version 2.1_beta1

git-svn-id: http://svn.openvpn.net/projects/openvpn/branches/BETA21/openvpn@581 e7ae566f-a301-0410-adde-c780ea21d3b5

1 files changed, 228 insertions, 34 deletions

diff --git a/tun.c b/tun.c
index 03df0c8..7fd0c51 100644
--- a/tun.c
+++ b/tun.c
@@ -169,14 +169,14 @@ static const char ifconfig_warn_how_to_silence[] = "(silence this warning with -
  *  like an IPv4 address.
  */
 static void
-ifconfig_sanity_check (bool tun, in_addr_t addr)
+ifconfig_sanity_check (bool tun, in_addr_t addr, int topology)
 {
   struct gc_arena gc = gc_new ();
   const bool looks_like_netmask = ((addr & 0xFF000000) == 0xFF000000);
   if (tun)
     {
-      if (looks_like_netmask)
-	msg (M_WARN, "WARNING: Since you are using --dev tun, the second argument to --ifconfig must be an IP address.  You are using something (%s) that looks more like a netmask. %s",
+      if (looks_like_netmask && (topology == TOP_NET30 || topology == TOP_P2P))
+	msg (M_WARN, "WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address.  You are using something (%s) that looks more like a netmask. %s",
 	     print_in_addr_t (addr, 0, &gc),
 	     ifconfig_warn_how_to_silence);
     }
@@ -283,7 +283,13 @@ ifconfig_options_string (const struct tuntap* tt, bool remote, bool disable, str
   struct buffer out = alloc_buf_gc (256, gc);
   if (tt->did_ifconfig_setup && !disable)
     {
-      if (tt->type == DEV_TYPE_TUN)
+      if (tt->type == DEV_TYPE_TAP || (tt->type == DEV_TYPE_TUN && tt->topology == TOP_SUBNET))
+	{
+	  buf_printf (&out, "%s %s",
+		      print_in_addr_t (tt->local & tt->remote_netmask, 0, gc),
+		      print_in_addr_t (tt->remote_netmask, 0, gc));
+	}
+      else if (tt->type == DEV_TYPE_TUN)
 	{
 	  const char *l, *r;
 	  if (remote)
@@ -298,12 +304,6 @@ ifconfig_options_string (const struct tuntap* tt, bool remote, bool disable, str
 	    }
 	  buf_printf (&out, "%s %s", r, l);
 	}
-      else if (tt->type == DEV_TYPE_TAP)
-	{
-	  buf_printf (&out, "%s %s",
-		      print_in_addr_t (tt->local & tt->remote_netmask, 0, gc),
-		      print_in_addr_t (tt->remote_netmask, 0, gc));
-	}
       else
 	buf_printf (&out, "[undef]");
     }
@@ -346,6 +346,24 @@ tun_stat (const struct tuntap *tt, unsigned int rwflags, struct gc_arena *gc)
 }
 
 /*
+ * Return true for point-to-point topology, false for subnet topology
+ */
+bool
+is_tun_p2p (const struct tuntap *tt)
+{
+  bool tun = false;
+
+  if (tt->type == DEV_TYPE_TAP || (tt->type == DEV_TYPE_TUN && tt->topology == TOP_SUBNET))
+    tun = false;
+  else if (tt->type == DEV_TYPE_TUN)
+    tun = true;
+  else
+    ASSERT (0); /* should have been caught in init_tun */
+
+  return tun;
+}
+
+/*
  * Init tun/tap object.
  *
  * Set up tuntap structure for ifconfig,
@@ -354,6 +372,7 @@ tun_stat (const struct tuntap *tt, unsigned int rwflags, struct gc_arena *gc)
 struct tuntap *
 init_tun (const char *dev,       /* --dev option */
 	  const char *dev_type,  /* --dev-type option */
+	  int topology,          /* one of the TOP_x values */
 	  const char *ifconfig_local_parm,          /* --ifconfig parm 1 */
 	  const char *ifconfig_remote_netmask_parm, /* --ifconfig parm 2 */
 	  in_addr_t local_public,
@@ -368,6 +387,7 @@ init_tun (const char *dev,       /* --dev option */
   clear_tuntap (tt);
 
   tt->type = dev_type_enum (dev, dev_type);
+  tt->topology = topology;
 
   if (ifconfig_local_parm && ifconfig_remote_netmask_parm)
     {
@@ -379,12 +399,7 @@ init_tun (const char *dev,       /* --dev option */
       /*
        * We only handle TUN/TAP devices here, not --dev null devices.
        */
-      if (tt->type == DEV_TYPE_TUN)
-	tun = true;
-      else if (tt->type == DEV_TYPE_TAP)
-	tun = false;
-      else
-	msg (M_FATAL, "'%s' is not a TUN/TAP device.  The --ifconfig option works only for TUN/TAP devices.", dev);
+      tun = is_tun_p2p (tt);
 
       /*
        * Convert arguments to binary IPv4 addresses.
@@ -415,7 +430,7 @@ init_tun (const char *dev,       /* --dev option */
        */
       if (strict_warn)
 	{
-	  ifconfig_sanity_check (tun, tt->remote_netmask);
+	  ifconfig_sanity_check (tt->type == DEV_TYPE_TUN, tt->remote_netmask, tt->topology);
 
 	  /*
 	   * If local_public or remote_public addresses are defined,
@@ -511,12 +526,7 @@ do_ifconfig (struct tuntap *tt,
       /*
        * We only handle TUN/TAP devices here, not --dev null devices.
        */
-      if (tt->type == DEV_TYPE_TUN)
-	tun = true;
-      else if (tt->type == DEV_TYPE_TAP)
-	tun = false;
-      else
-	ASSERT (0); /* should have been caught in init_tun */
+      tun = is_tun_p2p (tt);
 
       /*
        * Set ifconfig parameters
@@ -2376,6 +2386,34 @@ get_adapter_info_list (struct gc_arena *gc)
   return pi;
 }
 
+const IP_PER_ADAPTER_INFO *
+get_per_adapter_info (const DWORD index, struct gc_arena *gc)
+{
+  ULONG size = 0;
+  IP_PER_ADAPTER_INFO *pi = NULL;
+  DWORD status;
+
+  if ((status = GetPerAdapterInfo (index, NULL, &size)) != ERROR_BUFFER_OVERFLOW)
+    {
+      msg (M_INFO, "GetPerAdapterInfo #1 failed (status=%u) : %s",
+	   (unsigned int)status,
+	   strerror_win32 (status, gc));
+    }
+  else
+    {
+      pi = (PIP_PER_ADAPTER_INFO) gc_malloc (size, false, gc);
+      if ((status = GetPerAdapterInfo ((ULONG)index, pi, &size)) == ERROR_SUCCESS)
+	return pi;
+      else
+	{
+	  msg (M_INFO, "GetPerAdapterInfo #2 failed (status=%u) : %s",
+	       (unsigned int)status,
+	       strerror_win32 (status, gc));
+	}
+    }
+  return pi;
+}
+
 static const IP_INTERFACE_INFO *
 get_interface_info_list (struct gc_arena *gc)
 {
@@ -2443,7 +2481,7 @@ get_adapter (const IP_ADAPTER_INFO *ai, DWORD index)
   return NULL;
 }
 
-static const IP_ADAPTER_INFO *
+const IP_ADAPTER_INFO *
 get_adapter_info (DWORD index, struct gc_arena *gc)
 {
   return get_adapter (get_adapter_info_list (gc), index);
@@ -2762,6 +2800,14 @@ show_adapter (int msglev, const IP_ADAPTER_INFO *a, struct gc_arena *gc)
       msg (msglev, "  PRI WINS = %s", format_ip_addr_string (&a->PrimaryWinsServer, gc));
       msg (msglev, "  SEC WINS = %s", format_ip_addr_string (&a->SecondaryWinsServer, gc));
     }
+
+  {
+    const IP_PER_ADAPTER_INFO *pai = get_per_adapter_info (a->Index, gc);
+    if (pai)
+      {
+	msg (msglev, "  DNS SERV = %s", format_ip_addr_string (&pai->DnsServerList, gc));
+      }
+  }
 }
 
 /*
@@ -2788,6 +2834,123 @@ show_adapters (int msglev)
 }
 
 /*
+ * Set a particular TAP-Win32 adapter (or all of them if
+ * adapter_name == NULL) to allow it to be opened from
+ * a non-admin account.  This setting will only persist
+ * for the lifetime of the device object.
+ */
+
+static void
+tap_allow_nonadmin_access_handle (const char *device_path, HANDLE hand)
+{
+  struct security_attributes sa;
+  BOOL status;
+
+  if (!init_security_attributes_allow_all (&sa))
+    msg (M_ERR, "Error: init SA failed");
+
+  status = SetKernelObjectSecurity (hand, DACL_SECURITY_INFORMATION, &sa.sd);
+  if (!status)
+    {
+      msg (M_ERRNO, "Error: SetKernelObjectSecurity failed on %s", device_path);
+    }
+  else
+    {
+      msg (M_INFO|M_NOPREFIX, "TAP-Win32 device: %s [Non-admin access allowed]", device_path);
+    }
+}
+
+void
+tap_allow_nonadmin_access (const char *dev_node)
+{
+  struct gc_arena gc = gc_new ();
+  const struct tap_reg *tap_reg = get_tap_reg (&gc);
+  const struct panel_reg *panel_reg = get_panel_reg (&gc);
+  const char *device_guid = NULL;
+  HANDLE hand;
+  char guid_buffer[256];
+  char device_path[256];
+
+  at_least_one_tap_win32 (tap_reg);
+
+  if (dev_node)
+    {
+      /* Get the device GUID for the device specified with --dev-node. */
+      device_guid = get_device_guid (dev_node, guid_buffer, sizeof (guid_buffer), tap_reg, panel_reg, &gc);
+
+      if (!device_guid)
+	msg (M_FATAL, "TAP-Win32 adapter '%s' not found", dev_node);
+
+      /* Open Windows TAP-Win32 adapter */
+      openvpn_snprintf (device_path, sizeof(device_path), "%s%s%s",
+			USERMODEDEVICEDIR,
+			device_guid,
+			TAPSUFFIX);
+      
+      hand = CreateFile (
+			 device_path,
+			 MAXIMUM_ALLOWED,
+			 0, /* was: FILE_SHARE_READ */
+			 0,
+			 OPEN_EXISTING,
+			 FILE_ATTRIBUTE_SYSTEM | FILE_FLAG_OVERLAPPED,
+			 0
+			 );
+
+      if (hand == INVALID_HANDLE_VALUE)
+	msg (M_ERR, "CreateFile failed on TAP device: %s", device_path);
+
+      tap_allow_nonadmin_access_handle (device_path, hand);
+      CloseHandle (hand);
+    }
+  else 
+    {
+      int device_number = 0;
+
+      /* Try opening all TAP devices */
+      while (true)
+	{
+	  device_guid = get_unspecified_device_guid (device_number, 
+						     guid_buffer, 
+						     sizeof (guid_buffer),
+						     tap_reg,
+						     panel_reg,
+						     &gc);
+
+	  if (!device_guid)
+	    break;
+
+	  /* Open Windows TAP-Win32 adapter */
+	  openvpn_snprintf (device_path, sizeof(device_path), "%s%s%s",
+			    USERMODEDEVICEDIR,
+			    device_guid,
+			    TAPSUFFIX);
+
+	  hand = CreateFile (
+			     device_path,
+			     MAXIMUM_ALLOWED,
+			     0, /* was: FILE_SHARE_READ */
+			     0,
+			     OPEN_EXISTING,
+			     FILE_ATTRIBUTE_SYSTEM | FILE_FLAG_OVERLAPPED,
+			     0
+			     );
+
+	  if (hand == INVALID_HANDLE_VALUE)
+	    msg (M_WARN, "CreateFile failed on TAP device: %s", device_path);
+	  else
+	    {
+	      tap_allow_nonadmin_access_handle (device_path, hand);
+	      CloseHandle (hand);
+	    }
+  
+	  device_number++;
+	}
+    }
+  gc_free (&gc);
+}
+
+/*
  * DHCP release/renewal
  */
 
@@ -2963,7 +3126,7 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, bool ipv6
         device_guid = get_device_guid (dev_node, guid_buffer, sizeof (guid_buffer), tap_reg, panel_reg, &gc);
 
 	if (!device_guid)
-	    msg (M_FATAL, "TAP-Win32 adapter '%s' not found", dev_node);
+	  msg (M_FATAL, "TAP-Win32 adapter '%s' not found", dev_node);
 
         /* Open Windows TAP-Win32 adapter */
         openvpn_snprintf (device_path, sizeof(device_path), "%s%s%s",
@@ -3070,17 +3233,41 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, bool ipv6
 
   if (tt->type == DEV_TYPE_TUN)
     {
-      in_addr_t ep[2];
-      ep[0] = htonl (tt->local);
-      ep[1] = htonl (tt->remote_netmask);
       if (!tt->did_ifconfig_setup)
 	{
 	  msg (M_FATAL, "ERROR: --dev tun also requires --ifconfig");
 	}
-      if (!DeviceIoControl (tt->hand, TAP_IOCTL_CONFIG_POINT_TO_POINT,
-			    ep, sizeof (ep),
-			    ep, sizeof (ep), &len, NULL))
-	msg (M_FATAL, "ERROR: The TAP-Win32 driver rejected a DeviceIoControl call to set Point-to-Point mode, which is required for --dev tun");
+
+      if (tt->topology == TOP_SUBNET)
+	{
+	  in_addr_t ep[3];
+	  BOOL status;
+
+	  ep[0] = htonl (tt->local);
+	  ep[1] = htonl (tt->local & tt->remote_netmask);
+	  ep[2] = htonl (tt->remote_netmask);
+
+	  status = DeviceIoControl (tt->hand, TAP_IOCTL_CONFIG_TUN,
+				    ep, sizeof (ep),
+				    ep, sizeof (ep), &len, NULL);
+
+          msg (status ? M_INFO : M_FATAL, "Set TAP-Win32 TUN subnet mode network/local/netmask = %s/%s/%s [%s]",
+	       print_in_addr_t (ep[1], IA_NET_ORDER, &gc),
+	       print_in_addr_t (ep[0], IA_NET_ORDER, &gc),
+	       print_in_addr_t (ep[2], IA_NET_ORDER, &gc),
+	       status ? "SUCCEEDED" : "FAILED");
+
+	} else {
+
+	  in_addr_t ep[2];
+	  ep[0] = htonl (tt->local);
+	  ep[1] = htonl (tt->remote_netmask);
+
+	  if (!DeviceIoControl (tt->hand, TAP_IOCTL_CONFIG_POINT_TO_POINT,
+				ep, sizeof (ep),
+				ep, sizeof (ep), &len, NULL))
+	    msg (M_FATAL, "ERROR: The TAP-Win32 driver rejected a DeviceIoControl call to set Point-to-Point mode, which is required for --dev tun");
+	}
     }
 
   /* should we tell the TAP-Win32 driver to masquerade as a DHCP server as a means
@@ -3096,7 +3283,14 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, bool ipv6
       /* At what IP address should the DHCP server masquerade at? */
       if (tt->type == DEV_TYPE_TUN)
 	{
-	  ep[2] = htonl (tt->remote_netmask);
+	  if (tt->topology == TOP_SUBNET)
+	    {
+	      const in_addr_t netmask_inv = ~tt->remote_netmask;
+	      ep[2] = netmask_inv ? htonl ((tt->local | netmask_inv) - 1) : 0;
+	    }
+	  else
+	    ep[2] = htonl (tt->remote_netmask);
+
 	  if (tt->options.dhcp_masq_custom_offset)
 	    msg (M_WARN, "WARNING: because you are using '--dev tun' mode, the '--ip-win32 dynamic [offset]' option is ignoring the offset parameter");
 	}
@@ -3186,7 +3380,7 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, bool ipv6
 	       (unsigned int)index,
 	       device_guid);
 	else
-	  msg (M_WARN, "NOTE: FlushIpNetTable failed on interface [%u] %s (status=%u) : %s",
+	  msg (D_TUNTAP_INFO, "NOTE: FlushIpNetTable failed on interface [%u] %s (status=%u) : %s",
 	       (unsigned int)index,
 	       device_guid,
 	       (unsigned int)status,