tun_linux.go 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324
  1. //go:build !android && !e2e_testing
  2. // +build !android,!e2e_testing
  3. package overlay
  4. import (
  5. "fmt"
  6. "io"
  7. "net"
  8. "os"
  9. "strings"
  10. "unsafe"
  11. "github.com/sirupsen/logrus"
  12. "github.com/slackhq/nebula/cidr"
  13. "github.com/slackhq/nebula/iputil"
  14. "github.com/vishvananda/netlink"
  15. "golang.org/x/sys/unix"
  16. )
  17. type tun struct {
  18. io.ReadWriteCloser
  19. fd int
  20. Device string
  21. cidr *net.IPNet
  22. MaxMTU int
  23. DefaultMTU int
  24. TXQueueLen int
  25. Routes []Route
  26. routeTree *cidr.Tree4
  27. l *logrus.Logger
  28. }
  29. type ifReq struct {
  30. Name [16]byte
  31. Flags uint16
  32. pad [8]byte
  33. }
  34. func ioctl(a1, a2, a3 uintptr) error {
  35. _, _, errno := unix.Syscall(unix.SYS_IOCTL, a1, a2, a3)
  36. if errno != 0 {
  37. return errno
  38. }
  39. return nil
  40. }
  41. type ifreqAddr struct {
  42. Name [16]byte
  43. Addr unix.RawSockaddrInet4
  44. pad [8]byte
  45. }
  46. type ifreqMTU struct {
  47. Name [16]byte
  48. MTU int32
  49. pad [8]byte
  50. }
  51. type ifreqQLEN struct {
  52. Name [16]byte
  53. Value int32
  54. pad [8]byte
  55. }
  56. func newTunFromFd(l *logrus.Logger, deviceFd int, cidr *net.IPNet, defaultMTU int, routes []Route, txQueueLen int) (*tun, error) {
  57. routeTree, err := makeRouteTree(routes, true)
  58. if err != nil {
  59. return nil, err
  60. }
  61. file := os.NewFile(uintptr(deviceFd), "/dev/net/tun")
  62. return &tun{
  63. ReadWriteCloser: file,
  64. fd: int(file.Fd()),
  65. Device: "tun0",
  66. cidr: cidr,
  67. DefaultMTU: defaultMTU,
  68. TXQueueLen: txQueueLen,
  69. Routes: routes,
  70. routeTree: routeTree,
  71. l: l,
  72. }, nil
  73. }
  74. func newTun(l *logrus.Logger, deviceName string, cidr *net.IPNet, defaultMTU int, routes []Route, txQueueLen int, multiqueue bool) (*tun, error) {
  75. fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
  76. if err != nil {
  77. return nil, err
  78. }
  79. var req ifReq
  80. req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI)
  81. if multiqueue {
  82. req.Flags |= unix.IFF_MULTI_QUEUE
  83. }
  84. copy(req.Name[:], deviceName)
  85. if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
  86. return nil, err
  87. }
  88. name := strings.Trim(string(req.Name[:]), "\x00")
  89. file := os.NewFile(uintptr(fd), "/dev/net/tun")
  90. maxMTU := defaultMTU
  91. for _, r := range routes {
  92. if r.MTU > maxMTU {
  93. maxMTU = r.MTU
  94. }
  95. }
  96. routeTree, err := makeRouteTree(routes, true)
  97. if err != nil {
  98. return nil, err
  99. }
  100. return &tun{
  101. ReadWriteCloser: file,
  102. fd: int(file.Fd()),
  103. Device: name,
  104. cidr: cidr,
  105. MaxMTU: maxMTU,
  106. DefaultMTU: defaultMTU,
  107. TXQueueLen: txQueueLen,
  108. Routes: routes,
  109. routeTree: routeTree,
  110. l: l,
  111. }, nil
  112. }
  113. func (t *tun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
  114. fd, err := unix.Open("/dev/net/tun", os.O_RDWR, 0)
  115. if err != nil {
  116. return nil, err
  117. }
  118. var req ifReq
  119. req.Flags = uint16(unix.IFF_TUN | unix.IFF_NO_PI | unix.IFF_MULTI_QUEUE)
  120. copy(req.Name[:], t.Device)
  121. if err = ioctl(uintptr(fd), uintptr(unix.TUNSETIFF), uintptr(unsafe.Pointer(&req))); err != nil {
  122. return nil, err
  123. }
  124. file := os.NewFile(uintptr(fd), "/dev/net/tun")
  125. return file, nil
  126. }
  127. func (t *tun) RouteFor(ip iputil.VpnIp) iputil.VpnIp {
  128. r := t.routeTree.MostSpecificContains(ip)
  129. if r != nil {
  130. return r.(iputil.VpnIp)
  131. }
  132. return 0
  133. }
  134. func (t *tun) Write(b []byte) (int, error) {
  135. var nn int
  136. max := len(b)
  137. for {
  138. n, err := unix.Write(t.fd, b[nn:max])
  139. if n > 0 {
  140. nn += n
  141. }
  142. if nn == len(b) {
  143. return nn, err
  144. }
  145. if err != nil {
  146. return nn, err
  147. }
  148. if n == 0 {
  149. return nn, io.ErrUnexpectedEOF
  150. }
  151. }
  152. }
  153. func (t tun) deviceBytes() (o [16]byte) {
  154. for i, c := range t.Device {
  155. o[i] = byte(c)
  156. }
  157. return
  158. }
  159. func (t tun) Activate() error {
  160. devName := t.deviceBytes()
  161. var addr, mask [4]byte
  162. copy(addr[:], t.cidr.IP.To4())
  163. copy(mask[:], t.cidr.Mask)
  164. s, err := unix.Socket(
  165. unix.AF_INET,
  166. unix.SOCK_DGRAM,
  167. unix.IPPROTO_IP,
  168. )
  169. if err != nil {
  170. return err
  171. }
  172. fd := uintptr(s)
  173. ifra := ifreqAddr{
  174. Name: devName,
  175. Addr: unix.RawSockaddrInet4{
  176. Family: unix.AF_INET,
  177. Addr: addr,
  178. },
  179. }
  180. // Set the device ip address
  181. if err = ioctl(fd, unix.SIOCSIFADDR, uintptr(unsafe.Pointer(&ifra))); err != nil {
  182. return fmt.Errorf("failed to set tun address: %s", err)
  183. }
  184. // Set the device network
  185. ifra.Addr.Addr = mask
  186. if err = ioctl(fd, unix.SIOCSIFNETMASK, uintptr(unsafe.Pointer(&ifra))); err != nil {
  187. return fmt.Errorf("failed to set tun netmask: %s", err)
  188. }
  189. // Set the device name
  190. ifrf := ifReq{Name: devName}
  191. if err = ioctl(fd, unix.SIOCGIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
  192. return fmt.Errorf("failed to set tun device name: %s", err)
  193. }
  194. // Set the MTU on the device
  195. ifm := ifreqMTU{Name: devName, MTU: int32(t.MaxMTU)}
  196. if err = ioctl(fd, unix.SIOCSIFMTU, uintptr(unsafe.Pointer(&ifm))); err != nil {
  197. // This is currently a non fatal condition because the route table must have the MTU set appropriately as well
  198. t.l.WithError(err).Error("Failed to set tun mtu")
  199. }
  200. // Set the transmit queue length
  201. ifrq := ifreqQLEN{Name: devName, Value: int32(t.TXQueueLen)}
  202. if err = ioctl(fd, unix.SIOCSIFTXQLEN, uintptr(unsafe.Pointer(&ifrq))); err != nil {
  203. // If we can't set the queue length nebula will still work but it may lead to packet loss
  204. t.l.WithError(err).Error("Failed to set tun tx queue length")
  205. }
  206. // Bring up the interface
  207. ifrf.Flags = ifrf.Flags | unix.IFF_UP
  208. if err = ioctl(fd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
  209. return fmt.Errorf("failed to bring the tun device up: %s", err)
  210. }
  211. // Set the routes
  212. link, err := netlink.LinkByName(t.Device)
  213. if err != nil {
  214. return fmt.Errorf("failed to get tun device link: %s", err)
  215. }
  216. // Default route
  217. dr := &net.IPNet{IP: t.cidr.IP.Mask(t.cidr.Mask), Mask: t.cidr.Mask}
  218. nr := netlink.Route{
  219. LinkIndex: link.Attrs().Index,
  220. Dst: dr,
  221. MTU: t.DefaultMTU,
  222. AdvMSS: t.advMSS(Route{}),
  223. Scope: unix.RT_SCOPE_LINK,
  224. Src: t.cidr.IP,
  225. Protocol: unix.RTPROT_KERNEL,
  226. Table: unix.RT_TABLE_MAIN,
  227. Type: unix.RTN_UNICAST,
  228. }
  229. err = netlink.RouteReplace(&nr)
  230. if err != nil {
  231. return fmt.Errorf("failed to set mtu %v on the default route %v; %v", t.DefaultMTU, dr, err)
  232. }
  233. // Path routes
  234. for _, r := range t.Routes {
  235. nr := netlink.Route{
  236. LinkIndex: link.Attrs().Index,
  237. Dst: r.Cidr,
  238. MTU: r.MTU,
  239. AdvMSS: t.advMSS(r),
  240. Scope: unix.RT_SCOPE_LINK,
  241. }
  242. if r.Metric > 0 {
  243. nr.Priority = r.Metric
  244. }
  245. err = netlink.RouteAdd(&nr)
  246. if err != nil {
  247. return fmt.Errorf("failed to set mtu %v on route %v; %v", r.MTU, r.Cidr, err)
  248. }
  249. }
  250. // Run the interface
  251. ifrf.Flags = ifrf.Flags | unix.IFF_UP | unix.IFF_RUNNING
  252. if err = ioctl(fd, unix.SIOCSIFFLAGS, uintptr(unsafe.Pointer(&ifrf))); err != nil {
  253. return fmt.Errorf("failed to run tun device: %s", err)
  254. }
  255. return nil
  256. }
  257. func (t *tun) Cidr() *net.IPNet {
  258. return t.cidr
  259. }
  260. func (t *tun) Name() string {
  261. return t.Device
  262. }
  263. func (t tun) advMSS(r Route) int {
  264. mtu := r.MTU
  265. if r.MTU == 0 {
  266. mtu = t.DefaultMTU
  267. }
  268. // We only need to set advmss if the route MTU does not match the device MTU
  269. if mtu != t.MaxMTU {
  270. return mtu - 40
  271. }
  272. return 0
  273. }