gvpe/src/conf.C

/*
    conf.c -- configuration code
    Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
 
    This file is part of GVPE.

    GVPE is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with gvpe; if not, write to the Free Software
    Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include "config.h"

#include <cstdio>
#include <cstdlib>
#include <cstring>

#include <errno.h>
#include <netdb.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#include "netcompat.h"

#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/rsa.h>
#include <openssl/rand.h>
#include <openssl/bn.h>

#include "conf.h"
#include "slog.h"
#include "util.h"

char *confbase;
char *thisnode;
char *identname;

struct configuration conf;

u8 best_protocol (u8 protset)
{
  if (protset & PROT_IPv4  ) return PROT_IPv4;
  if (protset & PROT_ICMPv4) return PROT_ICMPv4;
  if (protset & PROT_UDPv4 ) return PROT_UDPv4;
  if (protset & PROT_TCPv4 ) return PROT_TCPv4;
  if (protset & PROT_DNSv4 ) return PROT_DNSv4;

  return 0;
}

const char *strprotocol (u8 protocol)
{
  if (protocol & PROT_IPv4  ) return "rawip";
  if (protocol & PROT_ICMPv4) return "icmp";
  if (protocol & PROT_UDPv4 ) return "udp";
  if (protocol & PROT_TCPv4 ) return "tcp";
  if (protocol & PROT_DNSv4 ) return "dns";

  return "<unknown>";
}

void
conf_node::print ()
{
  printf ("%4d  fe:fd:80:00:0%1x:%02x  %c  %-8.8s  %-10.10s  %s%s%d\n",
          id,
          id >> 8, id & 0xff,
          compress ? 'Y' : 'N',
          connectmode   == C_ONDEMAND ? "ondemand" :
            connectmode == C_NEVER    ? "never" :
            connectmode == C_ALWAYS   ? "always" : "",
          nodename,
          hostname ? hostname : "",
          hostname ? ":" : "",
          hostname ? udp_port : 0
          );
}

conf_node::~conf_node ()
{
  if (rsa_key)
    RSA_free (rsa_key);

  free (nodename);
  free (hostname);
#if ENABLE_DNS
  free (domain);
  free (dns_hostname);
#endif
}

void configuration::init ()
{
  memset (this, 0, sizeof (*this));

  mtu       = DEFAULT_MTU;
  rekey     = DEFAULT_REKEY;
  keepalive = DEFAULT_KEEPALIVE;
  llevel    = L_INFO;
  ip_proto  = IPPROTO_GRE;
#if ENABLE_ICMP
  icmp_type = ICMP_ECHOREPLY;
#endif

  default_node.udp_port    = DEFAULT_UDPPORT;
  default_node.tcp_port    = DEFAULT_UDPPORT; // ehrm
  default_node.connectmode = conf_node::C_ALWAYS;
  default_node.compress    = true;
  default_node.protocols   = 0;
  default_node.max_retry   = DEFAULT_MAX_RETRY;

#if ENABLE_DNS
  default_node.dns_port    = 0; // default is 0 == client

  dns_forw_host       = strdup ("127.0.0.1");
  dns_forw_port       = 53;
  dns_timeout_factor  = DEFAULT_DNS_TIMEOUT_FACTOR;
  dns_send_interval   = DEFAULT_DNS_SEND_INTERVAL;
  dns_overlap_factor  = DEFAULT_DNS_OVERLAP_FACTOR;
  dns_max_outstanding = DEFAULT_DNS_MAX_OUTSTANDING;
#endif

  conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
}

void configuration::cleanup()
{
  if (rsa_key)
    RSA_free (rsa_key);

  rsa_key = 0;

  free (pidfilename);   pidfilename   = 0;
  free (ifname);        ifname        = 0;
#if ENABLE_HTTP_PROXY
  free (proxy_host);    proxy_host    = 0;
  free (proxy_auth);    proxy_auth    = 0;
#endif
#if ENABLE_DNS
  free (dns_forw_host); dns_forw_host = 0;
#endif
}

void
configuration::clear_config ()
{
  for (configuration::node_vector::iterator i = nodes.begin(); i != nodes.end(); ++i)
    delete *i;

  nodes.clear ();

  cleanup ();
  init ();
}

#define parse_bool(target,name,trueval,falseval) do {           \
  if      (!strcmp (val, "yes"))        target = trueval;       \
  else if (!strcmp (val, "no"))         target = falseval;      \
  else if (!strcmp (val, "true"))       target = trueval;       \
  else if (!strcmp (val, "false"))      target = falseval;      \
  else if (!strcmp (val, "on"))         target = trueval;       \
  else if (!strcmp (val, "off"))        target = falseval;      \
  else                                                          \
    slog (L_WARN,                                               \
            _("illegal value for '%s', only 'yes|true|on' or 'no|false|off' allowed, at '%s' line %d"), \
            name, var, fname, lineno);                           \
} while (0)

void configuration::read_config (bool need_keys)
{
  char *fname;
  FILE *f;

  clear_config ();

  asprintf (&fname, "%s/gvpe.conf", confbase);
  f = fopen (fname, "r");

  if (f)
    {
      char line[16384];
      int lineno = 0;
      char *var, *val;
      conf_node *node = &default_node;

      while (fgets (line, sizeof (line), f))
        {
          lineno++;

          {
            char *end = line + strlen (line);

            while (*end < ' ' && end >= line)
              end--;

            *++end = 0;
          }

          char *tok = line;

retry:
          var = strtok (tok, "\t =");
          tok = 0;

          if (!var || !var[0])
            continue;           /* no tokens on this line */

          if (var[0] == '#')
            continue;           /* comment: ignore */

          val = strtok (NULL, "\t\n\r =");

          if (!val || val[0] == '#')
            {
              slog (L_WARN,
                      _("no value for variable `%s', at '%s' line %d, skipping."),
                      var, fname, lineno);
              continue;
            }

          if (!strcmp (var, "on"))
            {
              if (!::thisnode
                  || (val[0] == '!' && strcmp (val + 1, ::thisnode))
                  || !strcmp (val, ::thisnode))
                goto retry;

              continue;
            }

          // truly global
          if (!strcmp (var, "loglevel"))
            {
              loglevel l = string_to_loglevel (val);

              if (l != L_NONE)
                llevel = l;
              else
                slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line);
            }
          else if (!strcmp (var, "ip-proto"))
            ip_proto = atoi (val);
          else if (!strcmp (var, "icmp-type"))
            {
#if ENABLE_ICMP
              icmp_type = atoi (val);
#endif
            }

          // per config
          else if (!strcmp (var, "node"))
            {
              default_node.id++;

              node = new conf_node (default_node);

              nodes.push_back (node);

              node->nodename = strdup (val);

              {
                char *fname;
                FILE *f;

                asprintf (&fname, "%s/pubkey/%s", confbase, node->nodename);

                f = fopen (fname, "r");
                if (f)
                  {
                    node->rsa_key = RSA_new ();

                    if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
                      {
                        ERR_load_RSA_strings (); ERR_load_PEM_strings ();
                        slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
                        exit (EXIT_FAILURE);
                      }

                    require (RSA_blinding_on (node->rsa_key, 0));

                    fclose (f);
                  }
                else
                  {
                    slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));

                    if (need_keys)
                      exit (EXIT_FAILURE);
                  }

                free (fname);
              }

              if (::thisnode && !strcmp (node->nodename, ::thisnode))
                thisnode = node;
            }
          else if (!strcmp (var, "private-key"))
            free (prikeyfile), prikeyfile = strdup (val);
          else if (!strcmp (var, "ifpersist"))
            parse_bool (ifpersist, "ifpersist", true, false);
          else if (!strcmp (var, "ifname"))
            free (ifname), ifname = strdup (val);
          else if (!strcmp (var, "rekey"))
            rekey = atoi (val);
          else if (!strcmp (var, "keepalive"))
            keepalive = atoi (val);
          else if (!strcmp (var, "mtu"))
            mtu = atoi (val);
          else if (!strcmp (var, "if-up"))
            free (script_if_up), script_if_up = strdup (val);
          else if (!strcmp (var, "node-up"))
            free (script_node_up), script_node_up = strdup (val);
          else if (!strcmp (var, "node-down"))
            free (script_node_down), script_node_down = strdup (val);
          else if (!strcmp (var, "pid-file"))
            free (pidfilename), pidfilename = strdup (val);
          else if (!strcmp (var, "dns-forw-host"))
            {
#if ENABLE_DNS
              free (dns_forw_host), dns_forw_host = strdup (val);
#endif
            }
          else if (!strcmp (var, "dns-forw-port"))
            {
#if ENABLE_DNS
              dns_forw_port = atoi (val);
#endif
            }
          else if (!strcmp (var, "dns-timeout-factor"))
            {
#if ENABLE_DNS
              dns_timeout_factor = atof (val);
#endif
            }
          else if (!strcmp (var, "dns-send-interval"))
            {
#if ENABLE_DNS
              dns_send_interval = atoi (val);
#endif
            }
          else if (!strcmp (var, "dns-overlap-factor"))
            {
#if ENABLE_DNS
              dns_overlap_factor = atof (val);
#endif
            }
          else if (!strcmp (var, "dns-max-outstanding"))
            {
#if ENABLE_DNS
              dns_max_outstanding = atoi (val);
#endif
            }
          else if (!strcmp (var, "http-proxy-host"))
            {
#if ENABLE_HTTP_PROXY
              free (proxy_host), proxy_host = strdup (val);
#endif
            }
          else if (!strcmp (var, "http-proxy-port"))
            {
#if ENABLE_HTTP_PROXY
              proxy_port = atoi (val);
#endif
            }
          else if (!strcmp (var, "http-proxy-auth"))
            {
#if ENABLE_HTTP_PROXY
              proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val));
#endif
            }

          /* node-specific, non-defaultable */
          else if (node != &default_node && !strcmp (var, "hostname"))
            free (node->hostname), node->hostname = strdup (val);

          /* node-specific, defaultable */
          else if (!strcmp (var, "udp-port"))
            node->udp_port = atoi (val);
          else if (!strcmp (var, "tcp-port"))
            node->tcp_port = atoi (val);
          else if (!strcmp (var, "dns-hostname"))
            {
#if ENABLE_DNS
              free (node->dns_hostname), node->dns_hostname = strdup (val);
#endif
            }
          else if (!strcmp (var, "dns-port"))
            {
#if ENABLE_DNS
              node->dns_port = atoi (val);
#endif
            }
          else if (!strcmp (var, "dns-domain"))
            {
#if ENABLE_DNS
              free (node->domain), node->domain = strdup (val);
#endif
            }
          else if (!strcmp (var, "router-priority"))
            node->routerprio = atoi (val);
          else if (!strcmp (var, "max-retry"))
            node->max_retry = atoi (val);
          else if (!strcmp (var, "connect"))
            {
              if (!strcmp (val, "ondemand"))
                node->connectmode = conf_node::C_ONDEMAND;
              else if (!strcmp (val, "never"))
                node->connectmode = conf_node::C_NEVER;
              else if (!strcmp (val, "always"))
                node->connectmode = conf_node::C_ALWAYS;
              else if (!strcmp (val, "disabled"))
                node->connectmode = conf_node::C_DISABLED;
              else
                slog (L_WARN,
                      _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d, ignoring."),
                      var, fname, lineno);
            }
          else if (!strcmp (var, "inherit-tos"))
            parse_bool (node->inherit_tos, "inherit-tos", true, false);
          else if (!strcmp (var, "compress"))
            parse_bool (node->compress, "compress", true, false);
          // all these bool options really really cost a lot of executable size!
          else if (!strcmp (var, "enable-tcp"))
            {
#if ENABLE_TCP
              u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v;
#endif
            }
          else if (!strcmp (var, "enable-icmp"))
            {
#if ENABLE_ICMP
              u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v;
#endif
            }
          else if (!strcmp (var, "enable-dns"))
            {
#if ENABLE_DNS
              u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) | v;
#endif
            }
          else if (!strcmp (var, "enable-udp"))
            {
              u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
            }
          else if (!strcmp (var, "enable-rawip"))
            {
              u8 v; parse_bool (v, "enable-rawip", PROT_IPv4, 0); node->protocols = (node->protocols & ~PROT_IPv4 ) | v;
            }

          // unknown or misplaced
          else
            slog (L_WARN,
                    _("unknown or misplaced variable `%s', at '%s' line %d, skipping."),
                    var, fname, lineno);
        }

      fclose (f);
    }
  else
    {
      slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
      exit (EXIT_FAILURE);
    }

  free (fname);

  fname = config_filename (prikeyfile, "hostkey");

  f = fopen (fname, "r");
  if (f)
    {
      rsa_key = RSA_new ();

      if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL))
        {
          ERR_load_RSA_strings (); ERR_load_PEM_strings ();
          slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
          exit (EXIT_FAILURE);
        }

      require (RSA_blinding_on (rsa_key, 0));

      fclose (f);
    }
  else
    {
      slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));

      if (need_keys)
        exit (EXIT_FAILURE);
    }

  if (need_keys && ::thisnode
      && rsa_key && thisnode && thisnode->rsa_key)
    if (BN_cmp (rsa_key->n, thisnode->rsa_key->n) != 0
        || BN_cmp (rsa_key->e, thisnode->rsa_key->e) != 0)
      {
        slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
        exit (EXIT_FAILURE);
      }

  free (fname);
}

char *configuration::config_filename (const char *name, const char *dflt)
{
  char *fname;

  asprintf (&fname, name ? name : dflt, ::thisnode);

  if (!ABSOLUTE_PATH (fname))
    {
      char *rname = fname;
      asprintf (&fname, "%s/%s", confbase, rname);
      free (rname);
    }

  return fname;
}

void
configuration::print ()
{
  printf (_("\nConfiguration\n\n"));
  printf (_("# of nodes:         %d\n"), nodes.size ());
  printf (_("this node:          %s\n"), thisnode ? thisnode->nodename : "<unset>");
  printf (_("MTU:                %d\n"), mtu);
  printf (_("rekeying interval:  %d\n"), rekey);
  printf (_("keepalive interval: %d\n"), keepalive);
  printf (_("interface:          %s\n"), ifname);
  printf (_("primary rsa key:    %s\n"), prikeyfile ? prikeyfile : "<default>");
  printf (_("rsa key size:       %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
  printf ("\n");

  printf ("%4s  %-17s %s %-8.8s  %-10.10s  %s\n",
          _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));

  for (node_vector::iterator i = nodes.begin (); i != nodes.end (); ++i)
    (*i)->print ();

  printf ("\n");
}

configuration::configuration ()
{
  asprintf (&confbase, "%s/gvpe", CONFDIR);

  init ();
}

configuration::~configuration ()
{
  cleanup ();
}


Revision:	1.38
Committed:	Wed Mar 23 17:03:58 2005 UTC (19 years, 2 months ago) by pcg
Content type:	text/plain
Branch:	MAIN
Changes since 1.37:	+31 -2 lines
Log Message:	* empty log message *
#	User	Rev	Content
1	pcg	1.1	/*
2			conf.c -- configuration code
3	pcg	1.31	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4	pcg	1.1
5	pcg	1.31	This file is part of GVPE.
6
7			GVPE is free software; you can redistribute it and/or modify
8	pcg	1.1	it under the terms of the GNU General Public License as published by
9			the Free Software Foundation; either version 2 of the License, or
10			(at your option) any later version.
11
12			This program is distributed in the hope that it will be useful,
13			but WITHOUT ANY WARRANTY; without even the implied warranty of
14			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15			GNU General Public License for more details.
16
17			You should have received a copy of the GNU General Public License
18	pcg	1.31	along with gvpe; if not, write to the Free Software
19	pcg	1.1	Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20			*/
21
22			#include "config.h"
23
24			#include <cstdio>
25			#include <cstdlib>
26			#include <cstring>
27
28			#include <errno.h>
29			#include <netdb.h>
30			#include <sys/stat.h>
31			#include <sys/types.h>
32			#include <unistd.h>
33
34	pcg	1.17	#include "netcompat.h"
35	pcg	1.5
36	pcg	1.1	#include <openssl/err.h>
37			#include <openssl/pem.h>
38			#include <openssl/rsa.h>
39			#include <openssl/rand.h>
40	pcg	1.22	#include <openssl/bn.h>
41	pcg	1.1
42			#include "conf.h"
43			#include "slog.h"
44			#include "util.h"
45
46			char *confbase;
47			char *thisnode;
48			char *identname;
49
50			struct configuration conf;
51
52	pcg	1.7	u8 best_protocol (u8 protset)
53			{
54	pcg	1.13	if (protset & PROT_IPv4 ) return PROT_IPv4;
55			if (protset & PROT_ICMPv4) return PROT_ICMPv4;
56			if (protset & PROT_UDPv4 ) return PROT_UDPv4;
57			if (protset & PROT_TCPv4 ) return PROT_TCPv4;
58	pcg	1.24	if (protset & PROT_DNSv4 ) return PROT_DNSv4;
59	pcg	1.7
60	pcg	1.9	return 0;
61	pcg	1.7	}
62
63			const char *strprotocol (u8 protocol)
64			{
65	pcg	1.13	if (protocol & PROT_IPv4 ) return "rawip";
66			if (protocol & PROT_ICMPv4) return "icmp";
67			if (protocol & PROT_UDPv4 ) return "udp";
68			if (protocol & PROT_TCPv4 ) return "tcp";
69	pcg	1.24	if (protocol & PROT_DNSv4 ) return "dns";
70	pcg	1.7
71			return "<unknown>";
72			}
73
74	pcg	1.12	void
75			conf_node::print ()
76	pcg	1.1	{
77	pcg	1.12	printf ("%4d fe:fd:80:00:0%1x:%02x %c %-8.8s %-10.10s %s%s%d\n",
78			id,
79			id >> 8, id & 0xff,
80			compress ? 'Y' : 'N',
81			connectmode == C_ONDEMAND ? "ondemand" :
82			connectmode == C_NEVER ? "never" :
83			connectmode == C_ALWAYS ? "always" : "",
84			nodename,
85			hostname ? hostname : "",
86			hostname ? ":" : "",
87			hostname ? udp_port : 0
88			);
89	pcg	1.1	}
90
91	pcg	1.12	conf_node::~conf_node ()
92	pcg	1.1	{
93	pcg	1.12	if (rsa_key)
94			RSA_free (rsa_key);
95
96			free (nodename);
97			free (hostname);
98	pcg	1.30	#if ENABLE_DNS
99	pcg	1.28	free (domain);
100	pcg	1.30	free (dns_hostname);
101			#endif
102	pcg	1.1	}
103
104			void configuration::init ()
105			{
106			memset (this, 0, sizeof (*this));
107
108	pcg	1.19	mtu = DEFAULT_MTU;
109	pcg	1.1	rekey = DEFAULT_REKEY;
110			keepalive = DEFAULT_KEEPALIVE;
111	pcg	1.2	llevel = L_INFO;
112	pcg	1.5	ip_proto = IPPROTO_GRE;
113	pcg	1.16	#if ENABLE_ICMP
114	pcg	1.13	icmp_type = ICMP_ECHOREPLY;
115	pcg	1.16	#endif
116	pcg	1.1
117	pcg	1.5	default_node.udp_port = DEFAULT_UDPPORT;
118	pcg	1.24	default_node.tcp_port = DEFAULT_UDPPORT; // ehrm
119	pcg	1.1	default_node.connectmode = conf_node::C_ALWAYS;
120			default_node.compress = true;
121	pcg	1.29	default_node.protocols = 0;
122	pcg	1.27	default_node.max_retry = DEFAULT_MAX_RETRY;
123	pcg	1.25
124	pcg	1.30	#if ENABLE_DNS
125	pcg	1.32	default_node.dns_port = 0; // default is 0 == client
126	pcg	1.38
127			dns_forw_host = strdup ("127.0.0.1");
128			dns_forw_port = 53;
129			dns_timeout_factor = DEFAULT_DNS_TIMEOUT_FACTOR;
130			dns_send_interval = DEFAULT_DNS_SEND_INTERVAL;
131			dns_overlap_factor = DEFAULT_DNS_OVERLAP_FACTOR;
132			dns_max_outstanding = DEFAULT_DNS_MAX_OUTSTANDING;
133	pcg	1.30	#endif
134
135	pcg	1.27	conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
136	pcg	1.1	}
137
138			void configuration::cleanup()
139			{
140			if (rsa_key)
141			RSA_free (rsa_key);
142
143	pcg	1.12	rsa_key = 0;
144	pcg	1.1
145	pcg	1.28	free (pidfilename); pidfilename = 0;
146			free (ifname); ifname = 0;
147	pcg	1.12	#if ENABLE_HTTP_PROXY
148	pcg	1.28	free (proxy_host); proxy_host = 0;
149			free (proxy_auth); proxy_auth = 0;
150			#endif
151			#if ENABLE_DNS
152			free (dns_forw_host); dns_forw_host = 0;
153	pcg	1.12	#endif
154	pcg	1.1	}
155
156			void
157			configuration::clear_config ()
158			{
159			for (configuration::node_vector::iterator i = nodes.begin(); i != nodes.end(); ++i)
160			delete *i;
161
162			nodes.clear ();
163
164			cleanup ();
165			init ();
166			}
167
168	pcg	1.37	#define parse_bool(target,name,trueval,falseval) do { \
169			if (!strcmp (val, "yes")) target = trueval; \
170	pcg	1.5	else if (!strcmp (val, "no")) target = falseval; \
171			else if (!strcmp (val, "true")) target = trueval; \
172			else if (!strcmp (val, "false")) target = falseval; \
173			else if (!strcmp (val, "on")) target = trueval; \
174			else if (!strcmp (val, "off")) target = falseval; \
175			else \
176			slog (L_WARN, \
177			_("illegal value for '%s', only 'yes\|true\|on' or 'no\|false\|off' allowed, at '%s' line %d"), \
178	pcg	1.37	name, var, fname, lineno); \
179			} while (0)
180	pcg	1.5
181	pcg	1.1	void configuration::read_config (bool need_keys)
182			{
183			char *fname;
184			FILE *f;
185
186			clear_config ();
187
188	pcg	1.27	asprintf (&fname, "%s/gvpe.conf", confbase);
189	pcg	1.1	f = fopen (fname, "r");
190
191			if (f)
192			{
193			char line[16384];
194			int lineno = 0;
195			char var, val;
196			conf_node *node = &default_node;
197
198			while (fgets (line, sizeof (line), f))
199			{
200			lineno++;
201
202			{
203			char *end = line + strlen (line);
204
205			while (*end < ' ' && end >= line)
206			end--;
207
208			*++end = 0;
209			}
210
211			char *tok = line;
212
213			retry:
214			var = strtok (tok, "\t =");
215			tok = 0;
216
217			if (!var \|\| !var[0])
218			continue; /* no tokens on this line */
219
220			if (var[0] == '#')
221			continue; /* comment: ignore */
222
223			val = strtok (NULL, "\t\n\r =");
224
225			if (!val \|\| val[0] == '#')
226			{
227			slog (L_WARN,
228	pcg	1.36	_("no value for variable `%s', at '%s' line %d, skipping."),
229	pcg	1.1	var, fname, lineno);
230	pcg	1.36	continue;
231	pcg	1.1	}
232
233			if (!strcmp (var, "on"))
234			{
235			if (!::thisnode
236			\|\| (val[0] == '!' && strcmp (val + 1, ::thisnode))
237			\|\| !strcmp (val, ::thisnode))
238			goto retry;
239
240			continue;
241			}
242
243			// truly global
244			if (!strcmp (var, "loglevel"))
245			{
246			loglevel l = string_to_loglevel (val);
247
248			if (l != L_NONE)
249	pcg	1.2	llevel = l;
250	pcg	1.1	else
251			slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line);
252			}
253	pcg	1.5	else if (!strcmp (var, "ip-proto"))
254			ip_proto = atoi (val);
255	pcg	1.20	else if (!strcmp (var, "icmp-type"))
256			{
257	pcg	1.16	#if ENABLE_ICMP
258	pcg	1.20	icmp_type = atoi (val);
259	pcg	1.16	#endif
260	pcg	1.20	}
261	pcg	1.1
262			// per config
263			else if (!strcmp (var, "node"))
264			{
265			default_node.id++;
266
267			node = new conf_node (default_node);
268
269			nodes.push_back (node);
270
271			node->nodename = strdup (val);
272
273			{
274			char *fname;
275			FILE *f;
276
277			asprintf (&fname, "%s/pubkey/%s", confbase, node->nodename);
278
279			f = fopen (fname, "r");
280			if (f)
281			{
282			node->rsa_key = RSA_new ();
283
284			if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
285			{
286			ERR_load_RSA_strings (); ERR_load_PEM_strings ();
287			slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
288	pcg	1.22	exit (EXIT_FAILURE);
289	pcg	1.1	}
290
291	pcg	1.22	require (RSA_blinding_on (node->rsa_key, 0));
292	pcg	1.1
293			fclose (f);
294			}
295			else
296			{
297			slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
298
299			if (need_keys)
300	pcg	1.22	exit (EXIT_FAILURE);
301	pcg	1.1	}
302
303			free (fname);
304			}
305
306	pcg	1.23	if (::thisnode && !strcmp (node->nodename, ::thisnode))
307	pcg	1.1	thisnode = node;
308			}
309			else if (!strcmp (var, "private-key"))
310	pcg	1.24	free (prikeyfile), prikeyfile = strdup (val);
311	pcg	1.1	else if (!strcmp (var, "ifpersist"))
312	pcg	1.36	parse_bool (ifpersist, "ifpersist", true, false);
313	pcg	1.1	else if (!strcmp (var, "ifname"))
314	pcg	1.24	free (ifname), ifname = strdup (val);
315	pcg	1.1	else if (!strcmp (var, "rekey"))
316			rekey = atoi (val);
317			else if (!strcmp (var, "keepalive"))
318			keepalive = atoi (val);
319			else if (!strcmp (var, "mtu"))
320			mtu = atoi (val);
321			else if (!strcmp (var, "if-up"))
322	pcg	1.24	free (script_if_up), script_if_up = strdup (val);
323	pcg	1.1	else if (!strcmp (var, "node-up"))
324	pcg	1.24	free (script_node_up), script_node_up = strdup (val);
325	pcg	1.1	else if (!strcmp (var, "node-down"))
326	pcg	1.24	free (script_node_down), script_node_down = strdup (val);
327			else if (!strcmp (var, "pid-file"))
328			free (pidfilename), pidfilename = strdup (val);
329	pcg	1.34	else if (!strcmp (var, "dns-forw-host"))
330			{
331	pcg	1.30	#if ENABLE_DNS
332	pcg	1.34	free (dns_forw_host), dns_forw_host = strdup (val);
333			#endif
334			}
335	pcg	1.29	else if (!strcmp (var, "dns-forw-port"))
336	pcg	1.34	{
337			#if ENABLE_DNS
338			dns_forw_port = atoi (val);
339	pcg	1.28	#endif
340	pcg	1.34	}
341	pcg	1.38	else if (!strcmp (var, "dns-timeout-factor"))
342			{
343			#if ENABLE_DNS
344			dns_timeout_factor = atof (val);
345			#endif
346			}
347			else if (!strcmp (var, "dns-send-interval"))
348			{
349			#if ENABLE_DNS
350			dns_send_interval = atoi (val);
351			#endif
352			}
353			else if (!strcmp (var, "dns-overlap-factor"))
354			{
355			#if ENABLE_DNS
356			dns_overlap_factor = atof (val);
357			#endif
358			}
359			else if (!strcmp (var, "dns-max-outstanding"))
360			{
361			#if ENABLE_DNS
362			dns_max_outstanding = atoi (val);
363			#endif
364			}
365	pcg	1.20	else if (!strcmp (var, "http-proxy-host"))
366			{
367	pcg	1.12	#if ENABLE_HTTP_PROXY
368	pcg	1.24	free (proxy_host), proxy_host = strdup (val);
369	pcg	1.20	#endif
370			}
371	pcg	1.12	else if (!strcmp (var, "http-proxy-port"))
372	pcg	1.20	{
373			#if ENABLE_HTTP_PROXY
374			proxy_port = atoi (val);
375			#endif
376			}
377	pcg	1.12	else if (!strcmp (var, "http-proxy-auth"))
378	pcg	1.20	{
379			#if ENABLE_HTTP_PROXY
380			proxy_auth = (char )base64_encode ((const u8 )val, strlen (val));
381	pcg	1.12	#endif
382	pcg	1.20	}
383	pcg	1.1
384			/* node-specific, non-defaultable */
385			else if (node != &default_node && !strcmp (var, "hostname"))
386	pcg	1.24	free (node->hostname), node->hostname = strdup (val);
387	pcg	1.1
388			/* node-specific, defaultable */
389	pcg	1.4	else if (!strcmp (var, "udp-port"))
390	pcg	1.5	node->udp_port = atoi (val);
391	pcg	1.8	else if (!strcmp (var, "tcp-port"))
392			node->tcp_port = atoi (val);
393	pcg	1.34	else if (!strcmp (var, "dns-hostname"))
394			{
395	pcg	1.30	#if ENABLE_DNS
396	pcg	1.34	free (node->dns_hostname), node->dns_hostname = strdup (val);
397			#endif
398			}
399	pcg	1.24	else if (!strcmp (var, "dns-port"))
400	pcg	1.34	{
401			#if ENABLE_DNS
402			node->dns_port = atoi (val);
403			#endif
404			}
405	pcg	1.28	else if (!strcmp (var, "dns-domain"))
406	pcg	1.34	{
407			#if ENABLE_DNS
408			free (node->domain), node->domain = strdup (val);
409	pcg	1.28	#endif
410	pcg	1.34	}
411	pcg	1.1	else if (!strcmp (var, "router-priority"))
412			node->routerprio = atoi (val);
413	pcg	1.27	else if (!strcmp (var, "max-retry"))
414			node->max_retry = atoi (val);
415	pcg	1.1	else if (!strcmp (var, "connect"))
416			{
417			if (!strcmp (val, "ondemand"))
418			node->connectmode = conf_node::C_ONDEMAND;
419			else if (!strcmp (val, "never"))
420			node->connectmode = conf_node::C_NEVER;
421			else if (!strcmp (val, "always"))
422			node->connectmode = conf_node::C_ALWAYS;
423	pcg	1.4	else if (!strcmp (val, "disabled"))
424			node->connectmode = conf_node::C_DISABLED;
425	pcg	1.1	else
426			slog (L_WARN,
427	pcg	1.36	_("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d, ignoring."),
428	pcg	1.27	var, fname, lineno);
429	pcg	1.1	}
430	pcg	1.3	else if (!strcmp (var, "inherit-tos"))
431	pcg	1.36	parse_bool (node->inherit_tos, "inherit-tos", true, false);
432	pcg	1.1	else if (!strcmp (var, "compress"))
433	pcg	1.36	parse_bool (node->compress, "compress", true, false);
434	pcg	1.5	// all these bool options really really cost a lot of executable size!
435	pcg	1.8	else if (!strcmp (var, "enable-tcp"))
436			{
437	pcg	1.11	#if ENABLE_TCP
438	pcg	1.8	u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) \| v;
439	pcg	1.13	#endif
440			}
441			else if (!strcmp (var, "enable-icmp"))
442			{
443			#if ENABLE_ICMP
444			u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) \| v;
445	pcg	1.11	#endif
446	pcg	1.8	}
447	pcg	1.24	else if (!strcmp (var, "enable-dns"))
448			{
449			#if ENABLE_DNS
450			u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) \| v;
451			#endif
452			}
453	pcg	1.6	else if (!strcmp (var, "enable-udp"))
454	pcg	1.5	{
455	pcg	1.6	u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) \| v;
456	pcg	1.5	}
457	pcg	1.6	else if (!strcmp (var, "enable-rawip"))
458	pcg	1.28	{
459	pcg	1.6	u8 v; parse_bool (v, "enable-rawip", PROT_IPv4, 0); node->protocols = (node->protocols & ~PROT_IPv4 ) \| v;
460	pcg	1.1	}
461
462			// unknown or misplaced
463			else
464	pcg	1.12	slog (L_WARN,
465	pcg	1.36	_("unknown or misplaced variable `%s', at '%s' line %d, skipping."),
466	pcg	1.12	var, fname, lineno);
467	pcg	1.1	}
468
469			fclose (f);
470			}
471			else
472			{
473			slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
474	pcg	1.22	exit (EXIT_FAILURE);
475	pcg	1.1	}
476
477			free (fname);
478
479			fname = config_filename (prikeyfile, "hostkey");
480
481			f = fopen (fname, "r");
482			if (f)
483			{
484			rsa_key = RSA_new ();
485
486			if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL))
487			{
488			ERR_load_RSA_strings (); ERR_load_PEM_strings ();
489			slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
490	pcg	1.22	exit (EXIT_FAILURE);
491	pcg	1.1	}
492
493	pcg	1.22	require (RSA_blinding_on (rsa_key, 0));
494	pcg	1.1
495			fclose (f);
496			}
497			else
498			{
499			slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));
500
501			if (need_keys)
502	pcg	1.22	exit (EXIT_FAILURE);
503	pcg	1.1	}
504	pcg	1.22
505	pcg	1.23	if (need_keys && ::thisnode
506			&& rsa_key && thisnode && thisnode->rsa_key)
507	pcg	1.22	if (BN_cmp (rsa_key->n, thisnode->rsa_key->n) != 0
508			\|\| BN_cmp (rsa_key->e, thisnode->rsa_key->e) != 0)
509			{
510			slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
511			exit (EXIT_FAILURE);
512			}
513	pcg	1.1
514			free (fname);
515			}
516
517			char configuration::config_filename (const char name, const char *dflt)
518			{
519			char *fname;
520
521			asprintf (&fname, name ? name : dflt, ::thisnode);
522
523			if (!ABSOLUTE_PATH (fname))
524			{
525			char *rname = fname;
526			asprintf (&fname, "%s/%s", confbase, rname);
527			free (rname);
528			}
529
530			return fname;
531			}
532
533			void
534			configuration::print ()
535			{
536			printf (_("\nConfiguration\n\n"));
537			printf (_("# of nodes: %d\n"), nodes.size ());
538			printf (_("this node: %s\n"), thisnode ? thisnode->nodename : "<unset>");
539			printf (_("MTU: %d\n"), mtu);
540			printf (_("rekeying interval: %d\n"), rekey);
541			printf (_("keepalive interval: %d\n"), keepalive);
542			printf (_("interface: %s\n"), ifname);
543			printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>");
544	pcg	1.15	printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
545	pcg	1.1	printf ("\n");
546
547			printf ("%4s %-17s %s %-8.8s %-10.10s %s\n",
548			_("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));
549
550			for (node_vector::iterator i = nodes.begin (); i != nodes.end (); ++i)
551			(*i)->print ();
552
553			printf ("\n");
554			}
555
556	pcg	1.12	configuration::configuration ()
557			{
558	pcg	1.27	asprintf (&confbase, "%s/gvpe", CONFDIR);
559	pcg	1.26
560	pcg	1.12	init ();
561			}
562
563			configuration::~configuration ()
564	pcg	1.1	{
565	pcg	1.12	cleanup ();
566	pcg	1.1	}
567	pcg	1.12
568	pcg	1.1