tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #include <signal.h>
  31 #ifdef __linux__
  32 #include <linux/if_tun.h>
  33 #endif
  34 #include <fcntl.h>
  35 #include <unistd.h>
  36 #include <netinet/in_systm.h>
  37 #include <netinet/in.h>
  38 #include <netinet/ip.h>
  39 #include <net/if.h>
  40 #include <arpa/inet.h>
  41 #include <errno.h>
  42
  43 #include "openconnect.h"
  44
  45 #ifdef __OpenBSD__
  46 #define TUN_HAS_AF_PREFIX 1
  47 #endif
  48
  49 static int local_config_tun(struct openconnect_info *vpninfo, int mtu_only)
  50 {
  51         struct ifreq ifr;
  52         int net_fd;
  53
  54         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  55         if (net_fd < 0) {
  56                 perror("open net");
  57                 return -EINVAL;
  58         }
  59         memset(&ifr, 0, sizeof(ifr));
  60         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  61
  62         if (!mtu_only) {
  63                 struct sockaddr_in addr;
  64
  65                 if (ioctl(net_fd, SIOCGIFFLAGS, &ifr) < 0)
  66                         perror("SIOCGIFFLAGS");
  67
  68                 ifr.ifr_flags |= IFF_UP | IFF_POINTOPOINT;
  69                 if (ioctl(net_fd, SIOCSIFFLAGS, &ifr) < 0)
  70                         perror("SIOCSIFFLAGS");
  71
  72                 addr.sin_family = AF_INET;
  73                 addr.sin_addr.s_addr = inet_addr(vpninfo->vpn_addr);
  74                 memcpy(&ifr.ifr_addr, &addr, sizeof(addr));
  75                 if (ioctl(net_fd, SIOCSIFADDR, &ifr) < 0)
  76                         perror("SIOCSIFADDR");
  77         }
  78
  79         ifr.ifr_mtu = vpninfo->mtu;
  80         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  81                 perror("SIOCSIFMTU");
  82
  83         close(net_fd);
  84
  85         return 0;
  86 }
  87
  88 static int setenv_int(const char *opt, int value)
  89 {
  90         char buf[16];
  91         sprintf(buf, "%d", value);
  92         return setenv(opt, buf, 1);
  93 }
  94
  95 static int process_split_xxclude(struct openconnect_info *vpninfo,
  96                                  char *in_ex, char *route, int *nr_incs)
  97 {
  98         struct in_addr addr;
  99         int masklen;
 100         char envname[80];
 101         char *slash;
 102
 103         slash = strchr(route, '/');
 104         if (!slash) {
 105         badinc:
 106                 vpninfo->progress(vpninfo, PRG_ERR,
 107                                   "Discard bad split %sclude: \"%s\"\n",
 108                                   in_ex, route);
 109                 return -EINVAL;
 110         }
 111
 112         *slash = 0;
 113         if (!inet_aton(route, &addr)) {
 114                 *slash = '/';
 115                 goto badinc;
 116         }
 117
 118         envname[79] = 0;
 119         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *nr_incs);
 120         setenv(envname, route, 1);
 121
 122         /* Put it back how we found it */
 123         *slash = '/';
 124
 125         if (!inet_aton(slash+1, &addr))
 126                 goto badinc;
 127
 128         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *nr_incs);
 129         setenv(envname, slash+1, 1);
 130
 131         for (masklen = 0; masklen < 32; masklen++) {
 132                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 133                         break;
 134         }
 135         masklen = 32 - masklen;
 136
 137         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *nr_incs);
 138         setenv_int(envname, masklen);
 139
 140         (*nr_incs)++;
 141         return 0;
 142 }
 143
 144 static int appendenv(const char *opt, const char *new)
 145 {
 146         char buf[1024];
 147         char *old = getenv(opt);
 148
 149         buf[1023] = 0;
 150         if (old)
 151                 snprintf(buf, 1023, "%s %s", old, new);
 152         else
 153                 snprintf(buf, 1023, "%s", new);
 154
 155         return setenv(opt, buf, 1);
 156 }
 157
 158 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 159 {
 160         char *env_buf;
 161         int buflen = 0;
 162         int bufofs = 0;
 163         struct vpn_option *opt;
 164
 165         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 166                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 167
 168         env_buf = malloc(buflen + 1);
 169         if (!env_buf)
 170                 return;
 171
 172         env_buf[buflen] = 0;
 173
 174         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 175                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 176                                    "%s=%s\n", opt->option, opt->value);
 177
 178         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 179         free(env_buf);
 180 }
 181
 182 static void set_script_env(struct openconnect_info *vpninfo)
 183 {
 184         struct sockaddr_in *sin = (void *)vpninfo->peer_addr;
 185
 186         setenv("VPNGATEWAY", inet_ntoa(sin->sin_addr), 1);
 187         setenv("TUNDEV", vpninfo->ifname, 1);
 188         setenv("reason", "connect", 1);
 189         unsetenv("CISCO_BANNER");
 190         unsetenv("CISCO_SPLIT_INC");
 191         unsetenv("CISCO_SPLIT_EXC");
 192
 193         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 194
 195         if (vpninfo->vpn_addr) {
 196                 setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 197                 setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 198         }
 199         if (vpninfo->vpn_addr6) {
 200                 setenv("INTERNAL_IP6_ADDRESS", vpninfo->vpn_addr6, 1);
 201                 setenv("INTERNAL_IP6_NETMASK", vpninfo->vpn_netmask6, 1);
 202         }
 203
 204         if (vpninfo->vpn_dns[0])
 205                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 206         else
 207                 unsetenv("INTERNAL_IP4_DNS");
 208         if (vpninfo->vpn_dns[1])
 209                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 210         if (vpninfo->vpn_dns[2])
 211                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 212
 213         if (vpninfo->vpn_nbns[0])
 214                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 215         else
 216                 unsetenv("INTERNAL_IP4_NBNS");
 217         if (vpninfo->vpn_nbns[1])
 218                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 219         if (vpninfo->vpn_nbns[2])
 220                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 221
 222         if (vpninfo->vpn_domain)
 223                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 224         else unsetenv ("CISCO_DEF_DOMAIN");
 225
 226         if (vpninfo->vpn_proxy_pac)
 227                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 228
 229         if (vpninfo->split_includes) {
 230                 struct split_include *this = vpninfo->split_includes;
 231                 int nr_split_includes = 0;
 232
 233                 while (this) {
 234                         process_split_xxclude(vpninfo, "IN", this->route,
 235                                               &nr_split_includes);
 236                         this = this->next;
 237                 }
 238                 setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 239         }
 240         if (vpninfo->split_excludes) {
 241                 struct split_include *this = vpninfo->split_excludes;
 242                 int nr_split_excludes = 0;
 243
 244                 while (this) {
 245                         process_split_xxclude(vpninfo, "EX", this->route,
 246                                               &nr_split_excludes);
 247                         this = this->next;
 248                 }
 249                 setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 250         }
 251         setenv_cstp_opts(vpninfo);
 252 }
 253
 254 static int script_config_tun(struct openconnect_info *vpninfo)
 255 {
 256         if (vpninfo->peer_addr->sa_family != AF_INET || !vpninfo->vpn_addr) {
 257                 vpninfo->progress(vpninfo, PRG_ERR,
 258                                   "Script can only handle Legacy IP\n");
 259                 return -EINVAL;
 260         }
 261
 262         set_script_env(vpninfo);
 263
 264         system(vpninfo->vpnc_script);
 265         return 0;
 266 }
 267
 268
 269 /* Set up a tuntap device. */
 270 int setup_tun(struct openconnect_info *vpninfo)
 271 {
 272         int tun_fd;
 273
 274         if (vpninfo->script_tun) {
 275                 pid_t child;
 276                 int fds[2];
 277
 278                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 279                         perror("socketpair");
 280                         exit(1);
 281                 }
 282                 tun_fd = fds[0];
 283                 child = fork();
 284                 if (child < 0) {
 285                         perror("fork");
 286                         exit(1);
 287                 } else if (!child) {
 288                         close(tun_fd);
 289                         setenv_int("VPNFD", fds[1]);
 290                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 291                         perror("execl");
 292                         exit(1);
 293                 }
 294                 close(fds[1]);
 295                 vpninfo->script_tun = child;
 296                 vpninfo->ifname = "(script)";
 297         } else {
 298 #ifdef IFF_TUN /* Linux */
 299                 struct ifreq ifr;
 300
 301                 tun_fd = open("/dev/net/tun", O_RDWR);
 302                 if (tun_fd < 0) {
 303                         vpninfo->progress(vpninfo, PRG_ERR,
 304                                           "Failed to open tun device: %s\n",
 305                                           strerror(errno));
 306                         exit(1);
 307                 }
 308                 memset(&ifr, 0, sizeof(ifr));
 309                 ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 310                 if (vpninfo->ifname)
 311                         strncpy(ifr.ifr_name, vpninfo->ifname,
 312                                 sizeof(ifr.ifr_name) - 1);
 313                 if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 314                         vpninfo->progress(vpninfo, PRG_ERR,
 315                                           "TUNSETIFF failed: %s\n",
 316                                           strerror(errno));
 317                         exit(1);
 318                 }
 319                 if (!vpninfo->ifname)
 320                         vpninfo->ifname = strdup(ifr.ifr_name);
 321
 322 #else /* BSD et al have /dev/tun$x devices */
 323                 static char tun_name[80];
 324                 int i;
 325                 for (i = 0; i < 255; i++) {
 326                         sprintf(tun_name, "/dev/tun%d", i);
 327                         tun_fd = open(tun_name, O_RDWR);
 328                         if (tun_fd >= 0)
 329                                 break;
 330                 }
 331                 if (tun_fd < 0) {
 332                         perror("open tun");
 333                         exit(1);
 334                 }
 335                 vpninfo->ifname = tun_name + 5;
 336 #endif
 337                 if (vpninfo->vpnc_script) {
 338                         script_config_tun(vpninfo);
 339                         /* We have to set the MTU for ourselves, because the script doesn't */
 340                         local_config_tun(vpninfo, 1);
 341                 } else
 342                         local_config_tun(vpninfo, 0);
 343         }
 344
 345         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 346
 347         vpninfo->tun_fd = tun_fd;
 348
 349         if (vpninfo->select_nfds <= tun_fd)
 350                 vpninfo->select_nfds = tun_fd + 1;
 351
 352         FD_SET(tun_fd, &vpninfo->select_rfds);
 353
 354         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 355
 356         return 0;
 357 }
 358
 359 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 360 {
 361         unsigned char buf[2000];
 362         int len;
 363         int work_done = 0;
 364
 365         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 366                 while ((len = read(vpninfo->tun_fd, buf, sizeof(buf))) > 0) {
 367                         unsigned char *pkt = buf;
 368 #ifdef TUN_HAS_AF_PREFIX
 369                         pkt += 4;
 370                         len -= 4;
 371 #endif
 372                         if (queue_new_packet(&vpninfo->outgoing_queue, pkt,
 373                                              len))
 374                                 break;
 375
 376                         work_done = 1;
 377                         vpninfo->outgoing_qlen++;
 378                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 379                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 380                                 break;
 381                         }
 382                 }
 383         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 384                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 385         }
 386
 387         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 388            we could handle that and retry... but it doesn't let us poll() for
 389            the no-longer-full situation, so let's not bother. */
 390         while (vpninfo->incoming_queue) {
 391                 struct pkt *this = vpninfo->incoming_queue;
 392                 unsigned char *data = this->data;
 393                 int len = this->len;
 394
 395 #ifdef TUN_HAS_AF_PREFIX
 396                 struct ip *iph = (void *)data;
 397                 int type;
 398
 399                 if (iph->ip_v == 6)
 400                         type = AF_INET6;
 401                 else if (iph->ip_v == 4)
 402                         type = AF_INET;
 403                 else {
 404                         static int complained = 0;
 405                         if (!complained) {
 406                                 complained = 1;
 407                                 vpninfo->progress(vpninfo, PRG_ERR,
 408                                                   "Unknown packet (len %d) received: %02x %02x %02x %02x...\n",
 409                                                   len, data[0], data[1], data[2], data[3]);
 410                         }
 411                         free(this);
 412                         continue;
 413                 }
 414                 data -= 4;
 415                 len += 4;
 416                 *(int *)data = htonl(type);
 417 #endif
 418                 vpninfo->incoming_queue = this->next;
 419
 420                 if (write(vpninfo->tun_fd, data, len) < 0 &&
 421                     errno == ENOTCONN) {
 422                         vpninfo->quit_reason = "Client connection terminated";
 423                         return 1;
 424                 }
 425                 free(this);
 426         }
 427         /* Work is not done if we just got rid of packets off the queue */
 428         return work_done;
 429 }
 430
 431 void shutdown_tun(struct openconnect_info *vpninfo)
 432 {
 433         if (vpninfo->script_tun) {
 434                 kill(vpninfo->script_tun, SIGHUP);
 435         } else if (vpninfo->vpnc_script) {
 436                 setenv("TUNDEV", vpninfo->ifname, 1);
 437                 setenv("reason", "disconnect", 1);
 438                 system(vpninfo->vpnc_script);
 439         }
 440
 441         close(vpninfo->tun_fd);
 442         vpninfo->tun_fd = -1;
 443 }