/
script.c
581 lines (488 loc) · 14.5 KB
1
2
3
/*
* OpenConnect (SSL + DTLS) VPN client
*
4
* Copyright © 2008-2015 Intel Corporation.
5
6
7
8
9
10
11
12
13
14
15
16
17
*
* Author: David Woodhouse <dwmw2@infradead.org>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* version 2.1, as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*/
18
19
#include <config.h>
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
#include <sys/types.h>
#include <sys/stat.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#ifndef _WIN32
#include <sys/wait.h>
#endif
#include <errno.h>
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include "openconnect-internal.h"
35
int script_setenv(struct openconnect_info *vpninfo,
36
const char *opt, const char *val, int trunc, int append)
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
{
struct oc_vpn_option *p;
char *str;
for (p = vpninfo->script_env; p; p = p->next) {
if (!strcmp(opt, p->option)) {
if (append) {
if (asprintf(&str, "%s %s", p->value, val) == -1)
return -ENOMEM;
} else
str = val ? strdup(val) : NULL;
free (p->value);
p->value = str;
return 0;
}
}
p = malloc(sizeof(*p));
if (!p)
return -ENOMEM;
p->next = vpninfo->script_env;
p->option = strdup(opt);
59
p->value = val ? (trunc ? strndup(val, trunc) : strdup(val)) : NULL;
60
61
62
63
64
vpninfo->script_env = p;
return 0;
}
int script_setenv_int(struct openconnect_info *vpninfo, const char *opt, int value)
65
66
67
{
char buf[16];
sprintf(buf, "%d", value);
68
return script_setenv(vpninfo, opt, buf, 0, 0);
69
70
71
72
73
74
75
76
77
78
79
80
81
}
static int netmasklen(struct in_addr addr)
{
int masklen;
for (masklen = 0; masklen < 32; masklen++) {
if (ntohl(addr.s_addr) >= (0xffffffff << masklen))
break;
}
return 32 - masklen;
}
82
83
static uint32_t netmaskbits(int masklen)
{
84
85
86
87
if (masklen)
return htonl(0xffffffff << (32-masklen));
else /* Shifting by 32 is invalid, so special-case it */
return 0;
90
91
92
93
94
95
96
static int process_split_xxclude(struct openconnect_info *vpninfo,
int include, const char *route, int *v4_incs,
int *v6_incs)
{
struct in_addr addr;
const char *in_ex = include ? "IN" : "EX";
char envname[80];
97
98
99
const char *slash;
char *endp;
int masklen;
100
101
slash = strchr(route, '/');
102
envname[79] = 0;
103
104
105
106
if (strchr(route, ':')) {
snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_ADDR", in_ex,
*v6_incs);
107
script_setenv(vpninfo, envname, route, slash ? slash - route : 0, 0);
108
109
110
snprintf(envname, 79, "CISCO_IPV6_SPLIT_%sC_%d_MASKLEN", in_ex,
*v6_incs);
111
script_setenv(vpninfo, envname, slash ? slash + 1 : "128", 0, 0);
112
113
(*v6_incs)++;
114
return 0;
117
118
119
120
121
if (!slash) {
/* no mask (same as /32) */
masklen = 32;
addr.s_addr = netmaskbits(32);
} else if ((masklen = strtol(slash+1, &endp, 10))<=32 && *endp!='.') {
122
123
124
125
126
127
/* mask is /N */
addr.s_addr = netmaskbits(masklen);
} else if (inet_aton(slash+1, &addr)) {
/* mask is /A.B.C.D */
masklen = netmasklen(addr);
} else {
128
129
130
131
132
133
134
135
136
if (include)
vpn_progress(vpninfo, PRG_ERR,
_("Discard bad split include: \"%s\"\n"),
route);
else
vpn_progress(vpninfo, PRG_ERR,
_("Discard bad split exclude: \"%s\"\n"),
route);
return -EINVAL;
139
140
141
snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_ADDR", in_ex, *v4_incs);
script_setenv(vpninfo, envname, route, slash ? slash - route : 0, 0);
142
snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASK", in_ex, *v4_incs);
143
script_setenv(vpninfo, envname, inet_ntoa(addr), 0, 0);
144
145
snprintf(envname, 79, "CISCO_SPLIT_%sC_%d_MASKLEN", in_ex, *v4_incs);
146
script_setenv_int(vpninfo, envname, masklen);
147
148
(*v4_incs)++;
149
return 0;
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
}
static void setenv_cstp_opts(struct openconnect_info *vpninfo)
{
char *env_buf;
int buflen = 0;
int bufofs = 0;
struct oc_vpn_option *opt;
for (opt = vpninfo->cstp_options; opt; opt = opt->next)
buflen += 2 + strlen(opt->option) + strlen(opt->value);
env_buf = malloc(buflen + 1);
if (!env_buf)
return;
env_buf[buflen] = 0;
for (opt = vpninfo->cstp_options; opt; opt = opt->next)
bufofs += snprintf(env_buf + bufofs, buflen - bufofs,
"%s=%s\n", opt->option, opt->value);
172
script_setenv(vpninfo, "CISCO_CSTP_OPTIONS", env_buf, 0, 0);
173
174
175
free(env_buf);
}
176
177
178
179
180
181
182
183
184
185
186
187
188
static unsigned char nybble(unsigned char n)
{
if (n >= '0' && n <= '9') return n - '0';
else if (n >= 'A' && n <= 'F') return n - ('A' - 10);
else if (n >= 'a' && n <= 'f') return n - ('a' - 10);
return 0;
}
unsigned char unhex(const char *data)
{
return (nybble(data[0]) << 4) | nybble(data[1]);
}
189
190
static void set_banner(struct openconnect_info *vpninfo)
{
191
char *banner, *legacy_banner, *q;
192
193
194
const char *p;
if (!vpninfo->banner || !(banner = malloc(strlen(vpninfo->banner)+1))) {
195
script_setenv(vpninfo, "CISCO_BANNER", NULL, 0, 0);
196
197
198
199
200
201
202
203
204
205
206
207
208
209
return;
}
p = vpninfo->banner;
q = banner;
while (*p) {
if (*p == '%' && isxdigit((int)(unsigned char)p[1]) &&
isxdigit((int)(unsigned char)p[2])) {
*(q++) = unhex(p + 1);
p += 3;
} else
*(q++) = *(p++);
}
*q = 0;
210
legacy_banner = openconnect_utf8_to_legacy(vpninfo, banner);
211
script_setenv(vpninfo, "CISCO_BANNER", legacy_banner, 0, 0);
212
213
if (legacy_banner != banner)
free(legacy_banner);
214
215
216
217
free(banner);
}
218
void prepare_script_env(struct openconnect_info *vpninfo)
220
if (vpninfo->ip_info.gateway_addr)
221
script_setenv(vpninfo, "VPNGATEWAY", vpninfo->ip_info.gateway_addr, 0, 0);
222
223
set_banner(vpninfo);
224
225
script_setenv(vpninfo, "CISCO_SPLIT_INC", NULL, 0, 0);
script_setenv(vpninfo, "CISCO_SPLIT_EXC", NULL, 0, 0);
227
script_setenv_int(vpninfo, "INTERNAL_IP4_MTU", vpninfo->ip_info.mtu);
229
230
231
232
233
if (vpninfo->idle_timeout)
script_setenv_int(vpninfo, "IDLE_TIMEOUT", vpninfo->idle_timeout);
else
script_setenv(vpninfo, "IDLE_TIMEOUT", NULL, 0, 0);
234
if (vpninfo->ip_info.addr) {
235
script_setenv(vpninfo, "INTERNAL_IP4_ADDRESS", vpninfo->ip_info.addr, 0, 0);
236
237
238
239
240
241
242
243
244
245
246
if (vpninfo->ip_info.netmask) {
struct in_addr addr;
struct in_addr mask;
if (inet_aton(vpninfo->ip_info.addr, &addr) &&
inet_aton(vpninfo->ip_info.netmask, &mask)) {
char *netaddr;
addr.s_addr &= mask.s_addr;
netaddr = inet_ntoa(addr);
247
248
script_setenv(vpninfo, "INTERNAL_IP4_NETADDR", netaddr, 0, 0);
script_setenv(vpninfo, "INTERNAL_IP4_NETMASK", vpninfo->ip_info.netmask, 0, 0);
249
script_setenv_int(vpninfo, "INTERNAL_IP4_NETMASKLEN", netmasklen(mask));
250
251
252
253
}
}
}
if (vpninfo->ip_info.addr6) {
254
255
script_setenv(vpninfo, "INTERNAL_IP6_ADDRESS", vpninfo->ip_info.addr6, 0, 0);
script_setenv(vpninfo, "INTERNAL_IP6_NETMASK", vpninfo->ip_info.netmask6, 0, 0);
256
257
} else if (vpninfo->ip_info.netmask6) {
char *slash = strchr(vpninfo->ip_info.netmask6, '/');
258
259
260
261
script_setenv(vpninfo, "INTERNAL_IP6_NETMASK", vpninfo->ip_info.netmask6, 0, 0);
if (slash)
script_setenv(vpninfo, "INTERNAL_IP6_ADDRESS", vpninfo->ip_info.netmask6,
slash - vpninfo->ip_info.netmask6, 0);
262
263
264
}
if (vpninfo->ip_info.dns[0])
265
script_setenv(vpninfo, "INTERNAL_IP4_DNS", vpninfo->ip_info.dns[0], 0, 0);
267
script_setenv(vpninfo, "INTERNAL_IP4_DNS", NULL, 0, 0);
268
if (vpninfo->ip_info.dns[1])
269
script_setenv(vpninfo, "INTERNAL_IP4_DNS", vpninfo->ip_info.dns[1], 0, 1);
270
if (vpninfo->ip_info.dns[2])
271
script_setenv(vpninfo, "INTERNAL_IP4_DNS", vpninfo->ip_info.dns[2], 0, 1);
272
273
if (vpninfo->ip_info.nbns[0])
274
script_setenv(vpninfo, "INTERNAL_IP4_NBNS", vpninfo->ip_info.nbns[0], 0, 0);
276
script_setenv(vpninfo, "INTERNAL_IP4_NBNS", NULL, 0, 0);
277
if (vpninfo->ip_info.nbns[1])
278
script_setenv(vpninfo, "INTERNAL_IP4_NBNS", vpninfo->ip_info.nbns[1], 0, 1);
279
if (vpninfo->ip_info.nbns[2])
280
script_setenv(vpninfo, "INTERNAL_IP4_NBNS", vpninfo->ip_info.nbns[2], 0, 1);
281
282
if (vpninfo->ip_info.domain)
283
script_setenv(vpninfo, "CISCO_DEF_DOMAIN", vpninfo->ip_info.domain, 0, 0);
285
script_setenv(vpninfo, "CISCO_DEF_DOMAIN", NULL, 0, 0);
286
287
if (vpninfo->ip_info.proxy_pac)
288
script_setenv(vpninfo, "CISCO_PROXY_PAC", vpninfo->ip_info.proxy_pac, 0, 0);
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
if (vpninfo->ip_info.split_dns) {
char *list;
int len = 0;
struct oc_split_include *dns = vpninfo->ip_info.split_dns;
while (dns) {
len += strlen(dns->route) + 1;
dns = dns->next;
}
list = malloc(len);
if (list) {
char *p = list;
dns = vpninfo->ip_info.split_dns;
while (1) {
strcpy(p, dns->route);
p += strlen(p);
dns = dns->next;
if (!dns)
break;
*(p++) = ',';
}
312
script_setenv(vpninfo, "CISCO_SPLIT_DNS", list, 0, 0);
313
314
315
free(list);
}
}
317
318
319
320
321
322
323
324
325
326
327
328
if (vpninfo->ip_info.split_includes) {
struct oc_split_include *this = vpninfo->ip_info.split_includes;
int nr_split_includes = 0;
int nr_v6_split_includes = 0;
while (this) {
process_split_xxclude(vpninfo, 1, this->route,
&nr_split_includes,
&nr_v6_split_includes);
this = this->next;
}
if (nr_split_includes)
329
script_setenv_int(vpninfo, "CISCO_SPLIT_INC", nr_split_includes);
330
if (nr_v6_split_includes)
331
script_setenv_int(vpninfo, "CISCO_IPV6_SPLIT_INC", nr_v6_split_includes);
334
335
336
337
338
339
340
341
342
343
344
345
if (vpninfo->ip_info.split_excludes) {
struct oc_split_include *this = vpninfo->ip_info.split_excludes;
int nr_split_excludes = 0;
int nr_v6_split_excludes = 0;
while (this) {
process_split_xxclude(vpninfo, 0, this->route,
&nr_split_excludes,
&nr_v6_split_excludes);
this = this->next;
}
if (nr_split_excludes)
346
script_setenv_int(vpninfo, "CISCO_SPLIT_EXC", nr_split_excludes);
347
if (nr_v6_split_excludes)
348
script_setenv_int(vpninfo, "CISCO_IPV6_SPLIT_EXC", nr_v6_split_excludes);
349
350
351
}
setenv_cstp_opts(vpninfo);
}
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
void free_split_routes(struct openconnect_info *vpninfo)
{
struct oc_split_include *inc;
for (inc = vpninfo->ip_info.split_includes; inc; ) {
struct oc_split_include *next = inc->next;
free(inc);
inc = next;
}
for (inc = vpninfo->ip_info.split_excludes; inc; ) {
struct oc_split_include *next = inc->next;
free(inc);
inc = next;
}
for (inc = vpninfo->ip_info.split_dns; inc; ) {
struct oc_split_include *next = inc->next;
free(inc);
inc = next;
}
vpninfo->ip_info.split_dns = vpninfo->ip_info.split_includes =
vpninfo->ip_info.split_excludes = NULL;
}
377
#ifdef _WIN32
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
static wchar_t *create_script_env(struct openconnect_info *vpninfo)
{
struct oc_vpn_option *opt;
struct oc_text_buf *envbuf;
wchar_t **oldenv, **p, *newenv = NULL;
int nr_envs = 0, i;
/* _wenviron is NULL until we call _wgetenv() */
(void)_wgetenv(L"PATH");
/* Take a copy of _wenviron (but not of its strings) */
for (p = _wenviron; *p; p++)
nr_envs++;
oldenv = malloc(nr_envs * sizeof(*oldenv));
if (!oldenv)
return NULL;
memcpy(oldenv, _wenviron, nr_envs * sizeof(*oldenv));
envbuf = buf_alloc();
/* Add the script environment variables, prodding out any members of
oldenv which are obsoleted by them. */
for (opt = vpninfo->script_env; opt && !buf_error(envbuf); opt = opt->next) {
struct oc_text_buf *buf;
buf = buf_alloc();
buf_append_utf16le(buf, opt->option);
buf_append_utf16le(buf, "=");
if (buf_error(buf)) {
buf_free(buf);
goto err;
}
/* See if we can find it in the existing environment */
for (i = 0; i < nr_envs; i++) {
415
416
if (oldenv[i] &&
!wcsncmp((wchar_t *)buf->data, oldenv[i], buf->pos / 2)) {
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
oldenv[i] = NULL;
break;
}
}
if (opt->value) {
buf_append_bytes(envbuf, buf->data, buf->pos);
buf_append_utf16le(envbuf, opt->value);
buf_append_bytes(envbuf, "\0\0", 2);
}
buf_free(buf);
}
for (i = 0; i < nr_envs && !buf_error(envbuf); i++) {
if (oldenv[i])
buf_append_bytes(envbuf, oldenv[i],
(wcslen(oldenv[i]) + 1) * sizeof(wchar_t));
}
buf_append_bytes(envbuf, "\0\0", 2);
if (!buf_error(envbuf)) {
newenv = (wchar_t *)envbuf->data;
envbuf->data = NULL;
}
err:
free(oldenv);
buf_free(envbuf);
return newenv;
}
450
451
int script_config_tun(struct openconnect_info *vpninfo, const char *reason)
{
452
wchar_t *script_w;
453
wchar_t *script_env;
454
int nr_chars;
455
int ret;
456
457
458
char *cmd;
PROCESS_INFORMATION pi;
STARTUPINFOW si;
459
DWORD cpflags;
460
461
462
463
if (!vpninfo->vpnc_script || vpninfo->script_tun)
return 0;
464
465
466
467
468
469
memset(&si, 0, sizeof(si));
si.cb = sizeof(si);
/* probably superfluous */
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_HIDE;
470
script_setenv(vpninfo, "reason", reason, 0, 0);
472
473
474
475
if (asprintf(&cmd, "cscript.exe \"%s\"", vpninfo->vpnc_script) == -1)
return 0;
nr_chars = MultiByteToWideChar(CP_UTF8, 0, cmd, -1, NULL, 0);
476
script_w = malloc(nr_chars * sizeof(wchar_t));
477
478
479
if (!script_w) {
free(cmd);
480
return -ENOMEM;
483
MultiByteToWideChar(CP_UTF8, 0, cmd, -1, script_w, nr_chars);
485
486
free(cmd);
487
488
script_env = create_script_env(vpninfo);
489
490
491
492
493
494
cpflags = CREATE_UNICODE_ENVIRONMENT;
/* If we're running from a console, let the script use it too. */
if (!GetConsoleWindow())
cpflags |= CREATE_NO_WINDOW;
if (CreateProcessW(NULL, script_w, NULL, NULL, FALSE, cpflags,
495
script_env, NULL, &si, &pi)) {
496
497
498
499
500
501
502
503
504
ret = WaitForSingleObject(pi.hProcess,10000);
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
if (ret == WAIT_TIMEOUT)
ret = -ETIMEDOUT;
else
ret = 0;
} else {
ret = -EIO;
507
508
free(script_env);
509
if (ret < 0) {
510
char *errstr = openconnect__win32_strerror(GetLastError());
511
vpn_progress(vpninfo, PRG_ERR,
512
513
514
_("Failed to spawn script '%s' for %s: %s\n"),
vpninfo->vpnc_script, reason, errstr);
free(errstr);
515
goto cleanup;
517
518
519
520
cleanup:
free(script_w);
return ret;
523
/* Must only be run after fork(). */
524
int apply_script_env(struct oc_vpn_option *envs)
526
struct oc_vpn_option *p;
528
for (p = envs; p; p = p->next) {
529
530
531
532
533
534
535
536
if (p->value)
setenv(p->option, p->value, 1);
else
unsetenv(p->option);
}
return 0;
}
537
538
539
int script_config_tun(struct openconnect_info *vpninfo, const char *reason)
{
int ret;
540
pid_t pid;
541
542
543
544
if (!vpninfo->vpnc_script || vpninfo->script_tun)
return 0;
545
546
547
548
pid = fork();
if (!pid) {
/* Child */
char *script = openconnect_utf8_to_legacy(vpninfo, vpninfo->vpnc_script);
550
apply_script_env(vpninfo->script_env);
552
553
554
555
556
557
setenv("reason", reason, 1);
execl("/bin/sh", "/bin/sh", "-c", script, NULL);
exit(127);
}
if (pid == -1 || waitpid(pid, &ret, 0) == -1) {
558
559
560
561
562
563
int e = errno;
vpn_progress(vpninfo, PRG_ERR,
_("Failed to spawn script '%s' for %s: %s\n"),
vpninfo->vpnc_script, reason, strerror(e));
return -e;
}
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
if (!WIFEXITED(ret)) {
vpn_progress(vpninfo, PRG_ERR,
_("Script '%s' exited abnormally (%x)\n"),
vpninfo->vpnc_script, ret);
return -EIO;
}
ret = WEXITSTATUS(ret);
if (ret) {
vpn_progress(vpninfo, PRG_ERR,
_("Script '%s' returned error %d\n"),
vpninfo->vpnc_script, ret);
return -EIO;
}
return 0;
}