tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008-2010 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #include <signal.h>
  31 #include <fcntl.h>
  32 #include <unistd.h>
  33 #include <netdb.h>
  34 #include <netinet/in_systm.h>
  35 #include <netinet/in.h>
  36 #include <netinet/ip.h>
  37 #include <net/if.h>
  38 #include <arpa/inet.h>
  39 #include <errno.h>
  40 #include <ctype.h>
  41 #if defined(__sun__)
  42 #include <stropts.h>
  43 #include <sys/sockio.h>
  44 #include <net/if_tun.h>
  45 #ifndef TUNNEWPPA
  46 #error "Install TAP driver from http://www.whiteboard.ne.jp/~admin2/tuntap/"
  47 #endif
  48 #endif
  49
  50 #include "openconnect-internal.h"
  51
  52 /*
  53  * If an if_tun.h include file was found anywhere (by the Makefile), it's
  54  * included. Else, we end up assuming that we have BSD-style devices such
  55  * as /dev/tun0 etc.
  56  */
  57 #ifdef IF_TUN_HDR
  58 #include IF_TUN_HDR
  59 #endif
  60
  61 /*
  62  * The OS X tun/tap driver doesn't provide a header file; you're expected
  63  * to define this for yourself.
  64  */
  65 #ifdef __APPLE__
  66 #define TUNSIFHEAD  _IOW('t', 96, int)
  67 #endif
  68
  69 /*
  70  * OpenBSD always puts the protocol family prefix onto packets. Other
  71  * systems let us enable that with the TUNSIFHEAD ioctl, and some of them
  72  * (e.g. FreeBSD) _need_ it otherwise they'll interpret IPv6 packets as IPv4.
  73  */
  74 #if defined(__OpenBSD__) || defined(TUNSIFHEAD)
  75 #define TUN_HAS_AF_PREFIX 1
  76 #endif
  77
  78 static int set_tun_mtu(struct openconnect_info *vpninfo)
  79 {
  80 #ifndef __sun__ /* We don't know how to do this on Solaris */
  81         struct ifreq ifr;
  82         int net_fd;
  83
  84         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  85         if (net_fd < 0) {
  86                 perror(_("open net"));
  87                 return -EINVAL;
  88         }
  89
  90         memset(&ifr, 0, sizeof(ifr));
  91         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  92         ifr.ifr_mtu = vpninfo->mtu;
  93
  94         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  95                 perror(_("SIOCSIFMTU"));
  96
  97         close(net_fd);
  98 #endif
  99         return 0;
 100 }
 101
 102
 103 static int setenv_int(const char *opt, int value)
 104 {
 105         char buf[16];
 106         sprintf(buf, "%d", value);
 107         return setenv(opt, buf, 1);
 108 }
 109
 110 static int netmasklen(struct in_addr addr)
 111 {
 112         int masklen;
 113
 114         for (masklen = 0; masklen < 32; masklen++) {
 115                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 116                         break;
 117         }
 118         return 32 - masklen;
 119 }
 120
 121 static int process_split_xxclude(struct openconnect_info *vpninfo,
 122                                  int include, const char *route, int *v4_incs,
 123                                  int *v6_incs)
 124 {
 125         struct in_addr addr;
 126         const char *in_ex = include?"IN":"EX";
 127         char envname[80];
 128         char *slash;
 129
 130         slash = strchr(route, '/');
 131         if (!slash) {
 132         badinc:
 133                 if (include)
 134                         vpn_progress(vpninfo, PRG_ERR,
 135                                      _("Discard bad split include: \"%s\"\n"),
 136                                      route);
 137                 else
 138                         vpn_progress(vpninfo, PRG_ERR,
 139                                      _("Discard bad split exclude: \"%s\"\n"),
 140                                      route);
 141                 return -EINVAL;
 142         }
 143
 144         *slash = 0;
 145
 146         if (strchr(route, ':')) {
 147                 snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_ADDR", in_ex,
 148                          *v6_incs);
 149                 setenv(envname, route, 1);
 150
 151                 snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_MASKLEN", in_ex,
 152                          *v6_incs);
 153                 setenv(envname, slash+1, 1);
 154
 155                 (*v6_incs)++;
 156                 return 0;
 157         }
 158
 159         if (!inet_aton(route, &addr)) {
 160                 *slash = '/';
 161                 goto badinc;
 162         }
 163
 164         envname[79] = 0;
 165         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *v4_incs);
 166         setenv(envname, route, 1);
 167
 168         /* Put it back how we found it */
 169         *slash = '/';
 170
 171         if (!inet_aton(slash+1, &addr))
 172                 goto badinc;
 173
 174         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *v4_incs);
 175         setenv(envname, slash+1, 1);
 176
 177         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *v4_incs);
 178         setenv_int(envname, netmasklen(addr));
 179
 180         (*v4_incs)++;
 181         return 0;
 182 }
 183
 184 static int appendenv(const char *opt, const char *new)
 185 {
 186         char buf[1024];
 187         char *old = getenv(opt);
 188
 189         buf[1023] = 0;
 190         if (old)
 191                 snprintf(buf, 1023, "%s %s", old, new);
 192         else
 193                 snprintf(buf, 1023, "%s", new);
 194
 195         return setenv(opt, buf, 1);
 196 }
 197
 198 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 199 {
 200         char *env_buf;
 201         int buflen = 0;
 202         int bufofs = 0;
 203         struct vpn_option *opt;
 204
 205         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 206                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 207
 208         env_buf = malloc(buflen + 1);
 209         if (!env_buf)
 210                 return;
 211
 212         env_buf[buflen] = 0;
 213
 214         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 215                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 216                                    "%s=%s\n", opt->option, opt->value);
 217
 218         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 219         free(env_buf);
 220 }
 221
 222 static void set_banner(struct openconnect_info *vpninfo)
 223 {
 224         char *banner, *q;
 225         const char *p;
 226
 227         if (!vpninfo->banner || !(banner = malloc(strlen(vpninfo->banner)))) {
 228                 unsetenv("CISCO_BANNER");
 229                 return;
 230         }
 231         p = vpninfo->banner;
 232         q = banner;
 233
 234         while (*p) {
 235                 if (*p == '%' && isxdigit((int)(unsigned char)p[1]) &&
 236                     isxdigit((int)(unsigned char)p[2])) {
 237                         *(q++) = unhex(p + 1);
 238                         p += 3;
 239                 } else
 240                         *(q++) = *(p++);
 241         }
 242         *q = 0;
 243         setenv("CISCO_BANNER", banner, 1);
 244
 245         free(banner);
 246 }
 247
 248 static void set_script_env(struct openconnect_info *vpninfo)
 249 {
 250         char host[80];
 251         int ret = getnameinfo(vpninfo->peer_addr, vpninfo->peer_addrlen, host,
 252                               sizeof(host), NULL, 0, NI_NUMERICHOST);
 253         if (!ret)
 254                 setenv("VPNGATEWAY", host, 1);
 255
 256         set_banner(vpninfo);
 257         unsetenv("CISCO_SPLIT_INC");
 258         unsetenv("CISCO_SPLIT_EXC");
 259
 260         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 261
 262         if (vpninfo->vpn_addr) {
 263                 setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 264                 if (vpninfo->vpn_netmask) {
 265                         struct in_addr addr;
 266                         struct in_addr mask;
 267
 268                         if (inet_aton(vpninfo->vpn_addr, &addr) &&
 269                             inet_aton(vpninfo->vpn_netmask, &mask)) {
 270                                 char *netaddr;
 271
 272                                 addr.s_addr &= mask.s_addr;
 273                                 netaddr = inet_ntoa(addr);
 274
 275                                 setenv("INTERNAL_IP4_NETADDR", netaddr, 1);
 276                                 setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 277                                 setenv_int("INTERNAL_IP4_NETMASKLEN", netmasklen(mask));
 278                         }
 279                 }
 280         }
 281         if (vpninfo->vpn_addr6) {
 282                 setenv("INTERNAL_IP6_ADDRESS", vpninfo->vpn_addr6, 1);
 283                 setenv("INTERNAL_IP6_NETMASK", vpninfo->vpn_netmask6, 1);
 284         }
 285
 286         if (vpninfo->vpn_dns[0])
 287                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 288         else
 289                 unsetenv("INTERNAL_IP4_DNS");
 290         if (vpninfo->vpn_dns[1])
 291                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 292         if (vpninfo->vpn_dns[2])
 293                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 294
 295         if (vpninfo->vpn_nbns[0])
 296                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 297         else
 298                 unsetenv("INTERNAL_IP4_NBNS");
 299         if (vpninfo->vpn_nbns[1])
 300                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 301         if (vpninfo->vpn_nbns[2])
 302                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 303
 304         if (vpninfo->vpn_domain)
 305                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 306         else unsetenv ("CISCO_DEF_DOMAIN");
 307
 308         if (vpninfo->vpn_proxy_pac)
 309                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 310
 311         if (vpninfo->split_includes) {
 312                 struct split_include *this = vpninfo->split_includes;
 313                 int nr_split_includes = 0;
 314                 int nr_v6_split_includes = 0;
 315
 316                 while (this) {
 317                         process_split_xxclude(vpninfo, 1, this->route,
 318                                               &nr_split_includes,
 319                                               &nr_v6_split_includes);
 320                         this = this->next;
 321                 }
 322                 if (nr_split_includes)
 323                         setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 324                 if (nr_v6_split_includes)
 325                         setenv_int("CISCO_IPV6_SPLIT_INC", nr_v6_split_includes);
 326         }
 327         if (vpninfo->split_excludes) {
 328                 struct split_include *this = vpninfo->split_excludes;
 329                 int nr_split_excludes = 0;
 330                 int nr_v6_split_excludes = 0;
 331
 332                 while (this) {
 333                         process_split_xxclude(vpninfo, 0, this->route,
 334                                               &nr_split_excludes,
 335                                               &nr_v6_split_excludes);
 336                         this = this->next;
 337                 }
 338                 if (nr_split_excludes)
 339                         setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 340                 if (nr_v6_split_excludes)
 341                         setenv_int("CISCO_IPV6_SPLIT_EXC", nr_v6_split_excludes);
 342         }
 343         setenv_cstp_opts(vpninfo);
 344 }
 345
 346 int script_config_tun(struct openconnect_info *vpninfo, const char *reason)
 347 {
 348         if (!vpninfo->vpnc_script)
 349                 return 0;
 350
 351         setenv("reason", reason, 1);
 352         if (system(vpninfo->vpnc_script)) {
 353                 int e = errno;
 354                 vpn_progress(vpninfo, PRG_ERR,
 355                              _("Failed to spawn script '%s' for %s: %s\n"),
 356                              vpninfo->vpnc_script, reason, strerror(e));
 357                 return -e;
 358         }
 359         return 0;
 360 }
 361
 362 #ifdef __sun__
 363 static int link_proto(int unit_nr, const char *devname, uint64_t flags)
 364 {
 365         int ip_fd, mux_id, tun2_fd;
 366         struct lifreq ifr;
 367
 368         tun2_fd = open("/dev/tun", O_RDWR);
 369         if (tun2_fd < 0) {
 370                 perror(_("Could not /dev/tun for plumbing"));
 371                 return -EIO;
 372         }
 373         if (ioctl(tun2_fd, I_PUSH, "ip") < 0) {
 374                 perror(_("Can't push IP"));
 375                 close(tun2_fd);
 376                 return -EIO;
 377         }
 378
 379         sprintf(ifr.lifr_name, "tun%d", unit_nr);
 380         ifr.lifr_ppa = unit_nr;
 381         ifr.lifr_flags = flags;
 382
 383         if (ioctl(tun2_fd, SIOCSLIFNAME, &ifr) < 0) {
 384                 perror(_("Can't set ifname"));
 385                 close(tun2_fd);
 386                 return -1;
 387         }
 388
 389         ip_fd = open(devname, O_RDWR);
 390         if (ip_fd < 0) {
 391                 fprintf(stderr, _("Can't open %s: %s"), devname,
 392                         strerror(errno));
 393                 close(tun2_fd);
 394                 return -1;
 395         }
 396         if (ioctl(ip_fd, I_PUSH, "arp") < 0) {
 397                 perror(_("Can't push ARP"));
 398                 close(tun2_fd);
 399                 close(ip_fd);
 400                 return -1;
 401         }
 402
 403         mux_id = ioctl(ip_fd, I_LINK, tun2_fd);
 404         if (mux_id < 0) {
 405                 fprintf(stderr, _("Can't plumb %s for IPv%d: %s\n"),
 406                          ifr.lifr_name, (flags == IFF_IPV4) ? 4 : 6,
 407                          strerror(errno));
 408                 close(tun2_fd);
 409                 close(ip_fd);
 410                 return -1;
 411         }
 412
 413         close(tun2_fd);
 414
 415         return ip_fd;
 416 }
 417 #endif
 418
 419 static int os_setup_tun(struct openconnect_info *vpninfo)
 420 {
 421         int tun_fd;
 422
 423 #ifdef IFF_TUN /* Linux */
 424         struct ifreq ifr;
 425         int tunerr;
 426
 427         tun_fd = open("/dev/net/tun", O_RDWR);
 428         if (tun_fd < 0) {
 429                 /* Android has /dev/tun instead of /dev/net/tun
 430                    Since other systems might have too, just try it
 431                    as a fallback instead of using ifdef __ANDROID__ */
 432                 tunerr = errno;
 433                 tun_fd = open("/dev/tun", O_RDWR);
 434         }
 435         if (tun_fd < 0) {
 436                 /* If the error on /dev/tun is ENOENT, that's boring.
 437                    Use the error we got on /dev/net/tun instead */
 438                 if (errno != -ENOENT)
 439                         tunerr = errno;
 440
 441                 vpn_progress(vpninfo, PRG_ERR,
 442                              _("Failed to open tun device: %s\n"),
 443                              strerror(tunerr));
 444                 exit(1);
 445         }
 446         memset(&ifr, 0, sizeof(ifr));
 447         ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 448         if (vpninfo->ifname)
 449                 strncpy(ifr.ifr_name, vpninfo->ifname,
 450                         sizeof(ifr.ifr_name) - 1);
 451         if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 452                 vpn_progress(vpninfo, PRG_ERR,
 453                              _("TUNSETIFF failed: %s\n"),
 454                              strerror(errno));
 455                 exit(1);
 456         }
 457         if (!vpninfo->ifname)
 458                 vpninfo->ifname = strdup(ifr.ifr_name);
 459 #elif defined (__sun__)
 460         static char tun_name[80];
 461         int unit_nr;
 462
 463         tun_fd = open("/dev/tun", O_RDWR);
 464         if (tun_fd < 0) {
 465                 perror(_("open /dev/tun"));
 466                 return -EIO;
 467         }
 468
 469         unit_nr = ioctl(tun_fd, TUNNEWPPA, -1);
 470         if (unit_nr < 0) {
 471                 perror(_("Failed to create new tun"));
 472                 close(tun_fd);
 473                 return -EIO;
 474         }
 475
 476         if (ioctl(tun_fd, I_SRDOPT, RMSGD) < 0) {
 477                 perror(_("Failed to put tun file descriptor into message-discard mode"));
 478                 close(tun_fd);
 479                 return -EIO;
 480         }
 481
 482         sprintf(tun_name, "tun%d", unit_nr);
 483         vpninfo->ifname = strdup(tun_name);
 484
 485         vpninfo->ip_fd = link_proto(unit_nr, "/dev/udp", IFF_IPV4);
 486         if (vpninfo->ip_fd < 0) {
 487                 close(tun_fd);
 488                 return -EIO;
 489         }
 490
 491         if (vpninfo->vpn_addr6) {
 492                 vpninfo->ip6_fd = link_proto(unit_nr, "/dev/udp6", IFF_IPV6);
 493                 if (vpninfo->ip6_fd < 0) {
 494                         close(tun_fd);
 495                         close(vpninfo->ip_fd);
 496                         vpninfo->ip_fd = -1;
 497                         return -EIO;
 498                 }
 499         } else
 500                 vpninfo->ip6_fd = -1;
 501
 502 #else /* BSD et al have /dev/tun$x devices */
 503         static char tun_name[80];
 504         int i;
 505         for (i = 0; i < 255; i++) {
 506                 sprintf(tun_name, "/dev/tun%d", i);
 507                 tun_fd = open(tun_name, O_RDWR);
 508                 if (tun_fd >= 0)
 509                         break;
 510         }
 511         if (tun_fd < 0) {
 512                 perror(_("open tun"));
 513                 exit(1);
 514         }
 515         vpninfo->ifname = strdup(tun_name + 5);
 516 #ifdef TUNSIFHEAD
 517         i = 1;
 518         if (ioctl(tun_fd, TUNSIFHEAD, &i) < 0) {
 519                 perror(_("TUNSIFHEAD"));
 520                 exit(1);
 521         }
 522 #endif
 523 #endif
 524         return tun_fd;
 525 }
 526
 527 /* Set up a tuntap device. */
 528 int setup_tun(struct openconnect_info *vpninfo)
 529 {
 530         int tun_fd;
 531
 532         set_script_env(vpninfo);
 533
 534         if (vpninfo->script_tun) {
 535                 pid_t child;
 536                 int fds[2];
 537
 538                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 539                         perror(_("socketpair"));
 540                         exit(1);
 541                 }
 542                 tun_fd = fds[0];
 543                 child = fork();
 544                 if (child < 0) {
 545                         perror(_("fork"));
 546                         exit(1);
 547                 } else if (!child) {
 548                         close(tun_fd);
 549                         setenv_int("VPNFD", fds[1]);
 550                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 551                         perror(_("execl"));
 552                         exit(1);
 553                 }
 554                 close(fds[1]);
 555                 vpninfo->script_tun = child;
 556                 vpninfo->ifname = strdup(_("(script)"));
 557         } else {
 558                 script_config_tun(vpninfo, "pre-init");
 559
 560                 tun_fd = os_setup_tun(vpninfo);
 561                 if (tun_fd < 0)
 562                         return tun_fd;
 563
 564                 setenv("TUNDEV", vpninfo->ifname, 1);
 565                 script_config_tun(vpninfo, "connect");
 566
 567                 /* Ancient vpnc-scripts might not get this right */
 568                 set_tun_mtu(vpninfo);
 569         }
 570
 571         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 572
 573         vpninfo->tun_fd = tun_fd;
 574
 575         if (vpninfo->select_nfds <= tun_fd)
 576                 vpninfo->select_nfds = tun_fd + 1;
 577
 578         FD_SET(tun_fd, &vpninfo->select_rfds);
 579
 580         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 581
 582         return 0;
 583 }
 584
 585 static struct pkt *out_pkt;
 586
 587 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 588 {
 589         int work_done = 0;
 590         int prefix_size = 0;
 591
 592 #ifdef TUN_HAS_AF_PREFIX
 593         if (!vpninfo->script_tun)
 594                 prefix_size = sizeof(int);
 595 #endif
 596
 597         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 598                 while (1) {
 599                         int len = vpninfo->mtu;
 600
 601                         if (!out_pkt) {
 602                                 out_pkt = malloc(sizeof(struct pkt) + len);
 603                                 if (!out_pkt) {
 604                                         vpn_progress(vpninfo, PRG_ERR, "Allocation failed\n");
 605                                         break;
 606                                 }
 607                         }
 608
 609                         len = read(vpninfo->tun_fd, out_pkt->data - prefix_size, len + prefix_size);
 610                         if (len <= prefix_size)
 611                                 break;
 612                         out_pkt->len = len - prefix_size;
 613
 614                         queue_packet(&vpninfo->outgoing_queue, out_pkt);
 615                         out_pkt = NULL;
 616
 617                         work_done = 1;
 618                         vpninfo->outgoing_qlen++;
 619                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 620                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 621                                 break;
 622                         }
 623                 }
 624         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 625                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 626         }
 627
 628         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 629            we could handle that and retry... but it doesn't let us poll() for
 630            the no-longer-full situation, so let's not bother. */
 631         while (vpninfo->incoming_queue) {
 632                 struct pkt *this = vpninfo->incoming_queue;
 633                 unsigned char *data = this->data;
 634                 int len = this->len;
 635
 636 #ifdef TUN_HAS_AF_PREFIX
 637                 if (!vpninfo->script_tun) {
 638                         struct ip *iph = (void *)data;
 639                         int type;
 640
 641                         if (iph->ip_v == 6)
 642                                 type = AF_INET6;
 643                         else if (iph->ip_v == 4)
 644                                 type = AF_INET;
 645                         else {
 646                                 static int complained = 0;
 647                                 if (!complained) {
 648                                         complained = 1;
 649                                         vpn_progress(vpninfo, PRG_ERR,
 650                                                      _("Unknown packet (len %d) received: %02x %02x %02x %02x...\n"),
 651                                                      len, data[0], data[1], data[2], data[3]);
 652                                 }
 653                                 free(this);
 654                                 continue;
 655                         }
 656                         data -= 4;
 657                         len += 4;
 658                         *(int *)data = htonl(type);
 659                 }
 660 #endif
 661                 vpninfo->incoming_queue = this->next;
 662
 663                 if (write(vpninfo->tun_fd, data, len) < 0) {
 664                         /* Handle death of "script" socket */
 665                         if (vpninfo->script_tun && errno == ENOTCONN) {
 666                                 vpninfo->quit_reason = "Client connection terminated";
 667                                 return 1;
 668                         }
 669                         vpn_progress(vpninfo, PRG_ERR,
 670                                      _("Failed to write incoming packet: %s\n"),
 671                                      strerror(errno));
 672                 }
 673                 free(this);
 674         }
 675         /* Work is not done if we just got rid of packets off the queue */
 676         return work_done;
 677 }
 678
 679 void shutdown_tun(struct openconnect_info *vpninfo)
 680 {
 681         if (vpninfo->script_tun) {
 682                 kill(vpninfo->script_tun, SIGHUP);
 683         } else {
 684                 script_config_tun(vpninfo, "disconnect");
 685 #ifdef __sun__
 686                 close(vpninfo->ip_fd);
 687                 vpninfo->ip_fd = -1;
 688                 if (vpninfo->ip6_fd != -1) {
 689                         close(vpninfo->ip6_fd);
 690                         vpninfo->ip6_fd = -1;
 691                 }
 692 #endif
 693         }
 694
 695         close(vpninfo->tun_fd);
 696         vpninfo->tun_fd = -1;
 697 }