Free Software Foundation, Inc., 59 Temple Place - Suite 330,
Boston, MA 02111-1307, USA.
*/
+/**
+ * @file exit/gnunet-helper-exit-windows.c
+ * @brief the helper for the EXIT service in win32 builds.
+ * Opens a virtual network-interface, sends data received on the if to stdout,
+ * sends data received on stdin to the interface
+ * @author Christian M. Fuchs
+ *
+ * The following list of people have reviewed this code and considered
+ * it safe since the last modification (if you reviewed it, please
+ * have your name added to the list):
+ *
+ */
#include <stdio.h>
+#include <Winsock2.h>
#include <windows.h>
#include <setupapi.h>
+#ifndef __MINGW64_VERSION_MAJOR
#include <ddk/cfgmgr32.h>
#include <ddk/newdev.h>
-#include <Winsock2.h>
+#else
+#include <cfgmgr32.h>
+#include <newdev.h>
+#endif
#include <time.h>
#include "platform.h"
#include "tap-windows.h"
#define LOG_DEBUG(msg) do {} while (0)
#endif
+/**
+ * Will this binary be run in permissions testing mode?
+ */
+static boolean privilege_testing = FALSE;
/**
* Maximum size of a GNUnet message (GNUNET_SERVER_MAX_MESSAGE_SIZE)
* Name or Path+Name of our win32 driver.
* The .sys and .cat files HAVE to be in the same location as this file!
*/
-#define INF_FILE "share/gnunet/tapw32/OemWin2k.inf"
+#define INF_FILE "share/gnunet/openvpn-tap32/tapw32/OemWin2k.inf"
/**
* Name or Path+Name of our win64 driver.
* The .sys and .cat files HAVE to be in the same location as this file!
*/
-#define INF_FILE64 "share/gnunet/tapw64/OemWin2k.inf"
+#define INF_FILE64 "share/gnunet/openvpn-tap32/tapw64/OemWin2k.inf"
/**
- * Hardware ID used in the inf-file.
+ * Hardware ID used in the inf-file.
* This might change over time, as openvpn advances their driver
*/
#define HARDWARE_ID "tap0901"
#define TAP_WIN_MIN_MAJOR 9
/**
- * Minimum minor-id of the driver version we can work with.
+ * Minimum minor-id of the driver version we can work with.
* v <= 7 has buggy IPv6.
* v == 8 is broken for small IPv4 Packets
*/
/**
* Time in seconds to wait for our virtual device to go up after telling it to do so.
- *
+ *
* openvpn doesn't specify a value, 4 seems sane for testing, even for openwrt
* (in fact, 4 was chosen by a fair dice roll...)
*/
#define INTERFACE_REGISTRY_LOCATION "SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}"
/**
- * Our local process' PID. Used for creating a sufficiently unique additional
+ * Our local process' PID. Used for creating a sufficiently unique additional
* hardware ID for our device.
*/
static char secondary_hwid[LINE_LEN / 2];
*/
static char device_visible_name[256];
-/**
+/**
* This is our own local instance of a virtual network interface
* It is (somewhat) equivalent to using tun/tap in unixoid systems
- *
+ *
* Upon initialization, we create such an device node.
* Upon termination, we remove it again.
- *
+ *
* If we crash this device might stay around.
*/
static HDEVINFO DeviceInfo = INVALID_HANDLE_VALUE;
static SP_DEVINFO_DATA DeviceNode;
/**
- * GUID of our virtual device in the form of
+ * GUID of our virtual device in the form of
* {12345678-1234-1234-1234-123456789abc} - in hex
*/
static char device_guid[256];
enum IO_State
{
- /**
- * overlapped I/O is ready for work
+ /**
+ * overlapped I/O is ready for work
*/
IOSTATE_READY = 0,
- /**
- * overlapped I/O has been queued
+ /**
+ * overlapped I/O has been queued
*/
IOSTATE_QUEUED,
- /**
- * overlapped I/O has finished, but is waiting for it's write-partner
+ /**
+ * overlapped I/O has finished, but is waiting for it's write-partner
*/
- IOSTATE_WAITING,
-
- /**
+ IOSTATE_WAITING,
+
+ /**
* there is a full buffer waiting
*/
IOSTATE_RESUME,
- /**
+ /**
* Operlapped IO states for facility objects
- * overlapped I/O has failed, stop processing
+ * overlapped I/O has failed, stop processing
*/
- IOSTATE_FAILED
+ IOSTATE_FAILED
};
-/**
+/**
* A IO Object + read/writebuffer + buffer-size for windows asynchronous IO handling
*/
struct io_facility
* Amount of data actually written or read by readfile/writefile.
*/
DWORD buffer_size_processed;
+
+ /**
+ * How much of this buffer we have written in total
+ */
+ DWORD buffer_size_written;
};
/**
/**
* Determines if the host OS is win32 or win64
- *
- * @return true if
+ *
+ * @return true if
*/
BOOL
is_win64 ()
{
#if defined(_WIN64)
- //this is a win64 binary,
- return TRUE;
+ //this is a win64 binary,
+ return TRUE;
#elif defined(_WIN32)
//this is a 32bit binary, and we need to check if we are running in WOW64
BOOL success = FALSE;
BOOL on_wow64 = FALSE;
LPFN_ISWOW64PROCESS IsWow64Process = (LPFN_ISWOW64PROCESS) GetProcAddress (GetModuleHandle ("kernel32"), "IsWow64Process");
-
+
if (NULL != IsWow64Process)
success = IsWow64Process (GetCurrentProcess (), &on_wow64);
-
+
return success && on_wow64;
#endif
}
/**
* Wrapper for executing a shellcommand in windows.
- *
+ *
* @param command - the command + parameters to execute
- * @return * exitcode of the program executed,
+ * @return * exitcode of the program executed,
* * EINVAL (cmd/file not found)
* * EPIPE (could not read STDOUT)
*/
/**
* @brief Removes the IPv6-Address given in address from the interface dev
*
- * @param dev the interface to remove
* @param address the IPv4-Address
- * @param mask the netmask
*/
static void
remove_address6 (const char *address)
*/
snprintf (command, LINE_LEN,
"netsh interface ipv6 delete address \"%s\" store=persistent",
- device_visible_name, address);
+ device_visible_name);
/*
* Set the address
*/
/**
* @brief Sets the IPv4-Address given in address on the interface dev
*
- * @param dev the interface to configure
* @param address the IPv4-Address
* @param mask the netmask
*/
strerror (errno));
return -1;
}
- // Set Device to Subnet-Mode?
+ // Set Device to Subnet-Mode?
// do we really need tun.c:2925 ?
/*
/**
* @brief Removes the IPv4-Address given in address from the interface dev
*
- * @param dev the interface to remove
* @param address the IPv4-Address
- * @param mask the netmask
*/
static void
remove_address4 (const char *address)
*/
snprintf (command, LINE_LEN,
"netsh interface ipv4 delete address \"%s\" gateway=all store=persistent",
- device_visible_name, address);
+ device_visible_name);
/*
* Set the address
*/
/**
- * Setup a new virtual interface to use for tunneling.
- *
+ * Setup a new virtual interface to use for tunneling.
+ *
* @return: TRUE if setup was successful, else FALSE
*/
static BOOL
{
/*
* where to find our inf-file. (+ the "full" path, after windows found")
- *
+ *
* We do not directly input all the props here, because openvpn will update
* these details over time.
*/
GUID class_guid;
int str_length = 0;
- /**
+ /**
* Set the device's hardware ID and add it to a list.
- * This information will later on identify this device in registry.
+ * This information will later on identify this device in registry.
*/
strncpy (hwidlist, HARDWARE_ID, LINE_LEN);
/**
- * this is kind of over-complicated, but allows keeps things independent of
- * how the openvpn-hwid is actually stored.
- *
+ * this is kind of over-complicated, but allows keeps things independent of
+ * how the openvpn-hwid is actually stored.
+ *
* A HWID list is double-\0 terminated and \0 separated
*/
str_length = strlen (hwidlist) + 1;
strncpy (&hwidlist[str_length], secondary_hwid, LINE_LEN);
str_length += strlen (&hwidlist[str_length]) + 1;
-
- /**
+
+ /**
* Locate the inf-file, we need to store it somewhere where the system can
* find it. We need to pick the correct driver for win32/win64.
*/
GetFullPathNameA (INF_FILE, MAX_PATH, inf_file_path, &temp_inf_filename);
fprintf (stderr, "INFO: Located our driver's .inf file at %s\n", inf_file_path);
- /**
+ /**
* Bootstrap our device info using the drivers inf-file
*/
if ( ! SetupDiGetINFClassA (inf_file_path,
NULL))
return FALSE;
- /**
- * Collect all the other needed information...
- * let the system fill our this form
+ /**
+ * Collect all the other needed information...
+ * let the system fill our this form
*/
DeviceInfo = SetupDiCreateDeviceInfoList (&class_guid, NULL);
if (DeviceInfo == INVALID_HANDLE_VALUE)
/**
- * Remove our new virtual interface to use for tunneling.
+ * Remove our new virtual interface to use for tunneling.
* This function must be called AFTER setup_interface!
- *
+ *
* @return: TRUE if destruction was successful, else FALSE
*/
static BOOL
remove.Scope = DI_REMOVEDEVICE_GLOBAL;
remove.ClassInstallHeader.InstallFunction = DIF_REMOVE;
/*
- * 1. Prepare our existing device information set, and place the
+ * 1. Prepare our existing device information set, and place the
* uninstall related information into the structure
*/
if ( ! SetupDiSetClassInstallParamsA (DeviceInfo,
return FALSE;
SetupDiDestroyDeviceInfoList (DeviceInfo);
-
+
fprintf (stderr, "DEBUG: removed interface successfully\n");
return TRUE;
/**
* Do all the lookup necessary to retrieve the inteface's actual name
- * off the registry.
- *
+ * off the registry.
+ *
* @return: TRUE if we were able to lookup the interface's name, else FALSE
*/
static BOOL
0, //must be 0
NULL)) //hMachine, we are local
return FALSE;
-
+
fprintf (stderr, "DEBUG: Resolving interface name for network device %s\n",pnp_instance_id);
/* Registry is incredibly slow, retry for up to 30 seconds to allow registry to refresh */
&adapter_key_handle))
return FALSE;
- /* Of course there is a multitude of entries here, with arbitrary names,
+ /* Of course there is a multitude of entries here, with arbitrary names,
* thus we need to iterate through there.
*/
while (!retval)
NULL,
NULL);
- /* this may fail due to one of two reasons:
+ /* this may fail due to one of two reasons:
* we are at the end of the list*/
if (ERROR_NO_MORE_ITEMS == status)
break;
if (status != ERROR_SUCCESS || data_type != REG_SZ)
goto cleanup;
- /*
- * we have successfully found OUR instance,
+ /*
+ * we have successfully found OUR instance,
* save the device GUID before exiting
*/
/**
* Determines the version of the installed TAP32 driver and checks if it's sufficiently new for GNUNET
- *
+ *
* @param handle the handle to our tap device
* @return TRUE if the version is sufficient, else FALSE
*/
TAP_WIN_MIN_MINOR);
return FALSE;
}
-
+
return TRUE;
}
/**
* Brings a TAP device up and sets it to connected state.
- *
- * @param handle the handle to our TAP device
+ *
+ * @param handle the handle to our TAP device
* @return True if the operation succeeded, else false
*/
static BOOL
/**
* Attempts to read off an input facility (tap or named pipe) in overlapped mode.
- *
- * 1.
+ *
+ * 1.
* If the input facility is in IOSTATE_READY, it will issue a new read operation to the
- * input handle. Then it goes into IOSTATE_QUEUED state.
+ * input handle. Then it goes into IOSTATE_QUEUED state.
* In case the read succeeded instantly the input facility enters 3.
- *
- * 2.
+ *
+ * 2.
* If the input facility is in IOSTATE_QUEUED state, it will check if the queued read has finished already.
* If it has finished, go to state 3.
* If it has failed, set IOSTATE_FAILED
- *
+ *
* 3.
* If the output facility is in state IOSTATE_READY, the read-buffer is copied to the output buffer.
* The input facility enters state IOSTATE_READY
* The output facility enters state IOSTATE_READY
* If the output facility is in state IOSTATE_QUEUED, the input facility enters IOSTATE_WAITING
- *
+ *
* IOSTATE_WAITING is reset by the output facility, once it has completed.
- *
+ *
* @param input_facility input named pipe or file to work with.
* @param output_facility output pipe or file to hand over data to.
* @return false if an event reset was impossible (OS error), else true
{
struct GNUNET_MessageHeader * hdr;
unsigned short size;
-
+
switch (input_facility->facility_state)
{
case IOSTATE_READY:
- {
+ {
if (! ResetEvent (input_facility->overlapped.hEvent))
{
return FALSE;
/* reset event manually*/
if (! SetEvent (input_facility->overlapped.hEvent))
return FALSE;
-
+
fprintf (stderr, "DEBUG: tap read succeeded immediately\n");
-
+
/* we successfully read something from the TAP and now need to
* send it our via STDOUT. Is that possible at the moment? */
if ((IOSTATE_READY == output_facility->facility_state ||
{ /* hand over this buffers content and apply message header for gnunet */
hdr = (struct GNUNET_MessageHeader *) output_facility->buffer;
size = input_facility->buffer_size + sizeof (struct GNUNET_MessageHeader);
-
+
memcpy (output_facility->buffer + sizeof (struct GNUNET_MessageHeader),
input_facility->buffer,
input_facility->buffer_size);
return FALSE;
fprintf (stderr, "DEBUG: tap read succeeded delayed\n");
-
+
/* we successfully read something from the TAP and now need to
* send it our via STDOUT. Is that possible at the moment? */
if ((IOSTATE_READY == output_facility->facility_state ||
{ /* hand over this buffers content and apply message header for gnunet */
hdr = (struct GNUNET_MessageHeader *) output_facility->buffer;
size = input_facility->buffer_size + sizeof (struct GNUNET_MessageHeader);
-
+
memcpy (output_facility->buffer + sizeof (struct GNUNET_MessageHeader),
input_facility->buffer,
input_facility->buffer_size);
/**
* Attempts to read off an input facility (tap or named pipe) in overlapped mode.
- *
- * 1.
+ *
+ * 1.
* If the input facility is in IOSTATE_READY, it will issue a new read operation to the
- * input handle. Then it goes into IOSTATE_QUEUED state.
+ * input handle. Then it goes into IOSTATE_QUEUED state.
* In case the read succeeded instantly the input facility enters 3.
- *
- * 2.
+ *
+ * 2.
* If the input facility is in IOSTATE_QUEUED state, it will check if the queued read has finished already.
* If it has finished, go to state 3.
* If it has failed, set IOSTATE_FAILED
- *
+ *
* 3.
* If the facility is finished with ready
* The read-buffer is copied to the output buffer, except for the GNUNET_MessageHeader.
* The input facility enters state IOSTATE_READY
* The output facility enters state IOSTATE_READY
* If the output facility is in state IOSTATE_QUEUED, the input facility enters IOSTATE_WAITING
- *
+ *
* IOSTATE_WAITING is reset by the output facility, once it has completed.
- *
+ *
* @param input_facility input named pipe or file to work with.
* @param output_facility output pipe or file to hand over data to.
* @return false if an event reset was impossible (OS error), else true
struct io_facility * output_facility)
{
struct GNUNET_MessageHeader * hdr;
-
+
switch (input_facility->facility_state)
{
case IOSTATE_READY:
{
input_facility->buffer_size = 0;
-
+
partial_read_iostate_ready:
if (! ResetEvent (input_facility->overlapped.hEvent))
return FALSE;
-
+
/* Check how the task is handled */
if (ReadFile (input_facility->handle,
input_facility->buffer + input_facility->buffer_size,
input_facility->facility_state = IOSTATE_WAITING;
else /* we read nothing */
input_facility->facility_state = IOSTATE_READY;
- }
+ }
else /* operation was either queued or failed*/
{
int err = GetLastError ();
FALSE))
{/* successful return for a queued operation */
hdr = (struct GNUNET_MessageHeader *) input_facility->buffer;
-
+
if (! ResetEvent (input_facility->overlapped.hEvent))
return FALSE;
-
+
fprintf (stderr, "DEBUG: stdin read succeeded delayed\n");
input_facility->buffer_size += input_facility->buffer_size_processed;
-
+
if ((ntohs (hdr->type) != GNUNET_MESSAGE_TYPE_VPN_HELPER) ||
(ntohs (hdr->size) > sizeof (input_facility->buffer)))
{
* Attempts to write to an output facility (tap or named pipe) in overlapped mode.
*
* TODO: high level description
- *
+ *
* @param output_facility output pipe or file to hand over data to.
* @param input_facility input named pipe or file to work with.
* @return false if an event reset was impossible (OS error), else true
attempt_write (struct io_facility * output_facility,
struct io_facility * input_facility)
{
- BOOL status;
-
switch (output_facility->facility_state)
{
case IOSTATE_READY:
+ output_facility->buffer_size_written = 0;
+continue_partial_write:
if (! ResetEvent (output_facility->overlapped.hEvent))
return FALSE;
- output_facility->buffer_size_processed = 0;
- status = WriteFile (output_facility->handle,
- output_facility->buffer,
- output_facility->buffer_size,
- &output_facility->buffer_size_processed,
- &output_facility->overlapped);
-
/* Check how the task was handled */
- if (status &&
- output_facility->buffer_size_processed == output_facility->buffer_size)
+ if (WriteFile (output_facility->handle,
+ output_facility->buffer + output_facility->buffer_size_written,
+ output_facility->buffer_size - output_facility->buffer_size_written,
+ &output_facility->buffer_size_processed,
+ &output_facility->overlapped))
{/* async event processed immediately*/
fprintf (stderr, "DEBUG: write succeeded immediately\n");
-
+ output_facility->buffer_size_written += output_facility->buffer_size_processed;
+
/* reset event manually*/
if (! SetEvent (output_facility->overlapped.hEvent))
return FALSE;
+ /* partial write */
+ if (output_facility->buffer_size_written < output_facility->buffer_size)
+ goto continue_partial_write;
+
/* we are now waiting for our buffer to be filled*/
output_facility->facility_state = IOSTATE_WAITING;
- output_facility->buffer_size = 0;
- output_facility->buffer_size_processed = 0;
/* we successfully wrote something and now need to reset our reader */
if (IOSTATE_WAITING == input_facility->facility_state)
return TRUE;
case IOSTATE_QUEUED:
// there was an operation going on already, check if that has completed now.
- status = GetOverlappedResult (output_facility->handle,
+
+ if (GetOverlappedResult (output_facility->handle,
&output_facility->overlapped,
&output_facility->buffer_size_processed,
- FALSE);
- if (status &&
- output_facility->buffer_size_processed == output_facility->buffer_size)
+ FALSE))
{/* successful return for a queued operation */
if (! ResetEvent (output_facility->overlapped.hEvent))
return FALSE;
-
+
fprintf (stderr, "DEBUG: write succeeded delayed\n");
+ output_facility->buffer_size_written += output_facility->buffer_size_processed;
+
+ /* partial write */
+ if (output_facility->buffer_size_written < output_facility->buffer_size)
+ goto continue_partial_write;
/* we are now waiting for our buffer to be filled*/
output_facility->facility_state = IOSTATE_WAITING;
- output_facility->buffer_size = 0;
- output_facility->buffer_size_processed = 0;
-
+
/* we successfully wrote something and now need to reset our reader */
if (IOSTATE_WAITING == input_facility->facility_state)
input_facility->facility_state = IOSTATE_RESUME;
fprintf (stderr, "FATAL: Write to handle failed, exiting\n");
}
}
- default:
+ default:
return TRUE;
}
}
/**
* Initialize a overlapped structure
- *
+ *
* @param elem the element to initilize
* @param initial_state the initial state for this instance
* @param signaled if the hEvent created should default to signaled or not
/**
* Start forwarding to and from the tunnel.
*
- * @param fd_tun tunnel FD
+ * @param tap_handle device handle for interacting with the Virtual interface
*/
static void
run (HANDLE tap_handle)
/* tun up: */
/* we do this HERE and not beforehand (in init_tun()), in contrast to openvpn
* to remove the need to flush the arp cache, handle DHCP and wrong IPs.
- *
+ *
* DHCP and such are all features we will never use in gnunet afaik.
* But for openvpn those are essential.
*/
- if (! tun_up (tap_handle))
- return;
+ if ((privilege_testing) || (! tun_up (tap_handle) ))
+ goto teardown_final;
/* Initialize our overlapped IO structures*/
if (! (initialize_io_facility (&tap_read, IOSTATE_READY, FALSE)
/* Debug output to console STDIN/STDOUT*/
std_in.handle = parent_std_in_handle;
std_out.handle = parent_std_out_handle;
-
+
#else
fprintf (stderr, "DEBUG: reopening stdin/out for overlapped IO\n");
- /*
- * Find out the types of our handles.
- * This part is a problem, because in windows we need to handle files,
+ /*
+ * Find out the types of our handles.
+ * This part is a problem, because in windows we need to handle files,
* pipes and the console differently.
*/
if ((FILE_TYPE_PIPE != GetFileType (parent_std_in_handle)) ||
goto teardown;
}
#endif
-
+
fprintf (stderr, "DEBUG: mainloop has begun\n");
-
+
while (std_out.path_open || tap_write.path_open)
{
/* perform READ from stdin if possible */
if (std_out.path_open && (! attempt_write (&std_out, &tap_read)))
break;
}
+ fprintf (stderr, "DEBUG: teardown initiated\n");
teardown:
- fprintf (stderr, "DEBUG: teardown initiated\n");
-
CancelIo (tap_handle);
CancelIo (std_in.handle);
CancelIo (std_out.handle);
teardown_final:
-
+
CloseHandle (tap_handle);
}
* Open VPN tunnel interface.
*
* @param argc must be 6
- * @param argv 0: binary name (gnunet-helper-vpn)
- * 1: tunnel interface prefix (gnunet-vpn)
- * 2: IPv6 address (::1), "-" to disable
- * 3: IPv6 netmask length in bits (64), ignored if #2 is "-"
- * 4: IPv4 address (1.2.3.4), "-" to disable
- * 5: IPv4 netmask (255.255.0.0), ignored if #4 is "-"
+ * @param argv 0: binary name ("gnunet-helper-exit")
+ * 1: tunnel interface name ("gnunet-exit")
+ * 2: IPv4 "physical" interface name ("eth0"), or "-" to not do IPv4 NAT
+ * 3: IPv6 address ("::1"), or "-" to skip IPv6
+ * 4: IPv6 netmask length in bits ("64") [ignored if #4 is "-"]
+ * 5: IPv4 address ("1.2.3.4"), or "-" to skip IPv4
+ * 6: IPv4 netmask ("255.255.0.0") [ignored if #4 is "-"]
*/
int
main (int argc, char **argv)
{
char hwid[LINE_LEN];
HANDLE handle;
- int global_ret = 0;
+ int global_ret = 1;
+ int local_ret = EINVAL;
BOOL have_ip4 = FALSE;
BOOL have_ip6 = FALSE;
+ BOOL have_nat44 = FALSE;
+
+ if ( (1 < argc) && (0 != strcmp (argv[1], "-d"))){
+ privilege_testing = TRUE;
+ fprintf (stderr,
+ "%s",
+ "DEBUG: Running binary in privilege testing mode.");
+ argv++;
+ argc--;
+ }
if (6 != argc)
{
- fprintf (stderr, "FATAL: must supply 5 arguments\nUsage:\ngnunet-helper-vpn <if name prefix> <address6 or \"-\"> <netbits6> <address4 or \"-\"> <netmask4>\n", argv[0]);
+ fprintf (stderr,
+ "%s",
+ "FATAL: must supply 6 arguments\nUsage:\ngnunet-helper-exit [-d] <if name prefix> <uplink-interface name> <address6 or \"-\"> <netbits6> <address4 or \"-\"> <netmask4>\n");
return 1;
}
strncpy (hwid, argv[1], LINE_LEN);
hwid[LINE_LEN - 1] = '\0';
- /*
- * We use our PID for finding/resolving the control-panel name of our virtual
- * device. PIDs are (of course) unique at runtime, thus we can safely use it
+ /*
+ * We use our PID for finding/resolving the control-panel name of our virtual
+ * device. PIDs are (of course) unique at runtime, thus we can safely use it
* as additional hardware-id for our device.
*/
snprintf (secondary_hwid, LINE_LEN / 2, "%s-%d",
{
fprintf (stderr, "FATAL: could not initialize virtual-interface %s with IPv6 %s/%s and IPv4 %s/%s\n",
hwid,
- argv[2],
argv[3],
argv[4],
- argv[5]);
+ argv[5],
+ argv[6]);
global_ret = -1;
goto cleanup;
}
fprintf (stderr, "DEBUG: Setting IPs, if needed\n");
- if (0 != strcmp (argv[2], "-"))
+ if (0 != strcmp (argv[3], "-"))
{
- const char *address = argv[2];
- long prefix_len = atol (argv[3]);
+ char command[LINE_LEN];
+ const char *address = argv[3];
+ long prefix_len = atol (argv[4]);
if ((prefix_len < 1) || (prefix_len > 127))
{
goto cleanup;
}
- fprintf (stderr, "DEBUG: Setting IP6 address: %s/%d\n",address,prefix_len);
+ fprintf (stderr, "DEBUG: Setting IP6 address: %s/%d\n", address, prefix_len);
if (0 != (global_ret = set_address6 (address, prefix_len)))
goto cleanup;
have_ip6 = TRUE;
+
+ /* install our the windows NAT module*/
+ fprintf (stderr, "DEBUG: Setting IPv6 Forwarding for internal and external interface.\n");
+ /* outside interface (maybe that's already set) */
+ snprintf (command, LINE_LEN,
+ "netsh interface ipv6 set interface interface=\"%s\" metric=1 forwarding=enabled store=active",
+ argv[2]);
+ local_ret = execute_shellcommand (command);
+ if (0 != local_ret)
+ {
+ fprintf (stderr, "FATAL: Could not enable forwarding via netsh: %s\n", strerror (local_ret));
+ goto cleanup;
+ }
+ /* internal interface */
+ snprintf (command, LINE_LEN,
+ "netsh interface ipv6 set interface interface=\"%s\" metric=1 forwarding=enabled advertise=enabled store=active",
+ device_visible_name);
+ local_ret = execute_shellcommand (command);
+ if (0 != local_ret)
+ {
+ fprintf (stderr, "FATAL: Could not enable forwarding via netsh: %s\n", strerror (local_ret));
+ goto cleanup;
+ }
+ /* we can keep IPv6 forwarding around, as all interfaces have
+ * their forwarding mode reset to false at bootup. */
}
- if (0 != strcmp (argv[4], "-"))
+ if (0 != strcmp (argv[5], "-"))
{
- const char *address = argv[4];
- const char *mask = argv[5];
+ const char *address = argv[5];
+ const char *mask = argv[6];
- fprintf (stderr, "DEBUG: Setting IP4 address: %s/%s\n",address,mask);
+ fprintf (stderr, "DEBUG: Setting IP4 address: %s/%s\n", address, mask);
if (0 != (global_ret = set_address4 (address, mask)))
goto cleanup;
+ // setup NAPT, if possible
+ /* MS has REMOVED the routing/nat capabilities from Vista+, thus
+ * we can not setup NAT like in XP or on the server. Actually the
+ * the only feasible solution seems to be to use
+ * Internet Connection Sharing, which introduces a horde of problems
+ * such as sending out rogue-RAs on the external interface in an ipv6
+ * network.
+ * Thus, below stuff ONLY works on
+ * WinXP SP3
+ * Win Server 2003 SP1+
+ * Win Server 2008
+ * ...
+ */
have_ip4 = TRUE;
+ if (0 != strcmp (argv[2], "-"))
+ {
+ char command[LINE_LEN];
+
+ /* install our the windows NAT module*/
+ fprintf (stderr, "DEBUG: Adding NAPT/Masquerading between external IF %s and mine.\n", argv[2]);
+ local_ret = execute_shellcommand ("netsh routing ip nat install");
+ if (0 != local_ret)
+ {
+ fprintf (stderr, "FATAL: Could not install NAPT support via Netsh: %s\n", strerror (local_ret));
+ goto cleanup;
+ }
+ /* external IF */
+ snprintf (command, LINE_LEN,
+ "netsh routing ip nat add interface \"%s\" full", /*full = NAPT (addr+port)*/
+ argv[2]);
+ local_ret = execute_shellcommand (command);
+ if (0 != local_ret)
+ {
+ fprintf (stderr, "FATAL: IPv4-NAPT on external interface failed: %s\n", strerror (local_ret));
+ goto cleanup;
+ }
+ /* private/internal/virtual IF */
+ snprintf (command, LINE_LEN,
+ "netsh routing ip nat add interface \"%s\" private",
+ device_visible_name);
+ local_ret = execute_shellcommand (command);
+ if (0 != local_ret)
+ {
+ fprintf (stderr, "FATAL: IPv4-NAPT on internal interface failed: %s\n", strerror (local_ret));
+ goto cleanup;
+
+ have_nat44 = TRUE;
+ }
+ }
}
run (handle);
- global_ret = 0;
cleanup:
- if (have_ip4)
- {
- const char *address = argv[4];
- fprintf (stderr, "DEBUG: Removing IP4 address\n");
+ if (have_ip4) {
+ const char *address = argv[5];
+ if (have_nat44) {
+ char command[LINE_LEN];
+ fprintf(stderr, "DEBUG: removing IP4 NAPT from virtual interface \n");
+ snprintf(command, LINE_LEN,
+ "netsh routing ip nat del interface \"%s\"",
+ device_visible_name);
+ local_ret = execute_shellcommand(command);
+ if (0 != local_ret)
+ fprintf(stderr, "WARNING: Could not remove IPv4-NAPT from internal interface, hopefully this will have no effect in future runs: %s\n", strerror(local_ret));
+ }
+
+ fprintf(stderr, "DEBUG: Removing IP4 address\n");
remove_address4 (address);
- }
+ }
if (have_ip6)
{
- const char *address = argv[2];
+ const char *address = argv[3];
fprintf (stderr, "DEBUG: Removing IP6 address\n");
remove_address6 (address);
}