server: Introduce privilege separation.

[tripe] / server / tun-linux.c

diff --git a/server/tun-linux.c b/server/tun-linux.c
index 11c7f37a1667b3906253a98e9daf3319ea108f89..b870580263edc3576c1becaab815c6223d7c9cfc 100644 (file)
--- a/server/tun-linux.c
+++ b/server/tun-linux.c
@@ -88,40 +88,6 @@ static void t_read(int fd, unsigned mode, void *v)
 
 static void t_init(void) { return; }
 
-/* --- @t_open@ --- *
- *
- * Arguments:  @char **ifn@ = where to put the interface name
- *
- * Returns:    A file descriptor, or @-1@ on failure.
- *
- * Use:                Opens a tunnel device.  This will run with root privileges
- *             even if the rest of the server has dropped them.
- */
-
-static int t_open(char **ifn)
-{
-  int fd;
-  struct ifreq iff;
-
-  if ((fd = open("/dev/net/tun", O_RDWR)) < 0) {
-    a_warn("TUN", "-", "linux",
-          "open-error", "/dev/net/tun", "?ERRNO",
-          A_END);
-    return (-1);
-  }
-  memset(&iff, 0, sizeof(iff));
-  iff.ifr_name[0] = 0;
-  iff.ifr_flags = IFF_TUN | IFF_NO_PI;
-  if (ioctl(fd, TUNSETIFF, &iff) < 0) {
-    a_warn("TUN", "-", "linux", "config-error", "?ERRNO", A_END);
-    close(fd);
-    return (-1);
-  }
-  iff.ifr_name[IFNAMSIZ - 1] = 0;
-  *ifn = xstrdup(iff.ifr_name);
-  return (fd);
-}
-
 /* --- @t_create@ --- *
  *
  * Arguments:  @peer *p@ = pointer to peer block
@@ -179,8 +145,8 @@ static void t_destroy(tunnel *t)
 
 const tunnel_ops tun_linux = {
   "linux",
+  TUNF_PRIVOPEN,
   t_init,
-  t_open,
   t_create,
   0,
   t_inject,