[secnet] / tun.c

#include "secnet.h"
#include "util.h"
#include "netlink.h"
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>

#ifdef HAVE_LINUX_IF_H
#include <linux/if.h>
#include <linux/if_tun.h>
#endif

/* XXX where do we find if_tun on other platforms? */

/* Connection to the kernel through the universal TUN/TAP driver */

struct tun {
    struct netlink nl;
    int fd;
    string_t device_path;
    string_t interface_name;
    string_t ifconfig_path;
    string_t route_path;
    bool_t tun_old;
    bool_t search_for_if; /* Applies to tun-old only */
    struct buffer_if *buff; /* We receive packets into here
			       and send them to the netlink code. */
    netlink_deliver_fn *netlink_to_tunnel;
    uint32_t local_address; /* host interface address */
};

static int tun_beforepoll(void *sst, struct pollfd *fds, int *nfds_io,
			  int *timeout_io, const struct timeval *tv_now,
			  uint64_t *now)
{
    struct tun *st=sst;
    *nfds_io=1;
    fds[0].fd=st->fd;
    fds[0].events=POLLIN|POLLERR|POLLHUP;
    return 0;
}

static void tun_afterpoll(void *sst, struct pollfd *fds, int nfds,
			    const struct timeval *tv_now, uint64_t *now)
{
    struct tun *st=sst;
    int l;

    if (fds[0].revents&POLLERR) {
	printf("tun_afterpoll: hup!\n");
    }
    if (fds[0].revents&POLLIN) {
	BUF_ALLOC(st->buff,"tun_afterpoll");
	buffer_init(st->buff,st->nl.max_start_pad);
	l=read(st->fd,st->buff->start,st->buff->len-st->nl.max_start_pad);
	if (l<0) {
	    fatal_perror("tun_afterpoll: read()");
	}
	if (l==0) {
	    fatal("tun_afterpoll: read()=0; device gone away?\n");
	}
	if (l>0) {
	    st->buff->size=l;
	    st->netlink_to_tunnel(&st->nl,NULL,st->buff);
	    BUF_ASSERT_FREE(st->buff);
	}
    }
}

static void tun_deliver_to_kernel(void *sst, void *cid,
				  struct buffer_if *buf)
{
    struct tun *st=sst;

    BUF_ASSERT_USED(buf);

    /* No error checking, because we'd just throw the packet away anyway */
    write(st->fd,buf->start,buf->size);
    BUF_FREE(buf);
}

static bool_t tun_set_route(void *sst, struct netlink_route *route)
{
    struct tun *st=sst;
    string_t network, mask, secnetaddr;

    if (route->up != route->kup) {
	network=ipaddr_to_string(route->net.prefix);
	mask=ipaddr_to_string(route->net.mask);
	secnetaddr=ipaddr_to_string(st->nl.secnet_address);
	Message(M_INFO,"%s: %s route %s/%d %s kernel routing table\n",
		st->nl.name,route->up?"adding":"deleting",network,
		route->net.len,route->up?"to":"from");
	sys_cmd(st->route_path,"route",route->up?"add":"del","-net",network,
		"netmask",mask,"gw",secnetaddr,(char *)0);
	free(network); free(mask); free(secnetaddr);
	route->kup=route->up;
	return True;
    }
    return False;
}

static void tun_phase_hook(void *sst, uint32_t newphase)
{
    struct tun *st=sst;
    string_t hostaddr,secnetaddr;
    uint8_t mtu[6];
    string_t network,mask;
    struct netlink_route *r;
    int i;

    if (st->tun_old) {
	if (st->search_for_if) {
	    string_t dname;
	    int i;

	    /* ASSERT st->interface_name */
	    dname=safe_malloc(strlen(st->device_path)+4,"tun_old_apply");
	    st->interface_name=safe_malloc(8,"tun_phase_hook");
	
	    for (i=0; i<255; i++) {
		sprintf(dname,"%s%d",st->device_path,i);
		if ((st->fd=open(dname,O_RDWR))>0) {
		    sprintf(st->interface_name,"tun%d",i);
		    Message(M_INFO,"%s: allocated network interface %s "
			    "through %s\n",st->nl.name,st->interface_name,
			    dname);
		    break;
		}
	    }
	    if (st->fd==-1) {
		fatal("%s: unable to open any TUN device (%s...)\n",
		      st->nl.name,st->device_path);
	    }
	} else {
	    st->fd=open(st->device_path,O_RDWR);
	    if (st->fd==-1) {
		fatal_perror("%s: unable to open TUN device file %s",
			     st->nl.name,st->device_path);
	    }
	}
    } else {
#ifdef HAVE_LINUX_IF_H
	struct ifreq ifr;

	/* New TUN interface: open the device, then do ioctl TUNSETIFF
	   to set or find out the network interface name. */
	st->fd=open(st->device_path,O_RDWR);
	if (st->fd==-1) {
	    fatal_perror("%s: can't open device file %s",st->nl.name,
			 st->device_path);
	}
	memset(&ifr,0,sizeof(ifr));
	ifr.ifr_flags = IFF_TUN | IFF_NO_PI; /* Just send/receive IP packets,
						no extra headers */
	if (st->interface_name)
	    strncpy(ifr.ifr_name,st->interface_name,IFNAMSIZ);
	Message(M_DEBUG,"%s: about to ioctl(TUNSETIFF)...\n",st->nl.name);
	if (ioctl(st->fd,TUNSETIFF,&ifr)<0) {
	    fatal_perror("%s: ioctl(TUNSETIFF)",st->nl.name);
	}
	if (!st->interface_name) {
	    st->interface_name=safe_malloc(strlen(ifr.ifr_name)+1,"tun_apply");
	    strcpy(st->interface_name,ifr.ifr_name);
	    Message(M_INFO,"%s: allocated network interface %s\n",st->nl.name,
		    st->interface_name);
	}
#else
	fatal("netlink.c:tun_phase_hook:!tun_old unexpected\n");
#endif /* HAVE_LINUX_IF_H */
    }
    /* All the networks we'll be using have been registered. Invoke ifconfig
       to set the TUN device's address, and route to add routes to all
       our networks. */

    hostaddr=ipaddr_to_string(st->local_address);
    secnetaddr=ipaddr_to_string(st->nl.secnet_address);
    snprintf(mtu,6,"%d",st->nl.mtu);
    mtu[5]=0;

    sys_cmd(st->ifconfig_path,"ifconfig",st->interface_name,
	    hostaddr,"netmask","255.255.255.255","-broadcast",
	    "pointopoint",secnetaddr,"mtu",mtu,"up",(char *)0);

    r=st->nl.routes;
    for (i=0; i<st->nl.n_routes; i++) {
	if (r[i].up && !r[i].kup) {
	    network=ipaddr_to_string(r[i].net.prefix);
	    mask=ipaddr_to_string(r[i].net.mask);
	    sys_cmd(st->route_path,"route","add","-net",network,
		    "netmask",mask,"gw",secnetaddr,(char *)0);
	    r[i].kup=True;
	}
    }

    /* Register for poll() */
    register_for_poll(st, tun_beforepoll, tun_afterpoll, 1, st->nl.name);
}

#ifdef HAVE_LINUX_IF_H
static list_t *tun_apply(closure_t *self, struct cloc loc, dict_t *context,
			 list_t *args)
{
    struct tun *st;
    item_t *item;
    dict_t *dict;

    st=safe_malloc(sizeof(*st),"tun_apply");

    /* First parameter must be a dict */
    item=list_elem(args,0);
    if (!item || item->type!=t_dict)
	cfgfatal(loc,"tun","parameter must be a dictionary\n");
    
    dict=item->data.dict;

    st->netlink_to_tunnel=
	netlink_init(&st->nl,st,loc,dict,
		     "netlink-tun",tun_set_route,tun_deliver_to_kernel);

    st->tun_old=False;
    st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
    st->interface_name=dict_read_string(dict,"interface",False,
					"tun-netlink",loc);
    st->ifconfig_path=dict_read_string(dict,"ifconfig-path",
				       False,"tun-netlink",loc);
    st->route_path=dict_read_string(dict,"route-path",
				    False,"tun-netlink",loc);

    if (!st->device_path) st->device_path="/dev/net/tun";
    if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
    if (!st->route_path) st->route_path="route";
    st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
    st->local_address=string_to_ipaddr(
	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");

    add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);

    return new_closure(&st->nl.cl);
}
#endif /* HAVE_LINUX_IF_H */

static list_t *tun_old_apply(closure_t *self, struct cloc loc, dict_t *context,
			     list_t *args)
{
    struct tun *st;
    item_t *item;
    dict_t *dict;

    st=safe_malloc(sizeof(*st),"tun_old_apply");

    Message(M_WARNING,"the tun-old code has never been tested. Please report "
	    "success or failure to steve@greenend.org.uk\n");

    /* First parameter must be a dict */
    item=list_elem(args,0);
    if (!item || item->type!=t_dict)
	cfgfatal(loc,"tun","parameter must be a dictionary\n");
    
    dict=item->data.dict;

    st->netlink_to_tunnel=
	netlink_init(&st->nl,st,loc,dict,
		     "netlink-tun",NULL,tun_deliver_to_kernel);

    st->tun_old=True;
    st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
    st->interface_name=dict_read_string(dict,"interface",False,
					"tun-netlink",loc);
    st->search_for_if=dict_read_bool(dict,"interface-search",False,
				     "tun-netlink",loc,st->device_path==NULL);
    st->ifconfig_path=dict_read_string(dict,"ifconfig-path",False,
				       "tun-netlink",loc);
    st->route_path=dict_read_string(dict,"route-path",False,"tun-netlink",loc);

    if (!st->device_path) st->device_path="/dev/tun";
    if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
    if (!st->route_path) st->route_path="route";
    st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
    st->local_address=string_to_ipaddr(
	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");

    /* Old TUN interface: the network interface name depends on which
       /dev/tunX file we open. If 'interface-search' is set to true, treat
       'device' as the prefix and try numbers from 0--255. If it's set
       to false, treat 'device' as the whole name, and require than an
       appropriate interface name be specified. */
    if (st->search_for_if && st->interface_name) {
	cfgfatal(loc,"tun-old","you may not specify an interface name "
		 "in interface-search mode\n");
    }
    if (!st->search_for_if && !st->interface_name) {
	cfgfatal(loc,"tun-old","you must specify an interface name "
		 "when you explicitly specify a TUN device file\n");
    }


    add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);

    return new_closure(&st->nl.cl);
}

init_module tun_module;
void tun_module(dict_t *dict)
{
#ifdef HAVE_LINUX_IF_H
    add_closure(dict,"tun",tun_apply);
#endif
    add_closure(dict,"tun-old",tun_old_apply);
}
Commit	Line	Data
9d3a4132 SE	1	#include "secnet.h"
	2	#include "util.h"
	3	#include "netlink.h"
	4	#include <stdio.h>
	5	#include <string.h>
	6	#include <unistd.h>
	7	#include <fcntl.h>
	8	#include <sys/ioctl.h>
	9
	10	#ifdef HAVE_LINUX_IF_H
	11	#include <linux/if.h>
	12	#include <linux/if_tun.h>
	13	#endif
	14
	15	/* XXX where do we find if_tun on other platforms? */
	16
	17	/* Connection to the kernel through the universal TUN/TAP driver */
	18
	19	struct tun {
	20	struct netlink nl;
	21	int fd;
	22	string_t device_path;
	23	string_t interface_name;
	24	string_t ifconfig_path;
	25	string_t route_path;
	26	bool_t tun_old;
	27	bool_t search_for_if; /* Applies to tun-old only */
	28	struct buffer_if buff; / We receive packets into here
	29	and send them to the netlink code. */
	30	netlink_deliver_fn *netlink_to_tunnel;
b2a56f7c	31	uint32_t local_address; /* host interface address */
9d3a4132 SE	32	};
	33
	34	static int tun_beforepoll(void sst, struct pollfd fds, int *nfds_io,
	35	int timeout_io, const struct timeval tv_now,
	36	uint64_t *now)
	37	{
	38	struct tun *st=sst;
	39	*nfds_io=1;
	40	fds[0].fd=st->fd;
	41	fds[0].events=POLLIN\|POLLERR\|POLLHUP;
	42	return 0;
	43	}
	44
	45	static void tun_afterpoll(void sst, struct pollfd fds, int nfds,
	46	const struct timeval tv_now, uint64_t now)
	47	{
	48	struct tun *st=sst;
	49	int l;
	50
	51	if (fds[0].revents&POLLERR) {
	52	printf("tun_afterpoll: hup!\n");
	53	}
	54	if (fds[0].revents&POLLIN) {
	55	BUF_ALLOC(st->buff,"tun_afterpoll");
	56	buffer_init(st->buff,st->nl.max_start_pad);
	57	l=read(st->fd,st->buff->start,st->buff->len-st->nl.max_start_pad);
	58	if (l<0) {
	59	fatal_perror("tun_afterpoll: read()");
	60	}
	61	if (l==0) {
	62	fatal("tun_afterpoll: read()=0; device gone away?\n");
	63	}
	64	if (l>0) {
	65	st->buff->size=l;
	66	st->netlink_to_tunnel(&st->nl,NULL,st->buff);
	67	BUF_ASSERT_FREE(st->buff);
	68	}
	69	}
	70	}
	71
	72	static void tun_deliver_to_kernel(void sst, void cid,
	73	struct buffer_if *buf)
	74	{
	75	struct tun *st=sst;
	76
	77	BUF_ASSERT_USED(buf);
	78
	79	/* No error checking, because we'd just throw the packet away anyway */
	80	write(st->fd,buf->start,buf->size);
	81	BUF_FREE(buf);
	82	}
	83
	84	static bool_t tun_set_route(void sst, struct netlink_route route)
	85	{
	86	struct tun *st=sst;
	87	string_t network, mask, secnetaddr;
	88
	89	if (route->up != route->kup) {
	90	network=ipaddr_to_string(route->net.prefix);
	91	mask=ipaddr_to_string(route->net.mask);
	92	secnetaddr=ipaddr_to_string(st->nl.secnet_address);
	93	Message(M_INFO,"%s: %s route %s/%d %s kernel routing table\n",
	94	st->nl.name,route->up?"adding":"deleting",network,
	95	route->net.len,route->up?"to":"from");
96	sys_cmd(st->route_path,"route",route->up?"add":"del","-net",network,
97	"netmask",mask,"gw",secnetaddr,(char *)0);
98	free(network); free(mask); free(secnetaddr);
99	route->kup=route->up;
100	return True;
101	}
102	return False;
103	}
104
105	static void tun_phase_hook(void *sst, uint32_t newphase)
106	{
107	struct tun *st=sst;
108	string_t hostaddr,secnetaddr;
109	uint8_t mtu[6];
110	string_t network,mask;
111	struct netlink_route *r;
112	int i;
113
114	if (st->tun_old) {
115	if (st->search_for_if) {
116	string_t dname;
117	int i;
118
119	/* ASSERT st->interface_name */
120	dname=safe_malloc(strlen(st->device_path)+4,"tun_old_apply");
121	st->interface_name=safe_malloc(8,"tun_phase_hook");
122
123	for (i=0; i<255; i++) {
124	sprintf(dname,"%s%d",st->device_path,i);
125	if ((st->fd=open(dname,O_RDWR))>0) {
126	sprintf(st->interface_name,"tun%d",i);
127	Message(M_INFO,"%s: allocated network interface %s "
128	"through %s\n",st->nl.name,st->interface_name,
129	dname);
130	break;
131	}
132	}
133	if (st->fd==-1) {
134	fatal("%s: unable to open any TUN device (%s...)\n",
135	st->nl.name,st->device_path);
136	}
137	} else {
138	st->fd=open(st->device_path,O_RDWR);
139	if (st->fd==-1) {
140	fatal_perror("%s: unable to open TUN device file %s",
141	st->nl.name,st->device_path);
142	}
143	}
144	} else {
145	#ifdef HAVE_LINUX_IF_H
146	struct ifreq ifr;
147
148	/* New TUN interface: open the device, then do ioctl TUNSETIFF
149	to set or find out the network interface name. */
150	st->fd=open(st->device_path,O_RDWR);
151	if (st->fd==-1) {
152	fatal_perror("%s: can't open device file %s",st->nl.name,
153	st->device_path);
154	}
155	memset(&ifr,0,sizeof(ifr));
156	ifr.ifr_flags = IFF_TUN \| IFF_NO_PI; /* Just send/receive IP packets,
157	no extra headers */
158	if (st->interface_name)
159	strncpy(ifr.ifr_name,st->interface_name,IFNAMSIZ);
b2a56f7c	160	Message(M_DEBUG,"%s: about to ioctl(TUNSETIFF)...\n",st->nl.name);
9d3a4132 SE	161	if (ioctl(st->fd,TUNSETIFF,&ifr)<0) {
	162	fatal_perror("%s: ioctl(TUNSETIFF)",st->nl.name);
	163	}
	164	if (!st->interface_name) {
	165	st->interface_name=safe_malloc(strlen(ifr.ifr_name)+1,"tun_apply");
	166	strcpy(st->interface_name,ifr.ifr_name);
	167	Message(M_INFO,"%s: allocated network interface %s\n",st->nl.name,
	168	st->interface_name);
	169	}
	170	#else
	171	fatal("netlink.c:tun_phase_hook:!tun_old unexpected\n");
	172	#endif /* HAVE_LINUX_IF_H */
	173	}
	174	/* All the networks we'll be using have been registered. Invoke ifconfig
	175	to set the TUN device's address, and route to add routes to all
	176	our networks. */
	177
b2a56f7c	178	hostaddr=ipaddr_to_string(st->local_address);
9d3a4132 SE	179	secnetaddr=ipaddr_to_string(st->nl.secnet_address);
	180	snprintf(mtu,6,"%d",st->nl.mtu);
	181	mtu[5]=0;
	182
	183	sys_cmd(st->ifconfig_path,"ifconfig",st->interface_name,
	184	hostaddr,"netmask","255.255.255.255","-broadcast",
	185	"pointopoint",secnetaddr,"mtu",mtu,"up",(char *)0);
	186
	187	r=st->nl.routes;
	188	for (i=0; i<st->nl.n_routes; i++) {
	189	if (r[i].up && !r[i].kup) {
	190	network=ipaddr_to_string(r[i].net.prefix);
	191	mask=ipaddr_to_string(r[i].net.mask);
	192	sys_cmd(st->route_path,"route","add","-net",network,
	193	"netmask",mask,"gw",secnetaddr,(char *)0);
	194	r[i].kup=True;
	195	}
	196	}
	197
	198	/* Register for poll() */
	199	register_for_poll(st, tun_beforepoll, tun_afterpoll, 1, st->nl.name);
	200	}
	201
	202	#ifdef HAVE_LINUX_IF_H
	203	static list_t tun_apply(closure_t self, struct cloc loc, dict_t *context,
	204	list_t *args)
	205	{
	206	struct tun *st;
	207	item_t *item;
	208	dict_t *dict;
	209
	210	st=safe_malloc(sizeof(*st),"tun_apply");
	211
	212	/* First parameter must be a dict */
	213	item=list_elem(args,0);
	214	if (!item \|\| item->type!=t_dict)
	215	cfgfatal(loc,"tun","parameter must be a dictionary\n");
	216
	217	dict=item->data.dict;
	218
	219	st->netlink_to_tunnel=
	220	netlink_init(&st->nl,st,loc,dict,
	221	"netlink-tun",tun_set_route,tun_deliver_to_kernel);
	222
	223	st->tun_old=False;
	224	st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
	225	st->interface_name=dict_read_string(dict,"interface",False,
	226	"tun-netlink",loc);
	227	st->ifconfig_path=dict_read_string(dict,"ifconfig-path",
	228	False,"tun-netlink",loc);
	229	st->route_path=dict_read_string(dict,"route-path",
	230	False,"tun-netlink",loc);
	231
	232	if (!st->device_path) st->device_path="/dev/net/tun";
	233	if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
	234	if (!st->route_path) st->route_path="route";
	235	st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
b2a56f7c SE	236	st->local_address=string_to_ipaddr(
b2a56f7c SE	237	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");
9d3a4132 SE	238
	239	add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);
	240
	241	return new_closure(&st->nl.cl);
	242	}
	243	#endif /* HAVE_LINUX_IF_H */
	244
	245	static list_t tun_old_apply(closure_t self, struct cloc loc, dict_t *context,
	246	list_t *args)
	247	{
	248	struct tun *st;
	249	item_t *item;
	250	dict_t *dict;
	251
	252	st=safe_malloc(sizeof(*st),"tun_old_apply");
	253
	254	Message(M_WARNING,"the tun-old code has never been tested. Please report "
	255	"success or failure to steve@greenend.org.uk\n");
	256
	257	/* First parameter must be a dict */
	258	item=list_elem(args,0);
	259	if (!item \|\| item->type!=t_dict)
	260	cfgfatal(loc,"tun","parameter must be a dictionary\n");
	261
	262	dict=item->data.dict;
	263
	264	st->netlink_to_tunnel=
	265	netlink_init(&st->nl,st,loc,dict,
	266	"netlink-tun",NULL,tun_deliver_to_kernel);
	267
	268	st->tun_old=True;
	269	st->device_path=dict_read_string(dict,"device",False,"tun-netlink",loc);
	270	st->interface_name=dict_read_string(dict,"interface",False,
	271	"tun-netlink",loc);
	272	st->search_for_if=dict_read_bool(dict,"interface-search",False,
	273	"tun-netlink",loc,st->device_path==NULL);
	274	st->ifconfig_path=dict_read_string(dict,"ifconfig-path",False,
	275	"tun-netlink",loc);
	276	st->route_path=dict_read_string(dict,"route-path",False,"tun-netlink",loc);
	277
	278	if (!st->device_path) st->device_path="/dev/tun";
	279	if (!st->ifconfig_path) st->ifconfig_path="ifconfig";
	280	if (!st->route_path) st->route_path="route";
	281	st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"tun-netlink",loc);
b2a56f7c SE	282	st->local_address=string_to_ipaddr(
b2a56f7c SE	283	dict_find_item(dict,"local-address", True, "netlink", loc),"netlink");
9d3a4132 SE	284
	285	/* Old TUN interface: the network interface name depends on which
	286	/dev/tunX file we open. If 'interface-search' is set to true, treat
	287	'device' as the prefix and try numbers from 0--255. If it's set
	288	to false, treat 'device' as the whole name, and require than an
	289	appropriate interface name be specified. */
	290	if (st->search_for_if && st->interface_name) {
	291	cfgfatal(loc,"tun-old","you may not specify an interface name "
	292	"in interface-search mode\n");
	293	}
	294	if (!st->search_for_if && !st->interface_name) {
	295	cfgfatal(loc,"tun-old","you must specify an interface name "
	296	"when you explicitly specify a TUN device file\n");
	297	}
	298
	299
	300	add_hook(PHASE_GETRESOURCES,tun_phase_hook,st);
	301
	302	return new_closure(&st->nl.cl);
	303	}
	304
	305	init_module tun_module;
	306	void tun_module(dict_t *dict)
	307	{
	308	#ifdef HAVE_LINUX_IF_H
	309	add_closure(dict,"tun",tun_apply);
	310	#endif
	311	add_closure(dict,"tun-old",tun_old_apply);
	312	}