = 0;
 215
 216         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 217                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 218                                    "%s=%s\n", opt->option, opt->value);
 219
 220         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 221         free(env_buf);
 222 }
 223
 224 static void set_banner(struct openconnect_info *vpninfo)
 225 {
 226         char *banner, *q;
 227         const char *p;
 228
 229         if (!vpninfo->banner || !(banner = malloc(strlen(vpninfo->banner)+1))) {
 230                 unsetenv("CISCO_BANNER");
 231                 return;
 232         }
 233         p = vpninfo->banner;
 234         q = banner;
 235
 236         while (*p) {
 237                 if (*p == '%' && isxdigit((int)(unsigned char)p[1]) &&
 238                     isxdigit((int)(unsigned char)p[2])) {
 239                         *(q++) = unhex(p + 1);
 240                         p += 3;
 241                 } else
 242                         *(q++) = *(p++);
 243         }
 244         *q = 0;
 245         setenv("CISCO_BANNER", banner, 1);
 246
 247         free(banner);
 248 }
 249
 250 static void set_script_env(struct openconnect_info *vpninfo)
 251 {
 252         char host[80];
 253         int ret = getnameinfo(vpninfo->peer_addr, vpninfo->peer_addrlen, host,
 254                               sizeof(host), NULL, 0, NI_NUMERICHOST);
 255         if (!ret)
 256                 setenv("VPNGATEWAY", host, 1);
 257
 258         set_banner(vpninfo);
 259         unsetenv("CISCO_SPLIT_INC");
 260         unsetenv("CISCO_SPLIT_EXC");
 261
 262         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 263
 264         if (vpninfo->vpn_addr) {
 265                 setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 266                 if (vpninfo->vpn_netmask) {
 267                         struct in_addr addr;
 268                         struct in_addr mask;
 269
 270                         if (inet_aton(vpninfo->vpn_addr, &addr) &&
 271                             inet_aton(vpninfo->vpn_netmask, &mask)) {
 272                                 char *netaddr;
 273
 274                                 addr.s_addr &= mask.s_addr;
 275                                 netaddr = inet_ntoa(addr);
 276
 277                                 setenv("INTERNAL_IP4_NETADDR", netaddr, 1);
 278                                 setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 279                                 setenv_int("INTERNAL_IP4_NETMASKLEN", netmasklen(mask));
 280                         }
 281                 }
 282         }
 283         if (vpninfo->vpn_addr6) {
 284                 setenv("INTERNAL_IP6_ADDRESS", vpninfo->vpn_addr6, 1);
 285                 setenv("INTERNAL_IP6_NETMASK", vpninfo->vpn_netmask6, 1);
 286         }
 287
 288         if (vpninfo->vpn_dns[0])
 289                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 290         else
 291                 unsetenv("INTERNAL_IP4_DNS");
 292         if (vpninfo->vpn_dns[1])
 293                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 294         if (vpninfo->vpn_dns[2])
 295                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 296
 297         if (vpninfo->vpn_nbns[0])
 298                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 299         else
 300                 unsetenv("INTERNAL_IP4_NBNS");
 301         if (vpninfo->vpn_nbns[1])
 302                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 303         if (vpninfo->vpn_nbns[2])
 304                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 305
 306         if (vpninfo->vpn_domain)
 307                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 308         else unsetenv ("CISCO_DEF_DOMAIN");
 309
 310         if (vpninfo->vpn_proxy_pac)
 311                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 312
 313         if (vpninfo->split_includes) {
 314                 struct split_include *this = vpninfo->split_includes;
 315                 int nr_split_includes = 0;
 316                 int nr_v6_split_includes = 0;
 317
 318                 while (this) {
 319                         process_split_xxclude(vpninfo, 1, this->route,
 320                                               &nr_split_includes,
 321                                               &nr_v6_split_includes);
 322                         this = this->next;
 323                 }
 324                 if (nr_split_includes)
 325                         setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 326                 if (nr_v6_split_includes)
 327                         setenv_int("CISCO_IPV6_SPLIT_INC", nr_v6_split_includes);
 328         }
 329         if (vpninfo->split_excludes) {
 330                 struct split_include *this = vpninfo->split_excludes;
 331                 int nr_split_excludes = 0;
 332                 int nr_v6_split_excludes = 0;
 333
 334                 while (this) {
 335                         process_split_xxclude(vpninfo, 0, this->route,
 336                                               &nr_split_excludes,
 337                                               &nr_v6_split_excludes);
 338                         this = this->next;
 339                 }
 340                 if (nr_split_excludes)
 341                         setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 342                 if (nr_v6_split_excludes)
 343                         setenv_int("CISCO_IPV6_SPLIT_EXC", nr_v6_split_excludes);
 344         }
 345         setenv_cstp_opts(vpninfo);
 346 }
 347
 348 int script_config_tun(struct openconnect_info *vpninfo, const char *reason)
 349 {
 350         if (!vpninfo->vpnc_script)
 351                 return 0;
 352
 353         setenv("reason", reason, 1);
 354         if (system(vpninfo->vpnc_script)) {
 355                 int e = errno;
 356                 vpn_progress(vpninfo, PRG_ERR,
 357                              _("Failed to spawn script '%s' for %s: %s\n"),
 358                              vpninfo->vpnc_script, reason, strerror(e));
 359                 return -e;
 360         }
 361         return 0;
 362 }
 363
 364 #ifdef __sun__
 365 static int link_proto(int unit_nr, const char *devname, uint64_t flags)
 366 {
 367         int ip_fd, mux_id, tun2_fd;
 368         struct lifreq ifr;
 369
 370         tun2_fd = open("/dev/tun", O_RDWR);
 371         if (tun2_fd < 0) {
 372                 perror(_("Could not /dev/tun for plumbing"));
 373                 return -EIO;
 374         }
 375         if (ioctl(tun2_fd, I_PUSH, "ip") < 0) {
 376                 perror(_("Can't push IP"));
 377                 close(tun2_fd);
 378                 return -EIO;
 379         }
 380
 381         sprintf(ifr.lifr_name, "tun%d", unit_nr);
 382         ifr.lifr_ppa = unit_nr;
 383         ifr.lifr_flags = flags;
 384
 385         if (ioctl(tun2_fd, SIOCSLIFNAME, &ifr) < 0) {
 386                 perror(_("Can't set ifname"));
 387                 close(tun2_fd);
 388                 return -1;
 389         }
 390
 391         ip_fd = open(devname, O_RDWR);
 392         if (ip_fd < 0) {
 393                 fprintf(stderr, _("Can't open %s: %s"), devname,
 394                         strerror(errno));
 395                 close(tun2_fd);
 396                 return -1;
 397         }
 398
 399         mux_id = ioctl(ip_fd, I_LINK, tun2_fd);
 400         if (mux_id < 0) {
 401                 fprintf(stderr, _("Can't plumb %s for IPv%d: %s\n"),
 402                          ifr.lifr_name, (flags == IFF_IPV4) ? 4 : 6,
 403                          strerror(errno));
 404                 close(tun2_fd);
 405                 close(ip_fd);
 406                 return -1;
 407         }
 408
 409         close(tun2_fd);
 410
 411         return ip_fd;
 412 }
 413 #endif
 414
 415 static int os_setup_tun(struct openconnect_info *vpninfo)
 416 {
 417         int tun_fd;
 418
 419 #ifdef IFF_TUN /* Linux */
 420         struct ifreq ifr;
 421         int tunerr;
 422
 423         tun_fd = open("/dev/net/tun", O_RDWR);
 424         if (tun_fd < 0) {
 425                 /* Android has /dev/tun instead of /dev/net/tun
 426                    Since other systems might have too, just try it
 427                    as a fallback instead of using ifdef __ANDROID__ */
 428                 tunerr = errno;
 429                 tun_fd = open("/dev/tun", O_RDWR);
 430         }
 431         if (tun_fd < 0) {
 432                 /* If the error on /dev/tun is ENOENT, that's boring.
 433                    Use the error we got on /dev/net/tun instead */
 434                 if (errno != -ENOENT)
 435                         tunerr = errno;
 436
 437                 vpn_progress(vpninfo, PRG_ERR,
 438                              _("Failed to open tun device: %s\n"),
 439                              strerror(tunerr));
 440                 exit(1);
 441         }
 442         memset(&ifr, 0, sizeof(ifr));
 443         ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 444         if (vpninfo->ifname)
 445                 strncpy(ifr.ifr_name, vpninfo->ifname,
 446                         sizeof(ifr.ifr_name) - 1);
 447         if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 448                 vpn_progress(vpninfo, PRG_ERR,
 449                              _("TUNSETIFF failed: %s\n"),
 450                              strerror(errno));
 451                 exit(1);
 452         }
 453         if (!vpninfo->ifname)
 454                 vpninfo->ifname = strdup(ifr.ifr_name);
 455 #elif defined (__sun__)
 456         static char tun_name[80];
 457         int unit_nr;
 458
 459         tun_fd = open("/dev/tun", O_RDWR);
 460         if (tun_fd < 0) {
 461                 perror(_("open /dev/tun"));
 462                 return -EIO;
 463         }
 464
 465         unit_nr = ioctl(tun_fd, TUNNEWPPA, -1);
 466         if (unit_nr < 0) {
 467                 perror(_("Failed to create new tun"));
 468                 close(tun_fd);
 469                 return -EIO;
 470         }
 471
 472         if (ioctl(tun_fd, I_SRDOPT, RMSGD) < 0) {
 473                 perror(_("Failed to put tun file descriptor into message-discard mode"));
 474                 close(tun_fd);
 475                 return -EIO;
 476         }
 477
 478         sprintf(tun_name, "tun%d", unit_nr);
 479         vpninfo->ifname = strdup(tun_name);
 480
 481         vpninfo->ip_fd = link_proto(unit_nr, "/dev/udp", IFF_IPV4);
 482         if (vpninfo->ip_fd < 0) {
 483                 close(tun_fd);
 484                 return -EIO;
 485         }
 486
 487         if (vpninfo->vpn_addr6) {
 488                 vpninfo->ip6_fd = link_proto(unit_nr, "/dev/udp6", IFF_IPV6);
 489                 if (vpninfo->ip6_fd < 0) {
 490                         close(tun_fd);
 491                         close(vpninfo->ip_fd);
 492                         vpninfo->ip_fd = -1;
 493                         return -EIO;
 494                 }
 495         } else
 496                 vpninfo->ip6_fd = -1;
 497
 498 #else /* BSD et al have /dev/tun$x devices */
 499         static char tun_name[80];
 500         int i;
 501         for (i = 0; i < 255; i++) {
 502                 sprintf(tun_name, "/dev/tun%d", i);
 503                 tun_fd = open(tun_name, O_RDWR);
 504                 if (tun_fd >= 0)
 505                         break;
 506         }
 507         if (tun_fd < 0) {
 508                 perror(_("open tun"));
 509                 exit(1);
 510         }
 511         vpninfo->ifname = strdup(tun_name + 5);
 512 #ifdef TUNSIFHEAD
 513         i = 1;
 514         if (ioctl(tun_fd, TUNSIFHEAD, &i) < 0) {
 515                 perror(_("TUNSIFHEAD"));
 516                 exit(1);
 517         }
 518 #endif
 519 #endif
 520         return tun_fd;
 521 }
 522
 523 /* Set up a tuntap device. */
 524 int setup_tun(struct openconnect_info *vpninfo)
 525 {
 526         int tun_fd;
 527
 528         set_script_env(vpninfo);
 529
 530         if (vpninfo->script_tun) {
 531                 pid_t child;
 532                 int fds[2];
 533
 534                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 535                         perror(_("socketpair"));
 536                         exit(1);
 537                 }
 538                 tun_fd = fds[0];
 539                 child = fork();
 540                 if (child < 0) {
 541                         perror(_("fork"));
 542                         exit(1);
 543                 } else if (!child) {
 544                         close(tun_fd);
 545                         setenv_int("VPNFD", fds[1]);
 546                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 547                         perror(_("execl"));
 548                         exit(1);
 549                 }
 550                 close(fds[1]);
 551                 vpninfo->script_tun = child;
 552                 vpninfo->ifname = strdup(_("(script)"));
 553         } else {
 554                 script_config_tun(vpninfo, "pre-init");
 555
 556                 tun_fd = os_setup_tun(vpninfo);
 557                 if (tun_fd < 0)
 558                         return tun_fd;
 559
 560                 setenv("TUNDEV", vpninfo->ifname, 1);
 561                 script_config_tun(vpninfo, "connect");
 562
 563                 /* Ancient vpnc-scripts might not get this right */
 564                 set_tun_mtu(vpninfo);
 565         }
 566
 567         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 568
 569         vpninfo->tun_fd = tun_fd;
 570
 571         if (vpninfo->select_nfds <= tun_fd)
 572                 vpninfo->select_nfds = tun_fd + 1;
 573
 574         FD_SET(tun_fd, &vpninfo->select_rfds);
 575
 576         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 577
 578         return 0;
 579 }
 580
 581 static struct pkt *out_pkt;
 582
 583 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 584 {
 585         int work_done = 0;
 586         int prefix_size = 0;
 587
 588 #ifdef TUN_HAS_AF_PREFIX
 589         if (!vpninfo->script_tun)
 590                 prefix_size = sizeof(int);
 591 #endif
 592
 593         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 594                 while (1) {
 595                         int len = vpninfo->mtu;
 596
 597                         if (!out_pkt) {
 598                                 out_pkt = malloc(sizeof(struct pkt) + len);
 599                                 if (!out_pkt) {
 600                                         vpn_progress(vpninfo, PRG_ERR, "Allocation failed\n");
 601                                         break;
 602                                 }
 603                         }
 604
 605                         len = read(vpninfo->tun_fd, out_pkt->data - prefix_size, len + prefix_size);
 606                         if (len <= prefix_size)
 607                                 break;
 608                         out_pkt->len = len - prefix_size;
 609
 610                         queue_packet(&vpninfo->outgoing_queue, out_pkt);
 611                         out_pkt = NULL;
 612
 613                         work_done = 1;
 614                         vpninfo->outgoing_qlen++;
 615                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 616                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 617                                 break;
 618                         }
 619                 }
 620         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 621                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 622         }
 623
 624         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 625            we could handle that and retry... but it doesn't let us poll() for
 626            the no-longer-full situation, so let's not bother. */
 627         while (vpninfo->incoming_queue) {
 628                 struct pkt *this = vpninfo->incoming_queue;
 629                 unsigned char *data = this->data;
 630                 int len = this->len;
 631
 632 #ifdef TUN_HAS_AF_PREFIX
 633                 if (!vpninfo->script_tun) {
 634                         struct ip *iph = (void *)data;
 635                         int type;
 636
 637                         if (iph->ip_v == 6)
 638                                 type = AF_INET6;
 639                         else if (iph->ip_v == 4)
 640                                 type = AF_INET;
 641                         else {
 642                                 static int complained = 0;
 643                                 if (!complained) {
 644                                         complained = 1;
 645                                         vpn_progress(vpninfo, PRG_ERR,
 646                                                      _("Unknown packet (len %d) received: %02x %02x %02x %02x...\n"),
 647                                                      len, data[0], data[1], data[2], data[3]);
 648                                 }
 649                                 free(this);
 650                                 continue;
 651                         }
 652                         data -= 4;
 653                         len += 4;
 654                         *(int *)data = htonl(type);
 655                 }
 656 #endif
 657                 vpninfo->incoming_queue = this->next;
 658
 659                 if (write(vpninfo->tun_fd, data, len) < 0) {
 660                         /* Handle death of "script" socket */
 661                         if (vpninfo->script_tun && errno == ENOTCONN) {
 662                                 vpninfo->quit_reason = "Client connection terminated";
 663                                 return 1;
 664                         }
 665                         vpn_progress(vpninfo, PRG_ERR,
 666                                      _("Failed to write incoming packet: %s\n"),
 667                                      strerror(errno));
 668                 }
 669                 free(this);
 670         }
 671         /* Work is not done if we just got rid of packets off the queue */
 672         return work_done;
 673 }
 674
 675 void shutdown_tun(struct openconnect_info *vpninfo)
 676 {
 677         if (vpninfo->script_tun) {
 678                 kill(vpninfo->script_tun, SIGHUP);
 679         } else {
 680                 script_config_tun(vpninfo, "disconnect");
 681 #ifdef __sun__
 682                 close(vpninfo->ip_fd);
 683                 vpninfo->ip_fd = -1;
 684                 if (vpninfo->ip6_fd != -1) {
 685                         close(vpninfo->ip6_fd);
 686                         vpninfo->ip6_fd = -1;
 687                 }
 688 #endif
 689         }
 690
 691         close(vpninfo->tun_fd);
 692         vpninfo->tun_fd = -1;
 693 }