2 # Simple tunnel for userv-ipif tunnels.
4 # Example test invocation
6 # ./udptunnel -e nonce -e timestamp/10/30 -e pkcs5/8 -e blowfish-cbcmac/128 -e blowfish-cbc/128 -m -f ./udptunnel-forwarder davenant,Any anarres,Command 172.30.206.1,172.30.206.2,1000,cslip 15,70 '' '' rsh anarres things/userv-utils/ipif/udptunnel -f things/userv-utils/ipif/udptunnel-forwarder
10 # [ -l[<local-command/arg>] ... .
11 # | -e <encryption-mech>[/<encryption-parameter>...]
12 # | -m (`masquerade support': subcommand gets `Wait' instead of our addr/port)
13 # | -d (`dump keys': when no subcmd, spew keys rather than reading them;
14 # we always send keys to our subcmd if there is one)
15 # | -Dcrypto (debug crypto - use with care, prints keys, packets &c on screen!)
16 # | -f<path-to-udptunnel-forwarder>
19 # <public-local-addr>,<public-local-port>
20 # <public-remote-addr>,<public-remote-port>
21 # <private-local-addr>,<private-remote-addr>,<mtu>,<proto>
22 # <keepalive>,<timeout>
23 # <extra-local-nets> <extra-remote-nets>
24 # [ <remote-command> [<remote-args> ...] ]
26 # proto may be slip or cslip
28 # Any <..-addr> may also be hostname
30 # Local addr's and ports may also be:
31 # `Print' choose one ourselves and print both port and addr
32 # `Any' choose one ourselves and do not print it
33 # Remote addr's and ports may also be:
34 # `Wait' wait to receive a packet before assigning address
35 # `Command' run a subcommand and wait for it to tell us the values
36 # When any addr or port is `Command' then <remote-command> must be specified.
38 # If <remote-command> is specified it should run udptunnel at the
39 # remote end; it will be invoked as
40 # <remote-command> [ <-e arguments passed along> ]
41 # <public-remote-addr'>,<public-remote-port'>
42 # <public-local-addr'>,<public-local-port'>
43 # <private-remote-addr>,<private-local-addr>,<mtu>,<proto>
44 # <keepalive>,<timeout>
45 # <extra-remote-nets> <extra-local-nets>
48 # If it was given Print for <public-remote-foo'>, this command's first
49 # stdout output should be the real
50 # <public-remote-addr>,<public-remote-port> pair (and of course this
51 # udptunnel's output will be). It may then produce more stdout which,
52 # if any, will be forwarded to the local end's stdout as debugging info.
54 # After this, if any encryption was specified, the encryption
55 # parameters will be fed into its stdin. See the documentation in the
56 # mech-*.c files for details of the parameters. udptunnel will
57 # arrange to feed the keys fd of udptunnel-forwarder into the stdin of
60 # <public-remote-foo'> is as follows:
61 # <public-remote-foo> <public-remote-foo'>
62 # actual addr/port that addr/port
66 # <public-local-foo'> is as follows:
67 # <public-local-foo> <public-local-foo'> <public-local-foo'>
68 # (-m not specified) (-m specified)
69 # actual addr/port that addr/port `Wait'
70 # `Wait' the chosen address `Wait'
71 # `Print' the chosen address `Wait'
73 # udptunnel will userv ipif locally, as
74 # userv root ipif <private-local-addr>,<private-remote-addr>,<mtu>,<proto>
76 # or, if -l was given, userv root ipif is replaced with the argument(s)
77 # following -l option(s) until `.'.
79 # udptunnel will also run udptunnel-forwarder with appropriate options
81 # recommended encryption parameters are:
82 # -e nonce (prepend 32 bit counter)
83 # -e timestamp/<max-skew>/<max-age> (prepend 32 bit time_t, and check on receipt)
84 # -e pkcs5/8 (pad as per PKCS#5 to 8-byte boundary)
85 # -e blowfish-cbcmac/128 (prepend CBC MAC with random IV and 128 bit key)
86 # -e blowfish-cbc/128 (encrypt with CBC, random IV and 128 bit key)
87 # where <max-skew> is perhaps 10 and <max-age> perhaps 30.
89 # Copyright (C) 1999-2000 Ian Jackson
91 # This is free software; you can redistribute it and/or modify it
92 # under the terms of the GNU General Public License as published by
93 # the Free Software Foundation; either version 2 of the License, or
94 # (at your option) any later version.
96 # This program is distributed in the hope that it will be useful, but
97 # WITHOUT ANY WARRANTY; without even the implied warranty of
98 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
99 # General Public License for more details.
101 # You should have received a copy of the GNU General Public License
102 # along with userv-utils; if not, write to the Free Software
103 # Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
111 $progname= $0; $progname =~ s,.*/,,;
114 chomp($hostname= `uname -n`);
115 $? and die "$progname: cannot get hostname (uname failed with code $?)\n";
117 sub quit ($) { die "$progname - $hostname: fatal error: $_[0]\n"; }
118 sub debug ($) { print "$progname - $hostname: debug: $_[0]\n"; }
119 sub fail ($) { quit("unexpected system call failure: $_[0]: $!"); }
120 sub warning ($) { warn "$progname - $hostname: $_[0]\n"; }
122 sub eat_addr_port ($) {
124 @ARGV or quit("<addr>,<port> missing");
126 (m/^$x,/i && m/^[a-z]/ || m/,$x$/i && m/,[a-z]/)
127 and warning("$_: use Mixed Case for special values");
128 m/^([0-9a-z][0-9a-z-+.]+|$x)\,(\d+|$x)$/
129 or quit("$_: <host/addr>,<port> bad syntax".
130 (m/[A-Z]/ ? ' (use lowercase for hostnames)' : ''));
133 sub conv_host_addr ($) {
135 return INADDR_ANY() if $s =~ m/^[A-Z][a-z]/;
136 return $r if defined($r= inet_aton($s));
137 @h= gethostbyname($s) or quit("$s: cannot get address");
138 $h[2] eq &AF_INET or quit("$s: address is not IPv4");
139 @h < 5 or quit("$s: name maps to no addresses");
141 @h == 5 or warning("$s: name has several addresses, using ".inet_ntoa($r));
144 sub conv_port_number ($) {
146 return 0 if $s =~ m/^[A-Z][a-z]/;
148 $r>0 && $r<65536 or quit("$s: port out of range");
153 @s= unpack_sockaddr_in($s);
154 return inet_ntoa($s[1]);
158 @s= unpack_sockaddr_in($s);
161 sub show_addr_port ($) {
163 return show_addr($s).','.show_port($s);
168 return $val if length $val;
169 @ARGV or quit("$opt needs value");
177 $fcmd= 'udptunnel-forwarder';
180 while ($ARGV[0] =~ m/^-/) {
185 push @lcmd,$_ if length;
186 while (@ARGV && ($_= shift @ARGV) ne '.') { push @lcmd, $_; }
189 $fcmd= arg_value($_,'-f');
191 $encrarg= arg_value($_,'-e');
192 push @remoteopts, "-e$encrarg";
193 @thisencryption= split m#/#, $encrarg;
194 $thisencryption[0] =~ s/^/\|/;
195 push @encryption, @thisencryption;
200 } elsif (s/^-Dcrypto$/-/) {
202 push @remoteopts, '-Dcrypto';
204 quit("unknown option \`$_'");
209 # Variables \$[lr]a?p?(|s|d|r)
210 # Local/Remote Address&/Port
211 # actualvalue/Specified/Displaypassdown/fromRemote/passtoForwarder
213 ($las,$lps)= eat_addr_port('Print|Any');
214 $la= conv_host_addr($las);
215 $lp= conv_port_number($lps);
216 $ls= pack_sockaddr_in $lp,$la;
218 ($ras,$rps)= eat_addr_port('Wait|Command');
219 $ra= conv_host_addr($ras);
220 $rp= conv_port_number($rps);
221 $rs= pack_sockaddr_in $rp,$ra;
224 m/^([.0-9]+),([.0-9]+),(\d+),(slip|cslip)$/
225 or quit("lvaddr,rvaddr,mtu,proto missing or bad syntax or proto not [c]slip");
226 ($lva,$rva,$mtu,$proto) = ($1,$2,$3,$4);
229 m/^(\d+),(\d+)$/ or quit("keepalive,timeout missing or bad syntax");
230 ($keepalive,$timeout)= ($1,$2);
231 $keepalive && ($timeout > $keepalive*2) or quit("timeout must be < 2*keepalive")
234 # Variables \$[lr]exn
235 # Local/Remote Extra Nets
239 defined($udp= getprotobyname('udp')) or fail("getprotobyname udp");
241 socket(L,PF_INET,SOCK_DGRAM,$udp) or fail("socket");
242 bind(L,$ls) or quit("bind failed: $!");
243 defined($ls= getsockname(L)) or fail("getsockname");
244 $lad= show_addr($ls);
245 $lpd= show_port($ls);
248 print "$lapd\n" or fail("print addr/port") if ($las eq 'Print' || $lps eq 'Print');
250 $rapcmd= ($ras eq 'Command' || $rps eq 'Command');
251 quit("need remote-command if Command for remote addr/port") if $rapcmd && !@ARGV;
253 sub xform_remote ($$) {
254 my ($showed,$spec) = @_;
255 return 'Print' if $spec eq 'Command';
256 return 'Any' if $spec eq 'Wait';
261 warning("-d specified with remote command, ignoring") if $dump;
264 $rad= xform_remote(show_addr($rs),$ras);
265 $rpd= xform_remote(show_port($rs),$rps);
269 $masq ? 'Wait,Wait' : $lapd,
270 "$rva,$lva,$mtu,$proto",
271 "$keepalive,$timeout",
273 debug("remote command @rcmd");
276 pipe(RAPREAD,RCMDREADSUB) or fail("pipe");
278 pipe(RCMDWRITESUB,DUMPKEYS) or fail("pipe");
279 defined($c_rcmd= fork) or fail("fork for remote");
281 open STDIN, "<&RCMDWRITESUB" or fail("reopen stdin for remote command");
282 open STDOUT, ">&RCMDREADSUB" or fail("reopen stdout for remote command")
284 close RAPREAD if $rapcmd;
289 exec @rcmd; fail("failed to execute remote command $rcmd[0]");
294 close RCMDREADSUB if $rapcmd;
298 defined($nread= sysread(RAPREAD,$_,1,length))
299 or fail("read from remote command");
303 waitpid $c_rcmd,0 or fail("wait for remote command");
304 quit($? ? "remote command failed (code $?)" :
305 "no details received from remote");
309 m/^([.0-9]+)\,(\d+)$/ or quit("invalid details from remote end: \`$_'");
310 ($rar,$rpr) = ($1,$2);
311 $ra= conv_host_addr($rar);
312 $rp= conv_port_number($rpr);
314 defined($c_catremdebug= fork) or fail("fork for cat remote debug");
315 if (!$c_catremdebug) {
316 open(STDIN,"<&RAPREAD") or fail("redirect remote debug");
319 exec "cat"; fail("execute cat");
324 open DUMPKEYS, ">&STDOUT" or fail("reopen stdout for key material");
327 open DUMPKEYS, "<&STDIN" or fail("reopen stdout for key material");
330 $rs= pack_sockaddr_in $rp,$ra;
332 if ($ras eq 'Wait' || $rps eq 'Wait') {
334 $rapd= ('Wait,Wait');
336 @rapf= (show_addr($rs), show_port($rs));
337 $rapd= show_addr_port($rs);
339 @lcmd= qw(userv root ipif) unless @lcmd;
341 debug("using remote $rapd local $lapd");
342 push @lcmd, ("$lva,$rva,$mtu,$proto",$lexn);
343 debug("local command @lcmd.");
345 pipe(UR,UW) or fail("up pipe");
346 pipe(DR,DW) or fail("down pipe");
348 defined($c_lcmd= fork) or fail("fork for local command");
351 open(STDIN,"<&DR") or fail("reopen stdin for packets");
352 open(STDOUT,">&UW") or fail("reopen stdout for packets");
354 quit("cannot execute $lcmd[0]: $!");
359 $xfwdopts.= 'w' if $dump;
361 @fcmd= ($fcmd, $xfwdopts,
362 fileno(L), fileno(DW), fileno(UR), fileno(DUMPKEYS),
363 $mtu, $keepalive, $timeout,
366 debug("forwarding command @fcmd.");
368 defined($c_fwd= fork) or fail("fork for udptunnel-forwarder");
370 foreach $fd (qw(L DW UR DUMPKEYS)) {
371 fcntl($fd, F_SETFD, 0) or fail("set no-close-on-exec $fd");
373 exec @fcmd; fail("cannot execute $fcmd[0]");
381 %procs= ($c_fwd, 'forwarder',
382 $c_lcmd, 'local command');
383 $procs{$c_rcmd}= 'remote command' if $c_rcmd;
384 $procs{$c_catremdebug}= 'debug cat' if $c_catremdebug;
388 while (keys %procs) {
390 fail("wait failed (expecting ". join('; ',keys %procs). ")");
392 warning("unexpected child reaped: pid $c, code $status"), next
393 unless exists $procs{$c};
396 $status ? warning("subprocess $str failed with code $status")
397 : debug("subprocess $str finished");
398 if ($c==$c_lcmd || $c==$c_fwd || $c==$c_rcmd) {
399 kill 15, grep (exists $procs{$_}, $c_fwd, $c_rcmd);
401 $estatus=1 unless $c == $c_catremdebug;
404 debug("all processes terminated, exiting with status $estatus");