tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <sys/types.h>
  26 #include <sys/stat.h>
  27 #include <sys/socket.h>
  28 #include <sys/ioctl.h>
  29 #include <string.h>
  30 #ifdef __linux__
  31 #include <linux/if_tun.h>
  32 #endif
  33 #include <fcntl.h>
  34 #include <unistd.h>
  35 #include <netinet/in.h>
  36 #include <net/if.h>
  37 #include <arpa/inet.h>
  38 #include <errno.h>
  39
  40 #include "openconnect.h"
  41
  42 #ifdef BSD
  43 #define TUN_HAS_AF_PREFIX 1
  44 #endif
  45
  46 static int local_config_tun(struct openconnect_info *vpninfo, int mtu_only)
  47 {
  48         struct ifreq ifr;
  49         int net_fd;
  50
  51         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  52         if (net_fd < 0) {
  53                 perror("open net");
  54                 return -EINVAL;
  55         }
  56         memset(&ifr, 0, sizeof(ifr));
  57         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  58
  59         if (!mtu_only) {
  60                 struct sockaddr_in *addr = (struct sockaddr_in *) &ifr.ifr_addr;
  61
  62                 if (ioctl(net_fd, SIOCGIFFLAGS, &ifr) < 0)
  63                         perror("SIOCGIFFLAGS");
  64
  65                 ifr.ifr_flags |= IFF_UP | IFF_POINTOPOINT;
  66                 if (ioctl(net_fd, SIOCSIFFLAGS, &ifr) < 0)
  67                         perror("SIOCSIFFLAGS");
  68
  69                 addr->sin_family = AF_INET;
  70                 addr->sin_addr.s_addr = inet_addr(vpninfo->vpn_addr);
  71                 if (ioctl(net_fd, SIOCSIFADDR, &ifr) < 0)
  72                         perror("SIOCSIFADDR");
  73         }
  74
  75         ifr.ifr_mtu = vpninfo->mtu;
  76         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  77                 perror("SIOCSIFMTU");
  78
  79         close(net_fd);
  80
  81         return 0;
  82 }
  83
  84 static int setenv_int(const char *opt, int value)
  85 {
  86         char buf[16];
  87         sprintf(buf, "%d", value);
  88         return setenv(opt, buf, 1);
  89 }
  90
  91 static int process_split_xxclude(struct openconnect_info *vpninfo,
  92                                  char *in_ex, char *route, int *nr_incs)
  93 {
  94         struct in_addr addr;
  95         int masklen;
  96         char envname[80];
  97         char *slash;
  98
  99         slash = strchr(route, '/');
 100         if (!slash) {
 101         badinc:
 102                 vpninfo->progress(vpninfo, PRG_ERR,
 103                                   "Discard bad split %sclude: \"%s\"\n",
 104                                   in_ex, route);
 105                 return -EINVAL;
 106         }
 107
 108         *slash = 0;
 109         if (!inet_aton(route, &addr)) {
 110                 *slash = '/';
 111                 goto badinc;
 112         }
 113
 114         envname[79] = 0;
 115         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *nr_incs);
 116         setenv(envname, route, 1);
 117
 118         /* Put it back how we found it */
 119         *slash = '/';
 120
 121         if (!inet_aton(slash+1, &addr))
 122                 goto badinc;
 123
 124         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *nr_incs);
 125         setenv(envname, slash+1, 1);
 126
 127         for (masklen = 0; masklen < 32; masklen++) {
 128                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 129                         break;
 130         }
 131         masklen = 32 - masklen;
 132
 133         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *nr_incs);
 134         setenv_int(envname, masklen);
 135
 136         (*nr_incs)++;
 137         return 0;
 138 }
 139
 140 static int appendenv(const char *opt, const char *new)
 141 {
 142         char buf[1024];
 143         char *old = getenv(opt);
 144
 145         buf[1023] = 0;
 146         if (old)
 147                 snprintf(buf, 1023, "%s %s", old, new);
 148         else
 149                 snprintf(buf, 1023, "%s", new);
 150
 151         return setenv(opt, buf, 1);
 152 }
 153
 154 static void setenv_cstp_opts(struct openconnect_info *vpninfo)
 155 {
 156         char *env_buf;
 157         int buflen = 0;
 158         int bufofs = 0;
 159         struct vpn_option *opt;
 160
 161         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 162                 buflen += 2 + strlen(opt->option) + strlen(opt->value);
 163
 164         env_buf = malloc(buflen + 1);
 165         if (!env_buf)
 166                 return;
 167
 168         env_buf[buflen] = 0;
 169
 170         for (opt = vpninfo->cstp_options; opt; opt = opt->next)
 171                 bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
 172                                    "%s=%s\n", opt->option, opt->value);
 173
 174         setenv("CISCO_CSTP_OPTIONS", env_buf, 1);
 175         free(env_buf);
 176 }
 177
 178 static void set_script_env(struct openconnect_info *vpninfo)
 179 {
 180         struct sockaddr_in *sin = (void *)vpninfo->peer_addr;
 181
 182         setenv("VPNGATEWAY", inet_ntoa(sin->sin_addr), 1);
 183         setenv("TUNDEV", vpninfo->ifname, 1);
 184         setenv("reason", "connect", 1);
 185         unsetenv("CISCO_BANNER");
 186         unsetenv("CISCO_SPLIT_INC");
 187         unsetenv("CISCO_SPLIT_EXC");
 188
 189         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 190
 191         setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 192         setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 193
 194         if (vpninfo->vpn_dns[0])
 195                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 196         else
 197                 unsetenv("INTERNAL_IP4_DNS");
 198         if (vpninfo->vpn_dns[1])
 199                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 200         if (vpninfo->vpn_dns[2])
 201                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 202
 203         if (vpninfo->vpn_nbns[0])
 204                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 205         else
 206                 unsetenv("INTERNAL_IP4_NBNS");
 207         if (vpninfo->vpn_nbns[1])
 208                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 209         if (vpninfo->vpn_nbns[2])
 210                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 211
 212         if (vpninfo->vpn_domain)
 213                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 214         else unsetenv ("CISCO_DEF_DOMAIN");
 215
 216         if (vpninfo->vpn_proxy_pac)
 217                 setenv("CISCO_PROXY_PAC", vpninfo->vpn_proxy_pac, 1);
 218
 219         if (vpninfo->split_includes) {
 220                 struct split_include *this = vpninfo->split_includes;
 221                 int nr_split_includes = 0;
 222
 223                 while (this) {
 224                         process_split_xxclude(vpninfo, "IN", this->route,
 225                                               &nr_split_includes);
 226                         this = this->next;
 227                 }
 228                 setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 229         }
 230         if (vpninfo->split_excludes) {
 231                 struct split_include *this = vpninfo->split_excludes;
 232                 int nr_split_excludes = 0;
 233
 234                 while (this) {
 235                         process_split_xxclude(vpninfo, "EX", this->route,
 236                                               &nr_split_excludes);
 237                         this = this->next;
 238                 }
 239                 setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 240         }
 241         setenv_cstp_opts(vpninfo);
 242 }
 243
 244 static int script_config_tun(struct openconnect_info *vpninfo)
 245 {
 246         if (vpninfo->peer_addr->sa_family != AF_INET) {
 247                 vpninfo->progress(vpninfo, PRG_ERR, "Script cannot handle anything but Legacy IP\n");
 248                 return -EINVAL;
 249         }
 250
 251         set_script_env(vpninfo);
 252
 253         system(vpninfo->vpnc_script);
 254         return 0;
 255 }
 256
 257
 258 /* Set up a tuntap device. */
 259 int setup_tun(struct openconnect_info *vpninfo)
 260 {
 261         int tun_fd;
 262
 263         if (vpninfo->script_tun) {
 264                 pid_t child;
 265                 int fds[2];
 266
 267                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 268                         perror("socketpair");
 269                         exit(1);
 270                 }
 271                 tun_fd = fds[0];
 272                 child = fork();
 273                 if (child < 0) {
 274                         perror("fork");
 275                         exit(1);
 276                 } else if (!child) {
 277                         close(tun_fd);
 278                         setenv_int("VPNFD", fds[1]);
 279                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 280                         perror("execl");
 281                         exit(1);
 282                 }
 283                 close(fds[1]);
 284                 vpninfo->script_tun = child;
 285                 vpninfo->ifname = "(script)";
 286         } else {
 287 #ifdef IFF_TUN /* Linux */
 288                 struct ifreq ifr;
 289
 290                 tun_fd = open("/dev/net/tun", O_RDWR);
 291                 if (tun_fd < 0) {
 292                         vpninfo->progress(vpninfo, PRG_ERR,
 293                                           "Failed to open tun device: %s\n",
 294                                           strerror(errno));
 295                         exit(1);
 296                 }
 297                 memset(&ifr, 0, sizeof(ifr));
 298                 ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 299                 if (vpninfo->ifname)
 300                         strncpy(ifr.ifr_name, vpninfo->ifname,
 301                                 sizeof(ifr.ifr_name) - 1);
 302                 if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 303                         vpninfo->progress(vpninfo, PRG_ERR,
 304                                           "TUNSETIFF failed: %s\n",
 305                                           strerror(errno));
 306                         exit(1);
 307                 }
 308                 if (!vpninfo->ifname)
 309                         vpninfo->ifname = strdup(ifr.ifr_name);
 310
 311 #else /* BSD et al have /dev/tun$x devices */
 312                 static char tun_name[80];
 313                 int i;
 314                 for (i = 0; i < 255; i++) {
 315                         sprintf(tun_name, "/dev/tun%d", i);
 316                         tun_fd = open(tun_name, O_RDWR);
 317                         if (tun_fd >= 0)
 318                                 break;
 319                 }
 320                 if (tun_fd < 0) {
 321                         perror("open tun");
 322                         exit(1);
 323                 }
 324                 vpninfo->ifname = tun_name + 5;
 325 #endif
 326                 if (vpninfo->vpnc_script) {
 327                         script_config_tun(vpninfo);
 328                         /* We have to set the MTU for ourselves, because the script doesn't */
 329                         local_config_tun(vpninfo, 1);
 330                 } else
 331                         local_config_tun(vpninfo, 0);
 332         }
 333
 334         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 335
 336         vpninfo->tun_fd = tun_fd;
 337
 338         if (vpninfo->select_nfds <= tun_fd)
 339                 vpninfo->select_nfds = tun_fd + 1;
 340
 341         FD_SET(tun_fd, &vpninfo->select_rfds);
 342
 343         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 344
 345         return 0;
 346 }
 347
 348 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 349 {
 350         unsigned char buf[2000];
 351         int len;
 352         int work_done = 0;
 353
 354         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 355                 while ((len = read(vpninfo->tun_fd, buf, sizeof(buf))) > 0) {
 356                         unsigned char *pkt = buf;
 357 #ifdef TUN_HAS_AF_PREFIX
 358                         if (*(int *)buf != htonl(AF_INET))
 359                                 continue;
 360                         pkt += 4;
 361                         len -= 4;
 362 #endif
 363                         if (queue_new_packet(&vpninfo->outgoing_queue, AF_INET,
 364                                              pkt, len))
 365                                 break;
 366
 367                         work_done = 1;
 368                         vpninfo->outgoing_qlen++;
 369                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 370                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 371                                 break;
 372                         }
 373                 }
 374         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 375                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 376         }
 377
 378         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 379            we could handle that and retry... but it doesn't let us poll() for
 380            the no-longer-full situation, so let's not bother. */
 381         while (vpninfo->incoming_queue) {
 382                 struct pkt *this = vpninfo->incoming_queue;
 383                 unsigned char *data = this->data;
 384                 int len = this->len;
 385
 386                 vpninfo->incoming_queue = this->next;
 387
 388 #ifdef TUN_HAS_AF_PREFIX
 389                 data -= 4;
 390                 len += 4;
 391                 *(int *)data = htonl(AF_INET);
 392 #endif
 393
 394                 if (write(vpninfo->tun_fd, data, len) < 0 &&
 395                     errno == ENOTCONN) {
 396                         vpninfo->quit_reason = "Client connection terminated";
 397                         return 1;
 398                 }
 399                 free(this);
 400         }
 401         /* Work is not done if we just got rid of packets off the queue */
 402         return work_done;
 403 }