mirror of
https://github.com/KusakabeShi/EtherGuard-VPN.git
synced 2024-11-22 15:23:08 +01:00
431 lines
9.4 KiB
Go
431 lines
9.4 KiB
Go
/* SPDX-License-Identifier: MIT
|
|
*
|
|
* Copyright (C) 2017-2021 WireGuard LLC. All Rights Reserved.
|
|
*/
|
|
|
|
package tun
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net"
|
|
"os"
|
|
"sync"
|
|
"syscall"
|
|
"unsafe"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
const (
|
|
_TUNSIFHEAD = 0x80047460
|
|
_TUNSIFMODE = 0x8004745e
|
|
_TUNGIFNAME = 0x4020745d
|
|
_TUNSIFPID = 0x2000745f
|
|
|
|
_SIOCGIFINFO_IN6 = 0xc048696c
|
|
_SIOCSIFINFO_IN6 = 0xc048696d
|
|
_ND6_IFF_AUTO_LINKLOCAL = 0x20
|
|
_ND6_IFF_NO_DAD = 0x100
|
|
)
|
|
|
|
// Iface requests with just the name
|
|
type ifreqName struct {
|
|
Name [unix.IFNAMSIZ]byte
|
|
_ [16]byte
|
|
}
|
|
|
|
// Iface requests with a pointer
|
|
type ifreqPtr struct {
|
|
Name [unix.IFNAMSIZ]byte
|
|
Data uintptr
|
|
_ [16 - unsafe.Sizeof(uintptr(0))]byte
|
|
}
|
|
|
|
// Iface requests with MTU
|
|
type ifreqMtu struct {
|
|
Name [unix.IFNAMSIZ]byte
|
|
MTU uint32
|
|
_ [12]byte
|
|
}
|
|
|
|
// ND6 flag manipulation
|
|
type nd6Req struct {
|
|
Name [unix.IFNAMSIZ]byte
|
|
Linkmtu uint32
|
|
Maxmtu uint32
|
|
Basereachable uint32
|
|
Reachable uint32
|
|
Retrans uint32
|
|
Flags uint32
|
|
Recalctm int
|
|
Chlim uint8
|
|
Initialized uint8
|
|
Randomseed0 [8]byte
|
|
Randomseed1 [8]byte
|
|
Randomid [8]byte
|
|
}
|
|
|
|
type NativeTun struct {
|
|
name string
|
|
tunFile *os.File
|
|
events chan Event
|
|
errors chan error
|
|
routeSocket int
|
|
closeOnce sync.Once
|
|
}
|
|
|
|
func (tun *NativeTun) routineRouteListener(tunIfindex int) {
|
|
var (
|
|
statusUp bool
|
|
statusMTU int
|
|
)
|
|
|
|
defer close(tun.events)
|
|
|
|
data := make([]byte, os.Getpagesize())
|
|
for {
|
|
retry:
|
|
n, err := unix.Read(tun.routeSocket, data)
|
|
if err != nil {
|
|
if errors.Is(err, syscall.EINTR) {
|
|
goto retry
|
|
}
|
|
tun.errors <- err
|
|
return
|
|
}
|
|
|
|
if n < 14 {
|
|
continue
|
|
}
|
|
|
|
if data[3 /* type */] != unix.RTM_IFINFO {
|
|
continue
|
|
}
|
|
ifindex := int(*(*uint16)(unsafe.Pointer(&data[12 /* ifindex */])))
|
|
if ifindex != tunIfindex {
|
|
continue
|
|
}
|
|
|
|
iface, err := net.InterfaceByIndex(ifindex)
|
|
if err != nil {
|
|
tun.errors <- err
|
|
return
|
|
}
|
|
|
|
// Up / Down event
|
|
up := (iface.Flags & net.FlagUp) != 0
|
|
if up != statusUp && up {
|
|
tun.events <- EventUp
|
|
}
|
|
if up != statusUp && !up {
|
|
tun.events <- EventDown
|
|
}
|
|
statusUp = up
|
|
|
|
// MTU changes
|
|
if iface.MTU != statusMTU {
|
|
tun.events <- EventMTUUpdate
|
|
}
|
|
statusMTU = iface.MTU
|
|
}
|
|
}
|
|
|
|
func tunName(fd uintptr) (string, error) {
|
|
var ifreq ifreqName
|
|
_, _, err := unix.Syscall(unix.SYS_IOCTL, fd, _TUNGIFNAME, uintptr(unsafe.Pointer(&ifreq)))
|
|
if err != 0 {
|
|
return "", err
|
|
}
|
|
return unix.ByteSliceToString(ifreq.Name[:]), nil
|
|
}
|
|
|
|
// Destroy a named system interface
|
|
func tunDestroy(name string) error {
|
|
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer unix.Close(fd)
|
|
|
|
var ifr [32]byte
|
|
copy(ifr[:], name)
|
|
_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), uintptr(unix.SIOCIFDESTROY), uintptr(unsafe.Pointer(&ifr[0])))
|
|
if errno != 0 {
|
|
return fmt.Errorf("failed to destroy interface %s: %w", name, errno)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func CreateTUN(name string, mtu int) (Device, error) {
|
|
if len(name) > unix.IFNAMSIZ-1 {
|
|
return nil, errors.New("interface name too long")
|
|
}
|
|
|
|
// See if interface already exists
|
|
iface, _ := net.InterfaceByName(name)
|
|
if iface != nil {
|
|
return nil, fmt.Errorf("interface %s already exists", name)
|
|
}
|
|
|
|
tunFile, err := os.OpenFile("/dev/tun", unix.O_RDWR, 0)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
tun := NativeTun{tunFile: tunFile}
|
|
var assignedName string
|
|
tun.operateOnFd(func(fd uintptr) {
|
|
assignedName, err = tunName(fd)
|
|
})
|
|
if err != nil {
|
|
tunFile.Close()
|
|
return nil, err
|
|
}
|
|
|
|
// Enable ifhead mode, otherwise tun will complain if it gets a non-AF_INET packet
|
|
ifheadmode := 1
|
|
var errno syscall.Errno
|
|
tun.operateOnFd(func(fd uintptr) {
|
|
_, _, errno = unix.Syscall(unix.SYS_IOCTL, fd, _TUNSIFHEAD, uintptr(unsafe.Pointer(&ifheadmode)))
|
|
})
|
|
|
|
if errno != 0 {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, fmt.Errorf("unable to put into IFHEAD mode: %w", errno)
|
|
}
|
|
|
|
// Get out of PTP mode.
|
|
ifflags := syscall.IFF_BROADCAST | syscall.IFF_MULTICAST
|
|
tun.operateOnFd(func(fd uintptr) {
|
|
_, _, errno = unix.Syscall(unix.SYS_IOCTL, fd, uintptr(_TUNSIFMODE), uintptr(unsafe.Pointer(&ifflags)))
|
|
})
|
|
|
|
if errno != 0 {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, fmt.Errorf("unable to put into IFF_BROADCAST mode: %w", errno)
|
|
}
|
|
|
|
// Disable link-local v6, not just because WireGuard doesn't do that anyway, but
|
|
// also because there are serious races with attaching and detaching LLv6 addresses
|
|
// in relation to interface lifetime within the FreeBSD kernel.
|
|
confd6, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, 0)
|
|
if err != nil {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, err
|
|
}
|
|
defer unix.Close(confd6)
|
|
var ndireq nd6Req
|
|
copy(ndireq.Name[:], assignedName)
|
|
_, _, errno = unix.Syscall(unix.SYS_IOCTL, uintptr(confd6), uintptr(_SIOCGIFINFO_IN6), uintptr(unsafe.Pointer(&ndireq)))
|
|
if errno != 0 {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, fmt.Errorf("unable to get nd6 flags for %s: %w", assignedName, errno)
|
|
}
|
|
ndireq.Flags = ndireq.Flags &^ _ND6_IFF_AUTO_LINKLOCAL
|
|
ndireq.Flags = ndireq.Flags | _ND6_IFF_NO_DAD
|
|
_, _, errno = unix.Syscall(unix.SYS_IOCTL, uintptr(confd6), uintptr(_SIOCSIFINFO_IN6), uintptr(unsafe.Pointer(&ndireq)))
|
|
if errno != 0 {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, fmt.Errorf("unable to set nd6 flags for %s: %w", assignedName, errno)
|
|
}
|
|
|
|
if name != "" {
|
|
confd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
|
|
if err != nil {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, err
|
|
}
|
|
defer unix.Close(confd)
|
|
var newnp [unix.IFNAMSIZ]byte
|
|
copy(newnp[:], name)
|
|
var ifr ifreqPtr
|
|
copy(ifr.Name[:], assignedName)
|
|
ifr.Data = uintptr(unsafe.Pointer(&newnp[0]))
|
|
_, _, errno = unix.Syscall(unix.SYS_IOCTL, uintptr(confd), uintptr(unix.SIOCSIFNAME), uintptr(unsafe.Pointer(&ifr)))
|
|
if errno != 0 {
|
|
tunFile.Close()
|
|
tunDestroy(assignedName)
|
|
return nil, fmt.Errorf("Failed to rename %s to %s: %w", assignedName, name, errno)
|
|
}
|
|
}
|
|
|
|
return CreateTUNFromFile(tunFile, mtu)
|
|
}
|
|
|
|
func CreateTUNFromFile(file *os.File, mtu int) (Device, error) {
|
|
tun := &NativeTun{
|
|
tunFile: file,
|
|
events: make(chan Event, 10),
|
|
errors: make(chan error, 1),
|
|
}
|
|
|
|
var errno syscall.Errno
|
|
tun.operateOnFd(func(fd uintptr) {
|
|
_, _, errno = unix.Syscall(unix.SYS_IOCTL, fd, _TUNSIFPID, uintptr(0))
|
|
})
|
|
if errno != 0 {
|
|
tun.tunFile.Close()
|
|
return nil, fmt.Errorf("unable to become controlling TUN process: %w", errno)
|
|
}
|
|
|
|
name, err := tun.Name()
|
|
if err != nil {
|
|
tun.tunFile.Close()
|
|
return nil, err
|
|
}
|
|
|
|
tunIfindex, err := func() (int, error) {
|
|
iface, err := net.InterfaceByName(name)
|
|
if err != nil {
|
|
return -1, err
|
|
}
|
|
return iface.Index, nil
|
|
}()
|
|
if err != nil {
|
|
tun.tunFile.Close()
|
|
return nil, err
|
|
}
|
|
|
|
tun.routeSocket, err = unix.Socket(unix.AF_ROUTE, unix.SOCK_RAW, unix.AF_UNSPEC)
|
|
if err != nil {
|
|
tun.tunFile.Close()
|
|
return nil, err
|
|
}
|
|
|
|
go tun.routineRouteListener(tunIfindex)
|
|
|
|
err = tun.setMTU(mtu)
|
|
if err != nil {
|
|
tun.Close()
|
|
return nil, err
|
|
}
|
|
|
|
return tun, nil
|
|
}
|
|
|
|
func (tun *NativeTun) Name() (string, error) {
|
|
var name string
|
|
var err error
|
|
tun.operateOnFd(func(fd uintptr) {
|
|
name, err = tunName(fd)
|
|
})
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
tun.name = name
|
|
return name, nil
|
|
}
|
|
|
|
func (tun *NativeTun) File() *os.File {
|
|
return tun.tunFile
|
|
}
|
|
|
|
func (tun *NativeTun) Events() chan Event {
|
|
return tun.events
|
|
}
|
|
|
|
func (tun *NativeTun) Read(buff []byte, offset int) (int, error) {
|
|
select {
|
|
case err := <-tun.errors:
|
|
return 0, err
|
|
default:
|
|
buff := buff[offset-4:]
|
|
n, err := tun.tunFile.Read(buff[:])
|
|
if n < 4 {
|
|
return 0, err
|
|
}
|
|
return n - 4, err
|
|
}
|
|
}
|
|
|
|
func (tun *NativeTun) Write(buf []byte, offset int) (int, error) {
|
|
if offset < 4 {
|
|
return 0, io.ErrShortBuffer
|
|
}
|
|
buf = buf[offset-4:]
|
|
if len(buf) < 5 {
|
|
return 0, io.ErrShortBuffer
|
|
}
|
|
buf[0] = 0x00
|
|
buf[1] = 0x00
|
|
buf[2] = 0x00
|
|
switch buf[4] >> 4 {
|
|
case 4:
|
|
buf[3] = unix.AF_INET
|
|
case 6:
|
|
buf[3] = unix.AF_INET6
|
|
default:
|
|
return 0, unix.EAFNOSUPPORT
|
|
}
|
|
return tun.tunFile.Write(buf)
|
|
}
|
|
|
|
func (tun *NativeTun) Flush() error {
|
|
// TODO: can flushing be implemented by buffering and using sendmmsg?
|
|
return nil
|
|
}
|
|
|
|
func (tun *NativeTun) Close() error {
|
|
var err1, err2, err3 error
|
|
tun.closeOnce.Do(func() {
|
|
err1 = tun.tunFile.Close()
|
|
err2 = tunDestroy(tun.name)
|
|
if tun.routeSocket != -1 {
|
|
unix.Shutdown(tun.routeSocket, unix.SHUT_RDWR)
|
|
err3 = unix.Close(tun.routeSocket)
|
|
tun.routeSocket = -1
|
|
} else if tun.events != nil {
|
|
close(tun.events)
|
|
}
|
|
})
|
|
if err1 != nil {
|
|
return err1
|
|
}
|
|
if err2 != nil {
|
|
return err2
|
|
}
|
|
return err3
|
|
}
|
|
|
|
func (tun *NativeTun) setMTU(n int) error {
|
|
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer unix.Close(fd)
|
|
|
|
var ifr ifreqMtu
|
|
copy(ifr.Name[:], tun.name)
|
|
ifr.MTU = uint32(n)
|
|
_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), uintptr(unix.SIOCSIFMTU), uintptr(unsafe.Pointer(&ifr)))
|
|
if errno != 0 {
|
|
return fmt.Errorf("failed to set MTU on %s: %w", tun.name, errno)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (tun *NativeTun) MTU() (int, error) {
|
|
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
defer unix.Close(fd)
|
|
|
|
var ifr ifreqMtu
|
|
copy(ifr.Name[:], tun.name)
|
|
_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), uintptr(unix.SIOCGIFMTU), uintptr(unsafe.Pointer(&ifr)))
|
|
if errno != 0 {
|
|
return 0, fmt.Errorf("failed to get MTU on %s: %w", tun.name, errno)
|
|
}
|
|
return int(*(*int32)(unsafe.Pointer(&ifr.MTU))), nil
|
|
}
|