aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--init.c2
-rw-r--r--lladdr.c4
-rw-r--r--misc.c4
-rw-r--r--misc.h7
-rw-r--r--openvpn.816
-rw-r--r--options.c12
-rw-r--r--route.c6
-rw-r--r--tun.c56
-rw-r--r--tun.h3
9 files changed, 100 insertions, 10 deletions
diff --git a/init.c b/init.c
index 211effd..0651c2d 100644
--- a/init.c
+++ b/init.c
@@ -426,7 +426,7 @@ do_persist_tuntap (const struct options *options)
"options --mktun or --rmtun should only be used together with --dev");
tuncfg (options->dev, options->dev_type, options->dev_node,
options->tun_ipv6, options->persist_mode,
- &options->tuntap_options);
+ options->username, options->groupname, &options->tuntap_options);
if (options->persist_mode && options->lladdr)
set_lladdr(options->dev, options->lladdr, NULL);
return true;
diff --git a/lladdr.c b/lladdr.c
index 1f02ba4..1daa379 100644
--- a/lladdr.c
+++ b/lladdr.c
@@ -24,8 +24,8 @@ int set_lladdr(const char *ifname, const char *lladdr,
#if defined(TARGET_LINUX)
#ifdef CONFIG_FEATURE_IPROUTE
openvpn_snprintf (cmd, sizeof (cmd),
- IPROUTE_PATH " link set addr %s dev %s",
- lladdr, ifname);
+ "%s link set addr %s dev %s",
+ iproute_path, lladdr, ifname);
#else
openvpn_snprintf (cmd, sizeof (cmd),
IFCONFIG_PATH " %s hw ether %s",
diff --git a/misc.c b/misc.c
index 4329711..2821408 100644
--- a/misc.c
+++ b/misc.c
@@ -44,6 +44,10 @@
#include "memdbg.h"
+#ifdef CONFIG_FEATURE_IPROUTE
+const char *iproute_path = IPROUTE_PATH;
+#endif
+
/* Redefine the top level directory of the filesystem
to restrict access to files for security */
void
diff --git a/misc.h b/misc.h
index 09124e6..5b7f227 100644
--- a/misc.h
+++ b/misc.h
@@ -269,4 +269,11 @@ void configure_path (void);
void get_user_pass_auto_userid (struct user_pass *up, const char *tag);
#endif
+/*
+ * /sbin/ip path, may be overridden
+ */
+#ifdef CONFIG_FEATURE_IPROUTE
+extern const char *iproute_path;
+#endif
+
#endif
diff --git a/openvpn.8 b/openvpn.8
index 6446c5b..df276e7 100644
--- a/openvpn.8
+++ b/openvpn.8
@@ -71,6 +71,8 @@ openvpn \- secure IP tunnel daemon.
[\ \fB\-\-dev\-type\fR\ \fIdevice\-type\fR\ ]
[\ \fB\-\-dev\-node\fR\ \fInode\fR\ ]
[\ \fB\-\-lladdr\fR\ \fIaddress\fR\ ]
+[\ \fB\-\-user\fR\ \fIuser\fR\ ]
+[\ \fB\-\-group\fR\ \fIgroup\fR\ ]
.in -4
.ti +4
.hy
@@ -164,6 +166,7 @@ openvpn \- secure IP tunnel daemon.
[\ \fB\-\-inetd\fR\ \fI[wait|nowait]\ [progname]\fR\ ]
[\ \fB\-\-ip\-win32\fR\ \fImethod\fR\ ]
[\ \fB\-\-ipchange\fR\ \fIcmd\fR\ ]
+[\ \fB\-\-iproute\fR\ \fIcmd\fR\ ]
[\ \fB\-\-iroute\fR\ \fInetwork\ [netmask]\fR\ ]
[\ \fB\-\-keepalive\fR\ \fIn\ m\fR\ ]
[\ \fB\-\-key\-method\fR\ \fIm\fR\ ]
@@ -923,6 +926,11 @@ Specify the link layer address, more commonly known as the MAC address.
Only applied to TAP devices.
.\"*********************************************************
.TP
+.B --iproute cmd
+Set alternate command to execute instead of default iproute2 command.
+May be used in order to execute OpenVPN in unprivileged environment.
+.\"*********************************************************
+.TP
.B --ifconfig l rn
Set TUN/TAP adapter parameters.
.B l
@@ -4306,6 +4314,14 @@ Remove a persistent tunnel.
.B --dev tunX | tapX
TUN/TAP device
.\"*********************************************************
+.TP
+.B --user user
+Optional user to be owner of this tunnel.
+.\"*********************************************************
+.TP
+.B --group group
+Optional group to be owner of this tunnel.
+.\"*********************************************************
.SS Windows-Specific Options:
.\"*********************************************************
.TP
diff --git a/options.c b/options.c
index 8c5a268..a990fcd 100644
--- a/options.c
+++ b/options.c
@@ -156,6 +156,9 @@ static const char usage_message[] =
"--lladdr hw : Set the link layer address of the tap device.\n"
"--topology t : Set --dev tun topology: 'net30', 'p2p', or 'subnet'.\n"
"--tun-ipv6 : Build tun link capable of forwarding IPv6 traffic.\n"
+#ifdef CONFIG_FEATURE_IPROUTE
+ "--iproute cmd : Use this command instead of default " IPROUTE_PATH ".\n"
+#endif
"--ifconfig l rn : TUN: configure device to use IP address l as a local\n"
" endpoint and rn as a remote endpoint. l & rn should be\n"
" swapped on the other peer. l & rn must be private\n"
@@ -591,6 +594,8 @@ static const char usage_message[] =
"--rmtun : Remove a persistent tunnel.\n"
"--dev tunX|tapX : tun/tap device\n"
"--dev-type dt : Device type. See tunnel options above for details.\n"
+ "--user user : User to set privilege to.\n"
+ "--group group : Group to set privilege to.\n"
#endif
#ifdef ENABLE_PKCS11
"\n"
@@ -3225,6 +3230,13 @@ add_option (struct options *options,
VERIFY_PERMISSION (OPT_P_UP);
options->tun_ipv6 = true;
}
+#ifdef CONFIG_FEATURE_IPROUTE
+ else if (streq (p[0], "iproute") && p[1])
+ {
+ VERIFY_PERMISSION (OPT_P_UP);
+ iproute_path = p[1];
+ }
+#endif
else if (streq (p[0], "ifconfig") && p[1] && p[2])
{
VERIFY_PERMISSION (OPT_P_UP);
diff --git a/route.c b/route.c
index 36d41cd..507ef38 100644
--- a/route.c
+++ b/route.c
@@ -777,7 +777,8 @@ add_route (struct route *r, const struct tuntap *tt, unsigned int flags, const s
#if defined(TARGET_LINUX)
#ifdef CONFIG_FEATURE_IPROUTE
- buf_printf (&buf, IPROUTE_PATH " route add %s/%d via %s",
+ buf_printf (&buf, "%s route add %s/%d via %s",
+ iproute_path,
network,
count_netmask_bits(netmask),
gateway);
@@ -934,7 +935,8 @@ delete_route (const struct route *r, const struct tuntap *tt, unsigned int flags
#if defined(TARGET_LINUX)
#ifdef CONFIG_FEATURE_IPROUTE
- buf_printf (&buf, IPROUTE_PATH " route del %s/%d",
+ buf_printf (&buf, "%s route del %s/%d",
+ iproute_path,
network,
count_netmask_bits(netmask));
#else
diff --git a/tun.c b/tun.c
index 8c8616a..3a740bf 100644
--- a/tun.c
+++ b/tun.c
@@ -577,7 +577,8 @@ do_ifconfig (struct tuntap *tt,
* Set the MTU for the device
*/
openvpn_snprintf (command_line, sizeof (command_line),
- IPROUTE_PATH " link set dev %s up mtu %d",
+ "%s link set dev %s up mtu %d",
+ iproute_path,
actual,
tun_mtu
);
@@ -590,7 +591,8 @@ do_ifconfig (struct tuntap *tt,
* Set the address for the device
*/
openvpn_snprintf (command_line, sizeof (command_line),
- IPROUTE_PATH " addr add dev %s local %s peer %s",
+ "%s addr add dev %s local %s peer %s",
+ iproute_path,
actual,
ifconfig_local,
ifconfig_remote_netmask
@@ -599,7 +601,8 @@ do_ifconfig (struct tuntap *tt,
system_check (command_line, es, S_FATAL, "Linux ip addr add failed");
} else {
openvpn_snprintf (command_line, sizeof (command_line),
- IPROUTE_PATH " addr add dev %s %s/%d broadcast %s",
+ "%s addr add dev %s %s/%d broadcast %s",
+ iproute_path,
actual,
ifconfig_local,
count_netmask_bits(ifconfig_remote_netmask),
@@ -1162,8 +1165,20 @@ open_tun (const char *dev, const char *dev_type, const char *dev_node, bool ipv6
#ifdef TUNSETPERSIST
+/*
+ * This can be removed in future
+ * when all systems will use newer
+ * linux-headers
+ */
+#ifndef TUNSETOWNER
+#define TUNSETOWNER _IOW('T', 204, int)
+#endif
+#ifndef TUNSETGROUP
+#define TUNSETGROUP _IOW('T', 206, int)
+#endif
+
void
-tuncfg (const char *dev, const char *dev_type, const char *dev_node, bool ipv6, int persist_mode, const struct tuntap_options *options)
+tuncfg (const char *dev, const char *dev_type, const char *dev_node, bool ipv6, int persist_mode, const char *username, const char *groupname, const struct tuntap_options *options)
{
struct tuntap *tt;
@@ -1174,6 +1189,26 @@ tuncfg (const char *dev, const char *dev_type, const char *dev_node, bool ipv6,
open_tun (dev, dev_type, dev_node, ipv6, tt);
if (ioctl (tt->fd, TUNSETPERSIST, persist_mode) < 0)
msg (M_ERR, "Cannot ioctl TUNSETPERSIST(%d) %s", persist_mode, dev);
+ if (username != NULL)
+ {
+ struct user_state user_state;
+
+ if (!get_user (username, &user_state))
+ msg (M_ERR, "Cannot get user entry for %s", username);
+ else
+ if (ioctl (tt->fd, TUNSETOWNER, user_state.pw->pw_uid) < 0)
+ msg (M_ERR, "Cannot ioctl TUNSETOWNER(%s) %s", username, dev);
+ }
+ if (groupname != NULL)
+ {
+ struct group_state group_state;
+
+ if (!get_group (groupname, &group_state))
+ msg (M_ERR, "Cannot get group entry for %s", groupname);
+ else
+ if (ioctl (tt->fd, TUNSETGROUP, group_state.gr->gr_gid) < 0)
+ msg (M_ERR, "Cannot ioctl TUNSETOWNER(%s) %s", groupname, dev);
+ }
close_tun (tt);
msg (M_INFO, "Persist state set to: %s", (persist_mode ? "ON" : "OFF"));
}
@@ -1185,6 +1220,19 @@ close_tun (struct tuntap *tt)
{
if (tt)
{
+#ifdef CONFIG_FEATURE_IPROUTE
+ char command_line[256];
+ /*
+ * Flush IP configuration for the device
+ */
+ openvpn_snprintf (command_line, sizeof (command_line),
+ "%s addr flush dev %s",
+ iproute_path,
+ tt->actual_name
+ );
+ msg (M_INFO, "%s", command_line);
+ system_check (command_line, NULL, S_FATAL, "Linux ip flush failed");
+#endif
close_tun_generic (tt);
free (tt);
}
diff --git a/tun.h b/tun.h
index b25587c..63e6ca8 100644
--- a/tun.h
+++ b/tun.h
@@ -204,7 +204,8 @@ int write_tun (struct tuntap* tt, uint8_t *buf, int len);
int read_tun (struct tuntap* tt, uint8_t *buf, int len);
void tuncfg (const char *dev, const char *dev_type, const char *dev_node,
- bool ipv6, int persist_mode, const struct tuntap_options *options);
+ bool ipv6, int persist_mode, const char *username,
+ const char *groupname, const struct tuntap_options *options);
const char *guess_tuntap_dev (const char *dev,
const char *dev_type,
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-11 09:40:18 +0000