[Openvpn-devel] [[Patch v3] 2/3] add ability to send/receive file descriptors via management interface, only used in android so. For now under #ifdef ANDROID

[Openvpn-devel] [[Patch v3] 2/3] add ability to send/receive file descriptors via management interface, only used in android so. For now under #ifdef ANDROID

[Arne Schwabe]

---
 src/openvpn/manage.c |   87 ++++++++++++++++++++++++++++++++++++++++++++++++++
 src/openvpn/manage.h |    4 +++
 2 files changed, 91 insertions(+)

diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 0a4542a..80c469e 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -1779,6 +1779,78 @@ man_io_error (struct management *man, const char *prefix)
     return false;
 }
 
+#ifdef TARGET_ANDROID
+static ssize_t man_send_with_fd (int fd, void *ptr, size_t nbytes, int flags, int sendfd)
+{
+  struct msghdr msg;
+  struct iovec iov[1];
+    
+  union {
+    struct cmsghdr cm;
+    char    control[CMSG_SPACE(sizeof(int))];
+  } control_un;
+  struct cmsghdr *cmptr;
+    
+  msg.msg_control = control_un.control;
+  msg.msg_controllen = sizeof(control_un.control);
+    
+  cmptr = CMSG_FIRSTHDR(&msg);
+  cmptr->cmsg_len = CMSG_LEN(sizeof(int));
+  cmptr->cmsg_level = SOL_SOCKET;
+  cmptr->cmsg_type = SCM_RIGHTS;
+  *((int *) CMSG_DATA(cmptr)) = sendfd;
+    
+  msg.msg_name = NULL;
+  msg.msg_namelen = 0;
+    
+  iov[0].iov_base = ptr;
+  iov[0].iov_len = nbytes;
+  msg.msg_iov = iov;
+  msg.msg_iovlen = 1;
+    
+  return (sendmsg(fd, &msg, flags));
+}
+
+static ssize_t man_recv_with_fd (int fd, void *ptr, size_t nbytes, int flags, int *recvfd)
+{
+  struct msghdr msghdr;
+  struct iovec iov[1];
+  ssize_t n;
+    
+  union {
+    struct cmsghdr cm;
+    char     control[CMSG_SPACE(sizeof (int))];
+  } control_un;
+  struct cmsghdr  *cmptr;
+    
+  msghdr.msg_control  = control_un.control;
+  msghdr.msg_controllen = sizeof(control_un.control);
+    
+  msghdr.msg_name = NULL;
+  msghdr.msg_namelen = 0;
+    
+  iov[0].iov_base = ptr;
+  iov[0].iov_len = nbytes;
+  msghdr.msg_iov = iov;
+  msghdr.msg_iovlen = 1;
+    
+  if ( (n = recvmsg(fd, &msghdr, flags)) <= 0)
+    return (n);
+    
+  if ( (cmptr = CMSG_FIRSTHDR(&msghdr)) != NULL &&
+       cmptr->cmsg_len == CMSG_LEN(sizeof(int))) {
+    if (cmptr->cmsg_level != SOL_SOCKET)
+      msg (M_ERR, "control level != SOL_SOCKET");
+    if (cmptr->cmsg_type != SCM_RIGHTS)
+      msg (M_ERR, "control type != SCM_RIGHTS");
+    *recvfd = *((int *) CMSG_DATA(cmptr));
+  } else
+    *recvfd = -1;           /* descriptor was not passed */
+    
+  return (n);
+}
+#endif
+
 static int
 man_read (struct management *man)
 {
@@ -1788,7 +1860,15 @@ man_read (struct management *man)
   unsigned char buf[256];
   int len = 0;
 
+#ifdef TARGET_ANDROID
+  int fd;
+  len = man_recv_with_fd (man->connection.sd_cli, buf, sizeof (buf), MSG_NOSIGNAL, &fd);
+  if(fd >= 0) 
+     man->connection.lastfdreceived = fd;
+#else
   len = recv (man->connection.sd_cli, buf, sizeof (buf), MSG_NOSIGNAL);
+#endif
+
   if (len == 0)
     {
       man_reset_client_socket (man, false);
@@ -1865,6 +1945,13 @@ man_write (struct management *man)
   if (buf && BLEN (buf))
     {
       const int len = min_int (size_hint, BLEN (buf));
+#ifdef TARGET_ANDROID
+      if (man->connection.fdtosend > 0) 
+        {
+         sent = man_send_with_fd (man->connection.sd_cli, BPTR (buf), len, MSG_NOSIGNAL,man->connection.fdtosend);
+            man->connection.fdtosend = -1;
+        } else
+#endif
       sent = send (man->connection.sd_cli, BPTR (buf), len, MSG_NOSIGNAL);
       if (sent >= 0)
 	{
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index 28da69f..f5d776e 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -299,6 +299,10 @@ struct man_connection {
 #ifdef MANAGMENT_EXTERNAL_KEY
   struct buffer_list *rsa_sig;
 #endif
+#ifdef TARGET_ANDROID
+  int fdtosend;
+  int lastfdreceived;
+#endif
 };
 
 struct management
-- 
1.7.9.5

[Openvpn-devel] [[Patch v3] 3/3] Android platform specific changes.

[Arne Schwabe]

On Android 4.0 (TARGET_ANDROID) the real opening of the tun is handled by the (Java) application controlling OpenVPN. Instead of calling ifconfig/route call the management to do the work. When running openvpn as root openvpn should be compiled as TARGET_LINUX

Signed-off-by: Arne Schwabe <arne@...1227...>
---
 src/openvpn/manage.c  |   13 ++++++++
 src/openvpn/manage.h  |    4 +++
 src/openvpn/options.c |    6 ++++
 src/openvpn/route.c   |   18 ++++++++--
 src/openvpn/socket.c  |    9 +++++
 src/openvpn/ssl.c     |    2 ++
 src/openvpn/syshead.h |    2 +-
 src/openvpn/tun.c     |   88 +++++++++++++++++++++++++++++++++++++++++++++++--
 src/openvpn/tun.h     |    8 ++++-
 9 files changed, 144 insertions(+), 6 deletions(-)

diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 80c469e..3ede408 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -1849,6 +1849,19 @@ static ssize_t man_recv_with_fd (int fd, void *ptr, size_t nbytes, int flags, in
     
   return (n);
 }
+
+/*
+ * The android control method will instruct the GUI part of openvpn to
+ * do the route/ifconfig/open tun command. 
+ */
+bool management_android_control (struct management *man, const char *command, const char *msg)
+{
+  struct user_pass up;    
+  strcpy(up.username, msg);
+  
+  management_query_user_pass(management, &up , command, GET_USER_PASS_NEED_OK,(void*) 0);
+  return strcmp ("ok", up.password)==0;
+}
 #endif
 
 static int
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index f5d776e..b08bb78 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -376,6 +376,10 @@ bool management_query_user_pass (struct management *man,
 				 const unsigned int flags,
 				 const char *static_challenge);
 
+#ifdef TARGET_ANDROID
+bool management_android_control (struct management *man, const char *command, const char *msg);
+#endif
+
 bool management_should_daemonize (struct management *man);
 bool management_would_hold (struct management *man);
 bool management_hold (struct management *man);
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 05c6da2..9fdfd88 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -1125,7 +1125,9 @@ show_tuntap_options (const struct tuntap_options *o)
 }
 
 #endif
+#endif
 
+#if defined(WIN32) || defined(TARGET_ANDROID) 
 static void
 dhcp_option_address_parse (const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
 {
@@ -5935,6 +5937,8 @@ add_option (struct options *options,
       to->ip_win32_type = index;
       to->ip_win32_defined = true; 
     }
+#endif
+#if defined(WIN32) || defined(TARGET_ANDROID)
   else if (streq (p[0], "dhcp-option") && p[1])
     {
       struct tuntap_options *o = &options->tuntap_options;
@@ -5986,6 +5990,8 @@ add_option (struct options *options,
 	}
       o->dhcp_options = true;
     }
+#endif
+#ifdef WIN32
   else if (streq (p[0], "show-adapters"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
diff --git a/src/openvpn/route.c b/src/openvpn/route.c
index 4c1e14e..ff10734 100644
--- a/src/openvpn/route.c
+++ b/src/openvpn/route.c
@@ -1342,6 +1342,12 @@ add_route (struct route *r,
   argv_msg (D_ROUTE, &argv);
   status = openvpn_execve_check (&argv, es, 0, "ERROR: Linux route add command failed");
 
+#elif defined (TARGET_ANDROID)
+  struct buffer out = alloc_buf_gc (64, &gc);
+
+  buf_printf (&out, "%s %s", network, netmask);
+  management_android_control (management, "ROUTE", buf_bptr(&out));
+  
 #elif defined (WIN32)
   {
     DWORD ai = TUN_ADAPTER_INDEX_INVALID;
@@ -1616,6 +1622,13 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla
   argv_msg (D_ROUTE, &argv);
   status = openvpn_execve_check (&argv, es, 0, "ERROR: Linux route -6/-A inet6 add command failed");
 
+#elif defined (TARGET_ANDROID)
+    struct buffer out = alloc_buf_gc (64, &gc);
+
+    buf_printf (&out, "%s/%d", network, r6->netbits);
+
+    management_android_control (management, "ROUTE6", buf_bptr(&out));
+
 #elif defined (WIN32)
 
   /* netsh interface ipv6 add route 2001:db8::/32 MyTunDevice */
@@ -1875,7 +1888,8 @@ delete_route (struct route *r,
 
   argv_msg (D_ROUTE, &argv);
   openvpn_execve_check (&argv, es, 0, "ERROR: OpenBSD/NetBSD route delete command failed");
-
+#elif defined(TARGET_ANDROID)
+  msg (M_NONFATAL, "Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.");
 #else
   msg (M_FATAL, "Sorry, but I don't know how to do 'route' commands on this operating system.  Try putting your routes in a --route-up script");
 #endif
@@ -2425,7 +2439,7 @@ show_routes (int msglev)
   gc_free (&gc);
 }
 
-#elif defined(TARGET_LINUX)
+#elif defined(TARGET_LINUX) || defined(TARGET_ANDROID)
 
 void
 get_default_gateway (struct route_gateway_info *rgi)
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 8eb112b..ade9aad 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -38,6 +38,7 @@
 #include "ps.h"
 #include "manage.h"
 #include "misc.h"
+#include "manage.h"
 
 #include "memdbg.h"
 
@@ -725,6 +726,14 @@ create_socket (struct link_socket *sock)
     {
       ASSERT (0);
     }
+#ifdef TARGET_ANDROID
+    struct user_pass up;
+
+    management->connection.fdtosend = sock->sd;
+    management_android_control (management, "PROTECTFD", __func__);
+
+#endif
+    
 }
 
 /*
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 43b3980..b367386 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1797,6 +1797,8 @@ push_peer_info(struct buffer *buf, struct tls_session *session)
       buf_printf (&out, "IV_PLAT=netbsd\n");
 #elif defined(TARGET_FREEBSD)
       buf_printf (&out, "IV_PLAT=freebsd\n");
+#elif defined(TARGET_ANDROID)
+      buf_printf(&out, "IV_PLAT=android\n");
 #elif defined(WIN32)
       buf_printf (&out, "IV_PLAT=win\n");
 #endif
diff --git a/src/openvpn/syshead.h b/src/openvpn/syshead.h
index 4db29cc..0c3e4ee 100644
--- a/src/openvpn/syshead.h
+++ b/src/openvpn/syshead.h
@@ -212,7 +212,7 @@
 #include <net/if_tap.h>
 #endif
 
-#ifdef TARGET_LINUX
+#if defined(TARGET_LINUX) || defined (TARGET_ANDROID)
 
 #if defined(HAVE_NETINET_IF_ETHER_H)
 #include <netinet/if_ether.h>
diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
index a361233..2d07d1d 100644
--- a/src/openvpn/tun.c
+++ b/src/openvpn/tun.c
@@ -48,6 +48,7 @@
 #include "win32.h"
 
 #include "memdbg.h"
+#include <string.h>
 
 #ifdef WIN32
 
@@ -764,8 +765,36 @@ do_ifconfig (struct tuntap *tt,
       tt->did_ifconfig = true;
 
 #endif /*ENABLE_IPROUTE*/
+#elif defined(TARGET_ANDROID)
+        
+      if (do_ipv6) {
+          struct buffer out6 = alloc_buf_gc (64, &gc);
+          buf_printf (&out6, "%s/%d", ifconfig_ipv6_local,tt->netbits_ipv6);
+          management_android_control(management, "IFCONFIG6",buf_bptr(&out6));
+      }
+      
+      struct buffer out = alloc_buf_gc (64, &gc);
+
+      char* top;
+      switch(tt->topology) {
+      case TOP_NET30:
+          top = "net30";
+          break;
+      case TOP_P2P:
+          top="p2p";
+          break;
+      case TOP_SUBNET:
+          top="subnet";
+          break;
+      default:
+          top="undef";
+      }
+      
+      buf_printf (&out, "%s %s %d %s", ifconfig_local, ifconfig_remote_netmask, tun_mtu, top);
+      management_android_control (management, "IFCONFIG", buf_bptr(&out));
+        
 #elif defined(TARGET_SOLARIS)
-
+      
       /* Solaris 2.6 (and 7?) cannot set all parameters in one go...
        * example:
        *    ifconfig tun2 10.2.0.2 10.2.0.1 mtu 1450 up
@@ -1368,8 +1397,63 @@ close_tun_generic (struct tuntap *tt)
 
 #endif
 
-#if defined(TARGET_LINUX)
+#if defined (TARGET_ANDROID)
+void
+open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tuntap *tt)
+{
+#define ANDROID_TUNNAME "vpnservice-tun"
+  int i;
+  struct user_pass up;
+  struct gc_arena gc = gc_new ();
+  bool opentun;
+  
+  for (i = 0; i < tt->options.dns_len; ++i) {
+    management_android_control (management, "DNSSERVER",
+                                print_in_addr_t(tt->options.dns[i], 0, &gc));
+  }
+
+  if(tt->options.domain) 
+    management_android_control (management, "DNSDOMAIN", tt->options.domain);
+    
+  opentun = management_android_control (management, "OPENTUN", dev);
+
+  /* Pick up the fd from management interface after calling the OPENTUN command */
+  tt->fd = management->connection.lastfdreceived;
+  management->connection.lastfdreceived=-1;
+    
+  if( (tt->fd < 0) || !opentun) {
+    msg (M_ERR, "ERROR: Cannot open TUN");
+  }
+
+  /* Set the actual name to a dummy name */
+  tt->actual_name = malloc(sizeof(ANDROID_TUNNAME));
+  strcpy(tt->actual_name, ANDROID_TUNNAME);
+  gc_free (&gc);
+}
+
+void
+close_tun (struct tuntap *tt)
+{
+    if (tt)
+    {
+        close_tun_generic (tt);
+        free (tt);
+    }
+}
+
+int
+write_tun (struct tuntap* tt, uint8_t *buf, int len)
+{
+    return write (tt->fd, buf, len);
+}
+
+int
+read_tun (struct tuntap* tt, uint8_t *buf, int len)
+{
+    return read (tt->fd, buf, len);
+}
 
+#elif defined(TARGET_LINUX)
 #ifdef HAVE_LINUX_IF_TUN_H	/* New driver support */
 
 #ifndef HAVE_LINUX_SOCKIOS_H
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index 63e4b5c..956ad8d 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -38,7 +38,7 @@
 #include "proto.h"
 #include "misc.h"
 
-#ifdef WIN32
+#if defined(WIN32) || defined(TARGET_ANDROID)
 
 #define TUN_ADAPTER_INDEX_INVALID ((DWORD)-1)
 
@@ -292,6 +292,8 @@ ifconfig_order(void)
   return IFCONFIG_AFTER_TUN_OPEN;
 #elif defined(WIN32)
   return IFCONFIG_BEFORE_TUN_OPEN;
+#elif defined(TARGET_ANDROID)
+  return IFCONFIG_BEFORE_TUN_OPEN;
 #else
   return IFCONFIG_DEFAULT;
 #endif
@@ -304,7 +306,11 @@ ifconfig_order(void)
 static inline int
 route_order(void)
 {
+#if defined(TARGET_ANDROID)
+    return ROUTE_BEFORE_TUN;
+#else
     return ROUTE_ORDER_DEFAULT;
+#endif
 }
 
 
-- 
1.7.9.5

[Openvpn-devel] [[Patch v3] 4/4] Emulate persist-tun on Android

[Arne Schwabe]

On Android changing the configuration of tun is not possible. So instead of reconfiguring the tun device, open a new tun device and close the old one if needed
---
 src/openvpn/init.c |   18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index f08583b..9ff6600 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -1402,8 +1402,19 @@ do_open_tun (struct context *c)
   c->c2.ipv4_tun = (!c->options.tun_ipv6
 		    && is_dev_type (c->options.dev, c->options.dev_type, "tun"));
 
+#ifndef TARGET_ANDROID
   if (!c->c1.tuntap)
     {
+#endif
+      
+#ifdef TARGET_ANDROID
+      /* If we emulate persist-tun on android we still have to open a new tun and
+         then close the old */
+      int oldtunfd=-1;
+      if(c->c1.tuntap)
+          oldtunfd = c->c1.tuntap->fd;
+#endif
+        
       /* initialize (but do not open) tun/tap object */
       do_init_tun (c);
 
@@ -1439,7 +1450,10 @@ do_open_tun (struct context *c)
       /* open the tun device */
       open_tun (c->options.dev, c->options.dev_type, c->options.dev_node,
 		c->c1.tuntap);
-
+#ifdef TARGET_ANDROID
+      if(oldtunfd>=0)
+        close(oldtunfd);
+#endif
       /* set the hardware address */
       if (c->options.lladdr)
 	  set_lladdr(c->c1.tuntap->actual_name, c->options.lladdr, c->c2.es);
@@ -1481,6 +1495,7 @@ do_open_tun (struct context *c)
 
       ret = true;
       static_context = c;
+#ifndef TARGET_ANDROID
     }
   else
     {
@@ -1503,6 +1518,7 @@ do_open_tun (struct context *c)
 		     "up",
 		     c->c2.es);
     }
+#endif
   gc_free (&gc);
   return ret;
 }
-- 
1.7.9.5

Re: [Openvpn-devel] [[Patch v3] 1/3] Allow routes to be set before opening tun, similar to ifconfig before opening tun

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 813 bytes --]

Hi,

On Fri, Apr 26, 2013 at 09:54:03PM +0200, Arne Schwabe wrote:
> diff --git a/src/openvpn/init.c b/src/openvpn/init.c
> index 979ba23..f08583b 100644
> --- a/src/openvpn/init.c
> +++ b/src/openvpn/init.c
[..]
> -      if (!c->options.route_delay_defined)
> +      if ((ifconfig_order() == ROUTE_AFTER_TUN) && (!c->options.route_delay_defined))

uh...?  ifconfig_order() again?

> -	  if (c->options.route_delay_defined)
> +	  if ((ifconfig_order() == ROUTE_AFTER_TUN) && c->options.route_delay_defined)

And here.

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: Type: application/pgp-signature, Size: 305 bytes --]

Re: [Openvpn-devel] [[Patch v3] 3/3] Android platform specific changes.

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 1973 bytes --]

Hi,

On Fri, Apr 26, 2013 at 09:54:05PM +0200, Arne Schwabe wrote:
> +/*
> + * The android control method will instruct the GUI part of openvpn to
> + * do the route/ifconfig/open tun command. 
> + */
> +bool management_android_control (struct management *man, const char *command, const char *msg)
> +{
> +  struct user_pass up;    
> +  strcpy(up.username, msg);
> +  
> +  management_query_user_pass(management, &up , command, GET_USER_PASS_NEED_OK,(void*) 0);
> +  return strcmp ("ok", up.password)==0;
> +}
>  #endif

Much better :-) - but if I may voice some extra wishes... :-)

  CLEAR(up);
  strncp(up.username, msg, sizeof(up.username)-1);

"just to be sure"

> diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
> index 8eb112b..ade9aad 100644
> --- a/src/openvpn/socket.c
> +++ b/src/openvpn/socket.c
> @@ -725,6 +726,14 @@ create_socket (struct link_socket *sock)
>      {
>        ASSERT (0);
>      }
> +#ifdef TARGET_ANDROID
> +    struct user_pass up;
> +
> +    management->connection.fdtosend = sock->sd;
> +    management_android_control (management, "PROTECTFD", __func__);
> +
> +#endif
> +    

A stray "struct user_pass" is dangling around here :-) - and I think this
code would be helped by a comment

   /* pass socket FD to management interface to pass on to VPN API 
    * as "protected socket" (exempt from being routed into tunnel)
    */

[..]
> +  /* Set the actual name to a dummy name */
> +  tt->actual_name = malloc(sizeof(ANDROID_TUNNAME));
> +  strcpy(tt->actual_name, ANDROID_TUNNAME);

Uh... strdup()?  And malloc return value checking?

... but besides these, I think we're getting close :-)

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert@...1296...
fax: +49-89-35655025                        gert@...1297...

[-- Attachment #2: Type: application/pgp-signature, Size: 305 bytes --]

[Openvpn-devel] [Patch v4 3/4] Android platform specific changes.

[Arne Schwabe]

On Android 4.0 (TARGET_ANDROID) the real opening of the tun is handled by the (Java) application controlling OpenVPN. Instead of calling ifconfig/route call the management to do the work. When running openvpn as root openvpn should be compiled as TARGET_LINUX

Signed-off-by: Arne Schwabe <arne@...1227...>
---
 src/openvpn/manage.c  |   14 ++++++++
 src/openvpn/manage.h  |    4 +++
 src/openvpn/options.c |    6 ++++
 src/openvpn/route.c   |   18 ++++++++--
 src/openvpn/socket.c  |   10 ++++++
 src/openvpn/ssl.c     |    2 ++
 src/openvpn/syshead.h |    2 +-
 src/openvpn/tun.c     |   87 +++++++++++++++++++++++++++++++++++++++++++++++--
 src/openvpn/tun.h     |    8 ++++-
 9 files changed, 145 insertions(+), 6 deletions(-)

diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 80c469e..8dbb0bb 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -1849,6 +1849,20 @@ static ssize_t man_recv_with_fd (int fd, void *ptr, size_t nbytes, int flags, in
     
   return (n);
 }
+
+/*
+ * The android control method will instruct the GUI part of openvpn to
+ * do the route/ifconfig/open tun command. 
+ */
+bool management_android_control (struct management *man, const char *command, const char *msg)
+{
+  struct user_pass up;    
+  CLEAR(up);
+  strncpy (up.username, msg, sizeof(up.username)-1);
+  
+  management_query_user_pass(management, &up , command, GET_USER_PASS_NEED_OK,(void*) 0);
+  return strcmp ("ok", up.password)==0;
+}
 #endif
 
 static int
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index f5d776e..b08bb78 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -376,6 +376,10 @@ bool management_query_user_pass (struct management *man,
 				 const unsigned int flags,
 				 const char *static_challenge);
 
+#ifdef TARGET_ANDROID
+bool management_android_control (struct management *man, const char *command, const char *msg);
+#endif
+
 bool management_should_daemonize (struct management *man);
 bool management_would_hold (struct management *man);
 bool management_hold (struct management *man);
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 05c6da2..9fdfd88 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -1125,7 +1125,9 @@ show_tuntap_options (const struct tuntap_options *o)
 }
 
 #endif
+#endif
 
+#if defined(WIN32) || defined(TARGET_ANDROID) 
 static void
 dhcp_option_address_parse (const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
 {
@@ -5935,6 +5937,8 @@ add_option (struct options *options,
       to->ip_win32_type = index;
       to->ip_win32_defined = true; 
     }
+#endif
+#if defined(WIN32) || defined(TARGET_ANDROID)
   else if (streq (p[0], "dhcp-option") && p[1])
     {
       struct tuntap_options *o = &options->tuntap_options;
@@ -5986,6 +5990,8 @@ add_option (struct options *options,
 	}
       o->dhcp_options = true;
     }
+#endif
+#ifdef WIN32
   else if (streq (p[0], "show-adapters"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
diff --git a/src/openvpn/route.c b/src/openvpn/route.c
index 4c1e14e..ff10734 100644
--- a/src/openvpn/route.c
+++ b/src/openvpn/route.c
@@ -1342,6 +1342,12 @@ add_route (struct route *r,
   argv_msg (D_ROUTE, &argv);
   status = openvpn_execve_check (&argv, es, 0, "ERROR: Linux route add command failed");
 
+#elif defined (TARGET_ANDROID)
+  struct buffer out = alloc_buf_gc (64, &gc);
+
+  buf_printf (&out, "%s %s", network, netmask);
+  management_android_control (management, "ROUTE", buf_bptr(&out));
+  
 #elif defined (WIN32)
   {
     DWORD ai = TUN_ADAPTER_INDEX_INVALID;
@@ -1616,6 +1622,13 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla
   argv_msg (D_ROUTE, &argv);
   status = openvpn_execve_check (&argv, es, 0, "ERROR: Linux route -6/-A inet6 add command failed");
 
+#elif defined (TARGET_ANDROID)
+    struct buffer out = alloc_buf_gc (64, &gc);
+
+    buf_printf (&out, "%s/%d", network, r6->netbits);
+
+    management_android_control (management, "ROUTE6", buf_bptr(&out));
+
 #elif defined (WIN32)
 
   /* netsh interface ipv6 add route 2001:db8::/32 MyTunDevice */
@@ -1875,7 +1888,8 @@ delete_route (struct route *r,
 
   argv_msg (D_ROUTE, &argv);
   openvpn_execve_check (&argv, es, 0, "ERROR: OpenBSD/NetBSD route delete command failed");
-
+#elif defined(TARGET_ANDROID)
+  msg (M_NONFATAL, "Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.");
 #else
   msg (M_FATAL, "Sorry, but I don't know how to do 'route' commands on this operating system.  Try putting your routes in a --route-up script");
 #endif
@@ -2425,7 +2439,7 @@ show_routes (int msglev)
   gc_free (&gc);
 }
 
-#elif defined(TARGET_LINUX)
+#elif defined(TARGET_LINUX) || defined(TARGET_ANDROID)
 
 void
 get_default_gateway (struct route_gateway_info *rgi)
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 8eb112b..9bb8cff 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -38,6 +38,7 @@
 #include "ps.h"
 #include "manage.h"
 #include "misc.h"
+#include "manage.h"
 
 #include "memdbg.h"
 
@@ -725,6 +726,15 @@ create_socket (struct link_socket *sock)
     {
       ASSERT (0);
     }
+#ifdef TARGET_ANDROID
+  /* pass socket FD to management interface to pass on to VPNService API 
+   * as "protected socket" (exempt from being routed into tunnel)
+   */
+  
+  management->connection.fdtosend = sock->sd;
+  management_android_control (management, "PROTECTFD", __func__);
+#endif
+    
 }
 
 /*
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 43b3980..b367386 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1797,6 +1797,8 @@ push_peer_info(struct buffer *buf, struct tls_session *session)
       buf_printf (&out, "IV_PLAT=netbsd\n");
 #elif defined(TARGET_FREEBSD)
       buf_printf (&out, "IV_PLAT=freebsd\n");
+#elif defined(TARGET_ANDROID)
+      buf_printf(&out, "IV_PLAT=android\n");
 #elif defined(WIN32)
       buf_printf (&out, "IV_PLAT=win\n");
 #endif
diff --git a/src/openvpn/syshead.h b/src/openvpn/syshead.h
index 4db29cc..0c3e4ee 100644
--- a/src/openvpn/syshead.h
+++ b/src/openvpn/syshead.h
@@ -212,7 +212,7 @@
 #include <net/if_tap.h>
 #endif
 
-#ifdef TARGET_LINUX
+#if defined(TARGET_LINUX) || defined (TARGET_ANDROID)
 
 #if defined(HAVE_NETINET_IF_ETHER_H)
 #include <netinet/if_ether.h>
diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
index a361233..ac8b544 100644
--- a/src/openvpn/tun.c
+++ b/src/openvpn/tun.c
@@ -48,6 +48,7 @@
 #include "win32.h"
 
 #include "memdbg.h"
+#include <string.h>
 
 #ifdef WIN32
 
@@ -764,8 +765,36 @@ do_ifconfig (struct tuntap *tt,
       tt->did_ifconfig = true;
 
 #endif /*ENABLE_IPROUTE*/
+#elif defined(TARGET_ANDROID)
+        
+      if (do_ipv6) {
+          struct buffer out6 = alloc_buf_gc (64, &gc);
+          buf_printf (&out6, "%s/%d", ifconfig_ipv6_local,tt->netbits_ipv6);
+          management_android_control(management, "IFCONFIG6",buf_bptr(&out6));
+      }
+      
+      struct buffer out = alloc_buf_gc (64, &gc);
+
+      char* top;
+      switch(tt->topology) {
+      case TOP_NET30:
+          top = "net30";
+          break;
+      case TOP_P2P:
+          top="p2p";
+          break;
+      case TOP_SUBNET:
+          top="subnet";
+          break;
+      default:
+          top="undef";
+      }
+      
+      buf_printf (&out, "%s %s %d %s", ifconfig_local, ifconfig_remote_netmask, tun_mtu, top);
+      management_android_control (management, "IFCONFIG", buf_bptr(&out));
+        
 #elif defined(TARGET_SOLARIS)
-
+      
       /* Solaris 2.6 (and 7?) cannot set all parameters in one go...
        * example:
        *    ifconfig tun2 10.2.0.2 10.2.0.1 mtu 1450 up
@@ -1368,8 +1397,62 @@ close_tun_generic (struct tuntap *tt)
 
 #endif
 
-#if defined(TARGET_LINUX)
+#if defined (TARGET_ANDROID)
+void
+open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tuntap *tt)
+{
+#define ANDROID_TUNNAME "vpnservice-tun"
+  int i;
+  struct user_pass up;
+  struct gc_arena gc = gc_new ();
+  bool opentun;
+  
+  for (i = 0; i < tt->options.dns_len; ++i) {
+    management_android_control (management, "DNSSERVER",
+                                print_in_addr_t(tt->options.dns[i], 0, &gc));
+  }
+
+  if(tt->options.domain) 
+    management_android_control (management, "DNSDOMAIN", tt->options.domain);
+    
+  opentun = management_android_control (management, "OPENTUN", dev);
+
+  /* Pick up the fd from management interface after calling the OPENTUN command */
+  tt->fd = management->connection.lastfdreceived;
+  management->connection.lastfdreceived=-1;
+    
+  /* Set the actual name to a dummy name */
+  tt->actual_name = strdup (ANDROID_TUNNAME);
+
+  if( (tt->fd < 0) || !opentun || !tt->actual_name)
+    msg (M_ERR, "ERROR: Cannot open TUN");
+
+  gc_free (&gc);
+}
+
+void
+close_tun (struct tuntap *tt)
+{
+    if (tt)
+    {
+        close_tun_generic (tt);
+        free (tt);
+    }
+}
+
+int
+write_tun (struct tuntap* tt, uint8_t *buf, int len)
+{
+    return write (tt->fd, buf, len);
+}
+
+int
+read_tun (struct tuntap* tt, uint8_t *buf, int len)
+{
+    return read (tt->fd, buf, len);
+}
 
+#elif defined(TARGET_LINUX)
 #ifdef HAVE_LINUX_IF_TUN_H	/* New driver support */
 
 #ifndef HAVE_LINUX_SOCKIOS_H
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index 63e4b5c..956ad8d 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -38,7 +38,7 @@
 #include "proto.h"
 #include "misc.h"
 
-#ifdef WIN32
+#if defined(WIN32) || defined(TARGET_ANDROID)
 
 #define TUN_ADAPTER_INDEX_INVALID ((DWORD)-1)
 
@@ -292,6 +292,8 @@ ifconfig_order(void)
   return IFCONFIG_AFTER_TUN_OPEN;
 #elif defined(WIN32)
   return IFCONFIG_BEFORE_TUN_OPEN;
+#elif defined(TARGET_ANDROID)
+  return IFCONFIG_BEFORE_TUN_OPEN;
 #else
   return IFCONFIG_DEFAULT;
 #endif
@@ -304,7 +306,11 @@ ifconfig_order(void)
 static inline int
 route_order(void)
 {
+#if defined(TARGET_ANDROID)
+    return ROUTE_BEFORE_TUN;
+#else
     return ROUTE_ORDER_DEFAULT;
+#endif
 }
 
 
-- 
1.7.9.5

[Openvpn-devel] [Patch v4 1/4] Allow routes to be set before opening tun, similar to ifconfig before opening tun

[Arne Schwabe]

---
 src/openvpn/init.c |   13 ++++++++++---
 src/openvpn/tun.h  |   11 +++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/openvpn/init.c b/src/openvpn/init.c
index 979ba23..33725e2 100644
--- a/src/openvpn/init.c
+++ b/src/openvpn/init.c
@@ -1428,7 +1428,14 @@ do_open_tun (struct context *c)
 						&gc);
 	  do_ifconfig (c->c1.tuntap, guess, TUN_MTU_SIZE (&c->c2.frame), c->c2.es);
 	}
-
+      
+      /* possibly add routes */
+      if (route_order() == ROUTE_BEFORE_TUN) {
+        /* Ignore route_delay, would cause ROUTE_BEFORE_TUN to be ignored */
+        do_route (&c->options, c->c1.route_list, c->c1.route_ipv6_list,
+                  c->c1.tuntap, c->plugins, c->c2.es);
+      }
+      
       /* open the tun device */
       open_tun (c->options.dev, c->options.dev_type, c->options.dev_node,
 		c->c1.tuntap);
@@ -1460,7 +1467,7 @@ do_open_tun (struct context *c)
 		   c->c2.es);
 
       /* possibly add routes */
-      if (!c->options.route_delay_defined)
+      if ((route_order() == ROUTE_AFTER_TUN) && (!c->options.route_delay_defined))
 	do_route (&c->options, c->c1.route_list, c->c1.route_ipv6_list,
 		  c->c1.tuntap, c->plugins, c->c2.es);
 
@@ -1668,7 +1675,7 @@ do_up (struct context *c, bool pulled_options, unsigned int option_types_found)
 #endif
 
 	  /* if --route-delay was specified, start timer */
-	  if (c->options.route_delay_defined)
+	  if ((route_order() == ROUTE_AFTER_TUN) && c->options.route_delay_defined)
 	    {
 	      event_timeout_init (&c->c2.route_wakeup, c->options.route_delay, now);
 	      event_timeout_init (&c->c2.route_wakeup_expire, c->options.route_delay + c->options.route_delay_window, now);
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index c3fc62e..63e4b5c 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -297,6 +297,17 @@ ifconfig_order(void)
 #endif
 }
 
+#define ROUTE_BEFORE_TUN 0
+#define ROUTE_AFTER_TUN 1
+#define ROUTE_ORDER_DEFAULT ROUTE_AFTER_TUN
+
+static inline int
+route_order(void)
+{
+    return ROUTE_ORDER_DEFAULT;
+}
+
+
 #ifdef WIN32
 
 #define TUN_PASS_BUFFER
-- 
1.7.9.5

Re: [Openvpn-devel] [Patch v4 3/4] Android platform specific changes.

[David Sommerseth]

[-- Attachment #1: Type: text/plain, Size: 2552 bytes --]

On 28/04/13 16:31, Arne Schwabe wrote:
> On Android 4.0 (TARGET_ANDROID) the real opening of the tun is
> handled by the (Java) application controlling OpenVPN. Instead of calling
> ifconfig/route call the management to do the work. When running openvpn
> as root openvpn should be compiled as TARGET_LINUX
> 
> Signed-off-by: Arne Schwabe <arne@...1227...>
> ---
>  src/openvpn/manage.c  |   14 ++++++++
>  src/openvpn/manage.h  |    4 +++
>  src/openvpn/options.c |    6 ++++
>  src/openvpn/route.c   |   18 ++++++++--
>  src/openvpn/socket.c  |   10 ++++++
>  src/openvpn/ssl.c     |    2 ++
>  src/openvpn/syshead.h |    2 +-
>  src/openvpn/tun.c     |   87 +++++++++++++++++++++++++++++++++++++++++++++++--
>  src/openvpn/tun.h     |    8 ++++-
>  9 files changed, 145 insertions(+), 6 deletions(-)

[...snip...]

> diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
> index a361233..ac8b544 100644
> --- a/src/openvpn/tun.c
> +++ b/src/openvpn/tun.c
[...snip...]
> @@ -1368,8 +1397,62 @@ close_tun_generic (struct tuntap *tt)
>  
>  #endif
>  
> -#if defined(TARGET_LINUX)
> +#if defined (TARGET_ANDROID)
> +void
> +open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tuntap *tt)
> +{
> +#define ANDROID_TUNNAME "vpnservice-tun"
> +  int i;
> +  struct user_pass up;
> +  struct gc_arena gc = gc_new ();
> +  bool opentun;
> +  
> +  for (i = 0; i < tt->options.dns_len; ++i) {
> +    management_android_control (management, "DNSSERVER",
> +                                print_in_addr_t(tt->options.dns[i], 0, &gc));
> +  }
> +
> +  if(tt->options.domain) 
> +    management_android_control (management, "DNSDOMAIN", tt->options.domain);
> +    
> +  opentun = management_android_control (management, "OPENTUN", dev);
> +
> +  /* Pick up the fd from management interface after calling the OPENTUN command */
> +  tt->fd = management->connection.lastfdreceived;
> +  management->connection.lastfdreceived=-1;
> +    
> +  /* Set the actual name to a dummy name */
> +  tt->actual_name = strdup (ANDROID_TUNNAME);

Just nit-picking ... anything wrong with string_alloc() which is used in
similar places?  And which can make use of gc (if that is available
here, didn't check that) and it will do the proper malloc() checks too.

Otherwise, code looks find.  I don't fully understand all the tun magic
needed on Android, but OpenVPN on Android have been well tested, so I
would say that should count as well.


--
kind regards,

David Sommerseth



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 263 bytes --]

Re: [Openvpn-devel] [[Patch v3] 4/4] Emulate persist-tun on Android

[David Sommerseth]

[-- Attachment #1: Type: text/plain, Size: 2159 bytes --]

On 26/04/13 21:59, Arne Schwabe wrote:
> On Android changing the configuration of tun is not possible. So instead of reconfiguring the tun device, open a new tun device and close the old one if needed
> ---
>  src/openvpn/init.c |   18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
> 
> diff --git a/src/openvpn/init.c b/src/openvpn/init.c
> index f08583b..9ff6600 100644
> --- a/src/openvpn/init.c
> +++ b/src/openvpn/init.c
> @@ -1402,8 +1402,19 @@ do_open_tun (struct context *c)
>    c->c2.ipv4_tun = (!c->options.tun_ipv6
>  		    && is_dev_type (c->options.dev, c->options.dev_type, "tun"));
>  
> +#ifndef TARGET_ANDROID
>    if (!c->c1.tuntap)
>      {
> +#endif
> +      
> +#ifdef TARGET_ANDROID
> +      /* If we emulate persist-tun on android we still have to open a new tun and
> +         then close the old */
> +      int oldtunfd=-1;
> +      if(c->c1.tuntap)
> +          oldtunfd = c->c1.tuntap->fd;
> +#endif
> +        
>        /* initialize (but do not open) tun/tap object */
>        do_init_tun (c);
>  
> @@ -1439,7 +1450,10 @@ do_open_tun (struct context *c)
>        /* open the tun device */
>        open_tun (c->options.dev, c->options.dev_type, c->options.dev_node,
>  		c->c1.tuntap);
> -
> +#ifdef TARGET_ANDROID
> +      if(oldtunfd>=0)
> +        close(oldtunfd);
> +#endif
>        /* set the hardware address */
>        if (c->options.lladdr)
>  	  set_lladdr(c->c1.tuntap->actual_name, c->options.lladdr, c->c2.es);
> @@ -1481,6 +1495,7 @@ do_open_tun (struct context *c)
>  
>        ret = true;
>        static_context = c;
> +#ifndef TARGET_ANDROID
>      }
>    else
>      {
> @@ -1503,6 +1518,7 @@ do_open_tun (struct context *c)
>  		     "up",
>  		     c->c2.es);
>      }
> +#endif
>    gc_free (&gc);
>    return ret;
>  }


There are a few stylish details I could nit-pick on, such as

    if(bool) -> if (bool)

but that's so minor I don't even convinced this makes sense to fix up
before applying.

So, looks good, code wise.  Not compile tested, only patch review.


-- 
kind regards,

David Sommerseth


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 263 bytes --]

Re: [Openvpn-devel] [Patch v4 1/4] Allow routes to be set before opening tun, similar to ifconfig before opening tun

[David Sommerseth]

[-- Attachment #1: Type: text/plain, Size: 2769 bytes --]

On 28/04/13 16:32, Arne Schwabe wrote:
> ---
>  src/openvpn/init.c |   13 ++++++++++---
>  src/openvpn/tun.h  |   11 +++++++++++
>  2 files changed, 21 insertions(+), 3 deletions(-)
> 
> diff --git a/src/openvpn/init.c b/src/openvpn/init.c
> index 979ba23..33725e2 100644
> --- a/src/openvpn/init.c
> +++ b/src/openvpn/init.c
> @@ -1428,7 +1428,14 @@ do_open_tun (struct context *c)
>  						&gc);
>  	  do_ifconfig (c->c1.tuntap, guess, TUN_MTU_SIZE (&c->c2.frame), c->c2.es);
>  	}
> -
> +      
> +      /* possibly add routes */
> +      if (route_order() == ROUTE_BEFORE_TUN) {
> +        /* Ignore route_delay, would cause ROUTE_BEFORE_TUN to be ignored */
> +        do_route (&c->options, c->c1.route_list, c->c1.route_ipv6_list,
> +                  c->c1.tuntap, c->plugins, c->c2.es);
> +      }
> +      
>        /* open the tun device */
>        open_tun (c->options.dev, c->options.dev_type, c->options.dev_node,
>  		c->c1.tuntap);
> @@ -1460,7 +1467,7 @@ do_open_tun (struct context *c)
>  		   c->c2.es);
>  
>        /* possibly add routes */
> -      if (!c->options.route_delay_defined)
> +      if ((route_order() == ROUTE_AFTER_TUN) && (!c->options.route_delay_defined))
>  	do_route (&c->options, c->c1.route_list, c->c1.route_ipv6_list,
>  		  c->c1.tuntap, c->plugins, c->c2.es);
>  
> @@ -1668,7 +1675,7 @@ do_up (struct context *c, bool pulled_options, unsigned int option_types_found)
>  #endif
>  
>  	  /* if --route-delay was specified, start timer */
> -	  if (c->options.route_delay_defined)
> +	  if ((route_order() == ROUTE_AFTER_TUN) && c->options.route_delay_defined)
>  	    {
>  	      event_timeout_init (&c->c2.route_wakeup, c->options.route_delay, now);
>  	      event_timeout_init (&c->c2.route_wakeup_expire, c->options.route_delay + c->options.route_delay_window, now);
> diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
> index c3fc62e..63e4b5c 100644
> --- a/src/openvpn/tun.h
> +++ b/src/openvpn/tun.h
> @@ -297,6 +297,17 @@ ifconfig_order(void)
>  #endif
>  }
>  
> +#define ROUTE_BEFORE_TUN 0
> +#define ROUTE_AFTER_TUN 1
> +#define ROUTE_ORDER_DEFAULT ROUTE_AFTER_TUN
> +
> +static inline int
> +route_order(void)
> +{
> +    return ROUTE_ORDER_DEFAULT;
> +}

I remember we discussed this oddity a long time ago, but I acknowledge
this is the "coding style" used with ifconfig_order().  We could
probably solve this in a cleaner way avoiding calling a function to get
a constant returned (even though, I hope the compiler optimises this).

Other than that, I presume this is well tested code which has been a
part of the OpenVPN for Android for a while, and I otherwise think the
code looks sane.


-- 
kind regards,

David Sommerseth


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 263 bytes --]

[Openvpn-devel] [Patch v5 3/4] Android platform specific changes.

[Arne Schwabe]

On Android 4.0 (TARGET_ANDROID) the real opening of the tun is handled by the (Java) application controlling OpenVPN. Instead of calling ifconfig/route call the management to do the work. When running openvpn as root openvpn should be compiled as TARGET_LINUX

Signed-off-by: Arne Schwabe <arne@...1227...>
---
 src/openvpn/manage.c  |   14 ++++++++
 src/openvpn/manage.h  |    4 +++
 src/openvpn/options.c |    6 ++++
 src/openvpn/route.c   |   18 ++++++++--
 src/openvpn/socket.c  |   10 ++++++
 src/openvpn/ssl.c     |    2 ++
 src/openvpn/syshead.h |    2 +-
 src/openvpn/tun.c     |   87 +++++++++++++++++++++++++++++++++++++++++++++++--
 src/openvpn/tun.h     |    8 ++++-
 9 files changed, 145 insertions(+), 6 deletions(-)

diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c
index 80c469e..8dbb0bb 100644
--- a/src/openvpn/manage.c
+++ b/src/openvpn/manage.c
@@ -1849,6 +1849,20 @@ static ssize_t man_recv_with_fd (int fd, void *ptr, size_t nbytes, int flags, in
     
   return (n);
 }
+
+/*
+ * The android control method will instruct the GUI part of openvpn to
+ * do the route/ifconfig/open tun command. 
+ */
+bool management_android_control (struct management *man, const char *command, const char *msg)
+{
+  struct user_pass up;    
+  CLEAR(up);
+  strncpy (up.username, msg, sizeof(up.username)-1);
+  
+  management_query_user_pass(management, &up , command, GET_USER_PASS_NEED_OK,(void*) 0);
+  return strcmp ("ok", up.password)==0;
+}
 #endif
 
 static int
diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h
index f5d776e..b08bb78 100644
--- a/src/openvpn/manage.h
+++ b/src/openvpn/manage.h
@@ -376,6 +376,10 @@ bool management_query_user_pass (struct management *man,
 				 const unsigned int flags,
 				 const char *static_challenge);
 
+#ifdef TARGET_ANDROID
+bool management_android_control (struct management *man, const char *command, const char *msg);
+#endif
+
 bool management_should_daemonize (struct management *man);
 bool management_would_hold (struct management *man);
 bool management_hold (struct management *man);
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 05c6da2..9fdfd88 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -1125,7 +1125,9 @@ show_tuntap_options (const struct tuntap_options *o)
 }
 
 #endif
+#endif
 
+#if defined(WIN32) || defined(TARGET_ANDROID) 
 static void
 dhcp_option_address_parse (const char *name, const char *parm, in_addr_t *array, int *len, int msglevel)
 {
@@ -5935,6 +5937,8 @@ add_option (struct options *options,
       to->ip_win32_type = index;
       to->ip_win32_defined = true; 
     }
+#endif
+#if defined(WIN32) || defined(TARGET_ANDROID)
   else if (streq (p[0], "dhcp-option") && p[1])
     {
       struct tuntap_options *o = &options->tuntap_options;
@@ -5986,6 +5990,8 @@ add_option (struct options *options,
 	}
       o->dhcp_options = true;
     }
+#endif
+#ifdef WIN32
   else if (streq (p[0], "show-adapters"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
diff --git a/src/openvpn/route.c b/src/openvpn/route.c
index 4c1e14e..ff10734 100644
--- a/src/openvpn/route.c
+++ b/src/openvpn/route.c
@@ -1342,6 +1342,12 @@ add_route (struct route *r,
   argv_msg (D_ROUTE, &argv);
   status = openvpn_execve_check (&argv, es, 0, "ERROR: Linux route add command failed");
 
+#elif defined (TARGET_ANDROID)
+  struct buffer out = alloc_buf_gc (64, &gc);
+
+  buf_printf (&out, "%s %s", network, netmask);
+  management_android_control (management, "ROUTE", buf_bptr(&out));
+  
 #elif defined (WIN32)
   {
     DWORD ai = TUN_ADAPTER_INDEX_INVALID;
@@ -1616,6 +1622,13 @@ add_route_ipv6 (struct route_ipv6 *r6, const struct tuntap *tt, unsigned int fla
   argv_msg (D_ROUTE, &argv);
   status = openvpn_execve_check (&argv, es, 0, "ERROR: Linux route -6/-A inet6 add command failed");
 
+#elif defined (TARGET_ANDROID)
+    struct buffer out = alloc_buf_gc (64, &gc);
+
+    buf_printf (&out, "%s/%d", network, r6->netbits);
+
+    management_android_control (management, "ROUTE6", buf_bptr(&out));
+
 #elif defined (WIN32)
 
   /* netsh interface ipv6 add route 2001:db8::/32 MyTunDevice */
@@ -1875,7 +1888,8 @@ delete_route (struct route *r,
 
   argv_msg (D_ROUTE, &argv);
   openvpn_execve_check (&argv, es, 0, "ERROR: OpenBSD/NetBSD route delete command failed");
-
+#elif defined(TARGET_ANDROID)
+  msg (M_NONFATAL, "Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.");
 #else
   msg (M_FATAL, "Sorry, but I don't know how to do 'route' commands on this operating system.  Try putting your routes in a --route-up script");
 #endif
@@ -2425,7 +2439,7 @@ show_routes (int msglev)
   gc_free (&gc);
 }
 
-#elif defined(TARGET_LINUX)
+#elif defined(TARGET_LINUX) || defined(TARGET_ANDROID)
 
 void
 get_default_gateway (struct route_gateway_info *rgi)
diff --git a/src/openvpn/socket.c b/src/openvpn/socket.c
index 8eb112b..9bb8cff 100644
--- a/src/openvpn/socket.c
+++ b/src/openvpn/socket.c
@@ -38,6 +38,7 @@
 #include "ps.h"
 #include "manage.h"
 #include "misc.h"
+#include "manage.h"
 
 #include "memdbg.h"
 
@@ -725,6 +726,15 @@ create_socket (struct link_socket *sock)
     {
       ASSERT (0);
     }
+#ifdef TARGET_ANDROID
+  /* pass socket FD to management interface to pass on to VPNService API 
+   * as "protected socket" (exempt from being routed into tunnel)
+   */
+  
+  management->connection.fdtosend = sock->sd;
+  management_android_control (management, "PROTECTFD", __func__);
+#endif
+    
 }
 
 /*
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 43b3980..b367386 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1797,6 +1797,8 @@ push_peer_info(struct buffer *buf, struct tls_session *session)
       buf_printf (&out, "IV_PLAT=netbsd\n");
 #elif defined(TARGET_FREEBSD)
       buf_printf (&out, "IV_PLAT=freebsd\n");
+#elif defined(TARGET_ANDROID)
+      buf_printf(&out, "IV_PLAT=android\n");
 #elif defined(WIN32)
       buf_printf (&out, "IV_PLAT=win\n");
 #endif
diff --git a/src/openvpn/syshead.h b/src/openvpn/syshead.h
index 4db29cc..0c3e4ee 100644
--- a/src/openvpn/syshead.h
+++ b/src/openvpn/syshead.h
@@ -212,7 +212,7 @@
 #include <net/if_tap.h>
 #endif
 
-#ifdef TARGET_LINUX
+#if defined(TARGET_LINUX) || defined (TARGET_ANDROID)
 
 #if defined(HAVE_NETINET_IF_ETHER_H)
 #include <netinet/if_ether.h>
diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c
index a361233..76510e9 100644
--- a/src/openvpn/tun.c
+++ b/src/openvpn/tun.c
@@ -48,6 +48,7 @@
 #include "win32.h"
 
 #include "memdbg.h"
+#include <string.h>
 
 #ifdef WIN32
 
@@ -764,8 +765,36 @@ do_ifconfig (struct tuntap *tt,
       tt->did_ifconfig = true;
 
 #endif /*ENABLE_IPROUTE*/
+#elif defined(TARGET_ANDROID)
+        
+      if (do_ipv6) {
+          struct buffer out6 = alloc_buf_gc (64, &gc);
+          buf_printf (&out6, "%s/%d", ifconfig_ipv6_local,tt->netbits_ipv6);
+          management_android_control(management, "IFCONFIG6",buf_bptr(&out6));
+      }
+      
+      struct buffer out = alloc_buf_gc (64, &gc);
+
+      char* top;
+      switch(tt->topology) {
+      case TOP_NET30:
+          top = "net30";
+          break;
+      case TOP_P2P:
+          top="p2p";
+          break;
+      case TOP_SUBNET:
+          top="subnet";
+          break;
+      default:
+          top="undef";
+      }
+      
+      buf_printf (&out, "%s %s %d %s", ifconfig_local, ifconfig_remote_netmask, tun_mtu, top);
+      management_android_control (management, "IFCONFIG", buf_bptr(&out));
+        
 #elif defined(TARGET_SOLARIS)
-
+      
       /* Solaris 2.6 (and 7?) cannot set all parameters in one go...
        * example:
        *    ifconfig tun2 10.2.0.2 10.2.0.1 mtu 1450 up
@@ -1368,8 +1397,62 @@ close_tun_generic (struct tuntap *tt)
 
 #endif
 
-#if defined(TARGET_LINUX)
+#if defined (TARGET_ANDROID)
+void
+open_tun (const char *dev, const char *dev_type, const char *dev_node, struct tuntap *tt)
+{
+#define ANDROID_TUNNAME "vpnservice-tun"
+  int i;
+  struct user_pass up;
+  struct gc_arena gc = gc_new ();
+  bool opentun;
+  
+  for (i = 0; i < tt->options.dns_len; ++i) {
+    management_android_control (management, "DNSSERVER",
+                                print_in_addr_t(tt->options.dns[i], 0, &gc));
+  }
+
+  if(tt->options.domain) 
+    management_android_control (management, "DNSDOMAIN", tt->options.domain);
+    
+  opentun = management_android_control (management, "OPENTUN", dev);
+
+  /* Pick up the fd from management interface after calling the OPENTUN command */
+  tt->fd = management->connection.lastfdreceived;
+  management->connection.lastfdreceived=-1;
+    
+  /* Set the actual name to a dummy name */
+  tt->actual_name = string_alloc (ANDROID_TUNNAME, NULL);
+
+  if ((tt->fd < 0) || !opentun)
+    msg (M_ERR, "ERROR: Cannot open TUN");
+
+  gc_free (&gc);
+}
+
+void
+close_tun (struct tuntap *tt)
+{
+    if (tt)
+    {
+        close_tun_generic (tt);
+        free (tt);
+    }
+}
+
+int
+write_tun (struct tuntap* tt, uint8_t *buf, int len)
+{
+    return write (tt->fd, buf, len);
+}
+
+int
+read_tun (struct tuntap* tt, uint8_t *buf, int len)
+{
+    return read (tt->fd, buf, len);
+}
 
+#elif defined(TARGET_LINUX)
 #ifdef HAVE_LINUX_IF_TUN_H	/* New driver support */
 
 #ifndef HAVE_LINUX_SOCKIOS_H
diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h
index 63e4b5c..956ad8d 100644
--- a/src/openvpn/tun.h
+++ b/src/openvpn/tun.h
@@ -38,7 +38,7 @@
 #include "proto.h"
 #include "misc.h"
 
-#ifdef WIN32
+#if defined(WIN32) || defined(TARGET_ANDROID)
 
 #define TUN_ADAPTER_INDEX_INVALID ((DWORD)-1)
 
@@ -292,6 +292,8 @@ ifconfig_order(void)
   return IFCONFIG_AFTER_TUN_OPEN;
 #elif defined(WIN32)
   return IFCONFIG_BEFORE_TUN_OPEN;
+#elif defined(TARGET_ANDROID)
+  return IFCONFIG_BEFORE_TUN_OPEN;
 #else
   return IFCONFIG_DEFAULT;
 #endif
@@ -304,7 +306,11 @@ ifconfig_order(void)
 static inline int
 route_order(void)
 {
+#if defined(TARGET_ANDROID)
+    return ROUTE_BEFORE_TUN;
+#else
     return ROUTE_ORDER_DEFAULT;
+#endif
 }
 
 
-- 
1.7.9.5

[Openvpn-devel] [Patch v5 5/5] Document the Android implementation in OpenVPN

[Arne Schwabe]

Also fix a minor mistake in the manpage.
---
 doc/android.txt |   41 +++++++++++++++++++++++++++++++++++++++++
 doc/openvpn.8   |    1 +
 2 files changed, 42 insertions(+)
 create mode 100644 doc/android.txt

diff --git a/doc/android.txt b/doc/android.txt
new file mode 100644
index 0000000..fe97027
--- /dev/null
+++ b/doc/android.txt
@@ -0,0 +1,41 @@
+This file documents the support of OpenVPN in Android 4.0 and up. This support is primarily used in the "OpenVPN for Android" app (http://code.google.com/p/ics-openvpn/). For building see the developer README: http://code.google.com/p/ics-openvpn/source/browse/README.txt. 
+
+Android provides the VPNService API (http://developer.android.com/reference/android/net/VpnService.html) which allows establishing VPN connections without routing the device.
+
+Since all the interfaces are are Android specific the calls to this interface are made from the UI instead of OpenVPN directly. The API needs the following parameters:
+
+- IP and netmask of tun interface 
+- Networks that should be routed to the tun interface
+- DNS Servers and DNS Domain
+- MTU
+
+All IPs/Routes are in CIDR style. Non CIDR routes are not supported. Notable is the lack of support for setting routes to other interfaces usually used to avoid the server connection going over the tun interface. The Android VPNService API has the concept of protecting a socket from being routed over a interface. Calling protect (fd) will internally bind the socket to the interface used for the external connection (usually WiFi or mobile data).
+
+To use OpenVPN with the VPNService API OpenVPN must be build with the TARGET_ANDROID compile option. Also the UI must use a UNIX domain socket to connect to OpenVPN. When compiled as TARGET_ANDROID OpenVPN will use management callbacks instead of executing traditional ifconfig/route commands use the need-ok callback mechanism which will ask 
+
+> NEED-OK command
+
+where command can be:
+
+IFCONFIG6 IPv6/netmask
+IFCONFIG local remoteOrNetmask MTU topology
+
+To tell the UI which IPs addresses OpenVPN expects on the interface. Topology is one of "net30","p2p","subnet" or "undef".
+
+ROUTE6 network/netmask
+ROUTE network netmask
+
+To tell the UI which routes should be set on the tun interface.
+
+DNSSERVER serverip
+DNSDOMAIN searchdomain
+
+To set the DNS server and search domain.
+
+The GUI will then respond with a "needok 'command' ok' or "needok 'command' cancel', e.g. "needok 'IFCONFIG' ok".
+
+To protect a socket the OpenVPN will send a PROTECTFD to the UI. When sending the PROTECTFD command command to the UI it will send the fd of the socket as ancillary message over the UNIX socket. The UI will then call protect(fd) on the received socket protecting it from being routed over the VPN.
+
+When opening a tun device the OpenVPN process will first send all route, ifconfig and DNS related configuration to the UI and after that calls the OPENTUN command to receive a tun fd with the requested configuration. The UI will than use the collected information to call the VPNService's establish() method to receive a fd which in turn is send to the OpenVPN process as ancillary message to the "needok 'OPENTUN' ok' response.
+
+The OpenVPN for Android UI extensively uses other features that are not specific to Android but are rarely used on other platform. For example using SIGUSR1 and management-hold to restart, pause, continue the VPN on network changes or the external key management --management-external-key option and inline files.
diff --git a/doc/openvpn.8 b/doc/openvpn.8
index d590714..cbfc107 100644
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -2487,6 +2487,7 @@ Allow management interface to override
 .B \-\-remote
 directives (client-only).
 .\"*********************************************************
+.TP
 .B \-\-management-external-key
 Allows usage for external private key file instead of
 .B \-\-key
-- 
1.7.9.5

[Openvpn-devel] [PATCH applied] Re: Allow routes to be set before opening tun, similar to ifconfig before opening tun

[Gert Doering]

ACK from me.

Patch has been applied to the master branch (with some whitespace fixes).

commit 94e6a2daad7039e3938876e0124ec7d2bb7e9728
Author: Arne Schwabe
Date:   Sun Apr 28 16:32:39 2013 +0200

     Allow routes to be set before opening tun, similar to ifconfig before opening tun

     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <1367159559-22947-1-git-send-email-arne@...1227...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7564
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering

[Openvpn-devel] [PATCH applied] Re: 2/3] add ability to send/receive file descriptors via management interface, only used in android so. For now under #ifdef ANDROID

[Gert Doering]

ACK from me.

Patch has been applied to the master branch (with some whitespace fixes).

commit ad2df7b983eadbdc81fe0cf92543cad27b8f8882
Author: Arne Schwabe
Date:   Fri Apr 26 21:54:04 2013 +0200

     Add ability to send/receive file descriptors via management interface

     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <1367006045-13576-2-git-send-email-arne@...1227...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7557
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering

[Openvpn-devel] [PATCH applied] Re: Android platform specific changes.

[Gert Doering]

ACK from me.

Patch has been applied to the master branch (with some whitespace fixing),
plus I have taken the liberty to add a pointer to doc/management.txt to
the comment preceding management_android_control().

commit a55b3cdb236ebfd181c24f54ead4b4c27c7bdda7
Author: Arne Schwabe
Date:   Tue Apr 30 21:29:11 2013 +0200

     Android platform specific changes.

     Signed-off-by: Arne Schwabe <arne@...1227...>
     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <1367350151-23089-1-git-send-email-arne@...1227...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7570
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering

[Openvpn-devel] [PATCH applied] Re: 4/4] Emulate persist-tun on Android

[Gert Doering]

ACK from me.

Patch has been applied to the master branch (with some whitespace fixing).

commit bd14d55d87248d18088fc9897e9ffd46a59e147b
Author: Arne Schwabe
Date:   Fri Apr 26 21:59:32 2013 +0200

     Emulate persist-tun on Android

     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <1367006372-14815-1-git-send-email-arne@...1227...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7558
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering

[Openvpn-devel] [PATCH applied] Re: Document the Android implementation in OpenVPN

[Gert Doering]

ACK from me.

Patch has been applied to the master branch.  I have taken the liberty to
reformat the android.txt document a bit (explicit line breaks instead of 
one-paragraph-is-a-line), to be in line with management-notes.txt

commit 733050dcb994fa502ae5d4724efe65a9fe63e203
Author: Arne Schwabe
Date:   Tue Apr 30 22:33:17 2013 +0200

     Document the Android implementation in OpenVPN

     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <1367353997-6669-1-git-send-email-arne@...1227...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/7571
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering