mirror of
https://gitlab.com/openconnect/ocserv.git
synced 2026-02-10 16:57:00 +08:00
separated tun handling code from main worker code.
This commit is contained in:
Nikos Mavrogiannopoulos
@@ -14,7 +14,7 @@ CCAN_SOURCES = ccan/build_assert/build_assert.h ccan/check_type/check_type.h \
|
|||||||
|
|
||||||
|
|
||||||
ocserv_SOURCES = main.c main-auth.c worker-vpn.c worker-auth.c tlslib.c \
|
ocserv_SOURCES = main.c main-auth.c worker-vpn.c worker-auth.c tlslib.c \
|
||||||
http-parser/http_parser.c ipc.h cookies.c \
|
http-parser/http_parser.c ipc.h cookies.c worker-tun.c \
|
||||||
vpn.h cookies.h tlslib.h http-parser/http_parser.h log.c tun.c tun.h \
|
vpn.h cookies.h tlslib.h http-parser/http_parser.h log.c tun.c tun.h \
|
||||||
config.c pam.c pam.h worker-resume.c worker.h main-resume.c main.h \
|
config.c pam.c pam.h worker-resume.c worker.h main-resume.c main.h \
|
||||||
main-user.c cookies-gdbm.c cookies-hash.c $(CCAN_SOURCES)
|
main-user.c cookies-gdbm.c cookies-hash.c $(CCAN_SOURCES)
|
||||||
|
|||||||
238
src/worker-tun.c
Normal file
238
src/worker-tun.c
Normal file
@@ -0,0 +1,238 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (C) 2012, 2013 David Woodhouse
|
||||||
|
* Copyright (C) 2013 Nikos Mavrogiannopoulos
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <config.h>
|
||||||
|
|
||||||
|
#include <gnutls/gnutls.h>
|
||||||
|
#include <gnutls/dtls.h>
|
||||||
|
#include <gnutls/crypto.h>
|
||||||
|
#include <errno.h>
|
||||||
|
#include <stdlib.h>
|
||||||
|
#include <stdarg.h>
|
||||||
|
#include <stdio.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <sys/stat.h>
|
||||||
|
#include <fcntl.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
#include <limits.h>
|
||||||
|
#include <net/if.h>
|
||||||
|
#include <netinet/in.h>
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <sys/ioctl.h>
|
||||||
|
#include <sys/socket.h>
|
||||||
|
#include <arpa/inet.h>
|
||||||
|
#include <signal.h>
|
||||||
|
#include <time.h>
|
||||||
|
|
||||||
|
#include <vpn.h>
|
||||||
|
#include <worker.h>
|
||||||
|
#include <tlslib.h>
|
||||||
|
|
||||||
|
#include <http-parser/http_parser.h>
|
||||||
|
|
||||||
|
int set_tun_mtu(struct worker_st* ws, unsigned mtu)
|
||||||
|
{
|
||||||
|
int fd, ret, e;
|
||||||
|
struct ifreq ifr;
|
||||||
|
|
||||||
|
oclog(ws, LOG_DEBUG, "setting tun MTU to %u", mtu);
|
||||||
|
fd = socket(AF_INET, SOCK_STREAM, 0);
|
||||||
|
if (fd == -1)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
memset(&ifr, 0, sizeof(ifr));
|
||||||
|
snprintf(ifr.ifr_name, IFNAMSIZ, "%s", ws->tun_name);
|
||||||
|
ifr.ifr_mtu = mtu;
|
||||||
|
|
||||||
|
ret = ioctl(fd, SIOCSIFMTU, &ifr);
|
||||||
|
if (ret != 0) {
|
||||||
|
e = errno;
|
||||||
|
oclog(ws, LOG_INFO, "ioctl SIOCSIFMTU error: %s", strerror(e));
|
||||||
|
ret = -1;
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
fail:
|
||||||
|
close(fd);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* if local is non zero it returns the local, otherwise the remote */
|
||||||
|
static
|
||||||
|
int get_ip(struct worker_st* ws, int fd, int family, unsigned int local,
|
||||||
|
struct vpn_st* vinfo, char** buffer, size_t* buffer_size)
|
||||||
|
{
|
||||||
|
void* ptr;
|
||||||
|
const void* p;
|
||||||
|
struct ifreq ifr;
|
||||||
|
unsigned int flags;
|
||||||
|
int ret, e;
|
||||||
|
|
||||||
|
memset(&ifr, 0, sizeof(ifr));
|
||||||
|
ifr.ifr_addr.sa_family = family;
|
||||||
|
snprintf(ifr.ifr_name, IFNAMSIZ, "%s", vinfo->name);
|
||||||
|
|
||||||
|
if (local != 0)
|
||||||
|
flags = SIOCGIFDSTADDR;
|
||||||
|
else
|
||||||
|
flags = SIOCGIFADDR;
|
||||||
|
|
||||||
|
ret = ioctl(fd, flags, &ifr);
|
||||||
|
if (ret != 0) {
|
||||||
|
e = errno;
|
||||||
|
oclog(ws, LOG_DEBUG, "ioctl error: %s", strerror(e));
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (family == AF_INET) {
|
||||||
|
ptr = SA_IN_P(&ifr.ifr_addr);
|
||||||
|
} else if (family == AF_INET6) {
|
||||||
|
ptr = SA_IN6_P(&ifr.ifr_addr);
|
||||||
|
} else {
|
||||||
|
oclog(ws, LOG_DEBUG, "Unknown family!");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
p = inet_ntop(family, ptr, *buffer, *buffer_size);
|
||||||
|
if (p == NULL) {
|
||||||
|
e = errno;
|
||||||
|
oclog(ws, LOG_DEBUG, "inet_ntop error: %s", strerror(e));
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = strlen(p) + 1;
|
||||||
|
*buffer += ret;
|
||||||
|
*buffer_size -= ret;
|
||||||
|
|
||||||
|
if (family == AF_INET) {
|
||||||
|
if (strcmp(p, "0.0.0.0")==0)
|
||||||
|
p = NULL;
|
||||||
|
vinfo->ipv4 = p;
|
||||||
|
} else {
|
||||||
|
if (strcmp(p, "::")==0)
|
||||||
|
p = NULL;
|
||||||
|
vinfo->ipv6 = p;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
fail:
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Returns information based on an VPN network stored in worker_st but
|
||||||
|
* using real time information for many fields. Nothing is allocated,
|
||||||
|
* the provided buffer is used.
|
||||||
|
*
|
||||||
|
* Returns 0 on success.
|
||||||
|
*/
|
||||||
|
int get_rt_vpn_info(worker_st * ws,
|
||||||
|
struct vpn_st* vinfo, char* buffer, size_t buffer_size)
|
||||||
|
{
|
||||||
|
int fd, ret;
|
||||||
|
struct ifreq ifr;
|
||||||
|
|
||||||
|
memset(vinfo, 0, sizeof(*vinfo));
|
||||||
|
vinfo->name = ws->tun_name;
|
||||||
|
|
||||||
|
fd = socket(AF_INET, SOCK_STREAM, 0);
|
||||||
|
if (fd == -1)
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
/* get the remote IPs */
|
||||||
|
ret = get_ip(ws, fd, AF_INET6, 0, vinfo, &buffer, &buffer_size);
|
||||||
|
if (ret < 0)
|
||||||
|
oclog(ws, LOG_DEBUG, "Cannot obtain IPv6 remote IP for %s\n", vinfo->name);
|
||||||
|
|
||||||
|
ret = get_ip(ws, fd, AF_INET, 0, vinfo, &buffer, &buffer_size);
|
||||||
|
if (ret < 0)
|
||||||
|
oclog(ws, LOG_DEBUG, "Cannot obtain IPv4 remote IP for %s\n", vinfo->name);
|
||||||
|
|
||||||
|
if (vinfo->ipv4 == NULL && vinfo->ipv6 == NULL) {
|
||||||
|
ret = -1;
|
||||||
|
goto fail;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* get the local IPs */
|
||||||
|
ret = get_ip(ws, fd, AF_INET6, 1, vinfo, &buffer, &buffer_size);
|
||||||
|
if (ret < 0)
|
||||||
|
oclog(ws, LOG_DEBUG, "Cannot obtain IPv6 local IP for %s\n", vinfo->name);
|
||||||
|
|
||||||
|
ret = get_ip(ws, fd, AF_INET, 1, vinfo, &buffer, &buffer_size);
|
||||||
|
if (ret < 0)
|
||||||
|
oclog(ws, LOG_DEBUG, "Cannot obtain IPv4 local IP for %s\n", vinfo->name);
|
||||||
|
|
||||||
|
|
||||||
|
if (vinfo->ipv4_dns && strcmp(vinfo->ipv4_dns, "local") == 0)
|
||||||
|
vinfo->ipv4_dns = vinfo->ipv4_local;
|
||||||
|
else
|
||||||
|
vinfo->ipv4_dns = ws->config->network.ipv4_dns;
|
||||||
|
|
||||||
|
if (vinfo->ipv6_dns && strcmp(vinfo->ipv6_dns, "local") == 0)
|
||||||
|
vinfo->ipv6_dns = vinfo->ipv6_local;
|
||||||
|
else
|
||||||
|
vinfo->ipv6_dns = ws->config->network.ipv6_dns;
|
||||||
|
|
||||||
|
vinfo->routes_size = ws->config->network.routes_size;
|
||||||
|
if (ws->config->network.routes_size > 0)
|
||||||
|
vinfo->routes = ws->config->network.routes;
|
||||||
|
|
||||||
|
vinfo->ipv4_netmask = ws->config->network.ipv4_netmask;
|
||||||
|
vinfo->ipv6_netmask = ws->config->network.ipv6_netmask;
|
||||||
|
|
||||||
|
memset(&ifr, 0, sizeof(ifr));
|
||||||
|
ifr.ifr_addr.sa_family = AF_INET;
|
||||||
|
snprintf(ifr.ifr_name, IFNAMSIZ, "%s", vinfo->name);
|
||||||
|
ret = ioctl(fd, SIOCGIFMTU, (caddr_t)&ifr);
|
||||||
|
if (ret < 0) {
|
||||||
|
oclog(ws, LOG_ERR, "Cannot obtain MTU for %s. Assuming 1500", vinfo->name);
|
||||||
|
vinfo->mtu = 1500;
|
||||||
|
} else {
|
||||||
|
vinfo->mtu = ifr.ifr_mtu;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = 0;
|
||||||
|
fail:
|
||||||
|
close(fd);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
ssize_t tun_write(int sockfd, const void *buf, size_t len)
|
||||||
|
{
|
||||||
|
int left = len;
|
||||||
|
int ret;
|
||||||
|
const uint8_t * p = buf;
|
||||||
|
|
||||||
|
while(left > 0) {
|
||||||
|
ret = write(sockfd, p, left);
|
||||||
|
if (ret == -1) {
|
||||||
|
if (errno != EAGAIN && errno != EINTR)
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ret > 0) {
|
||||||
|
left -= ret;
|
||||||
|
p += ret;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return len;
|
||||||
|
}
|
||||||
|
|
||||||
188
src/worker-vpn.c
188
src/worker-vpn.c
@@ -440,194 +440,6 @@ finish:
|
|||||||
tls_close(session);
|
tls_close(session);
|
||||||
}
|
}
|
||||||
|
|
||||||
static int set_tun_mtu(struct worker_st* ws, unsigned mtu)
|
|
||||||
{
|
|
||||||
int fd, ret, e;
|
|
||||||
struct ifreq ifr;
|
|
||||||
|
|
||||||
oclog(ws, LOG_DEBUG, "setting tun MTU to %u", mtu);
|
|
||||||
fd = socket(AF_INET, SOCK_STREAM, 0);
|
|
||||||
if (fd == -1)
|
|
||||||
return -1;
|
|
||||||
|
|
||||||
memset(&ifr, 0, sizeof(ifr));
|
|
||||||
snprintf(ifr.ifr_name, IFNAMSIZ, "%s", ws->tun_name);
|
|
||||||
ifr.ifr_mtu = mtu;
|
|
||||||
|
|
||||||
ret = ioctl(fd, SIOCSIFMTU, &ifr);
|
|
||||||
if (ret != 0) {
|
|
||||||
e = errno;
|
|
||||||
oclog(ws, LOG_INFO, "ioctl SIOCSIFMTU error: %s", strerror(e));
|
|
||||||
ret = -1;
|
|
||||||
goto fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
ret = 0;
|
|
||||||
fail:
|
|
||||||
close(fd);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* if local is non zero it returns the local, otherwise the remote */
|
|
||||||
static int get_ip(struct worker_st* ws, int fd, int family, unsigned int local,
|
|
||||||
struct vpn_st* vinfo, char** buffer, size_t* buffer_size)
|
|
||||||
{
|
|
||||||
void* ptr;
|
|
||||||
const void* p;
|
|
||||||
struct ifreq ifr;
|
|
||||||
unsigned int flags;
|
|
||||||
int ret, e;
|
|
||||||
|
|
||||||
memset(&ifr, 0, sizeof(ifr));
|
|
||||||
ifr.ifr_addr.sa_family = family;
|
|
||||||
snprintf(ifr.ifr_name, IFNAMSIZ, "%s", vinfo->name);
|
|
||||||
|
|
||||||
if (local != 0)
|
|
||||||
flags = SIOCGIFDSTADDR;
|
|
||||||
else
|
|
||||||
flags = SIOCGIFADDR;
|
|
||||||
|
|
||||||
ret = ioctl(fd, flags, &ifr);
|
|
||||||
if (ret != 0) {
|
|
||||||
e = errno;
|
|
||||||
oclog(ws, LOG_DEBUG, "ioctl error: %s", strerror(e));
|
|
||||||
goto fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (family == AF_INET) {
|
|
||||||
ptr = SA_IN_P(&ifr.ifr_addr);
|
|
||||||
} else if (family == AF_INET6) {
|
|
||||||
ptr = SA_IN6_P(&ifr.ifr_addr);
|
|
||||||
} else {
|
|
||||||
oclog(ws, LOG_DEBUG, "Unknown family!");
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
p = inet_ntop(family, ptr, *buffer, *buffer_size);
|
|
||||||
if (p == NULL) {
|
|
||||||
e = errno;
|
|
||||||
oclog(ws, LOG_DEBUG, "inet_ntop error: %s", strerror(e));
|
|
||||||
goto fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
ret = strlen(p) + 1;
|
|
||||||
*buffer += ret;
|
|
||||||
*buffer_size -= ret;
|
|
||||||
|
|
||||||
if (family == AF_INET) {
|
|
||||||
if (strcmp(p, "0.0.0.0")==0)
|
|
||||||
p = NULL;
|
|
||||||
vinfo->ipv4 = p;
|
|
||||||
} else {
|
|
||||||
if (strcmp(p, "::")==0)
|
|
||||||
p = NULL;
|
|
||||||
vinfo->ipv6 = p;
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
fail:
|
|
||||||
return -1;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* Returns information based on an VPN network stored in worker_st but
|
|
||||||
* using real time information for many fields. Nothing is allocated,
|
|
||||||
* the provided buffer is used.
|
|
||||||
*
|
|
||||||
* Returns 0 on success.
|
|
||||||
*/
|
|
||||||
static int get_rt_vpn_info(worker_st * ws,
|
|
||||||
struct vpn_st* vinfo, char* buffer, size_t buffer_size)
|
|
||||||
{
|
|
||||||
int fd, ret;
|
|
||||||
struct ifreq ifr;
|
|
||||||
|
|
||||||
memset(vinfo, 0, sizeof(*vinfo));
|
|
||||||
vinfo->name = ws->tun_name;
|
|
||||||
|
|
||||||
fd = socket(AF_INET, SOCK_STREAM, 0);
|
|
||||||
if (fd == -1)
|
|
||||||
return -1;
|
|
||||||
|
|
||||||
/* get the remote IPs */
|
|
||||||
ret = get_ip(ws, fd, AF_INET6, 0, vinfo, &buffer, &buffer_size);
|
|
||||||
if (ret < 0)
|
|
||||||
oclog(ws, LOG_DEBUG, "Cannot obtain IPv6 remote IP for %s\n", vinfo->name);
|
|
||||||
|
|
||||||
ret = get_ip(ws, fd, AF_INET, 0, vinfo, &buffer, &buffer_size);
|
|
||||||
if (ret < 0)
|
|
||||||
oclog(ws, LOG_DEBUG, "Cannot obtain IPv4 remote IP for %s\n", vinfo->name);
|
|
||||||
|
|
||||||
if (vinfo->ipv4 == NULL && vinfo->ipv6 == NULL) {
|
|
||||||
ret = -1;
|
|
||||||
goto fail;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* get the local IPs */
|
|
||||||
ret = get_ip(ws, fd, AF_INET6, 1, vinfo, &buffer, &buffer_size);
|
|
||||||
if (ret < 0)
|
|
||||||
oclog(ws, LOG_DEBUG, "Cannot obtain IPv6 local IP for %s\n", vinfo->name);
|
|
||||||
|
|
||||||
ret = get_ip(ws, fd, AF_INET, 1, vinfo, &buffer, &buffer_size);
|
|
||||||
if (ret < 0)
|
|
||||||
oclog(ws, LOG_DEBUG, "Cannot obtain IPv4 local IP for %s\n", vinfo->name);
|
|
||||||
|
|
||||||
|
|
||||||
if (vinfo->ipv4_dns && strcmp(vinfo->ipv4_dns, "local") == 0)
|
|
||||||
vinfo->ipv4_dns = vinfo->ipv4_local;
|
|
||||||
else
|
|
||||||
vinfo->ipv4_dns = ws->config->network.ipv4_dns;
|
|
||||||
|
|
||||||
if (vinfo->ipv6_dns && strcmp(vinfo->ipv6_dns, "local") == 0)
|
|
||||||
vinfo->ipv6_dns = vinfo->ipv6_local;
|
|
||||||
else
|
|
||||||
vinfo->ipv6_dns = ws->config->network.ipv6_dns;
|
|
||||||
|
|
||||||
vinfo->routes_size = ws->config->network.routes_size;
|
|
||||||
if (ws->config->network.routes_size > 0)
|
|
||||||
vinfo->routes = ws->config->network.routes;
|
|
||||||
|
|
||||||
vinfo->ipv4_netmask = ws->config->network.ipv4_netmask;
|
|
||||||
vinfo->ipv6_netmask = ws->config->network.ipv6_netmask;
|
|
||||||
|
|
||||||
memset(&ifr, 0, sizeof(ifr));
|
|
||||||
ifr.ifr_addr.sa_family = AF_INET;
|
|
||||||
snprintf(ifr.ifr_name, IFNAMSIZ, "%s", vinfo->name);
|
|
||||||
ret = ioctl(fd, SIOCGIFMTU, (caddr_t)&ifr);
|
|
||||||
if (ret < 0) {
|
|
||||||
oclog(ws, LOG_ERR, "Cannot obtain MTU for %s. Assuming 1500", vinfo->name);
|
|
||||||
vinfo->mtu = 1500;
|
|
||||||
} else {
|
|
||||||
vinfo->mtu = ifr.ifr_mtu;
|
|
||||||
}
|
|
||||||
|
|
||||||
ret = 0;
|
|
||||||
fail:
|
|
||||||
close(fd);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
static ssize_t tun_write(int sockfd, const void *buf, size_t len)
|
|
||||||
{
|
|
||||||
int left = len;
|
|
||||||
int ret;
|
|
||||||
const uint8_t * p = buf;
|
|
||||||
|
|
||||||
while(left > 0) {
|
|
||||||
ret = write(sockfd, p, left);
|
|
||||||
if (ret == -1) {
|
|
||||||
if (errno != EAGAIN && errno != EINTR)
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (ret > 0) {
|
|
||||||
left -= ret;
|
|
||||||
p += ret;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return len;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* sets the provided value of mtu as bad,
|
/* sets the provided value of mtu as bad,
|
||||||
* and returns an estimation of good.
|
* and returns an estimation of good.
|
||||||
*
|
*
|
||||||
|
|||||||
@@ -89,4 +89,9 @@ struct req_data_st {
|
|||||||
void __attribute__ ((format(printf, 3, 4)))
|
void __attribute__ ((format(printf, 3, 4)))
|
||||||
oclog(const worker_st * server, int priority, const char *fmt, ...);
|
oclog(const worker_st * server, int priority, const char *fmt, ...);
|
||||||
|
|
||||||
|
int set_tun_mtu(struct worker_st* ws, unsigned mtu);
|
||||||
|
int get_rt_vpn_info(worker_st * ws,
|
||||||
|
struct vpn_st* vinfo, char* buffer, size_t buffer_size);
|
||||||
|
ssize_t tun_write(int sockfd, const void *buf, size_t len);
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|||||||
Reference in New Issue
Block a user