[secnet] / tun.c

#include "secnet.h"
#include "util.h"
#include "netlink.h"
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>

#ifdef HAVE_LINUX_IF_H
#include <linux/if.h>
#include <linux/if_tun.h>
#endif

/* Where do we find if_tun on other platforms? */

/* Connection to the kernel through the universal TUN/TAP driver */

struct tun {
    struct netlink nl;
    int fd;
    string_t device_path;
    string_t interface_name;
    string_t ifconfig_path;
    string_t route_path;
    bool_t tun_old;
    bool_t search_for_if; /* Applies to tun-old only */
    struct buffer_if *buff; /* We receive packets into here
			       and send them to the netlink code. */
    netlink_deliver_fn *netlink_to_tunnel;
    uint32_t local_address; /* host interface address */
};

static int tun_beforepoll(void *sst, struct pollfd *fds, int *nfds_io,
			  int *timeout_io, const struct timeval *tv_now,
			  uint64_t *now)
{
    struct tun *st=sst;
    *nfds_io=1;
    fds[0].fd=st->fd;
    fds[0].events=POLLIN|POLLERR|POLLHUP;
    return 0;
}

static void tun_afterpoll(void *sst, struct pollfd *fds, int nfds,
			    const struct timeval *tv_now, uint64_t *now)
{
    struct tun *st=sst;
    int l;

    if (nfds==0) return;
    if (fds[0].revents&POLLERR) {
	printf("tun_afterpoll: hup!\n");
    }
    if (fds[0].revents&POLLIN) {
	BUF_ALLOC(st->buff,"tun_afterpoll");
	buffer_init(st->buff,st->nl.max_start_pad);
	l=read(st->fd,st->buff->start,st->buff->len-st->nl.max_start_pad);
	if (l<0) {
	    fatal_perror("tun_afterpoll: read()");
	}
	if (l==0) {
	    fatal("tun_afterpoll: read()=0; device gone away?\n");
	}
	if (l>0) {
	    st->buff->size=l;
	    st->netlink_to_tunnel(&st->nl,NULL,st->buff);
	    BUF_ASSERT_FREE(st->buff);
	}
    }
}

static void tun_deliver_to_kernel(void *sst, void *cid,
				  struct buffer_if *buf)
{
    struct tun *st=sst;

    BUF_ASSERT_USED(buf);
    /* No error checking, because we'd just throw the packet away
       anyway if it didn't work. */
    write(st->fd,buf->start,buf->size);
    BUF_FREE(buf);
}

static bool_t tun_set_route(void *sst, struct netlink_route *route)
{
    struct tun *st=sst;
    string_t network, mask, secnetaddr;

    if (route->up != route->kup) {
	network=ipaddr_to_string(route->net.prefix);
	mask=ipaddr_to_string(route->net.mask);
	secnetaddr=ipaddr_to_string(st->nl.secnet_address);
	Message(M_INFO,"%s: %s route %s/%d %s kernel routing table\n",
		st->nl.name,route->up?"adding":"deleting",network,
		route->net.len,route->up?"to":"from");
	sys_cmd(st->route_path,"route",route->up?"add":"del","-net",network,
		"netmask",mask,"gw",secnetaddr,(char *)0);
	free(network); free(mask); free(secnetaddr);
	route->kup=route->up;
	return True;
    }
    return False;
}

static void tun_phase_hook(void *sst, uint32_t newphase)
{
    struct tun *st=sst;
    string_t hostaddr,secnetaddr;
    uint8_t mtu[6];
    string_t network,mask;
    struct netlink_route *r;
    int i;

    if (st->tun_old) {
	if (st->search_for_if) {
	    string_t dname;
	    int i;

	    /* ASSERT st->interface_name */
	    dname=safe_malloc(strlen(st->device_path)+4,"tun_old_apply");
	    st->interface_name=safe_malloc(8,"tun_phase_hook");
	
	    for (i=0; i<255; i++) {
		sprintf(dname,"%s%d",st->device_path,i);
		if ((st->fd=open(dname,O_RDWR))>0) {
		    sprintf(st->interface_name,"tun%d",i);
		    Message(M_INFO,"%s: allocated network interface %s "
			    "through %s\n",st->nl.name,st->interface_name,
			    dname);
		    break;
		}
	    }
	    if (st->fd==-1) {
		fatal("%s: unable to open any TUN device (%s...)\n",
		      st->nl.name,st->device_path);
	    }
	} else {
	    st->fd=open(st->device_path,O_RDWR);
	    if (st->fd==-1) {
		fatal_perror("%s: unable to open TUN device file %s",
			     st->nl.name,st->device_path);
	    }
	}
    } else {
#ifdef HAVE_LINUX_IF_H
	struct ifreq ifr;

	/* New TUN interface: open the device, then do ioctl TUNSETIFF
	   to set or find out the network interface name. */
	st->fd=open(st->device_path,O_RDWR);
	if (st->fd==-1) {
	    fatal_perror("%s: can't open device file %s",st->nl.name,
			 st->device_path);
	}
	memset(&ifr,0,sizeof(ifr));
	ifr.ifr_flags = IFF_TUN | IFF_NO_PI; /* Just send/receive IP packets,
						no extra headers */
	if (st->interface_name)
	    strncpy(ifr.ifr_name,st->interface_name,IFNAMSIZ);
	Message(M_DEBUG,"%s: about to ioctl(TUNSETIFF)...\n",st->nl.name);
	if (ioctl(st->fd,TUNSETIFF,&ifr)<0) {
	    fatal_perror("%s: ioctl(TUNSETIFF)",st->nl.name);
	}
	if (!st->interface_name) {
	    st->interface_name=safe_malloc(strlen(ifr.ifr_name)+1,"tun_apply");
	    strcpy(st->interface_name,ifr.ifr_name);
	    Message(M_INFO,"%s: allocated network interface %s\n",st->nl.name,
		    st->interface_name);
	}
#else
	fatal("netlink.c:tun_phase_hook:!tun_old unexpected\n");
#endif /* HAVE_LINUX_IF_H */
    }
    /* All the networks we'll be using have been registered. Invoke ifconfig
       to set the TUN device's address, and route to add routes to all
       our networks. */

    hostaddr=ipaddr_to_string(st->local_address);
    secnetaddr=ipaddr_to_string(st->nl.secnet_address);
    snprintf(mtu,6,"%d",st->nl.mtu);
    mtu[5]=0;

    sys_cmd(st->ifconfig_path,"ifconfig",st->interface_name,
	    hostaddr,"netmask","255.255.255.255","-broadcast",
	    "pointopoint",secnetaddr,"mtu",mtu,"up",(char *)0);

    r=st->nl.routes;
    for (i=0; i<st->nl.n_routes; i++) {
	if (r[i].up && !r[i].kup) {
	    network=ipaddr_to_string(r[i].net.prefix);
	    mask=ipaddr_to_string(r[i].net.mask);
	    sys_cmd(st->route_path,"route","add","-net",network,
		    "netmask",mask,"gw",secnetaddr,(char *)0);
	    r[i].kup=True;
	}
    }

    /* Register for poll() */
    register_for_poll(st, tun_beforepoll, tun_afterpoll, 1, st->nl.name);
}

#ifdef HAVE_LINUX_IF_H
static list_t *tun_apply(closure_t *self, struct cloc loc, dict_t *context,
			 list_t *args)
{
    struct tun *st;
    item_t *item;
    dict_t *dict;

    st=safe_malloc(sizeof(*st),"tun_apply");

    /* First parameter must be a dict */
    item=list_elem(args,0);
    if (!item || item->type!=t_dict)
	cfgfatal(loc,"tun","parameter must be a dictionary\n");
    
    dict=item->data.dict;

    st->netlink_to_tunnel=
	netlink_init(&st->nl,st,loc,dict,
		     "netlink-tun",tun_set_route,tun_deliver_to_kernel);

    st->tun_old=False;
    st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
    st->interface_name=dict_read_string(dict,"interface",False,
					"tun-netlink",loc);
    st->ifconfig_path=dict_read_string(dict,"ifconfig-path",
				       False,"tun-netlink",loc);
    st->route_path=dict_read_string(dict,"route-path",
				    False,"tun-netlink",loc);

    if (!st->device_path) st->device_path="/dev/net/tun";
    if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
    if (!st->route_path) st->route_path="route";
    st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
    st->local_address=string_to_ipaddr(
	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");

    add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);

    return new_closure(&st->nl.cl);
}
#endif /* HAVE_LINUX_IF_H */

static list_t *tun_old_apply(closure_t *self, struct cloc loc, dict_t *context,
			     list_t *args)
{
    struct tun *st;
    item_t *item;
    dict_t *dict;

    st=safe_malloc(sizeof(*st),"tun_old_apply");

    /* First parameter must be a dict */
    item=list_elem(args,0);
    if (!item || item->type!=t_dict)
	cfgfatal(loc,"tun","parameter must be a dictionary\n");
    
    dict=item->data.dict;

    st->netlink_to_tunnel=
	netlink_init(&st->nl,st,loc,dict,
		     "netlink-tun",NULL,tun_deliver_to_kernel);

    st->tun_old=True;
    st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
    st->interface_name=dict_read_string(dict,"interface",False,
					"tun-netlink",loc);
    st->search_for_if=dict_read_bool(dict,"interface-search",False,
				     "tun-netlink",loc,st->device_path==NULL);
    st->ifconfig_path=dict_read_string(dict,"ifconfig-path",False,
				       "tun-netlink",loc);
    st->route_path=dict_read_string(dict,"route-path",False,"tun-netlink",loc);

    if (!st->device_path) st->device_path="/dev/tun";
    if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
    if (!st->route_path) st->route_path="route";
    st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
    st->local_address=string_to_ipaddr(
	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");

    /* Old TUN interface: the network interface name depends on which
       /dev/tunX file we open. If 'interface-search' is set to true, treat
       'device' as the prefix and try numbers from 0--255. If it's set
       to false, treat 'device' as the whole name, and require than an
       appropriate interface name be specified. */
    if (st->search_for_if && st->interface_name) {
	cfgfatal(loc,"tun-old","you may not specify an interface name "
		 "in interface-search mode\n");
    }
    if (!st->search_for_if && !st->interface_name) {
	cfgfatal(loc,"tun-old","you must specify an interface name "
		 "when you explicitly specify a TUN device file\n");
    }


    add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);

    return new_closure(&st->nl.cl);
}

init_module tun_module;
void tun_module(dict_t *dict)
{
#ifdef HAVE_LINUX_IF_H
    add_closure(dict,"tun",tun_apply);
#endif
    add_closure(dict,"tun-old",tun_old_apply);
}
Commit	Line	Data
9d3a4132 SE	1	#include "secnet.h"
	2	#include "util.h"
	3	#include "netlink.h"
	4	#include <stdio.h>
	5	#include <string.h>
	6	#include <unistd.h>
	7	#include <fcntl.h>
	8	#include <sys/ioctl.h>
	9
	10	#ifdef HAVE_LINUX_IF_H
	11	#include <linux/if.h>
	12	#include <linux/if_tun.h>
	13	#endif
	14
c6f79b17	15	/* Where do we find if_tun on other platforms? */
9d3a4132 SE	16
	17	/* Connection to the kernel through the universal TUN/TAP driver */
	18
	19	struct tun {
	20	struct netlink nl;
	21	int fd;
	22	string_t device_path;
	23	string_t interface_name;
	24	string_t ifconfig_path;
	25	string_t route_path;
	26	bool_t tun_old;
	27	bool_t search_for_if; /* Applies to tun-old only */
	28	struct buffer_if buff; / We receive packets into here
	29	and send them to the netlink code. */
	30	netlink_deliver_fn *netlink_to_tunnel;
b2a56f7c	31	uint32_t local_address; /* host interface address */
9d3a4132 SE	32	};
	33
	34	static int tun_beforepoll(void sst, struct pollfd fds, int *nfds_io,
	35	int timeout_io, const struct timeval tv_now,
	36	uint64_t *now)
	37	{
	38	struct tun *st=sst;
	39	*nfds_io=1;
	40	fds[0].fd=st->fd;
	41	fds[0].events=POLLIN\|POLLERR\|POLLHUP;
	42	return 0;
	43	}
	44
	45	static void tun_afterpoll(void sst, struct pollfd fds, int nfds,
	46	const struct timeval tv_now, uint64_t now)
	47	{
	48	struct tun *st=sst;
	49	int l;
	50
7138d0c5	51	if (nfds==0) return;
9d3a4132 SE	52	if (fds[0].revents&POLLERR) {
	53	printf("tun_afterpoll: hup!\n");
	54	}
	55	if (fds[0].revents&POLLIN) {
	56	BUF_ALLOC(st->buff,"tun_afterpoll");
	57	buffer_init(st->buff,st->nl.max_start_pad);
	58	l=read(st->fd,st->buff->start,st->buff->len-st->nl.max_start_pad);
	59	if (l<0) {
	60	fatal_perror("tun_afterpoll: read()");
	61	}
	62	if (l==0) {
	63	fatal("tun_afterpoll: read()=0; device gone away?\n");
	64	}
	65	if (l>0) {
	66	st->buff->size=l;
	67	st->netlink_to_tunnel(&st->nl,NULL,st->buff);
	68	BUF_ASSERT_FREE(st->buff);
	69	}
	70	}
	71	}
	72
	73	static void tun_deliver_to_kernel(void sst, void cid,
	74	struct buffer_if *buf)
	75	{
	76	struct tun *st=sst;
	77
	78	BUF_ASSERT_USED(buf);
c6f79b17 SE	79	/* No error checking, because we'd just throw the packet away
c6f79b17 SE	80	anyway if it didn't work. */
9d3a4132 SE	81	write(st->fd,buf->start,buf->size);
	82	BUF_FREE(buf);
	83	}
	84
	85	static bool_t tun_set_route(void sst, struct netlink_route route)
	86	{
	87	struct tun *st=sst;
	88	string_t network, mask, secnetaddr;
	89
	90	if (route->up != route->kup) {
	91	network=ipaddr_to_string(route->net.prefix);
	92	mask=ipaddr_to_string(route->net.mask);
	93	secnetaddr=ipaddr_to_string(st->nl.secnet_address);
	94	Message(M_INFO,"%s: %s route %s/%d %s kernel routing table\n",
	95	st->nl.name,route->up?"adding":"deleting",network,
	96	route->net.len,route->up?"to":"from");
	97	sys_cmd(st->route_path,"route",route->up?"add":"del","-net",network,
	98	"netmask",mask,"gw",secnetaddr,(char *)0);
	99	free(network); free(mask); free(secnetaddr);
	100	route->kup=route->up;
	101	return True;
	102	}
	103	return False;
	104	}
	105
	106	static void tun_phase_hook(void *sst, uint32_t newphase)
	107	{
	108	struct tun *st=sst;
	109	string_t hostaddr,secnetaddr;
	110	uint8_t mtu[6];
	111	string_t network,mask;
	112	struct netlink_route *r;
	113	int i;
	114
	115	if (st->tun_old) {
	116	if (st->search_for_if) {
	117	string_t dname;
	118	int i;
	119
	120	/* ASSERT st->interface_name */
	121	dname=safe_malloc(strlen(st->device_path)+4,"tun_old_apply");
	122	st->interface_name=safe_malloc(8,"tun_phase_hook");
	123
	124	for (i=0; i<255; i++) {
	125	sprintf(dname,"%s%d",st->device_path,i);
	126	if ((st->fd=open(dname,O_RDWR))>0) {
	127	sprintf(st->interface_name,"tun%d",i);
	128	Message(M_INFO,"%s: allocated network interface %s "
	129	"through %s\n",st->nl.name,st->interface_name,
	130	dname);
	131	break;
	132	}
	133	}
	134	if (st->fd==-1) {
	135	fatal("%s: unable to open any TUN device (%s...)\n",
	136	st->nl.name,st->device_path);
	137	}
	138	} else {
	139	st->fd=open(st->device_path,O_RDWR);
	140	if (st->fd==-1) {
	141	fatal_perror("%s: unable to open TUN device file %s",
	142	st->nl.name,st->device_path);
	143	}
	144	}
145	} else {
146	#ifdef HAVE_LINUX_IF_H
147	struct ifreq ifr;
148
149	/* New TUN interface: open the device, then do ioctl TUNSETIFF
150	to set or find out the network interface name. */
151	st->fd=open(st->device_path,O_RDWR);
152	if (st->fd==-1) {
153	fatal_perror("%s: can't open device file %s",st->nl.name,
154	st->device_path);
155	}
156	memset(&ifr,0,sizeof(ifr));
157	ifr.ifr_flags = IFF_TUN \| IFF_NO_PI; /* Just send/receive IP packets,
158	no extra headers */
159	if (st->interface_name)
160	strncpy(ifr.ifr_name,st->interface_name,IFNAMSIZ);
b2a56f7c	161	Message(M_DEBUG,"%s: about to ioctl(TUNSETIFF)...\n",st->nl.name);
9d3a4132 SE	162	if (ioctl(st->fd,TUNSETIFF,&ifr)<0) {
	163	fatal_perror("%s: ioctl(TUNSETIFF)",st->nl.name);
	164	}
	165	if (!st->interface_name) {
	166	st->interface_name=safe_malloc(strlen(ifr.ifr_name)+1,"tun_apply");
	167	strcpy(st->interface_name,ifr.ifr_name);
	168	Message(M_INFO,"%s: allocated network interface %s\n",st->nl.name,
	169	st->interface_name);
	170	}
	171	#else
	172	fatal("netlink.c:tun_phase_hook:!tun_old unexpected\n");
	173	#endif /* HAVE_LINUX_IF_H */
	174	}
	175	/* All the networks we'll be using have been registered. Invoke ifconfig
	176	to set the TUN device's address, and route to add routes to all
	177	our networks. */
	178
b2a56f7c	179	hostaddr=ipaddr_to_string(st->local_address);
9d3a4132 SE	180	secnetaddr=ipaddr_to_string(st->nl.secnet_address);
	181	snprintf(mtu,6,"%d",st->nl.mtu);
	182	mtu[5]=0;
	183
	184	sys_cmd(st->ifconfig_path,"ifconfig",st->interface_name,
	185	hostaddr,"netmask","255.255.255.255","-broadcast",
	186	"pointopoint",secnetaddr,"mtu",mtu,"up",(char *)0);
	187
	188	r=st->nl.routes;
	189	for (i=0; i<st->nl.n_routes; i++) {
	190	if (r[i].up && !r[i].kup) {
	191	network=ipaddr_to_string(r[i].net.prefix);
	192	mask=ipaddr_to_string(r[i].net.mask);
	193	sys_cmd(st->route_path,"route","add","-net",network,
	194	"netmask",mask,"gw",secnetaddr,(char *)0);
	195	r[i].kup=True;
	196	}
	197	}
	198
	199	/* Register for poll() */
	200	register_for_poll(st, tun_beforepoll, tun_afterpoll, 1, st->nl.name);
	201	}
	202
	203	#ifdef HAVE_LINUX_IF_H
	204	static list_t tun_apply(closure_t self, struct cloc loc, dict_t *context,
	205	list_t *args)
	206	{
	207	struct tun *st;
	208	item_t *item;
	209	dict_t *dict;
	210
	211	st=safe_malloc(sizeof(*st),"tun_apply");
	212
	213	/* First parameter must be a dict */
	214	item=list_elem(args,0);
	215	if (!item \|\| item->type!=t_dict)
	216	cfgfatal(loc,"tun","parameter must be a dictionary\n");
	217
	218	dict=item->data.dict;
	219
	220	st->netlink_to_tunnel=
	221	netlink_init(&st->nl,st,loc,dict,
	222	"netlink-tun",tun_set_route,tun_deliver_to_kernel);
	223
	224	st->tun_old=False;
	225	st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
	226	st->interface_name=dict_read_string(dict,"interface",False,
	227	"tun-netlink",loc);
	228	st->ifconfig_path=dict_read_string(dict,"ifconfig-path",
	229	False,"tun-netlink",loc);
	230	st->route_path=dict_read_string(dict,"route-path",
	231	False,"tun-netlink",loc);
	232
	233	if (!st->device_path) st->device_path="/dev/net/tun";
	234	if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
	235	if (!st->route_path) st->route_path="route";
	236	st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
b2a56f7c SE	237	st->local_address=string_to_ipaddr(
b2a56f7c SE	238	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");
9d3a4132 SE	239
	240	add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);
	241
	242	return new_closure(&st->nl.cl);
	243	}
	244	#endif /* HAVE_LINUX_IF_H */
	245
	246	static list_t tun_old_apply(closure_t self, struct cloc loc, dict_t *context,
	247	list_t *args)
	248	{
	249	struct tun *st;
	250	item_t *item;
	251	dict_t *dict;
	252
	253	st=safe_malloc(sizeof(*st),"tun_old_apply");
	254
9d3a4132 SE	255	/* First parameter must be a dict */
	256	item=list_elem(args,0);
	257	if (!item \|\| item->type!=t_dict)
	258	cfgfatal(loc,"tun","parameter must be a dictionary\n");
	259
	260	dict=item->data.dict;
	261
	262	st->netlink_to_tunnel=
	263	netlink_init(&st->nl,st,loc,dict,
	264	"netlink-tun",NULL,tun_deliver_to_kernel);
	265
	266	st->tun_old=True;
	267	st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
	268	st->interface_name=dict_read_string(dict,"interface",False,
	269	"tun-netlink",loc);
	270	st->search_for_if=dict_read_bool(dict,"interface-search",False,
	271	"tun-netlink",loc,st->device_path==NULL);
	272	st->ifconfig_path=dict_read_string(dict,"ifconfig-path",False,
	273	"tun-netlink",loc);
	274	st->route_path=dict_read_string(dict,"route-path",False,"tun-netlink",loc);
	275
	276	if (!st->device_path) st->device_path="/dev/tun";
	277	if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
	278	if (!st->route_path) st->route_path="route";
	279	st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
b2a56f7c SE	280	st->local_address=string_to_ipaddr(
b2a56f7c SE	281	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");
9d3a4132 SE	282
	283	/* Old TUN interface: the network interface name depends on which
	284	/dev/tunX file we open. If 'interface-search' is set to true, treat
	285	'device' as the prefix and try numbers from 0--255. If it's set
	286	to false, treat 'device' as the whole name, and require than an
	287	appropriate interface name be specified. */
	288	if (st->search_for_if && st->interface_name) {
	289	cfgfatal(loc,"tun-old","you may not specify an interface name "
	290	"in interface-search mode\n");
	291	}
	292	if (!st->search_for_if && !st->interface_name) {
	293	cfgfatal(loc,"tun-old","you must specify an interface name "
	294	"when you explicitly specify a TUN device file\n");
	295	}
	296
	297
	298	add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);
	299
	300	return new_closure(&st->nl.cl);
	301	}
	302
	303	init_module tun_module;
	304	void tun_module(dict_t *dict)
	305	{
	306	#ifdef HAVE_LINUX_IF_H
	307	add_closure(dict,"tun",tun_apply);
	308	#endif
	309	add_closure(dict,"tun-old",tun_old_apply);
	310	}