OpenVPN
route.c
Go to the documentation of this file.
1/*
2 * OpenVPN -- An application to securely tunnel IP networks
3 * over a single TCP/UDP port, with support for SSL/TLS-based
4 * session authentication and key exchange,
5 * packet encryption, packet authentication, and
6 * packet compression.
7 *
8 * Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2
12 * as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, see <https://www.gnu.org/licenses/>.
21 */
22
23/*
24 * Support routines for adding/deleting network routes.
25 */
26#include <stddef.h>
27#include <stdbool.h>
28
29#ifdef HAVE_CONFIG_H
30#include "config.h"
31#endif
32
33#include "syshead.h"
34
35#include "common.h"
36#include "error.h"
37#include "route.h"
38#include "run_command.h"
39#include "socket.h"
40#include "manage.h"
41#include "win32.h"
42#include "options.h"
43#include "networking.h"
44#include "integer.h"
45
46#include "memdbg.h"
47
48#if defined(TARGET_LINUX) || defined(TARGET_ANDROID)
49#include <linux/rtnetlink.h> /* RTM_GETROUTE etc. */
50#endif
51
52#if defined(TARGET_NETBSD)
53#include <net/route.h> /* RT_ROUNDUP(), RT_ADVANCE() */
54#endif
55
56#ifdef _WIN32
57#include "openvpn-msg.h"
58
59#define METRIC_NOT_USED ((DWORD)-1)
60static int add_route_service(const struct route_ipv4 *, const struct tuntap *);
61
62static bool del_route_service(const struct route_ipv4 *, const struct tuntap *);
63
64static int add_route_ipv6_service(const struct route_ipv6 *, const struct tuntap *);
65
66static bool del_route_ipv6_service(const struct route_ipv6 *, const struct tuntap *);
67
68static int route_ipv6_ipapi(bool add, const struct route_ipv6 *, const struct tuntap *);
69
70static int add_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt,
71 DWORD adapter_index);
72
73static bool del_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt);
74
75
76#endif
77
78static void delete_route(struct route_ipv4 *r, const struct tuntap *tt, unsigned int flags,
79 const struct route_gateway_info *rgi, const struct env_set *es,
81
82static void get_bypass_addresses(struct route_bypass *rb, const unsigned int flags);
83
84#ifdef ENABLE_DEBUG
85
86static void
87print_bypass_addresses(const struct route_bypass *rb)
88{
89 struct gc_arena gc = gc_new();
90 int i;
91 for (i = 0; i < rb->n_bypass; ++i)
92 {
93 msg(D_ROUTE, "ROUTE: bypass_host_route[%d]=%s", i, print_in_addr_t(rb->bypass[i], 0, &gc));
94 }
95 gc_free(&gc);
96}
97
98#endif
99
100/* Route addition return status codes */
101#define RTA_ERROR 0 /* route addition failed */
102#define RTA_SUCCESS 1 /* route addition succeeded */
103#define RTA_EEXIST 2 /* route not added as it already exists */
104
105static bool
106add_bypass_address(struct route_bypass *rb, const in_addr_t a)
107{
108 int i;
109 for (i = 0; i < rb->n_bypass; ++i)
110 {
111 if (a == rb->bypass[i]) /* avoid duplicates */
112 {
113 return true;
114 }
115 }
116 if (rb->n_bypass < N_ROUTE_BYPASS)
117 {
118 rb->bypass[rb->n_bypass++] = a;
119 return true;
120 }
121 else
122 {
123 return false;
124 }
125}
126
127struct route_option_list *
129{
130 struct route_option_list *ret;
132 ret->gc = a;
133 return ret;
134}
135
138{
139 struct route_ipv6_option_list *ret;
141 ret->gc = a;
142 return ret;
143}
144
145/*
146 * NOTE: structs are cloned/copied shallow by design.
147 * The routes list from src will stay intact since it is allocated using
148 * the options->gc. The cloned/copied lists will share this common tail
149 * to avoid copying the data around between pulls. Pulled routes use
150 * the c2->gc so they get freed immediately after a reconnect.
151 */
152struct route_option_list *
154{
155 struct route_option_list *ret;
156 ALLOC_OBJ_GC(ret, struct route_option_list, a);
157 *ret = *src;
158 return ret;
159}
160
163{
164 struct route_ipv6_option_list *ret;
165 ALLOC_OBJ_GC(ret, struct route_ipv6_option_list, a);
166 *ret = *src;
167 return ret;
168}
169
170void
172 struct gc_arena *a)
173{
174 *dest = *src;
175 dest->gc = a;
176}
177
178void
180 const struct route_ipv6_option_list *src, struct gc_arena *a)
181{
182 *dest = *src;
183 dest->gc = a;
184}
185
186static const char *
187route_string(const struct route_ipv4 *r, struct gc_arena *gc)
188{
189 struct buffer out = alloc_buf_gc(256, gc);
190 buf_printf(&out, "ROUTE network %s netmask %s gateway %s", print_in_addr_t(r->network, 0, gc),
191 print_in_addr_t(r->netmask, 0, gc), print_in_addr_t(r->gateway, 0, gc));
192 if (r->flags & RT_METRIC_DEFINED)
193 {
194 buf_printf(&out, " metric %d", r->metric);
195 }
196 return BSTR(&out);
197}
198
199static bool
201{
202 if (!parm)
203 {
204 return false;
205 }
206 if (!strcmp(parm, "default"))
207 {
208 return false;
209 }
210 return true;
211}
212
213static void
214setenv_route_addr(struct env_set *es, const char *key, const in_addr_t addr, int i)
215{
216 struct gc_arena gc = gc_new();
217 struct buffer name = alloc_buf_gc(256, &gc);
218 if (i >= 0)
219 {
220 buf_printf(&name, "route_%s_%d", key, i);
221 }
222 else
223 {
224 buf_printf(&name, "route_%s", key);
225 }
226 setenv_str(es, BSTR(&name), print_in_addr_t(addr, 0, &gc));
227 gc_free(&gc);
228}
229
230static bool
231get_special_addr(const struct route_list *rl, const char *string, in_addr_t *out, bool *status)
232{
233 if (status)
234 {
235 *status = true;
236 }
237 if (!strcmp(string, "vpn_gateway"))
238 {
239 if (rl)
240 {
241 if (rl->spec.flags & RTSA_REMOTE_ENDPOINT)
242 {
243 *out = rl->spec.remote_endpoint;
244 }
245 else
246 {
247 msg(M_INFO, PACKAGE_NAME " ROUTE: vpn_gateway undefined");
248 if (status)
249 {
250 *status = false;
251 }
252 }
253 }
254 return true;
255 }
256 else if (!strcmp(string, "net_gateway"))
257 {
258 if (rl)
259 {
260 if (rl->rgi.flags & RGI_ADDR_DEFINED)
261 {
262 *out = rl->rgi.gateway.addr;
263 }
264 else
265 {
267 " ROUTE: net_gateway undefined -- unable to get default gateway from system");
268 if (status)
269 {
270 *status = false;
271 }
272 }
273 }
274 return true;
275 }
276 else if (!strcmp(string, "remote_host"))
277 {
278 if (rl)
279 {
280 if (rl->spec.flags & RTSA_REMOTE_HOST)
281 {
282 *out = rl->spec.remote_host;
283 }
284 else
285 {
286 msg(M_INFO, PACKAGE_NAME " ROUTE: remote_host undefined");
287 if (status)
288 {
289 *status = false;
290 }
291 }
292 }
293 return true;
294 }
295 return false;
296}
297
298bool
300{
301 if (addr_str)
302 {
304 }
305 else
306 {
307 return false;
308 }
309}
310
311static bool
312init_route(struct route_ipv4 *r, struct addrinfo **network_list, const struct route_option *ro,
313 const struct route_list *rl)
314{
316 bool status;
317 int ret;
318 struct in_addr special = { 0 };
319
320 CLEAR(*r);
321 r->option = ro;
322
323 /* network */
325 {
326 goto fail;
327 }
328
329 /* get_special_addr replaces specialaddr with a special ip addr
330 * like gw. getaddrinfo is called to convert a a addrinfo struct */
331
332 if (get_special_addr(rl, ro->network, (in_addr_t *)&special.s_addr, &status))
333 {
334 if (!status)
335 {
336 goto fail;
337 }
338 special.s_addr = htonl(special.s_addr);
339 char buf[INET_ADDRSTRLEN];
340 inet_ntop(AF_INET, &special, buf, sizeof(buf));
341 ret = openvpn_getaddrinfo(0, buf, NULL, 0, NULL, AF_INET, network_list);
342 }
343 else
344 {
346 NULL, AF_INET, network_list);
347 }
348
349 status = (ret == 0);
350
351 if (!status)
352 {
353 goto fail;
354 }
355
356 /* netmask */
357
359 {
360 r->netmask =
362 if (!status)
363 {
364 goto fail;
365 }
366 }
367 else
368 {
369 r->netmask = default_netmask;
370 }
371
372 /* gateway */
373
375 {
376 if (!get_special_addr(rl, ro->gateway, &r->gateway, &status))
377 {
379 ro->gateway, 0, &status, NULL);
380 }
381 if (!status)
382 {
383 goto fail;
384 }
385 }
386 else
387 {
389 {
391 }
392 else
393 {
394 msg(M_WARN, PACKAGE_NAME
395 " ROUTE: " PACKAGE_NAME
396 " needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options");
397 goto fail;
398 }
399 }
400
401 /* metric */
402
403 r->metric = 0;
405 {
406 r->metric = atoi(ro->metric);
407 if (r->metric < 0)
408 {
409 msg(M_WARN, PACKAGE_NAME " ROUTE: route metric for network %s (%s) must be >= 0",
410 ro->network, ro->metric);
411 goto fail;
412 }
414 }
415 else if (rl->spec.flags & RTSA_DEFAULT_METRIC)
416 {
417 r->metric = rl->spec.default_metric;
419 }
420
421 r->flags |= RT_DEFINED;
422
423 /* routing table id */
424 r->table_id = ro->table_id;
425
426 return true;
427
428fail:
429 msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve route for host/network: %s",
430 ro->network);
431 return false;
432}
433
434static bool
436 const struct route_ipv6_list *rl6)
437{
438 CLEAR(*r6);
439
440 if (!get_ipv6_addr(r6o->prefix, &r6->network, &r6->netbits, M_WARN))
441 {
442 goto fail;
443 }
444
445 /* gateway */
447 {
448 if (inet_pton(AF_INET6, r6o->gateway, &r6->gateway) != 1)
449 {
450 msg(M_WARN, PACKAGE_NAME "ROUTE6: cannot parse gateway spec '%s'", r6o->gateway);
451 }
452 }
453 else if (rl6->spec_flags & RTSA_REMOTE_ENDPOINT)
454 {
455 r6->gateway = rl6->remote_endpoint_ipv6;
456 }
457
458 /* metric */
459
460 r6->metric = -1;
462 {
463 r6->metric = atoi(r6o->metric);
464 if (r6->metric < 0)
465 {
466 msg(M_WARN, PACKAGE_NAME " ROUTE: route metric for network %s (%s) must be >= 0",
467 r6o->prefix, r6o->metric);
468 goto fail;
469 }
470 r6->flags |= RT_METRIC_DEFINED;
471 }
472 else if (rl6->spec_flags & RTSA_DEFAULT_METRIC)
473 {
474 r6->metric = rl6->default_metric;
475 r6->flags |= RT_METRIC_DEFINED;
476 }
477
478 r6->flags |= RT_DEFINED;
479
480 /* routing table id */
481 r6->table_id = r6o->table_id;
482
483 return true;
484
485fail:
486 msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve route for host/network: %s",
487 r6o->prefix);
488 return false;
489}
490
491void
492add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask,
493 const char *gateway, const char *metric, int table_id)
494{
495 struct route_option *ro;
496 ALLOC_OBJ_GC(ro, struct route_option, l->gc);
497 ro->network = network;
498 ro->netmask = netmask;
499 ro->gateway = gateway;
500 ro->metric = metric;
501 ro->table_id = table_id;
502 ro->next = l->routes;
503 l->routes = ro;
504}
505
506void
508 const char *gateway, const char *metric, int table_id)
509{
510 struct route_ipv6_option *ro;
511 ALLOC_OBJ_GC(ro, struct route_ipv6_option, l->gc);
512 ro->prefix = prefix;
513 ro->gateway = gateway;
514 ro->metric = metric;
515 ro->table_id = table_id;
516 ro->next = l->routes_ipv6;
517 l->routes_ipv6 = ro;
518}
519
520static void
522{
523 gc_free(&rl->gc);
524 CLEAR(*rl);
525}
526
527static void
529{
530 gc_free(&rl6->gc);
531 CLEAR(*rl6);
532}
533
534void
535route_list_add_vpn_gateway(struct route_list *rl, struct env_set *es, const in_addr_t addr)
536{
537 ASSERT(rl);
538 rl->spec.remote_endpoint = addr;
540 setenv_route_addr(es, "vpn_gateway", rl->spec.remote_endpoint, -1);
541}
542
543static void
545 in_addr_t target)
546{
547 if (rl->rgi.gateway.netmask < 0xFFFFFFFF)
548 {
549 struct route_ipv4 *r1, *r2;
550 unsigned int l2;
551
552 ALLOC_OBJ_GC(r1, struct route_ipv4, &rl->gc);
553 ALLOC_OBJ_GC(r2, struct route_ipv4, &rl->gc);
554
555 /* split a route into two smaller blocking routes, and direct them to target */
556 l2 = ((~gateway->netmask) + 1) >> 1;
557 r1->flags = RT_DEFINED;
558 r1->gateway = target;
559 r1->network = gateway->addr & gateway->netmask;
560 r1->netmask = ~(l2 - 1);
561 r1->next = rl->routes;
562 rl->routes = r1;
563
564 *r2 = *r1;
565 r2->network += l2;
566 r2->next = rl->routes;
567 rl->routes = r2;
568 }
569}
570
571static void
573{
574#ifndef TARGET_ANDROID
575 /* add bypass for gateway addr */
577#endif
578
579 /* block access to local subnet */
581
582 /* process additional subnets on gateway interface */
583 for (size_t i = 0; i < rl->rgi.n_addrs; ++i)
584 {
585 const struct route_gateway_address *gwa = &rl->rgi.addrs[i];
586 /* omit the add/subnet in &rl->rgi which we processed above */
587 if (!((rl->rgi.gateway.addr & rl->rgi.gateway.netmask) == (gwa->addr & gwa->netmask)
588 && rl->rgi.gateway.netmask == gwa->netmask))
589 {
591 }
592 }
593}
594
595bool
597{
598 const int rgi_needed = (RGI_ADDR_DEFINED | RGI_NETMASK_DEFINED);
599 return (rl->flags & RG_BLOCK_LOCAL) && (rl->rgi.flags & rgi_needed) == rgi_needed
601}
602
603bool
604init_route_list(struct route_list *rl, const struct route_option_list *opt,
605 const char *remote_endpoint, int default_metric, in_addr_t remote_host,
606 struct env_set *es, openvpn_net_ctx_t *ctx)
607{
608 struct gc_arena gc = gc_new();
609 bool ret = true;
610
612
613 rl->flags = opt->flags;
614
615 if (remote_host != IPV4_INVALID_ADDR)
616 {
617 rl->spec.remote_host = remote_host;
619 }
620
621 if (default_metric)
622 {
623 rl->spec.default_metric = default_metric;
625 }
626
627 get_default_gateway(&rl->rgi, remote_host != IPV4_INVALID_ADDR ? remote_host : INADDR_ANY, ctx);
628 if (rl->rgi.flags & RGI_ADDR_DEFINED)
629 {
630 setenv_route_addr(es, "net_gateway", rl->rgi.gateway.addr, -1);
631#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
632 print_default_gateway(D_ROUTE, &rl->rgi, NULL);
633#endif
634 }
635 else
636 {
637 dmsg(D_ROUTE, "ROUTE: default_gateway=UNDEF");
638 }
639
640 if (rl->spec.flags & RTSA_REMOTE_HOST)
641 {
642 rl->spec.remote_host_local = test_local_addr(remote_host, &rl->rgi);
643 }
644
645 if (is_route_parm_defined(remote_endpoint))
646 {
647 bool defined = false;
650 0, &defined, NULL);
651
652 if (defined)
653 {
654 setenv_route_addr(es, "vpn_gateway", rl->spec.remote_endpoint, -1);
656 }
657 else
658 {
659 msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve default gateway: %s",
660 remote_endpoint);
661 ret = false;
662 }
663 }
664
665 if (rl->flags & RG_ENABLE)
666 {
667 if (block_local_needed(rl))
668 {
670 }
672#ifdef ENABLE_DEBUG
673 print_bypass_addresses(&rl->spec.bypass);
674#endif
675 }
676
677 /* parse the routes from opt to rl */
678 {
679 struct route_option *ro;
680 for (ro = opt->routes; ro; ro = ro->next)
681 {
682 struct addrinfo *netlist = NULL;
683 struct route_ipv4 r;
684
685 if (!init_route(&r, &netlist, ro, rl))
686 {
687 ret = false;
688 }
689 else
690 {
691 struct addrinfo *curele;
692 for (curele = netlist; curele; curele = curele->ai_next)
693 {
694 struct route_ipv4 *new;
695 ALLOC_OBJ_GC(new, struct route_ipv4, &rl->gc);
696 *new = r;
697 new->network = ntohl(((struct sockaddr_in *)curele->ai_addr)->sin_addr.s_addr);
698 new->next = rl->routes;
699 rl->routes = new;
700 }
701 }
702 if (netlist)
703 {
705 }
706 }
707 }
708
709 gc_free(&gc);
710 return ret;
711}
712
713/* check whether an IPv6 host address is covered by a given route_ipv6
714 * (not the most beautiful implementation in the world, but portable and
715 * "good enough")
716 */
717static bool
718route_ipv6_match_host(const struct route_ipv6 *r6, const struct in6_addr *host)
719{
720 unsigned int bits = r6->netbits;
721 int i;
722 unsigned int mask;
723
724 if (bits > 128)
725 {
726 return false;
727 }
728
729 for (i = 0; bits >= 8; i++, bits -= 8)
730 {
731 if (r6->network.s6_addr[i] != host->s6_addr[i])
732 {
733 return false;
734 }
735 }
736
737 if (bits == 0)
738 {
739 return true;
740 }
741
742 mask = 0xff << (8 - bits);
743
744 if ((r6->network.s6_addr[i] & mask) == (host->s6_addr[i] & mask))
745 {
746 return true;
747 }
748
749 return false;
750}
751
752bool
754 const char *remote_endpoint, int default_metric,
755 const struct in6_addr *remote_host_ipv6, struct env_set *es,
757{
758 struct gc_arena gc = gc_new();
759 bool ret = true;
760 bool need_remote_ipv6_route;
761
763
764 rl6->flags = opt6->flags;
765
766 if (remote_host_ipv6)
767 {
768 rl6->remote_host_ipv6 = *remote_host_ipv6;
770 }
771
772 if (default_metric >= 0)
773 {
774 rl6->default_metric = default_metric;
776 }
777
778 msg(D_ROUTE, "GDG6: remote_host_ipv6=%s",
779 remote_host_ipv6 ? print_in6_addr(*remote_host_ipv6, 0, &gc) : "n/a");
780
781 get_default_gateway_ipv6(&rl6->rgi6, remote_host_ipv6, ctx);
782 if (rl6->rgi6.flags & RGI_ADDR_DEFINED)
783 {
784 setenv_str(es, "net_gateway_ipv6", print_in6_addr(rl6->rgi6.gateway.addr_ipv6, 0, &gc));
785#if defined(ENABLE_DEBUG) && !defined(ENABLE_SMALL)
786 print_default_gateway(D_ROUTE, NULL, &rl6->rgi6);
787#endif
788 }
789 else
790 {
791 dmsg(D_ROUTE, "ROUTE6: default_gateway=UNDEF");
792 }
793
794 if (is_route_parm_defined(remote_endpoint))
795 {
796 if (inet_pton(AF_INET6, remote_endpoint, &rl6->remote_endpoint_ipv6) == 1)
797 {
799 }
800 else
801 {
802 msg(M_WARN, PACKAGE_NAME " ROUTE: failed to parse/resolve VPN endpoint: %s",
803 remote_endpoint);
804 ret = false;
805 }
806 }
807
808 /* parse the routes from opt6 to rl6
809 * discovering potential overlaps with remote_host_ipv6 in the process
810 */
811 need_remote_ipv6_route = false;
812
813 {
814 struct route_ipv6_option *ro6;
815 for (ro6 = opt6->routes_ipv6; ro6; ro6 = ro6->next)
816 {
817 struct route_ipv6 *r6;
818 ALLOC_OBJ_GC(r6, struct route_ipv6, &rl6->gc);
819 if (!init_route_ipv6(r6, ro6, rl6))
820 {
821 ret = false;
822 }
823 else
824 {
825 r6->next = rl6->routes_ipv6;
826 rl6->routes_ipv6 = r6;
827
828#ifndef TARGET_ANDROID
829 /* On Android the VPNService protect function call will take of
830 * avoiding routing loops, so ignore this part and let
831 * need_remote_ipv6_route always evaluate to false
832 */
833 if (remote_host_ipv6 && route_ipv6_match_host(r6, remote_host_ipv6))
834 {
835 need_remote_ipv6_route = true;
836 msg(D_ROUTE,
837 "ROUTE6: %s/%d overlaps IPv6 remote %s, adding host route to VPN endpoint",
838 print_in6_addr(r6->network, 0, &gc), r6->netbits,
839 print_in6_addr(*remote_host_ipv6, 0, &gc));
840 }
841#endif
842 }
843 }
844 }
845
846 /* add VPN server host route if needed */
847 if (need_remote_ipv6_route)
848 {
851 {
852 struct route_ipv6 *r6;
853 ALLOC_OBJ_CLEAR_GC(r6, struct route_ipv6, &rl6->gc);
854
855 r6->network = *remote_host_ipv6;
856 r6->netbits = 128;
857 if (!(rl6->rgi6.flags & RGI_ON_LINK))
858 {
859 r6->gateway = rl6->rgi6.gateway.addr_ipv6;
860 }
861 r6->metric = 1;
862#ifdef _WIN32
863 r6->adapter_index = rl6->rgi6.adapter_index;
864#else
865 r6->iface = rl6->rgi6.iface;
866#endif
868
869 r6->next = rl6->routes_ipv6;
870 rl6->routes_ipv6 = r6;
871 }
872 else
873 {
874 msg(M_WARN,
875 "ROUTE6: IPv6 route overlaps with IPv6 remote address, but could not determine IPv6 gateway address + interface, expect failure\n");
876 }
877 }
878
879 gc_free(&gc);
880 return ret;
881}
882
883static bool
884add_route3(in_addr_t network, in_addr_t netmask, in_addr_t gateway, const struct tuntap *tt,
885 unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es,
887{
888 struct route_ipv4 r;
889 CLEAR(r);
890 r.flags = RT_DEFINED;
891 r.network = network;
892 r.netmask = netmask;
893 r.gateway = gateway;
894 return add_route(&r, tt, flags, rgi, es, ctx);
895}
896
897static void
898del_route3(in_addr_t network, in_addr_t netmask, in_addr_t gateway, const struct tuntap *tt,
899 unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es,
901{
902 struct route_ipv4 r;
903 CLEAR(r);
905 r.network = network;
906 r.netmask = netmask;
907 r.gateway = gateway;
908 delete_route(&r, tt, flags, rgi, es, ctx);
909}
910
911static bool
912add_bypass_routes(struct route_bypass *rb, in_addr_t gateway, const struct tuntap *tt,
913 unsigned int flags, const struct route_gateway_info *rgi,
914 const struct env_set *es, openvpn_net_ctx_t *ctx)
915{
916 int ret = true;
917 for (int i = 0; i < rb->n_bypass; ++i)
918 {
919 if (rb->bypass[i])
920 {
922 rgi, es, ctx)
923 && ret;
924 }
925 }
926 return ret;
927}
928
929static void
930del_bypass_routes(struct route_bypass *rb, in_addr_t gateway, const struct tuntap *tt,
931 unsigned int flags, const struct route_gateway_info *rgi,
932 const struct env_set *es, openvpn_net_ctx_t *ctx)
933{
934 int i;
935 for (i = 0; i < rb->n_bypass; ++i)
936 {
937 if (rb->bypass[i])
938 {
940 ctx);
941 }
942 }
943}
944
945static bool
946redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, unsigned int flags,
947 const struct env_set *es, openvpn_net_ctx_t *ctx)
948{
949 const char err[] = "NOTE: unable to redirect IPv4 default gateway --";
950 bool ret = true;
951
952 if (rl && rl->flags & RG_ENABLE)
953 {
954 bool local = rl->flags & RG_LOCAL;
955
956 if (!(rl->spec.flags & RTSA_REMOTE_ENDPOINT) && (rl->flags & RG_REROUTE_GW))
957 {
958 msg(M_WARN, "%s VPN gateway parameter (--route-gateway or --ifconfig) is missing", err);
959 ret = false;
960 }
961 /*
962 * check if a default route is defined, unless:
963 * - we are connecting to a remote host in our network
964 * - we are connecting to a non-IPv4 remote host (i.e. we use IPv6)
965 */
966 else if (!(rl->rgi.flags & RGI_ADDR_DEFINED) && !local
967 && (rl->spec.flags & RTSA_REMOTE_HOST))
968 {
969 msg(M_WARN, "%s Cannot read current default gateway from system", err);
970 ret = false;
971 }
972 else
973 {
974#ifndef TARGET_ANDROID
975 if (rl->flags & RG_AUTO_LOCAL)
976 {
977 const int tla = rl->spec.remote_host_local;
978 if (tla == TLA_NONLOCAL)
979 {
980 dmsg(D_ROUTE, "ROUTE remote_host is NOT LOCAL");
981 local = false;
982 }
983 else if (tla == TLA_LOCAL)
984 {
985 dmsg(D_ROUTE, "ROUTE remote_host is LOCAL");
986 local = true;
987 }
988 }
989 if (!local)
990 {
991 /* route remote host to original default gateway */
992 /* if remote_host is not ipv4 (ie: ipv6), just skip
993 * adding this special /32 route */
994 if ((rl->spec.flags & RTSA_REMOTE_HOST)
996 {
998 tt, flags | ROUTE_REF_GW, &rl->rgi, es, ctx);
999 if (ret)
1000 {
1001 rl->iflags |= RL_DID_LOCAL;
1002 }
1003 }
1004 else
1005 {
1006 dmsg(D_ROUTE, "ROUTE remote_host protocol differs from tunneled");
1007 }
1008 }
1009#endif /* ifndef TARGET_ANDROID */
1010
1011 /* route DHCP/DNS server traffic through original default gateway */
1012 ret = add_bypass_routes(&rl->spec.bypass, rl->rgi.gateway.addr, tt, flags, &rl->rgi, es,
1013 ctx)
1014 && ret;
1015
1016 if (rl->flags & RG_REROUTE_GW)
1017 {
1018 if (rl->flags & RG_DEF1)
1019 {
1020 /* add new default route (1st component) */
1021 ret = add_route3(0x00000000, 0x80000000, rl->spec.remote_endpoint, tt, flags,
1022 &rl->rgi, es, ctx)
1023 && ret;
1024
1025 /* add new default route (2nd component) */
1026 ret = add_route3(0x80000000, 0x80000000, rl->spec.remote_endpoint, tt, flags,
1027 &rl->rgi, es, ctx)
1028 && ret;
1029 }
1030 else
1031 {
1032 /* don't try to remove the def route if it does not exist */
1033 if (rl->rgi.flags & RGI_ADDR_DEFINED)
1034 {
1035 /* delete default route */
1036 del_route3(0, 0, rl->rgi.gateway.addr, tt, flags | ROUTE_REF_GW, &rl->rgi,
1037 es, ctx);
1038 }
1039
1040 /* add new default route */
1041 ret = add_route3(0, 0, rl->spec.remote_endpoint, tt, flags, &rl->rgi, es, ctx)
1042 && ret;
1043 }
1044 }
1045
1046 /* set a flag so we can undo later */
1048 }
1049 }
1050 return ret;
1051}
1052
1053static void
1055 unsigned int flags, const struct env_set *es,
1056 openvpn_net_ctx_t *ctx)
1057{
1059 {
1060 /* delete remote host route */
1061 if (rl->iflags & RL_DID_LOCAL)
1062 {
1064 flags | ROUTE_REF_GW, &rl->rgi, es, ctx);
1065 rl->iflags &= ~RL_DID_LOCAL;
1066 }
1067
1068 /* delete special DHCP/DNS bypass route */
1069 del_bypass_routes(&rl->spec.bypass, rl->rgi.gateway.addr, tt, flags, &rl->rgi, es, ctx);
1070
1071 if (rl->flags & RG_REROUTE_GW)
1072 {
1073 if (rl->flags & RG_DEF1)
1074 {
1075 /* delete default route (1st component) */
1076 del_route3(0x00000000, 0x80000000, rl->spec.remote_endpoint, tt, flags, &rl->rgi,
1077 es, ctx);
1078
1079 /* delete default route (2nd component) */
1080 del_route3(0x80000000, 0x80000000, rl->spec.remote_endpoint, tt, flags, &rl->rgi,
1081 es, ctx);
1082 }
1083 else
1084 {
1085 /* delete default route */
1086 del_route3(0, 0, rl->spec.remote_endpoint, tt, flags, &rl->rgi, es, ctx);
1087 /* restore original default route if there was any */
1088 if (rl->rgi.flags & RGI_ADDR_DEFINED)
1089 {
1090 add_route3(0, 0, rl->rgi.gateway.addr, tt, flags | ROUTE_REF_GW, &rl->rgi, es,
1091 ctx);
1092 }
1093 }
1094 }
1095
1096 rl->iflags &= ~RL_DID_REDIRECT_DEFAULT_GATEWAY;
1097 }
1098}
1099
1100bool
1101add_routes(struct route_list *rl, struct route_ipv6_list *rl6, const struct tuntap *tt,
1102 unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
1103{
1104 bool ret = redirect_default_route_to_vpn(rl, tt, flags, es, ctx);
1105 if (rl && !(rl->iflags & RL_ROUTES_ADDED))
1106 {
1107 struct route_ipv4 *r;
1108
1109 if (rl->routes && !tt->did_ifconfig_setup)
1110 {
1111 msg(M_INFO,
1112 "WARNING: OpenVPN was configured to add an IPv4 "
1113 "route. However, no IPv4 has been configured for %s, "
1114 "therefore the route installation may fail or may not work "
1115 "as expected.",
1116 tt->actual_name);
1117 }
1118
1119#ifdef ENABLE_MANAGEMENT
1120 if (management && rl->routes)
1121 {
1123 NULL);
1124 }
1125#endif
1126
1127 for (r = rl->routes; r; r = r->next)
1128 {
1130 {
1131 delete_route(r, tt, flags, &rl->rgi, es, ctx);
1132 }
1133 ret = add_route(r, tt, flags, &rl->rgi, es, ctx) && ret;
1134 }
1135 rl->iflags |= RL_ROUTES_ADDED;
1136 }
1137 if (rl6 && !(rl6->iflags & RL_ROUTES_ADDED))
1138 {
1139 struct route_ipv6 *r;
1140
1141 if (!tt->did_ifconfig_ipv6_setup)
1142 {
1143 msg(M_INFO,
1144 "WARNING: OpenVPN was configured to add an IPv6 "
1145 "route. However, no IPv6 has been configured for %s, "
1146 "therefore the route installation may fail or may not work "
1147 "as expected.",
1148 tt->actual_name);
1149 }
1150
1151 for (r = rl6->routes_ipv6; r; r = r->next)
1152 {
1154 {
1155 delete_route_ipv6(r, tt, es, ctx);
1156 }
1157 ret = add_route_ipv6(r, tt, flags, es, ctx) && ret;
1158 }
1159 rl6->iflags |= RL_ROUTES_ADDED;
1160 }
1161
1162 return ret;
1163}
1164
1165void
1166delete_routes(struct route_list *rl, struct route_ipv6_list *rl6, const struct tuntap *tt,
1167 unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
1168{
1169 delete_routes_v4(rl, tt, flags, es, ctx);
1170 delete_routes_v6(rl6, tt, flags, es, ctx);
1171}
1172
1173void
1174delete_routes_v4(struct route_list *rl, const struct tuntap *tt, unsigned int flags,
1175 const struct env_set *es, openvpn_net_ctx_t *ctx)
1176{
1177 if (rl && (rl->iflags & RL_ROUTES_ADDED))
1178 {
1179 struct route_ipv4 *r;
1180 for (r = rl->routes; r; r = r->next)
1181 {
1182 delete_route(r, tt, flags, &rl->rgi, es, ctx);
1183 }
1184 rl->iflags &= ~RL_ROUTES_ADDED;
1185 }
1186
1188
1189 if (rl)
1190 {
1191 clear_route_list(rl);
1192 }
1193}
1194
1195void
1196delete_routes_v6(struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags,
1197 const struct env_set *es, openvpn_net_ctx_t *ctx)
1198{
1199 if (rl6 && (rl6->iflags & RL_ROUTES_ADDED))
1200 {
1201 struct route_ipv6 *r6;
1202 for (r6 = rl6->routes_ipv6; r6; r6 = r6->next)
1203 {
1204 delete_route_ipv6(r6, tt, es, ctx);
1205 }
1206 rl6->iflags &= ~RL_ROUTES_ADDED;
1207 }
1208
1209 if (rl6)
1210 {
1212 }
1213}
1214
1215#ifndef ENABLE_SMALL
1216
1217static const char *
1218show_opt(const char *option)
1219{
1220 if (!option)
1221 {
1222 return "default (not set)";
1223 }
1224 else
1225 {
1226 return option;
1227 }
1228}
1229
1230static void
1231print_route_option(const struct route_option *ro, int level)
1232{
1233 msg(level, " route %s/%s/%s/%s", show_opt(ro->network), show_opt(ro->netmask),
1234 show_opt(ro->gateway), show_opt(ro->metric));
1235}
1236
1237void
1238print_route_options(const struct route_option_list *rol, int level)
1239{
1240 struct route_option *ro;
1241 if (rol->flags & RG_ENABLE)
1242 {
1243 msg(level, " [redirect_default_gateway local=%d]", (rol->flags & RG_LOCAL) != 0);
1244 }
1245 for (ro = rol->routes; ro; ro = ro->next)
1246 {
1247 print_route_option(ro, level);
1248 }
1249}
1250
1251void
1252print_default_gateway(const int msglevel, const struct route_gateway_info *rgi,
1253 const struct route_ipv6_gateway_info *rgi6)
1254{
1255 struct gc_arena gc = gc_new();
1256 if (rgi && (rgi->flags & RGI_ADDR_DEFINED))
1257 {
1258 struct buffer out = alloc_buf_gc(256, &gc);
1259 buf_printf(&out, "ROUTE_GATEWAY");
1260 if (rgi->flags & RGI_ON_LINK)
1261 {
1262 buf_printf(&out, " ON_LINK");
1263 }
1264 else
1265 {
1266 buf_printf(&out, " %s", print_in_addr_t(rgi->gateway.addr, 0, &gc));
1267 }
1268 if (rgi->flags & RGI_NETMASK_DEFINED)
1269 {
1270 buf_printf(&out, "/%s", print_in_addr_t(rgi->gateway.netmask, 0, &gc));
1271 }
1272#ifdef _WIN32
1273 if (rgi->flags & RGI_IFACE_DEFINED)
1274 {
1275 buf_printf(&out, " I=%lu", rgi->adapter_index);
1276 }
1277#else
1278 if (rgi->flags & RGI_IFACE_DEFINED)
1279 {
1280 buf_printf(&out, " IFACE=%s", rgi->iface);
1281 }
1282#endif
1283 if (rgi->flags & RGI_HWADDR_DEFINED)
1284 {
1285 buf_printf(&out, " HWADDR=%s", format_hex_ex(rgi->hwaddr, 6, 0, 1, ":", &gc));
1286 }
1287 msg(msglevel, "%s", BSTR(&out));
1288 }
1289
1290 if (rgi6 && (rgi6->flags & RGI_ADDR_DEFINED))
1291 {
1292 struct buffer out = alloc_buf_gc(256, &gc);
1293 buf_printf(&out, "ROUTE6_GATEWAY");
1294 buf_printf(&out, " %s", print_in6_addr(rgi6->gateway.addr_ipv6, 0, &gc));
1295 if (rgi6->flags & RGI_ON_LINK)
1296 {
1297 buf_printf(&out, " ON_LINK");
1298 }
1299 if (rgi6->flags & RGI_NETMASK_DEFINED)
1300 {
1301 buf_printf(&out, "/%d", rgi6->gateway.netbits_ipv6);
1302 }
1303#ifdef _WIN32
1304 if (rgi6->flags & RGI_IFACE_DEFINED)
1305 {
1306 buf_printf(&out, " I=%lu", rgi6->adapter_index);
1307 }
1308#else
1309 if (rgi6->flags & RGI_IFACE_DEFINED)
1310 {
1311 buf_printf(&out, " IFACE=%s", rgi6->iface);
1312 }
1313#endif
1314 if (rgi6->flags & RGI_HWADDR_DEFINED)
1315 {
1316 buf_printf(&out, " HWADDR=%s", format_hex_ex(rgi6->hwaddr, 6, 0, 1, ":", &gc));
1317 }
1318 msg(msglevel, "%s", BSTR(&out));
1319 }
1320 gc_free(&gc);
1321}
1322
1323#endif /* ifndef ENABLE_SMALL */
1324
1325static void
1326print_route(const struct route_ipv4 *r, int level)
1327{
1328 struct gc_arena gc = gc_new();
1329 if (r->flags & RT_DEFINED)
1330 {
1331 msg(level, "%s", route_string(r, &gc));
1332 }
1333 gc_free(&gc);
1334}
1335
1336void
1337print_routes(const struct route_list *rl, int level)
1338{
1339 struct route_ipv4 *r;
1340 for (r = rl->routes; r; r = r->next)
1341 {
1342 print_route(r, level);
1343 }
1344}
1345
1346static void
1347setenv_route(struct env_set *es, const struct route_ipv4 *r, int i)
1348{
1349 struct gc_arena gc = gc_new();
1350 if (r->flags & RT_DEFINED)
1351 {
1352 setenv_route_addr(es, "network", r->network, i);
1353 setenv_route_addr(es, "netmask", r->netmask, i);
1354 setenv_route_addr(es, "gateway", r->gateway, i);
1355
1356 if (r->flags & RT_METRIC_DEFINED)
1357 {
1358 struct buffer name = alloc_buf_gc(256, &gc);
1359 buf_printf(&name, "route_metric_%d", i);
1360 setenv_int(es, BSTR(&name), r->metric);
1361 }
1362 }
1363 gc_free(&gc);
1364}
1365
1366void
1367setenv_routes(struct env_set *es, const struct route_list *rl)
1368{
1369 int i = 1;
1370 struct route_ipv4 *r;
1371 for (r = rl->routes; r; r = r->next)
1372 {
1373 setenv_route(es, r, i++);
1374 }
1375}
1376
1377static void
1378setenv_route_ipv6(struct env_set *es, const struct route_ipv6 *r6, int i)
1379{
1380 struct gc_arena gc = gc_new();
1381 if (r6->flags & RT_DEFINED)
1382 {
1383 struct buffer name1 = alloc_buf_gc(256, &gc);
1384 struct buffer val = alloc_buf_gc(256, &gc);
1385 struct buffer name2 = alloc_buf_gc(256, &gc);
1386
1387 buf_printf(&name1, "route_ipv6_network_%d", i);
1388 buf_printf(&val, "%s/%d", print_in6_addr(r6->network, 0, &gc), r6->netbits);
1389 setenv_str(es, BSTR(&name1), BSTR(&val));
1390
1391 buf_printf(&name2, "route_ipv6_gateway_%d", i);
1392 setenv_str(es, BSTR(&name2), print_in6_addr(r6->gateway, 0, &gc));
1393
1394 if (r6->flags & RT_METRIC_DEFINED)
1395 {
1396 struct buffer name3 = alloc_buf_gc(256, &gc);
1397 buf_printf(&name3, "route_ipv6_metric_%d", i);
1398 setenv_int(es, BSTR(&name3), r6->metric);
1399 }
1400 }
1401 gc_free(&gc);
1402}
1403void
1405{
1406 int i = 1;
1407 struct route_ipv6 *r6;
1408 for (r6 = rl6->routes_ipv6; r6; r6 = r6->next)
1409 {
1410 setenv_route_ipv6(es, r6, i++);
1411 }
1412}
1413
1414/*
1415 * local_route() determines whether the gateway of a provided host
1416 * route is on the same interface that owns the default gateway.
1417 * It uses the data structure
1418 * returned by get_default_gateway() (struct route_gateway_info)
1419 * to determine this. If the route is local, LR_MATCH is returned.
1420 * When adding routes into the kernel, if LR_MATCH is defined for
1421 * a given route, the route should explicitly reference the default
1422 * gateway interface as the route destination. For example, here
1423 * is an example on Linux that uses LR_MATCH:
1424 *
1425 * route add -net 10.10.0.1 netmask 255.255.255.255 dev eth0
1426 *
1427 * This capability is needed by the "default-gateway block-local"
1428 * directive, to allow client access to the local subnet to be
1429 * blocked but still allow access to the local default gateway.
1430 */
1431
1432/* local_route() return values */
1433#define LR_NOMATCH 0 /* route is not local */
1434#define LR_MATCH 1 /* route is local */
1435#define LR_ERROR 2 /* caller should abort adding route */
1436
1437static int
1438local_route(in_addr_t network, in_addr_t netmask, in_addr_t gateway,
1439 const struct route_gateway_info *rgi)
1440{
1441 /* set LR_MATCH on local host routes */
1442 const int rgi_needed = (RGI_ADDR_DEFINED | RGI_NETMASK_DEFINED | RGI_IFACE_DEFINED);
1443 if (rgi && (rgi->flags & rgi_needed) == rgi_needed && gateway == rgi->gateway.addr
1444 && netmask == 0xFFFFFFFF)
1445 {
1446 if (((network ^ rgi->gateway.addr) & rgi->gateway.netmask) == 0)
1447 {
1448 return LR_MATCH;
1449 }
1450 else
1451 {
1452 /* examine additional subnets on gateway interface */
1453 size_t i;
1454 for (i = 0; i < rgi->n_addrs; ++i)
1455 {
1456 const struct route_gateway_address *gwa = &rgi->addrs[i];
1457 if (((network ^ gwa->addr) & gwa->netmask) == 0)
1458 {
1459 return LR_MATCH;
1460 }
1461 }
1462 }
1463 }
1464 return LR_NOMATCH;
1465}
1466
1467/* Return true if the "on-link" form of the route should be used. This is when the gateway for
1468 * a route is specified as an interface rather than an address. */
1469#if defined(TARGET_LINUX) || defined(_WIN32) || defined(TARGET_DARWIN)
1470static inline bool
1471is_on_link(const int is_local_route, const unsigned int flags, const struct route_gateway_info *rgi)
1472{
1473 return rgi
1474 && (is_local_route == LR_MATCH
1475 || ((flags & ROUTE_REF_GW) && (rgi->flags & RGI_ON_LINK)));
1476}
1477#endif
1478
1479bool
1480add_route(struct route_ipv4 *r, const struct tuntap *tt, unsigned int flags,
1481 const struct route_gateway_info *rgi, /* may be NULL */
1482 const struct env_set *es, openvpn_net_ctx_t *ctx)
1483{
1484 int status = 0;
1485 int is_local_route;
1486
1487 if (!(r->flags & RT_DEFINED))
1488 {
1489 return true; /* no error */
1490 }
1491
1492 struct argv argv = argv_new();
1493 struct gc_arena gc = gc_new();
1494
1495#if !defined(TARGET_LINUX)
1496 const char *network = print_in_addr_t(r->network, 0, &gc);
1497#if !defined(TARGET_AIX)
1498 const char *netmask = print_in_addr_t(r->netmask, 0, &gc);
1499#endif
1500 const char *gateway = print_in_addr_t(r->gateway, 0, &gc);
1501#endif
1502
1503 is_local_route = local_route(r->network, r->netmask, r->gateway, rgi);
1504 if (is_local_route == LR_ERROR)
1505 {
1506 goto done;
1507 }
1508
1509#if defined(TARGET_LINUX)
1510 const char *iface = NULL;
1511 int metric = -1;
1512
1513 if (is_on_link(is_local_route, flags, rgi))
1514 {
1515 iface = rgi->iface;
1516 }
1517
1518 if (r->flags & RT_METRIC_DEFINED)
1519 {
1520 metric = r->metric;
1521 }
1522
1523
1525 int ret = net_route_v4_add(ctx, &r->network, netmask_to_netbits2(r->netmask), &r->gateway,
1526 iface, r->table_id, metric);
1527 if (ret == -EEXIST)
1528 {
1529 msg(D_ROUTE, "NOTE: Linux route add command failed because route exists");
1531 }
1532 else if (ret < 0)
1533 {
1534 msg(M_WARN, "ERROR: Linux route add command failed");
1535 status = RTA_ERROR;
1536 }
1537
1538#elif defined(TARGET_ANDROID)
1539 char out[128];
1540
1541 if (rgi)
1542 {
1543 snprintf(out, sizeof(out), "%s %s %s dev %s", network, netmask, gateway, rgi->iface);
1544 }
1545 else
1546 {
1547 snprintf(out, sizeof(out), "%s %s %s", network, netmask, gateway);
1548 }
1549 bool ret = management_android_control(management, "ROUTE", out);
1550 status = ret ? RTA_SUCCESS : RTA_ERROR;
1551
1552#elif defined(_WIN32)
1553 {
1554 DWORD ai = TUN_ADAPTER_INDEX_INVALID;
1555 argv_printf(&argv, "%s%s ADD %s MASK %s %s", get_win_sys_path(), WIN_ROUTE_PATH_SUFFIX,
1556 network, netmask, gateway);
1557 if (r->flags & RT_METRIC_DEFINED)
1558 {
1559 argv_printf_cat(&argv, "METRIC %d", r->metric);
1560 }
1561 if (is_on_link(is_local_route, flags, rgi))
1562 {
1563 ai = rgi->adapter_index;
1564 argv_printf_cat(&argv, "IF %lu", ai);
1565 }
1566
1568
1569 const char *method = "service";
1570 if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_SERVICE)
1571 {
1572 status = add_route_service(r, tt);
1573 }
1574 else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_IPAPI)
1575 {
1576 status = add_route_ipapi(r, tt, ai);
1577 method = "ipapi";
1578 }
1579 else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_EXE)
1580 {
1582 bool ret =
1583 openvpn_execve_check(&argv, es, 0, "ERROR: Windows route add command failed");
1584 status = ret ? RTA_SUCCESS : RTA_ERROR;
1586 method = "route.exe";
1587 }
1588 else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_ADAPTIVE)
1589 {
1590 status = add_route_ipapi(r, tt, ai);
1591 method = "ipapi [adaptive]";
1592 if (status == RTA_ERROR)
1593 {
1594 msg(D_ROUTE, "Route addition fallback to route.exe");
1596 bool ret = openvpn_execve_check(
1597 &argv, es, 0, "ERROR: Windows route add command failed [adaptive]");
1598 status = ret ? RTA_SUCCESS : RTA_ERROR;
1600 method = "route.exe";
1601 }
1602 }
1603 else
1604 {
1605 ASSERT(0);
1606 }
1607 if (status != RTA_ERROR) /* error is logged upstream */
1608 {
1609 msg(D_ROUTE, "Route addition via %s %s", method,
1610 (status == RTA_SUCCESS) ? "succeeded" : "failed because route exists");
1611 }
1612 }
1613
1614#elif defined(TARGET_SOLARIS)
1615
1616 /* example: route add 192.0.2.32 -netmask 255.255.255.224 somegateway */
1617
1618 argv_printf(&argv, "%s add", ROUTE_PATH);
1619
1620 argv_printf_cat(&argv, "%s -netmask %s %s", network, netmask, gateway);
1621
1622 /* Solaris can only distinguish between "metric 0" == "on-link on the
1623 * interface where the IP address given is configured" and "metric > 0"
1624 * == "use gateway specified" (no finer-grained route metrics available)
1625 *
1626 * More recent versions of Solaris can also do "-interface", but that
1627 * would break backwards compatibility with older versions for no gain.
1628 */
1629 if (r->flags & RT_METRIC_DEFINED)
1630 {
1631 argv_printf_cat(&argv, "%d", r->metric);
1632 }
1633
1635 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route add command failed");
1636 status = ret ? RTA_SUCCESS : RTA_ERROR;
1637
1638#elif defined(TARGET_FREEBSD)
1639
1640 argv_printf(&argv, "%s add", ROUTE_PATH);
1641
1642#if 0
1643 if (r->flags & RT_METRIC_DEFINED)
1644 {
1645 argv_printf_cat(&argv, "-rtt %d", r->metric);
1646 }
1647#endif
1648
1649 argv_printf_cat(&argv, "-net %s %s %s", network, gateway, netmask);
1650
1651 /* FIXME -- add on-link support for FreeBSD */
1652
1654 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: FreeBSD route add command failed");
1655 status = ret ? RTA_SUCCESS : RTA_ERROR;
1656
1657#elif defined(TARGET_DRAGONFLY)
1658
1659 argv_printf(&argv, "%s add", ROUTE_PATH);
1660
1661#if 0
1662 if (r->flags & RT_METRIC_DEFINED)
1663 {
1664 argv_printf_cat(&argv, "-rtt %d", r->metric);
1665 }
1666#endif
1667
1668 argv_printf_cat(&argv, "-net %s %s %s", network, gateway, netmask);
1669
1670 /* FIXME -- add on-link support for Dragonfly */
1671
1673 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: DragonFly route add command failed");
1674 status = ret ? RTA_SUCCESS : RTA_ERROR;
1675
1676#elif defined(TARGET_DARWIN)
1677
1678 argv_printf(&argv, "%s add", ROUTE_PATH);
1679
1680#if 0
1681 if (r->flags & RT_METRIC_DEFINED)
1682 {
1683 argv_printf_cat(&argv, "-rtt %d", r->metric);
1684 }
1685#endif
1686
1687 if (is_on_link(is_local_route, flags, rgi))
1688 {
1689 /* Mac OS X route syntax for ON_LINK:
1690 * route add -cloning -net 10.10.0.1 -netmask 255.255.255.255 -interface en0 */
1691 argv_printf_cat(&argv, "-cloning -net %s -netmask %s -interface %s", network, netmask,
1692 rgi->iface);
1693 }
1694 else
1695 {
1696 argv_printf_cat(&argv, "-net %s %s %s", network, gateway, netmask);
1697 }
1698
1700 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: OS X route add command failed");
1701 status = ret ? RTA_SUCCESS : RTA_ERROR;
1702
1703#elif defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
1704
1705 argv_printf(&argv, "%s add", ROUTE_PATH);
1706
1707#if 0
1708 if (r->flags & RT_METRIC_DEFINED)
1709 {
1710 argv_printf_cat(&argv, "-rtt %d", r->metric);
1711 }
1712#endif
1713
1714 argv_printf_cat(&argv, "-net %s %s -netmask %s", network, gateway, netmask);
1715
1716 /* FIXME -- add on-link support for OpenBSD/NetBSD */
1717
1719 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: OpenBSD/NetBSD route add command failed");
1720 status = ret ? RTA_SUCCESS : RTA_ERROR;
1721
1722#elif defined(TARGET_AIX)
1723
1724 {
1725 int netbits = netmask_to_netbits2(r->netmask);
1726 argv_printf(&argv, "%s add -net %s/%d %s", ROUTE_PATH, network, netbits, gateway);
1728 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: AIX route add command failed");
1729 status = ret ? RTA_SUCCESS : RTA_ERROR;
1730 }
1731
1732#elif defined(TARGET_HAIKU)
1733
1734 /* ex: route add /dev/net/ipro1000/0 0.0.0.0 gw 192.168.1.1 netmask 128.0.0.0 */
1735 argv_printf(&argv, "%s add %s inet %s gw %s netmask %s", ROUTE_PATH, rgi->iface, network,
1736 gateway, netmask);
1738 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: Haiku inet route add command failed");
1739 status = ret ? RTA_SUCCESS : RTA_ERROR;
1740
1741#else /* if defined(TARGET_LINUX) */
1742 msg(M_FATAL,
1743 "Sorry, but I don't know how to do 'route' commands on this operating system. Try putting your routes in a --route-up script");
1744#endif /* if defined(TARGET_LINUX) */
1745
1746done:
1747 if (status == RTA_SUCCESS)
1748 {
1749 r->flags |= RT_ADDED;
1750 }
1751 else
1752 {
1753 r->flags &= ~RT_ADDED;
1754 }
1755 argv_free(&argv);
1756 gc_free(&gc);
1757 /* release resources potentially allocated during route setup */
1758 net_ctx_reset(ctx);
1759
1760 return (status != RTA_ERROR);
1761}
1762
1763
1764void
1766{
1767 /* clear host bit parts of route
1768 * (needed if routes are specified improperly, or if we need to
1769 * explicitly setup/clear the "connected" network routes on some OSes)
1770 */
1771 int byte = 15;
1772 int bits_to_clear = 128 - r6->netbits;
1773
1774 while (byte >= 0 && bits_to_clear > 0)
1775 {
1776 if (bits_to_clear >= 8)
1777 {
1778 r6->network.s6_addr[byte--] = 0;
1779 bits_to_clear -= 8;
1780 }
1781 else
1782 {
1783 r6->network.s6_addr[byte--] &= (0xff << bits_to_clear);
1784 bits_to_clear = 0;
1785 }
1786 }
1787}
1788
1789bool
1790add_route_ipv6(struct route_ipv6 *r6, const struct tuntap *tt, unsigned int flags,
1791 const struct env_set *es, openvpn_net_ctx_t *ctx)
1792{
1793 int status = 0;
1794 bool gateway_needed = false;
1795
1796 if (!(r6->flags & RT_DEFINED))
1797 {
1798 return true; /* no error */
1799 }
1800
1801 struct argv argv = argv_new();
1802 struct gc_arena gc = gc_new();
1803
1804#ifndef _WIN32
1805 const char *device = tt->actual_name;
1806 if (r6->iface != NULL) /* vpn server special route */
1807 {
1808 device = r6->iface;
1809 if (!IN6_IS_ADDR_UNSPECIFIED(&r6->gateway))
1810 {
1811 gateway_needed = true;
1812 }
1813 }
1814#endif
1815
1817 const char *network = print_in6_addr(r6->network, 0, &gc);
1818 const char *gateway = print_in6_addr(r6->gateway, 0, &gc);
1819
1820#if defined(TARGET_DARWIN) || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) \
1821 || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
1822
1823 /* the BSD platforms cannot specify gateway and interface independently,
1824 * but for link-local destinations, we MUST specify the interface, so
1825 * we build a combined "$gateway%$interface" gateway string
1826 */
1827 if (r6->iface != NULL && gateway_needed
1828 && IN6_IS_ADDR_LINKLOCAL(&r6->gateway)) /* fe80::...%intf */
1829 {
1830 int len = strlen(gateway) + 1 + strlen(r6->iface) + 1;
1831 char *tmp = gc_malloc(len, true, &gc);
1832 snprintf(tmp, len, "%s%%%s", gateway, r6->iface);
1833 gateway = tmp;
1834 }
1835#endif
1836
1837#ifndef _WIN32
1838 msg(D_ROUTE, "add_route_ipv6(%s/%d -> %s metric %d) dev %s", network, r6->netbits, gateway,
1839 r6->metric, device);
1840#else
1841 msg(D_ROUTE, "add_route_ipv6(%s/%d -> %s metric %d) IF %lu", network, r6->netbits, gateway,
1842 r6->metric, r6->adapter_index ? r6->adapter_index : tt->adapter_index);
1843#endif
1844
1845 /*
1846 * Filter out routes which are essentially no-ops
1847 * (not currently done for IPv6)
1848 */
1849
1850 /* On "tun" interface, we never set a gateway if the operating system
1851 * can do "route to interface" - it does not add value, as the target
1852 * dev already fully qualifies the route destination on point-to-point
1853 * interfaces. OTOH, on "tap" interface, we must always set the
1854 * gateway unless the route is to be an on-link network
1855 */
1856 if (tt->type == DEV_TYPE_TAP && !((r6->flags & RT_METRIC_DEFINED) && r6->metric == 0))
1857 {
1858 gateway_needed = true;
1859 }
1860
1861 if (gateway_needed && IN6_IS_ADDR_UNSPECIFIED(&r6->gateway))
1862 {
1863 msg(M_WARN,
1864 "ROUTE6 WARNING: " PACKAGE_NAME " needs a gateway "
1865 "parameter for a --route-ipv6 option and no default was set via "
1866 "--ifconfig-ipv6 or --route-ipv6-gateway option. Not installing "
1867 "IPv6 route to %s/%d.",
1868 network, r6->netbits);
1869 status = 0;
1870 goto done;
1871 }
1872
1873#if defined(TARGET_LINUX)
1874 int metric = -1;
1875 if ((r6->flags & RT_METRIC_DEFINED) && (r6->metric > 0))
1876 {
1877 metric = r6->metric;
1878 }
1879
1881 int ret = net_route_v6_add(ctx, &r6->network, r6->netbits, gateway_needed ? &r6->gateway : NULL,
1882 device, r6->table_id, metric);
1883 if (ret == -EEXIST)
1884 {
1885 msg(D_ROUTE, "NOTE: Linux route add command failed because route exists");
1887 }
1888 else if (ret < 0)
1889 {
1890 msg(M_WARN, "ERROR: Linux route add command failed");
1891 status = RTA_ERROR;
1892 }
1893
1894#elif defined(TARGET_ANDROID)
1895 char out[64];
1896
1897 snprintf(out, sizeof(out), "%s/%d %s", network, r6->netbits, device);
1898
1899 status = management_android_control(management, "ROUTE6", out);
1900
1901#elif defined(_WIN32)
1902
1903 if (tt->options.msg_channel)
1904 {
1906 }
1907 else
1908 {
1909 status = route_ipv6_ipapi(true, r6, tt);
1910 }
1911#elif defined(TARGET_SOLARIS)
1912
1913 /* example: route add -inet6 2001:db8::/32 somegateway 0 */
1914
1915 /* for some reason, routes to tun/tap do not work for me unless I set
1916 * "metric 0" - otherwise, the routes will be nicely installed, but
1917 * packets will just disappear somewhere. So we always use "0" now,
1918 * unless the route points to "gateway on other interface"...
1919 *
1920 * (Note: OpenSolaris can not specify host%interface gateways, so we just
1921 * use the GW addresses - it seems to still work for fe80:: addresses,
1922 * however this is done internally. NUD maybe?)
1923 */
1924 argv_printf(&argv, "%s add -inet6 %s/%d %s", ROUTE_PATH, network, r6->netbits, gateway);
1925
1926 /* on tun (not tap), not "elsewhere"? -> metric 0 */
1927 if (tt->type == DEV_TYPE_TUN && !r6->iface)
1928 {
1929 argv_printf_cat(&argv, "0");
1930 }
1931
1933 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route add -inet6 command failed");
1934 status = ret ? RTA_SUCCESS : RTA_ERROR;
1935
1936#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)
1937
1938 argv_printf(&argv, "%s add -inet6 %s/%d", ROUTE_PATH, network, r6->netbits);
1939
1940 if (gateway_needed)
1941 {
1942 argv_printf_cat(&argv, "%s", gateway);
1943 }
1944 else
1945 {
1946 argv_printf_cat(&argv, "-iface %s", device);
1947 }
1948
1950 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: *BSD route add -inet6 command failed");
1951 status = ret ? RTA_SUCCESS : RTA_ERROR;
1952
1953#elif defined(TARGET_DARWIN)
1954
1955 argv_printf(&argv, "%s add -inet6 %s -prefixlen %d", ROUTE_PATH, network, r6->netbits);
1956
1957 if (gateway_needed)
1958 {
1959 argv_printf_cat(&argv, "%s", gateway);
1960 }
1961 else
1962 {
1963 argv_printf_cat(&argv, "-iface %s", device);
1964 }
1965
1967 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: MacOS X route add -inet6 command failed");
1968 status = ret ? RTA_SUCCESS : RTA_ERROR;
1969
1970#elif defined(TARGET_OPENBSD)
1971
1972 argv_printf(&argv, "%s add -inet6 %s -prefixlen %d %s", ROUTE_PATH, network, r6->netbits,
1973 gateway);
1974
1976 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: OpenBSD route add -inet6 command failed");
1977 status = ret ? RTA_SUCCESS : RTA_ERROR;
1978
1979#elif defined(TARGET_NETBSD)
1980
1981 argv_printf(&argv, "%s add -inet6 %s/%d %s", ROUTE_PATH, network, r6->netbits, gateway);
1982
1984 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: NetBSD route add -inet6 command failed");
1985 status = ret ? RTA_SUCCESS : RTA_ERROR;
1986
1987#elif defined(TARGET_AIX)
1988
1989 argv_printf(&argv, "%s add -inet6 %s/%d %s", ROUTE_PATH, network, r6->netbits, gateway);
1991 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: AIX route add command failed");
1992 status = ret ? RTA_SUCCESS : RTA_ERROR;
1993
1994#elif defined(TARGET_HAIKU)
1995
1996 /* ex: route add /dev/net/ipro1000/0 inet6 :: gw beef::cafe prefixlen 64 */
1997 argv_printf(&argv, "%s add %s inet6 %s gw %s prefixlen %d", ROUTE_PATH, r6->iface, network,
1998 gateway, r6->netbits);
2000 bool ret = openvpn_execve_check(&argv, es, 0, "ERROR: Haiku inet6 route add command failed");
2001 status = ret ? RTA_SUCCESS : RTA_ERROR;
2002
2003#else /* if defined(TARGET_LINUX) */
2004 msg(M_FATAL,
2005 "Sorry, but I don't know how to do 'route ipv6' commands on this operating system. Try putting your routes in a --route-up script");
2006#endif /* if defined(TARGET_LINUX) */
2007
2008done:
2009 if (status == RTA_SUCCESS)
2010 {
2011 r6->flags |= RT_ADDED;
2012 }
2013 else
2014 {
2015 r6->flags &= ~RT_ADDED;
2016 }
2017 argv_free(&argv);
2018 gc_free(&gc);
2019 /* release resources potentially allocated during route setup */
2020 net_ctx_reset(ctx);
2021
2022 return (status != RTA_ERROR);
2023}
2024
2025static void
2026delete_route(struct route_ipv4 *r, const struct tuntap *tt, unsigned int flags,
2027 const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
2028{
2029#if !defined(TARGET_LINUX)
2030 const char *network;
2031#if !defined(TARGET_AIX)
2032 const char *netmask;
2033#endif
2034#if !defined(TARGET_ANDROID)
2035 const char *gateway;
2036#endif
2037#else /* if !defined(TARGET_LINUX) */
2038 int metric;
2039#endif
2040 int is_local_route;
2041
2042 if ((r->flags & (RT_DEFINED | RT_ADDED)) != (RT_DEFINED | RT_ADDED))
2043 {
2044 return;
2045 }
2046
2047 struct gc_arena gc = gc_new();
2048 struct argv argv = argv_new();
2049
2050#if !defined(TARGET_LINUX)
2051 network = print_in_addr_t(r->network, 0, &gc);
2052#if !defined(TARGET_AIX)
2053 netmask = print_in_addr_t(r->netmask, 0, &gc);
2054#endif
2055#if !defined(TARGET_ANDROID)
2056 gateway = print_in_addr_t(r->gateway, 0, &gc);
2057#endif
2058#endif
2059
2060 is_local_route = local_route(r->network, r->netmask, r->gateway, rgi);
2061 if (is_local_route == LR_ERROR)
2062 {
2063 goto done;
2064 }
2065
2066#if defined(TARGET_LINUX)
2067 metric = -1;
2068 if (r->flags & RT_METRIC_DEFINED)
2069 {
2070 metric = r->metric;
2071 }
2072
2073 if (net_route_v4_del(ctx, &r->network, netmask_to_netbits2(r->netmask), &r->gateway, NULL,
2074 r->table_id, metric)
2075 < 0)
2076 {
2077 msg(M_WARN, "ERROR: Linux route delete command failed");
2078 }
2079#elif defined(_WIN32)
2080
2081 argv_printf(&argv, "%s%s DELETE %s MASK %s %s", get_win_sys_path(), WIN_ROUTE_PATH_SUFFIX,
2082 network, netmask, gateway);
2083
2085
2086 if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_SERVICE)
2087 {
2088 const bool status = del_route_service(r, tt);
2089 msg(D_ROUTE, "Route deletion via service %s", status ? "succeeded" : "failed");
2090 }
2091 else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_IPAPI)
2092 {
2093 const bool status = del_route_ipapi(r, tt);
2094 msg(D_ROUTE, "Route deletion via IPAPI %s", status ? "succeeded" : "failed");
2095 }
2096 else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_EXE)
2097 {
2099 openvpn_execve_check(&argv, es, 0, "ERROR: Windows route delete command failed");
2101 }
2102 else if ((flags & ROUTE_METHOD_MASK) == ROUTE_METHOD_ADAPTIVE)
2103 {
2104 const bool status = del_route_ipapi(r, tt);
2105 msg(D_ROUTE, "Route deletion via IPAPI %s [adaptive]", status ? "succeeded" : "failed");
2106 if (!status)
2107 {
2108 msg(D_ROUTE, "Route deletion fallback to route.exe");
2111 "ERROR: Windows route delete command failed [adaptive]");
2113 }
2114 }
2115 else
2116 {
2117 ASSERT(0);
2118 }
2119
2120#elif defined(TARGET_SOLARIS)
2121
2122 argv_printf(&argv, "%s delete %s -netmask %s %s", ROUTE_PATH, network, netmask, gateway);
2123
2125 openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route delete command failed");
2126
2127#elif defined(TARGET_FREEBSD)
2128
2129 argv_printf(&argv, "%s delete -net %s %s %s", ROUTE_PATH, network, gateway, netmask);
2130
2132 openvpn_execve_check(&argv, es, 0, "ERROR: FreeBSD route delete command failed");
2133
2134#elif defined(TARGET_DRAGONFLY)
2135
2136 argv_printf(&argv, "%s delete -net %s %s %s", ROUTE_PATH, network, gateway, netmask);
2137
2139 openvpn_execve_check(&argv, es, 0, "ERROR: DragonFly route delete command failed");
2140
2141#elif defined(TARGET_DARWIN)
2142
2143 if (is_on_link(is_local_route, flags, rgi))
2144 {
2145 argv_printf(&argv, "%s delete -cloning -net %s -netmask %s -interface %s", ROUTE_PATH,
2146 network, netmask, rgi->iface);
2147 }
2148 else
2149 {
2150 argv_printf(&argv, "%s delete -net %s %s %s", ROUTE_PATH, network, gateway, netmask);
2151 }
2152
2154 openvpn_execve_check(&argv, es, 0, "ERROR: OS X route delete command failed");
2155
2156#elif defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
2157
2158 argv_printf(&argv, "%s delete -net %s %s -netmask %s", ROUTE_PATH, network, gateway, netmask);
2159
2161 openvpn_execve_check(&argv, es, 0, "ERROR: OpenBSD/NetBSD route delete command failed");
2162
2163#elif defined(TARGET_ANDROID)
2164 msg(D_ROUTE_DEBUG, "Deleting routes on Android is not possible/not "
2165 "needed. The VpnService API allows routes to be set "
2166 "on connect only and will clean up automatically.");
2167#elif defined(TARGET_AIX)
2168
2169 {
2170 int netbits = netmask_to_netbits2(r->netmask);
2171 argv_printf(&argv, "%s delete -net %s/%d %s", ROUTE_PATH, network, netbits, gateway);
2173 openvpn_execve_check(&argv, es, 0, "ERROR: AIX route delete command failed");
2174 }
2175
2176#elif defined(TARGET_HAIKU)
2177
2178 /* ex: route delete /dev/net/ipro1000/0 inet 192.168.0.0 gw 192.168.1.1 netmask 255.255.0.0 */
2179 argv_printf(&argv, "%s delete %s inet %s gw %s netmask %s", ROUTE_PATH, rgi->iface, network,
2180 gateway, netmask);
2182 openvpn_execve_check(&argv, es, 0, "ERROR: Haiku inet route delete command failed");
2183
2184#else /* if defined(TARGET_LINUX) */
2185 msg(M_FATAL,
2186 "Sorry, but I don't know how to do 'route' commands on this operating system. Try putting your routes in a --route-up script");
2187#endif /* if defined(TARGET_LINUX) */
2188
2189done:
2190 r->flags &= ~RT_ADDED;
2191 argv_free(&argv);
2192 gc_free(&gc);
2193 /* release resources potentially allocated during route cleanup */
2194 net_ctx_reset(ctx);
2195}
2196
2197void
2198delete_route_ipv6(const struct route_ipv6 *r6, const struct tuntap *tt, const struct env_set *es,
2199 openvpn_net_ctx_t *ctx)
2200{
2201 const char *network;
2202
2203 if ((r6->flags & (RT_DEFINED | RT_ADDED)) != (RT_DEFINED | RT_ADDED))
2204 {
2205 return;
2206 }
2207
2208#if !defined(_WIN32)
2209#if !defined(TARGET_LINUX)
2210 const char *gateway;
2211#endif
2212#if !defined(TARGET_SOLARIS)
2213 bool gateway_needed = false;
2214 const char *device = tt->actual_name;
2215 if (r6->iface != NULL) /* vpn server special route */
2216 {
2217 device = r6->iface;
2218 gateway_needed = true;
2219 }
2220
2221 /* if we used a gateway on "add route", we also need to specify it on
2222 * delete, otherwise some OSes will refuse to delete the route
2223 */
2224 if (tt->type == DEV_TYPE_TAP && !((r6->flags & RT_METRIC_DEFINED) && r6->metric == 0))
2225 {
2226 gateway_needed = true;
2227 }
2228#endif
2229#endif
2230
2231 struct gc_arena gc = gc_new();
2232 struct argv argv = argv_new();
2233
2234 network = print_in6_addr(r6->network, 0, &gc);
2235#if !defined(TARGET_LINUX) && !defined(_WIN32)
2236 gateway = print_in6_addr(r6->gateway, 0, &gc);
2237#endif
2238
2239#if defined(TARGET_DARWIN) || defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY) \
2240 || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
2241
2242 /* the BSD platforms cannot specify gateway and interface independently,
2243 * but for link-local destinations, we MUST specify the interface, so
2244 * we build a combined "$gateway%$interface" gateway string
2245 */
2246 if (r6->iface != NULL && gateway_needed
2247 && IN6_IS_ADDR_LINKLOCAL(&r6->gateway)) /* fe80::...%intf */
2248 {
2249 int len = strlen(gateway) + 1 + strlen(r6->iface) + 1;
2250 char *tmp = gc_malloc(len, true, &gc);
2251 snprintf(tmp, len, "%s%%%s", gateway, r6->iface);
2252 gateway = tmp;
2253 }
2254#endif
2255
2256 msg(D_ROUTE, "delete_route_ipv6(%s/%d)", network, r6->netbits);
2257
2258#if defined(TARGET_LINUX)
2259 int metric = -1;
2260 if ((r6->flags & RT_METRIC_DEFINED) && (r6->metric > 0))
2261 {
2262 metric = r6->metric;
2263 }
2264
2265 if (net_route_v6_del(ctx, &r6->network, r6->netbits, gateway_needed ? &r6->gateway : NULL,
2266 device, r6->table_id, metric)
2267 < 0)
2268 {
2269 msg(M_WARN, "ERROR: Linux route v6 delete command failed");
2270 }
2271
2272#elif defined(_WIN32)
2273
2274 if (tt->options.msg_channel)
2275 {
2277 }
2278 else
2279 {
2280 route_ipv6_ipapi(false, r6, tt);
2281 }
2282#elif defined(TARGET_SOLARIS)
2283
2284 /* example: route delete -inet6 2001:db8::/32 somegateway */
2285
2286 argv_printf(&argv, "%s delete -inet6 %s/%d %s", ROUTE_PATH, network, r6->netbits, gateway);
2287
2289 openvpn_execve_check(&argv, es, 0, "ERROR: Solaris route delete -inet6 command failed");
2290
2291#elif defined(TARGET_FREEBSD) || defined(TARGET_DRAGONFLY)
2292
2293 argv_printf(&argv, "%s delete -inet6 %s/%d", ROUTE_PATH, network, r6->netbits);
2294
2295 if (gateway_needed)
2296 {
2297 argv_printf_cat(&argv, "%s", gateway);
2298 }
2299 else
2300 {
2301 argv_printf_cat(&argv, "-iface %s", device);
2302 }
2303
2305 openvpn_execve_check(&argv, es, 0, "ERROR: *BSD route delete -inet6 command failed");
2306
2307#elif defined(TARGET_DARWIN)
2308
2309 argv_printf(&argv, "%s delete -inet6 %s -prefixlen %d", ROUTE_PATH, network, r6->netbits);
2310
2311 if (gateway_needed)
2312 {
2313 argv_printf_cat(&argv, "%s", gateway);
2314 }
2315 else
2316 {
2317 argv_printf_cat(&argv, "-iface %s", device);
2318 }
2319
2321 openvpn_execve_check(&argv, es, 0, "ERROR: MacOS X route delete -inet6 command failed");
2322
2323#elif defined(TARGET_OPENBSD)
2324
2325 argv_printf(&argv, "%s delete -inet6 %s -prefixlen %d %s", ROUTE_PATH, network, r6->netbits,
2326 gateway);
2327
2329 openvpn_execve_check(&argv, es, 0, "ERROR: OpenBSD route delete -inet6 command failed");
2330
2331#elif defined(TARGET_NETBSD)
2332
2333 argv_printf(&argv, "%s delete -inet6 %s/%d %s", ROUTE_PATH, network, r6->netbits, gateway);
2334
2336 openvpn_execve_check(&argv, es, 0, "ERROR: NetBSD route delete -inet6 command failed");
2337
2338#elif defined(TARGET_AIX)
2339
2340 argv_printf(&argv, "%s delete -inet6 %s/%d %s", ROUTE_PATH, network, r6->netbits, gateway);
2342 openvpn_execve_check(&argv, es, 0, "ERROR: AIX route add command failed");
2343
2344#elif defined(TARGET_ANDROID)
2345 msg(D_ROUTE_DEBUG, "Deleting routes on Android is not possible/not "
2346 "needed. The VpnService API allows routes to be set "
2347 "on connect only and will clean up automatically.");
2348#elif defined(TARGET_HAIKU)
2349
2350 /* ex: route delete /dev/net/ipro1000/0 inet6 :: gw beef::cafe prefixlen 64 */
2351 argv_printf(&argv, "%s delete %s inet6 %s gw %s prefixlen %d", ROUTE_PATH, r6->iface, network,
2352 gateway, r6->netbits);
2354 openvpn_execve_check(&argv, es, 0, "ERROR: Haiku inet6 route delete command failed");
2355
2356#else /* if defined(TARGET_LINUX) */
2357 msg(M_FATAL,
2358 "Sorry, but I don't know how to do 'route ipv6' commands on this operating system. Try putting your routes in a --route-down script");
2359#endif /* if defined(TARGET_LINUX) */
2360
2361 argv_free(&argv);
2362 gc_free(&gc);
2363 /* release resources potentially allocated during route cleanup */
2364 net_ctx_reset(ctx);
2365}
2366
2367/*
2368 * The --redirect-gateway option requires OS-specific code below
2369 * to get the current default gateway.
2370 */
2371
2372#if defined(_WIN32)
2373
2374static const MIB_IPFORWARDTABLE *
2376{
2377 ULONG size = 0;
2378 PMIB_IPFORWARDTABLE rt = NULL;
2379 DWORD status;
2380
2381 status = GetIpForwardTable(NULL, &size, TRUE);
2382 if (status == ERROR_INSUFFICIENT_BUFFER)
2383 {
2384 rt = (PMIB_IPFORWARDTABLE)gc_malloc(size, false, gc);
2385 status = GetIpForwardTable(rt, &size, TRUE);
2386 if (status != NO_ERROR)
2387 {
2388 msg(D_ROUTE, "NOTE: GetIpForwardTable returned error: %s (code=%u)",
2389 strerror_win32(status, gc), (unsigned int)status);
2390 rt = NULL;
2391 }
2392 }
2393 return rt;
2394}
2395
2396static int
2397test_route(const IP_ADAPTER_INFO *adapters, const in_addr_t gateway, DWORD *index)
2398{
2399 int count = 0;
2400 DWORD i = adapter_index_of_ip(adapters, gateway, &count, NULL);
2401 if (index)
2402 {
2403 *index = i;
2404 }
2405 return count;
2406}
2407
2408static void
2409test_route_helper(bool *ret, int *count, int *good, int *ambig, const IP_ADAPTER_INFO *adapters,
2410 const in_addr_t gateway)
2411{
2412 int c;
2413
2414 ++*count;
2415 c = test_route(adapters, gateway, NULL);
2416 if (c == 0)
2417 {
2418 *ret = false;
2419 }
2420 else
2421 {
2422 ++*good;
2423 }
2424 if (c > 1)
2425 {
2426 ++*ambig;
2427 }
2428}
2429
2430/*
2431 * If we tried to add routes now, would we succeed?
2432 */
2433bool
2434test_routes(const struct route_list *rl, const struct tuntap *tt)
2435{
2436 struct gc_arena gc = gc_new();
2437 const IP_ADAPTER_INFO *adapters = get_adapter_info_list(&gc);
2438 bool ret = false;
2439 int count = 0;
2440 int good = 0;
2441 int ambig = 0;
2442 int len = -1;
2443 bool adapter_up = false;
2444
2445 if (is_adapter_up(tt, adapters))
2446 {
2447 ret = true;
2448 adapter_up = true;
2449
2450 /* we do this test only if we have IPv4 routes to install, and if
2451 * the tun/tap interface has seen IPv4 ifconfig - because if we
2452 * have no IPv4, the check will always fail, failing tun init
2453 */
2454 if (rl && tt->did_ifconfig_setup)
2455 {
2456 struct route_ipv4 *r;
2457 for (r = rl->routes, len = 0; r; r = r->next, ++len)
2458 {
2459 test_route_helper(&ret, &count, &good, &ambig, adapters, r->gateway);
2460 }
2461
2462 if ((rl->flags & RG_ENABLE) && (rl->spec.flags & RTSA_REMOTE_ENDPOINT))
2463 {
2464 test_route_helper(&ret, &count, &good, &ambig, adapters, rl->spec.remote_endpoint);
2465 }
2466 }
2467 }
2468
2469 msg(D_ROUTE, "TEST ROUTES: %d/%d succeeded len=%d ret=%d a=%d u/d=%s", good, count, len,
2470 (int)ret, ambig, adapter_up ? "up" : "down");
2471
2472 gc_free(&gc);
2473 return ret;
2474}
2475
2476static const MIB_IPFORWARDROW *
2477get_default_gateway_row(const MIB_IPFORWARDTABLE *routes)
2478{
2479 struct gc_arena gc = gc_new();
2480 DWORD lowest_metric = MAXDWORD;
2481 const MIB_IPFORWARDROW *ret = NULL;
2482 int best = -1;
2483
2484 if (routes)
2485 {
2486 for (DWORD i = 0; i < routes->dwNumEntries; ++i)
2487 {
2488 const MIB_IPFORWARDROW *row = &routes->table[i];
2489 const in_addr_t net = ntohl(row->dwForwardDest);
2490 const in_addr_t mask = ntohl(row->dwForwardMask);
2491 const DWORD index = row->dwForwardIfIndex;
2492 const DWORD metric = row->dwForwardMetric1;
2493
2494 dmsg(D_ROUTE_DEBUG, "GDGR: route[%lu] %s/%s i=%d m=%d", i,
2495 print_in_addr_t((in_addr_t)net, 0, &gc), print_in_addr_t((in_addr_t)mask, 0, &gc),
2496 (int)index, (int)metric);
2497
2498 if (!net && !mask && metric < lowest_metric)
2499 {
2500 ret = row;
2501 lowest_metric = metric;
2502 best = i;
2503 }
2504 }
2505 }
2506
2507 dmsg(D_ROUTE_DEBUG, "GDGR: best=%d lm=%u", best, (unsigned int)lowest_metric);
2508
2509 gc_free(&gc);
2510 return ret;
2511}
2512
2524static DWORD
2525get_best_route(struct gc_arena *gc, SOCKADDR_INET *dest, MIB_IPFORWARD_ROW2 *best_route)
2526{
2527 DWORD best_if_index;
2528 DWORD status;
2529
2530 CLEAR(*best_route);
2531
2532 /* get the best interface index to reach dest */
2533 status = GetBestInterfaceEx((struct sockaddr *)dest, &best_if_index);
2534 if (status != NO_ERROR)
2535 {
2536 msg(D_ROUTE, "NOTE: GetBestInterfaceEx returned error: %s (code=%u)",
2537 strerror_win32(status, gc), (unsigned int)status);
2538 goto done;
2539 }
2540
2541 msg(D_ROUTE_DEBUG, "GetBestInterfaceEx() returned if=%d", (int)best_if_index);
2542
2543 /* get the routing information (such as NextHop) for the destination and interface */
2544 NET_LUID luid;
2545 CLEAR(luid);
2546 SOCKADDR_INET best_src;
2547 CLEAR(best_src);
2548 status = GetBestRoute2(&luid, best_if_index, NULL, dest, 0, best_route, &best_src);
2549 if (status != NO_ERROR)
2550 {
2551 msg(D_ROUTE, "NOTE: GetIpForwardEntry2 returned error: %s (code=%u)",
2552 strerror_win32(status, gc), (unsigned int)status);
2553 goto done;
2554 }
2555
2556done:
2557 return status;
2558}
2559
2560void
2562{
2563 CLEAR(*rgi);
2564
2565 struct gc_arena gc = gc_new();
2566
2567 /* convert in_addr_t into SOCKADDR_INET */
2568 SOCKADDR_INET sa;
2569 CLEAR(sa);
2570 sa.si_family = AF_INET;
2571 sa.Ipv4.sin_addr.s_addr = htonl(dest);
2572
2573 /* get the best route to the destination */
2574 MIB_IPFORWARD_ROW2 best_route;
2575 CLEAR(best_route);
2576 DWORD status = get_best_route(&gc, &sa, &best_route);
2577 if (status != NO_ERROR)
2578 {
2579 goto done;
2580 }
2581
2583 rgi->gateway.addr = ntohl(best_route.NextHop.Ipv4.sin_addr.S_un.S_addr);
2584 rgi->adapter_index = best_route.InterfaceIndex;
2585
2586 if (rgi->gateway.addr == INADDR_ANY)
2587 {
2588 rgi->flags |= RGI_ON_LINK;
2589 }
2590
2591 /* get netmask and MAC address */
2592 const IP_ADAPTER_INFO *adapters = get_adapter_info_list(&gc);
2593 const IP_ADAPTER_INFO *ai = get_adapter(adapters, rgi->adapter_index);
2594 if (ai)
2595 {
2596 memcpy(rgi->hwaddr, ai->Address, 6);
2597 rgi->flags |= RGI_HWADDR_DEFINED;
2598
2599 /* get netmask for non-onlink routes */
2600 in_addr_t nm = inet_addr(ai->IpAddressList.IpMask.String);
2601 if (!(rgi->flags & RGI_ON_LINK) && (nm != INADDR_NONE))
2602 {
2603 rgi->gateway.netmask = ntohl(nm);
2604 rgi->flags |= RGI_NETMASK_DEFINED;
2605 }
2606 }
2607
2608done:
2609 gc_free(&gc);
2610}
2611
2612static DWORD
2613windows_route_find_if_index(const struct route_ipv4 *r, const struct tuntap *tt)
2614{
2615 struct gc_arena gc = gc_new();
2616 DWORD ret = TUN_ADAPTER_INDEX_INVALID;
2617 int count = 0;
2618 const IP_ADAPTER_INFO *adapters = get_adapter_info_list(&gc);
2619 const IP_ADAPTER_INFO *tun_adapter = get_tun_adapter(tt, adapters);
2620 bool on_tun = false;
2621
2622 /* first test on tun interface */
2623 if (is_ip_in_adapter_subnet(tun_adapter, r->gateway, NULL))
2624 {
2625 ret = tun_adapter->Index;
2626 count = 1;
2627 on_tun = true;
2628 }
2629 else /* test on other interfaces */
2630 {
2631 count = test_route(adapters, r->gateway, &ret);
2632 }
2633
2634 if (count == 0)
2635 {
2636 msg(M_WARN, "Warning: route gateway is not reachable on any active network adapters: %s",
2637 print_in_addr_t(r->gateway, 0, &gc));
2639 }
2640 else if (count > 1)
2641 {
2642 msg(M_WARN, "Warning: route gateway is ambiguous: %s (%d matches)",
2643 print_in_addr_t(r->gateway, 0, &gc), count);
2644 }
2645
2646 dmsg(D_ROUTE_DEBUG, "DEBUG: route find if: on_tun=%d count=%d index=%d", on_tun, count,
2647 (int)ret);
2648
2649 gc_free(&gc);
2650 return ret;
2651}
2652
2653/* IPv6 implementation using GetBestRoute2()
2654 * (TBD: dynamic linking so the binary can still run on XP?)
2655 * https://msdn.microsoft.com/en-us/library/windows/desktop/aa365922(v=vs.85).aspx
2656 * https://msdn.microsoft.com/en-us/library/windows/desktop/aa814411(v=vs.85).aspx
2657 */
2658void
2659get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest,
2660 openvpn_net_ctx_t *ctx)
2661{
2662 struct gc_arena gc = gc_new();
2663 CLEAR(*rgi6);
2664
2665 SOCKADDR_INET DestinationAddress;
2666 CLEAR(DestinationAddress);
2667 DestinationAddress.si_family = AF_INET6;
2668 if (dest)
2669 {
2670 DestinationAddress.Ipv6.sin6_addr = *dest;
2671 }
2672
2673 MIB_IPFORWARD_ROW2 BestRoute;
2674 CLEAR(BestRoute);
2675 DWORD status = get_best_route(&gc, &DestinationAddress, &BestRoute);
2676
2677 if (status != NO_ERROR)
2678 {
2679 goto done;
2680 }
2681
2682 msg(D_ROUTE, "GDG6: II=%lu DP=%s/%d NH=%s", BestRoute.InterfaceIndex,
2683 print_in6_addr(BestRoute.DestinationPrefix.Prefix.Ipv6.sin6_addr, 0, &gc),
2684 BestRoute.DestinationPrefix.PrefixLength,
2685 print_in6_addr(BestRoute.NextHop.Ipv6.sin6_addr, 0, &gc));
2686 msg(D_ROUTE, "GDG6: Metric=%d, Loopback=%d, AA=%d, I=%d", (int)BestRoute.Metric,
2687 (int)BestRoute.Loopback, (int)BestRoute.AutoconfigureAddress, (int)BestRoute.Immortal);
2688
2689 rgi6->gateway.addr_ipv6 = BestRoute.NextHop.Ipv6.sin6_addr;
2690 rgi6->adapter_index = BestRoute.InterfaceIndex;
2692
2693 /* on-link is signalled by receiving an empty (::) NextHop */
2694 if (IN6_IS_ADDR_UNSPECIFIED(&BestRoute.NextHop.Ipv6.sin6_addr))
2695 {
2696 rgi6->flags |= RGI_ON_LINK;
2697 }
2698
2699done:
2700 gc_free(&gc);
2701}
2702
2703/* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */
2704static int
2705add_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt, DWORD adapter_index)
2706{
2707 struct gc_arena gc = gc_new();
2708 int ret = RTA_ERROR;
2709 DWORD status;
2710 const DWORD if_index = (adapter_index == TUN_ADAPTER_INDEX_INVALID)
2712 : adapter_index;
2713
2714 if (if_index != TUN_ADAPTER_INDEX_INVALID)
2715 {
2716 MIB_IPFORWARDROW fr;
2717 CLEAR(fr);
2718 fr.dwForwardDest = htonl(r->network);
2719 fr.dwForwardMask = htonl(r->netmask);
2720 fr.dwForwardPolicy = 0;
2721 fr.dwForwardNextHop = htonl(r->gateway);
2722 fr.dwForwardIfIndex = if_index;
2723 fr.dwForwardType = 4; /* the next hop is not the final dest */
2724 fr.dwForwardProto = 3; /* PROTO_IP_NETMGMT */
2725 fr.dwForwardAge = 0;
2726 fr.dwForwardNextHopAS = 0;
2727 fr.dwForwardMetric1 = (r->flags & RT_METRIC_DEFINED) ? r->metric : 1;
2728 fr.dwForwardMetric2 = METRIC_NOT_USED;
2729 fr.dwForwardMetric3 = METRIC_NOT_USED;
2730 fr.dwForwardMetric4 = METRIC_NOT_USED;
2731 fr.dwForwardMetric5 = METRIC_NOT_USED;
2732
2733 if ((r->network & r->netmask) != r->network)
2734 {
2735 msg(M_WARN, "Warning: address %s is not a network address in relation to netmask %s",
2736 print_in_addr_t(r->network, 0, &gc), print_in_addr_t(r->netmask, 0, &gc));
2737 }
2738
2739 status = CreateIpForwardEntry(&fr);
2740
2741 if (status == NO_ERROR)
2742 {
2743 ret = RTA_SUCCESS;
2744 }
2745 else if (status == ERROR_OBJECT_ALREADY_EXISTS)
2746 {
2747 ret = RTA_EEXIST;
2748 }
2749 else
2750 {
2751 /* failed, try increasing the metric to work around Vista issue */
2752 const unsigned int forward_metric_limit =
2753 2048; /* iteratively retry higher metrics up to this limit */
2754
2755 for (; fr.dwForwardMetric1 <= forward_metric_limit; ++fr.dwForwardMetric1)
2756 {
2757 /* try a different forward type=3 ("the next hop is the final dest") in addition
2758 * to 4.
2759 * --redirect-gateway over RRAS seems to need this. */
2760 for (fr.dwForwardType = 4; fr.dwForwardType >= 3; --fr.dwForwardType)
2761 {
2762 status = CreateIpForwardEntry(&fr);
2763 if (status == NO_ERROR)
2764 {
2765 msg(D_ROUTE,
2766 "ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=%u and dwForwardType=%u",
2767 (unsigned int)fr.dwForwardMetric1, (unsigned int)fr.dwForwardType);
2768 ret = RTA_SUCCESS;
2769 goto doublebreak;
2770 }
2771 else if (status != ERROR_BAD_ARGUMENTS)
2772 {
2773 goto doublebreak;
2774 }
2775 }
2776 }
2777
2778doublebreak:
2779 if (status != NO_ERROR)
2780 {
2781 if (status == ERROR_OBJECT_ALREADY_EXISTS)
2782 {
2783 ret = RTA_EEXIST;
2784 }
2785 else
2786 {
2787 msg(M_WARN,
2788 "ERROR: route addition failed using CreateIpForwardEntry: "
2789 "%s [status=%u if_index=%u]",
2790 strerror_win32(status, &gc), (unsigned int)status, (unsigned int)if_index);
2791 }
2792 }
2793 }
2794 }
2795
2796 gc_free(&gc);
2797 return ret;
2798}
2799
2800static bool
2801del_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt)
2802{
2803 struct gc_arena gc = gc_new();
2804 bool ret = false;
2805 DWORD status;
2806 const DWORD if_index = windows_route_find_if_index(r, tt);
2807
2808 if (if_index != TUN_ADAPTER_INDEX_INVALID)
2809 {
2810 MIB_IPFORWARDROW fr;
2811 CLEAR(fr);
2812
2813 fr.dwForwardDest = htonl(r->network);
2814 fr.dwForwardMask = htonl(r->netmask);
2815 fr.dwForwardPolicy = 0;
2816 fr.dwForwardNextHop = htonl(r->gateway);
2817 fr.dwForwardIfIndex = if_index;
2818
2819 status = DeleteIpForwardEntry(&fr);
2820
2821 if (status == NO_ERROR)
2822 {
2823 ret = true;
2824 }
2825 else
2826 {
2827 msg(M_WARN, "ERROR: route deletion failed using DeleteIpForwardEntry: %s",
2829 }
2830 }
2831
2832 gc_free(&gc);
2833 return ret;
2834}
2835
2836/* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */
2837static int
2838do_route_service(const bool add, const route_message_t *rt, const size_t size, HANDLE pipe)
2839{
2840 int ret = RTA_ERROR;
2841 ack_message_t ack;
2842 struct gc_arena gc = gc_new();
2843
2844 if (!send_msg_iservice(pipe, rt, size, &ack, "ROUTE"))
2845 {
2846 goto out;
2847 }
2848
2849 if (ack.error_number != NO_ERROR)
2850 {
2851 ret = (ack.error_number == ERROR_OBJECT_ALREADY_EXISTS) ? RTA_EEXIST : RTA_ERROR;
2852 if (ret == RTA_ERROR)
2853 {
2854 msg(M_WARN, "ERROR: route %s failed using service: %s [status=%u if_index=%d]",
2855 (add ? "addition" : "deletion"), strerror_win32(ack.error_number, &gc),
2856 ack.error_number, rt->iface.index);
2857 }
2858 goto out;
2859 }
2860
2861 ret = RTA_SUCCESS;
2862
2863out:
2864 gc_free(&gc);
2865 return ret;
2866}
2867
2868/* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */
2869static int
2870do_route_ipv4_service(const bool add, const struct route_ipv4 *r, const struct tuntap *tt)
2871{
2872 DWORD if_index = windows_route_find_if_index(r, tt);
2873 if (if_index == ~0)
2874 {
2875 return RTA_ERROR;
2876 }
2877
2879 sizeof(route_message_t), 0 },
2880 .family = AF_INET,
2881 .prefix.ipv4.s_addr = htonl(r->network),
2882 .gateway.ipv4.s_addr = htonl(r->gateway),
2883 .iface = { .index = if_index, .name = "" },
2884 .metric = (r->flags & RT_METRIC_DEFINED ? r->metric : -1) };
2885
2886 netmask_to_netbits(r->network, r->netmask, &msg.prefix_len);
2887 if (msg.prefix_len == -1)
2888 {
2889 msg.prefix_len = 32;
2890 }
2891
2892 return do_route_service(add, &msg, sizeof(msg), tt->options.msg_channel);
2893}
2894
2895/* Add or delete an ipv6 route
2896 * Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error
2897 */
2898static int
2899route_ipv6_ipapi(const bool add, const struct route_ipv6 *r, const struct tuntap *tt)
2900{
2901 DWORD err;
2902 int ret = RTA_ERROR;
2903 PMIB_IPFORWARD_ROW2 fwd_row;
2904 struct gc_arena gc = gc_new();
2905
2906 fwd_row = gc_malloc(sizeof(*fwd_row), true, &gc);
2907
2908 fwd_row->ValidLifetime = 0xffffffff;
2909 fwd_row->PreferredLifetime = 0xffffffff;
2910 fwd_row->Protocol = MIB_IPPROTO_NETMGMT;
2911 fwd_row->Metric = ((r->flags & RT_METRIC_DEFINED) ? r->metric : -1);
2912 fwd_row->DestinationPrefix.Prefix.si_family = AF_INET6;
2913 fwd_row->DestinationPrefix.Prefix.Ipv6.sin6_addr = r->network;
2914 fwd_row->DestinationPrefix.PrefixLength = (UINT8)r->netbits;
2915 fwd_row->NextHop.si_family = AF_INET6;
2916 fwd_row->NextHop.Ipv6.sin6_addr = r->gateway;
2917 fwd_row->InterfaceIndex = r->adapter_index ? r->adapter_index : tt->adapter_index;
2918
2919 /* In TUN mode we use a special link-local address as the next hop.
2920 * The tapdrvr knows about it and will answer neighbor discovery packets.
2921 * (only do this for routes actually using the tun/tap device)
2922 */
2923 if (tt->type == DEV_TYPE_TUN && !r->adapter_index)
2924 {
2925 inet_pton(AF_INET6, "fe80::8", &fwd_row->NextHop.Ipv6.sin6_addr);
2926 }
2927
2928 /* Use LUID if interface index not available */
2929 if (fwd_row->InterfaceIndex == TUN_ADAPTER_INDEX_INVALID && strlen(tt->actual_name))
2930 {
2931 NET_LUID luid;
2932 err = ConvertInterfaceAliasToLuid(wide_string(tt->actual_name, &gc), &luid);
2933 if (err != NO_ERROR)
2934 {
2935 goto out;
2936 }
2937 fwd_row->InterfaceLuid = luid;
2938 fwd_row->InterfaceIndex = 0;
2939 }
2940
2941 if (add)
2942 {
2943 err = CreateIpForwardEntry2(fwd_row);
2944 }
2945 else
2946 {
2947 err = DeleteIpForwardEntry2(fwd_row);
2948 }
2949
2950out:
2951 if (err != NO_ERROR)
2952 {
2953 ret = (err == ERROR_OBJECT_ALREADY_EXISTS) ? RTA_EEXIST : RTA_ERROR;
2954 if (ret == RTA_ERROR)
2955 {
2956 msg(M_WARN, "ERROR: route %s failed using ipapi: %s [status=%lu if_index=%lu]",
2957 (add ? "addition" : "deletion"), strerror_win32(err, &gc), err,
2958 fwd_row->InterfaceIndex);
2959 }
2960 else if (add)
2961 {
2962 msg(D_ROUTE, "IPv6 route addition using ipapi failed because route exists");
2963 }
2964 }
2965 else
2966 {
2967 msg(D_ROUTE, "IPv6 route %s using ipapi", add ? "added" : "deleted");
2968 ret = RTA_SUCCESS;
2969 }
2970 gc_free(&gc);
2971 return ret;
2972}
2973
2974/* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */
2975static int
2976do_route_ipv6_service(const bool add, const struct route_ipv6 *r, const struct tuntap *tt)
2977{
2978 int status;
2980 sizeof(route_message_t), 0 },
2981 .family = AF_INET6,
2982 .prefix.ipv6 = r->network,
2983 .prefix_len = r->netbits,
2984 .gateway.ipv6 = r->gateway,
2985 .iface = { .index = tt->adapter_index, .name = "" },
2986 .metric = ((r->flags & RT_METRIC_DEFINED) ? r->metric : -1) };
2987
2988 if (r->adapter_index) /* vpn server special route */
2989 {
2990 msg.iface.index = r->adapter_index;
2991 }
2992
2993 /* In TUN mode we use a special link-local address as the next hop.
2994 * The tapdrvr knows about it and will answer neighbor discovery packets.
2995 * (only do this for routes actually using the tun/tap device)
2996 */
2997 if (tt->type == DEV_TYPE_TUN && msg.iface.index == tt->adapter_index)
2998 {
2999 inet_pton(AF_INET6, "fe80::8", &msg.gateway.ipv6);
3000 }
3001
3002 if (msg.iface.index == TUN_ADAPTER_INDEX_INVALID)
3003 {
3004 strncpy(msg.iface.name, tt->actual_name, sizeof(msg.iface.name));
3005 msg.iface.name[sizeof(msg.iface.name) - 1] = '\0';
3006 }
3007
3008 status = do_route_service(add, &msg, sizeof(msg), tt->options.msg_channel);
3009 if (status != RTA_ERROR)
3010 {
3011 msg(D_ROUTE, "IPv6 route %s via service %s", add ? "addition" : "deletion",
3012 (status == RTA_SUCCESS) ? "succeeded" : "failed because route exists");
3013 }
3014 return status;
3015}
3016
3017/* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */
3018static int
3019add_route_service(const struct route_ipv4 *r, const struct tuntap *tt)
3020{
3021 return do_route_ipv4_service(true, r, tt);
3022}
3023
3024static bool
3025del_route_service(const struct route_ipv4 *r, const struct tuntap *tt)
3026{
3027 return do_route_ipv4_service(false, r, tt);
3028}
3029
3030/* Returns RTA_SUCCESS on success, RTA_EEXIST if route exists, RTA_ERROR on error */
3031static int
3032add_route_ipv6_service(const struct route_ipv6 *r, const struct tuntap *tt)
3033{
3034 return do_route_ipv6_service(true, r, tt);
3035}
3036
3037static bool
3038del_route_ipv6_service(const struct route_ipv6 *r, const struct tuntap *tt)
3039{
3040 return do_route_ipv6_service(false, r, tt);
3041}
3042
3043static const char *
3044format_route_entry(const MIB_IPFORWARDROW *r, struct gc_arena *gc)
3045{
3046 struct buffer out = alloc_buf_gc(256, gc);
3047 buf_printf(&out, "%s %s %s p=%d i=%d t=%d pr=%d a=%d h=%d m=%d/%d/%d/%d/%d",
3048 print_in_addr_t(r->dwForwardDest, IA_NET_ORDER, gc),
3049 print_in_addr_t(r->dwForwardMask, IA_NET_ORDER, gc),
3050 print_in_addr_t(r->dwForwardNextHop, IA_NET_ORDER, gc), (int)r->dwForwardPolicy,
3051 (int)r->dwForwardIfIndex, (int)r->dwForwardType, (int)r->dwForwardProto,
3052 (int)r->dwForwardAge, (int)r->dwForwardNextHopAS, (int)r->dwForwardMetric1,
3053 (int)r->dwForwardMetric2, (int)r->dwForwardMetric3, (int)r->dwForwardMetric4,
3054 (int)r->dwForwardMetric5);
3055 return BSTR(&out);
3056}
3057
3058/*
3059 * Show current routing table
3060 */
3061void
3063{
3064 struct gc_arena gc = gc_new();
3065
3066 const MIB_IPFORWARDTABLE *rt = get_windows_routing_table(&gc);
3067
3068 msg(msglev, "SYSTEM ROUTING TABLE");
3069 if (rt)
3070 {
3071 for (DWORD i = 0; i < rt->dwNumEntries; ++i)
3072 {
3073 msg(msglev, "%s", format_route_entry(&rt->table[i], &gc));
3074 }
3075 }
3076 gc_free(&gc);
3077}
3078
3079#elif defined(TARGET_ANDROID)
3080
3081void
3082get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
3083{
3084 /* Android, set some pseudo GW, addr is in host byte order,
3085 * Determining the default GW on Android 5.0+ is non trivial
3086 * and serves almost no purpose since OpenVPN only uses the
3087 * default GW address to add routes for networks that should
3088 * NOT be routed over the VPN. Using a well known address
3089 * (127.'d'.'g'.'w') for the default GW make detecting
3090 * these routes easier from the controlling app.
3091 */
3092 CLEAR(*rgi);
3093
3094 rgi->gateway.addr = 127 << 24 | 'd' << 16 | 'g' << 8 | 'w';
3096 strcpy(rgi->iface, "android-gw");
3097
3098 /* Skip scanning/fetching interface from loopback interface we do
3099 * normally on Linux.
3100 * It always fails and "ioctl(SIOCGIFCONF) failed" confuses users
3101 */
3102}
3103
3104void
3105get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest,
3106 openvpn_net_ctx_t *ctx)
3107{
3108 /* Same for ipv6 */
3109
3110 CLEAR(*rgi6);
3111
3112 /* Use a fake link-local address */
3113 ASSERT(inet_pton(AF_INET6, "fe80::ad", &rgi6->addrs->addr_ipv6) == 1);
3114 rgi6->addrs->netbits_ipv6 = 64;
3116 strcpy(rgi6->iface, "android-gw");
3117}
3118
3119#elif defined(TARGET_LINUX)
3120
3121void
3122get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
3123{
3124 struct gc_arena gc = gc_new();
3125 int sd = -1;
3126 char best_name[IFNAMSIZ];
3127
3128 CLEAR(*rgi);
3129 CLEAR(best_name);
3130
3131 /* find best route to 'dest', get gateway IP addr + interface */
3132 if (net_route_v4_best_gw(ctx, &dest, &rgi->gateway.addr, best_name) == 0)
3133 {
3134 rgi->flags |= RGI_ADDR_DEFINED;
3135 if (!rgi->gateway.addr && best_name[0])
3136 {
3137 rgi->flags |= RGI_ON_LINK;
3138 }
3139 }
3140
3141 /* scan adapter list */
3142 if (rgi->flags & RGI_ADDR_DEFINED)
3143 {
3144 struct ifreq *ifr, *ifend;
3145 in_addr_t addr, netmask;
3146 struct ifreq ifreq;
3147 struct ifconf ifc;
3148 struct ifreq ifs[20]; /* Maximum number of interfaces to scan */
3149
3150 if ((sd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
3151 {
3152 msg(M_WARN, "GDG: socket() failed");
3153 goto done;
3154 }
3155 ifc.ifc_len = sizeof(ifs);
3156 ifc.ifc_req = ifs;
3157 if (ioctl(sd, SIOCGIFCONF, &ifc) < 0)
3158 {
3159 msg(M_WARN, "GDG: ioctl(SIOCGIFCONF) failed");
3160 goto done;
3161 }
3162
3163 /* scan through interface list */
3164 ifend = ifs + (ifc.ifc_len / sizeof(struct ifreq));
3165 for (ifr = ifc.ifc_req; ifr < ifend; ifr++)
3166 {
3167 if (ifr->ifr_addr.sa_family == AF_INET)
3168 {
3169 /* get interface addr */
3170 addr = ntohl(((struct sockaddr_in *)&ifr->ifr_addr)->sin_addr.s_addr);
3171
3172 /* get interface name */
3173 strncpynt(ifreq.ifr_name, ifr->ifr_name, sizeof(ifreq.ifr_name));
3174
3175 /* check that the interface is up */
3176 if (ioctl(sd, SIOCGIFFLAGS, &ifreq) < 0)
3177 {
3178 continue;
3179 }
3180 if (!(ifreq.ifr_flags & IFF_UP))
3181 {
3182 continue;
3183 }
3184
3185 if (rgi->flags & RGI_ON_LINK)
3186 {
3187 /* check that interface name of current interface
3188 * matches interface name of best default route */
3189 if (strcmp(ifreq.ifr_name, best_name))
3190 {
3191 continue;
3192 }
3193#if 0
3194 /* if point-to-point link, use remote addr as route gateway */
3195 if ((ifreq.ifr_flags & IFF_POINTOPOINT) && ioctl(sd, SIOCGIFDSTADDR, &ifreq) >= 0)
3196 {
3197 rgi->gateway.addr = ntohl(((struct sockaddr_in *) &ifreq.ifr_addr)->sin_addr.s_addr);
3198 if (rgi->gateway.addr)
3199 {
3200 rgi->flags &= ~RGI_ON_LINK;
3201 }
3202 }
3203#endif
3204 }
3205 else
3206 {
3207 /* get interface netmask */
3208 if (ioctl(sd, SIOCGIFNETMASK, &ifreq) < 0)
3209 {
3210 continue;
3211 }
3212 netmask = ntohl(((struct sockaddr_in *)&ifreq.ifr_addr)->sin_addr.s_addr);
3213
3214 /* check that interface matches default route */
3215 if (((rgi->gateway.addr ^ addr) & netmask) != 0)
3216 {
3217 continue;
3218 }
3219
3220 /* save netmask */
3221 rgi->gateway.netmask = netmask;
3222 rgi->flags |= RGI_NETMASK_DEFINED;
3223 }
3224
3225 /* save iface name */
3226 strncpynt(rgi->iface, ifreq.ifr_name, sizeof(rgi->iface));
3227 rgi->flags |= RGI_IFACE_DEFINED;
3228
3229 /* now get the hardware address. */
3230 memset(&ifreq.ifr_hwaddr, 0, sizeof(struct sockaddr));
3231 if (ioctl(sd, SIOCGIFHWADDR, &ifreq) < 0)
3232 {
3233 msg(M_WARN, "GDG: SIOCGIFHWADDR(%s) failed", ifreq.ifr_name);
3234 goto done;
3235 }
3236 memcpy(rgi->hwaddr, &ifreq.ifr_hwaddr.sa_data, 6);
3237 rgi->flags |= RGI_HWADDR_DEFINED;
3238
3239 break;
3240 }
3241 }
3242 }
3243
3244done:
3245 if (sd >= 0)
3246 {
3247 close(sd);
3248 }
3249 gc_free(&gc);
3250}
3251
3252/* IPv6 implementation using netlink
3253 * http://www.linuxjournal.com/article/7356
3254 * netlink(3), netlink(7), rtnetlink(7)
3255 * http://www.virtualbox.org/svn/vbox/trunk/src/VBox/NetworkServices/NAT/rtmon_linux.c
3256 */
3257struct rtreq
3258{
3259 struct nlmsghdr nh;
3260 struct rtmsg rtm;
3261 char attrbuf[512];
3262};
3263
3264void
3265get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest,
3266 openvpn_net_ctx_t *ctx)
3267{
3268 int flags;
3269
3270 CLEAR(*rgi6);
3271
3272 if (net_route_v6_best_gw(ctx, dest, &rgi6->gateway.addr_ipv6, rgi6->iface) == 0)
3273 {
3274 if (!IN6_IS_ADDR_UNSPECIFIED(&rgi6->gateway.addr_ipv6))
3275 {
3276 rgi6->flags |= RGI_ADDR_DEFINED;
3277 }
3278
3279 if (strlen(rgi6->iface) > 0)
3280 {
3281 rgi6->flags |= RGI_IFACE_DEFINED;
3282 }
3283 }
3284
3285 /* if we have an interface but no gateway, the destination is on-link */
3286 flags = rgi6->flags & (RGI_IFACE_DEFINED | RGI_ADDR_DEFINED);
3287 if (flags == RGI_IFACE_DEFINED)
3288 {
3289 rgi6->flags |= (RGI_ADDR_DEFINED | RGI_ON_LINK);
3290 if (dest)
3291 {
3292 rgi6->gateway.addr_ipv6 = *dest;
3293 }
3294 }
3295}
3296
3297#elif defined(TARGET_DARWIN) || defined(TARGET_SOLARIS) || defined(TARGET_FREEBSD) \
3298 || defined(TARGET_DRAGONFLY) || defined(TARGET_OPENBSD) || defined(TARGET_NETBSD)
3299
3300#include <sys/types.h>
3301#include <sys/socket.h>
3302#include <netinet/in.h>
3303#include <net/route.h>
3304#include <net/if_dl.h>
3305#if !defined(TARGET_SOLARIS)
3306#include <ifaddrs.h>
3307#endif
3308
3309struct rtmsg
3310{
3311 struct rt_msghdr m_rtm;
3312 char m_space[512];
3313};
3314
3315/* the route socket code is identical for all 4 supported BSDs and for
3316 * MacOS X (Darwin), with one crucial difference: when going from
3317 * 32 bit to 64 bit, FreeBSD/OpenBSD increased the structure size but kept
3318 * source code compatibility by keeping the use of "long", while
3319 * MacOS X decided to keep binary compatibility by *changing* the API
3320 * to use "uint32_t", thus 32 bit on all OS X variants
3321 *
3322 * NetBSD does the MacOS way of "fixed number of bits, no matter if
3323 * 32 or 64 bit OS", but chose uint64_t. For maximum portability, we
3324 * just use the OS RT_ROUNDUP() macro, which is guaranteed to be correct.
3325 *
3326 * We used to have a large amount of duplicate code here which really
3327 * differed only in this (long) vs. (uint32_t) - IMHO, worse than
3328 * having a combined block for all BSDs with this single #ifdef inside
3329 */
3330
3331#if defined(TARGET_DARWIN)
3332#define ROUNDUP(a) ((a) > 0 ? (1 + (((a) - 1) | (sizeof(uint32_t) - 1))) : sizeof(uint32_t))
3333#elif defined(TARGET_NETBSD)
3334#define ROUNDUP(a) RT_ROUNDUP(a)
3335#else
3336#define ROUNDUP(a) ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
3337#endif
3338
3339#if defined(TARGET_SOLARIS)
3340#define NEXTADDR(w, u) \
3341 if (rtm_addrs & (w)) \
3342 { \
3343 l = sizeof(u); \
3344 memmove(cp, &(u), l); \
3345 cp += ROUNDUP(l); \
3346 }
3347
3348#define ADVANCE(x, n) (x += ROUNDUP(sizeof(struct sockaddr_in)))
3349#else /* if defined(TARGET_SOLARIS) */
3350#define NEXTADDR(w, u) \
3351 if (rtm_addrs & (w)) \
3352 { \
3353 l = ((struct sockaddr *)&(u))->sa_len; \
3354 memmove(cp, &(u), l); \
3355 cp += ROUNDUP(l); \
3356 }
3357
3358#define ADVANCE(x, n) (x += ROUNDUP((n)->sa_len))
3359#endif
3360
3361#define max(a, b) ((a) > (b) ? (a) : (b))
3362
3363void
3364get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
3365{
3366 struct gc_arena gc = gc_new();
3367 struct rtmsg m_rtmsg;
3368 int sockfd = -1;
3369 int seq, l, pid, rtm_addrs;
3370 unsigned int i;
3371 struct sockaddr so_dst, so_mask;
3372 char *cp = m_rtmsg.m_space;
3373 struct sockaddr *gate = NULL, *ifp = NULL, *sa;
3374 struct rt_msghdr *rtm_aux;
3375
3376#define rtm m_rtmsg.m_rtm
3377
3378 CLEAR(*rgi);
3379
3380 /* setup data to send to routing socket */
3381 pid = getpid();
3382 seq = 0;
3383#ifdef TARGET_OPENBSD
3384 rtm_addrs = RTA_DST | RTA_NETMASK; /* Kernel refuses RTA_IFP */
3385#else
3386 rtm_addrs = RTA_DST | RTA_NETMASK | RTA_IFP;
3387#endif
3388
3389 bzero(&m_rtmsg, sizeof(m_rtmsg));
3390 bzero(&so_dst, sizeof(so_dst));
3391 bzero(&so_mask, sizeof(so_mask));
3392 bzero(&rtm, sizeof(struct rt_msghdr));
3393
3394 rtm.rtm_type = RTM_GET;
3395 rtm.rtm_flags = RTF_UP | RTF_GATEWAY;
3396 rtm.rtm_version = RTM_VERSION;
3397 rtm.rtm_seq = ++seq;
3398#ifdef TARGET_OPENBSD
3399 rtm.rtm_tableid = getrtable();
3400#endif
3401 rtm.rtm_addrs = rtm_addrs;
3402
3403 so_dst.sa_family = AF_INET;
3404 so_mask.sa_family = AF_INET;
3405
3406#ifndef TARGET_SOLARIS
3407 so_dst.sa_len = sizeof(struct sockaddr_in);
3408 so_mask.sa_len = sizeof(struct sockaddr_in);
3409#endif
3410
3411 NEXTADDR(RTA_DST, so_dst);
3412 NEXTADDR(RTA_NETMASK, so_mask);
3413
3414 rtm.rtm_msglen = l = cp - (char *)&m_rtmsg;
3415
3416 /* transact with routing socket */
3417 sockfd = socket(PF_ROUTE, SOCK_RAW, 0);
3418 if (sockfd < 0)
3419 {
3420 msg(M_WARN, "GDG: socket #1 failed");
3421 goto done;
3422 }
3423 if (write(sockfd, (char *)&m_rtmsg, l) < 0)
3424 {
3425 msg(M_WARN | M_ERRNO, "GDG: problem writing to routing socket");
3426 goto done;
3427 }
3428 do
3429 {
3430 l = read(sockfd, (char *)&m_rtmsg, sizeof(m_rtmsg));
3431 } while (l > 0 && (rtm.rtm_seq != seq || rtm.rtm_pid != pid));
3432 close(sockfd);
3433 sockfd = -1;
3434
3435 /* extract return data from routing socket */
3436 rtm_aux = &rtm;
3437 cp = ((char *)(rtm_aux + 1));
3438 if (rtm_aux->rtm_addrs)
3439 {
3440 for (i = 1; i; i <<= 1)
3441 {
3442 if (i & rtm_aux->rtm_addrs)
3443 {
3444 sa = (struct sockaddr *)cp;
3445 if (i == RTA_GATEWAY)
3446 {
3447 gate = sa;
3448 }
3449 else if (i == RTA_IFP)
3450 {
3451 ifp = sa;
3452 }
3453 ADVANCE(cp, sa);
3454 }
3455 }
3456 }
3457 else
3458 {
3459 goto done;
3460 }
3461
3462 /* get gateway addr and interface name */
3463 if (gate != NULL)
3464 {
3465 /* get default gateway addr */
3466 rgi->gateway.addr = ntohl(((struct sockaddr_in *)gate)->sin_addr.s_addr);
3467 if (rgi->gateway.addr)
3468 {
3469 rgi->flags |= RGI_ADDR_DEFINED;
3470 }
3471
3472 if (ifp)
3473 {
3474 /* get interface name */
3475 const struct sockaddr_dl *adl = (struct sockaddr_dl *)ifp;
3476 if (adl->sdl_nlen && adl->sdl_nlen < sizeof(rgi->iface))
3477 {
3478 memcpy(rgi->iface, adl->sdl_data, adl->sdl_nlen);
3479 rgi->iface[adl->sdl_nlen] = '\0';
3480 rgi->flags |= RGI_IFACE_DEFINED;
3481 }
3482 }
3483 }
3484
3485 /* get netmask of interface that owns default gateway */
3486 if (rgi->flags & RGI_IFACE_DEFINED)
3487 {
3488 struct ifreq ifr;
3489
3490 sockfd = socket(AF_INET, SOCK_DGRAM, 0);
3491 if (sockfd < 0)
3492 {
3493 msg(M_WARN, "GDG: socket #2 failed");
3494 goto done;
3495 }
3496
3497 CLEAR(ifr);
3498 ifr.ifr_addr.sa_family = AF_INET;
3499 strncpynt(ifr.ifr_name, rgi->iface, IFNAMSIZ);
3500
3501 if (ioctl(sockfd, SIOCGIFNETMASK, (char *)&ifr) < 0)
3502 {
3503 msg(M_WARN, "GDG: ioctl #1 failed");
3504 goto done;
3505 }
3506 close(sockfd);
3507 sockfd = -1;
3508
3509 rgi->gateway.netmask = ntohl(((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr.s_addr);
3510 rgi->flags |= RGI_NETMASK_DEFINED;
3511 }
3512
3513 /* try to read MAC addr associated with interface that owns default gateway */
3514 if (rgi->flags & RGI_IFACE_DEFINED)
3515 {
3516#if defined(TARGET_SOLARIS)
3517 /* OpenSolaris has getifaddrs(3), but it does not return AF_LINK */
3518 sockfd = socket(AF_INET, SOCK_DGRAM, 0);
3519 if (sockfd < 0)
3520 {
3521 msg(M_WARN, "GDG: socket #3 failed");
3522 goto done;
3523 }
3524
3525 struct ifreq ifreq = { 0 };
3526
3527 /* now get the hardware address. */
3528 strncpynt(ifreq.ifr_name, rgi->iface, sizeof(ifreq.ifr_name));
3529 if (ioctl(sockfd, SIOCGIFHWADDR, &ifreq) < 0)
3530 {
3531 msg(M_WARN, "GDG: SIOCGIFHWADDR(%s) failed", ifreq.ifr_name);
3532 }
3533 else
3534 {
3535 memcpy(rgi->hwaddr, &ifreq.ifr_addr.sa_data, 6);
3536 rgi->flags |= RGI_HWADDR_DEFINED;
3537 }
3538#else /* if defined(TARGET_SOLARIS) */
3539 struct ifaddrs *ifap, *ifa;
3540
3541 if (getifaddrs(&ifap) != 0)
3542 {
3543 msg(M_WARN | M_ERRNO, "GDG: getifaddrs() failed");
3544 goto done;
3545 }
3546
3547 for (ifa = ifap; ifa; ifa = ifa->ifa_next)
3548 {
3549 if (ifa->ifa_addr != NULL && ifa->ifa_addr->sa_family == AF_LINK
3550 && !strncmp(ifa->ifa_name, rgi->iface, IFNAMSIZ))
3551 {
3552 struct sockaddr_dl *sdl = (struct sockaddr_dl *)ifa->ifa_addr;
3553 memcpy(rgi->hwaddr, LLADDR(sdl), 6);
3554 rgi->flags |= RGI_HWADDR_DEFINED;
3555 }
3556 }
3557
3558 freeifaddrs(ifap);
3559#endif /* if defined(TARGET_SOLARIS) */
3560 }
3561
3562done:
3563 if (sockfd >= 0)
3564 {
3565 close(sockfd);
3566 }
3567 gc_free(&gc);
3568}
3569
3570/* BSD implementation using routing socket (as does IPv4)
3571 * (the code duplication is somewhat unavoidable if we want this to
3572 * work on OpenSolaris as well. *sigh*)
3573 */
3574
3575/* Solaris has no length field - this is ugly, but less #ifdef in total
3576 */
3577#if defined(TARGET_SOLARIS)
3578#undef ADVANCE
3579#define ADVANCE(x, n) (x += ROUNDUP(sizeof(struct sockaddr_in6)))
3580#endif
3581
3582void
3583get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest,
3584 openvpn_net_ctx_t *ctx)
3585{
3586 struct rtmsg m_rtmsg;
3587 int sockfd = -1;
3588 int seq, l, pid, rtm_addrs;
3589 unsigned int i;
3590 struct sockaddr_in6 so_dst, so_mask;
3591 char *cp = m_rtmsg.m_space;
3592 struct sockaddr *gate = NULL, *ifp = NULL, *sa;
3593 struct rt_msghdr *rtm_aux;
3594
3595 CLEAR(*rgi6);
3596
3597 /* setup data to send to routing socket */
3598 pid = getpid();
3599 seq = 0;
3600#ifdef TARGET_OPENBSD
3601 rtm_addrs = RTA_DST | RTA_NETMASK; /* Kernel refuses RTA_IFP */
3602#else
3603 rtm_addrs = RTA_DST | RTA_NETMASK | RTA_IFP;
3604#endif
3605
3606 bzero(&m_rtmsg, sizeof(m_rtmsg));
3607 bzero(&so_dst, sizeof(so_dst));
3608 bzero(&so_mask, sizeof(so_mask));
3609 bzero(&rtm, sizeof(struct rt_msghdr));
3610
3611 rtm.rtm_type = RTM_GET;
3612 rtm.rtm_flags = RTF_UP;
3613 rtm.rtm_version = RTM_VERSION;
3614 rtm.rtm_seq = ++seq;
3615#ifdef TARGET_OPENBSD
3616 rtm.rtm_tableid = getrtable();
3617#endif
3618
3619 so_dst.sin6_family = AF_INET6;
3620 so_mask.sin6_family = AF_INET6;
3621
3622 if (dest != NULL /* specific host? */
3623 && !IN6_IS_ADDR_UNSPECIFIED(dest))
3624 {
3625 so_dst.sin6_addr = *dest;
3626 /* :: needs /0 "netmask", host route wants "no netmask */
3627 rtm_addrs &= ~RTA_NETMASK;
3628 }
3629
3630 rtm.rtm_addrs = rtm_addrs;
3631
3632#ifndef TARGET_SOLARIS
3633 so_dst.sin6_len = sizeof(struct sockaddr_in6);
3634 so_mask.sin6_len = sizeof(struct sockaddr_in6);
3635#endif
3636
3637 NEXTADDR(RTA_DST, so_dst);
3638 NEXTADDR(RTA_NETMASK, so_mask);
3639
3640 rtm.rtm_msglen = l = cp - (char *)&m_rtmsg;
3641
3642 /* transact with routing socket */
3643 sockfd = socket(PF_ROUTE, SOCK_RAW, 0);
3644 if (sockfd < 0)
3645 {
3646 msg(M_WARN, "GDG6: socket #1 failed");
3647 goto done;
3648 }
3649 if (write(sockfd, (char *)&m_rtmsg, l) < 0)
3650 {
3651 msg(M_WARN | M_ERRNO, "GDG6: problem writing to routing socket");
3652 goto done;
3653 }
3654
3655 do
3656 {
3657 l = read(sockfd, (char *)&m_rtmsg, sizeof(m_rtmsg));
3658 } while (l > 0 && (rtm.rtm_seq != seq || rtm.rtm_pid != pid));
3659
3660 close(sockfd);
3661 sockfd = -1;
3662
3663 /* extract return data from routing socket */
3664 rtm_aux = &rtm;
3665 cp = ((char *)(rtm_aux + 1));
3666 if (rtm_aux->rtm_addrs)
3667 {
3668 for (i = 1; i; i <<= 1)
3669 {
3670 if (i & rtm_aux->rtm_addrs)
3671 {
3672 sa = (struct sockaddr *)cp;
3673 if (i == RTA_GATEWAY)
3674 {
3675 gate = sa;
3676 }
3677 else if (i == RTA_IFP)
3678 {
3679 ifp = sa;
3680 }
3681 ADVANCE(cp, sa);
3682 }
3683 }
3684 }
3685 else
3686 {
3687 goto done;
3688 }
3689
3690 /* get gateway addr and interface name */
3691 if (gate != NULL)
3692 {
3693 struct sockaddr_in6 *s6 = (struct sockaddr_in6 *)gate;
3694 struct in6_addr gw = s6->sin6_addr;
3695
3696#ifndef TARGET_SOLARIS
3697 /* You do not really want to know... from FreeBSD's route.c
3698 * (KAME encodes the 16 bit scope_id in s6_addr[2] + [3],
3699 * but for a correct link-local address these must be :0000: )
3700 */
3701 if (gate->sa_len == sizeof(struct sockaddr_in6) && IN6_IS_ADDR_LINKLOCAL(&gw))
3702 {
3703 gw.s6_addr[2] = gw.s6_addr[3] = 0;
3704 }
3705
3706 if (gate->sa_len != sizeof(struct sockaddr_in6) || IN6_IS_ADDR_UNSPECIFIED(&gw))
3707 {
3708 rgi6->flags |= RGI_ON_LINK;
3709 }
3710 else
3711#endif
3712 {
3713 rgi6->gateway.addr_ipv6 = gw;
3714 }
3715 rgi6->flags |= RGI_ADDR_DEFINED;
3716
3717 if (ifp)
3718 {
3719 /* get interface name */
3720 const struct sockaddr_dl *adl = (struct sockaddr_dl *)ifp;
3721 if (adl->sdl_nlen && adl->sdl_nlen < sizeof(rgi6->iface))
3722 {
3723 memcpy(rgi6->iface, adl->sdl_data, adl->sdl_nlen);
3724 rgi6->flags |= RGI_IFACE_DEFINED;
3725 }
3726 }
3727 }
3728
3729done:
3730 if (sockfd >= 0)
3731 {
3732 close(sockfd);
3733 }
3734}
3735
3736#undef max
3737
3738#elif defined(TARGET_HAIKU)
3739
3740void
3741get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
3742{
3743 CLEAR(*rgi);
3744
3745 int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
3746 if (sockfd < 0)
3747 {
3748 msg(M_ERRNO, "%s: Error opening socket for AF_INET", __func__);
3749 return;
3750 }
3751
3752 struct ifconf config;
3753 config.ifc_len = sizeof(config.ifc_value);
3754 if (ioctl(sockfd, SIOCGRTSIZE, &config, sizeof(struct ifconf)) < 0)
3755 {
3756 msg(M_ERRNO, "%s: Error getting routing table size", __func__);
3757 return;
3758 }
3759
3760 uint32 size = (uint32)config.ifc_value;
3761 if (size == 0)
3762 {
3763 return;
3764 }
3765
3766 void *buffer = malloc(size);
3768
3769 config.ifc_len = size;
3770 config.ifc_buf = buffer;
3771 if (ioctl(sockfd, SIOCGRTTABLE, &config, sizeof(struct ifconf)) < 0)
3772 {
3773 free(buffer);
3774 return;
3775 }
3776
3777 struct ifreq *interface = (struct ifreq *)buffer;
3778 struct ifreq *end = (struct ifreq *)((uint8 *)buffer + size);
3779
3780 while (interface < end)
3781 {
3782 struct route_entry route = interface->ifr_route;
3783 if ((route.flags & RTF_GATEWAY) != 0 && (route.flags & RTF_DEFAULT) != 0)
3784 {
3785 rgi->gateway.addr = ntohl(((struct sockaddr_in *)route.gateway)->sin_addr.s_addr);
3787 strncpy(rgi->iface, interface->ifr_name, sizeof(rgi->iface));
3788 }
3789
3790 int32 address_size = 0;
3791 if (route.destination != NULL)
3792 {
3793 address_size += route.destination->sa_len;
3794 }
3795 if (route.mask != NULL)
3796 {
3797 address_size += route.mask->sa_len;
3798 }
3799 if (route.gateway != NULL)
3800 {
3801 address_size += route.gateway->sa_len;
3802 }
3803
3804 interface = (struct ifreq *)((addr_t)interface + IF_NAMESIZE + sizeof(struct route_entry)
3805 + address_size);
3806 }
3807 free(buffer);
3808}
3809
3810void
3811get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest,
3812 openvpn_net_ctx_t *ctx)
3813{
3814 /* TODO: Same for ipv6 with AF_INET6 */
3815 CLEAR(*rgi6);
3816}
3817
3818#else /* if defined(_WIN32) */
3819
3820/*
3821 * This is a platform-specific method that returns data about
3822 * the current default gateway. Return data is placed into
3823 * a struct route_gateway_info object provided by caller. The
3824 * implementation should CLEAR the structure before adding
3825 * data to it.
3826 *
3827 * Data returned includes:
3828 * 1. default gateway address (rgi->gateway.addr)
3829 * 2. netmask of interface that owns default gateway
3830 * (rgi->gateway.netmask)
3831 * 3. hardware address (i.e. MAC address) of interface that owns
3832 * default gateway (rgi->hwaddr)
3833 * 4. interface name (or adapter index on Windows) that owns default
3834 * gateway (rgi->iface or rgi->adapter_index)
3835 * 5. an array of additional address/netmask pairs defined by
3836 * interface that owns default gateway (rgi->addrs with length
3837 * given in rgi->n_addrs)
3838 *
3839 * The flags RGI_x_DEFINED may be used to indicate which of the data
3840 * members were successfully returned (set in rgi->flags). All of
3841 * the data members are optional, however certain OpenVPN functionality
3842 * may be disabled by missing items.
3843 */
3844void
3845get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
3846{
3847 CLEAR(*rgi);
3848}
3849void
3850get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest,
3851 openvpn_net_ctx_t *ctx)
3852{
3853 msg(D_ROUTE, "no support for get_default_gateway_ipv6() on this system");
3854 CLEAR(*rgi6);
3855}
3856
3857#endif /* if defined(_WIN32) */
3858
3859bool
3860netmask_to_netbits(const in_addr_t network, const in_addr_t netmask, int *netbits)
3861{
3862 int i;
3863 const int addrlen = sizeof(in_addr_t) * 8;
3864
3865 if ((network & netmask) == network)
3866 {
3867 for (i = 0; i <= addrlen; ++i)
3868 {
3869 in_addr_t mask = netbits_to_netmask(i);
3870 if (mask == netmask)
3871 {
3872 if (i == addrlen)
3873 {
3874 *netbits = -1;
3875 }
3876 else
3877 {
3878 *netbits = i;
3879 }
3880 return true;
3881 }
3882 }
3883 }
3884 return false;
3885}
3886
3887/* similar to netmask_to_netbits(), but don't mess with base address
3888 * etc., just convert to netbits - non-mappable masks are returned as "-1"
3889 */
3890int
3891netmask_to_netbits2(in_addr_t netmask)
3892{
3893 int i;
3894 const int addrlen = sizeof(in_addr_t) * 8;
3895
3896 for (i = 0; i <= addrlen; ++i)
3897 {
3898 in_addr_t mask = netbits_to_netmask(i);
3899 if (mask == netmask)
3900 {
3901 return i;
3902 }
3903 }
3904 return -1;
3905}
3906
3907
3908/*
3909 * get_bypass_addresses() is used by the redirect-gateway bypass-x
3910 * functions to build a route bypass to selected DHCP/DNS servers,
3911 * so that outgoing packets to these servers don't end up in the tunnel.
3912 */
3913
3914#if defined(_WIN32)
3915
3916static void
3917add_host_route_if_nonlocal(struct route_bypass *rb, const in_addr_t addr)
3918{
3919 if (test_local_addr(addr, NULL) == TLA_NONLOCAL && addr != 0 && addr != IPV4_NETMASK_HOST)
3920 {
3921 add_bypass_address(rb, addr);
3922 }
3923}
3924
3925static void
3926add_host_route_array(struct route_bypass *rb, const IP_ADDR_STRING *iplist)
3927{
3928 while (iplist)
3929 {
3930 bool succeed = false;
3931 const in_addr_t ip =
3932 getaddr(GETADDR_HOST_ORDER, iplist->IpAddress.String, 0, &succeed, NULL);
3933 if (succeed)
3934 {
3936 }
3937 iplist = iplist->Next;
3938 }
3939}
3940
3941static void
3942get_bypass_addresses(struct route_bypass *rb, const unsigned int flags)
3943{
3944 struct gc_arena gc = gc_new();
3945 /*bool ret_bool = false;*/
3946
3947 /* get full routing table */
3948 const MIB_IPFORWARDTABLE *routes = get_windows_routing_table(&gc);
3949
3950 /* get the route which represents the default gateway */
3951 const MIB_IPFORWARDROW *row = get_default_gateway_row(routes);
3952
3953 if (row)
3954 {
3955 /* get the adapter which the default gateway is associated with */
3956 const IP_ADAPTER_INFO *dgi = get_adapter_info(row->dwForwardIfIndex, &gc);
3957
3958 /* get extra adapter info, such as DNS addresses */
3959 const IP_PER_ADAPTER_INFO *pai = get_per_adapter_info(row->dwForwardIfIndex, &gc);
3960
3961 /* Bypass DHCP server address */
3962 if ((flags & RG_BYPASS_DHCP) && dgi && dgi->DhcpEnabled)
3963 {
3964 add_host_route_array(rb, &dgi->DhcpServer);
3965 }
3966
3967 /* Bypass DNS server addresses */
3968 if ((flags & RG_BYPASS_DNS) && pai)
3969 {
3970 add_host_route_array(rb, &pai->DnsServerList);
3971 }
3972 }
3973
3974 gc_free(&gc);
3975}
3976
3977#else /* if defined(_WIN32) */
3978
3979static void
3980get_bypass_addresses(struct route_bypass *rb, const unsigned int flags) /* PLATFORM-SPECIFIC */
3981{
3982}
3983
3984#endif /* if defined(_WIN32) */
3985
3986/*
3987 * Test if addr is reachable via a local interface (return ILA_LOCAL),
3988 * or if it needs to be routed via the default gateway (return
3989 * ILA_NONLOCAL). If the target platform doesn't implement this
3990 * function, return ILA_NOT_IMPLEMENTED.
3991 *
3992 * Used by redirect-gateway autolocal feature
3993 */
3994
3995#if defined(_WIN32)
3996
3997int
3998test_local_addr(const in_addr_t addr, const struct route_gateway_info *rgi)
3999{
4000 struct gc_arena gc = gc_new();
4001 const in_addr_t nonlocal_netmask =
4002 0x80000000L; /* routes with netmask <= to this are considered non-local */
4003 int ret = TLA_NONLOCAL;
4004
4005 /* get full routing table */
4006 const MIB_IPFORWARDTABLE *rt = get_windows_routing_table(&gc);
4007 if (rt)
4008 {
4009 for (DWORD i = 0; i < rt->dwNumEntries; ++i)
4010 {
4011 const MIB_IPFORWARDROW *row = &rt->table[i];
4012 const in_addr_t net = ntohl(row->dwForwardDest);
4013 const in_addr_t mask = ntohl(row->dwForwardMask);
4014 if (mask > nonlocal_netmask && (addr & mask) == net)
4015 {
4016 ret = TLA_LOCAL;
4017 break;
4018 }
4019 }
4020 }
4021
4022 gc_free(&gc);
4023 return ret;
4024}
4025
4026#else /* if defined(_WIN32) */
4027
4028int
4029test_local_addr(const in_addr_t addr, const struct route_gateway_info *rgi) /* PLATFORM-SPECIFIC */
4030{
4031 if (rgi)
4032 {
4033 if (local_route(addr, 0xFFFFFFFF, rgi->gateway.addr, rgi))
4034 {
4035 return TLA_LOCAL;
4036 }
4037 else
4038 {
4039 return TLA_NONLOCAL;
4040 }
4041 }
4042 return TLA_NOT_IMPLEMENTED;
4043}
4044
4045#endif /* if defined(_WIN32) */
void argv_msg(const int msglev, const struct argv *a)
Write the arguments stored in a struct argv via the msg() command.
Definition argv.c:242
void argv_free(struct argv *a)
Frees all memory allocations allocated by the struct argv related functions.
Definition argv.c:101
bool argv_printf(struct argv *argres, const char *format,...)
printf() variant which populates a struct argv.
Definition argv.c:438
bool argv_printf_cat(struct argv *argres, const char *format,...)
printf() inspired argv concatenation.
Definition argv.c:462
struct argv argv_new(void)
Allocates a new struct argv and ensures it is initialised.
Definition argv.c:87
bool buf_printf(struct buffer *buf, const char *format,...)
Definition buffer.c:241
char * format_hex_ex(const uint8_t *data, int size, int maxoutput, unsigned int space_break_flags, const char *separator, struct gc_arena *gc)
Definition buffer.c:483
void * gc_malloc(size_t size, bool clear, struct gc_arena *a)
Definition buffer.c:336
struct buffer alloc_buf_gc(size_t size, struct gc_arena *gc)
Definition buffer.c:89
void gc_addspecial(void *addr, void(*free_function)(void *), struct gc_arena *a)
Definition buffer.c:438
#define BSTR(buf)
Definition buffer.h:128
#define ALLOC_OBJ_CLEAR_GC(dptr, type, gc)
Definition buffer.h:1079
#define ALLOC_OBJ_GC(dptr, type, gc)
Definition buffer.h:1074
static void strncpynt(char *dest, const char *src, size_t maxlen)
Definition buffer.h:361
static void check_malloc_return(void *p)
Definition buffer.h:1085
static void gc_free(struct gc_arena *a)
Definition buffer.h:1015
static void gc_freeaddrinfo_callback(void *addr)
Definition buffer.h:215
static struct gc_arena gc_new(void)
Definition buffer.h:1007
void setenv_int(struct env_set *es, const char *name, int value)
Definition env_set.c:291
void setenv_str(struct env_set *es, const char *name, const char *value)
Definition env_set.c:307
#define D_ROUTE_DEBUG
Definition errlevel.h:132
#define M_INFO
Definition errlevel.h:54
#define D_ROUTE
Definition errlevel.h:79
static SERVICE_STATUS status
Definition interactive.c:51
@ route
Definition interactive.c:85
@ write
@ read
void management_set_state(struct management *man, const int state, const char *detail, const in_addr_t *tun_local_ip, const struct in6_addr *tun_local_ip6, const struct openvpn_sockaddr *local, const struct openvpn_sockaddr *remote)
Definition manage.c:2778
#define OPENVPN_STATE_ADD_ROUTES
Definition manage.h:451
static void net_ctx_reset(openvpn_net_ctx_t *ctx)
Definition networking.h:56
void * openvpn_net_ctx_t
Definition networking.h:38
@ msg_add_route
Definition openvpn-msg.h:34
@ msg_del_route
Definition openvpn-msg.h:35
#define IPV4_NETMASK_HOST
Definition basic.h:34
#define CLEAR(x)
Definition basic.h:32
const char * strerror_win32(DWORD errnum, struct gc_arena *gc)
Definition error.c:782
#define M_FATAL
Definition error.h:88
#define dmsg(flags,...)
Definition error.h:170
#define msg(flags,...)
Definition error.h:150
#define ASSERT(x)
Definition error.h:217
#define M_WARN
Definition error.h:90
#define M_ERRNO
Definition error.h:93
#define DEV_TYPE_TAP
Definition proto.h:36
#define DEV_TYPE_TUN
Definition proto.h:35
static void undo_redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1054
static bool route_ipv6_match_host(const struct route_ipv6 *r6, const struct in6_addr *host)
Definition route.c:718
static void add_host_route_if_nonlocal(struct route_bypass *rb, const in_addr_t addr)
Definition route.c:3917
bool add_routes(struct route_list *rl, struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1101
bool is_special_addr(const char *addr_str)
Definition route.c:299
struct route_option_list * clone_route_option_list(const struct route_option_list *src, struct gc_arena *a)
Definition route.c:153
void setenv_routes_ipv6(struct env_set *es, const struct route_ipv6_list *rl6)
Definition route.c:1404
static void clear_route_list(struct route_list *rl)
Definition route.c:521
static void test_route_helper(bool *ret, int *count, int *good, int *ambig, const IP_ADAPTER_INFO *adapters, const in_addr_t gateway)
Definition route.c:2409
static void del_bypass_routes(struct route_bypass *rb, in_addr_t gateway, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:930
static bool del_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt)
Definition route.c:2801
static bool redirect_default_route_to_vpn(struct route_list *rl, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:946
static bool add_route3(in_addr_t network, in_addr_t netmask, in_addr_t gateway, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:884
static void add_host_route_array(struct route_bypass *rb, const IP_ADDR_STRING *iplist)
Definition route.c:3926
int netmask_to_netbits2(in_addr_t netmask)
Definition route.c:3891
struct route_ipv6_option_list * new_route_ipv6_option_list(struct gc_arena *a)
Definition route.c:137
static bool init_route(struct route_ipv4 *r, struct addrinfo **network_list, const struct route_option *ro, const struct route_list *rl)
Definition route.c:312
void delete_routes_v6(struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1196
static const char * route_string(const struct route_ipv4 *r, struct gc_arena *gc)
Definition route.c:187
static bool get_special_addr(const struct route_list *rl, const char *string, in_addr_t *out, bool *status)
Definition route.c:231
#define RTA_EEXIST
Definition route.c:103
#define LR_NOMATCH
Definition route.c:1433
bool test_routes(const struct route_list *rl, const struct tuntap *tt)
Definition route.c:2434
static void add_block_local_routes(struct route_list *rl)
Definition route.c:572
bool block_local_needed(const struct route_list *rl)
Get the decision whether to block traffic to local networks while the VPN is connected.
Definition route.c:596
void get_default_gateway_ipv6(struct route_ipv6_gateway_info *rgi6, const struct in6_addr *dest, openvpn_net_ctx_t *ctx)
Definition route.c:2659
static const MIB_IPFORWARDTABLE * get_windows_routing_table(struct gc_arena *gc)
Definition route.c:2375
static DWORD get_best_route(struct gc_arena *gc, SOCKADDR_INET *dest, MIB_IPFORWARD_ROW2 *best_route)
Determines the best route to a destination for both IPv4 and IPv6.
Definition route.c:2525
void show_routes(int msglev)
Definition route.c:3062
static const char * format_route_entry(const MIB_IPFORWARDROW *r, struct gc_arena *gc)
Definition route.c:3044
static void print_route_option(const struct route_option *ro, int level)
Definition route.c:1231
static int add_route_service(const struct route_ipv4 *, const struct tuntap *)
Definition route.c:3019
bool init_route_ipv6_list(struct route_ipv6_list *rl6, const struct route_ipv6_option_list *opt6, const char *remote_endpoint, int default_metric, const struct in6_addr *remote_host_ipv6, struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:753
void print_route_options(const struct route_option_list *rol, int level)
Definition route.c:1238
static void delete_route(struct route_ipv4 *r, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:2026
static bool del_route_ipv6_service(const struct route_ipv6 *, const struct tuntap *)
Definition route.c:3038
void route_list_add_vpn_gateway(struct route_list *rl, struct env_set *es, const in_addr_t addr)
Definition route.c:535
void add_route_ipv6_to_option_list(struct route_ipv6_option_list *l, const char *prefix, const char *gateway, const char *metric, int table_id)
Definition route.c:507
void print_default_gateway(const int msglevel, const struct route_gateway_info *rgi, const struct route_ipv6_gateway_info *rgi6)
Definition route.c:1252
void copy_route_option_list(struct route_option_list *dest, const struct route_option_list *src, struct gc_arena *a)
Definition route.c:171
void copy_route_ipv6_option_list(struct route_ipv6_option_list *dest, const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:179
bool add_route(struct route_ipv4 *r, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1480
static int test_route(const IP_ADAPTER_INFO *adapters, const in_addr_t gateway, DWORD *index)
Definition route.c:2397
bool add_route_ipv6(struct route_ipv6 *r6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1790
static void print_route(const struct route_ipv4 *r, int level)
Definition route.c:1326
#define RTA_ERROR
Definition route.c:101
static bool del_route_service(const struct route_ipv4 *, const struct tuntap *)
Definition route.c:3025
static int local_route(in_addr_t network, in_addr_t netmask, in_addr_t gateway, const struct route_gateway_info *rgi)
Definition route.c:1438
static int add_route_ipv6_service(const struct route_ipv6 *, const struct tuntap *)
Definition route.c:3032
static bool is_on_link(const int is_local_route, const unsigned int flags, const struct route_gateway_info *rgi)
Definition route.c:1471
static const MIB_IPFORWARDROW * get_default_gateway_row(const MIB_IPFORWARDTABLE *routes)
Definition route.c:2477
void get_default_gateway(struct route_gateway_info *rgi, in_addr_t dest, openvpn_net_ctx_t *ctx)
Retrieves the best gateway for a given destination based on the routing table.
Definition route.c:2561
static int route_ipv6_ipapi(bool add, const struct route_ipv6 *, const struct tuntap *)
Definition route.c:2899
static void add_block_local_item(struct route_list *rl, const struct route_gateway_address *gateway, in_addr_t target)
Definition route.c:544
struct route_ipv6_option_list * clone_route_ipv6_option_list(const struct route_ipv6_option_list *src, struct gc_arena *a)
Definition route.c:162
static const char * show_opt(const char *option)
Definition route.c:1218
static bool init_route_ipv6(struct route_ipv6 *r6, const struct route_ipv6_option *r6o, const struct route_ipv6_list *rl6)
Definition route.c:435
struct route_option_list * new_route_option_list(struct gc_arena *a)
Definition route.c:128
int test_local_addr(const in_addr_t addr, const struct route_gateway_info *rgi)
Definition route.c:3998
#define METRIC_NOT_USED
Definition route.c:59
bool init_route_list(struct route_list *rl, const struct route_option_list *opt, const char *remote_endpoint, int default_metric, in_addr_t remote_host, struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:604
static int add_route_ipapi(const struct route_ipv4 *r, const struct tuntap *tt, DWORD adapter_index)
Definition route.c:2705
#define RTA_SUCCESS
Definition route.c:102
void delete_route_ipv6(const struct route_ipv6 *r6, const struct tuntap *tt, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:2198
#define LR_MATCH
Definition route.c:1434
static int do_route_ipv6_service(const bool add, const struct route_ipv6 *r, const struct tuntap *tt)
Definition route.c:2976
static int do_route_service(const bool add, const route_message_t *rt, const size_t size, HANDLE pipe)
Definition route.c:2838
void route_ipv6_clear_host_bits(struct route_ipv6 *r6)
Definition route.c:1765
static void clear_route_ipv6_list(struct route_ipv6_list *rl6)
Definition route.c:528
void delete_routes(struct route_list *rl, struct route_ipv6_list *rl6, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1166
#define LR_ERROR
Definition route.c:1435
void print_routes(const struct route_list *rl, int level)
Definition route.c:1337
bool netmask_to_netbits(const in_addr_t network, const in_addr_t netmask, int *netbits)
Definition route.c:3860
static void setenv_route_addr(struct env_set *es, const char *key, const in_addr_t addr, int i)
Definition route.c:214
static DWORD windows_route_find_if_index(const struct route_ipv4 *r, const struct tuntap *tt)
Definition route.c:2613
static int do_route_ipv4_service(const bool add, const struct route_ipv4 *r, const struct tuntap *tt)
Definition route.c:2870
void setenv_routes(struct env_set *es, const struct route_list *rl)
Definition route.c:1367
void delete_routes_v4(struct route_list *rl, const struct tuntap *tt, unsigned int flags, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:1174
static bool add_bypass_routes(struct route_bypass *rb, in_addr_t gateway, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:912
static void get_bypass_addresses(struct route_bypass *rb, const unsigned int flags)
Definition route.c:3942
static bool is_route_parm_defined(const char *parm)
Definition route.c:200
static void setenv_route_ipv6(struct env_set *es, const struct route_ipv6 *r6, int i)
Definition route.c:1378
static bool add_bypass_address(struct route_bypass *rb, const in_addr_t a)
Definition route.c:106
static void setenv_route(struct env_set *es, const struct route_ipv4 *r, int i)
Definition route.c:1347
void add_route_to_option_list(struct route_option_list *l, const char *network, const char *netmask, const char *gateway, const char *metric, int table_id)
Definition route.c:492
static void del_route3(in_addr_t network, in_addr_t netmask, in_addr_t gateway, const struct tuntap *tt, unsigned int flags, const struct route_gateway_info *rgi, const struct env_set *es, openvpn_net_ctx_t *ctx)
Definition route.c:898
#define RG_LOCAL
Definition route.h:87
#define TLA_LOCAL
Definition route.h:370
#define RGI_ON_LINK
Definition route.h:164
#define RL_DID_LOCAL
Definition route.h:231
#define RL_DID_REDIRECT_DEFAULT_GATEWAY
Definition route.h:230
#define ROUTE_REF_GW
Definition route.h:50
#define RG_BYPASS_DHCP
Definition route.h:89
#define RTSA_REMOTE_ENDPOINT
Definition route.h:62
#define RGI_ADDR_DEFINED
Definition route.h:159
#define RL_ROUTES_ADDED
Definition route.h:232
#define RGI_HWADDR_DEFINED
Definition route.h:161
static in_addr_t netbits_to_netmask(const int netbits)
Definition route.h:399
#define RTSA_REMOTE_HOST
Definition route.h:63
#define ROUTE_METHOD_SERVICE
Definition route.h:42
#define RGI_IFACE_DEFINED
Definition route.h:162
#define ROUTE_METHOD_IPAPI
Definition route.h:40
#define RT_ADDED
Definition route.h:121
#define ROUTE_METHOD_EXE
Definition route.h:41
#define RT_METRIC_DEFINED
Definition route.h:122
#define ROUTE_DELETE_FIRST
Definition route.h:49
#define RG_DEF1
Definition route.h:88
#define RG_BYPASS_DNS
Definition route.h:90
#define RG_ENABLE
Definition route.h:86
#define RG_REROUTE_GW
Definition route.h:91
#define TLA_NOT_IMPLEMENTED
Definition route.h:368
#define ROUTE_METHOD_ADAPTIVE
Definition route.h:39
#define RG_AUTO_LOCAL
Definition route.h:92
#define RG_BLOCK_LOCAL
Definition route.h:93
#define TLA_NONLOCAL
Definition route.h:369
#define N_ROUTE_BYPASS
Definition route.h:54
#define RT_DEFINED
Definition route.h:120
#define ROUTE_METHOD_MASK
Definition route.h:43
#define RTSA_DEFAULT_METRIC
Definition route.h:64
#define RGI_NETMASK_DEFINED
Definition route.h:160
int openvpn_execve_check(const struct argv *a, const struct env_set *es, const unsigned int flags, const char *error_message)
bool get_ipv6_addr(const char *hostname, struct in6_addr *network, unsigned int *netbits, int msglevel)
Translate an IPv6 addr or hostname from string form to in6_addr.
Definition socket.c:214
in_addr_t getaddr(unsigned int flags, const char *hostname, int resolve_retry_seconds, bool *succeeded, struct signal_info *sig_info)
Translate an IPv4 addr or hostname from string form to in_addr_t.
Definition socket.c:187
#define IPV4_INVALID_ADDR
Definition socket.h:327
int openvpn_getaddrinfo(unsigned int flags, const char *hostname, const char *servname, int resolve_retry_seconds, struct signal_info *sig_info, int ai_family, struct addrinfo **res)
const char * print_in6_addr(struct in6_addr a6, unsigned int flags, struct gc_arena *gc)
const char * print_in_addr_t(in_addr_t addr, unsigned int flags, struct gc_arena *gc)
#define IF_NAMESIZE
#define GETADDR_HOST_ORDER
#define GETADDR_RESOLVE
#define IA_NET_ORDER
Definition socket_util.h:90
#define GETADDR_WARN_ON_SIGNAL
Definition argv.h:35
Wrapper structure for dynamically allocated memory.
Definition buffer.h:60
int len
Length in bytes of the actual content within the allocated memory.
Definition buffer.h:65
Garbage collection arena used to keep track of dynamically allocated memory.
Definition buffer.h:116
Container for unidirectional cipher and HMAC key material.
Definition crypto.h:152
int n_bypass
Definition route.h:55
in_addr_t bypass[N_ROUTE_BYPASS]
Definition route.h:56
in_addr_t netmask
Definition route.h:154
uint8_t hwaddr[6]
Definition route.h:177
unsigned int flags
Definition route.h:165
struct route_gateway_address addrs[RGI_N_ADDRESSES]
Definition route.h:185
DWORD adapter_index
Definition route.h:169
struct route_gateway_address gateway
Definition route.h:180
const struct route_option * option
Definition route.h:125
int metric
Definition route.h:130
struct route_ipv4 * next
Definition route.h:123
int table_id
Definition route.h:129
in_addr_t network
Definition route.h:126
in_addr_t netmask
Definition route.h:127
in_addr_t gateway
Definition route.h:128
unsigned int flags
Definition route.h:124
struct in6_addr addr_ipv6
Definition route.h:190
struct route_ipv6_gateway_address gateway
Definition route.h:219
struct route_ipv6_gateway_address addrs[RGI_N_ADDRESSES]
Definition route.h:224
unsigned int flags
Definition route.h:197
uint8_t hwaddr[6]
Definition route.h:216
unsigned int iflags
Definition route.h:244
unsigned int flags
Definition route.h:252
struct route_ipv6_gateway_info rgi6
Definition route.h:251
struct route_ipv6 * routes_ipv6
Definition route.h:253
unsigned int spec_flags
Definition route.h:246
int default_metric
Definition route.h:249
struct in6_addr remote_host_ipv6
Definition route.h:248
struct gc_arena gc
Definition route.h:254
struct in6_addr remote_endpoint_ipv6
Definition route.h:247
unsigned int flags
Definition route.h:113
struct gc_arena * gc
Definition route.h:115
struct route_ipv6_option * routes_ipv6
Definition route.h:114
struct route_ipv6_option * next
Definition route.h:104
const char * gateway
Definition route.h:106
const char * metric
Definition route.h:107
const char * prefix
Definition route.h:105
struct in6_addr gateway
Definition route.h:139
DWORD adapter_index
Definition route.h:144
unsigned int netbits
Definition route.h:138
struct route_ipv6 * next
Definition route.h:135
unsigned int flags
Definition route.h:136
struct in6_addr network
Definition route.h:137
int metric
Definition route.h:140
struct route_gateway_info rgi
Definition route.h:236
struct route_ipv4 * routes
Definition route.h:238
struct route_special_addr spec
Definition route.h:235
unsigned int flags
Definition route.h:237
struct gc_arena gc
Definition route.h:239
unsigned int iflags
Definition route.h:233
message_header_t header
Definition openvpn-msg.h:90
interface_t iface
Definition openvpn-msg.h:95
struct gc_arena * gc
Definition route.h:99
unsigned int flags
Definition route.h:97
struct route_option * routes
Definition route.h:98
int table_id
Definition route.h:81
const char * network
Definition route.h:78
const char * netmask
Definition route.h:79
struct route_option * next
Definition route.h:77
const char * gateway
Definition route.h:80
const char * metric
Definition route.h:82
in_addr_t remote_host
Definition route.h:68
struct route_bypass bypass
Definition route.h:70
unsigned int flags
Definition route.h:65
in_addr_t remote_endpoint
Definition route.h:67
int remote_host_local
Definition route.h:69
HANDLE msg_channel
Definition tun.h:88
Definition tun.h:183
int type
Definition tun.h:185
DWORD adapter_index
Definition tun.h:234
bool did_ifconfig_ipv6_setup
if the internal variables related to ifconfig-ipv6 of this struct have been set up.
Definition tun.h:201
struct tuntap_options options
Definition tun.h:205
bool did_ifconfig_setup
if the internal variables related to ifconfig of this struct have been set up.
Definition tun.h:197
char * actual_name
Definition tun.h:207
static char * iface
struct env_set * es
char * r6[]
char * r1[]
struct gc_arena gc
Definition test_ssl.c:154
const IP_ADAPTER_INFO * get_tun_adapter(const struct tuntap *tt, const IP_ADAPTER_INFO *list)
Definition tun.c:4489
bool is_adapter_up(const struct tuntap *tt, const IP_ADAPTER_INFO *list)
Definition tun.c:4502
const IP_ADAPTER_INFO * get_adapter_info(DWORD index, struct gc_arena *gc)
Definition tun.c:4404
const IP_PER_ADAPTER_INFO * get_per_adapter_info(const DWORD index, struct gc_arena *gc)
Definition tun.c:4302
bool is_ip_in_adapter_subnet(const IP_ADAPTER_INFO *ai, const in_addr_t ip, in_addr_t *highest_netmask)
Definition tun.c:4546
const IP_ADAPTER_INFO * get_adapter_info_list(struct gc_arena *gc)
Definition tun.c:4277
const IP_ADAPTER_INFO * get_adapter(const IP_ADAPTER_INFO *ai, DWORD index)
Definition tun.c:4385
DWORD adapter_index_of_ip(const IP_ADAPTER_INFO *list, const in_addr_t ip, int *count, in_addr_t *netmask)
Definition tun.c:4580
#define TUN_ADAPTER_INDEX_INVALID
Definition tun.h:64
WCHAR * wide_string(const char *utf8, struct gc_arena *gc)
Definition win32-util.c:40
bool send_msg_iservice(HANDLE pipe, const void *data, size_t size, ack_message_t *ack, const char *context)
Definition win32.c:1422
void netcmd_semaphore_release(void)
Definition win32.c:867
char * get_win_sys_path(void)
Definition win32.c:1108
void netcmd_semaphore_lock(void)
Definition win32.c:851
#define WIN_ROUTE_PATH_SUFFIX
Definition win32.h:40