tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008-2010 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #include <signal.h>
  31 #include <fcntl.h>
  32 #include <unistd.h>
  33 #include <netdb.h>
  34 #include <netinet/in_systm.h>
  35 #include <netinet/in.h>
  36 #include <netinet/ip.h>
  37 #include <net/if.h>
  38 #include <arpa/inet.h>
  39 #include <errno.h>
  40 #include <ctype.h>
  41 #if defined(__sun__)
  42 #include <stropts.h>
  43 #include <sys/sockio.h>
  44 #include <net/if_tun.h>
  45 #ifndef TUNNEWPPA
  46 #error "Install TAP driver from http://www.whiteboard.ne.jp/~admin2/tuntap/"
  47 #endif
  48 #endif
  49
  50 #include "openconnect-internal.h"
  51
  52 /*
  53  * If an if_tun.h include file was found anywhere (by the Makefile), it's
  54  * included. Else, we end up assuming that we have BSD-style devices such
  55  * as /dev/tun0 etc.
  56  */
  57 #ifdef IF_TUN_HDR
  58 #include IF_TUN_HDR
  59 #endif
  60
  61 /*
  62  * The OS X tun/tap driver doesn't provide a header file; you're expected
  63  * to define this for yourself.
  64  */
  65 #ifdef __APPLE__
  66 #define TUNSIFHEAD  _IOW('t', 96, int)
  67 #endif
  68
  69 /*
  70  * OpenBSD always puts the protocol family prefix onto packets. Other
  71  * systems let us enable that with the TUNSIFHEAD ioctl, and some of them
  72  * (e.g. FreeBSD) _need_ it otherwise they'll interpret IPv6 packets as IPv4.
  73  */
  74 #if defined(__OpenBSD__) || defined(TUNSIFHEAD)
  75 #define TUN_HAS_AF_PREFIX 1
  76 #endif
  77
  78 static int set_tun_mtu(struct openconnect_info *vpninfo)
  79 {
  80 #ifndef __sun__ /* We don't know how to do this on Solaris */
  81         struct ifreq ifr;
  82         int net_fd;
  83
  84         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  85         if (net_fd < 0) {
  86                 perror(_("open net"));
  87                 return -EINVAL;
  88         }
  89
  90         memset(&ifr, 0, sizeof(ifr));
  91         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  92         ifr.ifr_mtu = vpninfo->mtu;
  93
  94         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  95                 perror(_("SIOCSIFMTU"));
  96
  97         close(net_fd);
  98 #endif
  99         return 0;
 100 }
 101
 102
 103 static int setenv_int(const char *opt, int value)
 104 {
 105         char buf[16];
 106         sprintf(buf, "%d", value);
 107         return setenv(opt, buf, 1);
 108 }
 109
 110 static int netmasklen(struct in_addr addr)
 111 {
 112         int masklen;
 113
 114         for (masklen = 0; masklen < 32; masklen++) {
 115                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 116                         break;
 117         }
 118         return 32 - masklen;
 119 }
 120
 121 static int process_split_xxclude(struct openconnect_info *vpninfo,
 122                                  int include, const char *route, int *v4_incs,
 123                                  int *v6_incs)
 124 {
 125         struct in_addr addr;
 126         const char *in_ex = include?"IN":"EX";
 127         char envname[80];
 128         char *slash;
 129
 130         slash = strchr(route, '/');
 131         if (!slash) {
 132         badinc:
 133                 if (include)
 134                         vpn_progress(vpninfo, PRG_ERR,
 135                                      _("Discard bad split include: \"%s\"\n"),
 136                                      route);
 137                 else
 138                         vpn_progress(vpninfo, PRG_ERR,
 139                                      _("Discard bad split exclude: \"%s\"\n"),
 140                                      route);
 141                 return -EINVAL;
 142         }
 143
 144         *slash = 0;
 145
 146         if (strchr(route, ':')) {
 147                 snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_ADDR", in_ex,
 148                          *v6_incs);
 149                 setenv(envname, route, 1);
 150
 151                 snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_MASKLEN", in_ex,
 152                          *v6_incs);
 153                 setenv(envname, slash+1, 1);
 154
 155                 (*v6_incs)++;
 156                 return 0;
 157         }
 158
 159         if (!inet_aton(route, &addr)) {
 160                 *slash = '/';
 161                 goto badinc;
 162         }
 163
 164         envname[79] = 0;
 165         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *v4_incs);
 166         setenv(envname, route, 1);
 167
 168         /* Put it back how we found it */
 169         *slash = '/';
 170
 171         if (!inet_aton(slash+1, &addr))
 172                 goto badinc;
 173
 174         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *v4_incs);
 175         setenv(envname, slash+1, 1);
 176
 177         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *v4_incs);
 178         setenv_int(envname, netmasklen(addr));
 179
 180         (*v4_incs)++;
 181         return 0;
 182 }
 183
 184 static int appendenv(const char *opt, const char *new)
 185 {
 186         char buf[1024];
 187         char *old = getenv(opt);
 188
 189         buf[1023] = 0;
 190         if (old)
 191                 snprintf(buf, 1023, "%s %s", old, new);
 192         else
 193                 snprintf(buf, 1023, "%s", new);
 194
 195         return setenv(opt, buf, 1);
 196 }
 197
 198 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 199 {
 200         char *env_buf;
 201         int buflen = 0;
 202         int bufofs = 0;
 203         struct vpn_option *opt;
 204
 205         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 206                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 207
 208         env_buf = malloc(buflen + 1);
 209         if (!env_buf)
 210                 return;
 211
 212         env_buf[buflen] = 0;
 213
 214         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 215                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 216                                    "%s=%s\n", opt->option, opt->value);
 217
 218         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 219         free(env_buf);
 220 }
 221
 222 static void set_banner(struct openconnect_info *vpninfo)
 223 {
 224         char *banner, *q;
 225         const char *p;
 226
 227         if (!vpninfo->banner || !(banner = malloc(strlen(vpninfo->banner)))) {
 228                 unsetenv("CISCO_BANNER");
 229                 return;
 230         }
 231         p = vpninfo->banner;
 232         q = banner;
 233
 234         while (*p) {
 235                 if (*p == '%' && isxdigit((int)(unsigned char)p[1]) &&
 236                     isxdigit((int)(unsigned char)p[2])) {
 237                         *(q++) = unhex(p + 1);
 238                         p += 3;
 239                 } else
 240                         *(q++) = *(p++);
 241         }
 242         *q = 0;
 243         setenv("CISCO_BANNER", banner, 1);
 244
 245         free(banner);
 246 }
 247
 248 static void set_script_env(struct openconnect_info *vpninfo)
 249 {
 250         char host[80];
 251         int ret = getnameinfo(vpninfo->peer_addr, vpninfo->peer_addrlen, host,
 252                               sizeof(host), NULL, 0, NI_NUMERICHOST);
 253         if (!ret)
 254                 setenv("VPNGATEWAY", host, 1);
 255
 256         set_banner(vpninfo);
 257         unsetenv("CISCO_SPLIT_INC");
 258         unsetenv("CISCO_SPLIT_EXC");
 259
 260         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 261
 262         if (vpninfo->vpn_addr) {
 263                 setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 264                 if (vpninfo->vpn_netmask) {
 265                         struct in_addr addr;
 266                         struct in_addr mask;
 267
 268                         if (inet_aton(vpninfo->vpn_addr, &addr) &&
 269                             inet_aton(vpninfo->vpn_netmask, &mask)) {
 270                                 char *netaddr;
 271
 272                                 addr.s_addr &= mask.s_addr;
 273                                 netaddr = inet_ntoa(addr);
 274
 275                                 setenv("INTERNAL_IP4_NETADDR", netaddr, 1);
 276                                 setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 277                                 setenv_int("INTERNAL_IP4_NETMASKLEN", netmasklen(mask));
 278                         }
 279                 }
 280         }
 281         if (vpninfo->vpn_addr6) {
 282                 setenv("INTERNAL_IP6_ADDRESS", vpninfo->vpn_addr6, 1);
 283                 setenv("INTERNAL_IP6_NETMASK", vpninfo->vpn_netmask6, 1);
 284         }
 285
 286         if (vpninfo->vpn_dns[0])
 287                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 288         else
 289                 unsetenv("INTERNAL_IP4_DNS");
 290         if (vpninfo->vpn_dns[1])
 291                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 292         if (vpninfo->vpn_dns[2])
 293                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 294
 295         if (vpninfo->vpn_nbns[0])
 296                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 297         else
 298                 unsetenv("INTERNAL_IP4_NBNS");
 299         if (vpninfo->vpn_nbns[1])
 300                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 301         if (vpninfo->vpn_nbns[2])
 302                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 303
 304         if (vpninfo->vpn_domain)
 305                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 306         else unsetenv ("CISCO_DEF_DOMAIN");
 307
 308         if (vpninfo->vpn_proxy_pac)
 309                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 310
 311         if (vpninfo->split_includes) {
 312                 struct split_include *this = vpninfo->split_includes;
 313                 int nr_split_includes = 0;
 314                 int nr_v6_split_includes = 0;
 315
 316                 while (this) {
 317                         process_split_xxclude(vpninfo, 1, this->route,
 318                                               &nr_split_includes,
 319                                               &nr_v6_split_includes);
 320                         this = this->next;
 321                 }
 322                 if (nr_split_includes)
 323                         setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 324                 if (nr_v6_split_includes)
 325                         setenv_int("CISCO_IPV6_SPLIT_INC", nr_v6_split_includes);
 326         }
 327         if (vpninfo->split_excludes) {
 328                 struct split_include *this = vpninfo->split_excludes;
 329                 int nr_split_excludes = 0;
 330                 int nr_v6_split_excludes = 0;
 331
 332                 while (this) {
 333                         process_split_xxclude(vpninfo, 0, this->route,
 334                                               &nr_split_excludes,
 335                                               &nr_v6_split_excludes);
 336                         this = this->next;
 337                 }
 338                 if (nr_split_excludes)
 339                         setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 340                 if (nr_v6_split_excludes)
 341                         setenv_int("CISCO_IPV6_SPLIT_EXC", nr_v6_split_excludes);
 342         }
 343         setenv_cstp_opts(vpninfo);
 344 }
 345
 346 int script_config_tun(struct openconnect_info *vpninfo, const char *reason)
 347 {
 348         if (!vpninfo->vpnc_script)
 349                 return 0;
 350
 351         setenv("reason", reason, 1);
 352         if (system(vpninfo->vpnc_script)) {
 353                 int e = errno;
 354                 vpn_progress(vpninfo, PRG_ERR,
 355                              _("Failed to spawn script '%s' for %s: %s\n"),
 356                              vpninfo->vpnc_script, reason, strerror(e));
 357                 return -e;
 358         }
 359         return 0;
 360 }
 361
 362 #ifdef __sun__
 363 static int link_proto(int unit_nr, const char *devname, uint64_t flags)
 364 {
 365         int ip_fd, mux_id, tun2_fd;
 366         struct lifreq ifr;
 367
 368         tun2_fd = open("/dev/tun", O_RDWR);
 369         if (tun2_fd < 0) {
 370                 perror(_("Could not /dev/tun for plumbing"));
 371                 return -EIO;
 372         }
 373         if (ioctl(tun2_fd, I_PUSH, "ip") < 0) {
 374                 perror(_("Can't push IP"));
 375                 close(tun2_fd);
 376                 return -EIO;
 377         }
 378
 379         sprintf(ifr.lifr_name, "tun%d", unit_nr);
 380         ifr.lifr_ppa = unit_nr;
 381         ifr.lifr_flags = flags;
 382
 383         if (ioctl(tun2_fd, SIOCSLIFNAME, &ifr) < 0) {
 384                 perror(_("Can't set ifname"));
 385                 close(tun2_fd);
 386                 return -1;
 387         }
 388
 389         ip_fd = open(devname, O_RDWR);
 390         if (ip_fd < 0) {
 391                 fprintf(stderr, _("Can't open %s: %s"), devname,
 392                         strerror(errno));
 393                 close(tun2_fd);
 394                 return -1;
 395         }
 396
 397         mux_id = ioctl(ip_fd, I_LINK, tun2_fd);
 398         if (mux_id < 0) {
 399                 fprintf(stderr, _("Can't plumb %s for IPv%d: %s\n"),
 400                          ifr.lifr_name, (flags == IFF_IPV4) ? 4 : 6,
 401                          strerror(errno));
 402                 close(tun2_fd);
 403                 close(ip_fd);
 404                 return -1;
 405         }
 406
 407         close(tun2_fd);
 408
 409         return ip_fd;
 410 }
 411 #endif
 412
 413 static int os_setup_tun(struct openconnect_info *vpninfo)
 414 {
 415         int tun_fd;
 416
 417 #ifdef IFF_TUN /* Linux */
 418         struct ifreq ifr;
 419         int tunerr;
 420
 421         tun_fd = open("/dev/net/tun", O_RDWR);
 422         if (tun_fd < 0) {
 423                 /* Android has /dev/tun instead of /dev/net/tun
 424                    Since other systems might have too, just try it
 425                    as a fallback instead of using ifdef __ANDROID__ */
 426                 tunerr = errno;
 427                 tun_fd = open("/dev/tun", O_RDWR);
 428         }
 429         if (tun_fd < 0) {
 430                 /* If the error on /dev/tun is ENOENT, that's boring.
 431                    Use the error we got on /dev/net/tun instead */
 432                 if (errno != -ENOENT)
 433                         tunerr = errno;
 434
 435                 vpn_progress(vpninfo, PRG_ERR,
 436                              _("Failed to open tun device: %s\n"),
 437                              strerror(tunerr));
 438                 exit(1);
 439         }
 440         memset(&ifr, 0, sizeof(ifr));
 441         ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 442         if (vpninfo->ifname)
 443                 strncpy(ifr.ifr_name, vpninfo->ifname,
 444                         sizeof(ifr.ifr_name) - 1);
 445         if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 446                 vpn_progress(vpninfo, PRG_ERR,
 447                              _("TUNSETIFF failed: %s\n"),
 448                              strerror(errno));
 449                 exit(1);
 450         }
 451         if (!vpninfo->ifname)
 452                 vpninfo->ifname = strdup(ifr.ifr_name);
 453 #elif defined (__sun__)
 454         static char tun_name[80];
 455         int unit_nr;
 456
 457         tun_fd = open("/dev/tun", O_RDWR);
 458         if (tun_fd < 0) {
 459                 perror(_("open /dev/tun"));
 460                 return -EIO;
 461         }
 462
 463         unit_nr = ioctl(tun_fd, TUNNEWPPA, -1);
 464         if (unit_nr < 0) {
 465                 perror(_("Failed to create new tun"));
 466                 close(tun_fd);
 467                 return -EIO;
 468         }
 469
 470         if (ioctl(tun_fd, I_SRDOPT, RMSGD) < 0) {
 471                 perror(_("Failed to put tun file descriptor into message-discard mode"));
 472                 close(tun_fd);
 473                 return -EIO;
 474         }
 475
 476         sprintf(tun_name, "tun%d", unit_nr);
 477         vpninfo->ifname = strdup(tun_name);
 478
 479         vpninfo->ip_fd = link_proto(unit_nr, "/dev/udp", IFF_IPV4);
 480         if (vpninfo->ip_fd < 0) {
 481                 close(tun_fd);
 482                 return -EIO;
 483         }
 484
 485         if (vpninfo->vpn_addr6) {
 486                 vpninfo->ip6_fd = link_proto(unit_nr, "/dev/udp6", IFF_IPV6);
 487                 if (vpninfo->ip6_fd < 0) {
 488                         close(tun_fd);
 489                         close(vpninfo->ip_fd);
 490                         vpninfo->ip_fd = -1;
 491                         return -EIO;
 492                 }
 493         } else
 494                 vpninfo->ip6_fd = -1;
 495
 496 #else /* BSD et al have /dev/tun$x devices */
 497         static char tun_name[80];
 498         int i;
 499         for (i = 0; i < 255; i++) {
 500                 sprintf(tun_name, "/dev/tun%d", i);
 501                 tun_fd = open(tun_name, O_RDWR);
 502                 if (tun_fd >= 0)
 503                         break;
 504         }
 505         if (tun_fd < 0) {
 506                 perror(_("open tun"));
 507                 exit(1);
 508         }
 509         vpninfo->ifname = strdup(tun_name + 5);
 510 #ifdef TUNSIFHEAD
 511         i = 1;
 512         if (ioctl(tun_fd, TUNSIFHEAD, &i) < 0) {
 513                 perror(_("TUNSIFHEAD"));
 514                 exit(1);
 515         }
 516 #endif
 517 #endif
 518         return tun_fd;
 519 }
 520
 521 /* Set up a tuntap device. */
 522 int setup_tun(struct openconnect_info *vpninfo)
 523 {
 524         int tun_fd;
 525
 526         set_script_env(vpninfo);
 527
 528         if (vpninfo->script_tun) {
 529                 pid_t child;
 530                 int fds[2];
 531
 532                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 533                         perror(_("socketpair"));
 534                         exit(1);
 535                 }
 536                 tun_fd = fds[0];
 537                 child = fork();
 538                 if (child < 0) {
 539                         perror(_("fork"));
 540                         exit(1);
 541                 } else if (!child) {
 542                         close(tun_fd);
 543                         setenv_int("VPNFD", fds[1]);
 544                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 545                         perror(_("execl"));
 546                         exit(1);
 547                 }
 548                 close(fds[1]);
 549                 vpninfo->script_tun = child;
 550                 vpninfo->ifname = strdup(_("(script)"));
 551         } else {
 552                 script_config_tun(vpninfo, "pre-init");
 553
 554                 tun_fd = os_setup_tun(vpninfo);
 555                 if (tun_fd < 0)
 556                         return tun_fd;
 557
 558                 setenv("TUNDEV", vpninfo->ifname, 1);
 559                 script_config_tun(vpninfo, "connect");
 560
 561                 /* Ancient vpnc-scripts might not get this right */
 562                 set_tun_mtu(vpninfo);
 563         }
 564
 565         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 566
 567         vpninfo->tun_fd = tun_fd;
 568
 569         if (vpninfo->select_nfds <= tun_fd)
 570                 vpninfo->select_nfds = tun_fd + 1;
 571
 572         FD_SET(tun_fd, &vpninfo->select_rfds);
 573
 574         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 575
 576         return 0;
 577 }
 578
 579 static struct pkt *out_pkt;
 580
 581 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 582 {
 583         int work_done = 0;
 584         int prefix_size = 0;
 585
 586 #ifdef TUN_HAS_AF_PREFIX
 587         if (!vpninfo->script_tun)
 588                 prefix_size = sizeof(int);
 589 #endif
 590
 591         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 592                 while (1) {
 593                         int len = vpninfo->mtu;
 594
 595                         if (!out_pkt) {
 596                                 out_pkt = malloc(sizeof(struct pkt) + len);
 597                                 if (!out_pkt) {
 598                                         vpn_progress(vpninfo, PRG_ERR, "Allocation failed\n");
 599                                         break;
 600                                 }
 601                         }
 602
 603                         len = read(vpninfo->tun_fd, out_pkt->data - prefix_size, len + prefix_size);
 604                         if (len <= prefix_size)
 605                                 break;
 606                         out_pkt->len = len - prefix_size;
 607
 608                         queue_packet(&vpninfo->outgoing_queue, out_pkt);
 609                         out_pkt = NULL;
 610
 611                         work_done = 1;
 612                         vpninfo->outgoing_qlen++;
 613                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 614                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 615                                 break;
 616                         }
 617                 }
 618         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 619                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 620         }
 621
 622         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 623            we could handle that and retry... but it doesn't let us poll() for
 624            the no-longer-full situation, so let's not bother. */
 625         while (vpninfo->incoming_queue) {
 626                 struct pkt *this = vpninfo->incoming_queue;
 627                 unsigned char *data = this->data;
 628                 int len = this->len;
 629
 630 #ifdef TUN_HAS_AF_PREFIX
 631                 if (!vpninfo->script_tun) {
 632                         struct ip *iph = (void *)data;
 633                         int type;
 634
 635                         if (iph->ip_v == 6)
 636                                 type = AF_INET6;
 637                         else if (iph->ip_v == 4)
 638                                 type = AF_INET;
 639                         else {
 640                                 static int complained = 0;
 641                                 if (!complained) {
 642                                         complained = 1;
 643                                         vpn_progress(vpninfo, PRG_ERR,
 644                                                      _("Unknown packet (len %d) received: %02x %02x %02x %02x...\n"),
 645                                                      len, data[0], data[1], data[2], data[3]);
 646                                 }
 647                                 free(this);
 648                                 continue;
 649                         }
 650                         data -= 4;
 651                         len += 4;
 652                         *(int *)data = htonl(type);
 653                 }
 654 #endif
 655                 vpninfo->incoming_queue = this->next;
 656
 657                 if (write(vpninfo->tun_fd, data, len) < 0) {
 658                         /* Handle death of "script" socket */
 659                         if (vpninfo->script_tun && errno == ENOTCONN) {
 660                                 vpninfo->quit_reason = "Client connection terminated";
 661                                 return 1;
 662                         }
 663                         vpn_progress(vpninfo, PRG_ERR,
 664                                      _("Failed to write incoming packet: %s\n"),
 665                                      strerror(errno));
 666                 }
 667                 free(this);
 668         }
 669         /* Work is not done if we just got rid of packets off the queue */
 670         return work_done;
 671 }
 672
 673 void shutdown_tun(struct openconnect_info *vpninfo)
 674 {
 675         if (vpninfo->script_tun) {
 676                 kill(vpninfo->script_tun, SIGHUP);
 677         } else {
 678                 script_config_tun(vpninfo, "disconnect");
 679 #ifdef __sun__
 680                 close(vpninfo->ip_fd);
 681                 vpninfo->ip_fd = -1;
 682                 if (vpninfo->ip6_fd != -1) {
 683                         close(vpninfo->ip6_fd);
 684                         vpninfo->ip6_fd = -1;
 685                 }
 686 #endif
 687         }
 688
 689         close(vpninfo->tun_fd);
 690         vpninfo->tun_fd = -1;
 691 }