Hack 48. Generate a Tunnel Configuration Automatically

Generate a vtund.conf on the fly to match changing network conditions.

If you're trying to connect two networks securely with vtun [Hack #47] and have got a headache from trying to edit the configuration files, the script described in this Hack will help you generate a working vtund.conf for the client side automatically.

If you haven't read that hack (or if you've never used vtun), go back and read it before attempting to grok this bit of Perl. Essentially, it attempts to take the guesswork out of changing the routing table around on the client side by autodetecting the default gateway, and building the vtund.conf accordingly.

To configure the script, take a look at the Configuration section. The first line of $Config contains the addresses, port, and secret that were used in the vtun hack. The second is there simply as an example of how to add more.

To run the script, either call it as vtundconf home, or set $TunnelName to the one you want to use. Better yet, make symlinks to the script like this:

# ln -s vtundconf home # ln -s vtundconf tunnel2

Then, generate the appropriate vtund.conf by calling the symlink directly:

# vtundconf home > /usr/local/etc/vtund.conf

3.10.1. The Code

Save this file as vtundconf, and run it each time you use a new wireless network to generate an appropriate vtund.conf for you on the fly:

#!/usr/bin/perl -w # vtund wrapper in need of a better name. # # (c)2002 Schuyler Erle & Rob Flickenger # ################ CONFIGURATION # If TunnelName is blank, the wrapper will look at @ARGV or $0. # # Config is TunnelName, LocalIP, RemoteIP, TunnelHost, TunnelPort, Secret # my $TunnelName = ""; my $Config = q{ home 208.201.239.33 208.201.239.32 208.201.239.5 5000 sHHH tunnel2 10.0.1.100 10.0.1.1 192.168.1.4 6001 foobar }; ################ MAIN PROGRAM BEGINS HERE use POSIX 'tmpnam'; use IO::File; use File::Basename; use strict; # Where to find things… # $ENV{PATH} = "/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/ [RETURN] sbin"; my $IP_Match = '((?:d{1,3}.){3}d{1,3})'; # match xxx.xxx.xxx.xxx my $Ifconfig = "ifconfig -a"; my $Netstat = "netstat -rn"; my $Vtund = "/bin/echo"; my $Debug = 1; # Load the template from the data section. # my $template = join( "", ); # Open a temp file -- adapted from Perl Cookbook, 1st Ed., sec. 7.5. # my ( $file, $name ) = ("", ""); $name = tmpnam( ) until $file = IO::File->new( $name, O_RDWR|O_CREAT|O_EXCL ); END { unlink( $name ) or warn "Can't remove temporary file $name! "; } # If no TunnelName is specified, use the first thing on the command line, # or if there isn't one, the basename of the script. # This allows users to symlink different tunnel names to the same script. # $TunnelName ||= shift(@ARGV) || basename($0); die "Can't determine tunnel config to use! " unless $TunnelName; # Parse config. # my ($LocalIP, $RemoteIP, $TunnelHost, $TunnelPort, $Secret); for (split(/ * +/, $Config)) { my ($conf, @vars) = grep( $_ ne "", split( /s+/ )); next if not $conf or $conf =~ /^s*#/o; # skip blank lines, comments if ($conf eq $TunnelName) { ($LocalIP, $RemoteIP, $TunnelHost, $TunnelPort, $Secret) = @vars; last; } } die "Can't determine configuration for TunnelName '$TunnelName'! " unless $RemoteIP and $TunnelHost and $TunnelPort; # Find the default gateway. # my ( $GatewayIP, $ExternalDevice ); for (qx{ $Netstat }) { # In both Linux and BSD, the gateway is the next thing on the line, # and the interface is the last. # if ( /^(?:0.0.0.0|default)s+(S+)s+.*?(S+)s*$/o ) { $GatewayIP = $1; $ExternalDevice = $2; last; } } die "Can't determine default gateway! " unless $GatewayIP and $ExternalDevice; # Figure out the LocalIP and LocalNetwork. # my ( $LocalNetwork ); my ( $iface, $addr, $up, $network, $mask ) = ""; sub compute_netmask { ($addr, $mask) = @_; # We have to mask $addr with $mask because linux /sbin/route # complains if the network address doesn't match the netmask. # my @ip = split( /./, $addr ); my @mask = split( /./, $mask ); $ip[$_] = ($ip[$_] + 0) & ($mask[$_] + 0) for (0..$#ip); $addr = join(".", @ip); return $addr; } for (qx{ $Ifconfig }) { last unless defined $_; # If we got a new device, stash the previous one (if any). if ( /^([^s:]+)/o ) { if ( $iface eq $ExternalDevice and $network and $up ) { $LocalNetwork = $network; last; } $iface = $1; $up = 0; } # Get the network mask for the current interface. if ( /addr:$IP_Match.*?mask:$IP_Match/io ) { # Linux style ifconfig. compute_netmask($1, $2); $network = "$addr netmask $mask"; } elsif ( /inet $IP_Match.*?mask 0x([a-f0-9]{8})/io ) { # BSD style ifconfig. ($addr, $mask) = ($1, $2); $mask = join(".", map( hex $_, $mask =~ /(..)/gs )); compute_netmask($addr, $mask); $network = "$addr/$mask"; } # Ignore interfaces that are loopback devices or aren't up. $iface = "" if /LOOPBACK/o; $up++ if /UP/o; } die "Can't determine local IP address! " unless $LocalIP and $LocalNetwork; # Set OS dependent variables. # my ( $GW, $NET, $PTP ); if ( $^O eq "linux" ) { $GW = "gw"; $PTP = "pointopoint"; $NET = "-net"; } else { $GW = $PTP = $NET = ""; } # Parse the config template. # $template =~ s/($w+)/$1/gee; # Write the temp file and execute vtund. # if ($Debug) { print $template; } else { print $file $template; close $file; system("$Vtund $name"); } _ _DATA_ _ options { port $TunnelPort; ifconfig /sbin/ifconfig; route /sbin/route; } default { compress no; speed 0; } # 'mytunnel' should really be `basename $0` or some such # for automagic config selection $TunnelName { type tun; proto tcp; keepalive yes; pass $Secret; up { ifconfig "%% $LocalIP $PTP $RemoteIP arp"; route "add $TunnelHost $GW $GatewayIP"; route "delete default"; route "add default $GW $RemoteIP"; route "add $NET $LocalNetwork $GW $GatewayIP"; }; down { ifconfig "%% down"; route "delete default"; route "delete $TunnelHost $GW $GatewayIP"; route "delete $NET $LocalNetwork"; route "add default $GW $GatewayIP"; }; }

You might be wondering why anyone would go to all of the trouble to make a script to generate a vtund.conf in the first place. Once you get the settings right, you'll never have to change them, right?

Well, usually that is the case. But consider the case of a Linux laptop that uses many different networks in the course of the day (say, a DSL line at home, Ethernet at work, and maybe a wireless connection at the local coffee shop). By running the vtundconf script once at each location, you will have a working configuration instantly, even if your IP and gateway are assigned by DHCP. This makes it easy to get up and running quickly with a live, routable IP address, regardless of the local network topology.