mirror of
https://github.com/OpenVPN/openvpn3.git
synced 2024-09-20 04:02:15 +02:00
Refactored Mac OS X tun handler (tuncli.hpp) by moving tun
interface management code into TunMac::Setup() (tunsetup.hpp). Added TunBuilderSetup::Config, Base, and Factory for use as a unix-portable abstraction layer for tun interface management code. Added Stop object pointer to Mac OS X tun config (TunMac::ClientConfig), so that tun management code can detect stop commands if it's blocking outside of outer asio::io_context.
This commit is contained in:
parent
57dccf4f9c
commit
0609c76c0b
@ -334,6 +334,7 @@ namespace openvpn {
|
||||
HTTPProxyTransport::Options::Ptr http_proxy_options;
|
||||
bool alt_proxy;
|
||||
bool dco;
|
||||
Stop stop;
|
||||
|
||||
asio::io_context* io_context;
|
||||
|
||||
@ -644,6 +645,7 @@ namespace openvpn {
|
||||
cc.tls_version_min_override = state->tls_version_min_override;
|
||||
cc.gui_version = state->gui_version;
|
||||
cc.extra_peer_info = state->extra_peer_info;
|
||||
cc.stop = &state->stop;
|
||||
#if defined(USE_TUN_BUILDER)
|
||||
cc.socket_protect = &state->socket_protect;
|
||||
cc.builder = this;
|
||||
@ -916,7 +918,10 @@ namespace openvpn {
|
||||
{
|
||||
ClientConnect::Ptr session = state->session;
|
||||
if (session)
|
||||
session->thread_safe_stop();
|
||||
{
|
||||
state->stop.stop();
|
||||
session->thread_safe_stop();
|
||||
}
|
||||
}
|
||||
|
||||
OPENVPN_CLIENT_EXPORT void OpenVPNClient::pause(const std::string& reason)
|
||||
|
@ -35,6 +35,7 @@
|
||||
#include <openvpn/common/size.hpp>
|
||||
#include <openvpn/common/platform.hpp>
|
||||
#include <openvpn/common/options.hpp>
|
||||
#include <openvpn/common/stop.hpp>
|
||||
#include <openvpn/frame/frame_init.hpp>
|
||||
#include <openvpn/pki/epkibase.hpp>
|
||||
#include <openvpn/crypto/cryptodcsel.hpp>
|
||||
@ -69,11 +70,14 @@
|
||||
#include <openvpn/tun/builder/client.hpp>
|
||||
#elif defined(OPENVPN_PLATFORM_LINUX) && !defined(OPENVPN_FORCE_TUN_NULL)
|
||||
#include <openvpn/tun/linux/client/tuncli.hpp>
|
||||
#ifdef OPENVPN_COMMAND_AGENT
|
||||
#include <openvpn/client/unix/cmdagent.hpp>
|
||||
#endif
|
||||
#elif defined(OPENVPN_PLATFORM_MAC) && !defined(OPENVPN_FORCE_TUN_NULL)
|
||||
#include <openvpn/tun/mac/client/tuncli.hpp>
|
||||
#include <openvpn/apple/maclife.hpp>
|
||||
#ifdef OPENVPN_COMMAND_AGENT
|
||||
#include <openvpn/client/mac/cmdagent.hpp>
|
||||
#include <openvpn/client/unix/cmdagent.hpp>
|
||||
#endif
|
||||
#elif defined(OPENVPN_PLATFORM_WIN) && !defined(OPENVPN_FORCE_TUN_NULL)
|
||||
#include <openvpn/tun/win/client/tuncli.hpp>
|
||||
@ -115,6 +119,7 @@ namespace openvpn {
|
||||
disable_client_cert = false;
|
||||
default_key_direction = -1;
|
||||
force_aes_cbc_ciphersuites = false;
|
||||
stop = nullptr;
|
||||
#if defined(USE_TUN_BUILDER)
|
||||
builder = nullptr;
|
||||
#endif
|
||||
@ -138,6 +143,7 @@ namespace openvpn {
|
||||
bool force_aes_cbc_ciphersuites;
|
||||
std::string tls_version_min_override;
|
||||
PeerInfo::Set::Ptr extra_peer_info;
|
||||
Stop* stop;
|
||||
|
||||
// callbacks -- must remain in scope for lifetime of ClientOptions object
|
||||
ExternalPKIBase* external_pki;
|
||||
@ -368,10 +374,11 @@ namespace openvpn {
|
||||
tunconf->tun_prop.mtu = tun_mtu;
|
||||
tunconf->frame = frame;
|
||||
tunconf->stats = cli_stats;
|
||||
tunconf->stop = config.stop;
|
||||
tunconf->enable_failsafe_block = config.tun_persist;
|
||||
client_lifecycle.reset(new MacLifeCycle);
|
||||
#ifdef OPENVPN_COMMAND_AGENT
|
||||
tunconf->tun_setup_factory = MacCommandAgent::new_agent(opt);
|
||||
tunconf->tun_setup_factory = UnixCommandAgent::new_agent(opt);
|
||||
#endif
|
||||
tun_factory = tunconf;
|
||||
}
|
||||
|
65
openvpn/tun/builder/setup.hpp
Normal file
65
openvpn/tun/builder/setup.hpp
Normal file
@ -0,0 +1,65 @@
|
||||
// OpenVPN -- An application to securely tunnel IP networks
|
||||
// over a single port, with support for SSL/TLS-based
|
||||
// session authentication and key exchange,
|
||||
// packet encryption, packet authentication, and
|
||||
// packet compression.
|
||||
//
|
||||
// Copyright (C) 2012-2015 OpenVPN Technologies, Inc.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License Version 3
|
||||
// as published by the Free Software Foundation.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program in the COPYING file.
|
||||
// If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
// Client tun setup base class for unix
|
||||
|
||||
#ifndef OPENVPN_TUN_BUILDER_SETUP_H
|
||||
#define OPENVPN_TUN_BUILDER_SETUP_H
|
||||
|
||||
#ifdef HAVE_JSONCPP
|
||||
#include "json/json.h"
|
||||
#endif
|
||||
|
||||
#include <openvpn/common/destruct.hpp>
|
||||
#include <openvpn/common/stop.hpp>
|
||||
#include <openvpn/tun/builder/capture.hpp>
|
||||
|
||||
namespace openvpn {
|
||||
namespace TunBuilderSetup {
|
||||
struct Config
|
||||
{
|
||||
#ifdef HAVE_JSONCPP
|
||||
virtual Json::Value to_json() = 0;
|
||||
virtual void from_json(const Json::Value& root, const std::string& title) = 0;
|
||||
#endif
|
||||
virtual ~Config() {}
|
||||
};
|
||||
|
||||
struct Base : public DestructorBase
|
||||
{
|
||||
typedef RCPtr<Base> Ptr;
|
||||
|
||||
virtual int establish(const TunBuilderCapture& pull,
|
||||
Config* config,
|
||||
Stop* stop,
|
||||
std::ostream& os) = 0;
|
||||
};
|
||||
|
||||
struct Factory : public RC<thread_unsafe_refcount>
|
||||
{
|
||||
typedef RCPtr<Factory> Ptr;
|
||||
|
||||
virtual Base::Ptr new_setup_obj() = 0;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
#endif
|
@ -30,22 +30,16 @@
|
||||
|
||||
#include <openvpn/common/format.hpp>
|
||||
#include <openvpn/common/scoped_asio_stream.hpp>
|
||||
#include <openvpn/common/process.hpp>
|
||||
#include <openvpn/common/action.hpp>
|
||||
#include <openvpn/common/cleanup.hpp>
|
||||
#include <openvpn/tun/client/tunbase.hpp>
|
||||
#include <openvpn/tun/client/tunprop.hpp>
|
||||
#include <openvpn/tun/persist/tunwrap.hpp>
|
||||
#include <openvpn/tun/persist/tunwrapasio.hpp>
|
||||
#include <openvpn/tun/tunio.hpp>
|
||||
#include <openvpn/tun/layer.hpp>
|
||||
#include <openvpn/tun/mac/tunutil.hpp>
|
||||
#include <openvpn/tun/mac/utun.hpp>
|
||||
#include <openvpn/tun/mac/macgw.hpp>
|
||||
#include <openvpn/tun/mac/macdns_watchdog.hpp>
|
||||
#include <openvpn/tun/mac/client/tunsetup.hpp>
|
||||
|
||||
#ifdef TEST_EER // test emulated exclude routes
|
||||
#include <openvpn/client/cliemuexr.hpp>
|
||||
#include <openvpn/tun/builder/rgwflags.hpp>
|
||||
#endif
|
||||
|
||||
namespace openvpn {
|
||||
@ -53,125 +47,6 @@ namespace openvpn {
|
||||
|
||||
OPENVPN_EXCEPTION(tun_mac_error);
|
||||
|
||||
enum { // add_del_route flags
|
||||
R_IPv6=(1<<0),
|
||||
R_IFACE=(1<<1),
|
||||
R_IFACE_HINT=(1<<2),
|
||||
R_ONLINK=(1<<3),
|
||||
R_REJECT=(1<<4),
|
||||
R_BLACKHOLE=(1<<5),
|
||||
};
|
||||
|
||||
inline void add_del_route(const std::string& addr_str,
|
||||
const int prefix_len,
|
||||
const std::string& gateway_str,
|
||||
const std::string& iface,
|
||||
const unsigned int flags,
|
||||
Action::Ptr& create,
|
||||
Action::Ptr& destroy)
|
||||
{
|
||||
if (flags & R_IPv6)
|
||||
{
|
||||
const IPv6::Addr addr = IPv6::Addr::from_string(addr_str);
|
||||
const IPv6::Addr netmask = IPv6::Addr::netmask_from_prefix_len(prefix_len);
|
||||
const IPv6::Addr net = addr & netmask;
|
||||
|
||||
Command::Ptr add(new Command);
|
||||
add->argv.push_back("/sbin/route");
|
||||
add->argv.push_back("add");
|
||||
add->argv.push_back("-net");
|
||||
add->argv.push_back("-inet6");
|
||||
add->argv.push_back(net.to_string());
|
||||
add->argv.push_back("-prefixlen");
|
||||
add->argv.push_back(to_string(prefix_len));
|
||||
if (flags & R_REJECT)
|
||||
add->argv.push_back("-reject");
|
||||
if (flags & R_BLACKHOLE)
|
||||
add->argv.push_back("-blackhole");
|
||||
if (!iface.empty())
|
||||
{
|
||||
if (flags & R_IFACE)
|
||||
{
|
||||
add->argv.push_back("-iface");
|
||||
add->argv.push_back(iface);
|
||||
}
|
||||
}
|
||||
if (!gateway_str.empty() && !(flags & R_IFACE))
|
||||
{
|
||||
std::string g = gateway_str;
|
||||
if (flags & R_IFACE_HINT)
|
||||
g += '%' + iface;
|
||||
add->argv.push_back(g);
|
||||
}
|
||||
create = add;
|
||||
|
||||
// for the destroy command, copy the add command but replace "add" with "delete"
|
||||
Command::Ptr del(add->copy());
|
||||
del->argv[1] = "delete";
|
||||
destroy = del;
|
||||
}
|
||||
else
|
||||
{
|
||||
const IPv4::Addr addr = IPv4::Addr::from_string(addr_str);
|
||||
const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(prefix_len);
|
||||
const IPv4::Addr net = addr & netmask;
|
||||
|
||||
Command::Ptr add(new Command);
|
||||
add->argv.push_back("/sbin/route");
|
||||
add->argv.push_back("add");
|
||||
if (flags & R_ONLINK)
|
||||
{
|
||||
add->argv.push_back("-cloning");
|
||||
add->argv.push_back("-net");
|
||||
add->argv.push_back(net.to_string());
|
||||
add->argv.push_back("-netmask");
|
||||
add->argv.push_back(netmask.to_string());
|
||||
add->argv.push_back("-interface");
|
||||
add->argv.push_back(iface);
|
||||
}
|
||||
else
|
||||
{
|
||||
add->argv.push_back("-net");
|
||||
add->argv.push_back(net.to_string());
|
||||
add->argv.push_back("-netmask");
|
||||
add->argv.push_back(netmask.to_string());
|
||||
if (flags & R_REJECT)
|
||||
add->argv.push_back("-reject");
|
||||
if (flags & R_BLACKHOLE)
|
||||
add->argv.push_back("-blackhole");
|
||||
if (!iface.empty())
|
||||
{
|
||||
if (flags & R_IFACE)
|
||||
{
|
||||
add->argv.push_back("-iface");
|
||||
add->argv.push_back(iface);
|
||||
}
|
||||
}
|
||||
add->argv.push_back(gateway_str);
|
||||
}
|
||||
create = add;
|
||||
|
||||
// for the destroy command, copy the add command but replace "add" with "delete"
|
||||
Command::Ptr del(add->copy());
|
||||
del->argv[1] = "delete";
|
||||
destroy = del;
|
||||
}
|
||||
}
|
||||
|
||||
inline void add_del_route(const std::string& addr_str,
|
||||
const int prefix_len,
|
||||
const std::string& gateway_str,
|
||||
const std::string& iface,
|
||||
const unsigned int flags,
|
||||
ActionList& create,
|
||||
ActionList& destroy)
|
||||
{
|
||||
Action::Ptr c, d;
|
||||
add_del_route(addr_str, prefix_len, gateway_str, iface, flags, c, d);
|
||||
create.add(c);
|
||||
destroy.add(d);
|
||||
}
|
||||
|
||||
// struct used to pass received tun packets
|
||||
struct PacketFrom
|
||||
{
|
||||
@ -209,255 +84,33 @@ namespace openvpn {
|
||||
typedef ScopedAsioStream<TUNStream> ScopedTUNStream;
|
||||
typedef TunWrapTemplate<ScopedTUNStream> TunWrap;
|
||||
|
||||
// Failsafe blocker. Try to prevent leakage of unencrypted data
|
||||
// to internet during pause/reconnect states.
|
||||
class FailsafeBlock : public RC<thread_unsafe_refcount>
|
||||
{
|
||||
public:
|
||||
typedef RCPtr<FailsafeBlock> Ptr;
|
||||
|
||||
FailsafeBlock()
|
||||
: halt(false),
|
||||
block_v4(false),
|
||||
block_v6(false),
|
||||
block_v6_public(false)
|
||||
{
|
||||
}
|
||||
|
||||
~FailsafeBlock()
|
||||
{
|
||||
finalize(true);
|
||||
}
|
||||
|
||||
const bool ip_hole_punch_exists(const Action::Ptr& action)
|
||||
{
|
||||
if (ip_hole_punch_added)
|
||||
return ip_hole_punch_added->exists(action);
|
||||
else
|
||||
return false;
|
||||
}
|
||||
|
||||
void init()
|
||||
{
|
||||
block_v4 = false;
|
||||
block_v6 = false;
|
||||
dns.reset();
|
||||
}
|
||||
|
||||
void add_dns(const MacDNS::Config::Ptr& dns_arg)
|
||||
{
|
||||
dns = dns_arg;
|
||||
}
|
||||
|
||||
void add_block_v4()
|
||||
{
|
||||
block_v4 = true;
|
||||
}
|
||||
|
||||
void add_block_v6()
|
||||
{
|
||||
block_v6 = true;
|
||||
}
|
||||
|
||||
void add_block_v6_public()
|
||||
{
|
||||
block_v6_public = true;
|
||||
}
|
||||
|
||||
void ip_hole_punch(const IP::Addr& addr)
|
||||
{
|
||||
if (!halt && (((addr.version() == IP::Addr::V4) && block_v4_teardown)
|
||||
|| ((addr.version() == IP::Addr::V6) && block_v6_teardown)))
|
||||
{
|
||||
if (!ip_hole_punch_added)
|
||||
ip_hole_punch_added.reset(new ActionList);
|
||||
if (!ip_hole_punch_teardown)
|
||||
ip_hole_punch_teardown.reset(new ActionList);
|
||||
|
||||
Action::Ptr create, destroy;
|
||||
MacGWInfo gw;
|
||||
if (addr.version() == IP::Addr::V4)
|
||||
{
|
||||
if (gw.v4.defined())
|
||||
add_del_route(addr.to_string(), 32, gw.v4.router.to_string(), gw.v4.iface, 0, create, destroy);
|
||||
else
|
||||
OPENVPN_LOG("FailsafeBlock::ip_hole_punch: IPv4 gateway undefined");
|
||||
}
|
||||
else if (addr.version() == IP::Addr::V6)
|
||||
{
|
||||
if (gw.v6.defined())
|
||||
add_del_route(addr.to_string(), 128, gw.v6.router.to_string(), gw.v6.iface, R_IPv6|R_IFACE_HINT, create, destroy);
|
||||
else
|
||||
OPENVPN_LOG("FailsafeBlock::ip_hole_punch: IPv6 gateway undefined");
|
||||
}
|
||||
|
||||
if (!ip_hole_punch_added->exists(create))
|
||||
{
|
||||
ip_hole_punch_added->add(create);
|
||||
ip_hole_punch_teardown->add(destroy);
|
||||
|
||||
ActionList::Ptr add_cmds = new ActionList();
|
||||
add_cmds->add(create);
|
||||
add_cmds->execute(std::cout); // fixme
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void establish(ActionList& create, ActionList& destroy)
|
||||
{
|
||||
if (!halt)
|
||||
{
|
||||
// block IPv4
|
||||
if (block_v4 && !block_v4_teardown)
|
||||
{
|
||||
block_v4_teardown.reset(new ActionList);
|
||||
add_del_route("0.0.0.0", 1, "127.0.0.1", "lo0", R_BLACKHOLE, create, *block_v4_teardown);
|
||||
add_del_route("128.0.0.0", 1, "127.0.0.1", "lo0", R_BLACKHOLE, create, *block_v4_teardown);
|
||||
}
|
||||
else if (!block_v4 && block_v4_teardown)
|
||||
{
|
||||
create.add(*block_v4_teardown);
|
||||
block_v4_teardown.reset();
|
||||
}
|
||||
|
||||
// block IPv6
|
||||
if ((block_v6 || block_v6_public) && !block_v6_teardown)
|
||||
{
|
||||
block_v6_teardown.reset(new ActionList);
|
||||
if (block_v6_public)
|
||||
{
|
||||
add_del_route("2000::", 4, "::1", "lo0", R_IPv6|R_REJECT|R_IFACE_HINT, create, *block_v6_teardown);
|
||||
add_del_route("3000::", 4, "::1", "lo0", R_IPv6|R_REJECT|R_IFACE_HINT, create, *block_v6_teardown);
|
||||
add_del_route("fc00::", 7, "::1", "lo0", R_IPv6|R_REJECT|R_IFACE_HINT, create, *block_v6_teardown);
|
||||
}
|
||||
else
|
||||
{
|
||||
#if 0 // fixme -- strangely, this code blocks ALL subsequently added routes, even with higher prefix lengths!
|
||||
add_del_route("0000::", 1, "::1", "lo0", R_IPv6|R_BLACKHOLE|R_IFACE_HINT, create, *block_v6_teardown);
|
||||
add_del_route("8000::", 1, "::1", "lo0", R_IPv6|R_BLACKHOLE|R_IFACE_HINT, create, *block_v6_teardown);
|
||||
#endif
|
||||
}
|
||||
}
|
||||
else if (!(block_v6 || block_v6_public) && block_v6_teardown)
|
||||
{
|
||||
create.add(*block_v6_teardown);
|
||||
block_v6_teardown.reset();
|
||||
}
|
||||
|
||||
// IP hole punch
|
||||
if (ip_hole_punch_teardown)
|
||||
{
|
||||
destroy.add(*ip_hole_punch_teardown);
|
||||
ip_hole_punch_teardown.reset();
|
||||
ip_hole_punch_added.reset();
|
||||
}
|
||||
|
||||
// DNS
|
||||
if (dns || dns_watchdog)
|
||||
{
|
||||
if (!dns_watchdog)
|
||||
dns_watchdog.reset(new MacDNSWatchdog);
|
||||
MacDNSWatchdog::DNSAction::Ptr da(new MacDNSWatchdog::DNSAction(dns_watchdog, dns, MacDNSWatchdog::FLUSH_RECONFIG));
|
||||
create.add(da);
|
||||
teardown_dns = MacDNS::Config::block(dns.get());
|
||||
}
|
||||
else
|
||||
teardown_dns.reset();
|
||||
}
|
||||
}
|
||||
|
||||
void finalize(const bool disconnected)
|
||||
{
|
||||
if (!halt)
|
||||
{
|
||||
halt = disconnected;
|
||||
ActionList::Ptr cmds = new ActionList();
|
||||
|
||||
// IP hole punch
|
||||
if (ip_hole_punch_teardown)
|
||||
{
|
||||
cmds->add(*ip_hole_punch_teardown);
|
||||
ip_hole_punch_teardown.reset();
|
||||
ip_hole_punch_added.reset();
|
||||
}
|
||||
|
||||
if (disconnected)
|
||||
{
|
||||
// block IPv4
|
||||
if (block_v4_teardown)
|
||||
{
|
||||
cmds->add(*block_v4_teardown);
|
||||
block_v4_teardown.reset();
|
||||
}
|
||||
|
||||
// block IPv6
|
||||
if (block_v6_teardown)
|
||||
{
|
||||
cmds->add(*block_v6_teardown);
|
||||
block_v6_teardown.reset();
|
||||
}
|
||||
|
||||
// DNS
|
||||
teardown_dns.reset();
|
||||
}
|
||||
|
||||
// DNS
|
||||
if (dns_watchdog)
|
||||
{
|
||||
MacDNSWatchdog::DNSAction::Ptr da(new MacDNSWatchdog::DNSAction(dns_watchdog,
|
||||
teardown_dns,
|
||||
teardown_dns ? 0 : MacDNSWatchdog::FLUSH_RECONFIG));
|
||||
cmds->add(da);
|
||||
}
|
||||
|
||||
// execute commands
|
||||
cmds->execute(std::cout); // fixme
|
||||
}
|
||||
}
|
||||
|
||||
private:
|
||||
bool halt;
|
||||
|
||||
bool block_v4;
|
||||
bool block_v6;
|
||||
bool block_v6_public;
|
||||
MacDNS::Config::Ptr dns;
|
||||
MacDNS::Config::Ptr teardown_dns;
|
||||
|
||||
MacDNSWatchdog::Ptr dns_watchdog;
|
||||
ActionList::Ptr ip_hole_punch_added;
|
||||
ActionList::Ptr ip_hole_punch_teardown;
|
||||
ActionList::Ptr block_v4_teardown;
|
||||
ActionList::Ptr block_v6_teardown;
|
||||
};
|
||||
|
||||
class Client;
|
||||
|
||||
class ClientConfig : public TunClientFactory
|
||||
{
|
||||
friend class Client; // accesses fsblock
|
||||
|
||||
public:
|
||||
typedef RCPtr<ClientConfig> Ptr;
|
||||
|
||||
Layer layer; // OSI layer
|
||||
|
||||
TunProp::Config tun_prop;
|
||||
int n_parallel; // number of parallel async reads on tun socket
|
||||
int n_parallel = 8; // number of parallel async reads on tun socket
|
||||
|
||||
bool enable_failsafe_block;
|
||||
bool enable_failsafe_block = false;
|
||||
|
||||
Frame::Ptr frame;
|
||||
SessionStats::Ptr stats;
|
||||
|
||||
ActionListFactory::Ptr action_list_factory;
|
||||
Stop* stop = nullptr;
|
||||
|
||||
ActionList::Ptr new_action_list()
|
||||
TunBuilderSetup::Factory::Ptr tun_setup_factory;
|
||||
|
||||
TunBuilderSetup::Base::Ptr new_setup_obj()
|
||||
{
|
||||
if (action_list_factory)
|
||||
return action_list_factory->new_action_list();
|
||||
if (tun_setup_factory)
|
||||
return tun_setup_factory->new_setup_obj();
|
||||
else
|
||||
return new ActionList();
|
||||
return new TunMac::Setup();
|
||||
}
|
||||
|
||||
static Ptr new_obj()
|
||||
@ -482,23 +135,7 @@ namespace openvpn {
|
||||
// called just prior to transmission of Disconnect event
|
||||
virtual void finalize(const bool disconnected)
|
||||
{
|
||||
if (fsblock)
|
||||
fsblock->finalize(disconnected);
|
||||
}
|
||||
|
||||
// Called just prior to transport layer opening up a socket to addr.
|
||||
// Allows the implementation to ensure connectivity for outgoing
|
||||
// transport connection to server.
|
||||
virtual void ip_hole_punch(const IP::Addr& addr)
|
||||
{
|
||||
if (fsblock)
|
||||
fsblock->ip_hole_punch(addr);
|
||||
}
|
||||
|
||||
private:
|
||||
ClientConfig() : n_parallel(8) {}
|
||||
|
||||
FailsafeBlock::Ptr fsblock;
|
||||
};
|
||||
|
||||
class Client : public TunClient
|
||||
@ -517,7 +154,6 @@ namespace openvpn {
|
||||
tun_wrap.reset(new TunWrap(false));
|
||||
|
||||
try {
|
||||
bool tun_prefix = false;
|
||||
const IP::Addr server_addr = transcli.server_endpoint_addr();
|
||||
|
||||
// notify parent
|
||||
@ -543,85 +179,35 @@ namespace openvpn {
|
||||
if (!po->mtu)
|
||||
po->mtu = 1500;
|
||||
|
||||
OPENVPN_LOG("CAPTURED OPTIONS:" << std::endl << po->to_string()); // fixme
|
||||
OPENVPN_LOG("CAPTURED OPTIONS:" << std::endl << po->to_string());
|
||||
|
||||
// Open tun device. Try Mac OS X integrated utun device first
|
||||
// (layer 3 only). If utun fails and MAC_TUNTAP_FALLBACK is defined,
|
||||
// then fall back to TunTap third-party device.
|
||||
// If successful, state->iface_name will be set to tun iface name.
|
||||
// create new tun setup object
|
||||
tun_setup = config->new_setup_obj();
|
||||
|
||||
// create config object for tun setup layer
|
||||
Setup::Config tsconf;
|
||||
tsconf.iface_name = state->iface_name;
|
||||
tsconf.layer = config->layer;
|
||||
|
||||
// open/config tun
|
||||
int fd = -1;
|
||||
try {
|
||||
# if defined(MAC_TUNTAP_FALLBACK)
|
||||
# if !defined(ASIO_DISABLE_KQUEUE)
|
||||
# error Mac OS X TunTap adapter is incompatible with kqueue; rebuild with ASIO_DISABLE_KQUEUE
|
||||
# endif
|
||||
if (config->layer() == Layer::OSI_LAYER_3)
|
||||
{
|
||||
try {
|
||||
fd = UTun::utun_open(state->iface_name);
|
||||
tun_prefix = true;
|
||||
}
|
||||
catch (const std::exception& e)
|
||||
{
|
||||
OPENVPN_LOG(e.what());
|
||||
}
|
||||
}
|
||||
if (fd == -1)
|
||||
fd = Util::tuntap_open(config->layer, state->iface_name);
|
||||
# else
|
||||
fd = UTun::utun_open(state->iface_name);
|
||||
tun_prefix = true;
|
||||
# endif
|
||||
{
|
||||
std::ostringstream os;
|
||||
auto os_print = Cleanup([&os](){ OPENVPN_LOG_STRING(os.str()); });
|
||||
fd = tun_setup->establish(*po, &tsconf, config->stop, os);
|
||||
}
|
||||
catch (const std::exception& e)
|
||||
{
|
||||
parent.tun_error(Error::TUN_IFACE_CREATE, e.what());
|
||||
return;
|
||||
}
|
||||
|
||||
OPENVPN_LOG("open " << state->iface_name << " SUCCEEDED");
|
||||
|
||||
// create ASIO wrapper for tun fd
|
||||
tun_wrap->save_replace_sock(new TUNStream(io_context, fd));
|
||||
|
||||
// initialize failsafe blocker
|
||||
if (config->enable_failsafe_block && !config->fsblock)
|
||||
config->fsblock.reset(new FailsafeBlock);
|
||||
FailsafeBlock* fsblock = config->fsblock.get();
|
||||
|
||||
// configure tun/tap interface properties
|
||||
ActionList::Ptr add_cmds = config->new_action_list();
|
||||
remove_cmds = config->new_action_list();
|
||||
|
||||
// configure tun properties
|
||||
tun_config(state->iface_name, *po, fsblock, *add_cmds, *remove_cmds);
|
||||
|
||||
// configure DNS
|
||||
{
|
||||
MacDNS::Config::Ptr dns(new MacDNS::Config(*po));
|
||||
if (fsblock)
|
||||
fsblock->add_dns(dns);
|
||||
else
|
||||
MacDNSWatchdog::add_actions(dns, MacDNSWatchdog::FLUSH_RECONFIG, *add_cmds, *remove_cmds);
|
||||
}
|
||||
|
||||
// configure failsafe blocker
|
||||
if (fsblock)
|
||||
fsblock->establish(*add_cmds, *remove_cmds);
|
||||
|
||||
// execute the add actions to bring up interface
|
||||
if (!execute_actions(*add_cmds))
|
||||
return;
|
||||
|
||||
// now that the add actions have succeeded,
|
||||
// enable the remove actions
|
||||
remove_cmds->enable_destroy(true);
|
||||
tun_wrap->add_destructor(remove_cmds);
|
||||
// enable tun_setup destructor
|
||||
tun_wrap->add_destructor(tun_setup);
|
||||
|
||||
// configure tun interface packet forwarding
|
||||
impl.reset(new TunImpl(tun_wrap,
|
||||
state->iface_name,
|
||||
tsconf.iface_name,
|
||||
true,
|
||||
tun_prefix,
|
||||
tsconf.tun_prefix,
|
||||
this,
|
||||
config->frame,
|
||||
config->stats
|
||||
@ -636,7 +222,11 @@ namespace openvpn {
|
||||
if (tun_wrap)
|
||||
tun_wrap->close();
|
||||
stop();
|
||||
parent.tun_error(Error::TUN_SETUP_FAILED, e.what());
|
||||
Error::Type err = Error::TUN_SETUP_FAILED;
|
||||
const ExceptionCode *ec = dynamic_cast<const ExceptionCode *>(&e);
|
||||
if (ec && ec->code_defined())
|
||||
err = ec->code();
|
||||
parent.tun_error(err, e.what());
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -689,200 +279,6 @@ namespace openvpn {
|
||||
{
|
||||
}
|
||||
|
||||
bool execute_actions(ActionList& actions)
|
||||
{
|
||||
std::ostringstream os;
|
||||
try {
|
||||
actions.execute(os);
|
||||
}
|
||||
catch (const std::exception& e)
|
||||
{
|
||||
OPENVPN_LOG_STRING(os.str());
|
||||
parent.tun_error(Error::TUN_SETUP_FAILED, e.what());
|
||||
return false;
|
||||
}
|
||||
OPENVPN_LOG_STRING(os.str());
|
||||
return true;
|
||||
}
|
||||
|
||||
static void tun_config(const std::string& iface_name,
|
||||
const TunBuilderCapture& pull,
|
||||
FailsafeBlock* fsblock,
|
||||
ActionList& create,
|
||||
ActionList& destroy)
|
||||
{
|
||||
// get default gateway
|
||||
MacGWInfo gw;
|
||||
|
||||
// set local4 and local6 to point to IPv4/6 route configurations
|
||||
const TunBuilderCapture::Route* local4 = nullptr;
|
||||
const TunBuilderCapture::Route* local6 = nullptr;
|
||||
if (pull.tunnel_address_index_ipv4 >= 0)
|
||||
local4 = &pull.tunnel_addresses[pull.tunnel_address_index_ipv4];
|
||||
if (pull.tunnel_address_index_ipv6 >= 0)
|
||||
local6 = &pull.tunnel_addresses[pull.tunnel_address_index_ipv6];
|
||||
|
||||
// Interface down
|
||||
Command::Ptr iface_down(new Command);
|
||||
iface_down->argv.push_back("/sbin/ifconfig");
|
||||
iface_down->argv.push_back(iface_name);
|
||||
iface_down->argv.push_back("down");
|
||||
create.add(iface_down);
|
||||
|
||||
// Set IPv4 Interface
|
||||
if (local4)
|
||||
{
|
||||
// Process ifconfig
|
||||
const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(local4->prefix_length);
|
||||
{
|
||||
Command::Ptr cmd(new Command);
|
||||
cmd->argv.push_back("/sbin/ifconfig");
|
||||
cmd->argv.push_back(iface_name);
|
||||
cmd->argv.push_back(local4->address);
|
||||
cmd->argv.push_back(local4->address);
|
||||
cmd->argv.push_back("netmask");
|
||||
cmd->argv.push_back(netmask.to_string());
|
||||
cmd->argv.push_back("mtu");
|
||||
cmd->argv.push_back(to_string(pull.mtu));
|
||||
cmd->argv.push_back("up");
|
||||
create.add(cmd);
|
||||
}
|
||||
add_del_route(local4->address, local4->prefix_length, local4->address, iface_name, 0, create, destroy);
|
||||
}
|
||||
|
||||
// Set IPv6 Interface
|
||||
if (local6)
|
||||
{
|
||||
{
|
||||
Command::Ptr cmd(new Command);
|
||||
cmd->argv.push_back("/sbin/ifconfig");
|
||||
cmd->argv.push_back(iface_name);
|
||||
cmd->argv.push_back("inet6");
|
||||
cmd->argv.push_back(local6->address + '/' + to_string(local6->prefix_length));
|
||||
cmd->argv.push_back("up");
|
||||
create.add(cmd);
|
||||
}
|
||||
add_del_route(local6->address, local6->prefix_length, "", iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
}
|
||||
|
||||
// Process Routes
|
||||
{
|
||||
for (std::vector<TunBuilderCapture::Route>::const_iterator i = pull.add_routes.begin(); i != pull.add_routes.end(); ++i)
|
||||
{
|
||||
const TunBuilderCapture::Route& route = *i;
|
||||
if (route.ipv6)
|
||||
add_del_route(route.address, route.prefix_length, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
else
|
||||
{
|
||||
if (local4 && !local4->gateway.empty())
|
||||
add_del_route(route.address, route.prefix_length, local4->gateway, iface_name, 0, create, destroy);
|
||||
else
|
||||
OPENVPN_LOG("ERROR: IPv4 route pushed without IPv4 ifconfig and/or route-gateway");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Process exclude routes
|
||||
if (!pull.exclude_routes.empty())
|
||||
{
|
||||
for (std::vector<TunBuilderCapture::Route>::const_iterator i = pull.exclude_routes.begin(); i != pull.exclude_routes.end(); ++i)
|
||||
{
|
||||
const TunBuilderCapture::Route& route = *i;
|
||||
if (route.ipv6)
|
||||
{
|
||||
if (gw.v6.defined())
|
||||
add_del_route(route.address, route.prefix_length, gw.v6.router.to_string(), gw.v6.iface, R_IPv6|R_IFACE_HINT, create, destroy);
|
||||
else
|
||||
OPENVPN_LOG("NOTE: cannot determine gateway for exclude IPv6 routes");
|
||||
}
|
||||
else
|
||||
{
|
||||
if (gw.v4.defined())
|
||||
add_del_route(route.address, route.prefix_length, gw.v4.router.to_string(), gw.v4.iface, 0, create, destroy);
|
||||
else
|
||||
OPENVPN_LOG("NOTE: cannot determine gateway for exclude IPv4 routes");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Process IPv4 redirect-gateway
|
||||
if (pull.reroute_gw.ipv4)
|
||||
{
|
||||
if (fsblock)
|
||||
fsblock->add_block_v4();
|
||||
|
||||
// add server bypass route
|
||||
if (gw.v4.defined())
|
||||
{
|
||||
if (!pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
|
||||
{
|
||||
Action::Ptr c, d;
|
||||
add_del_route(pull.remote_address.address, 32, gw.v4.router.to_string(), gw.v4.iface, 0, c, d);
|
||||
if (!fsblock || !fsblock->ip_hole_punch_exists(c))
|
||||
{
|
||||
create.add(c);
|
||||
destroy.add(d);
|
||||
}
|
||||
//add_del_route(gw.v4.router.to_string(), 32, "", gw.v4.iface, R_ONLINK, create, destroy); // fixme -- needed for block-local
|
||||
}
|
||||
}
|
||||
else
|
||||
OPENVPN_LOG("ERROR: cannot detect IPv4 default gateway");
|
||||
|
||||
#ifdef TEST_EER
|
||||
if (!(pull.reroute_gw.flags & RGWFlags::EmulateExcludeRoutes))
|
||||
#endif
|
||||
{
|
||||
add_del_route("0.0.0.0", 2, local4->gateway, iface_name, 0, create, destroy);
|
||||
add_del_route("64.0.0.0", 2, local4->gateway, iface_name, 0, create, destroy);
|
||||
add_del_route("128.0.0.0", 2, local4->gateway, iface_name, 0, create, destroy);
|
||||
add_del_route("192.0.0.0", 2, local4->gateway, iface_name, 0, create, destroy);
|
||||
}
|
||||
}
|
||||
|
||||
// Process IPv6 redirect-gateway
|
||||
if (pull.reroute_gw.ipv6)
|
||||
{
|
||||
if (fsblock)
|
||||
fsblock->add_block_v6();
|
||||
|
||||
// add server bypass route
|
||||
if (gw.v6.defined())
|
||||
{
|
||||
if (pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
|
||||
{
|
||||
Action::Ptr c, d;
|
||||
add_del_route(pull.remote_address.address, 128, gw.v6.router.to_string(), gw.v6.iface, R_IPv6|R_IFACE_HINT, c, d);
|
||||
if (!fsblock || !fsblock->ip_hole_punch_exists(c))
|
||||
{
|
||||
create.add(c);
|
||||
destroy.add(d);
|
||||
}
|
||||
//add_del_route(gw.v6.router.to_string(), 128, "", gw.v6.iface, R_IPv6|R_ONLINK, create, destroy); // fixme -- needed for block-local
|
||||
}
|
||||
}
|
||||
else
|
||||
OPENVPN_LOG("ERROR: cannot detect IPv6 default gateway");
|
||||
|
||||
#ifdef TEST_EER
|
||||
if (!(pull.reroute_gw.flags & RGWFlags::EmulateExcludeRoutes))
|
||||
#endif
|
||||
{
|
||||
add_del_route("0000::", 2, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
add_del_route("4000::", 2, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
add_del_route("8000::", 2, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
add_del_route("C000::", 2, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
}
|
||||
}
|
||||
|
||||
// Interface down
|
||||
destroy.add(iface_down);
|
||||
|
||||
// Block IPv6
|
||||
if (pull.block_ipv6 && fsblock)
|
||||
fsblock->add_block_v6_public();
|
||||
}
|
||||
|
||||
bool send(Buffer& buf)
|
||||
{
|
||||
if (impl)
|
||||
@ -921,7 +317,7 @@ namespace openvpn {
|
||||
TunImpl::Ptr impl;
|
||||
bool halt;
|
||||
TunProp::State::Ptr state;
|
||||
ActionList::Ptr remove_cmds;
|
||||
TunBuilderSetup::Base::Ptr tun_setup;
|
||||
};
|
||||
|
||||
inline TunClient::Ptr ClientConfig::new_tun_client_obj(asio::io_context& io_context,
|
||||
|
458
openvpn/tun/mac/client/tunsetup.hpp
Normal file
458
openvpn/tun/mac/client/tunsetup.hpp
Normal file
@ -0,0 +1,458 @@
|
||||
// OpenVPN -- An application to securely tunnel IP networks
|
||||
// over a single port, with support for SSL/TLS-based
|
||||
// session authentication and key exchange,
|
||||
// packet encryption, packet authentication, and
|
||||
// packet compression.
|
||||
//
|
||||
// Copyright (C) 2012-2015 OpenVPN Technologies, Inc.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License Version 3
|
||||
// as published by the Free Software Foundation.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program in the COPYING file.
|
||||
// If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
// Client tun setup for Mac
|
||||
|
||||
#ifndef OPENVPN_TUN_MAC_CLIENT_TUNSETUP_H
|
||||
#define OPENVPN_TUN_MAC_CLIENT_TUNSETUP_H
|
||||
|
||||
#include <string>
|
||||
#include <sstream>
|
||||
#include <ostream>
|
||||
|
||||
#include <openvpn/common/exception.hpp>
|
||||
#include <openvpn/common/rc.hpp>
|
||||
#include <openvpn/common/size.hpp>
|
||||
#include <openvpn/common/arraysize.hpp>
|
||||
#include <openvpn/common/action.hpp>
|
||||
#include <openvpn/common/process.hpp>
|
||||
#include <openvpn/error/excode.hpp>
|
||||
#include <openvpn/tun/layer.hpp>
|
||||
#include <openvpn/tun/mac/tunutil.hpp>
|
||||
#include <openvpn/tun/mac/utun.hpp>
|
||||
#include <openvpn/tun/mac/macgw.hpp>
|
||||
#include <openvpn/tun/mac/macdns_watchdog.hpp>
|
||||
#include <openvpn/tun/builder/rgwflags.hpp>
|
||||
#include <openvpn/tun/builder/setup.hpp>
|
||||
|
||||
#ifdef HAVE_JSONCPP
|
||||
#include <openvpn/common/jsonhelper.hpp>
|
||||
#endif
|
||||
|
||||
namespace openvpn {
|
||||
namespace TunMac {
|
||||
class Setup : public TunBuilderSetup::Base
|
||||
{
|
||||
public:
|
||||
typedef RCPtr<Setup> Ptr;
|
||||
|
||||
OPENVPN_EXCEPTION(tun_mac_setup);
|
||||
|
||||
struct Config : public TunBuilderSetup::Config
|
||||
{
|
||||
std::string iface_name;
|
||||
Layer layer; // OSI layer
|
||||
bool tun_prefix = false;
|
||||
|
||||
#ifdef HAVE_JSONCPP
|
||||
virtual Json::Value to_json() override
|
||||
{
|
||||
Json::Value root(Json::objectValue);
|
||||
root["iface_name"] = Json::Value(iface_name);
|
||||
root["layer"] = Json::Value(layer.str());
|
||||
root["tun_prefix"] = Json::Value(tun_prefix);
|
||||
return root;
|
||||
};
|
||||
|
||||
virtual void from_json(const Json::Value& root, const std::string& title) override
|
||||
{
|
||||
json::assert_dict(root, title);
|
||||
json::to_string(root, iface_name, "iface_name", title);
|
||||
layer = Layer::from_str(json::get_string(root, "layer", title));
|
||||
json::to_bool(root, tun_prefix, "tun_prefix", title);
|
||||
}
|
||||
#endif
|
||||
};
|
||||
|
||||
virtual int establish(const TunBuilderCapture& pull, // defined by TunBuilderSetup::Base
|
||||
TunBuilderSetup::Config* config,
|
||||
Stop* stop,
|
||||
std::ostream& os) override
|
||||
{
|
||||
// get configuration
|
||||
Config *conf = dynamic_cast<Config *>(config);
|
||||
if (!conf)
|
||||
throw tun_mac_setup("missing config");
|
||||
|
||||
// close out old remove cmds, if they exist
|
||||
destroy(os);
|
||||
|
||||
// Open tun device. Try Mac OS X integrated utun device first
|
||||
// (layer 3 only). If utun fails and MAC_TUNTAP_FALLBACK is defined,
|
||||
// then fall back to TunTap third-party device.
|
||||
// If successful, conf->iface_name will be set to tun iface name.
|
||||
int fd = -1;
|
||||
conf->tun_prefix = false;
|
||||
try {
|
||||
# if defined(MAC_TUNTAP_FALLBACK)
|
||||
# if !defined(ASIO_DISABLE_KQUEUE)
|
||||
# error Mac OS X TunTap adapter is incompatible with kqueue; rebuild with ASIO_DISABLE_KQUEUE
|
||||
# endif
|
||||
if (conf->layer() == Layer::OSI_LAYER_3)
|
||||
{
|
||||
try {
|
||||
fd = UTun::utun_open(conf->iface_name);
|
||||
conf->tun_prefix = true;
|
||||
}
|
||||
catch (const std::exception& e)
|
||||
{
|
||||
os << e.what() << std::endl;
|
||||
}
|
||||
}
|
||||
if (fd == -1)
|
||||
fd = Util::tuntap_open(conf->layer, conf->iface_name);
|
||||
# else
|
||||
fd = UTun::utun_open(conf->iface_name);
|
||||
conf->tun_prefix = true;
|
||||
# endif
|
||||
}
|
||||
catch (const std::exception& e)
|
||||
{
|
||||
throw ErrorCode(Error::TUN_IFACE_CREATE, true, e.what());
|
||||
}
|
||||
|
||||
// create ActionLists for setting up and removing adapter properties
|
||||
ActionList::Ptr add_cmds(new ActionList());
|
||||
remove_cmds.reset(new ActionList());
|
||||
|
||||
// populate add/remove lists with actions
|
||||
tun_config(conf->iface_name, pull, *add_cmds, *remove_cmds, os);
|
||||
|
||||
// execute the add actions
|
||||
add_cmds->execute(os);
|
||||
|
||||
// now that the add actions have succeeded,
|
||||
// enable the remove actions
|
||||
remove_cmds->enable_destroy(true);
|
||||
|
||||
os << "open " << conf->iface_name << " SUCCEEDED" << std::endl;
|
||||
return fd;
|
||||
}
|
||||
|
||||
virtual void destroy(std::ostream& os) override // defined by DestructorBase
|
||||
{
|
||||
if (remove_cmds)
|
||||
{
|
||||
remove_cmds->destroy(os);
|
||||
remove_cmds.reset();
|
||||
}
|
||||
}
|
||||
|
||||
virtual ~Setup()
|
||||
{
|
||||
std::ostringstream os;
|
||||
destroy(os);
|
||||
}
|
||||
|
||||
private:
|
||||
enum { // add_del_route flags
|
||||
R_IPv6=(1<<0),
|
||||
R_IFACE=(1<<1),
|
||||
R_IFACE_HINT=(1<<2),
|
||||
R_ONLINK=(1<<3),
|
||||
R_REJECT=(1<<4),
|
||||
R_BLACKHOLE=(1<<5),
|
||||
};
|
||||
|
||||
static void add_del_route(const std::string& addr_str,
|
||||
const int prefix_len,
|
||||
const std::string& gateway_str,
|
||||
const std::string& iface,
|
||||
const unsigned int flags,
|
||||
Action::Ptr& create,
|
||||
Action::Ptr& destroy)
|
||||
{
|
||||
if (flags & R_IPv6)
|
||||
{
|
||||
const IPv6::Addr addr = IPv6::Addr::from_string(addr_str);
|
||||
const IPv6::Addr netmask = IPv6::Addr::netmask_from_prefix_len(prefix_len);
|
||||
const IPv6::Addr net = addr & netmask;
|
||||
|
||||
Command::Ptr add(new Command);
|
||||
add->argv.push_back("/sbin/route");
|
||||
add->argv.push_back("add");
|
||||
add->argv.push_back("-net");
|
||||
add->argv.push_back("-inet6");
|
||||
add->argv.push_back(net.to_string());
|
||||
add->argv.push_back("-prefixlen");
|
||||
add->argv.push_back(to_string(prefix_len));
|
||||
if (flags & R_REJECT)
|
||||
add->argv.push_back("-reject");
|
||||
if (flags & R_BLACKHOLE)
|
||||
add->argv.push_back("-blackhole");
|
||||
if (!iface.empty())
|
||||
{
|
||||
if (flags & R_IFACE)
|
||||
{
|
||||
add->argv.push_back("-iface");
|
||||
add->argv.push_back(iface);
|
||||
}
|
||||
}
|
||||
if (!gateway_str.empty() && !(flags & R_IFACE))
|
||||
{
|
||||
std::string g = gateway_str;
|
||||
if (flags & R_IFACE_HINT)
|
||||
g += '%' + iface;
|
||||
add->argv.push_back(g);
|
||||
}
|
||||
create = add;
|
||||
|
||||
// for the destroy command, copy the add command but replace "add" with "delete"
|
||||
Command::Ptr del(add->copy());
|
||||
del->argv[1] = "delete";
|
||||
destroy = del;
|
||||
}
|
||||
else
|
||||
{
|
||||
const IPv4::Addr addr = IPv4::Addr::from_string(addr_str);
|
||||
const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(prefix_len);
|
||||
const IPv4::Addr net = addr & netmask;
|
||||
|
||||
Command::Ptr add(new Command);
|
||||
add->argv.push_back("/sbin/route");
|
||||
add->argv.push_back("add");
|
||||
if (flags & R_ONLINK)
|
||||
{
|
||||
add->argv.push_back("-cloning");
|
||||
add->argv.push_back("-net");
|
||||
add->argv.push_back(net.to_string());
|
||||
add->argv.push_back("-netmask");
|
||||
add->argv.push_back(netmask.to_string());
|
||||
add->argv.push_back("-interface");
|
||||
add->argv.push_back(iface);
|
||||
}
|
||||
else
|
||||
{
|
||||
add->argv.push_back("-net");
|
||||
add->argv.push_back(net.to_string());
|
||||
add->argv.push_back("-netmask");
|
||||
add->argv.push_back(netmask.to_string());
|
||||
if (flags & R_REJECT)
|
||||
add->argv.push_back("-reject");
|
||||
if (flags & R_BLACKHOLE)
|
||||
add->argv.push_back("-blackhole");
|
||||
if (!iface.empty())
|
||||
{
|
||||
if (flags & R_IFACE)
|
||||
{
|
||||
add->argv.push_back("-iface");
|
||||
add->argv.push_back(iface);
|
||||
}
|
||||
}
|
||||
add->argv.push_back(gateway_str);
|
||||
}
|
||||
create = add;
|
||||
|
||||
// for the destroy command, copy the add command but replace "add" with "delete"
|
||||
Command::Ptr del(add->copy());
|
||||
del->argv[1] = "delete";
|
||||
destroy = del;
|
||||
}
|
||||
}
|
||||
|
||||
static void add_del_route(const std::string& addr_str,
|
||||
const int prefix_len,
|
||||
const std::string& gateway_str,
|
||||
const std::string& iface,
|
||||
const unsigned int flags,
|
||||
ActionList& create,
|
||||
ActionList& destroy)
|
||||
{
|
||||
Action::Ptr c, d;
|
||||
add_del_route(addr_str, prefix_len, gateway_str, iface, flags, c, d);
|
||||
create.add(c);
|
||||
destroy.add(d);
|
||||
}
|
||||
|
||||
static void tun_config(const std::string& iface_name,
|
||||
const TunBuilderCapture& pull,
|
||||
ActionList& create,
|
||||
ActionList& destroy,
|
||||
std::ostream& os)
|
||||
{
|
||||
// get default gateway
|
||||
MacGWInfo gw;
|
||||
|
||||
// set local4 and local6 to point to IPv4/6 route configurations
|
||||
const TunBuilderCapture::RouteAddress* local4 = nullptr;
|
||||
const TunBuilderCapture::RouteAddress* local6 = nullptr;
|
||||
if (pull.tunnel_address_index_ipv4 >= 0)
|
||||
local4 = &pull.tunnel_addresses[pull.tunnel_address_index_ipv4];
|
||||
if (pull.tunnel_address_index_ipv6 >= 0)
|
||||
local6 = &pull.tunnel_addresses[pull.tunnel_address_index_ipv6];
|
||||
|
||||
// Interface down
|
||||
Command::Ptr iface_down(new Command);
|
||||
iface_down->argv.push_back("/sbin/ifconfig");
|
||||
iface_down->argv.push_back(iface_name);
|
||||
iface_down->argv.push_back("down");
|
||||
create.add(iface_down);
|
||||
|
||||
// Set IPv4 Interface
|
||||
if (local4)
|
||||
{
|
||||
// Process ifconfig
|
||||
const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(local4->prefix_length);
|
||||
{
|
||||
Command::Ptr cmd(new Command);
|
||||
cmd->argv.push_back("/sbin/ifconfig");
|
||||
cmd->argv.push_back(iface_name);
|
||||
cmd->argv.push_back(local4->address);
|
||||
cmd->argv.push_back(local4->address);
|
||||
cmd->argv.push_back("netmask");
|
||||
cmd->argv.push_back(netmask.to_string());
|
||||
cmd->argv.push_back("mtu");
|
||||
cmd->argv.push_back(to_string(pull.mtu));
|
||||
cmd->argv.push_back("up");
|
||||
create.add(cmd);
|
||||
}
|
||||
add_del_route(local4->address, local4->prefix_length, local4->address, iface_name, 0, create, destroy);
|
||||
}
|
||||
|
||||
// Set IPv6 Interface
|
||||
if (local6)
|
||||
{
|
||||
{
|
||||
Command::Ptr cmd(new Command);
|
||||
cmd->argv.push_back("/sbin/ifconfig");
|
||||
cmd->argv.push_back(iface_name);
|
||||
cmd->argv.push_back("inet6");
|
||||
cmd->argv.push_back(local6->address + '/' + to_string(local6->prefix_length));
|
||||
cmd->argv.push_back("up");
|
||||
create.add(cmd);
|
||||
}
|
||||
add_del_route(local6->address, local6->prefix_length, "", iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
}
|
||||
|
||||
// Process Routes
|
||||
{
|
||||
for (std::vector<TunBuilderCapture::Route>::const_iterator i = pull.add_routes.begin(); i != pull.add_routes.end(); ++i)
|
||||
{
|
||||
const TunBuilderCapture::Route& route = *i;
|
||||
if (route.ipv6)
|
||||
add_del_route(route.address, route.prefix_length, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
else
|
||||
{
|
||||
if (local4 && !local4->gateway.empty())
|
||||
add_del_route(route.address, route.prefix_length, local4->gateway, iface_name, 0, create, destroy);
|
||||
else
|
||||
os << "ERROR: IPv4 route pushed without IPv4 ifconfig and/or route-gateway" << std::endl;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Process exclude routes
|
||||
if (!pull.exclude_routes.empty())
|
||||
{
|
||||
for (std::vector<TunBuilderCapture::Route>::const_iterator i = pull.exclude_routes.begin(); i != pull.exclude_routes.end(); ++i)
|
||||
{
|
||||
const TunBuilderCapture::Route& route = *i;
|
||||
if (route.ipv6)
|
||||
{
|
||||
if (gw.v6.defined())
|
||||
add_del_route(route.address, route.prefix_length, gw.v6.router.to_string(), gw.v6.iface, R_IPv6|R_IFACE_HINT, create, destroy);
|
||||
else
|
||||
os << "NOTE: cannot determine gateway for exclude IPv6 routes" << std::endl;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (gw.v4.defined())
|
||||
add_del_route(route.address, route.prefix_length, gw.v4.router.to_string(), gw.v4.iface, 0, create, destroy);
|
||||
else
|
||||
os << "NOTE: cannot determine gateway for exclude IPv4 routes" << std::endl;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Process IPv4 redirect-gateway
|
||||
if (pull.reroute_gw.ipv4)
|
||||
{
|
||||
// add server bypass route
|
||||
if (gw.v4.defined())
|
||||
{
|
||||
if (!pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
|
||||
{
|
||||
Action::Ptr c, d;
|
||||
add_del_route(pull.remote_address.address, 32, gw.v4.router.to_string(), gw.v4.iface, 0, c, d);
|
||||
create.add(c);
|
||||
destroy.add(d);
|
||||
//add_del_route(gw.v4.router.to_string(), 32, "", gw.v4.iface, R_ONLINK, create, destroy); // fixme -- needed for block-local
|
||||
}
|
||||
}
|
||||
else
|
||||
os << "ERROR: cannot detect IPv4 default gateway" << std::endl;
|
||||
|
||||
if (!(pull.reroute_gw.flags & RGWFlags::EmulateExcludeRoutes))
|
||||
{
|
||||
add_del_route("0.0.0.0", 1, local4->gateway, iface_name, 0, create, destroy);
|
||||
add_del_route("128.0.0.0", 1, local4->gateway, iface_name, 0, create, destroy);
|
||||
}
|
||||
}
|
||||
|
||||
// Process IPv6 redirect-gateway
|
||||
if (pull.reroute_gw.ipv6)
|
||||
{
|
||||
// add server bypass route
|
||||
if (gw.v6.defined())
|
||||
{
|
||||
if (pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
|
||||
{
|
||||
Action::Ptr c, d;
|
||||
add_del_route(pull.remote_address.address, 128, gw.v6.router.to_string(), gw.v6.iface, R_IPv6|R_IFACE_HINT, c, d);
|
||||
create.add(c);
|
||||
destroy.add(d);
|
||||
//add_del_route(gw.v6.router.to_string(), 128, "", gw.v6.iface, R_IPv6|R_ONLINK, create, destroy); // fixme -- needed for block-local
|
||||
}
|
||||
}
|
||||
else
|
||||
os << "ERROR: cannot detect IPv6 default gateway" << std::endl;
|
||||
|
||||
if (!(pull.reroute_gw.flags & RGWFlags::EmulateExcludeRoutes))
|
||||
{
|
||||
add_del_route("0000::", 1, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
add_del_route("8000::", 1, local6->gateway, iface_name, R_IPv6|R_IFACE, create, destroy);
|
||||
}
|
||||
}
|
||||
|
||||
// Interface down
|
||||
destroy.add(iface_down);
|
||||
|
||||
// configure DNS
|
||||
{
|
||||
MacDNS::Config::Ptr dns(new MacDNS::Config(pull));
|
||||
MacDNSWatchdog::add_actions(dns,
|
||||
MacDNSWatchdog::FLUSH_RECONFIG
|
||||
#ifdef ENABLE_DNS_WATCHDOG
|
||||
| MacDNSWatchdog::SYNCHRONOUS
|
||||
| MacDNSWatchdog::ENABLE_WATCHDOG
|
||||
#endif
|
||||
,
|
||||
create,
|
||||
destroy);
|
||||
}
|
||||
}
|
||||
|
||||
ActionList::Ptr remove_cmds;
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
#endif
|
@ -3,6 +3,10 @@ GCC_EXTRA="$GCC_EXTRA -DOPENVPN_SHOW_SESSION_TOKEN"
|
||||
[ "$EER" = "1" ] && GCC_EXTRA="$GCC_EXTRA -DTEST_EER"
|
||||
[ "$NULL" = "1" ] && GCC_EXTRA="$GCC_EXTRA -DOPENVPN_FORCE_TUN_NULL"
|
||||
[ "$EXIT" = "1" ] && GCC_EXTRA="$GCC_EXTRA -DTUN_NULL_EXIT"
|
||||
if [ "$AGENT" = "1" ]; then
|
||||
GCC_EXTRA="$GCC_EXTRA -DOPENVPN_COMMAND_AGENT"
|
||||
export JSON=1
|
||||
fi
|
||||
export GCC_EXTRA
|
||||
if [ "$(uname)" == "Darwin" ]; then
|
||||
cd $O3/core
|
||||
|
Loading…
Reference in New Issue
Block a user