tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <sys/ioctl.h>
  28 #ifdef __linux__
  29 #include <linux/if_tun.h>
  30 #endif
  31 #include <sys/types.h>
  32 #include <sys/stat.h>
  33 #include <fcntl.h>
  34 #include <unistd.h>
  35 #include <netinet/in.h>
  36 #include <net/if.h>
  37 #include <arpa/inet.h>
  38 #include <errno.h>
  39
  40 #include "openconnect.h"
  41
  42 static int local_config_tun(struct openconnect_info *vpninfo, int mtu_only)
  43 {
  44         struct ifreq ifr;
  45         int net_fd;
  46
  47         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  48         if (net_fd < 0) {
  49                 perror("open net");
  50                 return -EINVAL;
  51         }
  52         memset(&ifr, 0, sizeof(ifr));
  53         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  54
  55         if (!mtu_only) {
  56                 struct sockaddr_in *addr = (struct sockaddr_in *) &ifr.ifr_addr;
  57
  58                 if (ioctl(net_fd, SIOCGIFFLAGS, &ifr) < 0)
  59                         perror("SIOCGIFFLAGS");
  60
  61                 ifr.ifr_flags |= IFF_UP | IFF_POINTOPOINT;
  62                 if (ioctl(net_fd, SIOCSIFFLAGS, &ifr) < 0)
  63                         perror("SIOCSIFFLAGS");
  64
  65                 addr->sin_family = AF_INET;
  66                 addr->sin_addr.s_addr = inet_addr(vpninfo->vpn_addr);
  67                 if (ioctl(net_fd, SIOCSIFADDR, &ifr) < 0)
  68                         perror("SIOCSIFADDR");
  69         }
  70
  71         ifr.ifr_mtu = vpninfo->mtu;
  72         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  73                 perror("SIOCSIFMTU");
  74
  75         close(net_fd);
  76
  77         return 0;
  78 }
  79
  80 static int setenv_int(const char *opt, int value)
  81 {
  82         char buf[16];
  83         sprintf(buf, "%d", value);
  84         return setenv(opt, buf, 1);
  85 }
  86
  87 static int process_split_xxclude(struct openconnect_info *vpninfo,
  88                                  char *in_ex, char *route, int *nr_incs)
  89 {
  90         struct in_addr addr;
  91         int masklen;
  92         char envname[80];
  93         char *slash;
  94
  95         slash = strchr(route, '/');
  96         if (!slash) {
  97         badinc:
  98                 vpninfo->progress(vpninfo, PRG_ERR,
  99                                   "Discard bad split %sclude: \"%s\"\n",
 100                                   in_ex, route);
 101                 return -EINVAL;
 102         }
 103
 104         *slash = 0;
 105         if (!inet_aton(route, &addr)) {
 106                 *slash = '/';
 107                 goto badinc;
 108         }
 109
 110         envname[79] = 0;
 111         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *nr_incs);
 112         setenv(envname, route, 1);
 113
 114         /* Put it back how we found it */
 115         *slash = '/';
 116
 117         if (!inet_aton(slash+1, &addr))
 118                 goto badinc;
 119
 120         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *nr_incs);
 121         setenv(envname, slash+1, 1);
 122
 123         for (masklen = 0; masklen < 32; masklen++) {
 124                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 125                         break;
 126         }
 127         masklen = 32 - masklen;
 128
 129         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *nr_incs);
 130         setenv_int(envname, masklen);
 131
 132         (*nr_incs)++;
 133         return 0;
 134 }
 135
 136 static int appendenv(const char *opt, const char *new)
 137 {
 138         char buf[1024];
 139         char *old = getenv(opt);
 140
 141         buf[1023] = 0;
 142         if (old)
 143                 snprintf(buf, 1023, "%s %s", old, new);
 144         else
 145                 snprintf(buf, 1023, "%s", new);
 146
 147         return setenv(opt, buf, 1);
 148 }
 149
 150 static void set_script_env(struct openconnect_info *vpninfo)
 151 {
 152         struct sockaddr_in *sin = (void *)vpninfo->peer_addr;
 153
 154         setenv("VPNGATEWAY", inet_ntoa(sin->sin_addr), 1);
 155         setenv("TUNDEV", vpninfo->ifname, 1);
 156         setenv("reason", "connect", 1);
 157         unsetenv("CISCO_BANNER");
 158         unsetenv("CISCO_SPLIT_INC");
 159         unsetenv("CISCO_SPLIT_EXC");
 160
 161         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 162
 163         setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 164         setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 165
 166         if (vpninfo->vpn_dns[0])
 167                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 168         else
 169                 unsetenv("INTERNAL_IP4_DNS");
 170         if (vpninfo->vpn_dns[1])
 171                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 172         if (vpninfo->vpn_dns[2])
 173                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 174
 175         if (vpninfo->vpn_nbns[0])
 176                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 177         else
 178                 unsetenv("INTERNAL_IP4_NBNS");
 179         if (vpninfo->vpn_nbns[1])
 180                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 181         if (vpninfo->vpn_nbns[2])
 182                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 183
 184         if (vpninfo->vpn_domain)
 185                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 186         else unsetenv ("CISCO_DEF_DOMAIN");
 187
 188         if (vpninfo->vpn_proxy_pac)
 189                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 190
 191         if (vpninfo->split_includes) {
 192                 struct split_include *this = vpninfo->split_includes;
 193                 int nr_split_includes = 0;
 194
 195                 while (this) {
 196                         process_split_xxclude(vpninfo, "IN", this->route,
 197                                               &nr_split_includes);
 198                         this = this->next;
 199                 }
 200                 setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 201         }
 202         if (vpninfo->split_excludes) {
 203                 struct split_include *this = vpninfo->split_excludes;
 204                 int nr_split_excludes = 0;
 205
 206                 while (this) {
 207                         process_split_xxclude(vpninfo, "EX", this->route,
 208                                               &nr_split_excludes);
 209                         this = this->next;
 210                 }
 211                 setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 212         }
 213 }
 214
 215 static int script_config_tun(struct openconnect_info *vpninfo)
 216 {
 217         if (vpninfo->peer_addr->sa_family != AF_INET) {
 218                 vpninfo->progress(vpninfo, PRG_ERR, "Script cannot handle anything but Legacy IP\n");
 219                 return -EINVAL;
 220         }
 221
 222         set_script_env(vpninfo);
 223
 224         system(vpninfo->vpnc_script);
 225         return 0;
 226 }
 227
 228
 229 /* Set up a tuntap device. */
 230 int setup_tun(struct openconnect_info *vpninfo)
 231 {
 232         struct ifreq ifr;
 233         int tun_fd;
 234
 235         if (vpninfo->script_tun) {
 236                 pid_t child;
 237                 int fds[2];
 238
 239                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 240                         perror("socketpair");
 241                         exit(1);
 242                 }
 243                 tun_fd = fds[0];
 244                 child = fork();
 245                 if (child < 0) {
 246                         perror("fork");
 247                         exit(1);
 248                 } else if (!child) {
 249                         close(tun_fd);
 250                         setenv_int("VPNFD", fds[1]);
 251                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 252                         perror("execl");
 253                         exit(1);
 254                 }
 255                 close(fds[1]);
 256                 vpninfo->script_tun = child;
 257                 vpninfo->ifname = "(script)";
 258         } else {
 259 #ifdef IFF_TUN /* Linux */
 260                 tun_fd = open("/dev/net/tun", O_RDWR);
 261                 if (tun_fd < 0) {
 262                         vpninfo->progress(vpninfo, PRG_ERR,
 263                                           "Failed to open tun device: %s\n",
 264                                           strerror(errno));
 265                         exit(1);
 266                 }
 267                 memset(&ifr, 0, sizeof(ifr));
 268                 ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 269                 if (vpninfo->ifname)
 270                         strncpy(ifr.ifr_name, vpninfo->ifname,
 271                                 sizeof(ifr.ifr_name) - 1);
 272                 if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 273                         vpninfo->progress(vpninfo, PRG_ERR,
 274                                           "TUNSETIFF failed: %s\n",
 275                                           strerror(errno));
 276                         exit(1);
 277                 }
 278                 if (!vpninfo->ifname)
 279                         vpninfo->ifname = strdup(ifr.ifr_name);
 280
 281 #else /* BSD et al have /dev/tun$x devices */
 282                 static char tun_name[80];
 283                 int i;
 284                 for (i = 0; i < 255; i++) {
 285                         sprintf(tun_name, "/dev/tun%d", i);
 286                         tun_fd = open(tun_name, O_RDWR);
 287                         if (tun_fd >= 0)
 288                                 break;
 289                 }
 290                 if (tun_fd < 0) {
 291                         perror("open tun");
 292                         exit(1);
 293                 }
 294                 vpninfo->ifname = tun_name + 5;
 295 #endif
 296                 if (vpninfo->vpnc_script) {
 297                         script_config_tun(vpninfo);
 298                         /* We have to set the MTU for ourselves, because the script doesn't */
 299                         local_config_tun(vpninfo, 1);
 300                 } else
 301                         local_config_tun(vpninfo, 0);
 302         }
 303
 304         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 305
 306         vpninfo->tun_fd = tun_fd;
 307
 308         if (vpninfo->select_nfds <= tun_fd)
 309                 vpninfo->select_nfds = tun_fd + 1;
 310
 311         FD_SET(tun_fd, &vpninfo->select_rfds);
 312
 313         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 314
 315         return 0;
 316 }
 317
 318 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 319 {
 320         char buf[2000];
 321         int len;
 322         int work_done = 0;
 323
 324         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 325                 while ((len = read(vpninfo->tun_fd, buf, sizeof(buf))) > 0) {
 326                         if (queue_new_packet(&vpninfo->outgoing_queue, AF_INET, buf, len))
 327                                 break;
 328
 329                         work_done = 1;
 330                         vpninfo->outgoing_qlen++;
 331                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 332                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 333                                 break;
 334                         }
 335                 }
 336         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 337                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 338         }
 339
 340         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 341            we could handle that and retry... but it doesn't let us poll() for
 342            the no-longer-full situation, so let's not bother. */
 343         while (vpninfo->incoming_queue) {
 344                 struct pkt *this = vpninfo->incoming_queue;
 345                 vpninfo->incoming_queue = this->next;
 346                 if (write(vpninfo->tun_fd, this->data, this->len) < 0 &&
 347                     errno == ENOTCONN) {
 348                         vpninfo->quit_reason = "Client connection terminated";
 349                         return 1;
 350                 }
 351                 free(this);
 352         }
 353         /* Work is not done if we just got rid of packets off the queue */
 354         return work_done;
 355 }