]>
Commit | Line | Data |
---|---|---|
e914f53a | 1 | /* |
2 | * Copyright (c) 2005 Reyk Floeter <reyk@openbsd.org> | |
3 | * | |
4 | * Permission to use, copy, modify, and distribute this software for any | |
5 | * purpose with or without fee is hereby granted, provided that the above | |
6 | * copyright notice and this permission notice appear in all copies. | |
7 | * | |
8 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | |
9 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | |
10 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | |
11 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | |
12 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |
13 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |
14 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | |
15 | */ | |
16 | ||
17 | #include "includes.h" | |
18 | ||
22bbb3e6 | 19 | #include <sys/types.h> |
3e9b2b1b | 20 | #include <sys/ioctl.h> |
5e837c7b | 21 | |
f9d5c000 | 22 | #include <netinet/in.h> |
5e837c7b | 23 | #include <arpa/inet.h> |
3e9b2b1b | 24 | #include <netinet/ip.h> |
25 | ||
fec71b2f | 26 | #include <errno.h> |
22bbb3e6 | 27 | #include <fcntl.h> |
f2265d5d | 28 | #include <stdarg.h> |
28cb0a43 | 29 | #include <string.h> |
30 | #include <unistd.h> | |
22bbb3e6 | 31 | |
c49ce62e | 32 | #include "openbsd-compat/sys-queue.h" |
e914f53a | 33 | #include "log.h" |
34 | #include "misc.h" | |
693a35d3 | 35 | #include "buffer.h" |
00a017bd | 36 | #include "channels.h" |
e914f53a | 37 | |
38 | /* | |
39 | * This is the portable version of the SSH tunnel forwarding, it | |
40 | * uses some preprocessor definitions for various platform-specific | |
41 | * settings. | |
42 | * | |
43 | * SSH_TUN_LINUX Use the (newer) Linux tun/tap device | |
e02505e2 | 44 | * SSH_TUN_FREEBSD Use the FreeBSD tun/tap device |
e914f53a | 45 | * SSH_TUN_COMPAT_AF Translate the OpenBSD address family |
46 | * SSH_TUN_PREPEND_AF Prepend/remove the address family | |
47 | */ | |
48 | ||
49 | /* | |
50 | * System-specific tunnel open function | |
51 | */ | |
52 | ||
53 | #if defined(SSH_TUN_LINUX) | |
3aef38da | 54 | #include <linux/if.h> |
e914f53a | 55 | #include <linux/if_tun.h> |
56 | ||
57 | int | |
58 | sys_tun_open(int tun, int mode) | |
59 | { | |
60 | struct ifreq ifr; | |
61 | int fd = -1; | |
62 | const char *name = NULL; | |
63 | ||
64 | if ((fd = open("/dev/net/tun", O_RDWR)) == -1) { | |
65 | debug("%s: failed to open tunnel control interface: %s", | |
66 | __func__, strerror(errno)); | |
67 | return (-1); | |
68 | } | |
69 | ||
70 | bzero(&ifr, sizeof(ifr)); | |
71 | ||
72 | if (mode == SSH_TUNMODE_ETHERNET) { | |
73 | ifr.ifr_flags = IFF_TAP; | |
74 | name = "tap%d"; | |
75 | } else { | |
76 | ifr.ifr_flags = IFF_TUN; | |
77 | name = "tun%d"; | |
78 | } | |
79 | ifr.ifr_flags |= IFF_NO_PI; | |
80 | ||
81 | if (tun != SSH_TUNID_ANY) { | |
82 | if (tun > SSH_TUNID_MAX) { | |
83 | debug("%s: invalid tunnel id %x: %s", __func__, | |
84 | tun, strerror(errno)); | |
85 | goto failed; | |
86 | } | |
87 | snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), name, tun); | |
88 | } | |
89 | ||
90 | if (ioctl(fd, TUNSETIFF, &ifr) == -1) { | |
91 | debug("%s: failed to configure tunnel (mode %d): %s", __func__, | |
92 | mode, strerror(errno)); | |
93 | goto failed; | |
94 | } | |
95 | ||
96 | if (tun == SSH_TUNID_ANY) | |
97 | debug("%s: tunnel mode %d fd %d", __func__, mode, fd); | |
98 | else | |
99 | debug("%s: %s mode %d fd %d", __func__, ifr.ifr_name, mode, fd); | |
100 | ||
101 | return (fd); | |
102 | ||
103 | failed: | |
104 | close(fd); | |
105 | return (-1); | |
106 | } | |
107 | #endif /* SSH_TUN_LINUX */ | |
108 | ||
0f6cb079 | 109 | #ifdef SSH_TUN_FREEBSD |
110 | #include <sys/socket.h> | |
111 | #include <net/if.h> | |
e02505e2 | 112 | |
113 | #ifdef HAVE_NET_IF_TUN_H | |
0f6cb079 | 114 | #include <net/if_tun.h> |
e02505e2 | 115 | #endif |
0f6cb079 | 116 | |
117 | int | |
118 | sys_tun_open(int tun, int mode) | |
119 | { | |
120 | struct ifreq ifr; | |
121 | char name[100]; | |
122 | int fd = -1, sock, flag; | |
123 | const char *tunbase = "tun"; | |
124 | ||
125 | if (mode == SSH_TUNMODE_ETHERNET) { | |
126 | #ifdef SSH_TUN_NO_L2 | |
127 | debug("%s: no layer 2 tunnelling support", __func__); | |
128 | return (-1); | |
129 | #else | |
130 | tunbase = "tap"; | |
131 | #endif | |
132 | } | |
133 | ||
134 | /* Open the tunnel device */ | |
135 | if (tun <= SSH_TUNID_MAX) { | |
136 | snprintf(name, sizeof(name), "/dev/%s%d", tunbase, tun); | |
137 | fd = open(name, O_RDWR); | |
138 | } else if (tun == SSH_TUNID_ANY) { | |
139 | for (tun = 100; tun >= 0; tun--) { | |
140 | snprintf(name, sizeof(name), "/dev/%s%d", | |
141 | tunbase, tun); | |
142 | if ((fd = open(name, O_RDWR)) >= 0) | |
143 | break; | |
144 | } | |
145 | } else { | |
146 | debug("%s: invalid tunnel %u\n", __func__, tun); | |
147 | return (-1); | |
148 | } | |
149 | ||
150 | if (fd < 0) { | |
151 | debug("%s: %s open failed: %s", __func__, name, | |
152 | strerror(errno)); | |
153 | return (-1); | |
154 | } | |
155 | ||
156 | /* Turn on tunnel headers */ | |
157 | flag = 1; | |
158 | #if defined(TUNSIFHEAD) && !defined(SSH_TUN_PREPEND_AF) | |
159 | if (mode != SSH_TUNMODE_ETHERNET && | |
160 | ioctl(fd, TUNSIFHEAD, &flag) == -1) { | |
161 | debug("%s: ioctl(%d, TUNSIFHEAD, 1): %s", __func__, fd, | |
162 | strerror(errno)); | |
163 | close(fd); | |
164 | } | |
165 | #endif | |
166 | ||
167 | debug("%s: %s mode %d fd %d", __func__, name, mode, fd); | |
168 | ||
169 | /* Set the tunnel device operation mode */ | |
170 | snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s%d", tunbase, tun); | |
171 | if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) == -1) | |
172 | goto failed; | |
173 | ||
174 | if (ioctl(sock, SIOCGIFFLAGS, &ifr) == -1) | |
175 | goto failed; | |
176 | ifr.ifr_flags |= IFF_UP; | |
177 | if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1) | |
178 | goto failed; | |
179 | ||
180 | close(sock); | |
181 | return (fd); | |
182 | ||
183 | failed: | |
184 | if (fd >= 0) | |
185 | close(fd); | |
186 | if (sock >= 0) | |
187 | close(sock); | |
188 | debug("%s: failed to set %s mode %d: %s", __func__, name, | |
189 | mode, strerror(errno)); | |
190 | return (-1); | |
191 | } | |
192 | #endif /* SSH_TUN_FREEBSD */ | |
193 | ||
e914f53a | 194 | /* |
195 | * System-specific channel filters | |
196 | */ | |
197 | ||
198 | #if defined(SSH_TUN_FILTER) | |
199 | #define OPENBSD_AF_INET 2 | |
200 | #define OPENBSD_AF_INET6 24 | |
201 | ||
202 | int | |
203 | sys_tun_infilter(struct Channel *c, char *buf, int len) | |
204 | { | |
205 | #if defined(SSH_TUN_PREPEND_AF) | |
206 | char rbuf[CHAN_RBUF]; | |
0f6cb079 | 207 | struct ip *iph; |
e914f53a | 208 | #endif |
209 | u_int32_t *af; | |
210 | char *ptr = buf; | |
211 | ||
212 | #if defined(SSH_TUN_PREPEND_AF) | |
0f6cb079 | 213 | if (len <= 0 || len > (int)(sizeof(rbuf) - sizeof(*af))) |
e914f53a | 214 | return (-1); |
215 | ptr = (char *)&rbuf[0]; | |
216 | bcopy(buf, ptr + sizeof(u_int32_t), len); | |
217 | len += sizeof(u_int32_t); | |
0f6cb079 | 218 | af = (u_int32_t *)ptr; |
219 | ||
220 | iph = (struct ip *)(ptr + sizeof(u_int32_t)); | |
221 | switch (iph->ip_v) { | |
222 | case 6: | |
223 | *af = AF_INET6; | |
224 | break; | |
225 | case 4: | |
226 | default: | |
227 | *af = AF_INET; | |
228 | break; | |
229 | } | |
e914f53a | 230 | #endif |
231 | ||
232 | #if defined(SSH_TUN_COMPAT_AF) | |
233 | if (len < (int)sizeof(u_int32_t)) | |
234 | return (-1); | |
235 | ||
236 | af = (u_int32_t *)ptr; | |
237 | if (*af == htonl(AF_INET6)) | |
238 | *af = htonl(OPENBSD_AF_INET6); | |
239 | else | |
240 | *af = htonl(OPENBSD_AF_INET); | |
241 | #endif | |
0f6cb079 | 242 | |
e914f53a | 243 | buffer_put_string(&c->input, ptr, len); |
244 | return (0); | |
245 | } | |
246 | ||
247 | u_char * | |
248 | sys_tun_outfilter(struct Channel *c, u_char **data, u_int *dlen) | |
249 | { | |
250 | u_char *buf; | |
251 | u_int32_t *af; | |
252 | ||
253 | *data = buffer_get_string(&c->output, dlen); | |
254 | if (*dlen < sizeof(*af)) | |
255 | return (NULL); | |
256 | buf = *data; | |
257 | ||
258 | #if defined(SSH_TUN_PREPEND_AF) | |
259 | *dlen -= sizeof(u_int32_t); | |
260 | buf = *data + sizeof(u_int32_t); | |
261 | #elif defined(SSH_TUN_COMPAT_AF) | |
262 | af = ntohl(*(u_int32_t *)buf); | |
263 | if (*af == OPENBSD_AF_INET6) | |
264 | *af = htonl(AF_INET6); | |
265 | else | |
266 | *af = htonl(AF_INET); | |
267 | #endif | |
268 | ||
269 | return (buf); | |
270 | } | |
271 | #endif /* SSH_TUN_FILTER */ |