问题是有关要使用Tun/Tap模块的Linux主机的正确配置。
我的目标:
利用现有的路由软件(以下简称APP1和APP2)，但拦截并修改它发送和接收的所有消息(由Mediator完成)。
我的场景:
Ubuntu 10.04 Machine
+---------------------------------------------+
| |
|APP1 --- tap1 --- Mediator --- tap2 --- APP2 |
| |
+---------------------------------------------+
#include <stdlib.h>
#include <stdio.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <fcntl.h>
#include <linux/if.h>
#include <linux/if_tun.h>
#include <string.h>
#include <errno.h>
#include <sys/resource.h>
void createTun(char *, char *, short);
int main(void)
{
const short FLAGS = IFF_TAP;
char *tunName;
char *tunIP;
// Create tap1
tunName = "tap1\0";
tunIP = "10.0.0.1/24\0";
createTun(tunName, tunIP, FLAGS);
printf("Created %s with IP %s\n", tunName, tunIP);
// Create tap2
tunName = "tap2\0";
tunIP = "10.0.0.2/24\0";
createTun(tunName, tunIP, FLAGS);
printf("Created %s with IP %s\n", tunName, tunIP);
return 0;
}
void createTun(char *tunName, char *tunIP, short FLAGS)
{
char *cmd;
char *cloneDev = "/dev/net/tun";
char *cmdIPLinkUpTemplate = "ip link set %s up";
char *cmdIPAddrAddTemplate = "ip addr add %s dev %s";
int cmdIPLinkUpRawLength = strlen(cmdIPLinkUpTemplate) - 2;
int cmdIPAddrAddRawLength = strlen(cmdIPAddrAddTemplate) - 4;
FILE *fp;
int fd, err, owner, group;
struct ifreq ifr;
owner = geteuid();
group = getegid();
// open the clone device
if((fd = open(cloneDev, O_RDWR)) < 0)
{
perror("OPEN CLONEDEV failed.");
exit(EXIT_FAILURE);
}
memset(&ifr, 0, sizeof(struct ifreq));
ifr.ifr_flags = FLAGS;
strncpy(ifr.ifr_name, tunName, strlen(tunName));
// create the device
if(ioctl(fd, TUNSETIFF, (void *) &ifr) < 0)
{
perror("IOCTL SETIFF denied.");
close(fd);
exit(EXIT_FAILURE);
}
// set dev owner
if(owner != -1)
{
if(ioctl(fd, TUNSETOWNER, owner) < 0)
{
perror("IOCTL SETOWNER denied.");
close(fd);
exit(EXIT_FAILURE);
}
}
// set dev group
if(group != -1)
{
if(ioctl(fd, TUNSETGROUP, group) < 0)
{
perror("IOCTL SETGROUP denied.");
close(fd);
exit(EXIT_FAILURE);
}
}
// set dev persistent
if(ioctl(fd, TUNSETPERSIST, 1) < 0)
{
perror("IOCTL SETPERSIST denied.");
close(fd);
exit(EXIT_FAILURE);
}
// Set dev up
cmd = malloc(cmdIPLinkUpRawLength + strlen(tunName) + 1);
sprintf(cmd, cmdIPLinkUpTemplate, ifr.ifr_name);
fp = popen(cmd, "r");
if(fp == NULL)
{
perror("POPEN failed.");
close(fd);
free(cmd);
exit(EXIT_FAILURE);
}
pclose(fp);
free(cmd);
// Assign IP
cmd = malloc(cmdIPAddrAddRawLength + strlen(tunIP) + strlen(tunName) + 1);
sprintf(cmd, cmdIPAddrAddTemplate, tunIP, tunName);
fp = popen(cmd, "r");
if(fp == NULL)
{
perror("POPEN failed.");
close(fd);
free(cmd);
exit(EXIT_FAILURE);
}
pclose(fp);
free(cmd);
return;
}
#include <unistd.h>
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/ip.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/epoll.h>
#include <errno.h>
#include <fcntl.h>
#include <stdlib.h>
#include <string.h>
#include <linux/if.h>
#include <linux/if_tun.h>
int main(int argc, char *argv[])
{
const int NOF_FD = 2;
const char *TUN1 = "tap1";
const char *TUN2 = "tap2";
const char *CLONEDEV = "/dev/net/tun";
int fd_tun1, fd_tun2, fd_epoll;
struct ifreq ifr_tun1, ifr_tun2;
struct epoll_event ev;
const int MAX_EVENTS = 1;
int ready, s, t;
const int MAX_BUF = 2000;
char buf[MAX_BUF];
struct sockaddr_in to;
const short FLAGS = IFF_TAP;
// Open tap1
if((fd_tun1 = open(CLONEDEV, O_RDWR)) < 0)
{
perror("OPEN CLONEDEV for tun1 failed");
exit(EXIT_FAILURE);
}
memset(&ifr_tun1, 0, sizeof(struct ifreq));
ifr_tun1.ifr_flags = FLAGS;
strcpy(ifr_tun1.ifr_name, TUN1);
if(ioctl(fd_tun1, TUNSETIFF, (void *) &ifr_tun1) < 0)
{
perror("IOCTL SETIFF for tap1 failed");
close(fd_tun1);
exit(EXIT_FAILURE);
}
// Open tap2
if((fd_tun2 = open(CLONEDEV, O_RDWR)) < 0)
{
perror("OPEN CLONEDEV for tap2 failed");
exit(EXIT_FAILURE);
}
memset(&ifr_tun2, 0, sizeof(struct ifreq));
ifr_tun2.ifr_flags = FLAGS;
strcpy(ifr_tun2.ifr_name, TUN2);
if(ioctl(fd_tun2, TUNSETIFF, (void *) &ifr_tun2) < 0)
{
perror("IOCTL SETIFF for tun2 failed");
close(fd_tun1);
close(fd_tun2);
exit(EXIT_FAILURE);
}
// Prepare EPOLL
if((fd_epoll = epoll_create(NOF_FD)) < 0)
{
perror("EPOLL CREATE failed");
close(fd_tun1);
close(fd_tun2);
exit(EXIT_FAILURE);
}
memset(&ev, 0, sizeof(ev));
ev.events = EPOLLIN;
ev.data.fd = fd_tun1;
if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_tun1, &ev) < 0)
{
perror("EPOLL CTL ADD fd_tun1 failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
memset(&ev, 0, sizeof(ev));
ev.events = EPOLLIN;
ev.data.fd = fd_tun2;
if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, fd_tun2, &ev) < 0)
{
perror("EPOLL CTL ADD fd_tun2 failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
// Do relay
while(1)
{
if((ready = epoll_wait(fd_epoll, &ev, MAX_EVENTS, -1)) < 0)
{
if(errno == EINTR)
continue;
else
{
perror("EPOLL WAIT failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
}
//printf("EPOLL WAIT SIGNALED\n");
if(ev.events & EPOLLIN)
{
if((s = read(ev.data.fd, buf, MAX_BUF)) < 0)
{
perror("READ failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
printf("Read from %s. Bytes: %d\nData:\n", (ev.data.fd == fd_tun1 ? "tun1" : "tun2"), s);
int k;
for(k = 0; k < s; k++)
{
printf("%c", buf[k]);
}
printf("\n");
t = (ev.data.fd == fd_tun1) ? fd_tun2 : fd_tun1;
if((s = write(t, buf, s)) < 0)
{
perror("WRITE failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
printf("Written to %s. Bytes: %d\n", (t == fd_tun1 ? "tun1" : "tun2"), s);
if(epoll_ctl(fd_epoll, EPOLL_CTL_DEL, ev.data.fd, NULL) < 0)
{
perror("EPOLL CTL DEL failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
if(epoll_ctl(fd_epoll, EPOLL_CTL_ADD, ev.data.fd, &ev) < 0)
{
perror("EPOLL CTL ADD failed");
close(fd_tun1);
close(fd_tun2);
close(fd_epoll);
exit(EXIT_FAILURE);
}
}
printf("\n\n");
}
}
socket(PF_INET, SOCK_RAW, 0X59 /*IPPROTO_??? */) = 8 // Opening a socket for OSPF and tap1
fcntl64(8, F_SETFL, 0_RDONLY | 0_NONBLOCK) = 0
setsockopt(8, SOL_IP, IP_TOS, [192], 4) = 0
setsockopt(8, SOL_SOCKET, SO_PRIORITY, [7], 4) = 0
setsockopt(8, SOL_IP, IP_PKTINFO, [1], 4) = 0
setsockopt(8, SOL_IP, IP_MTU_DISCOVER, [0], 4) = 0
setsockopt(8, SOL_IP, IP_MULTICAST_LOOP, [0], 4) = 0
setsockopt(8, SOL_IP, IP_MULTICAST_TTL, [1], 4) = 0
setsockopt(8, SOL_IP, IP_MUTLICAST_IF, "\0\0\0\0\n\0\0\1\223\0\0\0", 12) = 0
setsockopt(8, SOL_SOCKET, SO_BINDTODEVICE, "tap1\0\0\0\0\0\0\0\0\0\0\0\0\0\315\375\307\250\352\t\t8\207\t\10\0\0\0\0", 32) = 0
setsockopt(8, SOL_IP, IP_ADD_MEMBERSHIP, "340\0\0\5\n\0\0\1\223\0\0\0", 12) = 0
// Then it gets in a cycle like:
select(9, [3, 7, 8], [], NULL, {1, 0}) = 0 (Timeout)
clock_gettime(CLOCK_MONOTONIC, {120893, 360452769}) = 0
time(NULL)
clock_gettime(CLOCK_MONOTONIC, {120893, 360504525}) = 0
select(9, [3, 7, 8], [], NULL, {1, 0}) = 0 (Timeout)
clock_gettime(CLOCK_MONOTONIC, {120894, 363022746}) = 0
time(NULL)
...
我的用法:
我的问题:
即使连接到Tap1的Wireshk看到了来自Tap1和Tap2的消息，APP2也不会接收APP1发送的消息，APP2也不会接收来自APP1的消息。在上面显示的strace提取中，select()调用从不返回文件描述符8，该文件描述符实际上是连接到tap1的套接字。
我的问题:
即使APP1发送了这些消息，并由Mediator中继并由tap1附带的Wireshark看到了这些消息，为什么APP1仍未收到APP2发送的消息？
我是否需要在Linux主机上添加任何类型/种类的其他路由？
设置调谐器/抽头设备时是否出错？
我的调解员代码不能正常工作吗？
最佳答案
我没有尝试过您的代码(您可以从用户空间打开两次TAP设备而不是using a multiqueue flag有点奇怪，但让我们假设这是正确的)，但是您在处理TAP设备的方式上存在概念性错误。
TUN/TAP本质上只是一个管道，该管道的一侧在内核中(tapX接口(interface))，而另一侧在某些用户空间应用程序中。该应用程序写入管道的所有内容都会作为传入流量到达内核接口(interface)(您可以通过wireshark看到它)。内核发送到该管道的任何内容(发送到tapX)最终都会进入应用程序(您可以在应用程序中读取的数据)。
您的代码当前正在执行的操作是在同一管道中打开另一个用户空间部分，这不是您想要的。您想在管道的另一侧获得流量。从技术上讲，您当前正在做的事情可以通过一个简单的桥接接口(interface)来完成，将两个分接头都添加为端口。当然，如果您不仅要桥接，而且要以某种方式修改流量，事情会变得有些复杂。
解决此问题的一种方法是添加另一对TAP接口(interface)。您将tap1和tap2与tap4桥接起来(就像在内核桥接中一样)，现在在“mediator”中打开tap3和tap4，并在它们之间使用代理帧。这是非常低效的，但可能是解决您的问题的方法。
关于c - Linux TUN/TAP : Unable to read data back from TAP devices，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/21001713/