1 /*
2 * Copyright (C) 2011 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <stdio.h>
18 #include <stdlib.h>
19 #include <string.h>
20 #include <errno.h>
21
22 #include <arpa/inet.h>
23 #include <netinet/in.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 #include <sys/socket.h>
27 #include <sys/ioctl.h>
28 #include <linux/if.h>
29 #include <linux/route.h>
30
31 #define LOG_TAG "ip-up-vpn"
32 #include <cutils/log.h>
33
34 #define DIR "/data/misc/vpn/"
35
env(const char * name)36 static const char *env(const char *name) {
37 const char *value = getenv(name);
38 return value ? value : "";
39 }
40
set_address(struct sockaddr * sa,const char * address)41 static int set_address(struct sockaddr *sa, const char *address) {
42 sa->sa_family = AF_INET;
43 errno = EINVAL;
44 return inet_pton(AF_INET, address, &((struct sockaddr_in *)sa)->sin_addr);
45 }
46
47 /*
48 * The primary goal is to create a file with VPN parameters. Currently they
49 * are interface, addresses, routes, DNS servers, and search domains. Each
50 * parameter occupies one line in the file, and it can be an empty string or
51 * space-separated values. The order and the format must be consistent with
52 * com.android.server.connectivity.Vpn. Here is an example.
53 *
54 * ppp0
55 * 192.168.1.100/24
56 * 0.0.0.0/0
57 * 192.168.1.1 192.168.1.2
58 * example.org
59 *
60 * The secondary goal is to unify the outcome of VPN. The current baseline
61 * is to have an interface configured with the given address and netmask
62 * and maybe add a host route to protect the tunnel. PPP-based VPN already
63 * does this, but others might not. Routes, DNS servers, and search domains
64 * are handled by the framework since they can be overridden by the users.
65 */
main(int argc,char ** argv)66 int main(int argc, char **argv)
67 {
68 FILE *state = fopen(DIR ".tmp", "wb");
69 if (!state) {
70 ALOGE("Cannot create state: %s", strerror(errno));
71 return 1;
72 }
73
74 if (argc >= 6) {
75 /* Invoked by pppd. */
76 fprintf(state, "%s\n", argv[1]);
77 fprintf(state, "%s/32\n", argv[4]);
78 fprintf(state, "0.0.0.0/0\n");
79 fprintf(state, "%s %s\n", env("DNS1"), env("DNS2"));
80 fprintf(state, "\n");
81 } else if (argc == 2) {
82 /* Invoked by racoon. */
83 const char *interface = env("INTERFACE");
84 const char *address = env("INTERNAL_ADDR4");
85 const char *routes = env("SPLIT_INCLUDE_CIDR");
86
87 int s = socket(AF_INET, SOCK_DGRAM, 0);
88 struct rtentry rt;
89 struct ifreq ifr;
90
91 memset(&rt, 0, sizeof(rt));
92 memset(&ifr, 0, sizeof(ifr));
93
94 /* Remove the old host route. There could be more than one. */
95 rt.rt_flags |= RTF_UP | RTF_HOST;
96 if (set_address(&rt.rt_dst, env("REMOTE_ADDR"))) {
97 while (!ioctl(s, SIOCDELRT, &rt));
98 }
99 if (errno != ESRCH) {
100 ALOGE("Cannot remove host route: %s", strerror(errno));
101 return 1;
102 }
103
104 /* Create a new host route. */
105 rt.rt_flags |= RTF_GATEWAY;
106 if (!set_address(&rt.rt_gateway, argv[1]) ||
107 (ioctl(s, SIOCADDRT, &rt) && errno != EEXIST)) {
108 ALOGE("Cannot create host route: %s", strerror(errno));
109 return 1;
110 }
111
112 /* Bring up the interface. */
113 ifr.ifr_flags = IFF_UP;
114 strncpy(ifr.ifr_name, interface, IFNAMSIZ);
115 if (ioctl(s, SIOCSIFFLAGS, &ifr)) {
116 ALOGE("Cannot bring up %s: %s", interface, strerror(errno));
117 return 1;
118 }
119
120 /* Set the address. */
121 if (!set_address(&ifr.ifr_addr, address) ||
122 ioctl(s, SIOCSIFADDR, &ifr)) {
123 ALOGE("Cannot set address: %s", strerror(errno));
124 return 1;
125 }
126
127 /* Set the netmask. */
128 if (set_address(&ifr.ifr_netmask, env("INTERNAL_NETMASK4"))) {
129 if (ioctl(s, SIOCSIFNETMASK, &ifr)) {
130 ALOGE("Cannot set netmask: %s", strerror(errno));
131 return 1;
132 }
133 }
134
135 /* TODO: Send few packets to trigger phase 2? */
136
137 fprintf(state, "%s\n", interface);
138 fprintf(state, "%s/%s\n", address, env("INTERNAL_CIDR4"));
139 fprintf(state, "%s\n", routes[0] ? routes : "0.0.0.0/0");
140 fprintf(state, "%s\n", env("INTERNAL_DNS4_LIST"));
141 fprintf(state, "%s\n", env("DEFAULT_DOMAIN"));
142 } else {
143 ALOGE("Cannot parse parameters");
144 return 1;
145 }
146
147 fclose(state);
148 if (chmod(DIR ".tmp", 0444) || rename(DIR ".tmp", DIR "state")) {
149 ALOGE("Cannot write state: %s", strerror(errno));
150 return 1;
151 }
152 return 0;
153 }
154