tun.c

   1 /*
   2  * OpenConnect (SSL + DTLS) VPN client
   3  *
   4  * Copyright © 2008 Intel Corporation.
   5  *
   6  * Author: David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * This program is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * version 2.1, as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to:
  19  *
  20  *   Free Software Foundation, Inc.
  21  *   51 Franklin Street, Fifth Floor,
  22  *   Boston, MA 02110-1301 USA
  23  */
  24
  25 #include <string.h>
  26 #include <sys/socket.h>
  27 #include <sys/ioctl.h>
  28 #ifdef __linux__
  29 #include <linux/if_tun.h>
  30 #endif
  31 #include <sys/types.h>
  32 #include <sys/stat.h>
  33 #include <fcntl.h>
  34 #include <unistd.h>
  35 #include <netinet/in.h>
  36 #include <net/if.h>
  37 #include <arpa/inet.h>
  38 #include <errno.h>
  39
  40 #include "openconnect.h"
  41
  42 static int local_config_tun(struct openconnect_info *vpninfo, int mtu_only)
  43 {
  44         struct ifreq ifr;
  45         int net_fd;
  46
  47         net_fd = socket(PF_INET, SOCK_DGRAM, 0);
  48         if (net_fd < 0) {
  49                 perror("open net");
  50                 return -EINVAL;
  51         }
  52         memset(&ifr, 0, sizeof(ifr));
  53         strncpy(ifr.ifr_name, vpninfo->ifname, sizeof(ifr.ifr_name) - 1);
  54
  55         if (!mtu_only) {
  56                 struct sockaddr_in *addr = (struct sockaddr_in *) &ifr.ifr_addr;
  57
  58                 if (ioctl(net_fd, SIOCGIFFLAGS, &ifr) < 0)
  59                         perror("SIOCGIFFLAGS");
  60
  61                 ifr.ifr_flags |= IFF_UP | IFF_POINTOPOINT;
  62                 if (ioctl(net_fd, SIOCSIFFLAGS, &ifr) < 0)
  63                         perror("SIOCSIFFLAGS");
  64
  65                 addr->sin_family = AF_INET;
  66                 addr->sin_addr.s_addr = inet_addr(vpninfo->vpn_addr);
  67                 if (ioctl(net_fd, SIOCSIFADDR, &ifr) < 0)
  68                         perror("SIOCSIFADDR");
  69         }
  70
  71         ifr.ifr_mtu = vpninfo->mtu;
  72         if (ioctl(net_fd, SIOCSIFMTU, &ifr) < 0)
  73                 perror("SIOCSIFMTU");
  74
  75         close(net_fd);
  76
  77         return 0;
  78 }
  79
  80 static int setenv_int(const char *opt, int value)
  81 {
  82         char buf[16];
  83         sprintf(buf, "%d", value);
  84         return setenv(opt, buf, 1);
  85 }
  86
  87 static int process_split_xxclude(struct openconnect_info *vpninfo,
  88                                  char *in_ex, char *route, int *nr_incs)
  89 {
  90         struct in_addr addr;
  91         int masklen;
  92         char envname[80];
  93         char *slash;
  94
  95         slash = strchr(route, '/');
  96         if (!slash) {
  97         badinc:
  98                 vpninfo->progress(vpninfo, PRG_ERR,
  99                                   "Discard bad split %sclude: \"%s\"\n",
 100                                   in_ex, route);
 101                 return -EINVAL;
 102         }
 103
 104         *slash = 0;
 105         if (!inet_aton(route, &addr)) {
 106                 *slash = '/';
 107                 goto badinc;
 108         }
 109
 110         envname[79] = 0;
 111         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *nr_incs);
 112         setenv(envname, route, 1);
 113
 114         /* Put it back how we found it */
 115         *slash = '/';
 116
 117         if (!inet_aton(slash+1, &addr))
 118                 goto badinc;
 119
 120         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *nr_incs);
 121         setenv(envname, slash+1, 1);
 122
 123         for (masklen = 0; masklen < 32; masklen++) {
 124                 if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
 125                         break;
 126         }
 127         masklen = 32 - masklen;
 128
 129         snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *nr_incs);
 130         setenv_int(envname, masklen);
 131
 132         (*nr_incs)++;
 133         return 0;
 134 }
 135
 136 static int appendenv(const char *opt, const char *new)
 137 {
 138         char buf[1024];
 139         char *old = getenv(opt);
 140
 141         buf[1023] = 0;
 142         if (old)
 143                 snprintf(buf, 1023, "%s %s", old, new);
 144         else
 145                 snprintf(buf, 1023, "%s", new);
 146
 147         return setenv(opt, buf, 1);
 148 }
 149
 150 static void set_script_env(struct openconnect_info *vpninfo)
 151 {
 152         struct sockaddr_in *sin = (void *)vpninfo->peer_addr;
 153
 154         setenv("VPNGATEWAY", inet_ntoa(sin->sin_addr), 1);
 155         setenv("TUNDEV", vpninfo->ifname, 1);
 156         setenv("reason", "connect", 1);
 157         unsetenv("CISCO_BANNER");
 158         unsetenv("CISCO_SPLIT_INC");
 159         unsetenv("CISCO_SPLIT_EXC");
 160
 161         setenv_int("INTERNAL_IP4_MTU", vpninfo->mtu);
 162
 163         setenv("INTERNAL_IP4_ADDRESS", vpninfo->vpn_addr, 1);
 164         setenv("INTERNAL_IP4_NETMASK", vpninfo->vpn_netmask, 1);
 165
 166         if (vpninfo->vpn_dns[0])
 167                 setenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[0], 1);
 168         else
 169                 unsetenv("INTERNAL_IP4_DNS");
 170         if (vpninfo->vpn_dns[1])
 171                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[1]);
 172         if (vpninfo->vpn_dns[2])
 173                 appendenv("INTERNAL_IP4_DNS", vpninfo->vpn_dns[2]);
 174
 175         if (vpninfo->vpn_nbns[0])
 176                 setenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[0], 1);
 177         else
 178                 unsetenv("INTERNAL_IP4_NBNS");
 179         if (vpninfo->vpn_nbns[1])
 180                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[1]);
 181         if (vpninfo->vpn_nbns[2])
 182                 appendenv("INTERNAL_IP4_NBNS", vpninfo->vpn_nbns[2]);
 183
 184         if (vpninfo->vpn_domain)
 185                 setenv("CISCO_DEF_DOMAIN", vpninfo->vpn_domain, 1);
 186         else unsetenv ("CISCO_DEF_DOMAIN");
 187
 188         if (vpninfo->split_includes) {
 189                 struct split_include *this = vpninfo->split_includes;
 190                 int nr_split_includes = 0;
 191
 192                 while (this) {
 193                         process_split_xxclude(vpninfo, "IN", this->route,
 194                                               &nr_split_includes);
 195                         this = this->next;
 196                 }
 197                 setenv_int("CISCO_SPLIT_INC", nr_split_includes);
 198         }
 199         if (vpninfo->split_excludes) {
 200                 struct split_include *this = vpninfo->split_excludes;
 201                 int nr_split_excludes = 0;
 202
 203                 while (this) {
 204                         process_split_xxclude(vpninfo, "EX", this->route,
 205                                               &nr_split_excludes);
 206                         this = this->next;
 207                 }
 208                 setenv_int("CISCO_SPLIT_EXC", nr_split_excludes);
 209         }
 210 }
 211
 212 static int script_config_tun(struct openconnect_info *vpninfo)
 213 {
 214         if (vpninfo->peer_addr->sa_family != AF_INET) {
 215                 vpninfo->progress(vpninfo, PRG_ERR, "Script cannot handle anything but Legacy IP\n");
 216                 return -EINVAL;
 217         }
 218
 219         set_script_env(vpninfo);
 220
 221         system(vpninfo->vpnc_script);
 222         return 0;
 223 }
 224
 225
 226 /* Set up a tuntap device. */
 227 int setup_tun(struct openconnect_info *vpninfo)
 228 {
 229         struct ifreq ifr;
 230         int tun_fd;
 231
 232         if (vpninfo->script_tun) {
 233                 pid_t child;
 234                 int fds[2];
 235
 236                 if (socketpair(AF_UNIX, SOCK_DGRAM, 0, fds)) {
 237                         perror("socketpair");
 238                         exit(1);
 239                 }
 240                 tun_fd = fds[0];
 241                 child = fork();
 242                 if (child < 0) {
 243                         perror("fork");
 244                         exit(1);
 245                 } else if (!child) {
 246                         close(tun_fd);
 247                         setenv_int("VPNFD", fds[1]);
 248                         execl("/bin/sh", "/bin/sh", "-c", vpninfo->vpnc_script, NULL);
 249                         perror("execl");
 250                         exit(1);
 251                 }
 252                 close(fds[1]);
 253                 vpninfo->script_tun = child;
 254                 vpninfo->ifname = "(script)";
 255         } else {
 256 #ifdef IFF_TUN /* Linux */
 257                 tun_fd = open("/dev/net/tun", O_RDWR);
 258                 if (tun_fd < 0) {
 259                         vpninfo->progress(vpninfo, PRG_ERR,
 260                                           "Failed to open tun device: %s\n",
 261                                           strerror(errno));
 262                         exit(1);
 263                 }
 264                 memset(&ifr, 0, sizeof(ifr));
 265                 ifr.ifr_flags = IFF_TUN | IFF_NO_PI;
 266                 if (vpninfo->ifname)
 267                         strncpy(ifr.ifr_name, vpninfo->ifname,
 268                                 sizeof(ifr.ifr_name) - 1);
 269                 if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
 270                         vpninfo->progress(vpninfo, PRG_ERR,
 271                                           "TUNSETIFF failed: %s\n",
 272                                           strerror(errno));
 273                         exit(1);
 274                 }
 275                 if (!vpninfo->ifname)
 276                         vpninfo->ifname = strdup(ifr.ifr_name);
 277
 278 #else /* BSD et al have /dev/tun$x devices */
 279                 static char tun_name[80];
 280                 int i;
 281                 for (i = 0; i < 255; i++) {
 282                         sprintf(tun_name, "/dev/tun%d", i);
 283                         tun_fd = open(tun_name, O_RDWR);
 284                         if (tun_fd >= 0)
 285                                 break;
 286                 }
 287                 if (tun_fd < 0) {
 288                         perror("open tun");
 289                         exit(1);
 290                 }
 291                 vpninfo->ifname = tun_name + 5;
 292 #endif
 293                 if (vpninfo->vpnc_script) {
 294                         script_config_tun(vpninfo);
 295                         /* We have to set the MTU for ourselves, because the script doesn't */
 296                         local_config_tun(vpninfo, 1);
 297                 } else
 298                         local_config_tun(vpninfo, 0);
 299         }
 300
 301         fcntl(tun_fd, F_SETFD, FD_CLOEXEC);
 302
 303         vpninfo->tun_fd = tun_fd;
 304
 305         if (vpninfo->select_nfds <= tun_fd)
 306                 vpninfo->select_nfds = tun_fd + 1;
 307
 308         FD_SET(tun_fd, &vpninfo->select_rfds);
 309
 310         fcntl(vpninfo->tun_fd, F_SETFL, fcntl(vpninfo->tun_fd, F_GETFL) | O_NONBLOCK);
 311
 312         return 0;
 313 }
 314
 315 int tun_mainloop(struct openconnect_info *vpninfo, int *timeout)
 316 {
 317         char buf[2000];
 318         int len;
 319         int work_done = 0;
 320
 321         if (FD_ISSET(vpninfo->tun_fd, &vpninfo->select_rfds)) {
 322                 while ((len = read(vpninfo->tun_fd, buf, sizeof(buf))) > 0) {
 323                         if (queue_new_packet(&vpninfo->outgoing_queue, AF_INET, buf, len))
 324                                 break;
 325
 326                         work_done = 1;
 327                         vpninfo->outgoing_qlen++;
 328                         if (vpninfo->outgoing_qlen == vpninfo->max_qlen) {
 329                                 FD_CLR(vpninfo->tun_fd, &vpninfo->select_rfds);
 330                                 break;
 331                         }
 332                 }
 333         } else if (vpninfo->outgoing_qlen < vpninfo->max_qlen) {
 334                 FD_SET(vpninfo->tun_fd, &vpninfo->select_rfds);
 335         }
 336
 337         /* The kernel returns -ENOMEM when the queue is full, so theoretically
 338            we could handle that and retry... but it doesn't let us poll() for
 339            the no-longer-full situation, so let's not bother. */
 340         while (vpninfo->incoming_queue) {
 341                 struct pkt *this = vpninfo->incoming_queue;
 342                 vpninfo->incoming_queue = this->next;
 343                 if (write(vpninfo->tun_fd, this->data, this->len) < 0 &&
 344                     errno == ENOTCONN) {
 345                         vpninfo->quit_reason = "Client connection terminated";
 346                         return 1;
 347                 }
 348                 free(this);
 349         }
 350         /* Work is not done if we just got rid of packets off the queue */
 351         return work_done;
 352 }