Merge commit '86cc97e55fe346502462284d2e636a2b3708163e' as 'Sources/OpenVPN3'

Sources/OpenVPN3/openvpn/tun/linux/client/tuncli.hpp

@@ -0,0 +1,356 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Client tun interface for Linux.
+
+#ifndef OPENVPN_TUN_LINUX_CLIENT_TUNCLI_H
+#define OPENVPN_TUN_LINUX_CLIENT_TUNCLI_H
+
+#include <openvpn/asio/asioerr.hpp>
+#include <openvpn/common/cleanup.hpp>
+#include <openvpn/common/scoped_fd.hpp>
+#include <openvpn/tun/builder/setup.hpp>
+#include <openvpn/tun/tunio.hpp>
+#include <openvpn/tun/persist/tunpersist.hpp>
+
+// check if Netlink has been selected at compile time
+#ifdef OPENVPN_USE_SITNL
+#include <openvpn/tun/linux/client/tunnetlink.hpp>
+#define TUN_LINUX openvpn::TunNetlink::TunMethods
+#else
+#include <openvpn/tun/linux/client/tuniproute.hpp>
+#define TUN_LINUX openvpn::TunIPRoute::TunMethods
+#endif
+
+namespace openvpn {
+  namespace TunLinux {
+
+    struct PacketFrom
+    {
+      typedef std::unique_ptr<PacketFrom> SPtr;
+      BufferAllocated buf;
+    };
+
+    template <typename ReadHandler>
+    class Tun : public TunIO<ReadHandler, PacketFrom, openvpn_io::posix::stream_descriptor>
+    {
+      typedef TunIO<ReadHandler, PacketFrom, openvpn_io::posix::stream_descriptor> Base;
+
+    public:
+      typedef RCPtr<Tun> Ptr;
+
+      Tun(openvpn_io::io_context& io_context,
+	  ReadHandler read_handler_arg,
+	  const Frame::Ptr& frame_arg,
+	  const SessionStats::Ptr& stats_arg,
+	  const int socket,
+	  const std::string& name)
+	: Base(read_handler_arg, frame_arg, stats_arg)
+      {
+	Base::name_ = name;
+	Base::retain_stream = true;
+	Base::stream = new openvpn_io::posix::stream_descriptor(io_context, socket);
+	OPENVPN_LOG_TUN(Base::name_ << " opened");
+      }
+
+      ~Tun() { Base::stop(); }
+    };
+
+    typedef TunPersistTemplate<ScopedFD> TunPersist;
+
+    class ClientConfig : public TunClientFactory
+    {
+    public:
+      typedef RCPtr<ClientConfig> Ptr;
+
+      std::string dev_name;
+      int txqueuelen = 200;
+
+      TunProp::Config tun_prop;
+
+      int n_parallel = 8;
+      Frame::Ptr frame;
+      SessionStats::Ptr stats;
+
+      TunBuilderSetup::Factory::Ptr tun_setup_factory;
+      TunPersist::Ptr tun_persist;
+
+      void load(const OptionList& opt)
+      {
+	// set a default MTU
+	if (!tun_prop.mtu)
+	  tun_prop.mtu = 1500;
+
+	// parse "dev" option
+	if (dev_name.empty())
+	  {
+	    const Option* dev = opt.get_ptr("dev");
+	    if (dev)
+	      dev_name = dev->get(1, 64);
+	  }
+      }
+
+      static Ptr new_obj()
+      {
+	return new ClientConfig;
+      }
+
+      virtual TunClient::Ptr new_tun_client_obj(openvpn_io::io_context& io_context,
+						TunClientParent& parent,
+						TransportClient* transcli);
+
+      TunBuilderSetup::Base::Ptr new_setup_obj()
+      {
+	if (tun_setup_factory)
+	  return tun_setup_factory->new_setup_obj();
+	else
+	  return new TunLinuxSetup::Setup<TUN_LINUX>();
+      }
+
+    private:
+      ClientConfig() {}
+    };
+
+    class Client : public TunClient
+    {
+      friend class ClientConfig;  // calls constructor
+      friend class TunIO<Client*, PacketFrom, openvpn_io::posix::stream_descriptor>;  // calls tun_read_handler
+
+      typedef Tun<Client*> TunImpl;
+
+    public:
+      virtual void tun_start(const OptionList& opt, TransportClient& transcli, CryptoDCSettings&) override
+      {
+	if (!impl)
+	  {
+	    halt = false;
+
+	    if (config->tun_persist)
+	      {
+		OPENVPN_LOG("TunPersist: long-term session scope");
+		tun_persist = config->tun_persist; // long-term persistent
+	      }
+	    else
+	      {
+		OPENVPN_LOG("TunPersist: short-term connection scope");
+		tun_persist.reset(new TunPersist(true, false, nullptr)); // short-term
+	      }
+
+	    try {
+	      const IP::Addr server_addr = transcli.server_endpoint_addr();
+
+	      int sd = -1;
+
+	      // Check if persisted tun session matches properties of to-be-created session
+	      if (tun_persist->use_persisted_tun(server_addr, config->tun_prop, opt))
+		{
+		  state = tun_persist->state();
+		  sd = tun_persist->obj();
+		  state = tun_persist->state();
+		  OPENVPN_LOG("TunPersist: reused tun context");
+		}
+	      else
+	        {
+		  // notify parent
+		  parent.tun_pre_tun_config();
+
+		  // close old tun handle if persisted
+		  tun_persist->close();
+
+		  // parse pushed options
+		  TunBuilderCapture::Ptr po(new TunBuilderCapture());
+		  TunProp::configure_builder(po.get(),
+		  			     state.get(),
+					     config->stats.get(),
+					     server_addr,
+					     config->tun_prop,
+					     opt,
+					     nullptr,
+					     false);
+
+		  OPENVPN_LOG("CAPTURED OPTIONS:" << std::endl << po->to_string());
+
+		  // create new tun setup object
+		  tun_setup = config->new_setup_obj();
+
+		  // create config object for tun setup layer
+		  TunLinuxSetup::Setup<TUN_LINUX>::Config tsconf;
+		  tsconf.layer = config->tun_prop.layer;
+		  tsconf.dev_name = config->dev_name;
+		  tsconf.txqueuelen = config->txqueuelen;
+		  tsconf.add_bypass_routes_on_establish = true;
+
+		  // open/config tun
+		  {
+		    std::ostringstream os;
+		    auto os_print = Cleanup([&os](){ OPENVPN_LOG_STRING(os.str()); });
+		    sd = tun_setup->establish(*po, &tsconf, nullptr, os);
+		  }
+
+		  // persist tun settings state
+		  state->iface_name = tsconf.iface_name;
+		  tun_persist->persist_tun_state(sd, state);
+
+		  // enable tun_setup destructor
+		  tun_persist->add_destructor(tun_setup);
+		}
+
+	      // start tun
+	      impl.reset(new TunImpl(io_context,
+				     this,
+				     config->frame,
+				     config->stats,
+				     sd,
+				     state->iface_name
+				     ));
+	      impl->start(config->n_parallel);
+
+	      // signal that we are connected
+	      parent.tun_connected();
+	    }
+	    catch (const std::exception& e)
+	      {
+		if (tun_persist)
+		  tun_persist->close();
+
+		stop();
+		parent.tun_error(Error::TUN_SETUP_FAILED, e.what());
+	      }
+	  }
+      }
+
+      virtual bool tun_send(BufferAllocated& buf) override
+      {
+	return send(buf);
+      }
+
+      virtual std::string tun_name() const override
+      {
+	if (impl)
+	  return impl->name();
+	else
+	  return "UNDEF_TUN";
+      }
+
+      virtual std::string vpn_ip4() const override
+      {
+	if (state->vpn_ip4_addr.specified())
+	  return state->vpn_ip4_addr.to_string();
+	else
+	  return "";
+      }
+
+      virtual std::string vpn_ip6() const override
+      {
+	if (state->vpn_ip6_addr.specified())
+	  return state->vpn_ip6_addr.to_string();
+	else
+	  return "";
+      }
+
+      virtual std::string vpn_gw4() const override
+      {
+	if (state->vpn_ip4_gw.specified())
+	  return state->vpn_ip4_gw.to_string();
+	else
+	  return "";
+      }
+
+      virtual std::string vpn_gw6() const override
+      {
+	if (state->vpn_ip6_gw.specified())
+	  return state->vpn_ip6_gw.to_string();
+	else
+	  return "";
+      }
+
+      virtual void set_disconnect() override
+      {
+      }
+
+      virtual void stop() override { stop_(); }
+      virtual ~Client() { stop_(); }
+
+    private:
+      Client(openvpn_io::io_context& io_context_arg,
+	     ClientConfig* config_arg,
+	     TunClientParent& parent_arg)
+	:  io_context(io_context_arg),
+	   config(config_arg),
+	   parent(parent_arg),
+	   state(new TunProp::State()),
+	   halt(false)
+      {
+      }
+
+      bool send(Buffer& buf)
+      {
+	if (impl)
+	  return impl->write(buf);
+	else
+	  return false;
+      }
+
+      void tun_read_handler(PacketFrom::SPtr& pfp) // called by TunImpl
+      {
+	parent.tun_recv(pfp->buf);
+      }
+
+      void tun_error_handler(const Error::Type errtype, // called by TunImpl
+			     const openvpn_io::error_code* error)
+      {
+      }
+
+      void stop_()
+      {
+	if (!halt)
+	  {
+	    halt = true;
+
+	    // stop tun
+	    if (impl)
+	      impl->stop();
+
+	    tun_persist.reset();
+	  }
+      }
+
+      openvpn_io::io_context& io_context;
+      TunPersist::Ptr tun_persist;
+      ClientConfig::Ptr config;
+      TunClientParent& parent;
+      TunImpl::Ptr impl;
+      TunProp::State::Ptr state;
+      TunBuilderSetup::Base::Ptr tun_setup;
+      bool halt;
+    };
+
+    inline TunClient::Ptr ClientConfig::new_tun_client_obj(openvpn_io::io_context& io_context,
+							   TunClientParent& parent,
+							   TransportClient* transcli)
+    {
+      return TunClient::Ptr(new Client(io_context, this, parent));
+    }
+
+  }
+} // namespace openvpn
+
+#endif // OPENVPN_TUN_LINUX_CLIENT_TUNCLI_H

Sources/OpenVPN3/openvpn/tun/linux/client/tuniproute.hpp

@@ -0,0 +1,351 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#pragma once
+
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <net/if.h>
+#include <linux/if_tun.h>
+
+#include <openvpn/common/exception.hpp>
+#include <openvpn/common/file.hpp>
+#include <openvpn/common/split.hpp>
+#include <openvpn/common/splitlines.hpp>
+#include <openvpn/common/hexstr.hpp>
+#include <openvpn/common/to_string.hpp>
+#include <openvpn/common/process.hpp>
+#include <openvpn/common/action.hpp>
+#include <openvpn/addr/route.hpp>
+#include <openvpn/tun/builder/capture.hpp>
+#include <openvpn/tun/builder/setup.hpp>
+#include <openvpn/tun/client/tunbase.hpp>
+#include <openvpn/tun/client/tunprop.hpp>
+#include <openvpn/tun/client/tunprop.hpp>
+#include <openvpn/tun/linux/client/tunsetup.hpp>
+#include <openvpn/netconf/linux/gw.hpp>
+
+namespace openvpn {
+  namespace TunIPRoute {
+
+    using namespace openvpn::TunLinuxSetup;
+
+    enum { // add_del_route flags
+      R_IPv6=(1<<0),
+      R_ADD_SYS=(1<<1),
+      R_ADD_DCO=(1<<2),
+      R_ADD_ALL=R_ADD_SYS|R_ADD_DCO,
+    };
+
+    inline IP::Addr cvt_pnr_ip_v4(const std::string& hexaddr)
+    {
+      BufferAllocated v(4, BufferAllocated::CONSTRUCT_ZERO);
+      parse_hex(v, hexaddr);
+      if (v.size() != 4)
+	throw tun_linux_error("bad hex address");
+      IPv4::Addr ret = IPv4::Addr::from_bytes(v.data());
+      return IP::Addr::from_ipv4(ret);
+    }
+
+    inline void add_del_route(const std::string& addr_str,
+			      const int prefix_len,
+			      const std::string& gateway_str,
+			      const std::string& dev,
+			      const unsigned int flags,
+			      std::vector<IP::Route>* rtvec,
+			      Action::Ptr& create,
+			      Action::Ptr& destroy)
+    {
+      if (flags & R_IPv6)
+	{
+	  const IPv6::Addr addr = IPv6::Addr::from_string(addr_str);
+	  const IPv6::Addr netmask = IPv6::Addr::netmask_from_prefix_len(prefix_len);
+	  const IPv6::Addr net = addr & netmask;
+
+	  if (flags & R_ADD_SYS)
+	    {
+	      // ip route add 2001:db8:1::/48 via 2001:db8:1::1
+	      Command::Ptr add(new Command);
+	      add->argv.push_back("/sbin/ip");
+	      add->argv.push_back("-6");
+	      add->argv.push_back("route");
+	      add->argv.push_back("prepend");
+	      add->argv.push_back(net.to_string() + '/' + openvpn::to_string(prefix_len));
+	      add->argv.push_back("via");
+	      add->argv.push_back(gateway_str);
+	      if (!dev.empty())
+		{
+		  add->argv.push_back("dev");
+		  add->argv.push_back(dev);
+		}
+	      create = add;
+
+	      // for the destroy command, copy the add command but replace "add" with "delete"
+	      Command::Ptr del(add->copy());
+	      del->argv[3] = "del";
+	      destroy = del;
+	    }
+
+	if (rtvec && (flags & R_ADD_DCO))
+	  rtvec->emplace_back(IP::Addr::from_ipv6(net), prefix_len);
+      }
+      else
+      {
+	const IPv4::Addr addr = IPv4::Addr::from_string(addr_str);
+	const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(prefix_len);
+	const IPv4::Addr net = addr & netmask;
+
+	if (flags & R_ADD_SYS)
+	  {
+	    // ip route add 192.0.2.128/25 via 192.0.2.1
+	    Command::Ptr add(new Command);
+	    add->argv.push_back("/sbin/ip");
+	    add->argv.push_back("-4");
+	    add->argv.push_back("route");
+	    add->argv.push_back("prepend");
+	    add->argv.push_back(net.to_string() + '/' + openvpn::to_string(prefix_len));
+	    add->argv.push_back("via");
+	    add->argv.push_back(gateway_str);
+	    if (!dev.empty())
+	    {
+	      add->argv.push_back("dev");
+	      add->argv.push_back(dev);
+	    }
+	    create = add;
+
+	    // for the destroy command, copy the add command but replace "add" with "delete"
+	    Command::Ptr del(add->copy());
+	    del->argv[3] = "del";
+	    destroy = del;
+	  }
+
+	if (rtvec && (flags & R_ADD_DCO))
+	  rtvec->emplace_back(IP::Addr::from_ipv4(net), prefix_len);
+      }
+    }
+
+    inline void add_del_route(const std::string& addr_str,
+			      const int prefix_len,
+			      const std::string& gateway_str,
+			      const std::string& dev,
+			      const unsigned int flags,// add interface route to rtvec if defined
+			      std::vector<IP::Route>* rtvec,
+			      ActionList& create,
+			      ActionList& destroy)
+    {
+      Action::Ptr c, d;
+      add_del_route(addr_str, prefix_len, gateway_str, dev, flags, rtvec, c, d);
+      create.add(c);
+      destroy.add(d);
+    }
+
+    inline void iface_up(const std::string& iface_name,
+			 const int mtu,
+			 ActionList& create,
+			 ActionList& destroy)
+    {
+      {
+	Command::Ptr add(new Command);
+	add->argv.push_back("/sbin/ip");
+	add->argv.push_back("link");
+	add->argv.push_back("set");
+	add->argv.push_back(iface_name);
+	add->argv.push_back("up");
+	if (mtu > 0)
+	  {
+	    add->argv.push_back("mtu");
+	    add->argv.push_back(openvpn::to_string(mtu));
+	  }
+	create.add(add);
+
+	// for the destroy command, copy the add command but replace "up" with "down"
+	Command::Ptr del(add->copy());
+	del->argv[4] = "down";
+	destroy.add(del);
+      }
+    }
+
+    inline void iface_config(const std::string& iface_name,
+			     int unit,
+			     const TunBuilderCapture& pull,
+			     std::vector<IP::Route>* rtvec,
+			     ActionList& create,
+			     ActionList& destroy)
+    {
+      // set local4 and local6 to point to IPv4/6 route configurations
+      const TunBuilderCapture::RouteAddress* local4 = pull.vpn_ipv4();
+      const TunBuilderCapture::RouteAddress* local6 = pull.vpn_ipv6();
+
+      // Set IPv4 Interface
+      if (local4)
+	{
+	  Command::Ptr add(new Command);
+	  add->argv.push_back("/sbin/ip");
+	  add->argv.push_back("-4");
+	  add->argv.push_back("addr");
+	  add->argv.push_back("add");
+	  add->argv.push_back(local4->address + '/' + openvpn::to_string(local4->prefix_length));
+	  add->argv.push_back("broadcast");
+	  add->argv.push_back((IPv4::Addr::from_string(local4->address) | ~IPv4::Addr::netmask_from_prefix_len(local4->prefix_length)).to_string());
+	  add->argv.push_back("dev");
+	  add->argv.push_back(iface_name);
+	  if (unit >= 0)
+	    {
+	      add->argv.push_back("label");
+	      add->argv.push_back(iface_name + ':' + openvpn::to_string(unit));
+	    }
+	  create.add(add);
+
+	  // for the destroy command, copy the add command but replace "add" with "delete"
+	  Command::Ptr del(add->copy());
+	  del->argv[3] = "del";
+	  destroy.add(del);
+
+	  // add interface route to rtvec if defined
+	  add_del_route(local4->address, local4->prefix_length, local4->address, iface_name, R_ADD_DCO, rtvec, create, destroy);
+	}
+
+      // Set IPv6 Interface
+      if (local6 && !pull.block_ipv6)
+      {
+	Command::Ptr add(new Command);
+	add->argv.push_back("/sbin/ip");
+	add->argv.push_back("-6");
+	add->argv.push_back("addr");
+	add->argv.push_back("add");
+	add->argv.push_back(local6->address + '/' + openvpn::to_string(local6->prefix_length));
+	add->argv.push_back("dev");
+	add->argv.push_back(iface_name);
+	create.add(add);
+
+	// for the destroy command, copy the add command but replace "add" with "delete"
+	Command::Ptr del(add->copy());
+	del->argv[3] = "del";
+	destroy.add(del);
+
+	// add interface route to rtvec if defined
+	add_del_route(local6->address, local6->prefix_length, local6->address, iface_name, R_ADD_DCO|R_IPv6, rtvec, create, destroy);
+      }
+    }
+
+    struct TunMethods
+    {
+      static inline void tun_config(const std::string& iface_name,
+			     const TunBuilderCapture& pull,
+			     std::vector<IP::Route>* rtvec,
+			     ActionList& create,
+			     ActionList& destroy,
+			     bool add_bypass_routes = true)
+      {
+	const LinuxGW46 gw(true);
+
+	// set local4 and local6 to point to IPv4/6 route configurations
+	const TunBuilderCapture::RouteAddress* local4 = pull.vpn_ipv4();
+	const TunBuilderCapture::RouteAddress* local6 = pull.vpn_ipv6();
+
+	// configure interface
+	iface_up(iface_name, pull.mtu, create, destroy);
+	iface_config(iface_name, -1, pull, rtvec, create, destroy);
+
+	// Process Routes
+	{
+	  for (const auto &route : pull.add_routes)
+	    {
+	      if (route.ipv6)
+		{
+		  if (!pull.block_ipv6)
+		    add_del_route(route.address, route.prefix_length, local6->gateway, iface_name, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
+		}
+	      else
+		{
+		  if (local4 && !local4->gateway.empty())
+		    add_del_route(route.address, route.prefix_length, local4->gateway, iface_name, R_ADD_ALL, rtvec, create, destroy);
+		  else
+		    OPENVPN_LOG("ERROR: IPv4 route pushed without IPv4 ifconfig and/or route-gateway");
+		}
+	    }
+	}
+
+	// Process exclude routes
+	{
+	  for (const auto &route : pull.exclude_routes)
+	    {
+	      if (route.ipv6)
+		{
+		  OPENVPN_LOG("NOTE: exclude IPv6 routes not supported yet"); // fixme
+		}
+	      else
+		{
+		  if (gw.v4.defined())
+		    add_del_route(route.address, route.prefix_length, gw.v4.addr().to_string(), gw.v4.dev(), R_ADD_SYS, rtvec, create, destroy);
+		  else
+		    OPENVPN_LOG("NOTE: cannot determine gateway for exclude IPv4 routes");
+		}
+	    }
+	}
+
+	// Process IPv4 redirect-gateway
+	if (pull.reroute_gw.ipv4)
+	  {
+	    // add bypass route
+	    if (add_bypass_routes && !pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL) && gw.v4.defined())
+	      add_del_route(pull.remote_address.address, 32, gw.v4.addr().to_string(), gw.v4.dev(), R_ADD_SYS, rtvec, create, destroy);
+
+	    add_del_route("0.0.0.0", 1, local4->gateway, iface_name, R_ADD_ALL, rtvec, create, destroy);
+	    add_del_route("128.0.0.0", 1, local4->gateway, iface_name, R_ADD_ALL, rtvec, create, destroy);
+	  }
+
+	// Process IPv6 redirect-gateway
+	if (pull.reroute_gw.ipv6 && !pull.block_ipv6)
+	  {
+	    // add bypass route
+	    if (add_bypass_routes && pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL) && gw.v4.defined())
+	      add_del_route(pull.remote_address.address, 128, gw.v6.addr().to_string(), gw.v6.dev(), R_ADD_SYS|R_IPv6, rtvec, create, destroy);
+
+	    add_del_route("0000::", 1, local6->gateway, iface_name, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
+	    add_del_route("8000::", 1, local6->gateway, iface_name, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
+	  }
+
+	// fixme -- Process block-ipv6
+
+	// fixme -- Handle pushed DNS servers
+      }
+
+      static inline void add_bypass_route(const std::string& tun_iface_name,
+					  const std::string& address,
+					  bool ipv6,
+					  std::vector<IP::Route>* rtvec,
+					  ActionList& create,
+					  ActionList& destroy)
+      {
+	LinuxGW46 gw(true);
+
+	if (!ipv6 && gw.v4.defined())
+	  add_del_route(address, 32, gw.v4.addr().to_string(), gw.dev(), R_ADD_SYS, rtvec, create, destroy);
+
+	if (ipv6 && gw.v6.defined())
+	  add_del_route(address, 128, gw.v6.addr().to_string(), gw.dev(), R_ADD_SYS, rtvec, create, destroy);
+      }
+    };
+  }
+} // namespace openvpn
+

Sources/OpenVPN3/openvpn/tun/linux/client/tunnetlink.hpp

@@ -0,0 +1,700 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2018 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+#pragma once
+
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <net/if.h>
+#include <linux/if_tun.h>
+
+#include <openvpn/asio/asioerr.hpp>
+#include <openvpn/netconf/linux/gwnetlink.hpp>
+#include <openvpn/common/action.hpp>
+#include <openvpn/tun/builder/setup.hpp>
+#include <openvpn/tun/client/tunbase.hpp>
+#include <openvpn/tun/linux/client/sitnl.hpp>
+#include <openvpn/tun/linux/client/tunsetup.hpp>
+
+namespace openvpn {
+  namespace TunNetlink {
+
+    using namespace openvpn::TunLinuxSetup;
+
+    struct NetlinkLinkSet : public Action
+    {
+      typedef RCPtr<NetlinkLinkSet> Ptr;
+
+      NetlinkLinkSet() {}
+
+      NetlinkLinkSet(std::string dev_arg, bool up_arg, int mtu_arg)
+	: dev(dev_arg),
+	  up(up_arg),
+	  mtu(mtu_arg)
+      {
+      }
+
+      NetlinkLinkSet* copy() const
+      {
+	NetlinkLinkSet *ret = new NetlinkLinkSet;
+	ret->dev = dev;
+	ret->up = up;
+	ret->mtu = mtu;
+	return ret;
+      }
+
+      virtual void execute(std::ostream& os) override
+      {
+	int ret;
+
+	if (dev.empty())
+	{
+	  os << "Error: can't call NetlinkLinkSet with no interface" << std::endl;
+	  return;
+	}
+
+	ret = SITNL::net_iface_mtu_set(dev, mtu);
+	if (ret)
+	{
+	  os << "Error while executing NetlinkLinkSet " << dev << " mtu " << mtu
+	    << ": " << ret << std::endl;
+	}
+
+	ret = SITNL::net_iface_up(dev, up);
+	if (ret)
+	{
+	  os << "Error while executing NetlinkLinkSet " << dev << " up " << up
+	    << ": " << ret << std::endl;
+	}
+      }
+
+      virtual std::string to_string() const override
+      {
+	std::ostringstream os;
+	os << "netlink iface " << dev << " link set " << up << " mtu " << mtu;
+	return os.str();
+      }
+
+      std::string dev;
+      bool up;
+      int mtu;
+    };
+
+    struct NetlinkAddr4 : public Action
+    {
+      typedef RCPtr<NetlinkAddr4> Ptr;
+
+      NetlinkAddr4() {}
+
+      NetlinkAddr4(std::string dev_arg, IPv4::Addr& addr_arg, int prefixlen_arg,
+		   IPv4::Addr& broadcast_arg, bool add_arg)
+	: dev(dev_arg),
+	  addr(addr_arg),
+	  prefixlen(prefixlen_arg),
+	  broadcast(broadcast_arg),
+	  add(add_arg)
+      {
+      }
+
+      NetlinkAddr4* copy() const
+      {
+	NetlinkAddr4 *ret = new NetlinkAddr4;
+	ret->dev = dev;
+	ret->addr = addr;
+	ret->prefixlen = prefixlen;
+	ret->broadcast = broadcast;
+	ret->add = add;
+	return ret;
+      }
+
+      virtual void execute(std::ostream& os) override
+      {
+	int ret;
+
+	if (dev.empty())
+	{
+	  os << "Error: can't call NetlinkAddr4 with no interface" << std::endl;
+	  return;
+	}
+
+	if (add)
+	{
+	  ret = SITNL::net_addr_add(dev, addr, prefixlen, broadcast);
+	}
+	else
+	{
+	  ret = SITNL::net_addr_del(dev, addr, prefixlen);
+	}
+
+	if (ret)
+	{
+	  os << "Error while executing NetlinkAddr4(add: " << add << ") "
+	    << dev << ": " << ret << std::endl;
+	}
+      }
+
+      virtual std::string to_string() const override
+      {
+	std::ostringstream os;
+	os << "netlink iface " << dev << " " << (add ? "add" : "del") << " "
+	  << addr.to_string() << "/" << prefixlen << " broadcast "
+	  << broadcast.to_string();
+	return os.str();
+      }
+
+      std::string dev;
+      IPv4::Addr addr;
+      int prefixlen;
+      IPv4::Addr broadcast;
+      bool add;
+    };
+
+    struct NetlinkAddr6 : public Action
+    {
+      typedef RCPtr<NetlinkAddr6> Ptr;
+
+      NetlinkAddr6() {}
+
+      NetlinkAddr6(std::string dev_arg, IPv6::Addr& addr_arg, int prefixlen_arg,
+		   bool add_arg)
+	: dev(dev_arg),
+	  addr(addr_arg),
+	  prefixlen(prefixlen_arg),
+	  add(add_arg)
+      {
+      }
+
+      NetlinkAddr6* copy() const
+      {
+	NetlinkAddr6 *ret = new NetlinkAddr6;
+	ret->dev = dev;
+	ret->addr = addr;
+	ret->prefixlen = prefixlen;
+	ret->add = add;
+	return ret;
+      }
+
+      virtual void execute(std::ostream& os) override
+      {
+	int ret;
+
+	if (dev.empty())
+	{
+	  os << "Error: can't call NetlinkAddr6 with no interface" << std::endl;
+	  return;
+	}
+
+	if (add)
+	{
+	  ret = SITNL::net_addr_add(dev, addr, prefixlen);
+	}
+	else
+	{
+	  ret = SITNL::net_addr_del(dev, addr, prefixlen);
+	}
+
+	if (ret)
+	{
+	  os << "Error while executing NetlinkAddr6(add: " << add << ") "
+	    << dev << ": " << ret << std::endl;
+	}
+      }
+
+      virtual std::string to_string() const override
+      {
+	std::ostringstream os;
+	os << "netlink iface " << dev << " " << (add ? "add" : "del") << " "
+	  << addr.to_string() << "/" << prefixlen;
+	return os.str();
+      }
+
+      std::string dev;
+      IPv6::Addr addr;
+      int prefixlen;
+      bool add;
+    };
+
+    struct NetlinkAddr4PtP : public Action
+    {
+      typedef RCPtr<NetlinkAddr4PtP> Ptr;
+
+      NetlinkAddr4PtP() {}
+
+      NetlinkAddr4PtP(std::string dev_arg, IPv4::Addr local_arg,
+		       IPv4::Addr remote_arg, bool add_arg)
+	: dev(dev_arg),
+	  local(local_arg),
+	  remote(remote_arg),
+	  add(add_arg)
+      {
+      }
+
+      NetlinkAddr4PtP* copy() const
+      {
+	NetlinkAddr4PtP *ret = new NetlinkAddr4PtP;
+	ret->dev = dev;
+	ret->local = local;
+	ret->remote = remote;
+	ret->add = add;
+	return ret;
+      }
+
+      virtual void execute(std::ostream& os) override
+      {
+	int ret;
+
+	if (dev.empty())
+	{
+	  os << "Error: can't call NetlinkAddr4PtP with no interface" << std::endl;
+	  return;
+	}
+
+	if (add)
+	{
+	  ret = SITNL::net_addr_ptp_add(dev, local, remote);
+	}
+	else
+	{
+	  ret = SITNL::net_addr_ptp_del(dev, local, remote);
+	}
+
+	if (ret)
+	{
+	  os << "Error while executing NetlinkAddr4PtP(add: " << add << ") "
+	    << dev << ": " << ret << std::endl;
+	}
+      }
+
+      virtual std::string to_string() const override
+      {
+	return "netlink iface " + dev + " " + (add ? "add" : "del") + " ptp "
+	  + local.to_string() + " remote " + remote.to_string();
+      }
+
+      std::string dev;
+      IPv4::Addr local;
+      IPv4::Addr remote;
+      bool add;
+    };
+
+    struct NetlinkRoute4 : public Action
+    {
+      typedef RCPtr<NetlinkRoute4> Ptr;
+
+      NetlinkRoute4() {}
+
+      NetlinkRoute4(IPv4::Addr& dst_arg, int prefixlen_arg, IPv4::Addr& gw_arg,
+		    std::string dev_arg, bool add_arg)
+	: route(dst_arg, prefixlen_arg),
+	  gw(gw_arg),
+	  dev(dev_arg),
+	  add(add_arg)
+      {
+      }
+
+      NetlinkRoute4* copy() const
+      {
+	NetlinkRoute4 *ret = new NetlinkRoute4;
+	ret->route = route;
+	ret->gw = gw;
+	ret->dev = dev;
+	return ret;
+      }
+
+      virtual void execute(std::ostream& os) override
+      {
+	int ret;
+
+	if (dev.empty())
+	{
+	  os << "Error: can't call NetlinkRoute4 with no interface" << std::endl;
+	  return;
+	}
+
+	if (add)
+	{
+	  ret = SITNL::net_route_add(route, gw, dev, 0, 0);
+	}
+	else
+	{
+	  ret = SITNL::net_route_del(route, gw, dev, 0, 0);
+	}
+
+	if (ret)
+	{
+	  os << "Error while executing NetlinkRoute4(add: " << add << ") "
+	    << dev << ": " << ret << std::endl;
+	}
+      }
+
+      virtual std::string to_string() const override
+      {
+	std::ostringstream os;
+	os << "netlink route " << (add ? "add" : "del") << " dev " << dev << " "
+	  << route << " via " << gw.to_string();
+	return os.str();
+      }
+
+      IP::Route4 route;
+      IPv4::Addr gw;
+      std::string dev;
+      bool add;
+    };
+
+    struct NetlinkRoute6 : public Action
+    {
+      typedef RCPtr<NetlinkRoute6> Ptr;
+
+      NetlinkRoute6() {}
+
+      NetlinkRoute6(IPv6::Addr& dst_arg, int prefixlen_arg, IPv6::Addr& gw_arg,
+		    std::string dev_arg, bool add_arg)
+	: route(dst_arg, prefixlen_arg),
+	  gw(gw_arg),
+	  dev(dev_arg),
+	  add(add_arg)
+      {
+      }
+
+      NetlinkRoute6* copy() const
+      {
+	NetlinkRoute6 *ret = new NetlinkRoute6;
+	ret->route = route;
+	ret->gw = gw;
+	ret->dev = dev;
+	return ret;
+      }
+
+      virtual void execute(std::ostream& os) override
+      {
+	int ret;
+
+	if (dev.empty())
+	{
+	  os << "Error: can't call NetlinkRoute6 with no interface" << std::endl;
+	  return;
+	}
+
+	if (add)
+	{
+	  ret = SITNL::net_route_add(route, gw, dev, 0, 0);
+	}
+	else
+	{
+	  ret = SITNL::net_route_del(route, gw, dev, 0, 0);
+	}
+
+	if (ret)
+	{
+	  os << "Error while executing NetlinkRoute6(add: " << add << ") "
+	    << dev << ": " << ret << std::endl;
+	}
+      }
+
+      virtual std::string to_string() const override
+      {
+	std::ostringstream os;
+	os << "netlink route " << (add ? "add" : "del") << " dev " << dev << " "
+	  << route << " via " << gw.to_string();
+	return os.str();
+      }
+
+      IP::Route6 route;
+      IPv6::Addr gw;
+      std::string dev;
+      bool add;
+    };
+
+    enum { // add_del_route flags
+      R_IPv6=(1<<0),
+      R_ADD_SYS=(1<<1),
+      R_ADD_DCO=(1<<2),
+      R_ADD_ALL=R_ADD_SYS|R_ADD_DCO,
+    };
+
+    /*inline IPv4::Addr cvt_pnr_ip_v4(const std::string& hexaddr)
+    {
+      BufferAllocated v(4, BufferAllocated::CONSTRUCT_ZERO);
+      parse_hex(v, hexaddr);
+      if (v.size() != 4)
+	throw tun_linux_error("bad hex address");
+      IPv4::Addr ret = IPv4::Addr::from_bytes(v.data());
+      return IP::Addr::from_ipv4(ret);
+    }*/
+
+    inline void add_del_route(const std::string& addr_str,
+			      const int prefix_len,
+			      const std::string& gateway_str,
+			      const std::string& dev,
+			      const unsigned int flags,
+			      std::vector<IP::Route>* rtvec,
+			      Action::Ptr& create,
+			      Action::Ptr& destroy)
+    {
+      if (flags & R_IPv6)
+	{
+	  const IPv6::Addr addr = IPv6::Addr::from_string(addr_str);
+	  const IPv6::Addr netmask = IPv6::Addr::netmask_from_prefix_len(prefix_len);
+	  const IPv6::Addr net = addr & netmask;
+
+	  if (flags & R_ADD_SYS)
+	    {
+	      // ip route add 2001:db8:1::/48 via 2001:db8:1::1
+	      NetlinkRoute6::Ptr add(new NetlinkRoute6);
+	      add->route.addr = net;
+	      add->route.prefix_len = prefix_len;
+	      add->gw = IPv6::Addr::from_string(gateway_str);
+	      add->dev = dev;
+	      add->add = true;
+
+	      create = add;
+	      // for the destroy command, copy the add command but replace "add" with "delete"
+	      NetlinkRoute6::Ptr del(add->copy());
+	      del->add = false;
+	      destroy = del;
+	    }
+
+	  if (rtvec && (flags & R_ADD_DCO))
+	    rtvec->emplace_back(IP::Addr::from_ipv6(net), prefix_len);
+	}
+      else
+	{
+	  const IPv4::Addr addr = IPv4::Addr::from_string(addr_str);
+	  const IPv4::Addr netmask = IPv4::Addr::netmask_from_prefix_len(prefix_len);
+	  const IPv4::Addr net = addr & netmask;
+
+	  if (flags & R_ADD_SYS)
+	    {
+	      // ip route add 192.0.2.128/25 via 192.0.2.1
+	      NetlinkRoute4::Ptr add(new NetlinkRoute4);
+	      add->route.addr = net;
+	      add->route.prefix_len = prefix_len;
+	      add->gw = IPv4::Addr::from_string(gateway_str);
+	      add->dev = dev;
+	      add->add = true;
+
+	      create = add;
+	      // for the destroy command, copy the add command but replace "add" with "delete"
+	      NetlinkRoute4::Ptr del(add->copy());
+	      del->add = false;
+	      destroy = del;
+	    }
+
+	  if (rtvec && (flags & R_ADD_DCO))
+	    rtvec->emplace_back(IP::Addr::from_ipv4(net), prefix_len);
+	}
+    }
+
+    inline void add_del_route(const std::string& addr_str,
+			      const int prefix_len,
+			      const std::string& gateway_str,
+			      const std::string& dev,
+			      const unsigned int flags,// add interface route to rtvec if defined
+			      std::vector<IP::Route>* rtvec,
+			      ActionList& create,
+			      ActionList& destroy)
+    {
+      Action::Ptr c, d;
+      add_del_route(addr_str, prefix_len, gateway_str, dev, flags, rtvec, c, d);
+      create.add(c);
+      destroy.add(d);
+    }
+
+    inline void iface_up(const std::string& iface_name,
+			     const int mtu,
+			     ActionList& create,
+			     ActionList& destroy)
+    {
+      {
+	NetlinkLinkSet::Ptr add(new NetlinkLinkSet);
+	add->dev = iface_name;
+	add->up = true;
+	add->mtu = mtu;
+
+	create.add(add);
+	// for the destroy command, copy the add command but replace "up" with "down"
+	NetlinkLinkSet::Ptr del(add->copy());
+	del->up = false;
+	destroy.add(del);
+      }
+    }
+
+    inline void iface_config(const std::string& iface_name,
+			     int unit,
+			     const TunBuilderCapture& pull,
+			     std::vector<IP::Route>* rtvec,
+			     ActionList& create,
+			     ActionList& destroy)
+    {
+      // set local4 and local6 to point to IPv4/6 route configurations
+      const TunBuilderCapture::RouteAddress* local4 = pull.vpn_ipv4();
+      const TunBuilderCapture::RouteAddress* local6 = pull.vpn_ipv6();
+
+      // Set IPv4 Interface
+      if (local4)
+	{
+	  NetlinkAddr4::Ptr add(new NetlinkAddr4);
+	  add->addr = IPv4::Addr::from_string(local4->address);
+	  add->prefixlen = local4->prefix_length;
+	  add->broadcast = IPv4::Addr::from_string(local4->address)
+	    | ~IPv4::Addr::netmask_from_prefix_len(local4->prefix_length);
+	  add->dev = iface_name;
+	  add->add = true;
+//	  if (unit >= 0)
+//	    {
+//	      add->argv.push_back("label");
+//	      add->argv.push_back(iface_name + ':' + openvpn::to_string(unit));
+//	    }
+	  create.add(add);
+
+	  // for the destroy command, copy the add command but replace "add" with "delete"
+	  NetlinkAddr4::Ptr del(add->copy());
+	  del->add = false;
+	  destroy.add(del);
+
+	  // add interface route to rtvec if defined
+	  add_del_route(local4->address, local4->prefix_length, local4->address, iface_name, R_ADD_DCO, rtvec, create, destroy);
+	}
+
+      // Set IPv6 Interface
+      if (local6 && !pull.block_ipv6)
+	{
+	  NetlinkAddr6::Ptr add(new NetlinkAddr6);
+	  add->addr = IPv6::Addr::from_string(local6->address);
+	  add->prefixlen = local6->prefix_length;
+	  add->dev = iface_name;
+	  add->add = true;
+
+	  create.add(add);
+
+	  // for the destroy command, copy the add command but replace "add" with "delete"
+	  NetlinkAddr6::Ptr del(add->copy());
+	  del->add = false;
+	  destroy.add(del);
+
+	  // add interface route to rtvec if defined
+	  add_del_route(local6->address, local6->prefix_length, local6->address, iface_name, R_ADD_DCO|R_IPv6, rtvec, create, destroy);
+	}
+    }
+
+    struct TunMethods
+    {
+      static inline void tun_config(const std::string& iface_name,
+				    const TunBuilderCapture& pull,
+				    std::vector<IP::Route>* rtvec,
+				    ActionList& create,
+				    ActionList& destroy,
+				    bool add_bypass_routes)
+      {
+	// set local4 and local6 to point to IPv4/6 route configurations
+	const TunBuilderCapture::RouteAddress* local4 = pull.vpn_ipv4();
+	const TunBuilderCapture::RouteAddress* local6 = pull.vpn_ipv6();
+
+	// configure interface
+	iface_up(iface_name, pull.mtu, create, destroy);
+	iface_config(iface_name, -1, pull, rtvec, create, destroy);
+
+	// Process Routes
+	{
+	  for (const auto &route : pull.add_routes)
+	    {
+	      if (route.ipv6)
+		{
+		  if (!pull.block_ipv6)
+		    add_del_route(route.address, route.prefix_length, local6->gateway, iface_name, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
+		}
+	      else
+		{
+		  if (local4 && !local4->gateway.empty())
+		    add_del_route(route.address, route.prefix_length, local4->gateway, iface_name, R_ADD_ALL, rtvec, create, destroy);
+		  else
+		    OPENVPN_LOG("ERROR: IPv4 route pushed without IPv4 ifconfig and/or route-gateway");
+		}
+	    }
+	}
+
+	// Process exclude routes
+	if (!pull.exclude_routes.empty())
+	{
+	  LinuxGW46Netlink gw(iface_name);
+
+	  for (const auto &route : pull.exclude_routes)
+	    {
+	      if (route.ipv6)
+		{
+		  OPENVPN_LOG("NOTE: exclude IPv6 routes not supported yet"); // fixme
+		}
+	      else
+		{
+		  if (gw.v4.defined())
+		    add_del_route(route.address, route.prefix_length, gw.v4.addr().to_string(), gw.v4.dev(), R_ADD_SYS, rtvec, create, destroy);
+		  else
+		    OPENVPN_LOG("NOTE: cannot determine gateway for exclude IPv4 routes");
+		}
+	    }
+	}
+
+	// Process IPv4 redirect-gateway
+	if (pull.reroute_gw.ipv4)
+	  {
+	    // add bypass route
+	    if (add_bypass_routes && !pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
+	      add_bypass_route(iface_name, pull.remote_address.address, false, rtvec, create, destroy);
+
+	    add_del_route("0.0.0.0", 1, local4->gateway, iface_name, R_ADD_ALL, rtvec, create, destroy);
+	    add_del_route("128.0.0.0", 1, local4->gateway, iface_name, R_ADD_ALL, rtvec, create, destroy);
+	  }
+
+	// Process IPv6 redirect-gateway
+	if (pull.reroute_gw.ipv6 && !pull.block_ipv6)
+	  {
+	    // add bypass route
+	    if (add_bypass_routes && pull.remote_address.ipv6 && !(pull.reroute_gw.flags & RedirectGatewayFlags::RG_LOCAL))
+	      add_bypass_route(iface_name, pull.remote_address.address, true, rtvec, create, destroy);
+
+	    add_del_route("0000::", 1, local6->gateway, iface_name, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
+	    add_del_route("8000::", 1, local6->gateway, iface_name, R_ADD_ALL|R_IPv6, rtvec, create, destroy);
+	  }
+
+	// fixme -- Process block-ipv6
+
+	// fixme -- Handle pushed DNS servers
+      }
+
+      static inline void add_bypass_route(const std::string& tun_iface_name,
+					  const std::string& address,
+					  bool ipv6,
+					  std::vector<IP::Route>* rtvec,
+					  ActionList& create,
+					  ActionList& destroy)
+      {
+	LinuxGW46Netlink gw(tun_iface_name, address);
+
+	if (!ipv6 && gw.v4.defined())
+	  add_del_route(address, 32, gw.v4.addr().to_string(), gw.dev(), R_ADD_SYS, rtvec, create, destroy);
+
+	if (ipv6 && gw.v6.defined())
+	  add_del_route(address, 128, gw.v6.addr().to_string(), gw.dev(), R_ADD_SYS, rtvec, create, destroy);
+      }
+    };
+  }
+} // namespace openvpn

Sources/OpenVPN3/openvpn/tun/linux/client/tunsetup.hpp

@@ -0,0 +1,244 @@
+//    OpenVPN -- An application to securely tunnel IP networks
+//               over a single port, with support for SSL/TLS-based
+//               session authentication and key exchange,
+//               packet encryption, packet authentication, and
+//               packet compression.
+//
+//    Copyright (C) 2012-2017 OpenVPN Inc.
+//
+//    This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License Version 3
+//    as published by the Free Software Foundation.
+//
+//    This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+//    GNU Affero General Public License for more details.
+//
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program in the COPYING file.
+//    If not, see <http://www.gnu.org/licenses/>.
+
+// Client tun interface for Linux.
+
+#ifndef OPENVPN_TUN_LINUX_CLIENT_TUNSETUP_H
+#define OPENVPN_TUN_LINUX_CLIENT_TUNSETUP_H
+
+#include <sys/ioctl.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <net/if.h>
+#include <linux/if_tun.h>
+
+#include <openvpn/common/exception.hpp>
+#include <openvpn/common/file.hpp>
+#include <openvpn/common/split.hpp>
+#include <openvpn/common/splitlines.hpp>
+#include <openvpn/common/hexstr.hpp>
+#include <openvpn/common/to_string.hpp>
+#include <openvpn/common/process.hpp>
+#include <openvpn/common/action.hpp>
+#include <openvpn/addr/route.hpp>
+#include <openvpn/asio/asioerr.hpp>
+#include <openvpn/tun/builder/capture.hpp>
+#include <openvpn/tun/builder/setup.hpp>
+#include <openvpn/tun/client/tunbase.hpp>
+#include <openvpn/tun/client/tunprop.hpp>
+#include <openvpn/netconf/linux/gw.hpp>
+
+namespace openvpn {
+  namespace TunLinuxSetup {
+
+    OPENVPN_EXCEPTION(tun_linux_error);
+    OPENVPN_EXCEPTION(tun_open_error);
+    OPENVPN_EXCEPTION(tun_layer_error);
+    OPENVPN_EXCEPTION(tun_ioctl_error);
+    OPENVPN_EXCEPTION(tun_fcntl_error);
+    OPENVPN_EXCEPTION(tun_name_error);
+    OPENVPN_EXCEPTION(tun_tx_queue_len_error);
+    OPENVPN_EXCEPTION(tun_ifconfig_error);
+
+    template <class TUNMETHODS>
+    class Setup : public TunBuilderSetup::Base
+    {
+    public:
+      typedef RCPtr<Setup> Ptr;
+
+      // This empty constructor shouldn't be needed, but due to a
+      // plausible compiler bug in GCC 4.8.5 (RHEL 7), this empty
+      // constructor is required to be able to build.  This is
+      // related to the member initialization of the private
+      // remove_cmds_bypass_gw and remove_cmds class members.
+      Setup() {}
+
+      struct Config : public TunBuilderSetup::Config
+      {
+	std::string iface_name;
+	Layer layer; // OSI layer
+	std::string dev_name;
+	int txqueuelen;
+	bool add_bypass_routes_on_establish; // required when not using tunbuilder
+
+#ifdef HAVE_JSON
+	virtual Json::Value to_json() override
+	{
+	  Json::Value root(Json::objectValue);
+	  root["iface_name"] = Json::Value(iface_name);
+	  root["layer"] = Json::Value(layer.str());
+	  root["dev_name"] = Json::Value(dev_name);
+	  root["txqueuelen"] = Json::Value(txqueuelen);
+	  return root;
+	};
+
+	virtual void from_json(const Json::Value& root, const std::string& title) override
+	{
+	  json::assert_dict(root, title);
+	  json::to_string(root, iface_name, "iface_name", title);
+	  layer = Layer::from_str(json::get_string(root, "layer", title));
+	  json::to_string(root, dev_name, "dev_name", title);
+	  json::to_int(root, txqueuelen, "txqueuelen", title);
+	}
+#endif
+      };
+
+      void destroy(std::ostream &os) override
+      {
+	// remove added routes
+	remove_cmds->execute(os);
+
+	// remove bypass route
+	remove_cmds_bypass_gw->execute(os);
+      }
+
+      bool add_bypass_route(const std::string& address,
+			    bool ipv6,
+			    std::ostream& os)
+      {
+	// nothing to do if we reconnect to the same gateway
+	if (connected_gw == address)
+	  return true;
+
+	// remove previous bypass route
+	remove_cmds_bypass_gw->execute(os);
+	remove_cmds_bypass_gw->clear();
+
+	ActionList::Ptr add_cmds = new ActionList();
+	TUNMETHODS::add_bypass_route(tun_iface_name, address, ipv6, nullptr, *add_cmds, *remove_cmds_bypass_gw);
+
+	// add gateway bypass route
+	add_cmds->execute(os);
+	return true;
+      }
+
+      int establish(const TunBuilderCapture& pull, // defined by TunBuilderSetup::Base
+		    TunBuilderSetup::Config* config,
+		    Stop* stop,
+		    std::ostream& os) override
+      {
+	// get configuration
+	Config *conf = dynamic_cast<Config *>(config);
+	if (!conf)
+	  throw tun_linux_error("missing config");
+
+	static const char node[] = "/dev/net/tun";
+	ScopedFD fd(open(node, O_RDWR));
+	if (!fd.defined())
+	  OPENVPN_THROW(tun_open_error, "error opening tun device " << node << ": " << errinfo(errno));
+
+	struct ifreq ifr;
+	std::memset(&ifr, 0, sizeof(ifr));
+	ifr.ifr_flags = IFF_ONE_QUEUE;
+	ifr.ifr_flags |= IFF_NO_PI;
+	if (conf->layer() == Layer::OSI_LAYER_3)
+	  ifr.ifr_flags |= IFF_TUN;
+	else if (conf->layer() == Layer::OSI_LAYER_2)
+	  ifr.ifr_flags |= IFF_TAP;
+	else
+	  throw tun_layer_error("unknown OSI layer");
+
+	open_unit(conf->dev_name, ifr, fd);
+
+	if (fcntl (fd(), F_SETFL, O_NONBLOCK) < 0)
+	  throw tun_fcntl_error(errinfo(errno));
+
+	// Set the TX send queue size
+	if (conf->txqueuelen)
+	  {
+	    struct ifreq netifr;
+	    ScopedFD ctl_fd(socket (AF_INET, SOCK_DGRAM, 0));
+
+	    if (ctl_fd.defined())
+	      {
+		std::memset(&netifr, 0, sizeof(netifr));
+		strcpy (netifr.ifr_name, ifr.ifr_name);
+		netifr.ifr_qlen = conf->txqueuelen;
+		if (ioctl (ctl_fd(), SIOCSIFTXQLEN, (void *) &netifr) < 0)
+		  throw tun_tx_queue_len_error(errinfo(errno));
+	      }
+	    else
+	      throw tun_tx_queue_len_error(errinfo(errno));
+	  }
+
+	conf->iface_name = ifr.ifr_name;
+	tun_iface_name = ifr.ifr_name;
+
+	ActionList::Ptr add_cmds = new ActionList();
+	ActionList::Ptr remove_cmds_new = new ActionListReversed();
+
+	// configure tun properties
+	TUNMETHODS::tun_config(ifr.ifr_name, pull, nullptr, *add_cmds, *remove_cmds_new, conf->add_bypass_routes_on_establish);
+
+	// execute commands to bring up interface
+	add_cmds->execute(os);
+
+	// tear down old routes
+	remove_cmds->execute(os);
+	std::swap(remove_cmds, remove_cmds_new);
+
+	connected_gw = pull.remote_address.to_string();
+
+	return fd.release();
+      }
+
+    private:
+      void open_unit(const std::string& name, struct ifreq& ifr, ScopedFD& fd)
+      {
+	if (!name.empty())
+	  {
+	    const int max_units = 256;
+	    for (int unit = 0; unit < max_units; ++unit)
+	      {
+		std::string n = name;
+		if (unit)
+		  n += openvpn::to_string(unit);
+		if (n.length() < IFNAMSIZ)
+		  ::strcpy (ifr.ifr_name, n.c_str());
+		else
+		  throw tun_name_error();
+		if (ioctl (fd(), TUNSETIFF, (void *) &ifr) == 0)
+		  return;
+	      }
+	    const int eno = errno;
+	    OPENVPN_THROW(tun_ioctl_error, "failed to open tun device '" << name << "' after trying " << max_units << " units : " << errinfo(eno));
+	  }
+	else
+	  {
+	    if (ioctl (fd(), TUNSETIFF, (void *) &ifr) < 0)
+	      {
+		const int eno = errno;
+		OPENVPN_THROW(tun_ioctl_error, "failed to open tun device '" << name << "' : " << errinfo(eno));
+	      }
+	  }
+      }
+
+      ActionList::Ptr remove_cmds_bypass_gw = new ActionList();
+      ActionListReversed::Ptr remove_cmds = new ActionListReversed();
+
+      std::string connected_gw;
+
+      std::string tun_iface_name; // used to skip tun-based default gw when add bypass route
+    };
+  }
+} // namespace openvpn
+
+#endif // OPENVPN_TUN_LINUX_CLIENT_TUNCLI_H