]>
Commit | Line | Data |
---|---|---|
6fbf66fa JY |
1 | /* |
2 | * OpenVPN -- An application to securely tunnel IP networks | |
3 | * over a single TCP/UDP port, with support for SSL/TLS-based | |
4 | * session authentication and key exchange, | |
5 | * packet encryption, packet authentication, and | |
6 | * packet compression. | |
7 | * | |
b25c6d7e | 8 | * Copyright (C) 2002-2024 OpenVPN Inc <sales@openvpn.net> |
6fbf66fa JY |
9 | * |
10 | * This program is free software; you can redistribute it and/or modify | |
11 | * it under the terms of the GNU General Public License version 2 | |
12 | * as published by the Free Software Foundation. | |
13 | * | |
14 | * This program is distributed in the hope that it will be useful, | |
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
17 | * GNU General Public License for more details. | |
18 | * | |
caa54ac3 DS |
19 | * You should have received a copy of the GNU General Public License along |
20 | * with this program; if not, write to the Free Software Foundation, Inc., | |
21 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
6fbf66fa JY |
22 | */ |
23 | ||
24 | /* | |
25 | * Support routines for adding/deleting network routes. | |
26 | */ | |
f1333100 | 27 | #include <stddef.h> |
6fbf66fa | 28 | |
c110b289 ABL |
29 | #ifdef HAVE_CONFIG_H |
30 | #include "config.h" | |
c110b289 ABL |
31 | #endif |
32 | ||
6fbf66fa JY |
33 | #include "syshead.h" |
34 | ||
35 | #include "common.h" | |
36 | #include "error.h" | |
37 | #include "route.h" | |
bf97c00f | 38 | #include "run_command.h" |
6fbf66fa JY |
39 | #include "socket.h" |
40 | #include "manage.h" | |
5a2e9a25 | 41 | #include "win32.h" |
1840c852 | 42 | #include "options.h" |
aec4a3d1 | 43 | #include "networking.h" |
f1333100 | 44 | #include "integer.h" |
6fbf66fa JY |
45 | |
46 | #include "memdbg.h" | |
47 | ||
3128abcf | 48 | #if defined(TARGET_LINUX) || defined(TARGET_ANDROID) |
81d882d5 | 49 | #include <linux/rtnetlink.h> /* RTM_GETROUTE etc. */ |
3128abcf GD |
50 | #endif |
51 | ||
37aab49b | 52 | #if defined(TARGET_NETBSD) |
abe49856 | 53 | #include <net/route.h> /* RT_ROUNDUP(), RT_ADVANCE() */ |
37aab49b GD |
54 | #endif |
55 | ||
445b192a | 56 | #ifdef _WIN32 |
a24dd2e3 HH |
57 | #include "openvpn-msg.h" |
58 | ||
12e46092 | 59 | #define METRIC_NOT_USED ((DWORD)-1) |
9c6d72c7 | 60 | static int add_route_service(const struct route_ipv4 *, const struct tuntap *); |
81d882d5 DS |
61 | |
62 | static bool del_route_service(const struct route_ipv4 *, const struct tuntap *); | |
63 | ||
9c6d72c7 | 64 | static int add_route_ipv6_service(const struct route_ipv6 *, const struct tuntap *); |
81d882d5 DS |
65 | |
66 | static bool del_route_ipv6_service(const struct route_ipv6 *, const struct tuntap *); | |
67 | ||
9c6d72c7 SN |
68 | static int route_ipv6_ipapi(bool add, const struct route_ipv6 *, const struct tuntap *); |
69 | ||
70 | static int add_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt, DWORD adapter_index); | |
71 | ||
72 | static bool del_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt); | |
73 | ||
dd669581 | 74 | |
12e46092 ABL |
75 | #endif |
76 | ||
aec4a3d1 | 77 | static void delete_route(struct route_ipv4 *r, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx); |
576dc96c | 78 | |
81d882d5 | 79 | static void get_bypass_addresses(struct route_bypass *rb, const unsigned int flags); |
3c7f2f55 JY |
80 | |
81 | #ifdef ENABLE_DEBUG | |
82 | ||
83 | static void | |
81d882d5 | 84 | print_bypass_addresses(const struct route_bypass *rb) |
3c7f2f55 | 85 | { |
81d882d5 DS |
86 | struct gc_arena gc = gc_new(); |
87 | int i; | |
88 | for (i = 0; i < rb->n_bypass; ++i) | |
3c7f2f55 | 89 | { |
81d882d5 DS |
90 | msg(D_ROUTE, "ROUTE: bypass_host_route[%d]=%s", |
91 | i, | |
92 | print_in_addr_t(rb->bypass[i], 0, &gc)); | |
3c7f2f55 | 93 | } |
81d882d5 | 94 | gc_free(&gc); |
3c7f2f55 JY |
95 | } |
96 | ||
97 | #endif | |
98 | ||
328cc40c SN |
99 | /* Route addition return status codes */ |
100 | #define RTA_ERROR 0 /* route addition failed */ | |
101 | #define RTA_SUCCESS 1 /* route addition succeeded */ | |
102 | #define RTA_EEXIST 2 /* route not added as it already exists */ | |
103 | ||
d02a86d3 | 104 | static bool |
81d882d5 | 105 | add_bypass_address(struct route_bypass *rb, const in_addr_t a) |
d02a86d3 | 106 | { |
81d882d5 DS |
107 | int i; |
108 | for (i = 0; i < rb->n_bypass; ++i) | |
d02a86d3 | 109 | { |
81d882d5 DS |
110 | if (a == rb->bypass[i]) /* avoid duplicates */ |
111 | { | |
112 | return true; | |
113 | } | |
d02a86d3 | 114 | } |
81d882d5 | 115 | if (rb->n_bypass < N_ROUTE_BYPASS) |
d02a86d3 | 116 | { |
81d882d5 DS |
117 | rb->bypass[rb->n_bypass++] = a; |
118 | return true; | |
d02a86d3 | 119 | } |
81d882d5 | 120 | else |
d02a86d3 | 121 | { |
81d882d5 | 122 | return false; |
d02a86d3 JY |
123 | } |
124 | } | |
125 | ||
6fbf66fa | 126 | struct route_option_list * |
81d882d5 | 127 | new_route_option_list(struct gc_arena *a) |
6fbf66fa | 128 | { |
81d882d5 DS |
129 | struct route_option_list *ret; |
130 | ALLOC_OBJ_CLEAR_GC(ret, struct route_option_list, a); | |
131 | ret->gc = a; | |
132 | return ret; | |
6fbf66fa JY |
133 | } |
134 | ||
512cda46 | 135 | struct route_ipv6_option_list * |
81d882d5 | 136 | new_route_ipv6_option_list(struct gc_arena *a) |
512cda46 | 137 | { |
81d882d5 DS |
138 | struct route_ipv6_option_list *ret; |
139 | ALLOC_OBJ_CLEAR_GC(ret, struct route_ipv6_option_list, a); | |
140 | ret->gc = a; | |
141 | return ret; | |
512cda46 GD |
142 | } |
143 | ||
d0085293 HH |
144 | /* |
145 | * NOTE: structs are cloned/copied shallow by design. | |
146 | * The routes list from src will stay intact since it is allocated using | |
147 | * the options->gc. The cloned/copied lists will share this common tail | |
148 | * to avoid copying the data around between pulls. Pulled routes use | |
149 | * the c2->gc so they get freed immediately after a reconnect. | |
150 | */ | |
673f583f | 151 | struct route_option_list * |
81d882d5 | 152 | clone_route_option_list(const struct route_option_list *src, struct gc_arena *a) |
673f583f | 153 | { |
81d882d5 DS |
154 | struct route_option_list *ret; |
155 | ALLOC_OBJ_GC(ret, struct route_option_list, a); | |
156 | *ret = *src; | |
157 | return ret; | |
673f583f JY |
158 | } |
159 | ||
91402236 | 160 | struct route_ipv6_option_list * |
81d882d5 | 161 | clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a) |
91402236 | 162 | { |
81d882d5 DS |
163 | struct route_ipv6_option_list *ret; |
164 | ALLOC_OBJ_GC(ret, struct route_ipv6_option_list, a); | |
165 | *ret = *src; | |
166 | return ret; | |
91402236 GD |
167 | } |
168 | ||
673f583f | 169 | void |
81d882d5 | 170 | copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a) |
673f583f | 171 | { |
81d882d5 DS |
172 | *dest = *src; |
173 | dest->gc = a; | |
673f583f JY |
174 | } |
175 | ||
91402236 | 176 | void |
81d882d5 DS |
177 | copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, |
178 | const struct route_ipv6_option_list *src, | |
179 | struct gc_arena *a) | |
512cda46 | 180 | { |
81d882d5 DS |
181 | *dest = *src; |
182 | dest->gc = a; | |
512cda46 GD |
183 | } |
184 | ||
6fbf66fa | 185 | static const char * |
81d882d5 | 186 | route_string(const struct route_ipv4 *r, struct gc_arena *gc) |
6fbf66fa | 187 | { |
81d882d5 DS |
188 | struct buffer out = alloc_buf_gc(256, gc); |
189 | buf_printf(&out, "ROUTE network %s netmask %s gateway %s", | |
190 | print_in_addr_t(r->network, 0, gc), | |
191 | print_in_addr_t(r->netmask, 0, gc), | |
192 | print_in_addr_t(r->gateway, 0, gc) | |
193 | ); | |
194 | if (r->flags & RT_METRIC_DEFINED) | |
195 | { | |
196 | buf_printf(&out, " metric %d", r->metric); | |
197 | } | |
198 | return BSTR(&out); | |
6fbf66fa JY |
199 | } |
200 | ||
201 | static bool | |
81d882d5 | 202 | is_route_parm_defined(const char *parm) |
6fbf66fa | 203 | { |
81d882d5 DS |
204 | if (!parm) |
205 | { | |
206 | return false; | |
207 | } | |
208 | if (!strcmp(parm, "default")) | |
209 | { | |
210 | return false; | |
211 | } | |
212 | return true; | |
6fbf66fa JY |
213 | } |
214 | ||
215 | static void | |
81d882d5 | 216 | setenv_route_addr(struct env_set *es, const char *key, const in_addr_t addr, int i) |
6fbf66fa | 217 | { |
81d882d5 DS |
218 | struct gc_arena gc = gc_new(); |
219 | struct buffer name = alloc_buf_gc(256, &gc); | |
220 | if (i >= 0) | |
221 | { | |
222 | buf_printf(&name, "route_%s_%d", key, i); | |
223 | } | |
224 | else | |
225 | { | |
226 | buf_printf(&name, "route_%s", key); | |
227 | } | |
228 | setenv_str(es, BSTR(&name), print_in_addr_t(addr, 0, &gc)); | |
229 | gc_free(&gc); | |
6fbf66fa JY |
230 | } |
231 | ||
232 | static bool | |
81d882d5 DS |
233 | get_special_addr(const struct route_list *rl, |
234 | const char *string, | |
235 | in_addr_t *out, | |
236 | bool *status) | |
237 | { | |
238 | if (status) | |
239 | { | |
240 | *status = true; | |
241 | } | |
242 | if (!strcmp(string, "vpn_gateway")) | |
243 | { | |
244 | if (rl) | |
245 | { | |
246 | if (rl->spec.flags & RTSA_REMOTE_ENDPOINT) | |
247 | { | |
248 | *out = rl->spec.remote_endpoint; | |
249 | } | |
250 | else | |
251 | { | |
252 | msg(M_INFO, PACKAGE_NAME " ROUTE: vpn_gateway undefined"); | |
253 | if (status) | |
254 | { | |
255 | *status = false; | |
256 | } | |
257 | } | |
258 | } | |
259 | return true; | |
260 | } | |
261 | else if (!strcmp(string, "net_gateway")) | |
262 | { | |
263 | if (rl) | |
264 | { | |
265 | if (rl->rgi.flags & RGI_ADDR_DEFINED) | |
266 | { | |
267 | *out = rl->rgi.gateway.addr; | |
268 | } | |
269 | else | |
270 | { | |
271 | msg(M_INFO, PACKAGE_NAME " ROUTE: net_gateway undefined -- unable to get default gateway from system"); | |
272 | if (status) | |
273 | { | |
274 | *status = false; | |
275 | } | |
276 | } | |
277 | } | |
278 | return true; | |
279 | } | |
280 | else if (!strcmp(string, "remote_host")) | |
281 | { | |
282 | if (rl) | |
283 | { | |
284 | if (rl->spec.flags & RTSA_REMOTE_HOST) | |
285 | { | |
286 | *out = rl->spec.remote_host; | |
287 | } | |
288 | else | |
289 | { | |
290 | msg(M_INFO, PACKAGE_NAME " ROUTE: remote_host undefined"); | |
291 | if (status) | |
292 | { | |
293 | *status = false; | |
294 | } | |
295 | } | |
296 | } | |
297 | return true; | |
298 | } | |
299 | return false; | |
6fbf66fa JY |
300 | } |
301 | ||
b4073a76 | 302 | bool |
81d882d5 | 303 | is_special_addr(const char *addr_str) |
b4073a76 | 304 | { |
81d882d5 DS |
305 | if (addr_str) |
306 | { | |
307 | return get_special_addr(NULL, addr_str, NULL, NULL); | |
308 | } | |
309 | else | |
310 | { | |
311 | return false; | |
312 | } | |
b4073a76 JY |
313 | } |
314 | ||
6fbf66fa | 315 | static bool |
81d882d5 DS |
316 | init_route(struct route_ipv4 *r, |
317 | struct addrinfo **network_list, | |
318 | const struct route_option *ro, | |
319 | const struct route_list *rl) | |
6fbf66fa | 320 | { |
81d882d5 DS |
321 | const in_addr_t default_netmask = IPV4_NETMASK_HOST; |
322 | bool status; | |
323 | int ret; | |
d559affd | 324 | struct in_addr special = {0}; |
6fbf66fa | 325 | |
81d882d5 DS |
326 | CLEAR(*r); |
327 | r->option = ro; | |
6fbf66fa | 328 | |
81d882d5 | 329 | /* network */ |
6fbf66fa | 330 | |
81d882d5 | 331 | if (!is_route_parm_defined(ro->network)) |
6fbf66fa | 332 | { |
81d882d5 | 333 | goto fail; |
6fbf66fa | 334 | } |
f2d6f3bc AS |
335 | |
336 | ||
81d882d5 DS |
337 | /* get_special_addr replaces specialaddr with a special ip addr |
338 | * like gw. getaddrinfo is called to convert a a addrinfo struct */ | |
f2d6f3bc | 339 | |
81d882d5 DS |
340 | if (get_special_addr(rl, ro->network, (in_addr_t *) &special.s_addr, &status)) |
341 | { | |
aa346849 GD |
342 | if (!status) |
343 | { | |
344 | goto fail; | |
345 | } | |
81d882d5 | 346 | special.s_addr = htonl(special.s_addr); |
7c637b35 FL |
347 | char buf[INET_ADDRSTRLEN]; |
348 | inet_ntop(AF_INET, &special, buf, sizeof(buf)); | |
349 | ret = openvpn_getaddrinfo(0, buf, NULL, 0, NULL, | |
81d882d5 DS |
350 | AF_INET, network_list); |
351 | } | |
352 | else | |
6fbf66fa | 353 | { |
81d882d5 DS |
354 | ret = openvpn_getaddrinfo(GETADDR_RESOLVE | GETADDR_WARN_ON_SIGNAL, |
355 | ro->network, NULL, 0, NULL, AF_INET, network_list); | |
6fbf66fa | 356 | } |
f2d6f3bc | 357 | |
81d882d5 | 358 | status = (ret == 0); |
6fbf66fa | 359 | |
81d882d5 DS |
360 | if (!status) |
361 | { | |
362 | goto fail; | |
363 | } | |
6fbf66fa | 364 | |
81d882d5 | 365 | /* netmask */ |
6fbf66fa | 366 | |
81d882d5 DS |
367 | if (is_route_parm_defined(ro->netmask)) |
368 | { | |
369 | r->netmask = getaddr( | |
370 | GETADDR_HOST_ORDER | |
371 | | GETADDR_WARN_ON_SIGNAL, | |
372 | ro->netmask, | |
373 | 0, | |
374 | &status, | |
375 | NULL); | |
376 | if (!status) | |
377 | { | |
378 | goto fail; | |
379 | } | |
380 | } | |
381 | else | |
6fbf66fa | 382 | { |
81d882d5 | 383 | r->netmask = default_netmask; |
6fbf66fa | 384 | } |
6fbf66fa | 385 | |
81d882d5 | 386 | /* gateway */ |
6fbf66fa | 387 | |
81d882d5 | 388 | if (is_route_parm_defined(ro->gateway)) |
6fbf66fa | 389 | { |
81d882d5 DS |
390 | if (!get_special_addr(rl, ro->gateway, &r->gateway, &status)) |
391 | { | |
392 | r->gateway = getaddr( | |
393 | GETADDR_RESOLVE | |
394 | | GETADDR_HOST_ORDER | |
395 | | GETADDR_WARN_ON_SIGNAL, | |
396 | ro->gateway, | |
397 | 0, | |
398 | &status, | |
399 | NULL); | |
400 | } | |
401 | if (!status) | |
402 | { | |
403 | goto fail; | |
404 | } | |
6fbf66fa | 405 | } |
81d882d5 | 406 | else |
6fbf66fa | 407 | { |
81d882d5 DS |
408 | if (rl->spec.flags & RTSA_REMOTE_ENDPOINT) |
409 | { | |
410 | r->gateway = rl->spec.remote_endpoint; | |
411 | } | |
412 | else | |
413 | { | |
414 | msg(M_WARN, PACKAGE_NAME " ROUTE: " PACKAGE_NAME " needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options"); | |
415 | goto fail; | |
416 | } | |
6fbf66fa JY |
417 | } |
418 | ||
81d882d5 | 419 | /* metric */ |
6fbf66fa | 420 | |
81d882d5 DS |
421 | r->metric = 0; |
422 | if (is_route_parm_defined(ro->metric)) | |
6fbf66fa | 423 | { |
81d882d5 DS |
424 | r->metric = atoi(ro->metric); |
425 | if (r->metric < 0) | |
426 | { | |
427 | msg(M_WARN, PACKAGE_NAME " ROUTE: route metric for network %s (%s) must be >= 0", | |
428 | ro->network, | |
429 | ro->metric); | |
430 | goto fail; | |
431 | } | |
432 | r->flags |= RT_METRIC_DEFINED; | |
6fbf66fa | 433 | } |
81d882d5 | 434 | else if (rl->spec.flags & RTSA_DEFAULT_METRIC) |
6fbf66fa | 435 | { |
81d882d5 DS |
436 | r->metric = rl->spec.default_metric; |
437 | r->flags |= RT_METRIC_DEFINED; | |
6fbf66fa JY |
438 | } |
439 | ||
81d882d5 | 440 | r->flags |= RT_DEFINED; |
6fbf66fa | 441 | |
81d882d5 | 442 | return true; |
6fbf66fa | 443 | |
81d882d5 DS |
444 | fail: |
445 | msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve route for host/network: %s", | |
446 | ro->network); | |
447 | return false; | |
6fbf66fa JY |
448 | } |
449 | ||
512cda46 | 450 | static bool |
81d882d5 DS |
451 | init_route_ipv6(struct route_ipv6 *r6, |
452 | const struct route_ipv6_option *r6o, | |
453 | const struct route_ipv6_list *rl6 ) | |
512cda46 | 454 | { |
81d882d5 | 455 | CLEAR(*r6); |
512cda46 | 456 | |
81d882d5 DS |
457 | if (!get_ipv6_addr( r6o->prefix, &r6->network, &r6->netbits, M_WARN )) |
458 | { | |
459 | goto fail; | |
460 | } | |
512cda46 | 461 | |
81d882d5 DS |
462 | /* gateway */ |
463 | if (is_route_parm_defined(r6o->gateway)) | |
512cda46 | 464 | { |
81d882d5 | 465 | if (inet_pton( AF_INET6, r6o->gateway, &r6->gateway ) != 1) |
512cda46 | 466 | { |
81d882d5 | 467 | msg( M_WARN, PACKAGE_NAME "ROUTE6: cannot parse gateway spec '%s'", r6o->gateway ); |
512cda46 GD |
468 | } |
469 | } | |
81d882d5 | 470 | else if (rl6->spec_flags & RTSA_REMOTE_ENDPOINT) |
512cda46 | 471 | { |
81d882d5 | 472 | r6->gateway = rl6->remote_endpoint_ipv6; |
512cda46 | 473 | } |
512cda46 | 474 | |
81d882d5 | 475 | /* metric */ |
512cda46 | 476 | |
81d882d5 DS |
477 | r6->metric = -1; |
478 | if (is_route_parm_defined(r6o->metric)) | |
512cda46 | 479 | { |
81d882d5 DS |
480 | r6->metric = atoi(r6o->metric); |
481 | if (r6->metric < 0) | |
482 | { | |
483 | msg(M_WARN, PACKAGE_NAME " ROUTE: route metric for network %s (%s) must be >= 0", | |
484 | r6o->prefix, | |
485 | r6o->metric); | |
486 | goto fail; | |
487 | } | |
488 | r6->flags |= RT_METRIC_DEFINED; | |
512cda46 | 489 | } |
81d882d5 | 490 | else if (rl6->spec_flags & RTSA_DEFAULT_METRIC) |
512cda46 | 491 | { |
81d882d5 DS |
492 | r6->metric = rl6->default_metric; |
493 | r6->flags |= RT_METRIC_DEFINED; | |
512cda46 GD |
494 | } |
495 | ||
81d882d5 | 496 | r6->flags |= RT_DEFINED; |
512cda46 | 497 | |
81d882d5 | 498 | return true; |
512cda46 | 499 | |
81d882d5 DS |
500 | fail: |
501 | msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve route for host/network: %s", | |
502 | r6o->prefix); | |
503 | return false; | |
512cda46 GD |
504 | } |
505 | ||
6fbf66fa | 506 | void |
81d882d5 DS |
507 | add_route_to_option_list(struct route_option_list *l, |
508 | const char *network, | |
509 | const char *netmask, | |
510 | const char *gateway, | |
511 | const char *metric) | |
6fbf66fa | 512 | { |
81d882d5 DS |
513 | struct route_option *ro; |
514 | ALLOC_OBJ_GC(ro, struct route_option, l->gc); | |
515 | ro->network = network; | |
516 | ro->netmask = netmask; | |
517 | ro->gateway = gateway; | |
518 | ro->metric = metric; | |
519 | ro->next = l->routes; | |
520 | l->routes = ro; | |
d0085293 | 521 | |
6fbf66fa JY |
522 | } |
523 | ||
512cda46 | 524 | void |
81d882d5 DS |
525 | add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, |
526 | const char *prefix, | |
527 | const char *gateway, | |
528 | const char *metric) | |
512cda46 | 529 | { |
81d882d5 DS |
530 | struct route_ipv6_option *ro; |
531 | ALLOC_OBJ_GC(ro, struct route_ipv6_option, l->gc); | |
532 | ro->prefix = prefix; | |
533 | ro->gateway = gateway; | |
534 | ro->metric = metric; | |
535 | ro->next = l->routes_ipv6; | |
536 | l->routes_ipv6 = ro; | |
512cda46 GD |
537 | } |
538 | ||
72bcdfdc | 539 | static void |
81d882d5 | 540 | clear_route_list(struct route_list *rl) |
6fbf66fa | 541 | { |
81d882d5 DS |
542 | gc_free(&rl->gc); |
543 | CLEAR(*rl); | |
6fbf66fa JY |
544 | } |
545 | ||
72bcdfdc | 546 | static void |
81d882d5 | 547 | clear_route_ipv6_list(struct route_ipv6_list *rl6) |
512cda46 | 548 | { |
81d882d5 DS |
549 | gc_free(&rl6->gc); |
550 | CLEAR(*rl6); | |
512cda46 GD |
551 | } |
552 | ||
03731db3 | 553 | void |
81d882d5 DS |
554 | route_list_add_vpn_gateway(struct route_list *rl, |
555 | struct env_set *es, | |
556 | const in_addr_t addr) | |
03731db3 | 557 | { |
81d882d5 DS |
558 | ASSERT(rl); |
559 | rl->spec.remote_endpoint = addr; | |
560 | rl->spec.flags |= RTSA_REMOTE_ENDPOINT; | |
561 | setenv_route_addr(es, "vpn_gateway", rl->spec.remote_endpoint, -1); | |
03731db3 JY |
562 | } |
563 | ||
7fb0e07e | 564 | static void |
81d882d5 DS |
565 | add_block_local_item(struct route_list *rl, |
566 | const struct route_gateway_address *gateway, | |
567 | in_addr_t target) | |
7fb0e07e | 568 | { |
81d882d5 DS |
569 | const int rgi_needed = (RGI_ADDR_DEFINED|RGI_NETMASK_DEFINED); |
570 | if ((rl->rgi.flags & rgi_needed) == rgi_needed | |
571 | && rl->rgi.gateway.netmask < 0xFFFFFFFF) | |
7fb0e07e | 572 | { |
81d882d5 DS |
573 | struct route_ipv4 *r1, *r2; |
574 | unsigned int l2; | |
575 | ||
576 | ALLOC_OBJ_GC(r1, struct route_ipv4, &rl->gc); | |
577 | ALLOC_OBJ_GC(r2, struct route_ipv4, &rl->gc); | |
578 | ||
579 | /* split a route into two smaller blocking routes, and direct them to target */ | |
580 | l2 = ((~gateway->netmask)+1)>>1; | |
581 | r1->flags = RT_DEFINED; | |
582 | r1->gateway = target; | |
583 | r1->network = gateway->addr & gateway->netmask; | |
584 | r1->netmask = ~(l2-1); | |
585 | r1->next = rl->routes; | |
586 | rl->routes = r1; | |
587 | ||
588 | *r2 = *r1; | |
589 | r2->network += l2; | |
590 | r2->next = rl->routes; | |
591 | rl->routes = r2; | |
7fb0e07e JY |
592 | } |
593 | } | |
594 | ||
595 | static void | |
81d882d5 | 596 | add_block_local(struct route_list *rl) |
7fb0e07e | 597 | { |
81d882d5 DS |
598 | const int rgi_needed = (RGI_ADDR_DEFINED|RGI_NETMASK_DEFINED); |
599 | if ((rl->flags & RG_BLOCK_LOCAL) | |
600 | && (rl->rgi.flags & rgi_needed) == rgi_needed | |
601 | && (rl->spec.flags & RTSA_REMOTE_ENDPOINT) | |
602 | && rl->spec.remote_host_local != TLA_LOCAL) | |
7fb0e07e | 603 | { |
81d882d5 | 604 | size_t i; |
7fb0e07e | 605 | |
ad80d677 | 606 | #ifndef TARGET_ANDROID |
81d882d5 DS |
607 | /* add bypass for gateway addr */ |
608 | add_bypass_address(&rl->spec.bypass, rl->rgi.gateway.addr); | |
ad80d677 | 609 | #endif |
7fb0e07e | 610 | |
81d882d5 DS |
611 | /* block access to local subnet */ |
612 | add_block_local_item(rl, &rl->rgi.gateway, rl->spec.remote_endpoint); | |
7fb0e07e | 613 | |
81d882d5 DS |
614 | /* process additional subnets on gateway interface */ |
615 | for (i = 0; i < rl->rgi.n_addrs; ++i) | |
616 | { | |
617 | const struct route_gateway_address *gwa = &rl->rgi.addrs[i]; | |
618 | /* omit the add/subnet in &rl->rgi which we processed above */ | |
619 | if (!((rl->rgi.gateway.addr & rl->rgi.gateway.netmask) == (gwa->addr & gwa->netmask) | |
620 | && rl->rgi.gateway.netmask == gwa->netmask)) | |
621 | { | |
622 | add_block_local_item(rl, gwa, rl->spec.remote_endpoint); | |
623 | } | |
624 | } | |
7fb0e07e JY |
625 | } |
626 | } | |
627 | ||
6fbf66fa | 628 | bool |
81d882d5 DS |
629 | init_route_list(struct route_list *rl, |
630 | const struct route_option_list *opt, | |
631 | const char *remote_endpoint, | |
632 | int default_metric, | |
633 | in_addr_t remote_host, | |
aec4a3d1 AQ |
634 | struct env_set *es, |
635 | openvpn_net_ctx_t *ctx) | |
6fbf66fa | 636 | { |
81d882d5 DS |
637 | struct gc_arena gc = gc_new(); |
638 | bool ret = true; | |
6fbf66fa | 639 | |
81d882d5 | 640 | clear_route_list(rl); |
6fbf66fa | 641 | |
81d882d5 | 642 | rl->flags = opt->flags; |
3c7f2f55 | 643 | |
aa346849 | 644 | if (remote_host != IPV4_INVALID_ADDR) |
6fbf66fa | 645 | { |
81d882d5 DS |
646 | rl->spec.remote_host = remote_host; |
647 | rl->spec.flags |= RTSA_REMOTE_HOST; | |
6fbf66fa JY |
648 | } |
649 | ||
81d882d5 | 650 | if (default_metric) |
40ac3d7a | 651 | { |
81d882d5 DS |
652 | rl->spec.default_metric = default_metric; |
653 | rl->spec.flags |= RTSA_DEFAULT_METRIC; | |
40ac3d7a JY |
654 | } |
655 | ||
aec4a3d1 | 656 | get_default_gateway(&rl->rgi, ctx); |
81d882d5 | 657 | if (rl->rgi.flags & RGI_ADDR_DEFINED) |
6fbf66fa | 658 | { |
81d882d5 | 659 | setenv_route_addr(es, "net_gateway", rl->rgi.gateway.addr, -1); |
c29e08a2 | 660 | #if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL) |
81d882d5 | 661 | print_default_gateway(D_ROUTE, &rl->rgi, NULL); |
7fb0e07e | 662 | #endif |
3c7f2f55 | 663 | } |
81d882d5 | 664 | else |
03653f42 | 665 | { |
81d882d5 | 666 | dmsg(D_ROUTE, "ROUTE: default_gateway=UNDEF"); |
03653f42 | 667 | } |
3c7f2f55 | 668 | |
81d882d5 | 669 | if (rl->spec.flags & RTSA_REMOTE_HOST) |
6fbf66fa | 670 | { |
81d882d5 DS |
671 | rl->spec.remote_host_local = test_local_addr(remote_host, &rl->rgi); |
672 | } | |
6fbf66fa | 673 | |
81d882d5 DS |
674 | if (is_route_parm_defined(remote_endpoint)) |
675 | { | |
676 | bool defined = false; | |
677 | rl->spec.remote_endpoint = getaddr( | |
678 | GETADDR_RESOLVE | |
679 | | GETADDR_HOST_ORDER | |
680 | | GETADDR_WARN_ON_SIGNAL, | |
681 | remote_endpoint, | |
682 | 0, | |
683 | &defined, | |
684 | NULL); | |
685 | ||
686 | if (defined) | |
687 | { | |
688 | setenv_route_addr(es, "vpn_gateway", rl->spec.remote_endpoint, -1); | |
689 | rl->spec.flags |= RTSA_REMOTE_ENDPOINT; | |
690 | } | |
691 | else | |
692 | { | |
693 | msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve default gateway: %s", | |
694 | remote_endpoint); | |
695 | ret = false; | |
696 | } | |
6fbf66fa | 697 | } |
7fb0e07e | 698 | |
81d882d5 | 699 | if (rl->flags & RG_ENABLE) |
7fb0e07e | 700 | { |
81d882d5 DS |
701 | add_block_local(rl); |
702 | get_bypass_addresses(&rl->spec.bypass, rl->flags); | |
7fb0e07e | 703 | #ifdef ENABLE_DEBUG |
81d882d5 | 704 | print_bypass_addresses(&rl->spec.bypass); |
7fb0e07e JY |
705 | #endif |
706 | } | |
6fbf66fa | 707 | |
81d882d5 DS |
708 | /* parse the routes from opt to rl */ |
709 | { | |
710 | struct route_option *ro; | |
711 | for (ro = opt->routes; ro; ro = ro->next) | |
712 | { | |
713 | struct addrinfo *netlist = NULL; | |
714 | struct route_ipv4 r; | |
715 | ||
716 | if (!init_route(&r, &netlist, ro, rl)) | |
717 | { | |
718 | ret = false; | |
719 | } | |
720 | else | |
721 | { | |
722 | struct addrinfo *curele; | |
723 | for (curele = netlist; curele; curele = curele->ai_next) | |
724 | { | |
725 | struct route_ipv4 *new; | |
726 | ALLOC_OBJ_GC(new, struct route_ipv4, &rl->gc); | |
727 | *new = r; | |
728 | new->network = ntohl(((struct sockaddr_in *)curele->ai_addr)->sin_addr.s_addr); | |
729 | new->next = rl->routes; | |
730 | rl->routes = new; | |
731 | } | |
732 | } | |
733 | if (netlist) | |
734 | { | |
735 | gc_addspecial(netlist, &gc_freeaddrinfo_callback, &gc); | |
736 | } | |
737 | } | |
738 | } | |
739 | ||
740 | gc_free(&gc); | |
741 | return ret; | |
6fbf66fa JY |
742 | } |
743 | ||
3ddb5643 GD |
744 | /* check whether an IPv6 host address is covered by a given route_ipv6 |
745 | * (not the most beautiful implementation in the world, but portable and | |
746 | * "good enough") | |
747 | */ | |
748 | static bool | |
749 | route_ipv6_match_host( const struct route_ipv6 *r6, | |
81d882d5 | 750 | const struct in6_addr *host ) |
3ddb5643 GD |
751 | { |
752 | unsigned int bits = r6->netbits; | |
753 | int i; | |
754 | unsigned int mask; | |
755 | ||
81d882d5 DS |
756 | if (bits>128) |
757 | { | |
758 | return false; | |
759 | } | |
3ddb5643 | 760 | |
81d882d5 | 761 | for (i = 0; bits >= 8; i++, bits -= 8) |
3ddb5643 | 762 | { |
81d882d5 DS |
763 | if (r6->network.s6_addr[i] != host->s6_addr[i]) |
764 | { | |
765 | return false; | |
766 | } | |
3ddb5643 GD |
767 | } |
768 | ||
81d882d5 DS |
769 | if (bits == 0) |
770 | { | |
771 | return true; | |
772 | } | |
3ddb5643 GD |
773 | |
774 | mask = 0xff << (8-bits); | |
775 | ||
776 | if ( (r6->network.s6_addr[i] & mask) == (host->s6_addr[i] & mask )) | |
81d882d5 DS |
777 | { |
778 | return true; | |
779 | } | |
3ddb5643 GD |
780 | |
781 | return false; | |
782 | } | |
783 | ||
512cda46 | 784 | bool |
81d882d5 DS |
785 | init_route_ipv6_list(struct route_ipv6_list *rl6, |
786 | const struct route_ipv6_option_list *opt6, | |
787 | const char *remote_endpoint, | |
788 | int default_metric, | |
789 | const struct in6_addr *remote_host_ipv6, | |
c454b21e AQ |
790 | struct env_set *es, |
791 | openvpn_net_ctx_t *ctx) | |
512cda46 | 792 | { |
81d882d5 DS |
793 | struct gc_arena gc = gc_new(); |
794 | bool ret = true; | |
795 | bool need_remote_ipv6_route; | |
512cda46 | 796 | |
81d882d5 | 797 | clear_route_ipv6_list(rl6); |
512cda46 | 798 | |
81d882d5 | 799 | rl6->flags = opt6->flags; |
512cda46 | 800 | |
81d882d5 | 801 | if (remote_host_ipv6) |
3ddb5643 | 802 | { |
81d882d5 DS |
803 | rl6->remote_host_ipv6 = *remote_host_ipv6; |
804 | rl6->spec_flags |= RTSA_REMOTE_HOST; | |
3ddb5643 GD |
805 | } |
806 | ||
81d882d5 | 807 | if (default_metric >= 0) |
512cda46 | 808 | { |
81d882d5 DS |
809 | rl6->default_metric = default_metric; |
810 | rl6->spec_flags |= RTSA_DEFAULT_METRIC; | |
512cda46 GD |
811 | } |
812 | ||
81d882d5 DS |
813 | msg(D_ROUTE, "GDG6: remote_host_ipv6=%s", |
814 | remote_host_ipv6 ? print_in6_addr(*remote_host_ipv6, 0, &gc) : "n/a" ); | |
3ddb5643 | 815 | |
c454b21e | 816 | get_default_gateway_ipv6(&rl6->rgi6, remote_host_ipv6, ctx); |
81d882d5 | 817 | if (rl6->rgi6.flags & RGI_ADDR_DEFINED) |
3ddb5643 | 818 | { |
81d882d5 | 819 | setenv_str(es, "net_gateway_ipv6", print_in6_addr(rl6->rgi6.gateway.addr_ipv6, 0, &gc)); |
3ddb5643 | 820 | #if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL) |
81d882d5 | 821 | print_default_gateway(D_ROUTE, NULL, &rl6->rgi6); |
3ddb5643 GD |
822 | #endif |
823 | } | |
81d882d5 | 824 | else |
512cda46 | 825 | { |
81d882d5 | 826 | dmsg(D_ROUTE, "ROUTE6: default_gateway=UNDEF"); |
512cda46 GD |
827 | } |
828 | ||
81d882d5 | 829 | if (is_route_parm_defined( remote_endpoint )) |
512cda46 | 830 | { |
81d882d5 DS |
831 | if (inet_pton( AF_INET6, remote_endpoint, |
832 | &rl6->remote_endpoint_ipv6) == 1) | |
833 | { | |
834 | rl6->spec_flags |= RTSA_REMOTE_ENDPOINT; | |
835 | } | |
836 | else | |
512cda46 | 837 | { |
81d882d5 DS |
838 | msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve VPN endpoint: %s", remote_endpoint); |
839 | ret = false; | |
512cda46 | 840 | } |
512cda46 | 841 | } |
512cda46 | 842 | |
81d882d5 DS |
843 | /* parse the routes from opt6 to rl6 |
844 | * discovering potential overlaps with remote_host_ipv6 in the process | |
845 | */ | |
846 | need_remote_ipv6_route = false; | |
3ddb5643 | 847 | |
81d882d5 DS |
848 | { |
849 | struct route_ipv6_option *ro6; | |
850 | for (ro6 = opt6->routes_ipv6; ro6; ro6 = ro6->next) | |
851 | { | |
852 | struct route_ipv6 *r6; | |
853 | ALLOC_OBJ_GC(r6, struct route_ipv6, &rl6->gc); | |
854 | if (!init_route_ipv6(r6, ro6, rl6)) | |
855 | { | |
856 | ret = false; | |
857 | } | |
858 | else | |
859 | { | |
860 | r6->next = rl6->routes_ipv6; | |
861 | rl6->routes_ipv6 = r6; | |
3ddb5643 | 862 | |
1ff39cff | 863 | #ifndef TARGET_ANDROID |
81d882d5 DS |
864 | /* On Android the VPNService protect function call will take of |
865 | * avoiding routing loops, so ignore this part and let | |
866 | * need_remote_ipv6_route always evaluate to false | |
867 | */ | |
868 | if (remote_host_ipv6 | |
869 | && route_ipv6_match_host( r6, remote_host_ipv6 ) ) | |
870 | { | |
871 | need_remote_ipv6_route = true; | |
872 | msg(D_ROUTE, "ROUTE6: %s/%d overlaps IPv6 remote %s, adding host route to VPN endpoint", | |
873 | print_in6_addr(r6->network, 0, &gc), r6->netbits, | |
874 | print_in6_addr(*remote_host_ipv6, 0, &gc)); | |
875 | } | |
1ff39cff | 876 | #endif |
81d882d5 DS |
877 | } |
878 | } | |
879 | } | |
512cda46 | 880 | |
81d882d5 DS |
881 | /* add VPN server host route if needed */ |
882 | if (need_remote_ipv6_route) | |
3ddb5643 | 883 | { |
81d882d5 DS |
884 | if ( (rl6->rgi6.flags & (RGI_ADDR_DEFINED|RGI_IFACE_DEFINED) ) == |
885 | (RGI_ADDR_DEFINED|RGI_IFACE_DEFINED) ) | |
3ddb5643 | 886 | { |
81d882d5 DS |
887 | struct route_ipv6 *r6; |
888 | ALLOC_OBJ_CLEAR_GC(r6, struct route_ipv6, &rl6->gc); | |
889 | ||
890 | r6->network = *remote_host_ipv6; | |
891 | r6->netbits = 128; | |
892 | if (!(rl6->rgi6.flags & RGI_ON_LINK) ) | |
893 | { | |
894 | r6->gateway = rl6->rgi6.gateway.addr_ipv6; | |
895 | } | |
896 | r6->metric = 1; | |
445b192a | 897 | #ifdef _WIN32 |
81d882d5 | 898 | r6->adapter_index = rl6->rgi6.adapter_index; |
3ddb5643 | 899 | #else |
81d882d5 | 900 | r6->iface = rl6->rgi6.iface; |
3ddb5643 | 901 | #endif |
81d882d5 | 902 | r6->flags = RT_DEFINED | RT_METRIC_DEFINED; |
3ddb5643 | 903 | |
81d882d5 DS |
904 | r6->next = rl6->routes_ipv6; |
905 | rl6->routes_ipv6 = r6; | |
906 | } | |
907 | else | |
3ddb5643 | 908 | { |
81d882d5 DS |
909 | msg(M_WARN, "ROUTE6: IPv6 route overlaps with IPv6 remote address, but could not determine IPv6 gateway address + interface, expect failure\n" ); |
910 | } | |
3ddb5643 GD |
911 | } |
912 | ||
81d882d5 DS |
913 | gc_free(&gc); |
914 | return ret; | |
512cda46 GD |
915 | } |
916 | ||
e04c2536 | 917 | static bool |
81d882d5 DS |
918 | add_route3(in_addr_t network, |
919 | in_addr_t netmask, | |
920 | in_addr_t gateway, | |
921 | const struct tuntap *tt, | |
922 | unsigned int flags, | |
923 | const struct route_gateway_info *rgi, | |
aec4a3d1 AQ |
924 | const struct env_set *es, |
925 | openvpn_net_ctx_t *ctx) | |
81d882d5 DS |
926 | { |
927 | struct route_ipv4 r; | |
928 | CLEAR(r); | |
929 | r.flags = RT_DEFINED; | |
930 | r.network = network; | |
931 | r.netmask = netmask; | |
932 | r.gateway = gateway; | |
e04c2536 | 933 | return add_route(&r, tt, flags, rgi, es, ctx); |
6fbf66fa JY |
934 | } |
935 | ||
936 | static void | |
81d882d5 DS |
937 | del_route3(in_addr_t network, |
938 | in_addr_t netmask, | |
939 | in_addr_t gateway, | |
940 | const struct tuntap *tt, | |
941 | unsigned int flags, | |
942 | const struct route_gateway_info *rgi, | |
aec4a3d1 AQ |
943 | const struct env_set *es, |
944 | openvpn_net_ctx_t *ctx) | |
81d882d5 DS |
945 | { |
946 | struct route_ipv4 r; | |
947 | CLEAR(r); | |
948 | r.flags = RT_DEFINED|RT_ADDED; | |
949 | r.network = network; | |
950 | r.netmask = netmask; | |
951 | r.gateway = gateway; | |
aec4a3d1 | 952 | delete_route(&r, tt, flags, rgi, es, ctx); |
6fbf66fa JY |
953 | } |
954 | ||
e04c2536 | 955 | static bool |
81d882d5 DS |
956 | add_bypass_routes(struct route_bypass *rb, |
957 | in_addr_t gateway, | |
958 | const struct tuntap *tt, | |
959 | unsigned int flags, | |
960 | const struct route_gateway_info *rgi, | |
aec4a3d1 AQ |
961 | const struct env_set *es, |
962 | openvpn_net_ctx_t *ctx) | |
3c7f2f55 | 963 | { |
e04c2536 SN |
964 | int ret = true; |
965 | for (int i = 0; i < rb->n_bypass; ++i) | |
3c7f2f55 | 966 | { |
81d882d5 DS |
967 | if (rb->bypass[i]) |
968 | { | |
e04c2536 SN |
969 | ret = add_route3(rb->bypass[i], IPV4_NETMASK_HOST, gateway, tt, |
970 | flags | ROUTE_REF_GW, rgi, es, ctx) && ret; | |
81d882d5 | 971 | } |
3c7f2f55 | 972 | } |
e04c2536 | 973 | return ret; |
3c7f2f55 JY |
974 | } |
975 | ||
976 | static void | |
81d882d5 DS |
977 | del_bypass_routes(struct route_bypass *rb, |
978 | in_addr_t gateway, | |
979 | const struct tuntap *tt, | |
980 | unsigned int flags, | |
981 | const struct route_gateway_info *rgi, | |
aec4a3d1 AQ |
982 | const struct env_set *es, |
983 | openvpn_net_ctx_t *ctx) | |
3c7f2f55 | 984 | { |
81d882d5 DS |
985 | int i; |
986 | for (i = 0; i < rb->n_bypass; ++i) | |
3c7f2f55 | 987 | { |
81d882d5 DS |
988 | if (rb->bypass[i]) |
989 | { | |
990 | del_route3(rb->bypass[i], | |
991 | IPV4_NETMASK_HOST, | |
992 | gateway, | |
993 | tt, | |
994 | flags | ROUTE_REF_GW, | |
995 | rgi, | |
aec4a3d1 AQ |
996 | es, |
997 | ctx); | |
81d882d5 | 998 | } |
3c7f2f55 JY |
999 | } |
1000 | } | |
1001 | ||
e04c2536 | 1002 | static bool |
aec4a3d1 AQ |
1003 | redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, |
1004 | unsigned int flags, const struct env_set *es, | |
1005 | openvpn_net_ctx_t *ctx) | |
81d882d5 | 1006 | { |
826d8953 | 1007 | const char err[] = "NOTE: unable to redirect IPv4 default gateway --"; |
e04c2536 | 1008 | bool ret = true; |
6fbf66fa | 1009 | |
81d882d5 DS |
1010 | if (rl && rl->flags & RG_ENABLE) |
1011 | { | |
14670a9d AQ |
1012 | bool local = rl->flags & RG_LOCAL; |
1013 | ||
81d882d5 DS |
1014 | if (!(rl->spec.flags & RTSA_REMOTE_ENDPOINT) && (rl->flags & RG_REROUTE_GW)) |
1015 | { | |
1016 | msg(M_WARN, "%s VPN gateway parameter (--route-gateway or --ifconfig) is missing", err); | |
e04c2536 | 1017 | ret = false; |
81d882d5 | 1018 | } |
14670a9d AQ |
1019 | /* |
1020 | * check if a default route is defined, unless: | |
1021 | * - we are connecting to a remote host in our network | |
1022 | * - we are connecting to a non-IPv4 remote host (i.e. we use IPv6) | |
1023 | */ | |
1024 | else if (!(rl->rgi.flags & RGI_ADDR_DEFINED) && !local | |
23e11e59 | 1025 | && (rl->spec.flags & RTSA_REMOTE_HOST)) |
81d882d5 DS |
1026 | { |
1027 | msg(M_WARN, "%s Cannot read current default gateway from system", err); | |
e04c2536 | 1028 | ret = false; |
81d882d5 | 1029 | } |
81d882d5 DS |
1030 | else |
1031 | { | |
1032 | #ifndef TARGET_ANDROID | |
81d882d5 DS |
1033 | if (rl->flags & RG_AUTO_LOCAL) |
1034 | { | |
1035 | const int tla = rl->spec.remote_host_local; | |
1036 | if (tla == TLA_NONLOCAL) | |
1037 | { | |
1038 | dmsg(D_ROUTE, "ROUTE remote_host is NOT LOCAL"); | |
1039 | local = false; | |
1040 | } | |
1041 | else if (tla == TLA_LOCAL) | |
1042 | { | |
1043 | dmsg(D_ROUTE, "ROUTE remote_host is LOCAL"); | |
1044 | local = true; | |
1045 | } | |
1046 | } | |
1047 | if (!local) | |
1048 | { | |
1049 | /* route remote host to original default gateway */ | |
1050 | /* if remote_host is not ipv4 (ie: ipv6), just skip | |
1051 | * adding this special /32 route */ | |
23e11e59 GD |
1052 | if ((rl->spec.flags & RTSA_REMOTE_HOST) |
1053 | && rl->spec.remote_host != IPV4_INVALID_ADDR) | |
81d882d5 | 1054 | { |
e04c2536 SN |
1055 | ret = add_route3(rl->spec.remote_host, IPV4_NETMASK_HOST, |
1056 | rl->rgi.gateway.addr, tt, flags | ROUTE_REF_GW, | |
1057 | &rl->rgi, es, ctx); | |
81d882d5 DS |
1058 | rl->iflags |= RL_DID_LOCAL; |
1059 | } | |
1060 | else | |
1061 | { | |
1062 | dmsg(D_ROUTE, "ROUTE remote_host protocol differs from tunneled"); | |
1063 | } | |
1064 | } | |
1065 | #endif /* ifndef TARGET_ANDROID */ | |
1066 | ||
1067 | /* route DHCP/DNS server traffic through original default gateway */ | |
e04c2536 | 1068 | ret = add_bypass_routes(&rl->spec.bypass, rl->rgi.gateway.addr, tt, flags, |
8067cc8d | 1069 | &rl->rgi, es, ctx) && ret; |
81d882d5 DS |
1070 | |
1071 | if (rl->flags & RG_REROUTE_GW) | |
1072 | { | |
1073 | if (rl->flags & RG_DEF1) | |
1074 | { | |
1075 | /* add new default route (1st component) */ | |
e04c2536 SN |
1076 | ret = add_route3(0x00000000, 0x80000000, rl->spec.remote_endpoint, |
1077 | tt, flags, &rl->rgi, es, ctx) && ret; | |
81d882d5 DS |
1078 | |
1079 | /* add new default route (2nd component) */ | |
e04c2536 SN |
1080 | ret = add_route3(0x80000000, 0x80000000, rl->spec.remote_endpoint, |
1081 | tt, flags, &rl->rgi, es, ctx) && ret; | |
81d882d5 DS |
1082 | } |
1083 | else | |
1084 | { | |
14670a9d AQ |
1085 | /* don't try to remove the def route if it does not exist */ |
1086 | if (rl->rgi.flags & RGI_ADDR_DEFINED) | |
1087 | { | |
1088 | /* delete default route */ | |
1089 | del_route3(0, 0, rl->rgi.gateway.addr, tt, | |
aec4a3d1 | 1090 | flags | ROUTE_REF_GW, &rl->rgi, es, ctx); |
14670a9d | 1091 | } |
81d882d5 DS |
1092 | |
1093 | /* add new default route */ | |
e04c2536 SN |
1094 | ret = add_route3(0, 0, rl->spec.remote_endpoint, tt, |
1095 | flags, &rl->rgi, es, ctx) && ret; | |
81d882d5 DS |
1096 | } |
1097 | } | |
1098 | ||
1099 | /* set a flag so we can undo later */ | |
1100 | rl->iflags |= RL_DID_REDIRECT_DEFAULT_GATEWAY; | |
1101 | } | |
b723833b | 1102 | } |
e04c2536 | 1103 | return ret; |
b723833b JY |
1104 | } |
1105 | ||
1106 | static void | |
aec4a3d1 AQ |
1107 | undo_redirect_default_route_to_vpn(struct route_list *rl, |
1108 | const struct tuntap *tt, unsigned int flags, | |
1109 | const struct env_set *es, | |
1110 | openvpn_net_ctx_t *ctx) | |
81d882d5 DS |
1111 | { |
1112 | if (rl && rl->iflags & RL_DID_REDIRECT_DEFAULT_GATEWAY) | |
1113 | { | |
1114 | /* delete remote host route */ | |
1115 | if (rl->iflags & RL_DID_LOCAL) | |
1116 | { | |
1117 | del_route3(rl->spec.remote_host, | |
1118 | IPV4_NETMASK_HOST, | |
1119 | rl->rgi.gateway.addr, | |
1120 | tt, | |
1121 | flags | ROUTE_REF_GW, | |
1122 | &rl->rgi, | |
aec4a3d1 AQ |
1123 | es, |
1124 | ctx); | |
81d882d5 DS |
1125 | rl->iflags &= ~RL_DID_LOCAL; |
1126 | } | |
1127 | ||
1128 | /* delete special DHCP/DNS bypass route */ | |
aec4a3d1 AQ |
1129 | del_bypass_routes(&rl->spec.bypass, rl->rgi.gateway.addr, tt, flags, |
1130 | &rl->rgi, es, ctx); | |
81d882d5 DS |
1131 | |
1132 | if (rl->flags & RG_REROUTE_GW) | |
1133 | { | |
1134 | if (rl->flags & RG_DEF1) | |
1135 | { | |
1136 | /* delete default route (1st component) */ | |
1137 | del_route3(0x00000000, | |
1138 | 0x80000000, | |
1139 | rl->spec.remote_endpoint, | |
1140 | tt, | |
1141 | flags, | |
1142 | &rl->rgi, | |
aec4a3d1 AQ |
1143 | es, |
1144 | ctx); | |
81d882d5 DS |
1145 | |
1146 | /* delete default route (2nd component) */ | |
1147 | del_route3(0x80000000, | |
1148 | 0x80000000, | |
1149 | rl->spec.remote_endpoint, | |
1150 | tt, | |
1151 | flags, | |
1152 | &rl->rgi, | |
aec4a3d1 AQ |
1153 | es, |
1154 | ctx); | |
81d882d5 DS |
1155 | } |
1156 | else | |
1157 | { | |
1158 | /* delete default route */ | |
1159 | del_route3(0, | |
1160 | 0, | |
1161 | rl->spec.remote_endpoint, | |
1162 | tt, | |
1163 | flags, | |
1164 | &rl->rgi, | |
aec4a3d1 AQ |
1165 | es, |
1166 | ctx); | |
14670a9d AQ |
1167 | /* restore original default route if there was any */ |
1168 | if (rl->rgi.flags & RGI_ADDR_DEFINED) | |
1169 | { | |
1170 | add_route3(0, 0, rl->rgi.gateway.addr, tt, | |
aec4a3d1 | 1171 | flags | ROUTE_REF_GW, &rl->rgi, es, ctx); |
14670a9d | 1172 | } |
81d882d5 DS |
1173 | } |
1174 | } | |
1175 | ||
1176 | rl->iflags &= ~RL_DID_REDIRECT_DEFAULT_GATEWAY; | |
6fbf66fa JY |
1177 | } |
1178 | } | |
1179 | ||
e04c2536 | 1180 | bool |
aec4a3d1 AQ |
1181 | add_routes(struct route_list *rl, struct route_ipv6_list *rl6, |
1182 | const struct tuntap *tt, unsigned int flags, | |
1183 | const struct env_set *es, openvpn_net_ctx_t *ctx) | |
6fbf66fa | 1184 | { |
e04c2536 | 1185 | bool ret = redirect_default_route_to_vpn(rl, tt, flags, es, ctx); |
81d882d5 | 1186 | if (rl && !(rl->iflags & RL_ROUTES_ADDED) ) |
6fbf66fa | 1187 | { |
81d882d5 | 1188 | struct route_ipv4 *r; |
6fbf66fa | 1189 | |
826d8953 AQ |
1190 | if (rl->routes && !tt->did_ifconfig_setup) |
1191 | { | |
1192 | msg(M_INFO, "WARNING: OpenVPN was configured to add an IPv4 " | |
1193 | "route. However, no IPv4 has been configured for %s, " | |
1194 | "therefore the route installation may fail or may not work " | |
1195 | "as expected.", tt->actual_name); | |
1196 | } | |
1197 | ||
6fbf66fa | 1198 | #ifdef ENABLE_MANAGEMENT |
81d882d5 DS |
1199 | if (management && rl->routes) |
1200 | { | |
1201 | management_set_state(management, | |
1202 | OPENVPN_STATE_ADD_ROUTES, | |
1203 | NULL, | |
1204 | NULL, | |
1205 | NULL, | |
1206 | NULL, | |
1207 | NULL); | |
1208 | } | |
6fbf66fa | 1209 | #endif |
d0085293 | 1210 | |
81d882d5 DS |
1211 | for (r = rl->routes; r; r = r->next) |
1212 | { | |
1213 | check_subnet_conflict(r->network, r->netmask, "route"); | |
1214 | if (flags & ROUTE_DELETE_FIRST) | |
1215 | { | |
aec4a3d1 | 1216 | delete_route(r, tt, flags, &rl->rgi, es, ctx); |
81d882d5 | 1217 | } |
e04c2536 | 1218 | ret = add_route(r, tt, flags, &rl->rgi, es, ctx) && ret; |
81d882d5 DS |
1219 | } |
1220 | rl->iflags |= RL_ROUTES_ADDED; | |
6fbf66fa | 1221 | } |
81d882d5 | 1222 | if (rl6 && !(rl6->iflags & RL_ROUTES_ADDED) ) |
512cda46 | 1223 | { |
81d882d5 | 1224 | struct route_ipv6 *r; |
2b7650e7 AQ |
1225 | |
1226 | if (!tt->did_ifconfig_ipv6_setup) | |
1227 | { | |
1228 | msg(M_INFO, "WARNING: OpenVPN was configured to add an IPv6 " | |
826d8953 AQ |
1229 | "route. However, no IPv6 has been configured for %s, " |
1230 | "therefore the route installation may fail or may not work " | |
1231 | "as expected.", tt->actual_name); | |
2b7650e7 AQ |
1232 | } |
1233 | ||
81d882d5 DS |
1234 | for (r = rl6->routes_ipv6; r; r = r->next) |
1235 | { | |
1236 | if (flags & ROUTE_DELETE_FIRST) | |
1237 | { | |
aec4a3d1 | 1238 | delete_route_ipv6(r, tt, flags, es, ctx); |
81d882d5 | 1239 | } |
e04c2536 | 1240 | ret = add_route_ipv6(r, tt, flags, es, ctx) && ret; |
81d882d5 DS |
1241 | } |
1242 | rl6->iflags |= RL_ROUTES_ADDED; | |
512cda46 | 1243 | } |
e04c2536 | 1244 | return ret; |
6fbf66fa JY |
1245 | } |
1246 | ||
1247 | void | |
81d882d5 | 1248 | delete_routes(struct route_list *rl, struct route_ipv6_list *rl6, |
aec4a3d1 AQ |
1249 | const struct tuntap *tt, unsigned int flags, |
1250 | const struct env_set *es, openvpn_net_ctx_t *ctx) | |
6fbf66fa | 1251 | { |
81d882d5 | 1252 | if (rl && rl->iflags & RL_ROUTES_ADDED) |
6fbf66fa | 1253 | { |
81d882d5 DS |
1254 | struct route_ipv4 *r; |
1255 | for (r = rl->routes; r; r = r->next) | |
1256 | { | |
aec4a3d1 | 1257 | delete_route(r, tt, flags, &rl->rgi, es, ctx); |
81d882d5 DS |
1258 | } |
1259 | rl->iflags &= ~RL_ROUTES_ADDED; | |
6fbf66fa | 1260 | } |
6fbf66fa | 1261 | |
aec4a3d1 | 1262 | undo_redirect_default_route_to_vpn(rl, tt, flags, es, ctx); |
f0257abb | 1263 | |
81d882d5 | 1264 | if (rl) |
f0257abb | 1265 | { |
81d882d5 | 1266 | clear_route_list(rl); |
f0257abb | 1267 | } |
512cda46 | 1268 | |
81d882d5 | 1269 | if (rl6 && (rl6->iflags & RL_ROUTES_ADDED) ) |
512cda46 | 1270 | { |
81d882d5 DS |
1271 | struct route_ipv6 *r6; |
1272 | for (r6 = rl6->routes_ipv6; r6; r6 = r6->next) | |
1273 | { | |
aec4a3d1 | 1274 | delete_route_ipv6(r6, tt, flags, es, ctx); |
81d882d5 DS |
1275 | } |
1276 | rl6->iflags &= ~RL_ROUTES_ADDED; | |
512cda46 GD |
1277 | } |
1278 | ||
81d882d5 | 1279 | if (rl6) |
512cda46 | 1280 | { |
81d882d5 | 1281 | clear_route_ipv6_list(rl6); |
512cda46 | 1282 | } |
6fbf66fa JY |
1283 | } |
1284 | ||
6c61d0dd | 1285 | #ifndef ENABLE_SMALL |
6fbf66fa JY |
1286 | |
1287 | static const char * | |
81d882d5 | 1288 | show_opt(const char *option) |
6fbf66fa | 1289 | { |
81d882d5 DS |
1290 | if (!option) |
1291 | { | |
1292 | return "default (not set)"; | |
1293 | } | |
1294 | else | |
1295 | { | |
1296 | return option; | |
1297 | } | |
6fbf66fa JY |
1298 | } |
1299 | ||
1300 | static void | |
81d882d5 | 1301 | print_route_option(const struct route_option *ro, int level) |
6fbf66fa | 1302 | { |
81d882d5 DS |
1303 | msg(level, " route %s/%s/%s/%s", |
1304 | show_opt(ro->network), | |
1305 | show_opt(ro->netmask), | |
1306 | show_opt(ro->gateway), | |
1307 | show_opt(ro->metric)); | |
6fbf66fa JY |
1308 | } |
1309 | ||
1310 | void | |
81d882d5 DS |
1311 | print_route_options(const struct route_option_list *rol, |
1312 | int level) | |
6fbf66fa | 1313 | { |
81d882d5 DS |
1314 | struct route_option *ro; |
1315 | if (rol->flags & RG_ENABLE) | |
1316 | { | |
1317 | msg(level, " [redirect_default_gateway local=%d]", | |
1318 | (rol->flags & RG_LOCAL) != 0); | |
1319 | } | |
1320 | for (ro = rol->routes; ro; ro = ro->next) | |
4cd4899e | 1321 | { |
81d882d5 | 1322 | print_route_option(ro, level); |
4cd4899e | 1323 | } |
6fbf66fa JY |
1324 | } |
1325 | ||
7fb0e07e | 1326 | void |
d8a8656f | 1327 | print_default_gateway(const int msglevel, |
81d882d5 DS |
1328 | const struct route_gateway_info *rgi, |
1329 | const struct route_ipv6_gateway_info *rgi6) | |
1330 | { | |
1331 | struct gc_arena gc = gc_new(); | |
1332 | if (rgi && (rgi->flags & RGI_ADDR_DEFINED)) | |
1333 | { | |
1334 | struct buffer out = alloc_buf_gc(256, &gc); | |
1335 | buf_printf(&out, "ROUTE_GATEWAY"); | |
1336 | if (rgi->flags & RGI_ON_LINK) | |
1337 | { | |
1338 | buf_printf(&out, " ON_LINK"); | |
1339 | } | |
1340 | else | |
1341 | { | |
1342 | buf_printf(&out, " %s", print_in_addr_t(rgi->gateway.addr, 0, &gc)); | |
1343 | } | |
1344 | if (rgi->flags & RGI_NETMASK_DEFINED) | |
1345 | { | |
1346 | buf_printf(&out, "/%s", print_in_addr_t(rgi->gateway.netmask, 0, &gc)); | |
1347 | } | |
445b192a | 1348 | #ifdef _WIN32 |
81d882d5 DS |
1349 | if (rgi->flags & RGI_IFACE_DEFINED) |
1350 | { | |
06ad53e0 | 1351 | buf_printf(&out, " I=%lu", rgi->adapter_index); |
81d882d5 | 1352 | } |
7fb0e07e | 1353 | #else |
81d882d5 DS |
1354 | if (rgi->flags & RGI_IFACE_DEFINED) |
1355 | { | |
1356 | buf_printf(&out, " IFACE=%s", rgi->iface); | |
1357 | } | |
7fb0e07e | 1358 | #endif |
81d882d5 DS |
1359 | if (rgi->flags & RGI_HWADDR_DEFINED) |
1360 | { | |
1361 | buf_printf(&out, " HWADDR=%s", format_hex_ex(rgi->hwaddr, 6, 0, 1, ":", &gc)); | |
1362 | } | |
1363 | msg(msglevel, "%s", BSTR(&out)); | |
7fb0e07e | 1364 | } |
d8a8656f | 1365 | |
81d882d5 | 1366 | if (rgi6 && (rgi6->flags & RGI_ADDR_DEFINED)) |
d8a8656f | 1367 | { |
81d882d5 DS |
1368 | struct buffer out = alloc_buf_gc(256, &gc); |
1369 | buf_printf(&out, "ROUTE6_GATEWAY"); | |
1370 | buf_printf(&out, " %s", print_in6_addr(rgi6->gateway.addr_ipv6, 0, &gc)); | |
1371 | if (rgi6->flags & RGI_ON_LINK) | |
1372 | { | |
1373 | buf_printf(&out, " ON_LINK"); | |
1374 | } | |
1375 | if (rgi6->flags & RGI_NETMASK_DEFINED) | |
1376 | { | |
1377 | buf_printf(&out, "/%d", rgi6->gateway.netbits_ipv6); | |
1378 | } | |
445b192a | 1379 | #ifdef _WIN32 |
81d882d5 DS |
1380 | if (rgi6->flags & RGI_IFACE_DEFINED) |
1381 | { | |
06ad53e0 | 1382 | buf_printf(&out, " I=%lu", rgi6->adapter_index); |
81d882d5 | 1383 | } |
d8a8656f | 1384 | #else |
81d882d5 DS |
1385 | if (rgi6->flags & RGI_IFACE_DEFINED) |
1386 | { | |
1387 | buf_printf(&out, " IFACE=%s", rgi6->iface); | |
1388 | } | |
d8a8656f | 1389 | #endif |
81d882d5 DS |
1390 | if (rgi6->flags & RGI_HWADDR_DEFINED) |
1391 | { | |
1392 | buf_printf(&out, " HWADDR=%s", format_hex_ex(rgi6->hwaddr, 6, 0, 1, ":", &gc)); | |
1393 | } | |
1394 | msg(msglevel, "%s", BSTR(&out)); | |
d8a8656f | 1395 | } |
81d882d5 | 1396 | gc_free(&gc); |
7fb0e07e JY |
1397 | } |
1398 | ||
81d882d5 | 1399 | #endif /* ifndef ENABLE_SMALL */ |
6fbf66fa JY |
1400 | |
1401 | static void | |
81d882d5 | 1402 | print_route(const struct route_ipv4 *r, int level) |
6fbf66fa | 1403 | { |
81d882d5 DS |
1404 | struct gc_arena gc = gc_new(); |
1405 | if (r->flags & RT_DEFINED) | |
1406 | { | |
1407 | msg(level, "%s", route_string(r, &gc)); | |
1408 | } | |
1409 | gc_free(&gc); | |
6fbf66fa JY |
1410 | } |
1411 | ||
1412 | void | |
81d882d5 | 1413 | print_routes(const struct route_list *rl, int level) |
6fbf66fa | 1414 | { |
81d882d5 DS |
1415 | struct route_ipv4 *r; |
1416 | for (r = rl->routes; r; r = r->next) | |
4cd4899e | 1417 | { |
81d882d5 | 1418 | print_route(r, level); |
4cd4899e | 1419 | } |
6fbf66fa JY |
1420 | } |
1421 | ||
1422 | static void | |
81d882d5 | 1423 | setenv_route(struct env_set *es, const struct route_ipv4 *r, int i) |
6fbf66fa | 1424 | { |
81d882d5 DS |
1425 | struct gc_arena gc = gc_new(); |
1426 | if (r->flags & RT_DEFINED) | |
6fbf66fa | 1427 | { |
81d882d5 DS |
1428 | setenv_route_addr(es, "network", r->network, i); |
1429 | setenv_route_addr(es, "netmask", r->netmask, i); | |
1430 | setenv_route_addr(es, "gateway", r->gateway, i); | |
6fbf66fa | 1431 | |
81d882d5 DS |
1432 | if (r->flags & RT_METRIC_DEFINED) |
1433 | { | |
1434 | struct buffer name = alloc_buf_gc(256, &gc); | |
1435 | buf_printf(&name, "route_metric_%d", i); | |
1436 | setenv_int(es, BSTR(&name), r->metric); | |
1437 | } | |
6fbf66fa | 1438 | } |
81d882d5 | 1439 | gc_free(&gc); |
6fbf66fa JY |
1440 | } |
1441 | ||
1442 | void | |
81d882d5 | 1443 | setenv_routes(struct env_set *es, const struct route_list *rl) |
6fbf66fa | 1444 | { |
81d882d5 DS |
1445 | int i = 1; |
1446 | struct route_ipv4 *r; | |
1447 | for (r = rl->routes; r; r = r->next) | |
4cd4899e | 1448 | { |
81d882d5 | 1449 | setenv_route(es, r, i++); |
4cd4899e | 1450 | } |
6fbf66fa JY |
1451 | } |
1452 | ||
512cda46 | 1453 | static void |
81d882d5 | 1454 | setenv_route_ipv6(struct env_set *es, const struct route_ipv6 *r6, int i) |
512cda46 | 1455 | { |
81d882d5 DS |
1456 | struct gc_arena gc = gc_new(); |
1457 | if (r6->flags & RT_DEFINED) | |
512cda46 | 1458 | { |
81d882d5 DS |
1459 | struct buffer name1 = alloc_buf_gc( 256, &gc ); |
1460 | struct buffer val = alloc_buf_gc( 256, &gc ); | |
1461 | struct buffer name2 = alloc_buf_gc( 256, &gc ); | |
512cda46 | 1462 | |
81d882d5 DS |
1463 | buf_printf( &name1, "route_ipv6_network_%d", i ); |
1464 | buf_printf( &val, "%s/%d", print_in6_addr( r6->network, 0, &gc ), | |
1465 | r6->netbits ); | |
1466 | setenv_str( es, BSTR(&name1), BSTR(&val) ); | |
512cda46 | 1467 | |
81d882d5 DS |
1468 | buf_printf( &name2, "route_ipv6_gateway_%d", i ); |
1469 | setenv_str( es, BSTR(&name2), print_in6_addr( r6->gateway, 0, &gc )); | |
bfb28845 JS |
1470 | |
1471 | if (r6->flags & RT_METRIC_DEFINED) | |
1472 | { | |
1473 | struct buffer name3 = alloc_buf_gc( 256, &gc ); | |
abe49856 | 1474 | buf_printf( &name3, "route_ipv6_metric_%d", i); |
bfb28845 JS |
1475 | setenv_int( es, BSTR(&name3), r6->metric); |
1476 | } | |
512cda46 | 1477 | } |
81d882d5 | 1478 | gc_free(&gc); |
512cda46 GD |
1479 | } |
1480 | void | |
81d882d5 | 1481 | setenv_routes_ipv6(struct env_set *es, const struct route_ipv6_list *rl6) |
512cda46 | 1482 | { |
81d882d5 DS |
1483 | int i = 1; |
1484 | struct route_ipv6 *r6; | |
1485 | for (r6 = rl6->routes_ipv6; r6; r6 = r6->next) | |
4cd4899e | 1486 | { |
81d882d5 | 1487 | setenv_route_ipv6(es, r6, i++); |
4cd4899e | 1488 | } |
512cda46 GD |
1489 | } |
1490 | ||
7fb0e07e JY |
1491 | /* |
1492 | * local_route() determines whether the gateway of a provided host | |
1493 | * route is on the same interface that owns the default gateway. | |
1494 | * It uses the data structure | |
1495 | * returned by get_default_gateway() (struct route_gateway_info) | |
1496 | * to determine this. If the route is local, LR_MATCH is returned. | |
1497 | * When adding routes into the kernel, if LR_MATCH is defined for | |
1498 | * a given route, the route should explicitly reference the default | |
1499 | * gateway interface as the route destination. For example, here | |
1500 | * is an example on Linux that uses LR_MATCH: | |
1501 | * | |
576dc96c | 1502 | * route add -net 10.10.0.1 netmask 255.255.255.255 dev eth0 |
7fb0e07e JY |
1503 | * |
1504 | * This capability is needed by the "default-gateway block-local" | |
1505 | * directive, to allow client access to the local subnet to be | |
1506 | * blocked but still allow access to the local default gateway. | |
1507 | */ | |
1508 | ||
1509 | /* local_route() return values */ | |
1510 | #define LR_NOMATCH 0 /* route is not local */ | |
1511 | #define LR_MATCH 1 /* route is local */ | |
1512 | #define LR_ERROR 2 /* caller should abort adding route */ | |
1513 | ||
1514 | static int | |
81d882d5 DS |
1515 | local_route(in_addr_t network, |
1516 | in_addr_t netmask, | |
1517 | in_addr_t gateway, | |
1518 | const struct route_gateway_info *rgi) | |
1519 | { | |
1520 | /* set LR_MATCH on local host routes */ | |
1521 | const int rgi_needed = (RGI_ADDR_DEFINED|RGI_NETMASK_DEFINED|RGI_IFACE_DEFINED); | |
1522 | if (rgi | |
1523 | && (rgi->flags & rgi_needed) == rgi_needed | |
1524 | && gateway == rgi->gateway.addr | |
1525 | && netmask == 0xFFFFFFFF) | |
1526 | { | |
1527 | if (((network ^ rgi->gateway.addr) & rgi->gateway.netmask) == 0) | |
1528 | { | |
1529 | return LR_MATCH; | |
1530 | } | |
1531 | else | |
1532 | { | |
1533 | /* examine additional subnets on gateway interface */ | |
1534 | size_t i; | |
1535 | for (i = 0; i < rgi->n_addrs; ++i) | |
1536 | { | |
1537 | const struct route_gateway_address *gwa = &rgi->addrs[i]; | |
1538 | if (((network ^ gwa->addr) & gwa->netmask) == 0) | |
1539 | { | |
1540 | return LR_MATCH; | |
1541 | } | |
1542 | } | |
1543 | } | |
7fb0e07e JY |
1544 | } |
1545 | return LR_NOMATCH; | |
1546 | } | |
1547 | ||
99035769 | 1548 | /* Return true if the "on-link" form of the route should be used. This is when the gateway for |
81d882d5 | 1549 | * a route is specified as an interface rather than an address. */ |
99035769 | 1550 | #if defined(TARGET_LINUX) || defined(_WIN32) || defined(TARGET_DARWIN) |
8fc83a2d | 1551 | static inline bool |
81d882d5 | 1552 | is_on_link(const int is_local_route, const unsigned int flags, const struct route_gateway_info *rgi) |
8fc83a2d | 1553 | { |
81d882d5 | 1554 | return rgi && (is_local_route == LR_MATCH || ((flags & ROUTE_REF_GW) && (rgi->flags & RGI_ON_LINK))); |
8fc83a2d | 1555 | } |
99035769 | 1556 | #endif |
8fc83a2d | 1557 | |
e04c2536 | 1558 | bool |
81d882d5 DS |
1559 | add_route(struct route_ipv4 *r, |
1560 | const struct tuntap *tt, | |
1561 | unsigned int flags, | |
1562 | const struct route_gateway_info *rgi, /* may be NULL */ | |
aec4a3d1 AQ |
1563 | const struct env_set *es, |
1564 | openvpn_net_ctx_t *ctx) | |
6fbf66fa | 1565 | { |
9c6d72c7 | 1566 | int status = 0; |
81d882d5 DS |
1567 | int is_local_route; |
1568 | ||
1569 | if (!(r->flags & RT_DEFINED)) | |
1570 | { | |
e04c2536 | 1571 | return true; /* no error */ |
81d882d5 | 1572 | } |
6fbf66fa | 1573 | |
903e2cf5 GD |
1574 | struct argv argv = argv_new(); |
1575 | struct gc_arena gc = gc_new(); | |
6fbf66fa | 1576 | |
aec4a3d1 | 1577 | #if !defined(TARGET_LINUX) |
903e2cf5 | 1578 | const char *network = print_in_addr_t(r->network, 0, &gc); |
d42f070c | 1579 | #if !defined(TARGET_AIX) |
903e2cf5 | 1580 | const char *netmask = print_in_addr_t(r->netmask, 0, &gc); |
22e75ca1 | 1581 | #endif |
903e2cf5 | 1582 | const char *gateway = print_in_addr_t(r->gateway, 0, &gc); |
aec4a3d1 | 1583 | #endif |
6fbf66fa | 1584 | |
81d882d5 DS |
1585 | is_local_route = local_route(r->network, r->netmask, r->gateway, rgi); |
1586 | if (is_local_route == LR_ERROR) | |
1587 | { | |
1588 | goto done; | |
1589 | } | |
6fbf66fa JY |
1590 | |
1591 | #if defined(TARGET_LINUX) | |
d42f070c AQ |
1592 | const char *iface = NULL; |
1593 | int metric = -1; | |
1594 | ||
81d882d5 DS |
1595 | if (is_on_link(is_local_route, flags, rgi)) |
1596 | { | |
aec4a3d1 | 1597 | iface = rgi->iface; |
81d882d5 | 1598 | } |
aec4a3d1 | 1599 | |
81d882d5 DS |
1600 | if (r->flags & RT_METRIC_DEFINED) |
1601 | { | |
aec4a3d1 | 1602 | metric = r->metric; |
81d882d5 | 1603 | } |
aec4a3d1 | 1604 | |
328cc40c | 1605 | status = RTA_SUCCESS; |
adc54f48 GD |
1606 | int ret = net_route_v4_add(ctx, &r->network, netmask_to_netbits2(r->netmask), |
1607 | &r->gateway, iface, 0, metric); | |
1608 | if (ret == -EEXIST) | |
1609 | { | |
1610 | msg(D_ROUTE, "NOTE: Linux route add command failed because route exists"); | |
1611 | status = RTA_EEXIST; | |
1612 | } | |
1613 | else if (ret < 0) | |
81d882d5 | 1614 | { |
aec4a3d1 | 1615 | msg(M_WARN, "ERROR: Linux route add command failed"); |
328cc40c | 1616 | status = RTA_ERROR; |
81d882d5 | 1617 | } |
7fb0e07e | 1618 | |
a55b3cdb | 1619 | #elif defined (TARGET_ANDROID) |
8fcc63b2 | 1620 | char out[128]; |
a55b3cdb | 1621 | |
81d882d5 DS |
1622 | if (rgi) |
1623 | { | |
8fcc63b2 | 1624 | openvpn_snprintf(out, sizeof(out), "%s %s %s dev %s", network, netmask, gateway, rgi->iface); |
81d882d5 DS |
1625 | } |
1626 | else | |
1627 | { | |
8fcc63b2 | 1628 | openvpn_snprintf(out, sizeof(out), "%s %s %s", network, netmask, gateway); |
81d882d5 | 1629 | } |
328cc40c SN |
1630 | bool ret = management_android_control(management, "ROUTE", out); |
1631 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
a55b3cdb | 1632 | |
445b192a | 1633 | #elif defined (_WIN32) |
81d882d5 DS |
1634 | { |
1635 | DWORD ai = TUN_ADAPTER_INDEX_INVALID; | |
4ed7bf7f | 1636 | argv_printf(&argv, "%s%s ADD %s MASK %s %s", |
81d882d5 DS |
1637 | get_win_sys_path(), |
1638 | WIN_ROUTE_PATH_SUFFIX, | |
1639 | network, | |
1640 | netmask, | |
1641 | gateway); | |
1642 | if (r->flags & RT_METRIC_DEFINED) | |
1643 | { | |
1644 | argv_printf_cat(&argv, "METRIC %d", r->metric); | |
1645 | } | |
1646 | if (is_on_link(is_local_route, flags, rgi)) | |
1647 | { | |
1648 | ai = rgi->adapter_index; | |
06ad53e0 | 1649 | argv_printf_cat(&argv, "IF %lu", ai); |
81d882d5 | 1650 | } |
6fbf66fa | 1651 | |
81d882d5 | 1652 | argv_msg(D_ROUTE, &argv); |
6fbf66fa | 1653 | |
a45c201e | 1654 | const char *method = "service"; |
81d882d5 DS |
1655 | if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_SERVICE) |
1656 | { | |
1657 | status = add_route_service(r, tt); | |
81d882d5 DS |
1658 | } |
1659 | else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_IPAPI) | |
1660 | { | |
1661 | status = add_route_ipapi(r, tt, ai); | |
a45c201e | 1662 | method = "ipapi"; |
81d882d5 DS |
1663 | } |
1664 | else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_EXE) | |
1665 | { | |
1666 | netcmd_semaphore_lock(); | |
328cc40c SN |
1667 | bool ret = openvpn_execve_check(&argv, es, 0, |
1668 | "ERROR: Windows route add command failed"); | |
1669 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
81d882d5 | 1670 | netcmd_semaphore_release(); |
a45c201e | 1671 | method = "route.exe"; |
81d882d5 DS |
1672 | } |
1673 | else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_ADAPTIVE) | |
1674 | { | |
1675 | status = add_route_ipapi(r, tt, ai); | |
a45c201e | 1676 | method = "ipapi [adaptive]"; |
328cc40c | 1677 | if (status == RTA_ERROR) |
81d882d5 DS |
1678 | { |
1679 | msg(D_ROUTE, "Route addition fallback to route.exe"); | |
1680 | netcmd_semaphore_lock(); | |
328cc40c SN |
1681 | bool ret = openvpn_execve_check(&argv, es, 0, |
1682 | "ERROR: Windows route add command failed [adaptive]"); | |
1683 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
81d882d5 | 1684 | netcmd_semaphore_release(); |
a45c201e | 1685 | method = "route.exe"; |
81d882d5 DS |
1686 | } |
1687 | } | |
1688 | else | |
1689 | { | |
1690 | ASSERT(0); | |
1691 | } | |
a45c201e SN |
1692 | if (status != RTA_ERROR) /* error is logged upstream */ |
1693 | { | |
1694 | msg(D_ROUTE, "Route addition via %s %s", method, | |
1695 | (status == RTA_SUCCESS) ? "succeeded" : "failed because route exists"); | |
1696 | } | |
81d882d5 | 1697 | } |
6fbf66fa JY |
1698 | |
1699 | #elif defined (TARGET_SOLARIS) | |
1700 | ||
81d882d5 | 1701 | /* example: route add 192.0.2.32 -netmask 255.255.255.224 somegateway */ |
6fbf66fa | 1702 | |
81d882d5 DS |
1703 | argv_printf(&argv, "%s add", |
1704 | ROUTE_PATH); | |
6fbf66fa | 1705 | |
81d882d5 DS |
1706 | argv_printf_cat(&argv, "%s -netmask %s %s", |
1707 | network, | |
1708 | netmask, | |
1709 | gateway); | |
6fbf66fa | 1710 | |
81d882d5 DS |
1711 | /* Solaris can only distinguish between "metric 0" == "on-link on the |
1712 | * interface where the IP address given is configured" and "metric > 0" | |
1713 | * == "use gateway specified" (no finer-grained route metrics available) | |
1714 | * | |
1715 | * More recent versions of Solaris can also do "-interface", but that | |
1716 | * would break backwards compatibility with older versions for no gain. | |
1717 | */ | |
1718 | if (r->flags & RT_METRIC_DEFINED) | |
1719 | { | |
1720 | argv_printf_cat(&argv, "%d", r->metric); | |
1721 | } | |
f0eac1a5 | 1722 | |
81d882d5 | 1723 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
1724 | bool ret = openvpn_execve_check(&argv, es, 0, |
1725 | "ERROR: Solaris route add command failed"); | |
1726 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
6fbf66fa JY |
1727 | |
1728 | #elif defined(TARGET_FREEBSD) | |
1729 | ||
81d882d5 DS |
1730 | argv_printf(&argv, "%s add", |
1731 | ROUTE_PATH); | |
6fbf66fa JY |
1732 | |
1733 | #if 0 | |
81d882d5 DS |
1734 | if (r->flags & RT_METRIC_DEFINED) |
1735 | { | |
1736 | argv_printf_cat(&argv, "-rtt %d", r->metric); | |
1737 | } | |
6fbf66fa JY |
1738 | #endif |
1739 | ||
81d882d5 DS |
1740 | argv_printf_cat(&argv, "-net %s %s %s", |
1741 | network, | |
1742 | gateway, | |
1743 | netmask); | |
6fbf66fa | 1744 | |
81d882d5 | 1745 | /* FIXME -- add on-link support for FreeBSD */ |
7fb0e07e | 1746 | |
81d882d5 | 1747 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
1748 | bool ret = openvpn_execve_check(&argv, es, 0, |
1749 | "ERROR: FreeBSD route add command failed"); | |
1750 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
6fbf66fa | 1751 | |
1bda73a7 JY |
1752 | #elif defined(TARGET_DRAGONFLY) |
1753 | ||
81d882d5 DS |
1754 | argv_printf(&argv, "%s add", |
1755 | ROUTE_PATH); | |
1bda73a7 JY |
1756 | |
1757 | #if 0 | |
81d882d5 DS |
1758 | if (r->flags & RT_METRIC_DEFINED) |
1759 | { | |
1760 | argv_printf_cat(&argv, "-rtt %d", r->metric); | |
1761 | } | |
1bda73a7 JY |
1762 | #endif |
1763 | ||
81d882d5 DS |
1764 | argv_printf_cat(&argv, "-net %s %s %s", |
1765 | network, | |
1766 | gateway, | |
1767 | netmask); | |
1bda73a7 | 1768 | |
81d882d5 | 1769 | /* FIXME -- add on-link support for Dragonfly */ |
7fb0e07e | 1770 | |
81d882d5 | 1771 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
1772 | bool ret = openvpn_execve_check(&argv, es, 0, |
1773 | "ERROR: DragonFly route add command failed"); | |
1774 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
1bda73a7 | 1775 | |
6fbf66fa JY |
1776 | #elif defined(TARGET_DARWIN) |
1777 | ||
81d882d5 DS |
1778 | argv_printf(&argv, "%s add", |
1779 | ROUTE_PATH); | |
6fbf66fa JY |
1780 | |
1781 | #if 0 | |
81d882d5 DS |
1782 | if (r->flags & RT_METRIC_DEFINED) |
1783 | { | |
1784 | argv_printf_cat(&argv, "-rtt %d", r->metric); | |
1785 | } | |
6fbf66fa JY |
1786 | #endif |
1787 | ||
81d882d5 | 1788 | if (is_on_link(is_local_route, flags, rgi)) |
7fb0e07e | 1789 | { |
81d882d5 DS |
1790 | /* Mac OS X route syntax for ON_LINK: |
1791 | * route add -cloning -net 10.10.0.1 -netmask 255.255.255.255 -interface en0 */ | |
1792 | argv_printf_cat(&argv, "-cloning -net %s -netmask %s -interface %s", | |
1793 | network, | |
1794 | netmask, | |
1795 | rgi->iface); | |
7fb0e07e | 1796 | } |
81d882d5 | 1797 | else |
7fb0e07e | 1798 | { |
81d882d5 DS |
1799 | argv_printf_cat(&argv, "-net %s %s %s", |
1800 | network, | |
1801 | gateway, | |
1802 | netmask); | |
7fb0e07e | 1803 | } |
6fbf66fa | 1804 | |
81d882d5 | 1805 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
1806 | bool ret = openvpn_execve_check(&argv, es, 0, |
1807 | "ERROR: OS X route add command failed"); | |
1808 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
6fbf66fa JY |
1809 | |
1810 | #elif defined(TARGET_OPENBSD) || defined(TARGET_NETBSD) | |
1811 | ||
81d882d5 DS |
1812 | argv_printf(&argv, "%s add", |
1813 | ROUTE_PATH); | |
6fbf66fa JY |
1814 | |
1815 | #if 0 | |
81d882d5 DS |
1816 | if (r->flags & RT_METRIC_DEFINED) |
1817 | { | |
1818 | argv_printf_cat(&argv, "-rtt %d", r->metric); | |
1819 | } | |
6fbf66fa JY |
1820 | #endif |
1821 | ||
81d882d5 DS |
1822 | argv_printf_cat(&argv, "-net %s %s -netmask %s", |
1823 | network, | |
1824 | gateway, | |
1825 | netmask); | |
6fbf66fa | 1826 | |
81d882d5 | 1827 | /* FIXME -- add on-link support for OpenBSD/NetBSD */ |
7fb0e07e | 1828 | |
81d882d5 | 1829 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
1830 | bool ret = openvpn_execve_check(&argv, es, 0, |
1831 | "ERROR: OpenBSD/NetBSD route add command failed"); | |
1832 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
6fbf66fa | 1833 | |
b4b92ae5 GD |
1834 | #elif defined(TARGET_AIX) |
1835 | ||
81d882d5 DS |
1836 | { |
1837 | int netbits = netmask_to_netbits2(r->netmask); | |
1838 | argv_printf(&argv, "%s add -net %s/%d %s", | |
1839 | ROUTE_PATH, | |
1840 | network, netbits, gateway); | |
1841 | argv_msg(D_ROUTE, &argv); | |
328cc40c SN |
1842 | bool ret = openvpn_execve_check(&argv, es, 0, |
1843 | "ERROR: AIX route add command failed"); | |
1844 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
81d882d5 | 1845 | } |
b4b92ae5 | 1846 | |
81d882d5 DS |
1847 | #else /* if defined(TARGET_LINUX) */ |
1848 | msg(M_FATAL, "Sorry, but I don't know how to do 'route' commands on this operating system. Try putting your routes in a --route-up script"); | |
1849 | #endif /* if defined(TARGET_LINUX) */ | |
6fbf66fa | 1850 | |
81d882d5 | 1851 | done: |
328cc40c | 1852 | if (status == RTA_SUCCESS) |
81d882d5 DS |
1853 | { |
1854 | r->flags |= RT_ADDED; | |
1855 | } | |
1856 | else | |
1857 | { | |
1858 | r->flags &= ~RT_ADDED; | |
1859 | } | |
870e2405 | 1860 | argv_free(&argv); |
81d882d5 | 1861 | gc_free(&gc); |
59fde742 AQ |
1862 | /* release resources potentially allocated during route setup */ |
1863 | net_ctx_reset(ctx); | |
e04c2536 | 1864 | |
328cc40c | 1865 | return (status != RTA_ERROR); |
6fbf66fa JY |
1866 | } |
1867 | ||
b55e49bd | 1868 | |
2cea7200 | 1869 | void |
a24dd2e3 | 1870 | route_ipv6_clear_host_bits( struct route_ipv6 *r6 ) |
b55e49bd | 1871 | { |
81d882d5 DS |
1872 | /* clear host bit parts of route |
1873 | * (needed if routes are specified improperly, or if we need to | |
ccb636c7 | 1874 | * explicitly setup/clear the "connected" network routes on some OSes) |
81d882d5 DS |
1875 | */ |
1876 | int byte = 15; | |
1877 | int bits_to_clear = 128 - r6->netbits; | |
b55e49bd | 1878 | |
81d882d5 | 1879 | while (byte >= 0 && bits_to_clear > 0) |
b55e49bd | 1880 | { |
81d882d5 DS |
1881 | if (bits_to_clear >= 8) |
1882 | { | |
1883 | r6->network.s6_addr[byte--] = 0; bits_to_clear -= 8; | |
1884 | } | |
1885 | else | |
1886 | { | |
1887 | r6->network.s6_addr[byte--] &= (0xff << bits_to_clear); bits_to_clear = 0; | |
1888 | } | |
b55e49bd | 1889 | } |
b55e49bd GD |
1890 | } |
1891 | ||
e04c2536 | 1892 | bool |
aec4a3d1 AQ |
1893 | add_route_ipv6(struct route_ipv6 *r6, const struct tuntap *tt, |
1894 | unsigned int flags, const struct env_set *es, | |
1895 | openvpn_net_ctx_t *ctx) | |
512cda46 | 1896 | { |
9c6d72c7 | 1897 | int status = 0; |
81d882d5 | 1898 | bool gateway_needed = false; |
ff9c39b6 | 1899 | |
81d882d5 DS |
1900 | if (!(r6->flags & RT_DEFINED) ) |
1901 | { | |
e04c2536 | 1902 | return true; /* no error */ |
81d882d5 | 1903 | } |
512cda46 | 1904 | |
903e2cf5 GD |
1905 | struct argv argv = argv_new(); |
1906 | struct gc_arena gc = gc_new(); | |
1907 | ||
445b192a | 1908 | #ifndef _WIN32 |
a45c201e | 1909 | const char *device = tt->actual_name; |
81d882d5 | 1910 | if (r6->iface != NULL) /* vpn server special route */ |
3ddb5643 | 1911 | { |
81d882d5 DS |
1912 | device = r6->iface; |
1913 | if (!IN6_IS_ADDR_UNSPECIFIED(&r6->gateway) ) | |
1914 | { | |
1915 | gateway_needed = true; | |
1916 | } | |
3ddb5643 GD |
1917 | } |
1918 | #endif | |
1919 | ||
81d882d5 | 1920 | route_ipv6_clear_host_bits(r6); |
903e2cf5 GD |
1921 | const char *network = print_in6_addr( r6->network, 0, &gc); |
1922 | const char *gateway = print_in6_addr( r6->gateway, 0, &gc); | |
512cda46 | 1923 | |
81d882d5 DS |
1924 | #if defined(TARGET_DARWIN) \ |
1925 | || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) \ | |
1926 | || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD) | |
2ff366f7 | 1927 | |
81d882d5 DS |
1928 | /* the BSD platforms cannot specify gateway and interface independently, |
1929 | * but for link-local destinations, we MUST specify the interface, so | |
1930 | * we build a combined "$gateway%$interface" gateway string | |
1931 | */ | |
1932 | if (r6->iface != NULL && gateway_needed | |
1933 | && IN6_IS_ADDR_LINKLOCAL(&r6->gateway) ) /* fe80::...%intf */ | |
2ff366f7 | 1934 | { |
81d882d5 DS |
1935 | int len = strlen(gateway) + 1 + strlen(r6->iface)+1; |
1936 | char *tmp = gc_malloc( len, true, &gc ); | |
1937 | snprintf( tmp, len, "%s%%%s", gateway, r6->iface ); | |
1938 | gateway = tmp; | |
2ff366f7 GD |
1939 | } |
1940 | #endif | |
1941 | ||
a45c201e | 1942 | #ifndef _WIN32 |
7268e14d SK |
1943 | msg(D_ROUTE, "add_route_ipv6(%s/%d -> %s metric %d) dev %s", |
1944 | network, r6->netbits, gateway, r6->metric, device ); | |
a45c201e | 1945 | #else |
7268e14d SK |
1946 | msg(D_ROUTE, "add_route_ipv6(%s/%d -> %s metric %d) IF %lu", |
1947 | network, r6->netbits, gateway, r6->metric, | |
1948 | r6->adapter_index ? r6->adapter_index : tt->adapter_index); | |
a45c201e | 1949 | #endif |
512cda46 | 1950 | |
81d882d5 DS |
1951 | /* |
1952 | * Filter out routes which are essentially no-ops | |
1953 | * (not currently done for IPv6) | |
1954 | */ | |
512cda46 | 1955 | |
81d882d5 DS |
1956 | /* On "tun" interface, we never set a gateway if the operating system |
1957 | * can do "route to interface" - it does not add value, as the target | |
1958 | * dev already fully qualifies the route destination on point-to-point | |
1959 | * interfaces. OTOH, on "tap" interface, we must always set the | |
1960 | * gateway unless the route is to be an on-link network | |
1961 | */ | |
1962 | if (tt->type == DEV_TYPE_TAP | |
1963 | && !( (r6->flags & RT_METRIC_DEFINED) && r6->metric == 0 ) ) | |
ff9c39b6 | 1964 | { |
81d882d5 | 1965 | gateway_needed = true; |
ff9c39b6 GD |
1966 | } |
1967 | ||
14d7e0e4 GD |
1968 | if (gateway_needed && IN6_IS_ADDR_UNSPECIFIED(&r6->gateway)) |
1969 | { | |
1970 | msg(M_WARN, "ROUTE6 WARNING: " PACKAGE_NAME " needs a gateway " | |
1971 | "parameter for a --route-ipv6 option and no default was set via " | |
1972 | "--ifconfig-ipv6 or --route-ipv6-gateway option. Not installing " | |
1973 | "IPv6 route to %s/%d.", network, r6->netbits); | |
9c6d72c7 | 1974 | status = 0; |
14d7e0e4 GD |
1975 | goto done; |
1976 | } | |
1977 | ||
512cda46 | 1978 | #if defined(TARGET_LINUX) |
903e2cf5 | 1979 | int metric = -1; |
aec4a3d1 | 1980 | if ((r6->flags & RT_METRIC_DEFINED) && (r6->metric > 0)) |
81d882d5 | 1981 | { |
aec4a3d1 | 1982 | metric = r6->metric; |
81d882d5 | 1983 | } |
512cda46 | 1984 | |
328cc40c | 1985 | status = RTA_SUCCESS; |
adc54f48 GD |
1986 | int ret = net_route_v6_add(ctx, &r6->network, r6->netbits, |
1987 | gateway_needed ? &r6->gateway : NULL, | |
1988 | device, 0, metric); | |
1989 | if (ret == -EEXIST) | |
81d882d5 | 1990 | { |
adc54f48 GD |
1991 | msg(D_ROUTE, "NOTE: Linux route add command failed because route exists"); |
1992 | status = RTA_EEXIST; | |
1993 | } | |
1994 | else if (ret < 0) | |
1995 | { | |
1996 | msg(M_WARN, "ERROR: Linux route add command failed"); | |
328cc40c | 1997 | status = RTA_ERROR; |
81d882d5 | 1998 | } |
512cda46 | 1999 | |
a55b3cdb | 2000 | #elif defined (TARGET_ANDROID) |
8fcc63b2 | 2001 | char out[64]; |
a55b3cdb | 2002 | |
8fcc63b2 | 2003 | openvpn_snprintf(out, sizeof(out), "%s/%d %s", network, r6->netbits, device); |
a55b3cdb | 2004 | |
e04c2536 | 2005 | status = management_android_control(management, "ROUTE6", out); |
a55b3cdb | 2006 | |
445b192a | 2007 | #elif defined (_WIN32) |
512cda46 | 2008 | |
81d882d5 DS |
2009 | if (tt->options.msg_channel) |
2010 | { | |
2011 | status = add_route_ipv6_service(r6, tt); | |
2012 | } | |
2013 | else | |
2014 | { | |
dd669581 | 2015 | status = route_ipv6_ipapi(true, r6, tt); |
a24dd2e3 | 2016 | } |
512cda46 GD |
2017 | #elif defined (TARGET_SOLARIS) |
2018 | ||
81d882d5 DS |
2019 | /* example: route add -inet6 2001:db8::/32 somegateway 0 */ |
2020 | ||
2021 | /* for some reason, routes to tun/tap do not work for me unless I set | |
2022 | * "metric 0" - otherwise, the routes will be nicely installed, but | |
2023 | * packets will just disappear somewhere. So we always use "0" now, | |
2024 | * unless the route points to "gateway on other interface"... | |
2025 | * | |
2026 | * (Note: OpenSolaris can not specify host%interface gateways, so we just | |
2027 | * use the GW addresses - it seems to still work for fe80:: addresses, | |
2028 | * however this is done internally. NUD maybe?) | |
2029 | */ | |
2030 | argv_printf(&argv, "%s add -inet6 %s/%d %s", | |
2031 | ROUTE_PATH, | |
2032 | network, | |
2033 | r6->netbits, | |
2034 | gateway ); | |
2035 | ||
01b3a48c GD |
2036 | /* on tun (not tap), not "elsewhere"? -> metric 0 */ |
2037 | if (tt->type == DEV_TYPE_TUN && !r6->iface) | |
81d882d5 DS |
2038 | { |
2039 | argv_printf_cat(&argv, "0"); | |
2040 | } | |
2041 | ||
2042 | argv_msg(D_ROUTE, &argv); | |
328cc40c SN |
2043 | bool ret = openvpn_execve_check(&argv, es, 0, |
2044 | "ERROR: Solaris route add -inet6 command failed"); | |
2045 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
512cda46 GD |
2046 | |
2047 | #elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) | |
2048 | ||
81d882d5 DS |
2049 | argv_printf(&argv, "%s add -inet6 %s/%d", |
2050 | ROUTE_PATH, | |
2051 | network, | |
2052 | r6->netbits); | |
ff9c39b6 | 2053 | |
81d882d5 DS |
2054 | if (gateway_needed) |
2055 | { | |
2056 | argv_printf_cat(&argv, "%s", gateway); | |
2057 | } | |
2058 | else | |
2059 | { | |
2060 | argv_printf_cat(&argv, "-iface %s", device); | |
2061 | } | |
512cda46 | 2062 | |
81d882d5 | 2063 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
2064 | bool ret = openvpn_execve_check(&argv, es, 0, |
2065 | "ERROR: *BSD route add -inet6 command failed"); | |
2066 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
512cda46 | 2067 | |
81d882d5 | 2068 | #elif defined(TARGET_DARWIN) |
512cda46 | 2069 | |
81d882d5 DS |
2070 | argv_printf(&argv, "%s add -inet6 %s -prefixlen %d", |
2071 | ROUTE_PATH, | |
2072 | network, r6->netbits ); | |
ff9c39b6 | 2073 | |
81d882d5 DS |
2074 | if (gateway_needed) |
2075 | { | |
2076 | argv_printf_cat(&argv, "%s", gateway); | |
2077 | } | |
2078 | else | |
2079 | { | |
2080 | argv_printf_cat(&argv, "-iface %s", device); | |
2081 | } | |
512cda46 | 2082 | |
81d882d5 | 2083 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
2084 | bool ret = openvpn_execve_check(&argv, es, 0, |
2085 | "ERROR: MacOS X route add -inet6 command failed"); | |
2086 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
512cda46 | 2087 | |
ada9769e | 2088 | #elif defined(TARGET_OPENBSD) |
512cda46 | 2089 | |
81d882d5 DS |
2090 | argv_printf(&argv, "%s add -inet6 %s -prefixlen %d %s", |
2091 | ROUTE_PATH, | |
2092 | network, r6->netbits, gateway ); | |
ada9769e | 2093 | |
81d882d5 | 2094 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
2095 | bool ret = openvpn_execve_check(&argv, es, 0, |
2096 | "ERROR: OpenBSD route add -inet6 command failed"); | |
2097 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
ada9769e GD |
2098 | |
2099 | #elif defined(TARGET_NETBSD) | |
512cda46 | 2100 | |
81d882d5 DS |
2101 | argv_printf(&argv, "%s add -inet6 %s/%d %s", |
2102 | ROUTE_PATH, | |
2103 | network, r6->netbits, gateway ); | |
512cda46 | 2104 | |
81d882d5 | 2105 | argv_msg(D_ROUTE, &argv); |
328cc40c SN |
2106 | bool ret = openvpn_execve_check(&argv, es, 0, |
2107 | "ERROR: NetBSD route add -inet6 command failed"); | |
2108 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
512cda46 | 2109 | |
b4b92ae5 GD |
2110 | #elif defined(TARGET_AIX) |
2111 | ||
81d882d5 DS |
2112 | argv_printf(&argv, "%s add -inet6 %s/%d %s", |
2113 | ROUTE_PATH, | |
2114 | network, r6->netbits, gateway); | |
2115 | argv_msg(D_ROUTE, &argv); | |
328cc40c SN |
2116 | bool ret = openvpn_execve_check(&argv, es, 0, |
2117 | "ERROR: AIX route add command failed"); | |
2118 | status = ret ? RTA_SUCCESS : RTA_ERROR; | |
b4b92ae5 | 2119 | |
81d882d5 DS |
2120 | #else /* if defined(TARGET_LINUX) */ |
2121 | msg(M_FATAL, "Sorry, but I don't know how to do 'route ipv6' commands on this operating system. Try putting your routes in a --route-up script"); | |
2122 | #endif /* if defined(TARGET_LINUX) */ | |
512cda46 | 2123 | |
14d7e0e4 | 2124 | done: |
328cc40c | 2125 | if (status == RTA_SUCCESS) |
81d882d5 DS |
2126 | { |
2127 | r6->flags |= RT_ADDED; | |
2128 | } | |
2129 | else | |
2130 | { | |
2131 | r6->flags &= ~RT_ADDED; | |
2132 | } | |
870e2405 | 2133 | argv_free(&argv); |
81d882d5 | 2134 | gc_free(&gc); |
59fde742 AQ |
2135 | /* release resources potentially allocated during route setup */ |
2136 | net_ctx_reset(ctx); | |
e04c2536 | 2137 | |
328cc40c | 2138 | return (status != RTA_ERROR); |
512cda46 GD |
2139 | } |
2140 | ||
6fbf66fa | 2141 | static void |
81d882d5 DS |
2142 | delete_route(struct route_ipv4 *r, |
2143 | const struct tuntap *tt, | |
2144 | unsigned int flags, | |
2145 | const struct route_gateway_info *rgi, | |
aec4a3d1 AQ |
2146 | const struct env_set *es, |
2147 | openvpn_net_ctx_t *ctx) | |
6fbf66fa | 2148 | { |
aec4a3d1 | 2149 | #if !defined(TARGET_LINUX) |
81d882d5 | 2150 | const char *network; |
d42f070c | 2151 | #if !defined(TARGET_AIX) |
81d882d5 | 2152 | const char *netmask; |
22e75ca1 | 2153 | #endif |
d42f070c | 2154 | #if !defined(TARGET_ANDROID) |
81d882d5 | 2155 | const char *gateway; |
aec4a3d1 | 2156 | #endif |
9cf7b492 | 2157 | #else /* if !defined(TARGET_LINUX) */ |
aec4a3d1 | 2158 | int metric; |
22e75ca1 | 2159 | #endif |
81d882d5 DS |
2160 | int is_local_route; |
2161 | ||
2162 | if ((r->flags & (RT_DEFINED|RT_ADDED)) != (RT_DEFINED|RT_ADDED)) | |
2163 | { | |
2164 | return; | |
2165 | } | |
6fbf66fa | 2166 | |
5ac33a88 AQ |
2167 | struct gc_arena gc = gc_new(); |
2168 | struct argv argv = argv_new(); | |
6fbf66fa | 2169 | |
aec4a3d1 | 2170 | #if !defined(TARGET_LINUX) |
81d882d5 | 2171 | network = print_in_addr_t(r->network, 0, &gc); |
d42f070c | 2172 | #if !defined(TARGET_AIX) |
81d882d5 | 2173 | netmask = print_in_addr_t(r->netmask, 0, &gc); |
22e75ca1 | 2174 | #endif |
d42f070c | 2175 | #if !defined(TARGET_ANDROID) |
81d882d5 | 2176 | gateway = print_in_addr_t(r->gateway, 0, &gc); |
aec4a3d1 | 2177 | #endif |
22e75ca1 | 2178 | #endif |
6fbf66fa | 2179 | |
81d882d5 DS |
2180 | is_local_route = local_route(r->network, r->netmask, r->gateway, rgi); |
2181 | if (is_local_route == LR_ERROR) | |
2182 | { | |
2183 | goto done; | |
2184 | } | |
7fb0e07e | 2185 | |
6fbf66fa | 2186 | #if defined(TARGET_LINUX) |
aec4a3d1 | 2187 | metric = -1; |
81d882d5 DS |
2188 | if (r->flags & RT_METRIC_DEFINED) |
2189 | { | |
aec4a3d1 | 2190 | metric = r->metric; |
81d882d5 | 2191 | } |
6fbf66fa | 2192 | |
aec4a3d1 AQ |
2193 | if (net_route_v4_del(ctx, &r->network, netmask_to_netbits2(r->netmask), |
2194 | &r->gateway, NULL, 0, metric) < 0) | |
2195 | { | |
2196 | msg(M_WARN, "ERROR: Linux route delete command failed"); | |
2197 | } | |
445b192a | 2198 | #elif defined (_WIN32) |
6fbf66fa | 2199 | |
4ed7bf7f | 2200 | argv_printf(&argv, "%s%s DELETE %s MASK %s %s", |
81d882d5 DS |
2201 | get_win_sys_path(), |
2202 | WIN_ROUTE_PATH_SUFFIX, | |
2203 | network, | |
2204 | netmask, | |
2205 | gateway); | |
2206 | ||
2207 | argv_msg(D_ROUTE, &argv); | |
6fbf66fa | 2208 | |
81d882d5 | 2209 | if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_SERVICE) |
a24dd2e3 | 2210 | { |
81d882d5 DS |
2211 | const bool status = del_route_service(r, tt); |
2212 | msg(D_ROUTE, "Route deletion via service %s", status ? "succeeded" : "failed"); | |
a24dd2e3 | 2213 | } |
81d882d5 | 2214 | else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_IPAPI) |
6fbf66fa | 2215 | { |
81d882d5 DS |
2216 | const bool status = del_route_ipapi(r, tt); |
2217 | msg(D_ROUTE, "Route deletion via IPAPI %s", status ? "succeeded" : "failed"); | |
6fbf66fa | 2218 | } |
81d882d5 | 2219 | else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_EXE) |
6fbf66fa | 2220 | { |
81d882d5 DS |
2221 | netcmd_semaphore_lock(); |
2222 | openvpn_execve_check(&argv, es, 0, "ERROR: Windows route delete command failed"); | |
2223 | netcmd_semaphore_release(); | |
6fbf66fa | 2224 | } |
81d882d5 | 2225 | else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_ADAPTIVE) |
6215931b | 2226 | { |
81d882d5 DS |
2227 | const bool status = del_route_ipapi(r, tt); |
2228 | msg(D_ROUTE, "Route deletion via IPAPI %s [adaptive]", status ? "succeeded" : "failed"); | |
2229 | if (!status) | |
2230 | { | |
2231 | msg(D_ROUTE, "Route deletion fallback to route.exe"); | |
2232 | netcmd_semaphore_lock(); | |
2233 | openvpn_execve_check(&argv, es, 0, "ERROR: Windows route delete command failed [adaptive]"); | |
2234 | netcmd_semaphore_release(); | |
2235 | } | |
6215931b | 2236 | } |
81d882d5 | 2237 | else |
6fbf66fa | 2238 | { |
81d882d5 | 2239 | ASSERT(0); |
6fbf66fa JY |
2240 | } |
2241 | ||
2242 | #elif defined (TARGET_SOLARIS) | |
2243 | ||
81d882d5 DS |
2244 | argv_printf(&argv, "%s delete %s -netmask %s %s", |
2245 | ROUTE_PATH, | |
2246 | network, | |
2247 | netmask, | |
2248 | gateway); | |
6fbf66fa | 2249 | |
81d882d5 DS |
2250 | argv_msg(D_ROUTE, &argv); |
2251 | openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route delete command failed"); | |
6fbf66fa JY |
2252 | |
2253 | #elif defined(TARGET_FREEBSD) | |
2254 | ||
81d882d5 DS |
2255 | argv_printf(&argv, "%s delete -net %s %s %s", |
2256 | ROUTE_PATH, | |
2257 | network, | |
2258 | gateway, | |
2259 | netmask); | |
6fbf66fa | 2260 | |
81d882d5 DS |
2261 | argv_msg(D_ROUTE, &argv); |
2262 | openvpn_execve_check(&argv, es, 0, "ERROR: FreeBSD route delete command failed"); | |
6fbf66fa | 2263 | |
1bda73a7 JY |
2264 | #elif defined(TARGET_DRAGONFLY) |
2265 | ||
81d882d5 DS |
2266 | argv_printf(&argv, "%s delete -net %s %s %s", |
2267 | ROUTE_PATH, | |
2268 | network, | |
2269 | gateway, | |
2270 | netmask); | |
1bda73a7 | 2271 | |
81d882d5 DS |
2272 | argv_msg(D_ROUTE, &argv); |
2273 | openvpn_execve_check(&argv, es, 0, "ERROR: DragonFly route delete command failed"); | |
1bda73a7 | 2274 | |
6fbf66fa JY |
2275 | #elif defined(TARGET_DARWIN) |
2276 | ||
81d882d5 | 2277 | if (is_on_link(is_local_route, flags, rgi)) |
7fb0e07e | 2278 | { |
81d882d5 DS |
2279 | argv_printf(&argv, "%s delete -cloning -net %s -netmask %s -interface %s", |
2280 | ROUTE_PATH, | |
2281 | network, | |
2282 | netmask, | |
2283 | rgi->iface); | |
7fb0e07e | 2284 | } |
81d882d5 | 2285 | else |
7fb0e07e | 2286 | { |
81d882d5 DS |
2287 | argv_printf(&argv, "%s delete -net %s %s %s", |
2288 | ROUTE_PATH, | |
2289 | network, | |
2290 | gateway, | |
2291 | netmask); | |
7fb0e07e | 2292 | } |
6fbf66fa | 2293 | |
81d882d5 DS |
2294 | argv_msg(D_ROUTE, &argv); |
2295 | openvpn_execve_check(&argv, es, 0, "ERROR: OS X route delete command failed"); | |
6fbf66fa JY |
2296 | |
2297 | #elif defined(TARGET_OPENBSD) || defined(TARGET_NETBSD) | |
2298 | ||
81d882d5 DS |
2299 | argv_printf(&argv, "%s delete -net %s %s -netmask %s", |
2300 | ROUTE_PATH, | |
2301 | network, | |
2302 | gateway, | |
2303 | netmask); | |
6fbf66fa | 2304 | |
81d882d5 DS |
2305 | argv_msg(D_ROUTE, &argv); |
2306 | openvpn_execve_check(&argv, es, 0, "ERROR: OpenBSD/NetBSD route delete command failed"); | |
b4b92ae5 | 2307 | |
a55b3cdb | 2308 | #elif defined(TARGET_ANDROID) |
ab01eaf4 AS |
2309 | msg(D_ROUTE_DEBUG, "Deleting routes on Android is not possible/not " |
2310 | "needed. The VpnService API allows routes to be set " | |
2311 | "on connect only and will clean up automatically."); | |
b4b92ae5 GD |
2312 | #elif defined(TARGET_AIX) |
2313 | ||
81d882d5 DS |
2314 | { |
2315 | int netbits = netmask_to_netbits2(r->netmask); | |
2316 | argv_printf(&argv, "%s delete -net %s/%d %s", | |
2317 | ROUTE_PATH, | |
2318 | network, netbits, gateway); | |
2319 | argv_msg(D_ROUTE, &argv); | |
2320 | openvpn_execve_check(&argv, es, 0, "ERROR: AIX route delete command failed"); | |
2321 | } | |
b4b92ae5 | 2322 | |
81d882d5 DS |
2323 | #else /* if defined(TARGET_LINUX) */ |
2324 | msg(M_FATAL, "Sorry, but I don't know how to do 'route' commands on this operating system. Try putting your routes in a --route-up script"); | |
2325 | #endif /* if defined(TARGET_LINUX) */ | |
6fbf66fa | 2326 | |
81d882d5 DS |
2327 | done: |
2328 | r->flags &= ~RT_ADDED; | |
870e2405 | 2329 | argv_free(&argv); |
81d882d5 | 2330 | gc_free(&gc); |
59fde742 AQ |
2331 | /* release resources potentially allocated during route cleanup */ |
2332 | net_ctx_reset(ctx); | |
6fbf66fa JY |
2333 | } |
2334 | ||
b55e49bd | 2335 | void |
aec4a3d1 AQ |
2336 | delete_route_ipv6(const struct route_ipv6 *r6, const struct tuntap *tt, |
2337 | unsigned int flags, const struct env_set *es, | |
2338 | openvpn_net_ctx_t *ctx) | |
512cda46 | 2339 | { |
81d882d5 | 2340 | const char *network; |
81d882d5 DS |
2341 | |
2342 | if ((r6->flags & (RT_DEFINED|RT_ADDED)) != (RT_DEFINED|RT_ADDED)) | |
2343 | { | |
2344 | return; | |
2345 | } | |
512cda46 | 2346 | |
efbedf21 | 2347 | #if !defined(_WIN32) |
48495ce3 FL |
2348 | #if !defined(TARGET_LINUX) |
2349 | const char *gateway; | |
48495ce3 | 2350 | #endif |
efbedf21 | 2351 | #if !defined(TARGET_SOLARIS) |
48495ce3 | 2352 | bool gateway_needed = false; |
7890e51a | 2353 | const char *device = tt->actual_name; |
81d882d5 | 2354 | if (r6->iface != NULL) /* vpn server special route */ |
3ddb5643 | 2355 | { |
81d882d5 DS |
2356 | device = r6->iface; |
2357 | gateway_needed = true; | |
3ddb5643 | 2358 | } |
48495ce3 FL |
2359 | |
2360 | /* if we used a gateway on "add route", we also need to specify it on | |
2361 | * delete, otherwise some OSes will refuse to delete the route | |
2362 | */ | |
2363 | if (tt->type == DEV_TYPE_TAP | |
2364 | && !( (r6->flags & RT_METRIC_DEFINED) && r6->metric == 0 ) ) | |
2365 | { | |
2366 | gateway_needed = true; | |
2367 | } | |
efbedf21 | 2368 | #endif |
3ddb5643 GD |
2369 | #endif |
2370 | ||
5ac33a88 AQ |
2371 | struct gc_arena gc = gc_new(); |
2372 | struct argv argv = argv_new(); | |
512cda46 | 2373 | |
81d882d5 | 2374 | network = print_in6_addr( r6->network, 0, &gc); |
48495ce3 | 2375 | #if !defined(TARGET_LINUX) && !defined(_WIN32) |
81d882d5 | 2376 | gateway = print_in6_addr( r6->gateway, 0, &gc); |
aec4a3d1 | 2377 | #endif |
512cda46 | 2378 | |
81d882d5 DS |
2379 | #if defined(TARGET_DARWIN) \ |
2380 | || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) \ | |
2381 | || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD) | |
2ff366f7 | 2382 | |
81d882d5 DS |
2383 | /* the BSD platforms cannot specify gateway and interface independently, |
2384 | * but for link-local destinations, we MUST specify the interface, so | |
2385 | * we build a combined "$gateway%$interface" gateway string | |
2386 | */ | |
2387 | if (r6->iface != NULL && gateway_needed | |
2388 | && IN6_IS_ADDR_LINKLOCAL(&r6->gateway) ) /* fe80::...%intf */ | |
2ff366f7 | 2389 | { |
81d882d5 DS |
2390 | int len = strlen(gateway) + 1 + strlen(r6->iface)+1; |
2391 | char *tmp = gc_malloc( len, true, &gc ); | |
2392 | snprintf( tmp, len, "%s%%%s", gateway, r6->iface ); | |
2393 | gateway = tmp; | |
2ff366f7 GD |
2394 | } |
2395 | #endif | |
2396 | ||
7268e14d | 2397 | msg(D_ROUTE, "delete_route_ipv6(%s/%d)", network, r6->netbits ); |
512cda46 GD |
2398 | |
2399 | #if defined(TARGET_LINUX) | |
efbedf21 | 2400 | int metric = -1; |
aec4a3d1 | 2401 | if ((r6->flags & RT_METRIC_DEFINED) && (r6->metric > 0)) |
81d882d5 | 2402 | { |
aec4a3d1 | 2403 | metric = r6->metric; |
81d882d5 | 2404 | } |
aec4a3d1 AQ |
2405 | |
2406 | if (net_route_v6_del(ctx, &r6->network, r6->netbits, | |
2407 | gateway_needed ? &r6->gateway : NULL, device, 0, | |
2408 | metric) < 0) | |
81d882d5 | 2409 | { |
aec4a3d1 | 2410 | msg(M_WARN, "ERROR: Linux route v6 delete command failed"); |
81d882d5 | 2411 | } |
512cda46 | 2412 | |
445b192a | 2413 | #elif defined (_WIN32) |
512cda46 | 2414 | |
81d882d5 DS |
2415 | if (tt->options.msg_channel) |
2416 | { | |
2417 | del_route_ipv6_service(r6, tt); | |
2418 | } | |
2419 | else | |
2420 | { | |
dd669581 | 2421 | route_ipv6_ipapi(false, r6, tt); |
a24dd2e3 | 2422 | } |
512cda46 GD |
2423 | #elif defined (TARGET_SOLARIS) |
2424 | ||
81d882d5 | 2425 | /* example: route delete -inet6 2001:db8::/32 somegateway */ |
512cda46 | 2426 | |
81d882d5 DS |
2427 | argv_printf(&argv, "%s delete -inet6 %s/%d %s", |
2428 | ROUTE_PATH, | |
2429 | network, | |
2430 | r6->netbits, | |
2431 | gateway ); | |
512cda46 | 2432 | |
81d882d5 DS |
2433 | argv_msg(D_ROUTE, &argv); |
2434 | openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route delete -inet6 command failed"); | |
512cda46 GD |
2435 | |
2436 | #elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) | |
2437 | ||
81d882d5 DS |
2438 | argv_printf(&argv, "%s delete -inet6 %s/%d", |
2439 | ROUTE_PATH, | |
2440 | network, | |
2441 | r6->netbits ); | |
ff9c39b6 | 2442 | |
81d882d5 DS |
2443 | if (gateway_needed) |
2444 | { | |
2445 | argv_printf_cat(&argv, "%s", gateway); | |
2446 | } | |
2447 | else | |
2448 | { | |
2449 | argv_printf_cat(&argv, "-iface %s", device); | |
2450 | } | |
512cda46 | 2451 | |
81d882d5 DS |
2452 | argv_msg(D_ROUTE, &argv); |
2453 | openvpn_execve_check(&argv, es, 0, "ERROR: *BSD route delete -inet6 command failed"); | |
512cda46 | 2454 | |
81d882d5 | 2455 | #elif defined(TARGET_DARWIN) |
512cda46 | 2456 | |
81d882d5 DS |
2457 | argv_printf(&argv, "%s delete -inet6 %s -prefixlen %d", |
2458 | ROUTE_PATH, | |
2459 | network, r6->netbits ); | |
ff9c39b6 | 2460 | |
81d882d5 DS |
2461 | if (gateway_needed) |
2462 | { | |
2463 | argv_printf_cat(&argv, "%s", gateway); | |
2464 | } | |
2465 | else | |
2466 | { | |
2467 | argv_printf_cat(&argv, "-iface %s", device); | |
2468 | } | |
512cda46 | 2469 | |
81d882d5 DS |
2470 | argv_msg(D_ROUTE, &argv); |
2471 | openvpn_execve_check(&argv, es, 0, "ERROR: MacOS X route delete -inet6 command failed"); | |
512cda46 | 2472 | |
ada9769e | 2473 | #elif defined(TARGET_OPENBSD) |
512cda46 | 2474 | |
81d882d5 DS |
2475 | argv_printf(&argv, "%s delete -inet6 %s -prefixlen %d %s", |
2476 | ROUTE_PATH, | |
2477 | network, r6->netbits, gateway ); | |
ada9769e | 2478 | |
81d882d5 DS |
2479 | argv_msg(D_ROUTE, &argv); |
2480 | openvpn_execve_check(&argv, es, 0, "ERROR: OpenBSD route delete -inet6 command failed"); | |
ada9769e GD |
2481 | |
2482 | #elif defined(TARGET_NETBSD) | |
512cda46 | 2483 | |
81d882d5 DS |
2484 | argv_printf(&argv, "%s delete -inet6 %s/%d %s", |
2485 | ROUTE_PATH, | |
2486 | network, r6->netbits, gateway ); | |
512cda46 | 2487 | |
81d882d5 DS |
2488 | argv_msg(D_ROUTE, &argv); |
2489 | openvpn_execve_check(&argv, es, 0, "ERROR: NetBSD route delete -inet6 command failed"); | |
512cda46 | 2490 | |
b4b92ae5 GD |
2491 | #elif defined(TARGET_AIX) |
2492 | ||
81d882d5 DS |
2493 | argv_printf(&argv, "%s delete -inet6 %s/%d %s", |
2494 | ROUTE_PATH, | |
2495 | network, r6->netbits, gateway); | |
2496 | argv_msg(D_ROUTE, &argv); | |
2497 | openvpn_execve_check(&argv, es, 0, "ERROR: AIX route add command failed"); | |
ab01eaf4 AS |
2498 | #elif defined(TARGET_ANDROID) |
2499 | msg(D_ROUTE_DEBUG, "Deleting routes on Android is not possible/not " | |
2500 | "needed. The VpnService API allows routes to be set " | |
2501 | "on connect only and will clean up automatically."); | |
81d882d5 DS |
2502 | #else /* if defined(TARGET_LINUX) */ |
2503 | msg(M_FATAL, "Sorry, but I don't know how to do 'route ipv6' commands on this operating system. Try putting your routes in a --route-down script"); | |
2504 | #endif /* if defined(TARGET_LINUX) */ | |
512cda46 | 2505 | |
870e2405 | 2506 | argv_free(&argv); |
81d882d5 | 2507 | gc_free(&gc); |
59fde742 AQ |
2508 | /* release resources potentially allocated during route cleanup */ |
2509 | net_ctx_reset(ctx); | |
512cda46 GD |
2510 | } |
2511 | ||
6fbf66fa JY |
2512 | /* |
2513 | * The --redirect-gateway option requires OS-specific code below | |
2514 | * to get the current default gateway. | |
2515 | */ | |
2516 | ||
445b192a | 2517 | #if defined(_WIN32) |
6fbf66fa JY |
2518 | |
2519 | static const MIB_IPFORWARDTABLE * | |
81d882d5 | 2520 | get_windows_routing_table(struct gc_arena *gc) |
6fbf66fa | 2521 | { |
81d882d5 DS |
2522 | ULONG size = 0; |
2523 | PMIB_IPFORWARDTABLE rt = NULL; | |
2524 | DWORD status; | |
6fbf66fa | 2525 | |
81d882d5 DS |
2526 | status = GetIpForwardTable(NULL, &size, TRUE); |
2527 | if (status == ERROR_INSUFFICIENT_BUFFER) | |
6fbf66fa | 2528 | { |
81d882d5 DS |
2529 | rt = (PMIB_IPFORWARDTABLE) gc_malloc(size, false, gc); |
2530 | status = GetIpForwardTable(rt, &size, TRUE); | |
2531 | if (status != NO_ERROR) | |
2532 | { | |
2533 | msg(D_ROUTE, "NOTE: GetIpForwardTable returned error: %s (code=%u)", | |
2534 | strerror_win32(status, gc), | |
2535 | (unsigned int)status); | |
2536 | rt = NULL; | |
2537 | } | |
6fbf66fa | 2538 | } |
81d882d5 | 2539 | return rt; |
6fbf66fa JY |
2540 | } |
2541 | ||
2542 | static int | |
81d882d5 DS |
2543 | test_route(const IP_ADAPTER_INFO *adapters, |
2544 | const in_addr_t gateway, | |
2545 | DWORD *index) | |
6fbf66fa | 2546 | { |
81d882d5 DS |
2547 | int count = 0; |
2548 | DWORD i = adapter_index_of_ip(adapters, gateway, &count, NULL); | |
2549 | if (index) | |
2550 | { | |
2551 | *index = i; | |
2552 | } | |
2553 | return count; | |
6fbf66fa JY |
2554 | } |
2555 | ||
2556 | static void | |
81d882d5 DS |
2557 | test_route_helper(bool *ret, |
2558 | int *count, | |
2559 | int *good, | |
2560 | int *ambig, | |
2561 | const IP_ADAPTER_INFO *adapters, | |
2562 | const in_addr_t gateway) | |
6fbf66fa | 2563 | { |
81d882d5 | 2564 | int c; |
6fbf66fa | 2565 | |
81d882d5 DS |
2566 | ++*count; |
2567 | c = test_route(adapters, gateway, NULL); | |
2568 | if (c == 0) | |
2569 | { | |
2570 | *ret = false; | |
2571 | } | |
2572 | else | |
2573 | { | |
2574 | ++*good; | |
2575 | } | |
2576 | if (c > 1) | |
2577 | { | |
2578 | ++*ambig; | |
2579 | } | |
6fbf66fa JY |
2580 | } |
2581 | ||
2582 | /* | |
2583 | * If we tried to add routes now, would we succeed? | |
2584 | */ | |
2585 | bool | |
81d882d5 | 2586 | test_routes(const struct route_list *rl, const struct tuntap *tt) |
6fbf66fa | 2587 | { |
81d882d5 DS |
2588 | struct gc_arena gc = gc_new(); |
2589 | const IP_ADAPTER_INFO *adapters = get_adapter_info_list(&gc); | |
2590 | bool ret = false; | |
2591 | int count = 0; | |
2592 | int good = 0; | |
2593 | int ambig = 0; | |
2594 | int len = -1; | |
2595 | bool adapter_up = false; | |
2596 | ||
2597 | if (is_adapter_up(tt, adapters)) | |
6fbf66fa | 2598 | { |
81d882d5 DS |
2599 | ret = true; |
2600 | adapter_up = true; | |
6fbf66fa | 2601 | |
125e9df9 AQ |
2602 | /* we do this test only if we have IPv4 routes to install, and if |
2603 | * the tun/tap interface has seen IPv4 ifconfig - because if we | |
2604 | * have no IPv4, the check will always fail, failing tun init | |
2605 | */ | |
2606 | if (rl && tt->did_ifconfig_setup) | |
81d882d5 DS |
2607 | { |
2608 | struct route_ipv4 *r; | |
2609 | for (r = rl->routes, len = 0; r; r = r->next, ++len) | |
4cd4899e | 2610 | { |
81d882d5 | 2611 | test_route_helper(&ret, &count, &good, &ambig, adapters, r->gateway); |
4cd4899e | 2612 | } |
81d882d5 DS |
2613 | |
2614 | if ((rl->flags & RG_ENABLE) && (rl->spec.flags & RTSA_REMOTE_ENDPOINT)) | |
2615 | { | |
2616 | test_route_helper(&ret, &count, &good, &ambig, adapters, rl->spec.remote_endpoint); | |
2617 | } | |
2618 | } | |
6fbf66fa JY |
2619 | } |
2620 | ||
81d882d5 DS |
2621 | msg(D_ROUTE, "TEST ROUTES: %d/%d succeeded len=%d ret=%d a=%d u/d=%s", |
2622 | good, | |
2623 | count, | |
2624 | len, | |
2625 | (int)ret, | |
2626 | ambig, | |
2627 | adapter_up ? "up" : "down"); | |
6fbf66fa | 2628 | |
81d882d5 DS |
2629 | gc_free(&gc); |
2630 | return ret; | |
6fbf66fa JY |
2631 | } |
2632 | ||
3c7f2f55 | 2633 | static const MIB_IPFORWARDROW * |
81d882d5 | 2634 | get_default_gateway_row(const MIB_IPFORWARDTABLE *routes) |
6fbf66fa | 2635 | { |
81d882d5 DS |
2636 | struct gc_arena gc = gc_new(); |
2637 | DWORD lowest_metric = MAXDWORD; | |
2638 | const MIB_IPFORWARDROW *ret = NULL; | |
81d882d5 | 2639 | int best = -1; |
6fbf66fa | 2640 | |
81d882d5 | 2641 | if (routes) |
6fbf66fa | 2642 | { |
467b16dc | 2643 | for (DWORD i = 0; i < routes->dwNumEntries; ++i) |
81d882d5 DS |
2644 | { |
2645 | const MIB_IPFORWARDROW *row = &routes->table[i]; | |
2646 | const in_addr_t net = ntohl(row->dwForwardDest); | |
2647 | const in_addr_t mask = ntohl(row->dwForwardMask); | |
2648 | const DWORD index = row->dwForwardIfIndex; | |
2649 | const DWORD metric = row->dwForwardMetric1; | |
2650 | ||
7890e51a | 2651 | dmsg(D_ROUTE_DEBUG, "GDGR: route[%lu] %s/%s i=%d m=%d", |
81d882d5 DS |
2652 | i, |
2653 | print_in_addr_t((in_addr_t) net, 0, &gc), | |
2654 | print_in_addr_t((in_addr_t) mask, 0, &gc), | |
2655 | (int)index, | |
2656 | (int)metric); | |
2657 | ||
2658 | if (!net && !mask && metric < lowest_metric) | |
2659 | { | |
2660 | ret = row; | |
2661 | lowest_metric = metric; | |
2662 | best = i; | |
2663 | } | |
2664 | } | |
6fbf66fa | 2665 | } |
348fb443 | 2666 | |
81d882d5 | 2667 | dmsg(D_ROUTE_DEBUG, "GDGR: best=%d lm=%u", best, (unsigned int)lowest_metric); |
348fb443 | 2668 | |
81d882d5 DS |
2669 | gc_free(&gc); |
2670 | return ret; | |
3c7f2f55 JY |
2671 | } |
2672 | ||
7fb0e07e | 2673 | void |
aec4a3d1 | 2674 | get_default_gateway(struct route_gateway_info *rgi, openvpn_net_ctx_t *ctx) |
3c7f2f55 | 2675 | { |
81d882d5 | 2676 | struct gc_arena gc = gc_new(); |
3c7f2f55 | 2677 | |
81d882d5 DS |
2678 | const IP_ADAPTER_INFO *adapters = get_adapter_info_list(&gc); |
2679 | const MIB_IPFORWARDTABLE *routes = get_windows_routing_table(&gc); | |
2680 | const MIB_IPFORWARDROW *row = get_default_gateway_row(routes); | |
2681 | DWORD a_index; | |
2682 | const IP_ADAPTER_INFO *ai; | |
7fb0e07e | 2683 | |
81d882d5 | 2684 | CLEAR(*rgi); |
3c7f2f55 | 2685 | |
81d882d5 | 2686 | if (row) |
3c7f2f55 | 2687 | { |
81d882d5 DS |
2688 | rgi->gateway.addr = ntohl(row->dwForwardNextHop); |
2689 | if (rgi->gateway.addr) | |
2690 | { | |
2691 | rgi->flags |= RGI_ADDR_DEFINED; | |
2692 | a_index = adapter_index_of_ip(adapters, rgi->gateway.addr, NULL, &rgi->gateway.netmask); | |
2693 | if (a_index != TUN_ADAPTER_INDEX_INVALID) | |
2694 | { | |
2695 | rgi->adapter_index = a_index; | |
2696 | rgi->flags |= (RGI_IFACE_DEFINED|RGI_NETMASK_DEFINED); | |
2697 | ai = get_adapter(adapters, a_index); | |
2698 | if (ai) | |
2699 | { | |
2700 | memcpy(rgi->hwaddr, ai->Address, 6); | |
2701 | rgi->flags |= RGI_HWADDR_DEFINED; | |
2702 | } | |
2703 | } | |
2704 | } | |
3c7f2f55 JY |
2705 | } |
2706 | ||
81d882d5 | 2707 | gc_free(&gc); |
6fbf66fa JY |
2708 | } |
2709 | ||
2710 | static DWORD | |
81d882d5 | 2711 | windows_route_find_if_index(const struct route_ipv4 *r, const struct tuntap *tt) |
6fbf66fa | 2712 | { |
81d882d5 DS |
2713 | struct gc_arena gc = gc_new(); |
2714 | DWORD ret = TUN_ADAPTER_INDEX_INVALID; | |
2715 | int count = 0; | |
2716 | const IP_ADAPTER_INFO *adapters = get_adapter_info_list(&gc); | |
2717 | const IP_ADAPTER_INFO *tun_adapter = get_tun_adapter(tt, adapters); | |
2718 | bool on_tun = false; | |
2719 | ||
2720 | /* first test on tun interface */ | |
2721 | if (is_ip_in_adapter_subnet(tun_adapter, r->gateway, NULL)) | |
6fbf66fa | 2722 | { |
81d882d5 DS |
2723 | ret = tun_adapter->Index; |
2724 | count = 1; | |
2725 | on_tun = true; | |
6fbf66fa | 2726 | } |
81d882d5 | 2727 | else /* test on other interfaces */ |
6fbf66fa | 2728 | { |
81d882d5 | 2729 | count = test_route(adapters, r->gateway, &ret); |
6fbf66fa JY |
2730 | } |
2731 | ||
81d882d5 | 2732 | if (count == 0) |
6fbf66fa | 2733 | { |
81d882d5 DS |
2734 | msg(M_WARN, "Warning: route gateway is not reachable on any active network adapters: %s", |
2735 | print_in_addr_t(r->gateway, 0, &gc)); | |
2736 | ret = TUN_ADAPTER_INDEX_INVALID; | |
6fbf66fa | 2737 | } |
81d882d5 | 2738 | else if (count > 1) |
6fbf66fa | 2739 | { |
81d882d5 DS |
2740 | msg(M_WARN, "Warning: route gateway is ambiguous: %s (%d matches)", |
2741 | print_in_addr_t(r->gateway, 0, &gc), | |
2742 | count); | |
6fbf66fa JY |
2743 | } |
2744 | ||
81d882d5 DS |
2745 | dmsg(D_ROUTE_DEBUG, "DEBUG: route find if: on_tun=%d count=%d index=%d", |
2746 | on_tun, | |
2747 | count, | |
2748 | (int)ret); | |
6fbf66fa | 2749 | |
81d882d5 DS |
2750 | gc_free(&gc); |
2751 | return ret; | |
6fbf66fa JY |
2752 | } |
2753 | ||
5fcd4933 GD |
2754 | /* IPv6 implementation using GetBestRoute2() |
2755 | * (TBD: dynamic linking so the binary can still run on XP?) | |
2756 | * https://msdn.microsoft.com/en-us/library/windows/desktop/aa365922(v=vs.85).aspx | |
2757 | * https://msdn.microsoft.com/en-us/library/windows/desktop/aa814411(v=vs.85).aspx | |
d8a8656f GD |
2758 | */ |
2759 | void | |
2760 | get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, | |
c454b21e | 2761 | const struct in6_addr *dest, openvpn_net_ctx_t *ctx) |
d8a8656f | 2762 | { |
81d882d5 | 2763 | struct gc_arena gc = gc_new(); |
5fcd4933 GD |
2764 | MIB_IPFORWARD_ROW2 BestRoute; |
2765 | SOCKADDR_INET DestinationAddress, BestSourceAddress; | |
2766 | DWORD BestIfIndex; | |
2767 | DWORD status; | |
2768 | NET_LUID InterfaceLuid; | |
2769 | ||
d8a8656f | 2770 | CLEAR(*rgi6); |
81d882d5 | 2771 | CLEAR(InterfaceLuid); /* cleared = not used for lookup */ |
5fcd4933 GD |
2772 | CLEAR(DestinationAddress); |
2773 | ||
2774 | DestinationAddress.si_family = AF_INET6; | |
81d882d5 | 2775 | if (dest) |
5fcd4933 GD |
2776 | { |
2777 | DestinationAddress.Ipv6.sin6_addr = *dest; | |
2778 | } | |
2779 | ||
2569902c | 2780 | status = GetBestInterfaceEx( (struct sockaddr *)&DestinationAddress, &BestIfIndex ); |
5fcd4933 GD |
2781 | |
2782 | if (status != NO_ERROR) | |
2783 | { | |
81d882d5 DS |
2784 | msg(D_ROUTE, "NOTE: GetBestInterfaceEx returned error: %s (code=%u)", |
2785 | strerror_win32(status, &gc), | |
2786 | (unsigned int)status); | |
2787 | goto done; | |
5fcd4933 GD |
2788 | } |
2789 | ||
2790 | msg( D_ROUTE, "GetBestInterfaceEx() returned if=%d", (int) BestIfIndex ); | |
2791 | ||
2792 | status = GetBestRoute2( &InterfaceLuid, BestIfIndex, NULL, | |
2793 | &DestinationAddress, 0, | |
2794 | &BestRoute, &BestSourceAddress ); | |
2795 | ||
2796 | if (status != NO_ERROR) | |
2797 | { | |
81d882d5 DS |
2798 | msg(D_ROUTE, "NOTE: GetIpForwardEntry2 returned error: %s (code=%u)", |
2799 | strerror_win32(status, &gc), | |
2800 | (unsigned int)status); | |
2801 | goto done; | |
5fcd4933 GD |
2802 | } |
2803 | ||
06ad53e0 | 2804 | msg( D_ROUTE, "GDG6: II=%lu DP=%s/%d NH=%s", |
81d882d5 DS |
2805 | BestRoute.InterfaceIndex, |
2806 | print_in6_addr( BestRoute.DestinationPrefix.Prefix.Ipv6.sin6_addr, 0, &gc), | |
2807 | BestRoute.DestinationPrefix.PrefixLength, | |
2808 | print_in6_addr( BestRoute.NextHop.Ipv6.sin6_addr, 0, &gc) ); | |
5fcd4933 | 2809 | msg( D_ROUTE, "GDG6: Metric=%d, Loopback=%d, AA=%d, I=%d", |
81d882d5 DS |
2810 | (int) BestRoute.Metric, |
2811 | (int) BestRoute.Loopback, | |
2812 | (int) BestRoute.AutoconfigureAddress, | |
2813 | (int) BestRoute.Immortal ); | |
5fcd4933 GD |
2814 | |
2815 | rgi6->gateway.addr_ipv6 = BestRoute.NextHop.Ipv6.sin6_addr; | |
2816 | rgi6->adapter_index = BestRoute.InterfaceIndex; | |
2817 | rgi6->flags |= RGI_ADDR_DEFINED | RGI_IFACE_DEFINED; | |
2818 | ||
2819 | /* on-link is signalled by receiving an empty (::) NextHop */ | |
81d882d5 DS |
2820 | if (IN6_IS_ADDR_UNSPECIFIED(&BestRoute.NextHop.Ipv6.sin6_addr) ) |
2821 | { | |
2822 | rgi6->flags |= RGI_ON_LINK; | |
2823 | } | |
5fcd4933 | 2824 | |
81d882d5 DS |
2825 | done: |
2826 | gc_free(&gc); | |
d8a8656f GD |
2827 | } |
2828 | ||
328cc40c | 2829 | /* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */ |
9c6d72c7 | 2830 | static int |
81d882d5 DS |
2831 | add_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt, DWORD adapter_index) |
2832 | { | |
2833 | struct gc_arena gc = gc_new(); | |
328cc40c | 2834 | int ret = RTA_ERROR; |
81d882d5 DS |
2835 | DWORD status; |
2836 | const DWORD if_index = (adapter_index == TUN_ADAPTER_INDEX_INVALID) ? windows_route_find_if_index(r, tt) : adapter_index; | |
2837 | ||
2838 | if (if_index != TUN_ADAPTER_INDEX_INVALID) | |
2839 | { | |
2840 | MIB_IPFORWARDROW fr; | |
2841 | CLEAR(fr); | |
2842 | fr.dwForwardDest = htonl(r->network); | |
2843 | fr.dwForwardMask = htonl(r->netmask); | |
2844 | fr.dwForwardPolicy = 0; | |
2845 | fr.dwForwardNextHop = htonl(r->gateway); | |
2846 | fr.dwForwardIfIndex = if_index; | |
2847 | fr.dwForwardType = 4; /* the next hop is not the final dest */ | |
2848 | fr.dwForwardProto = 3; /* PROTO_IP_NETMGMT */ | |
2849 | fr.dwForwardAge = 0; | |
2850 | fr.dwForwardNextHopAS = 0; | |
2851 | fr.dwForwardMetric1 = (r->flags & RT_METRIC_DEFINED) ? r->metric : 1; | |
2852 | fr.dwForwardMetric2 = METRIC_NOT_USED; | |
2853 | fr.dwForwardMetric3 = METRIC_NOT_USED; | |
2854 | fr.dwForwardMetric4 = METRIC_NOT_USED; | |
2855 | fr.dwForwardMetric5 = METRIC_NOT_USED; | |
2856 | ||
2857 | if ((r->network & r->netmask) != r->network) | |
2858 | { | |
2859 | msg(M_WARN, "Warning: address %s is not a network address in relation to netmask %s", | |
2860 | print_in_addr_t(r->network, 0, &gc), | |
2861 | print_in_addr_t(r->netmask, 0, &gc)); | |
2862 | } | |
2863 | ||
2864 | status = CreateIpForwardEntry(&fr); | |
2865 | ||
2866 | if (status == NO_ERROR) | |
2867 | { | |
328cc40c | 2868 | ret = RTA_SUCCESS; |
9c6d72c7 SN |
2869 | } |
2870 | else if (status == ERROR_OBJECT_ALREADY_EXISTS) | |
2871 | { | |
328cc40c | 2872 | ret = RTA_EEXIST; |
81d882d5 DS |
2873 | } |
2874 | else | |
2875 | { | |
2876 | /* failed, try increasing the metric to work around Vista issue */ | |
2877 | const unsigned int forward_metric_limit = 2048; /* iteratively retry higher metrics up to this limit */ | |
2878 | ||
2879 | for (; fr.dwForwardMetric1 <= forward_metric_limit; ++fr.dwForwardMetric1) | |
2880 | { | |
2881 | /* try a different forward type=3 ("the next hop is the final dest") in addition to 4. | |
2882 | * --redirect-gateway over RRAS seems to need this. */ | |
2883 | for (fr.dwForwardType = 4; fr.dwForwardType >= 3; --fr.dwForwardType) | |
2884 | { | |
2885 | status = CreateIpForwardEntry(&fr); | |
2886 | if (status == NO_ERROR) | |
2887 | { | |
2888 | msg(D_ROUTE, "ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=%u and dwForwardType=%u", | |
2889 | (unsigned int)fr.dwForwardMetric1, | |
2890 | (unsigned int)fr.dwForwardType); | |
328cc40c | 2891 | ret = RTA_SUCCESS; |
81d882d5 DS |
2892 | goto doublebreak; |
2893 | } | |
2894 | else if (status != ERROR_BAD_ARGUMENTS) | |
2895 | { | |
2896 | goto doublebreak; | |
2897 | } | |
2898 | } | |
2899 | } | |
2900 | ||
2901 | doublebreak: | |
2902 | if (status != NO_ERROR) | |
2903 | { | |
9c6d72c7 SN |
2904 | if (status == ERROR_OBJECT_ALREADY_EXISTS) |
2905 | { | |
328cc40c | 2906 | ret = RTA_EEXIST; |
9c6d72c7 | 2907 | } |
a45c201e SN |
2908 | else |
2909 | { | |
2910 | msg(M_WARN, "ERROR: route addition failed using CreateIpForwardEntry: " | |
2911 | "%s [status=%u if_index=%u]", strerror_win32(status, &gc), | |
2912 | (unsigned int)status, (unsigned int)if_index); | |
2913 | } | |
81d882d5 DS |
2914 | } |
2915 | } | |
2916 | } | |
2917 | ||
2918 | gc_free(&gc); | |
2919 | return ret; | |
6fbf66fa JY |
2920 | } |
2921 | ||
9c6d72c7 | 2922 | static bool |
81d882d5 | 2923 | del_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt) |
6fbf66fa | 2924 | { |
81d882d5 DS |
2925 | struct gc_arena gc = gc_new(); |
2926 | bool ret = false; | |
2927 | DWORD status; | |
2928 | const DWORD if_index = windows_route_find_if_index(r, tt); | |
6fbf66fa | 2929 | |
81d882d5 | 2930 | if (if_index != TUN_ADAPTER_INDEX_INVALID) |
6fbf66fa | 2931 | { |
81d882d5 DS |
2932 | MIB_IPFORWARDROW fr; |
2933 | CLEAR(fr); | |
6fbf66fa | 2934 | |
81d882d5 DS |
2935 | fr.dwForwardDest = htonl(r->network); |
2936 | fr.dwForwardMask = htonl(r->netmask); | |
2937 | fr.dwForwardPolicy = 0; | |
2938 | fr.dwForwardNextHop = htonl(r->gateway); | |
2939 | fr.dwForwardIfIndex = if_index; | |
6fbf66fa | 2940 | |
81d882d5 | 2941 | status = DeleteIpForwardEntry(&fr); |
6fbf66fa | 2942 | |
81d882d5 DS |
2943 | if (status == NO_ERROR) |
2944 | { | |
2945 | ret = true; | |
2946 | } | |
2947 | else | |
2948 | { | |
a45c201e | 2949 | msg(M_WARN, "ERROR: route deletion failed using DeleteIpForwardEntry: %s", |
81d882d5 DS |
2950 | strerror_win32(status, &gc)); |
2951 | } | |
6fbf66fa JY |
2952 | } |
2953 | ||
81d882d5 DS |
2954 | gc_free(&gc); |
2955 | return ret; | |
6fbf66fa JY |
2956 | } |
2957 | ||
328cc40c | 2958 | /* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */ |
9c6d72c7 | 2959 | static int |
81d882d5 | 2960 | do_route_service(const bool add, const route_message_t *rt, const size_t size, HANDLE pipe) |
a24dd2e3 | 2961 | { |
328cc40c | 2962 | int ret = RTA_ERROR; |
81d882d5 DS |
2963 | ack_message_t ack; |
2964 | struct gc_arena gc = gc_new(); | |
a24dd2e3 | 2965 | |
717c1930 | 2966 | if (!send_msg_iservice(pipe, rt, size, &ack, "ROUTE")) |
a24dd2e3 | 2967 | { |
81d882d5 | 2968 | goto out; |
a24dd2e3 HH |
2969 | } |
2970 | ||
81d882d5 | 2971 | if (ack.error_number != NO_ERROR) |
a24dd2e3 | 2972 | { |
328cc40c | 2973 | ret = (ack.error_number == ERROR_OBJECT_ALREADY_EXISTS) ? RTA_EEXIST : RTA_ERROR; |
a45c201e SN |
2974 | if (ret == RTA_ERROR) |
2975 | { | |
2976 | msg(M_WARN, "ERROR: route %s failed using service: %s [status=%u if_index=%d]", | |
2977 | (add ? "addition" : "deletion"), strerror_win32(ack.error_number, &gc), | |
2978 | ack.error_number, rt->iface.index); | |
2979 | } | |
81d882d5 | 2980 | goto out; |
a24dd2e3 HH |
2981 | } |
2982 | ||
328cc40c | 2983 | ret = RTA_SUCCESS; |
a24dd2e3 HH |
2984 | |
2985 | out: | |
81d882d5 DS |
2986 | gc_free(&gc); |
2987 | return ret; | |
a24dd2e3 HH |
2988 | } |
2989 | ||
328cc40c | 2990 | /* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */ |
9c6d72c7 | 2991 | static int |
81d882d5 | 2992 | do_route_ipv4_service(const bool add, const struct route_ipv4 *r, const struct tuntap *tt) |
a24dd2e3 | 2993 | { |
81d882d5 DS |
2994 | DWORD if_index = windows_route_find_if_index(r, tt); |
2995 | if (if_index == ~0) | |
2996 | { | |
328cc40c | 2997 | return RTA_ERROR; |
81d882d5 | 2998 | } |
a24dd2e3 | 2999 | |
81d882d5 DS |
3000 | route_message_t msg = { |
3001 | .header = { | |
3002 | (add ? msg_add_route : msg_del_route), | |
3003 | sizeof(route_message_t), | |
3004 | 0 | |
3005 | }, | |
3006 | .family = AF_INET, | |
3007 | .prefix.ipv4.s_addr = htonl(r->network), | |
3008 | .gateway.ipv4.s_addr = htonl(r->gateway), | |
3009 | .iface = { .index = if_index, .name = "" }, | |
3010 | .metric = (r->flags & RT_METRIC_DEFINED ? r->metric : -1) | |
3011 | }; | |
3012 | ||
3013 | netmask_to_netbits(r->network, r->netmask, &msg.prefix_len); | |
3014 | if (msg.prefix_len == -1) | |
3015 | { | |
3016 | msg.prefix_len = 32; | |
3017 | } | |
a24dd2e3 | 3018 | |
81d882d5 | 3019 | return do_route_service(add, &msg, sizeof(msg), tt->options.msg_channel); |
a24dd2e3 HH |
3020 | } |
3021 | ||
9c6d72c7 | 3022 | /* Add or delete an ipv6 route |
328cc40c | 3023 | * Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error |
9c6d72c7 SN |
3024 | */ |
3025 | static int | |
dd669581 SN |
3026 | route_ipv6_ipapi(const bool add, const struct route_ipv6 *r, const struct tuntap *tt) |
3027 | { | |
3028 | DWORD err; | |
328cc40c | 3029 | int ret = RTA_ERROR; |
dd669581 SN |
3030 | PMIB_IPFORWARD_ROW2 fwd_row; |
3031 | struct gc_arena gc = gc_new(); | |
3032 | ||
3033 | fwd_row = gc_malloc(sizeof(*fwd_row), true, &gc); | |
3034 | ||
3035 | fwd_row->ValidLifetime = 0xffffffff; | |
3036 | fwd_row->PreferredLifetime = 0xffffffff; | |
3037 | fwd_row->Protocol = MIB_IPPROTO_NETMGMT; | |
3038 | fwd_row->Metric = ((r->flags & RT_METRIC_DEFINED) ? r->metric : -1); | |
3039 | fwd_row->DestinationPrefix.Prefix.si_family = AF_INET6; | |
3040 | fwd_row->DestinationPrefix.Prefix.Ipv6.sin6_addr = r->network; | |
3041 | fwd_row->DestinationPrefix.PrefixLength = (UINT8) r->netbits; | |
3042 | fwd_row->NextHop.si_family = AF_INET6; | |
3043 | fwd_row->NextHop.Ipv6.sin6_addr = r->gateway; | |
3044 | fwd_row->InterfaceIndex = r->adapter_index ? r->adapter_index : tt->adapter_index; | |
3045 | ||
3046 | /* In TUN mode we use a special link-local address as the next hop. | |
3047 | * The tapdrvr knows about it and will answer neighbor discovery packets. | |
3048 | * (only do this for routes actually using the tun/tap device) | |
3049 | */ | |
3050 | if (tt->type == DEV_TYPE_TUN && !r->adapter_index) | |
3051 | { | |
3052 | inet_pton(AF_INET6, "fe80::8", &fwd_row->NextHop.Ipv6.sin6_addr); | |
3053 | } | |
3054 | ||
3055 | /* Use LUID if interface index not available */ | |
3056 | if (fwd_row->InterfaceIndex == TUN_ADAPTER_INDEX_INVALID && strlen(tt->actual_name)) | |
3057 | { | |
3058 | NET_LUID luid; | |
3059 | err = ConvertInterfaceAliasToLuid(wide_string(tt->actual_name, &gc), &luid); | |
3060 | if (err != NO_ERROR) | |
3061 | { | |
3062 | goto out; | |
3063 | } | |
3064 | fwd_row->InterfaceLuid = luid; | |
3065 | fwd_row->InterfaceIndex = 0; | |
3066 | } | |
3067 | ||
3068 | if (add) | |
3069 | { | |
3070 | err = CreateIpForwardEntry2(fwd_row); | |
3071 | } | |
3072 | else | |
3073 | { | |
3074 | err = DeleteIpForwardEntry2(fwd_row); | |
3075 | } | |
3076 | ||
3077 | out: | |
3078 | if (err != NO_ERROR) | |
3079 | { | |
328cc40c | 3080 | ret = (err == ERROR_OBJECT_ALREADY_EXISTS) ? RTA_EEXIST : RTA_ERROR; |
a45c201e SN |
3081 | if (ret == RTA_ERROR) |
3082 | { | |
3083 | msg(M_WARN, "ERROR: route %s failed using ipapi: %s [status=%lu if_index=%lu]", | |
3084 | (add ? "addition" : "deletion"), strerror_win32(err, &gc), err, | |
3085 | fwd_row->InterfaceIndex); | |
3086 | } | |
3087 | else if (add) | |
3088 | { | |
3089 | msg(D_ROUTE, "IPv6 route addition using ipapi failed because route exists"); | |
3090 | } | |
dd669581 SN |
3091 | } |
3092 | else | |
3093 | { | |
3094 | msg(D_ROUTE, "IPv6 route %s using ipapi", add ? "added" : "deleted"); | |
328cc40c | 3095 | ret = RTA_SUCCESS; |
dd669581 SN |
3096 | } |
3097 | gc_free(&gc); | |
9c6d72c7 | 3098 | return ret; |
dd669581 SN |
3099 | } |
3100 | ||
328cc40c | 3101 | /* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */ |
9c6d72c7 | 3102 | static int |
81d882d5 | 3103 | do_route_ipv6_service(const bool add, const struct route_ipv6 *r, const struct tuntap *tt) |
a24dd2e3 | 3104 | { |
9c6d72c7 | 3105 | int status; |
81d882d5 DS |
3106 | route_message_t msg = { |
3107 | .header = { | |
3108 | (add ? msg_add_route : msg_del_route), | |
3109 | sizeof(route_message_t), | |
3110 | 0 | |
3111 | }, | |
3112 | .family = AF_INET6, | |
3113 | .prefix.ipv6 = r->network, | |
3114 | .prefix_len = r->netbits, | |
3115 | .gateway.ipv6 = r->gateway, | |
3116 | .iface = { .index = tt->adapter_index, .name = "" }, | |
3117 | .metric = ( (r->flags & RT_METRIC_DEFINED) ? r->metric : -1) | |
3118 | }; | |
3119 | ||
3120 | if (r->adapter_index) /* vpn server special route */ | |
3121 | { | |
3122 | msg.iface.index = r->adapter_index; | |
3123 | } | |
a24dd2e3 | 3124 | |
81d882d5 DS |
3125 | /* In TUN mode we use a special link-local address as the next hop. |
3126 | * The tapdrvr knows about it and will answer neighbor discovery packets. | |
27740b37 | 3127 | * (only do this for routes actually using the tun/tap device) |
81d882d5 | 3128 | */ |
27740b37 | 3129 | if (tt->type == DEV_TYPE_TUN |
f57431cd | 3130 | && msg.iface.index == tt->adapter_index) |
81d882d5 DS |
3131 | { |
3132 | inet_pton(AF_INET6, "fe80::8", &msg.gateway.ipv6); | |
3133 | } | |
a24dd2e3 | 3134 | |
81d882d5 | 3135 | if (msg.iface.index == TUN_ADAPTER_INDEX_INVALID) |
a24dd2e3 | 3136 | { |
81d882d5 DS |
3137 | strncpy(msg.iface.name, tt->actual_name, sizeof(msg.iface.name)); |
3138 | msg.iface.name[sizeof(msg.iface.name) - 1] = '\0'; | |
a24dd2e3 HH |
3139 | } |
3140 | ||
81d882d5 | 3141 | status = do_route_service(add, &msg, sizeof(msg), tt->options.msg_channel); |
a45c201e SN |
3142 | if (status != RTA_ERROR) |
3143 | { | |
3144 | msg(D_ROUTE, "IPv6 route %s via service %s", | |
3145 | add ? "addition" : "deletion", | |
3146 | (status == RTA_SUCCESS) ? "succeeded" : "failed because route exists"); | |
3147 | } | |
81d882d5 | 3148 | return status; |
a24dd2e3 HH |
3149 | } |
3150 | ||
328cc40c | 3151 | /* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */ |
9c6d72c7 | 3152 | static int |
81d882d5 | 3153 | add_route_service(const struct route_ipv4 *r, const struct tuntap *tt) |
a24dd2e3 | 3154 | { |
81d882d5 | 3155 | return do_route_ipv4_service(true, r, tt); |
a24dd2e3 HH |
3156 | } |
3157 | ||
3158 | static bool | |
81d882d5 | 3159 | del_route_service(const struct route_ipv4 *r, const struct tuntap *tt) |
a24dd2e3 | 3160 | { |
81d882d5 | 3161 | return do_route_ipv4_service(false, r, tt); |
a24dd2e3 HH |
3162 | } |
3163 | ||
328cc40c | 3164 | /* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */ |
9c6d72c7 | 3165 | static int |
81d882d5 | 3166 | add_route_ipv6_service(const struct route_ipv6 *r, const struct tuntap *tt) |
a24dd2e3 | 3167 | { |
81d882d5 | 3168 | return do_route_ipv6_service(true, r, tt); |
a24dd2e3 HH |
3169 | } |
3170 | ||
3171 | static bool | |
81d882d5 | 3172 | del_route_ipv6_service(const struct route_ipv6 *r, const struct tuntap *tt) |
a24dd2e3 | 3173 | { |
81d882d5 | 3174 | return do_route_ipv6_service(false, r, tt); |
a24dd2e3 HH |
3175 | } |
3176 | ||
6fbf66fa | 3177 | static const char * |
81d882d5 DS |
3178 | format_route_entry(const MIB_IPFORWARDROW *r, struct gc_arena *gc) |
3179 | { | |
3180 | struct buffer out = alloc_buf_gc(256, gc); | |
3181 | buf_printf(&out, "%s %s %s p=%d i=%d t=%d pr=%d a=%d h=%d m=%d/%d/%d/%d/%d", | |
3182 | print_in_addr_t(r->dwForwardDest, IA_NET_ORDER, gc), | |
3183 | print_in_addr_t(r->dwForwardMask, IA_NET_ORDER, gc), | |
3184 | print_in_addr_t(r->dwForwardNextHop, IA_NET_ORDER, gc), | |
3185 | (int)r->dwForwardPolicy, | |
3186 | (int)r->dwForwardIfIndex, | |
3187 | (int)r->dwForwardType, | |
3188 | (int)r->dwForwardProto, | |
3189 | (int)r->dwForwardAge, | |
3190 | (int)r->dwForwardNextHopAS, | |
3191 | (int)r->dwForwardMetric1, | |
3192 | (int)r->dwForwardMetric2, | |
3193 | (int)r->dwForwardMetric3, | |
3194 | (int)r->dwForwardMetric4, | |
3195 | (int)r->dwForwardMetric5); | |
3196 | return BSTR(&out); | |
6fbf66fa JY |
3197 | } |
3198 | ||
3199 | /* | |
3200 | * Show current routing table | |
3201 | */ | |
3202 | void | |
81d882d5 | 3203 | show_routes(int msglev) |
6fbf66fa | 3204 | { |
81d882d5 | 3205 | struct gc_arena gc = gc_new(); |
6fbf66fa | 3206 | |
81d882d5 | 3207 | const MIB_IPFORWARDTABLE *rt = get_windows_routing_table(&gc); |
6fbf66fa | 3208 | |
81d882d5 DS |
3209 | msg(msglev, "SYSTEM ROUTING TABLE"); |
3210 | if (rt) | |
6fbf66fa | 3211 | { |
467b16dc | 3212 | for (DWORD i = 0; i < rt->dwNumEntries; ++i) |
81d882d5 DS |
3213 | { |
3214 | msg(msglev, "%s", format_route_entry(&rt->table[i], &gc)); | |
3215 | } | |
6fbf66fa | 3216 | } |
81d882d5 | 3217 | gc_free(&gc); |
6fbf66fa JY |
3218 | } |
3219 | ||
26e5b800 AS |
3220 | #elif defined(TARGET_ANDROID) |
3221 | ||
3222 | void | |
3223 | get_default_gateway(struct route_gateway_info *rgi, openvpn_net_ctx_t *ctx) | |
3224 | { | |
3225 | /* Android, set some pseudo GW, addr is in host byte order, | |
3226 | * Determining the default GW on Android 5.0+ is non trivial | |
3227 | * and serves almost no purpose since OpenVPN only uses the | |
3228 | * default GW address to add routes for networks that should | |
3229 | * NOT be routed over the VPN. Using a well known address | |
3230 | * (127.'d'.'g'.'w') for the default GW make detecting | |
3231 | * these routes easier from the controlling app. | |
3232 | */ | |
3233 | CLEAR(*rgi); | |
3234 | ||
3235 | rgi->gateway.addr = 127 << 24 | 'd' << 16 | 'g' << 8 | 'w'; | |
3236 | rgi->flags = RGI_ADDR_DEFINED | RGI_IFACE_DEFINED; | |
3237 | strcpy(rgi->iface, "android-gw"); | |
3238 | ||
3239 | /* Skip scanning/fetching interface from loopback interface we do | |
3240 | * normally on Linux. | |
3241 | * It always fails and "ioctl(SIOCGIFCONF) failed" confuses users | |
3242 | */ | |
3243 | ||
3244 | } | |
3245 | ||
3246 | void | |
3247 | get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, | |
3248 | const struct in6_addr *dest, openvpn_net_ctx_t *ctx) | |
3249 | { | |
3250 | /* Same for ipv6 */ | |
3251 | ||
3252 | CLEAR(*rgi6); | |
3253 | ||
3254 | /* Use a fake link-local address */ | |
3255 | ASSERT(inet_pton(AF_INET6, "fe80::ad", &rgi6->addrs->addr_ipv6) == 1); | |
3256 | rgi6->addrs->netbits_ipv6 = 64; | |
3257 | rgi6->flags = RGI_ADDR_DEFINED | RGI_IFACE_DEFINED; | |
3258 | strcpy(rgi6->iface, "android-gw"); | |
3259 | } | |
3260 | ||
3261 | #elif defined(TARGET_LINUX) | |
6fbf66fa | 3262 | |
7fb0e07e | 3263 | void |
aec4a3d1 | 3264 | get_default_gateway(struct route_gateway_info *rgi, openvpn_net_ctx_t *ctx) |
6fbf66fa | 3265 | { |
81d882d5 DS |
3266 | struct gc_arena gc = gc_new(); |
3267 | int sd = -1; | |
aec4a3d1 | 3268 | char best_name[IFNAMSIZ]; |
7fb0e07e | 3269 | |
81d882d5 | 3270 | CLEAR(*rgi); |
aec4a3d1 | 3271 | CLEAR(best_name); |
7fb0e07e | 3272 | |
81d882d5 | 3273 | /* get default gateway IP addr */ |
4490b5a1 | 3274 | if (net_route_v4_best_gw(ctx, NULL, &rgi->gateway.addr, best_name) == 0) |
81d882d5 | 3275 | { |
aec4a3d1 AQ |
3276 | rgi->flags |= RGI_ADDR_DEFINED; |
3277 | if (!rgi->gateway.addr && best_name[0]) | |
81d882d5 | 3278 | { |
aec4a3d1 | 3279 | rgi->flags |= RGI_ON_LINK; |
81d882d5 DS |
3280 | } |
3281 | } | |
81d882d5 DS |
3282 | |
3283 | /* scan adapter list */ | |
3284 | if (rgi->flags & RGI_ADDR_DEFINED) | |
3285 | { | |
3286 | struct ifreq *ifr, *ifend; | |
3287 | in_addr_t addr, netmask; | |
3288 | struct ifreq ifreq; | |
3289 | struct ifconf ifc; | |
3290 | struct ifreq ifs[20]; /* Maximum number of interfaces to scan */ | |
3291 | ||
3292 | if ((sd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) | |
3293 | { | |
3294 | msg(M_WARN, "GDG: socket() failed"); | |
3295 | goto done; | |
3296 | } | |
3297 | ifc.ifc_len = sizeof(ifs); | |
3298 | ifc.ifc_req = ifs; | |
3299 | if (ioctl(sd, SIOCGIFCONF, &ifc) < 0) | |
3300 | { | |
3301 | msg(M_WARN, "GDG: ioctl(SIOCGIFCONF) failed"); | |
3302 | goto done; | |
3303 | } | |
7fb0e07e | 3304 | |
81d882d5 DS |
3305 | /* scan through interface list */ |
3306 | ifend = ifs + (ifc.ifc_len / sizeof(struct ifreq)); | |
3307 | for (ifr = ifc.ifc_req; ifr < ifend; ifr++) | |
3308 | { | |
3309 | if (ifr->ifr_addr.sa_family == AF_INET) | |
3310 | { | |
3311 | /* get interface addr */ | |
3312 | addr = ntohl(((struct sockaddr_in *) &ifr->ifr_addr)->sin_addr.s_addr); | |
3313 | ||
3314 | /* get interface name */ | |
3315 | strncpynt(ifreq.ifr_name, ifr->ifr_name, sizeof(ifreq.ifr_name)); | |
3316 | ||
3317 | /* check that the interface is up */ | |
3318 | if (ioctl(sd, SIOCGIFFLAGS, &ifreq) < 0) | |
3319 | { | |
3320 | continue; | |
3321 | } | |
3322 | if (!(ifreq.ifr_flags & IFF_UP)) | |
3323 | { | |
3324 | continue; | |
3325 | } | |
3326 | ||
3327 | if (rgi->flags & RGI_ON_LINK) | |
3328 | { | |
3329 | /* check that interface name of current interface | |
f57431cd | 3330 | * matches interface name of best default route */ |
81d882d5 DS |
3331 | if (strcmp(ifreq.ifr_name, best_name)) |
3332 | { | |
3333 | continue; | |
3334 | } | |
8fc83a2d | 3335 | #if 0 |
81d882d5 DS |
3336 | /* if point-to-point link, use remote addr as route gateway */ |
3337 | if ((ifreq.ifr_flags & IFF_POINTOPOINT) && ioctl(sd, SIOCGIFDSTADDR, &ifreq) >= 0) | |
3338 | { | |
3339 | rgi->gateway.addr = ntohl(((struct sockaddr_in *) &ifreq.ifr_addr)->sin_addr.s_addr); | |
3340 | if (rgi->gateway.addr) | |
3341 | { | |
3342 | rgi->flags &= ~RGI_ON_LINK; | |
3343 | } | |
3344 | } | |
8fc83a2d | 3345 | #endif |
81d882d5 DS |
3346 | } |
3347 | else | |
3348 | { | |
3349 | /* get interface netmask */ | |
3350 | if (ioctl(sd, SIOCGIFNETMASK, &ifreq) < 0) | |
3351 | { | |
3352 | continue; | |
3353 | } | |
3354 | netmask = ntohl(((struct sockaddr_in *) &ifreq.ifr_addr)->sin_addr.s_addr); | |
3355 | ||
3356 | /* check that interface matches default route */ | |
3357 | if (((rgi->gateway.addr ^ addr) & netmask) != 0) | |
3358 | { | |
3359 | continue; | |
3360 | } | |
3361 | ||
3362 | /* save netmask */ | |
3363 | rgi->gateway.netmask = netmask; | |
3364 | rgi->flags |= RGI_NETMASK_DEFINED; | |
3365 | } | |
3366 | ||
3367 | /* save iface name */ | |
3368 | strncpynt(rgi->iface, ifreq.ifr_name, sizeof(rgi->iface)); | |
3369 | rgi->flags |= RGI_IFACE_DEFINED; | |
3370 | ||
3371 | /* now get the hardware address. */ | |
3372 | memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr)); | |
3373 | if (ioctl(sd, SIOCGIFHWADDR, &ifreq) < 0) | |
3374 | { | |
3375 | msg(M_WARN, "GDG: SIOCGIFHWADDR(%s) failed", ifreq.ifr_name); | |
3376 | goto done; | |
3377 | } | |
3378 | memcpy(rgi->hwaddr, &ifreq.ifr_hwaddr.sa_data, 6); | |
3379 | rgi->flags |= RGI_HWADDR_DEFINED; | |
3380 | ||
3381 | break; | |
3382 | } | |
3383 | } | |
3384 | } | |
3385 | ||
3386 | done: | |
3387 | if (sd >= 0) | |
3388 | { | |
3389 | close(sd); | |
3390 | } | |
3391 | gc_free(&gc); | |
6fbf66fa JY |
3392 | } |
3393 | ||
3128abcf GD |
3394 | /* IPv6 implementation using netlink |
3395 | * http://www.linuxjournal.com/article/7356 | |
3396 | * netlink(3), netlink(7), rtnetlink(7) | |
3397 | * http://www.virtualbox.org/svn/vbox/trunk/src/VBox/NetworkServices/NAT/rtmon_linux.c | |
d8a8656f | 3398 | */ |
3128abcf | 3399 | struct rtreq { |
81d882d5 DS |
3400 | struct nlmsghdr nh; |
3401 | struct rtmsg rtm; | |
3402 | char attrbuf[512]; | |
3128abcf GD |
3403 | }; |
3404 | ||
d8a8656f GD |
3405 | void |
3406 | get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, | |
c454b21e | 3407 | const struct in6_addr *dest, openvpn_net_ctx_t *ctx) |
d8a8656f | 3408 | { |
c454b21e | 3409 | int flags; |
3128abcf | 3410 | |
d8a8656f | 3411 | CLEAR(*rgi6); |
3128abcf | 3412 | |
4490b5a1 | 3413 | if (net_route_v6_best_gw(ctx, dest, &rgi6->gateway.addr_ipv6, |
c454b21e | 3414 | rgi6->iface) == 0) |
81d882d5 | 3415 | { |
aa0e44e2 | 3416 | if (!IN6_IS_ADDR_UNSPECIFIED(&rgi6->gateway.addr_ipv6)) |
81d882d5 | 3417 | { |
c454b21e | 3418 | rgi6->flags |= RGI_ADDR_DEFINED; |
81d882d5 DS |
3419 | } |
3420 | ||
ac4ceada | 3421 | if (strlen(rgi6->iface) > 0) |
81d882d5 | 3422 | { |
c454b21e | 3423 | rgi6->flags |= RGI_IFACE_DEFINED; |
81d882d5 | 3424 | } |
3128abcf GD |
3425 | } |
3426 | ||
3427 | /* if we have an interface but no gateway, the destination is on-link */ | |
c454b21e AQ |
3428 | flags = rgi6->flags & (RGI_IFACE_DEFINED | RGI_ADDR_DEFINED); |
3429 | if (flags == RGI_IFACE_DEFINED) | |
3128abcf | 3430 | { |
81d882d5 DS |
3431 | rgi6->flags |= (RGI_ADDR_DEFINED | RGI_ON_LINK); |
3432 | if (dest) | |
3433 | { | |
3434 | rgi6->gateway.addr_ipv6 = *dest; | |
3435 | } | |
3128abcf | 3436 | } |
d8a8656f GD |
3437 | } |
3438 | ||
81d882d5 DS |
3439 | #elif defined(TARGET_DARWIN) || defined(TARGET_SOLARIS) \ |
3440 | || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) \ | |
3441 | || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD) | |
6fbf66fa JY |
3442 | |
3443 | #include <sys/types.h> | |
3444 | #include <sys/socket.h> | |
3445 | #include <netinet/in.h> | |
6a8ea970 JY |
3446 | #include <net/route.h> |
3447 | #include <net/if_dl.h> | |
76d11614 GD |
3448 | #if !defined(TARGET_SOLARIS) |
3449 | #include <ifaddrs.h> | |
3450 | #endif | |
6fbf66fa | 3451 | |
6a8ea970 | 3452 | struct rtmsg { |
81d882d5 DS |
3453 | struct rt_msghdr m_rtm; |
3454 | char m_space[512]; | |
6a8ea970 | 3455 | }; |
6fbf66fa | 3456 | |
cab6305b GD |
3457 | /* the route socket code is identical for all 4 supported BSDs and for |
3458 | * MacOS X (Darwin), with one crucial difference: when going from | |
37aab49b | 3459 | * 32 bit to 64 bit, FreeBSD/OpenBSD increased the structure size but kept |
cab6305b GD |
3460 | * source code compatibility by keeping the use of "long", while |
3461 | * MacOS X decided to keep binary compatibility by *changing* the API | |
3462 | * to use "uint32_t", thus 32 bit on all OS X variants | |
3463 | * | |
37aab49b GD |
3464 | * NetBSD does the MacOS way of "fixed number of bits, no matter if |
3465 | * 32 or 64 bit OS", but chose uint64_t. For maximum portability, we | |
3466 | * just use the OS RT_ROUNDUP() macro, which is guaranteed to be correct. | |
3467 | * | |
cab6305b GD |
3468 | * We used to have a large amount of duplicate code here which really |
3469 | * differed only in this (long) vs. (uint32_t) - IMHO, worse than | |
3470 | * having a combined block for all BSDs with this single #ifdef inside | |
3471 | */ | |
3472 | ||
3473 | #if defined(TARGET_DARWIN) | |
81d882d5 DS |
3474 | #define ROUNDUP(a) \ |
3475 | ((a) > 0 ? (1 + (((a) - 1) | (sizeof(uint32_t) - 1))) : sizeof(uint32_t)) | |
37aab49b GD |
3476 | #elif defined(TARGET_NETBSD) |
3477 | #define ROUNDUP(a) RT_ROUNDUP(a) | |
cab6305b | 3478 | #else |
81d882d5 DS |
3479 | #define ROUNDUP(a) \ |
3480 | ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long)) | |
cab6305b | 3481 | #endif |
6fbf66fa | 3482 | |
01bfdf3a AP |
3483 | #if defined(TARGET_SOLARIS) |
3484 | #define NEXTADDR(w, u) \ | |
81d882d5 | 3485 | if (rtm_addrs & (w)) { \ |
7e65483d | 3486 | l = sizeof(u); memmove(cp, &(u), l); cp += ROUNDUP(l); \ |
81d882d5 | 3487 | } |
01bfdf3a AP |
3488 | |
3489 | #define ADVANCE(x, n) (x += ROUNDUP(sizeof(struct sockaddr_in))) | |
81d882d5 | 3490 | #else /* if defined(TARGET_SOLARIS) */ |
7fb0e07e | 3491 | #define NEXTADDR(w, u) \ |
81d882d5 | 3492 | if (rtm_addrs & (w)) { \ |
5fde831c | 3493 | l = ((struct sockaddr *)&(u))->sa_len; memmove(cp, &(u), l); cp += ROUNDUP(l); \ |
81d882d5 | 3494 | } |
7fb0e07e JY |
3495 | |
3496 | #define ADVANCE(x, n) (x += ROUNDUP((n)->sa_len)) | |
01bfdf3a | 3497 | #endif |
7fb0e07e | 3498 | |
e51d9a73 | 3499 | #define max(a, b) ((a) > (b) ? (a) : (b)) |
7fb0e07e JY |
3500 | |
3501 | void | |
aec4a3d1 | 3502 | get_default_gateway(struct route_gateway_info *rgi, openvpn_net_ctx_t *ctx) |
6fbf66fa | 3503 | { |
81d882d5 DS |
3504 | struct gc_arena gc = gc_new(); |
3505 | struct rtmsg m_rtmsg; | |
3506 | int sockfd = -1; | |
3507 | int seq, l, pid, rtm_addrs; | |
3508 | unsigned int i; | |
3509 | struct sockaddr so_dst, so_mask; | |
3510 | char *cp = m_rtmsg.m_space; | |
3511 | struct sockaddr *gate = NULL, *ifp = NULL, *sa; | |
3512 | struct rt_msghdr *rtm_aux; | |
6fbf66fa | 3513 | |
81d882d5 | 3514 | #define rtm m_rtmsg.m_rtm |
6fbf66fa | 3515 | |
81d882d5 | 3516 | CLEAR(*rgi); |
6fbf66fa | 3517 | |
81d882d5 DS |
3518 | /* setup data to send to routing socket */ |
3519 | pid = getpid(); | |
3520 | seq = 0; | |
acf6f339 GD |
3521 | #ifdef TARGET_OPENBSD |
3522 | rtm_addrs = RTA_DST | RTA_NETMASK; /* Kernel refuses RTA_IFP */ | |
3523 | #else | |
81d882d5 | 3524 | rtm_addrs = RTA_DST | RTA_NETMASK | RTA_IFP; |
acf6f339 | 3525 | #endif |
6fbf66fa | 3526 | |
81d882d5 DS |
3527 | bzero(&m_rtmsg, sizeof(m_rtmsg)); |
3528 | bzero(&so_dst, sizeof(so_dst)); | |
3529 | bzero(&so_mask, sizeof(so_mask)); | |
3530 | bzero(&rtm, sizeof(struct rt_msghdr)); | |
6fbf66fa | 3531 | |
81d882d5 DS |
3532 | rtm.rtm_type = RTM_GET; |
3533 | rtm.rtm_flags = RTF_UP | RTF_GATEWAY; | |
3534 | rtm.rtm_version = RTM_VERSION; | |
3535 | rtm.rtm_seq = ++seq; | |
3dd30bfe SM |
3536 | #ifdef TARGET_OPENBSD |
3537 | rtm.rtm_tableid = getrtable(); | |
3538 | #endif | |
81d882d5 | 3539 | rtm.rtm_addrs = rtm_addrs; |
6fbf66fa | 3540 | |
81d882d5 DS |
3541 | so_dst.sa_family = AF_INET; |
3542 | so_mask.sa_family = AF_INET; | |
01bfdf3a AP |
3543 | |
3544 | #ifndef TARGET_SOLARIS | |
81d882d5 DS |
3545 | so_dst.sa_len = sizeof(struct sockaddr_in); |
3546 | so_mask.sa_len = sizeof(struct sockaddr_in); | |
01bfdf3a | 3547 | #endif |
6fbf66fa | 3548 | |
81d882d5 DS |
3549 | NEXTADDR(RTA_DST, so_dst); |
3550 | NEXTADDR(RTA_NETMASK, so_mask); | |
3551 | ||
3552 | rtm.rtm_msglen = l = cp - (char *)&m_rtmsg; | |
3553 | ||
3554 | /* transact with routing socket */ | |
3555 | sockfd = socket(PF_ROUTE, SOCK_RAW, 0); | |
7fb0e07e | 3556 | if (sockfd < 0) |
81d882d5 DS |
3557 | { |
3558 | msg(M_WARN, "GDG: socket #1 failed"); | |
3559 | goto done; | |
3560 | } | |
3561 | if (write(sockfd, (char *)&m_rtmsg, l) < 0) | |
3562 | { | |
acf6f339 | 3563 | msg(M_WARN|M_ERRNO, "GDG: problem writing to routing socket"); |
81d882d5 DS |
3564 | goto done; |
3565 | } | |
4cd4899e SK |
3566 | do |
3567 | { | |
81d882d5 DS |
3568 | l = read(sockfd, (char *)&m_rtmsg, sizeof(m_rtmsg)); |
3569 | } while (l > 0 && (rtm.rtm_seq != seq || rtm.rtm_pid != pid)); | |
7fb0e07e JY |
3570 | close(sockfd); |
3571 | sockfd = -1; | |
3572 | ||
81d882d5 DS |
3573 | /* extract return data from routing socket */ |
3574 | rtm_aux = &rtm; | |
3575 | cp = ((char *)(rtm_aux + 1)); | |
3576 | if (rtm_aux->rtm_addrs) | |
3577 | { | |
3578 | for (i = 1; i; i <<= 1) | |
3579 | { | |
3580 | if (i & rtm_aux->rtm_addrs) | |
3581 | { | |
3582 | sa = (struct sockaddr *)cp; | |
3583 | if (i == RTA_GATEWAY) | |
3584 | { | |
3585 | gate = sa; | |
3586 | } | |
3587 | else if (i == RTA_IFP) | |
3588 | { | |
3589 | ifp = sa; | |
3590 | } | |
3591 | ADVANCE(cp, sa); | |
3592 | } | |
3593 | } | |
3594 | } | |
3595 | else | |
3596 | { | |
3597 | goto done; | |
3598 | } | |
3599 | ||
3600 | /* get gateway addr and interface name */ | |
3601 | if (gate != NULL) | |
3602 | { | |
3603 | /* get default gateway addr */ | |
3604 | rgi->gateway.addr = ntohl(((struct sockaddr_in *)gate)->sin_addr.s_addr); | |
3605 | if (rgi->gateway.addr) | |
3606 | { | |
3607 | rgi->flags |= RGI_ADDR_DEFINED; | |
3608 | } | |
3609 | ||
3610 | if (ifp) | |
3611 | { | |
3612 | /* get interface name */ | |
3613 | const struct sockaddr_dl *adl = (struct sockaddr_dl *) ifp; | |
3614 | if (adl->sdl_nlen && adl->sdl_nlen < sizeof(rgi->iface)) | |
3615 | { | |
3616 | memcpy(rgi->iface, adl->sdl_data, adl->sdl_nlen); | |
3617 | rgi->iface[adl->sdl_nlen] = '\0'; | |
3618 | rgi->flags |= RGI_IFACE_DEFINED; | |
3619 | } | |
3620 | } | |
3621 | } | |
3622 | ||
3623 | /* get netmask of interface that owns default gateway */ | |
3624 | if (rgi->flags & RGI_IFACE_DEFINED) | |
3625 | { | |
3626 | struct ifreq ifr; | |
3627 | ||
3628 | sockfd = socket(AF_INET, SOCK_DGRAM, 0); | |
3629 | if (sockfd < 0) | |
3630 | { | |
3631 | msg(M_WARN, "GDG: socket #2 failed"); | |
3632 | goto done; | |
3633 | } | |
3634 | ||
3635 | CLEAR(ifr); | |
3636 | ifr.ifr_addr.sa_family = AF_INET; | |
3637 | strncpynt(ifr.ifr_name, rgi->iface, IFNAMSIZ); | |
3638 | ||
3639 | if (ioctl(sockfd, SIOCGIFNETMASK, (char *)&ifr) < 0) | |
3640 | { | |
3641 | msg(M_WARN, "GDG: ioctl #1 failed"); | |
3642 | goto done; | |
3643 | } | |
3644 | close(sockfd); | |
3645 | sockfd = -1; | |
3646 | ||
3647 | rgi->gateway.netmask = ntohl(((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr.s_addr); | |
3648 | rgi->flags |= RGI_NETMASK_DEFINED; | |
3649 | } | |
3650 | ||
3651 | /* try to read MAC addr associated with interface that owns default gateway */ | |
3652 | if (rgi->flags & RGI_IFACE_DEFINED) | |
3653 | { | |
76d11614 GD |
3654 | #if defined(TARGET_SOLARIS) |
3655 | /* OpenSolaris has getifaddrs(3), but it does not return AF_LINK */ | |
81d882d5 DS |
3656 | sockfd = socket(AF_INET, SOCK_DGRAM, 0); |
3657 | if (sockfd < 0) | |
3658 | { | |
3659 | msg(M_WARN, "GDG: socket #3 failed"); | |
3660 | goto done; | |
3661 | } | |
3662 | ||
76d11614 | 3663 | struct ifreq ifreq = { 0 }; |
81d882d5 | 3664 | |
76d11614 GD |
3665 | /* now get the hardware address. */ |
3666 | strncpynt(ifreq.ifr_name, rgi->iface, sizeof(ifreq.ifr_name)); | |
3667 | if (ioctl(sockfd, SIOCGIFHWADDR, &ifreq) < 0) | |
81d882d5 | 3668 | { |
76d11614 | 3669 | msg(M_WARN, "GDG: SIOCGIFHWADDR(%s) failed", ifreq.ifr_name); |
81d882d5 | 3670 | } |
76d11614 GD |
3671 | else |
3672 | { | |
3673 | memcpy(rgi->hwaddr, &ifreq.ifr_addr.sa_data, 6); | |
3674 | rgi->flags |= RGI_HWADDR_DEFINED; | |
3675 | } | |
3676 | #else /* if defined(TARGET_SOLARIS) */ | |
3677 | struct ifaddrs *ifap, *ifa; | |
81d882d5 | 3678 | |
76d11614 | 3679 | if (getifaddrs(&ifap) != 0) |
81d882d5 | 3680 | { |
76d11614 GD |
3681 | msg(M_WARN|M_ERRNO, "GDG: getifaddrs() failed"); |
3682 | goto done; | |
3683 | } | |
01bfdf3a | 3684 | |
76d11614 GD |
3685 | for (ifa = ifap; ifa; ifa = ifa->ifa_next) |
3686 | { | |
3687 | if (ifa->ifa_addr != NULL | |
3688 | && ifa->ifa_addr->sa_family == AF_LINK | |
3689 | && !strncmp(ifa->ifa_name, rgi->iface, IFNAMSIZ) ) | |
81d882d5 | 3690 | { |
76d11614 GD |
3691 | struct sockaddr_dl *sdl = (struct sockaddr_dl *)ifa->ifa_addr; |
3692 | memcpy(rgi->hwaddr, LLADDR(sdl), 6); | |
3693 | rgi->flags |= RGI_HWADDR_DEFINED; | |
81d882d5 | 3694 | } |
81d882d5 | 3695 | } |
76d11614 GD |
3696 | |
3697 | freeifaddrs(ifap); | |
3698 | #endif /* if defined(TARGET_SOLARIS) */ | |
81d882d5 DS |
3699 | } |
3700 | ||
3701 | done: | |
3702 | if (sockfd >= 0) | |
3703 | { | |
3704 | close(sockfd); | |
3705 | } | |
3706 | gc_free(&gc); | |
6a8ea970 JY |
3707 | } |
3708 | ||
2ff366f7 GD |
3709 | /* BSD implementation using routing socket (as does IPv4) |
3710 | * (the code duplication is somewhat unavoidable if we want this to | |
3711 | * work on OpenSolaris as well. *sigh*) | |
d8a8656f | 3712 | */ |
2ff366f7 GD |
3713 | |
3714 | /* Solaris has no length field - this is ugly, but less #ifdef in total | |
3715 | */ | |
3716 | #if defined(TARGET_SOLARIS) | |
81d882d5 DS |
3717 | #undef ADVANCE |
3718 | #define ADVANCE(x, n) (x += ROUNDUP(sizeof(struct sockaddr_in6))) | |
2ff366f7 GD |
3719 | #endif |
3720 | ||
d8a8656f GD |
3721 | void |
3722 | get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, | |
c454b21e | 3723 | const struct in6_addr *dest, openvpn_net_ctx_t *ctx) |
d8a8656f | 3724 | { |
2ff366f7 GD |
3725 | |
3726 | struct rtmsg m_rtmsg; | |
3727 | int sockfd = -1; | |
d4d5d925 MM |
3728 | int seq, l, pid, rtm_addrs; |
3729 | unsigned int i; | |
2ff366f7 GD |
3730 | struct sockaddr_in6 so_dst, so_mask; |
3731 | char *cp = m_rtmsg.m_space; | |
3732 | struct sockaddr *gate = NULL, *ifp = NULL, *sa; | |
3733 | struct rt_msghdr *rtm_aux; | |
3734 | ||
d8a8656f | 3735 | CLEAR(*rgi6); |
2ff366f7 GD |
3736 | |
3737 | /* setup data to send to routing socket */ | |
3738 | pid = getpid(); | |
3739 | seq = 0; | |
acf6f339 GD |
3740 | #ifdef TARGET_OPENBSD |
3741 | rtm_addrs = RTA_DST | RTA_NETMASK; /* Kernel refuses RTA_IFP */ | |
3742 | #else | |
2ff366f7 | 3743 | rtm_addrs = RTA_DST | RTA_NETMASK | RTA_IFP; |
acf6f339 | 3744 | #endif |
2ff366f7 GD |
3745 | |
3746 | bzero(&m_rtmsg, sizeof(m_rtmsg)); | |
3747 | bzero(&so_dst, sizeof(so_dst)); | |
3748 | bzero(&so_mask, sizeof(so_mask)); | |
3749 | bzero(&rtm, sizeof(struct rt_msghdr)); | |
3750 | ||
3751 | rtm.rtm_type = RTM_GET; | |
3752 | rtm.rtm_flags = RTF_UP; | |
3753 | rtm.rtm_version = RTM_VERSION; | |
3754 | rtm.rtm_seq = ++seq; | |
3dd30bfe SM |
3755 | #ifdef TARGET_OPENBSD |
3756 | rtm.rtm_tableid = getrtable(); | |
3757 | #endif | |
2ff366f7 GD |
3758 | |
3759 | so_dst.sin6_family = AF_INET6; | |
3760 | so_mask.sin6_family = AF_INET6; | |
3761 | ||
81d882d5 DS |
3762 | if (dest != NULL /* specific host? */ |
3763 | && !IN6_IS_ADDR_UNSPECIFIED(dest) ) | |
2ff366f7 | 3764 | { |
81d882d5 DS |
3765 | so_dst.sin6_addr = *dest; |
3766 | /* :: needs /0 "netmask", host route wants "no netmask */ | |
3767 | rtm_addrs &= ~RTA_NETMASK; | |
2ff366f7 GD |
3768 | } |
3769 | ||
3770 | rtm.rtm_addrs = rtm_addrs; | |
3771 | ||
3772 | #ifndef TARGET_SOLARIS | |
3773 | so_dst.sin6_len = sizeof(struct sockaddr_in6); | |
3774 | so_mask.sin6_len = sizeof(struct sockaddr_in6); | |
3775 | #endif | |
3776 | ||
3777 | NEXTADDR(RTA_DST, so_dst); | |
3778 | NEXTADDR(RTA_NETMASK, so_mask); | |
3779 | ||
3780 | rtm.rtm_msglen = l = cp - (char *)&m_rtmsg; | |
3781 | ||
3782 | /* transact with routing socket */ | |
3783 | sockfd = socket(PF_ROUTE, SOCK_RAW, 0); | |
3784 | if (sockfd < 0) | |
3785 | { | |
81d882d5 DS |
3786 | msg(M_WARN, "GDG6: socket #1 failed"); |
3787 | goto done; | |
2ff366f7 GD |
3788 | } |
3789 | if (write(sockfd, (char *)&m_rtmsg, l) < 0) | |
3790 | { | |
37aab49b | 3791 | msg(M_WARN|M_ERRNO, "GDG6: problem writing to routing socket"); |
81d882d5 | 3792 | goto done; |
2ff366f7 GD |
3793 | } |
3794 | ||
3795 | do | |
3796 | { | |
81d882d5 | 3797 | l = read(sockfd, (char *)&m_rtmsg, sizeof(m_rtmsg)); |
2ff366f7 GD |
3798 | } |
3799 | while (l > 0 && (rtm.rtm_seq != seq || rtm.rtm_pid != pid)); | |
3800 | ||
3801 | close(sockfd); | |
3802 | sockfd = -1; | |
3803 | ||
3804 | /* extract return data from routing socket */ | |
3805 | rtm_aux = &rtm; | |
3806 | cp = ((char *)(rtm_aux + 1)); | |
3807 | if (rtm_aux->rtm_addrs) | |
3808 | { | |
81d882d5 DS |
3809 | for (i = 1; i; i <<= 1) |
3810 | { | |
3811 | if (i & rtm_aux->rtm_addrs) | |
3812 | { | |
3813 | sa = (struct sockaddr *)cp; | |
3814 | if (i == RTA_GATEWAY) | |
3815 | { | |
3816 | gate = sa; | |
3817 | } | |
3818 | else if (i == RTA_IFP) | |
3819 | { | |
3820 | ifp = sa; | |
3821 | } | |
3822 | ADVANCE(cp, sa); | |
3823 | } | |
3824 | } | |
2ff366f7 GD |
3825 | } |
3826 | else | |
81d882d5 DS |
3827 | { |
3828 | goto done; | |
3829 | } | |
2ff366f7 GD |
3830 | |
3831 | /* get gateway addr and interface name */ | |
81d882d5 | 3832 | if (gate != NULL) |
2ff366f7 | 3833 | { |
81d882d5 DS |
3834 | struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)gate; |
3835 | struct in6_addr gw = s6->sin6_addr; | |
2ff366f7 GD |
3836 | |
3837 | #ifndef TARGET_SOLARIS | |
81d882d5 DS |
3838 | /* You do not really want to know... from FreeBSD's route.c |
3839 | * (KAME encodes the 16 bit scope_id in s6_addr[2] + [3], | |
3840 | * but for a correct link-local address these must be :0000: ) | |
3841 | */ | |
3842 | if (gate->sa_len == sizeof(struct sockaddr_in6) | |
3843 | && IN6_IS_ADDR_LINKLOCAL(&gw) ) | |
3844 | { | |
3845 | gw.s6_addr[2] = gw.s6_addr[3] = 0; | |
3846 | } | |
3847 | ||
3848 | if (gate->sa_len != sizeof(struct sockaddr_in6) | |
3849 | || IN6_IS_ADDR_UNSPECIFIED(&gw) ) | |
3850 | { | |
3851 | rgi6->flags |= RGI_ON_LINK; | |
3852 | } | |
3853 | else | |
2ff366f7 GD |
3854 | #endif |
3855 | ||
81d882d5 DS |
3856 | rgi6->gateway.addr_ipv6 = gw; |
3857 | rgi6->flags |= RGI_ADDR_DEFINED; | |
2ff366f7 | 3858 | |
81d882d5 DS |
3859 | if (ifp) |
3860 | { | |
3861 | /* get interface name */ | |
3862 | const struct sockaddr_dl *adl = (struct sockaddr_dl *) ifp; | |
3863 | if (adl->sdl_nlen && adl->sdl_nlen < sizeof(rgi6->iface)) | |
3864 | { | |
3865 | memcpy(rgi6->iface, adl->sdl_data, adl->sdl_nlen); | |
3866 | rgi6->flags |= RGI_IFACE_DEFINED; | |
3867 | } | |
3868 | } | |
2ff366f7 GD |
3869 | } |
3870 | ||
81d882d5 | 3871 | done: |
2ff366f7 | 3872 | if (sockfd >= 0) |
81d882d5 DS |
3873 | { |
3874 | close(sockfd); | |
3875 | } | |
d8a8656f GD |
3876 | } |
3877 | ||
7fb0e07e JY |
3878 | #undef max |
3879 | ||
81d882d5 | 3880 | #else /* if defined(_WIN32) */ |
6fbf66fa | 3881 | |
7fb0e07e JY |
3882 | /* |
3883 | * This is a platform-specific method that returns data about | |
3884 | * the current default gateway. Return data is placed into | |
3885 | * a struct route_gateway_info object provided by caller. The | |
3886 | * implementation should CLEAR the structure before adding | |
3887 | * data to it. | |
3888 | * | |
3889 | * Data returned includes: | |
3890 | * 1. default gateway address (rgi->gateway.addr) | |
3891 | * 2. netmask of interface that owns default gateway | |
3892 | * (rgi->gateway.netmask) | |
3893 | * 3. hardware address (i.e. MAC address) of interface that owns | |
3894 | * default gateway (rgi->hwaddr) | |
3895 | * 4. interface name (or adapter index on Windows) that owns default | |
3896 | * gateway (rgi->iface or rgi->adapter_index) | |
3897 | * 5. an array of additional address/netmask pairs defined by | |
3898 | * interface that owns default gateway (rgi->addrs with length | |
3899 | * given in rgi->n_addrs) | |
3900 | * | |
3901 | * The flags RGI_x_DEFINED may be used to indicate which of the data | |
3902 | * members were successfully returned (set in rgi->flags). All of | |
3903 | * the data members are optional, however certain OpenVPN functionality | |
3904 | * may be disabled by missing items. | |
3905 | */ | |
3906 | void | |
aec4a3d1 | 3907 | get_default_gateway(struct route_gateway_info *rgi, openvpn_net_ctx_t *ctx) |
6fbf66fa | 3908 | { |
81d882d5 | 3909 | CLEAR(*rgi); |
6fbf66fa | 3910 | } |
d8a8656f GD |
3911 | void |
3912 | get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, | |
c454b21e | 3913 | const struct in6_addr *dest, openvpn_net_ctx_t *ctx) |
d8a8656f GD |
3914 | { |
3915 | msg(D_ROUTE, "no support for get_default_gateway_ipv6() on this system"); | |
3916 | CLEAR(*rgi6); | |
3917 | } | |
6fbf66fa | 3918 | |
81d882d5 | 3919 | #endif /* if defined(_WIN32) */ |
6fbf66fa JY |
3920 | |
3921 | bool | |
81d882d5 | 3922 | netmask_to_netbits(const in_addr_t network, const in_addr_t netmask, int *netbits) |
6fbf66fa | 3923 | { |
81d882d5 DS |
3924 | int i; |
3925 | const int addrlen = sizeof(in_addr_t) * 8; | |
6fbf66fa | 3926 | |
81d882d5 | 3927 | if ((network & netmask) == network) |
6fbf66fa | 3928 | { |
81d882d5 DS |
3929 | for (i = 0; i <= addrlen; ++i) |
3930 | { | |
3931 | in_addr_t mask = netbits_to_netmask(i); | |
3932 | if (mask == netmask) | |
3933 | { | |
3934 | if (i == addrlen) | |
3935 | { | |
3936 | *netbits = -1; | |
3937 | } | |
3938 | else | |
3939 | { | |
3940 | *netbits = i; | |
3941 | } | |
3942 | return true; | |
3943 | } | |
3944 | } | |
6fbf66fa | 3945 | } |
81d882d5 | 3946 | return false; |
6fbf66fa | 3947 | } |
3c7f2f55 | 3948 | |
b4b92ae5 GD |
3949 | /* similar to netmask_to_netbits(), but don't mess with base address |
3950 | * etc., just convert to netbits - non-mappable masks are returned as "-1" | |
3951 | */ | |
81d882d5 DS |
3952 | int |
3953 | netmask_to_netbits2(in_addr_t netmask) | |
b4b92ae5 | 3954 | { |
81d882d5 DS |
3955 | int i; |
3956 | const int addrlen = sizeof(in_addr_t) * 8; | |
b4b92ae5 | 3957 | |
81d882d5 | 3958 | for (i = 0; i <= addrlen; ++i) |
b4b92ae5 | 3959 | { |
81d882d5 DS |
3960 | in_addr_t mask = netbits_to_netmask(i); |
3961 | if (mask == netmask) | |
3962 | { | |
3963 | return i; | |
3964 | } | |
b4b92ae5 | 3965 | } |
81d882d5 | 3966 | return -1; |
b4b92ae5 GD |
3967 | } |
3968 | ||
3969 | ||
3c7f2f55 JY |
3970 | /* |
3971 | * get_bypass_addresses() is used by the redirect-gateway bypass-x | |
3972 | * functions to build a route bypass to selected DHCP/DNS servers, | |
3973 | * so that outgoing packets to these servers don't end up in the tunnel. | |
3974 | */ | |
3975 | ||
445b192a | 3976 | #if defined(_WIN32) |
3c7f2f55 JY |
3977 | |
3978 | static void | |
81d882d5 | 3979 | add_host_route_if_nonlocal(struct route_bypass *rb, const in_addr_t addr) |
3c7f2f55 | 3980 | { |
81d882d5 DS |
3981 | if (test_local_addr(addr, NULL) == TLA_NONLOCAL && addr != 0 && addr != IPV4_NETMASK_HOST) |
3982 | { | |
3983 | add_bypass_address(rb, addr); | |
3984 | } | |
3c7f2f55 JY |
3985 | } |
3986 | ||
3987 | static void | |
81d882d5 | 3988 | add_host_route_array(struct route_bypass *rb, const IP_ADDR_STRING *iplist) |
3c7f2f55 | 3989 | { |
81d882d5 | 3990 | while (iplist) |
3c7f2f55 | 3991 | { |
81d882d5 DS |
3992 | bool succeed = false; |
3993 | const in_addr_t ip = getaddr(GETADDR_HOST_ORDER, iplist->IpAddress.String, 0, &succeed, NULL); | |
3994 | if (succeed) | |
3995 | { | |
3996 | add_host_route_if_nonlocal(rb, ip); | |
3997 | } | |
3998 | iplist = iplist->Next; | |
3c7f2f55 JY |
3999 | } |
4000 | } | |
4001 | ||
4002 | static void | |
81d882d5 | 4003 | get_bypass_addresses(struct route_bypass *rb, const unsigned int flags) |
3c7f2f55 | 4004 | { |
81d882d5 DS |
4005 | struct gc_arena gc = gc_new(); |
4006 | /*bool ret_bool = false;*/ | |
3c7f2f55 | 4007 | |
81d882d5 DS |
4008 | /* get full routing table */ |
4009 | const MIB_IPFORWARDTABLE *routes = get_windows_routing_table(&gc); | |
3c7f2f55 | 4010 | |
81d882d5 DS |
4011 | /* get the route which represents the default gateway */ |
4012 | const MIB_IPFORWARDROW *row = get_default_gateway_row(routes); | |
3c7f2f55 | 4013 | |
81d882d5 | 4014 | if (row) |
3c7f2f55 | 4015 | { |
81d882d5 DS |
4016 | /* get the adapter which the default gateway is associated with */ |
4017 | const IP_ADAPTER_INFO *dgi = get_adapter_info(row->dwForwardIfIndex, &gc); | |
3c7f2f55 | 4018 | |
81d882d5 DS |
4019 | /* get extra adapter info, such as DNS addresses */ |
4020 | const IP_PER_ADAPTER_INFO *pai = get_per_adapter_info(row->dwForwardIfIndex, &gc); | |
3c7f2f55 | 4021 | |
81d882d5 DS |
4022 | /* Bypass DHCP server address */ |
4023 | if ((flags & RG_BYPASS_DHCP) && dgi && dgi->DhcpEnabled) | |
4024 | { | |
4025 | add_host_route_array(rb, &dgi->DhcpServer); | |
4026 | } | |
3c7f2f55 | 4027 | |
81d882d5 DS |
4028 | /* Bypass DNS server addresses */ |
4029 | if ((flags & RG_BYPASS_DNS) && pai) | |
4030 | { | |
4031 | add_host_route_array(rb, &pai->DnsServerList); | |
4032 | } | |
3c7f2f55 JY |
4033 | } |
4034 | ||
81d882d5 | 4035 | gc_free(&gc); |
3c7f2f55 JY |
4036 | } |
4037 | ||
81d882d5 | 4038 | #else /* if defined(_WIN32) */ |
3c7f2f55 JY |
4039 | |
4040 | static void | |
81d882d5 | 4041 | get_bypass_addresses(struct route_bypass *rb, const unsigned int flags) /* PLATFORM-SPECIFIC */ |
3c7f2f55 JY |
4042 | { |
4043 | } | |
4044 | ||
81d882d5 | 4045 | #endif /* if defined(_WIN32) */ |
5f31881e | 4046 | |
775a6ac2 JY |
4047 | /* |
4048 | * Test if addr is reachable via a local interface (return ILA_LOCAL), | |
4049 | * or if it needs to be routed via the default gateway (return | |
4050 | * ILA_NONLOCAL). If the target platform doesn't implement this | |
4051 | * function, return ILA_NOT_IMPLEMENTED. | |
4052 | * | |
4053 | * Used by redirect-gateway autolocal feature | |
4054 | */ | |
4055 | ||
445b192a | 4056 | #if defined(_WIN32) |
775a6ac2 JY |
4057 | |
4058 | int | |
81d882d5 | 4059 | test_local_addr(const in_addr_t addr, const struct route_gateway_info *rgi) |
775a6ac2 | 4060 | { |
81d882d5 DS |
4061 | struct gc_arena gc = gc_new(); |
4062 | const in_addr_t nonlocal_netmask = 0x80000000L; /* routes with netmask <= to this are considered non-local */ | |
4063 | int ret = TLA_NONLOCAL; | |
775a6ac2 | 4064 | |
81d882d5 DS |
4065 | /* get full routing table */ |
4066 | const MIB_IPFORWARDTABLE *rt = get_windows_routing_table(&gc); | |
4067 | if (rt) | |
775a6ac2 | 4068 | { |
467b16dc | 4069 | for (DWORD i = 0; i < rt->dwNumEntries; ++i) |
81d882d5 DS |
4070 | { |
4071 | const MIB_IPFORWARDROW *row = &rt->table[i]; | |
4072 | const in_addr_t net = ntohl(row->dwForwardDest); | |
4073 | const in_addr_t mask = ntohl(row->dwForwardMask); | |
4074 | if (mask > nonlocal_netmask && (addr & mask) == net) | |
4075 | { | |
4076 | ret = TLA_LOCAL; | |
4077 | break; | |
4078 | } | |
4079 | } | |
775a6ac2 JY |
4080 | } |
4081 | ||
81d882d5 DS |
4082 | gc_free(&gc); |
4083 | return ret; | |
775a6ac2 JY |
4084 | } |
4085 | ||
81d882d5 | 4086 | #else /* if defined(_WIN32) */ |
775a6ac2 | 4087 | |
775a6ac2 | 4088 | int |
81d882d5 | 4089 | test_local_addr(const in_addr_t addr, const struct route_gateway_info *rgi) /* PLATFORM-SPECIFIC */ |
775a6ac2 | 4090 | { |
81d882d5 | 4091 | if (rgi) |
7fb0e07e | 4092 | { |
81d882d5 DS |
4093 | if (local_route(addr, 0xFFFFFFFF, rgi->gateway.addr, rgi)) |
4094 | { | |
4095 | return TLA_LOCAL; | |
4096 | } | |
4097 | else | |
4098 | { | |
4099 | return TLA_NONLOCAL; | |
4100 | } | |
7fb0e07e | 4101 | } |
81d882d5 | 4102 | return TLA_NOT_IMPLEMENTED; |
775a6ac2 JY |
4103 | } |
4104 | ||
81d882d5 | 4105 | #endif /* if defined(_WIN32) */ |