tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #ifdef __linux__
  31 #include <linux/if_tun.h>
  32 #endif
  33 #include <fcntl.h>
  34 #include <unistd.h>
  35 #include <netinet/in.h>
  36 #include <net/if.h>
  37 #include <arpa/inet.h>
  38 #include <errno.h>
  39
  40 #include "openconnect.h"
  41
  42 static int local_config_tun(struct openconnect_info *vpninfo, int mtu_only)
  43 {
  44         struct ifreq ifr;
  45         int net_fd;
  46
  47         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  48         if (net_fd < 0) {
  49                 perror("open net");
  50                 return -EINVAL;
  51         }
  52         memset(&ifr, 0, sizeof(ifr));
  53         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  54
  55         if (!mtu_only) {
  56                 struct sockaddr_in *addr = (struct sockaddr_in *) &ifr.ifr_addr;
  57
  58                 if (ioctl(net_fd, SIOCGIFFLAGS, &ifr) < 0)
  59                         perror("SIOCGIFFLAGS");
  60
  61                 ifr.ifr_flags |= IFF_UP | IFF_POINTOPOINT;
  62                 if (ioctl(net_fd, SIOCSIFFLAGS, &ifr) < 0)
  63                         perror("SIOCSIFFLAGS");
  64
  65                 addr->sin_family = AF_INET;
  66                 addr->sin_addr.s_addr = inet_addr(vpninfo->vpn_addr);
  67                 if (ioctl(net_fd, SIOCSIFADDR, &ifr) < 0)
  68                         perror("SIOCSIFADDR");
  69         }
  70
  71         ifr.ifr_mtu = vpninfo->mtu;
  72         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  73                 perror("SIOCSIFMTU");
  74
  75         close(net_fd);
  76
  77         return 0;
  78 }
  79
  80 static int setenv_int(const char *opt, int value)
  81 {
  82         char buf[16];
  83         sprintf(buf, "%d", value);
  84         return setenv(opt, buf, 1);
  85 }
  86
  87 static int process_split_xxclude(struct openconnect_info *vpninfo,
  88                                  char *in_ex, char *route, int *nr_incs)
  89 {
  90         struct in_addr addr;
  91         int masklen;
  92         char envname[80];
  93         char *slash;
  94
  95         slash = strchr(route, '/');
  96         if (!slash) {
  97         badinc:
  98                 vpninfo->progress(vpninfo, PRG_ERR,
  99                                   "Discard bad split %sclude: \"%s\"\n",
 100                                   in_ex, route);
 101                 return -EINVAL;
 102         }
 103
 104         *slash = 0;
 105         if (!inet_aton(route, &addr)) {
 106                 *slash = '/';
 107                 goto badinc;
 108         }
 109
 110         envname[79] = 0;
 111         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *nr_incs);
 112         setenv(envname, route, 1);
 113
 114         /* Put it back how we found it */
 115         *slash = '/';
 116
 117         if (!inet_aton(slash+1, &addr))
 118                 goto badinc;
 119
 120         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *nr_incs);
 121         setenv(envname, slash+1, 1);
 122
 123         for (masklen = 0; masklen < 32; masklen++) {
 124                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 125                         break;
 126         }
 127         masklen = 32 - masklen;
 128
 129         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *nr_incs);
 130         setenv_int(envname, masklen);
 131
 132         (*nr_incs)++;
 133         return 0;
 134 }
 135
 136 static int appendenv(const char *opt, const char *new)
 137 {
 138         char buf[1024];
 139         char *old = getenv(opt);
 140
 141         buf[1023] = 0;
 142         if (old)
 143                 snprintf(buf, 1023, "%s %s", old, new);
 144         else
 145                 snprintf(buf, 1023, "%s", new);
 146
 147         return setenv(opt, buf, 1);
 148 }
 149
 150 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 151 {
 152         char *env_buf;
 153         int buflen = 0;
 154         int bufofs = 0;
 155         struct vpn_option *opt;
 156
 157         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 158                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 159
 160         env_buf = malloc(buflen + 1);
 161         if (!env_buf)
 162                 return;
 163
 164         env_buf[buflen] = 0;
 165
 166         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 167                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 168                                    "%s=%s\n", opt->option, opt->value);
 169
 170         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 171         free(env_buf);
 172 }
 173
 174 static void set_script_env(struct openconnect_info *vpninfo)
 175 {
 176         struct sockaddr_in *sin = (void *)vpninfo->peer_addr;
 177
 178         setenv("VPNGATEWAY", inet_ntoa(sin->sin_addr), 1);
 179         setenv("TUNDEV", vpninfo->ifname, 1);
 180         setenv("reason", "connect", 1);
 181         unsetenv("CISCO_BANNER");
 182         unsetenv("CISCO_SPLIT_INC");
 183         unsetenv("CISCO_SPLIT_EXC");
 184
 185         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 186
 187         setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 188         setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 189
 190         if (vpninfo->vpn_dns[0])
 191                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 192         else
 193                 unsetenv("INTERNAL_IP4_DNS");
 194         if (vpninfo->vpn_dns[1])
 195                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 196         if (vpninfo->vpn_dns[2])
 197                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 198
 199         if (vpninfo->vpn_nbns[0])
 200                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 201         else
 202                 unsetenv("INTERNAL_IP4_NBNS");
 203         if (vpninfo->vpn_nbns[1])
 204                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 205         if (vpninfo->vpn_nbns[2])
 206                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 207
 208         if (vpninfo->vpn_domain)
 209                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 210         else unsetenv ("CISCO_DEF_DOMAIN");
 211
 212         if (vpninfo->vpn_proxy_pac)
 213                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 214
 215         if (vpninfo->split_includes) {
 216                 struct split_include *this = vpninfo->split_includes;
 217                 int nr_split_includes = 0;
 218
 219                 while (this) {
 220                         process_split_xxclude(vpninfo, "IN", this->route,
 221                                               &nr_split_includes);
 222                         this = this->next;
 223                 }
 224                 setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 225         }
 226         if (vpninfo->split_excludes) {
 227                 struct split_include *this = vpninfo->split_excludes;
 228                 int nr_split_excludes = 0;
 229
 230                 while (this) {
 231                         process_split_xxclude(vpninfo, "EX", this->route,
 232                                               &nr_split_excludes);
 233                         this = this->next;
 234                 }
 235                 setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 236         }
 237         setenv_cstp_opts(vpninfo);
 238 }
 239
 240 static int script_config_tun(struct openconnect_info *vpninfo)
 241 {
 242         if (vpninfo->peer_addr->sa_family != AF_INET) {
 243                 vpninfo->progress(vpninfo, PRG_ERR, "Script cannot handle anything but Legacy IP\n");
 244                 return -EINVAL;
 245         }
 246
 247         set_script_env(vpninfo);
 248
 249         system(vpninfo->vpnc_script);
 250         return 0;
 251 }
 252
 253
 254 /* Set up a tuntap device. */
 255 int setup_tun(struct openconnect_info *vpninfo)
 256 {
 257         struct ifreq ifr;
 258         int tun_fd;
 259
 260         if (vpninfo->script_tun) {
 261                 pid_t child;
 262                 int fds[2];
 263
 264                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 265                         perror("socketpair");
 266                         exit(1);
 267                 }
 268                 tun_fd = fds[0];
 269                 child = fork();
 270                 if (child < 0) {
 271                         perror("fork");
 272                         exit(1);
 273                 } else if (!child) {
 274                         close(tun_fd);
 275                         setenv_int("VPNFD", fds[1]);
 276                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 277                         perror("execl");
 278                         exit(1);
 279                 }
 280                 close(fds[1]);
 281                 vpninfo->script_tun = child;
 282                 vpninfo->ifname = "(script)";
 283         } else {
 284 #ifdef IFF_TUN /* Linux */
 285                 tun_fd = open("/dev/net/tun", O_RDWR);
 286                 if (tun_fd < 0) {
 287                         vpninfo->progress(vpninfo, PRG_ERR,
 288                                           "Failed to open tun device: %s\n",
 289                                           strerror(errno));
 290                         exit(1);
 291                 }
 292                 memset(&ifr, 0, sizeof(ifr));
 293                 ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 294                 if (vpninfo->ifname)
 295                         strncpy(ifr.ifr_name, vpninfo->ifname,
 296                                 sizeof(ifr.ifr_name) - 1);
 297                 if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 298                         vpninfo->progress(vpninfo, PRG_ERR,
 299                                           "TUNSETIFF failed: %s\n",
 300                                           strerror(errno));
 301                         exit(1);
 302                 }
 303                 if (!vpninfo->ifname)
 304                         vpninfo->ifname = strdup(ifr.ifr_name);
 305
 306 #else /* BSD et al have /dev/tun$x devices */
 307                 static char tun_name[80];
 308                 int i;
 309                 for (i = 0; i < 255; i++) {
 310                         sprintf(tun_name, "/dev/tun%d", i);
 311                         tun_fd = open(tun_name, O_RDWR);
 312                         if (tun_fd >= 0)
 313                                 break;
 314                 }
 315                 if (tun_fd < 0) {
 316                         perror("open tun");
 317                         exit(1);
 318                 }
 319                 vpninfo->ifname = tun_name + 5;
 320 #endif
 321                 if (vpninfo->vpnc_script) {
 322                         script_config_tun(vpninfo);
 323                         /* We have to set the MTU for ourselves, because the script doesn't */
 324                         local_config_tun(vpninfo, 1);
 325                 } else
 326                         local_config_tun(vpninfo, 0);
 327         }
 328
 329         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 330
 331         vpninfo->tun_fd = tun_fd;
 332
 333         if (vpninfo->select_nfds <= tun_fd)
 334                 vpninfo->select_nfds = tun_fd + 1;
 335
 336         FD_SET(tun_fd, &vpninfo->select_rfds);
 337
 338         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 339
 340         return 0;
 341 }
 342
 343 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 344 {
 345         char buf[2000];
 346         int len;
 347         int work_done = 0;
 348
 349         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 350                 while ((len = read(vpninfo->tun_fd, buf, sizeof(buf))) > 0) {
 351                         if (queue_new_packet(&vpninfo->outgoing_queue, AF_INET, buf, len))
 352                                 break;
 353
 354                         work_done = 1;
 355                         vpninfo->outgoing_qlen++;
 356                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 357                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 358                                 break;
 359                         }
 360                 }
 361         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 362                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 363         }
 364
 365         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 366            we could handle that and retry... but it doesn't let us poll() for
 367            the no-longer-full situation, so let's not bother. */
 368         while (vpninfo->incoming_queue) {
 369                 struct pkt *this = vpninfo->incoming_queue;
 370                 vpninfo->incoming_queue = this->next;
 371                 if (write(vpninfo->tun_fd, this->data, this->len) < 0 &&
 372                     errno == ENOTCONN) {
 373                         vpninfo->quit_reason = "Client connection terminated";
 374                         return 1;
 375                 }
 376                 free(this);
 377         }
 378         /* Work is not done if we just got rid of packets off the queue */
 379         return work_done;
 380 }