gvpe/src/conf.C

/*
    conf.c -- configuration code
    Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
 
    This file is part of GVPE.

    GVPE is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
 
    You should have received a copy of the GNU General Public License
    along with gvpe; if not, write to the Free Software
    Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
*/

#include "config.h"

#include <cstdio>
#include <cstdlib>
#include <cstring>

#include <errno.h>
#include <netdb.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#include "netcompat.h"

#include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/rsa.h>
#include <openssl/rand.h>
#include <openssl/bn.h>

#include "conf.h"
#include "slog.h"
#include "util.h"

char *confbase;
char *thisnode;
char *identname;

struct configuration conf;

u8 best_protocol (u8 protset)
{
  if (protset & PROT_IPv4  ) return PROT_IPv4;
  if (protset & PROT_ICMPv4) return PROT_ICMPv4;
  if (protset & PROT_UDPv4 ) return PROT_UDPv4;
  if (protset & PROT_TCPv4 ) return PROT_TCPv4;
  if (protset & PROT_DNSv4 ) return PROT_DNSv4;

  return 0;
}

const char *strprotocol (u8 protocol)
{
  if (protocol & PROT_IPv4  ) return "rawip";
  if (protocol & PROT_ICMPv4) return "icmp";
  if (protocol & PROT_UDPv4 ) return "udp";
  if (protocol & PROT_TCPv4 ) return "tcp";
  if (protocol & PROT_DNSv4 ) return "dns";

  return "<unknown>";
}

static bool
match_list (const vector<const char *> &list, const char *str)
{
   for (vector<const char *>::const_iterator i = list.end (); i-- > list.begin (); )
     if ((*i)[0] == '*' && !(*i)[1])
       return true;
     else if (!strcmp (*i, str))
       return true;

   return false;
}

bool
conf_node::can_direct (struct conf_node *other)
{
  if (match_list (allow_direct, other->nodename))
    return true;

  if (match_list (deny_direct, other->nodename))
    return false;

  return true;
}

void
conf_node::print ()
{
  printf ("%4d  fe:fd:80:00:0%1x:%02x  %c  %-8.8s  %-10.10s  %s%s%d\n",
          id,
          id >> 8, id & 0xff,
          compress ? 'Y' : 'N',
          connectmode   == C_ONDEMAND ? "ondemand" :
            connectmode == C_NEVER    ? "never" :
            connectmode == C_ALWAYS   ? "always" : "",
          nodename,
          hostname ? hostname : "",
          hostname ? ":" : "",
          hostname ? udp_port : 0
          );
}

conf_node::~conf_node ()
{
#if 0
  // does not work, because string pointers etc. are shared
  // is not called, however
  if (rsa_key)
    RSA_free (rsa_key);

  free (nodename);
  free (hostname);
  free (if_up_data);
#if ENABLE_DNS
  free (domain);
  free (dns_hostname);
#endif
#endif
}

void configuration::init ()
{
  memset (this, 0, sizeof (*this));

  mtu       = DEFAULT_MTU;
  rekey     = DEFAULT_REKEY;
  keepalive = DEFAULT_KEEPALIVE;
  llevel    = L_INFO;
  ip_proto  = IPPROTO_GRE;
#if ENABLE_ICMP
  icmp_type = ICMP_ECHOREPLY;
#endif

  default_node.udp_port    = DEFAULT_UDPPORT;
  default_node.tcp_port    = DEFAULT_UDPPORT; // ehrm
  default_node.connectmode = conf_node::C_ALWAYS;
  default_node.compress    = true;
  default_node.protocols   = 0;
  default_node.max_retry   = DEFAULT_MAX_RETRY;
  default_node.max_ttl     = DEFAULT_MAX_TTL;
  default_node.max_queue   = DEFAULT_MAX_QUEUE;
  default_node.if_up_data  = strdup ("");

#if ENABLE_DNS
  default_node.dns_port    = 0; // default is 0 == client

  dns_forw_host       = strdup ("127.0.0.1");
  dns_forw_port       = 53;
  dns_timeout_factor  = DEFAULT_DNS_TIMEOUT_FACTOR;
  dns_send_interval   = DEFAULT_DNS_SEND_INTERVAL;
  dns_overlap_factor  = DEFAULT_DNS_OVERLAP_FACTOR;
  dns_max_outstanding = DEFAULT_DNS_MAX_OUTSTANDING;
#endif

  conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
}

void configuration::cleanup()
{
  if (rsa_key)
    RSA_free (rsa_key);

  rsa_key = 0;

  free (pidfilename);   pidfilename   = 0;
  free (ifname);        ifname        = 0;
#if ENABLE_HTTP_PROXY
  free (proxy_host);    proxy_host    = 0;
  free (proxy_auth);    proxy_auth    = 0;
#endif
#if ENABLE_DNS
  free (dns_forw_host); dns_forw_host = 0;
#endif
}

void
configuration::clear ()
{
  for (configuration::node_vector::iterator i = nodes.begin(); i != nodes.end(); ++i)
    delete *i;

  nodes.clear ();

  cleanup ();
  init ();
}

#define parse_bool(target,name,trueval,falseval) do {           \
  if      (!strcmp (val, "yes"))        target = trueval;       \
  else if (!strcmp (val, "no"))         target = falseval;      \
  else if (!strcmp (val, "true"))       target = trueval;       \
  else if (!strcmp (val, "false"))      target = falseval;      \
  else if (!strcmp (val, "on"))         target = trueval;       \
  else if (!strcmp (val, "off"))        target = falseval;      \
  else                                                          \
    return _("illegal boolean value, only 'yes|true|on' or 'no|false|off' allowed. (ignored)"); \
} while (0)

const char *
configuration_parser::parse_line (char *line)
{
  {
    char *end = line + strlen (line);

    while (*end < ' ' && end >= line)
      end--;

    *++end = 0;
  }

  char *tok = line;
  const char *var = strtok (tok, "\t =");
  tok = 0;

  if (!var || !var[0])
    return 0;           /* no tokens on this line */

  if (var[0] == '#')
    return 0;           /* comment: ignore */

  char *val = strtok (NULL, "\t\n\r =");

  if (!val || val[0] == '#')
    return _("no value given for variable. (ignored)");

  if (!strcmp (var, "on"))
    {
      if (!::thisnode
          || (val[0] == '!' && strcmp (val + 1, ::thisnode))
          || !strcmp (val, ::thisnode))
        return parse_line (strtok (NULL, "\n\r"));
      else
        return 0;
    }

  // truly global
  if (!strcmp (var, "loglevel"))
    {
      loglevel l = string_to_loglevel (val);

      if (l == L_NONE)
        return _("unknown loglevel. (skipping)");
    }
  else if (!strcmp (var, "ip-proto"))
    conf.ip_proto = atoi (val);
  else if (!strcmp (var, "icmp-type"))
    {
#if ENABLE_ICMP
      conf.icmp_type = atoi (val);
#endif
    }

  // per config
  else if (!strcmp (var, "node"))
    {
      parse_argv ();

      conf.default_node.id++;
      node = new conf_node (conf.default_node);
      conf.nodes.push_back (node);
      node->nodename = strdup (val);

      {
        char *fname;
        FILE *f;

        asprintf (&fname, "%s/pubkey/%s", confbase, node->nodename);

        f = fopen (fname, "r");
        if (f)
          {
            node->rsa_key = RSA_new ();

            if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
              {
                ERR_load_RSA_strings (); ERR_load_PEM_strings ();
                slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
                exit (EXIT_FAILURE);
              }

            require (RSA_blinding_on (node->rsa_key, 0));

            fclose (f);
          }
        else
          {
            slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));

            if (need_keys)
              exit (EXIT_FAILURE);
          }

        free (fname);
      }

      if (::thisnode && !strcmp (node->nodename, ::thisnode))
        conf.thisnode = node;
    }
  else if (!strcmp (var, "private-key"))
    free (conf.prikeyfile), conf.prikeyfile = strdup (val);
  else if (!strcmp (var, "ifpersist"))
    parse_bool (conf.ifpersist, "ifpersist", true, false);
  else if (!strcmp (var, "ifname"))
    free (conf.ifname), conf.ifname = strdup (val);
  else if (!strcmp (var, "rekey"))
    conf.rekey = atoi (val);
  else if (!strcmp (var, "keepalive"))
    conf.keepalive = atoi (val);
  else if (!strcmp (var, "mtu"))
    conf.mtu = atoi (val);
  else if (!strcmp (var, "if-up"))
    free (conf.script_if_up), conf.script_if_up = strdup (val);
  else if (!strcmp (var, "node-up"))
    free (conf.script_node_up), conf.script_node_up = strdup (val);
  else if (!strcmp (var, "node-down"))
    free (conf.script_node_down), conf.script_node_down = strdup (val);
  else if (!strcmp (var, "pid-file"))
    free (conf.pidfilename), conf.pidfilename = strdup (val);
  else if (!strcmp (var, "dns-forw-host"))
    {
#if ENABLE_DNS
      free (conf.dns_forw_host), conf.dns_forw_host = strdup (val);
#endif
    }
  else if (!strcmp (var, "dns-forw-port"))
    {
#if ENABLE_DNS
      conf.dns_forw_port = atoi (val);
#endif
    }
  else if (!strcmp (var, "dns-timeout-factor"))
    {
#if ENABLE_DNS
      conf.dns_timeout_factor = atof (val);
#endif
    }
  else if (!strcmp (var, "dns-send-interval"))
    {
#if ENABLE_DNS
      conf.dns_send_interval = atoi (val);
#endif
    }
  else if (!strcmp (var, "dns-overlap-factor"))
    {
#if ENABLE_DNS
      conf.dns_overlap_factor = atof (val);
#endif
    }
  else if (!strcmp (var, "dns-max-outstanding"))
    {
#if ENABLE_DNS
      conf.dns_max_outstanding = atoi (val);
#endif
    }
  else if (!strcmp (var, "http-proxy-host"))
    {
#if ENABLE_HTTP_PROXY
      free (conf.proxy_host), conf.proxy_host = strdup (val);
#endif
    }
  else if (!strcmp (var, "http-proxy-port"))
    {
#if ENABLE_HTTP_PROXY
      conf.proxy_port = atoi (val);
#endif
    }
  else if (!strcmp (var, "http-proxy-auth"))
    {
#if ENABLE_HTTP_PROXY
      conf.proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val));
#endif
    }

  /* node-specific, non-defaultable */
  else if (node != &conf.default_node && !strcmp (var, "hostname"))
    free (node->hostname), node->hostname = strdup (val);

  /* node-specific, defaultable */
  else if (!strcmp (var, "udp-port"))
    node->udp_port = atoi (val);
  else if (!strcmp (var, "tcp-port"))
    node->tcp_port = atoi (val);
  else if (!strcmp (var, "dns-hostname"))
    {
#if ENABLE_DNS
      free (node->dns_hostname), node->dns_hostname = strdup (val);
#endif
    }
  else if (!strcmp (var, "dns-port"))
    {
#if ENABLE_DNS
      node->dns_port = atoi (val);
#endif
    }
  else if (!strcmp (var, "dns-domain"))
    {
#if ENABLE_DNS
      free (node->domain), node->domain = strdup (val);
#endif
    }
  else if (!strcmp (var, "if-up-data"))
    free (node->if_up_data), node->if_up_data = strdup (val);
  else if (!strcmp (var, "router-priority"))
    node->routerprio = atoi (val);
  else if (!strcmp (var, "max-retry"))
    node->max_retry = atoi (val);
  else if (!strcmp (var, "connect"))
    {
      if (!strcmp (val, "ondemand"))
        node->connectmode = conf_node::C_ONDEMAND;
      else if (!strcmp (val, "never"))
        node->connectmode = conf_node::C_NEVER;
      else if (!strcmp (val, "always"))
        node->connectmode = conf_node::C_ALWAYS;
      else if (!strcmp (val, "disabled"))
        node->connectmode = conf_node::C_DISABLED;
      else
        return _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled'. (ignored)");
    }
  else if (!strcmp (var, "inherit-tos"))
    parse_bool (node->inherit_tos, "inherit-tos", true, false);
  else if (!strcmp (var, "compress"))
    parse_bool (node->compress, "compress", true, false);
  // all these bool options really really cost a lot of executable size!
  else if (!strcmp (var, "enable-tcp"))
    {
#if ENABLE_TCP
      u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v;
#endif
    }
  else if (!strcmp (var, "enable-icmp"))
    {
#if ENABLE_ICMP
      u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v;
#endif
    }
  else if (!strcmp (var, "enable-dns"))
    {
#if ENABLE_DNS
      u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) | v;
#endif
    }
  else if (!strcmp (var, "enable-udp"))
    {
      u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
    }
  else if (!strcmp (var, "enable-rawip"))
    {
      u8 v; parse_bool (v, "enable-rawip", PROT_IPv4, 0); node->protocols = (node->protocols & ~PROT_IPv4 ) | v;
    }
  else if (!strcmp (var, "allow-direct"))
    node->allow_direct.push_back (strdup (val));
  else if (!strcmp (var, "deny-direct"))
    node->deny_direct.push_back (strdup (val));
  else if (!strcmp (var, "max-ttl"))
    node->max_ttl = atof (val);
  else if (!strcmp (var, "max-queue"))
    node->max_queue = atoi (val);

  // unknown or misplaced
  else
    return _("unknown configuration directive. (ignored)");

  return 0;
}

void configuration_parser::parse_argv ()
{
  for (int i = 0; i < argc; ++i)
    {
      char *v = argv [i];

      if (!*v)
        continue;

      char *enode = v;

      while (*enode != '.' && *enode > ' ' && *enode != '=' && *enode)
        enode++;

      if (*enode != '.')
        enode = 0;

      char *wnode = node == &conf.default_node
                    ? 0
                    : node->nodename;

      if ((!wnode && !enode)
          || (wnode && enode && !strncmp (wnode, v, enode - v)))
        {
          const char *warn = parse_line (enode ? enode + 1 : v);

          if (warn)
            slog (L_WARN, _("%s, while parsing command line option '%s'."), warn, v);

          *v = 0;
        }
    }
}

configuration_parser::configuration_parser (configuration &conf,
                                            bool need_keys,
                                            int argc,
                                            char **argv)
: conf (conf),need_keys (need_keys), argc (argc), argv (argv)
{
  char *fname;
  FILE *f;

  conf.clear ();

  asprintf (&fname, "%s/gvpe.conf", confbase);
  f = fopen (fname, "r");

  if (f)
    {
      char line[16384];
      int lineno = 0;
      node = &conf.default_node;

      while (fgets (line, sizeof (line), f))
        {
          lineno++;

          const char *warn = parse_line (line);

          if (warn)
            slog (L_WARN, _("%s, at '%s', line %d."), warn, fname, lineno);
        }

      fclose (f);

      parse_argv ();
    }
  else
    {
      slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
      exit (EXIT_FAILURE);
    }

  free (fname);

  fname = conf.config_filename (conf.prikeyfile, "hostkey");

  f = fopen (fname, "r");
  if (f)
    {
      conf.rsa_key = RSA_new ();

      if (!PEM_read_RSAPrivateKey (f, &conf.rsa_key, NULL, NULL))
        {
          ERR_load_RSA_strings (); ERR_load_PEM_strings ();
          slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
          exit (EXIT_FAILURE);
        }

      require (RSA_blinding_on (conf.rsa_key, 0));

      fclose (f);
    }
  else
    {
      slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));

      if (need_keys)
        exit (EXIT_FAILURE);
    }

  if (need_keys && ::thisnode
      && conf.rsa_key && conf.thisnode && conf.thisnode->rsa_key)
    if (BN_cmp (conf.rsa_key->n, conf.thisnode->rsa_key->n) != 0
        || BN_cmp (conf.rsa_key->e, conf.thisnode->rsa_key->e) != 0)
      {
        slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
        exit (EXIT_FAILURE);
      }

  free (fname);
}

char *configuration::config_filename (const char *name, const char *dflt)
{
  char *fname;

  asprintf (&fname, name ? name : dflt, ::thisnode);

  if (!ABSOLUTE_PATH (fname))
    {
      char *rname = fname;
      asprintf (&fname, "%s/%s", confbase, rname);
      free (rname);
    }

  return fname;
}

void
configuration::print ()
{
  printf (_("\nConfiguration\n\n"));
  printf (_("# of nodes:         %d\n"), nodes.size ());
  printf (_("this node:          %s\n"), thisnode ? thisnode->nodename : "<unset>");
  printf (_("MTU:                %d\n"), mtu);
  printf (_("rekeying interval:  %d\n"), rekey);
  printf (_("keepalive interval: %d\n"), keepalive);
  printf (_("interface:          %s\n"), ifname);
  printf (_("primary rsa key:    %s\n"), prikeyfile ? prikeyfile : "<default>");
  printf (_("rsa key size:       %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
  printf ("\n");

  printf ("%4s  %-17s %s %-8.8s  %-10.10s  %s\n",
          _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));

  for (node_vector::iterator i = nodes.begin (); i != nodes.end (); ++i)
    (*i)->print ();

  printf ("\n");
}

configuration::configuration ()
{
  asprintf (&confbase, "%s/gvpe", CONFDIR);

  init ();
}

configuration::~configuration ()
{
  cleanup ();
}


Revision:	1.43
Committed:	Thu Aug 7 16:34:21 2008 UTC (15 years, 9 months ago) by pcg
Content type:	text/plain
Branch:	MAIN
Changes since 1.42:	+6 -0 lines
Log Message:	* empty log message *
#	User	Rev	Content
1	pcg	1.1	/*
2			conf.c -- configuration code
3	pcg	1.31	Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4	pcg	1.1
5	pcg	1.31	This file is part of GVPE.
6
7			GVPE is free software; you can redistribute it and/or modify
8	pcg	1.1	it under the terms of the GNU General Public License as published by
9			the Free Software Foundation; either version 2 of the License, or
10			(at your option) any later version.
11
12			This program is distributed in the hope that it will be useful,
13			but WITHOUT ANY WARRANTY; without even the implied warranty of
14			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15			GNU General Public License for more details.
16
17			You should have received a copy of the GNU General Public License
18	pcg	1.31	along with gvpe; if not, write to the Free Software
19	pcg	1.41	Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
20	pcg	1.1	*/
21
22			#include "config.h"
23
24			#include <cstdio>
25			#include <cstdlib>
26			#include <cstring>
27
28			#include <errno.h>
29			#include <netdb.h>
30			#include <sys/stat.h>
31			#include <sys/types.h>
32			#include <unistd.h>
33
34	pcg	1.17	#include "netcompat.h"
35	pcg	1.5
36	pcg	1.1	#include <openssl/err.h>
37			#include <openssl/pem.h>
38			#include <openssl/rsa.h>
39			#include <openssl/rand.h>
40	pcg	1.22	#include <openssl/bn.h>
41	pcg	1.1
42			#include "conf.h"
43			#include "slog.h"
44			#include "util.h"
45
46			char *confbase;
47			char *thisnode;
48			char *identname;
49
50			struct configuration conf;
51
52	pcg	1.7	u8 best_protocol (u8 protset)
53			{
54	pcg	1.13	if (protset & PROT_IPv4 ) return PROT_IPv4;
55			if (protset & PROT_ICMPv4) return PROT_ICMPv4;
56			if (protset & PROT_UDPv4 ) return PROT_UDPv4;
57			if (protset & PROT_TCPv4 ) return PROT_TCPv4;
58	pcg	1.24	if (protset & PROT_DNSv4 ) return PROT_DNSv4;
59	pcg	1.7
60	pcg	1.9	return 0;
61	pcg	1.7	}
62
63			const char *strprotocol (u8 protocol)
64			{
65	pcg	1.13	if (protocol & PROT_IPv4 ) return "rawip";
66			if (protocol & PROT_ICMPv4) return "icmp";
67			if (protocol & PROT_UDPv4 ) return "udp";
68			if (protocol & PROT_TCPv4 ) return "tcp";
69	pcg	1.24	if (protocol & PROT_DNSv4 ) return "dns";
70	pcg	1.7
71			return "<unknown>";
72			}
73
74	pcg	1.42	static bool
75			match_list (const vector<const char > &list, const char str)
76			{
77			for (vector<const char *>::const_iterator i = list.end (); i-- > list.begin (); )
78			if ((i)[0] == '' && !(*i)[1])
79			return true;
80			else if (!strcmp (*i, str))
81			return true;
82
83			return false;
84			}
85
86			bool
87			conf_node::can_direct (struct conf_node *other)
88			{
89			if (match_list (allow_direct, other->nodename))
90			return true;
91
92			if (match_list (deny_direct, other->nodename))
93			return false;
94
95			return true;
96			}
97
98	pcg	1.12	void
99			conf_node::print ()
100	pcg	1.1	{
101	pcg	1.12	printf ("%4d fe:fd:80:00:0%1x:%02x %c %-8.8s %-10.10s %s%s%d\n",
102			id,
103			id >> 8, id & 0xff,
104			compress ? 'Y' : 'N',
105			connectmode == C_ONDEMAND ? "ondemand" :
106			connectmode == C_NEVER ? "never" :
107			connectmode == C_ALWAYS ? "always" : "",
108			nodename,
109			hostname ? hostname : "",
110			hostname ? ":" : "",
111			hostname ? udp_port : 0
112			);
113	pcg	1.1	}
114
115	pcg	1.12	conf_node::~conf_node ()
116	pcg	1.1	{
117	pcg	1.39	#if 0
118			// does not work, because string pointers etc. are shared
119			// is not called, however
120	pcg	1.12	if (rsa_key)
121			RSA_free (rsa_key);
122
123			free (nodename);
124			free (hostname);
125	pcg	1.39	free (if_up_data);
126	pcg	1.30	#if ENABLE_DNS
127	pcg	1.28	free (domain);
128	pcg	1.30	free (dns_hostname);
129			#endif
130	pcg	1.39	#endif
131	pcg	1.1	}
132
133			void configuration::init ()
134			{
135			memset (this, 0, sizeof (*this));
136
137	pcg	1.19	mtu = DEFAULT_MTU;
138	pcg	1.1	rekey = DEFAULT_REKEY;
139			keepalive = DEFAULT_KEEPALIVE;
140	pcg	1.2	llevel = L_INFO;
141	pcg	1.5	ip_proto = IPPROTO_GRE;
142	pcg	1.16	#if ENABLE_ICMP
143	pcg	1.13	icmp_type = ICMP_ECHOREPLY;
144	pcg	1.16	#endif
145	pcg	1.1
146	pcg	1.5	default_node.udp_port = DEFAULT_UDPPORT;
147	pcg	1.24	default_node.tcp_port = DEFAULT_UDPPORT; // ehrm
148	pcg	1.1	default_node.connectmode = conf_node::C_ALWAYS;
149			default_node.compress = true;
150	pcg	1.29	default_node.protocols = 0;
151	pcg	1.27	default_node.max_retry = DEFAULT_MAX_RETRY;
152	pcg	1.43	default_node.max_ttl = DEFAULT_MAX_TTL;
153			default_node.max_queue = DEFAULT_MAX_QUEUE;
154	pcg	1.39	default_node.if_up_data = strdup ("");
155	pcg	1.25
156	pcg	1.30	#if ENABLE_DNS
157	pcg	1.32	default_node.dns_port = 0; // default is 0 == client
158	pcg	1.38
159			dns_forw_host = strdup ("127.0.0.1");
160			dns_forw_port = 53;
161			dns_timeout_factor = DEFAULT_DNS_TIMEOUT_FACTOR;
162			dns_send_interval = DEFAULT_DNS_SEND_INTERVAL;
163			dns_overlap_factor = DEFAULT_DNS_OVERLAP_FACTOR;
164			dns_max_outstanding = DEFAULT_DNS_MAX_OUTSTANDING;
165	pcg	1.30	#endif
166
167	pcg	1.27	conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
168	pcg	1.1	}
169
170			void configuration::cleanup()
171			{
172			if (rsa_key)
173			RSA_free (rsa_key);
174
175	pcg	1.12	rsa_key = 0;
176	pcg	1.1
177	pcg	1.28	free (pidfilename); pidfilename = 0;
178			free (ifname); ifname = 0;
179	pcg	1.12	#if ENABLE_HTTP_PROXY
180	pcg	1.28	free (proxy_host); proxy_host = 0;
181			free (proxy_auth); proxy_auth = 0;
182			#endif
183			#if ENABLE_DNS
184			free (dns_forw_host); dns_forw_host = 0;
185	pcg	1.12	#endif
186	pcg	1.1	}
187
188			void
189	pcg	1.40	configuration::clear ()
190	pcg	1.1	{
191			for (configuration::node_vector::iterator i = nodes.begin(); i != nodes.end(); ++i)
192			delete *i;
193
194			nodes.clear ();
195
196			cleanup ();
197			init ();
198			}
199
200	pcg	1.37	#define parse_bool(target,name,trueval,falseval) do { \
201			if (!strcmp (val, "yes")) target = trueval; \
202	pcg	1.5	else if (!strcmp (val, "no")) target = falseval; \
203			else if (!strcmp (val, "true")) target = trueval; \
204			else if (!strcmp (val, "false")) target = falseval; \
205			else if (!strcmp (val, "on")) target = trueval; \
206			else if (!strcmp (val, "off")) target = falseval; \
207			else \
208	pcg	1.40	return _("illegal boolean value, only 'yes\|true\|on' or 'no\|false\|off' allowed. (ignored)"); \
209	pcg	1.37	} while (0)
210	pcg	1.5
211	pcg	1.40	const char *
212			configuration_parser::parse_line (char *line)
213	pcg	1.1	{
214	pcg	1.40	{
215			char *end = line + strlen (line);
216
217			while (*end < ' ' && end >= line)
218			end--;
219	pcg	1.1
220	pcg	1.40	*++end = 0;
221			}
222	pcg	1.1
223	pcg	1.40	char *tok = line;
224			const char *var = strtok (tok, "\t =");
225			tok = 0;
226	pcg	1.1
227	pcg	1.40	if (!var \|\| !var[0])
228			return 0; /* no tokens on this line */
229	pcg	1.1
230	pcg	1.40	if (var[0] == '#')
231			return 0; /* comment: ignore */
232	pcg	1.1
233	pcg	1.40	char *val = strtok (NULL, "\t\n\r =");
234	pcg	1.1
235	pcg	1.40	if (!val \|\| val[0] == '#')
236			return _("no value given for variable. (ignored)");
237	pcg	1.1
238	pcg	1.40	if (!strcmp (var, "on"))
239			{
240			if (!::thisnode
241			\|\| (val[0] == '!' && strcmp (val + 1, ::thisnode))
242			\|\| !strcmp (val, ::thisnode))
243			return parse_line (strtok (NULL, "\n\r"));
244			else
245			return 0;
246			}
247	pcg	1.1
248	pcg	1.40	// truly global
249			if (!strcmp (var, "loglevel"))
250			{
251			loglevel l = string_to_loglevel (val);
252	pcg	1.1
253	pcg	1.40	if (l == L_NONE)
254			return _("unknown loglevel. (skipping)");
255			}
256			else if (!strcmp (var, "ip-proto"))
257			conf.ip_proto = atoi (val);
258			else if (!strcmp (var, "icmp-type"))
259			{
260	pcg	1.16	#if ENABLE_ICMP
261	pcg	1.40	conf.icmp_type = atoi (val);
262	pcg	1.16	#endif
263	pcg	1.40	}
264	pcg	1.1
265	pcg	1.40	// per config
266			else if (!strcmp (var, "node"))
267			{
268			parse_argv ();
269	pcg	1.1
270	pcg	1.40	conf.default_node.id++;
271			node = new conf_node (conf.default_node);
272			conf.nodes.push_back (node);
273			node->nodename = strdup (val);
274	pcg	1.1
275	pcg	1.40	{
276			char *fname;
277			FILE *f;
278
279			asprintf (&fname, "%s/pubkey/%s", confbase, node->nodename);
280	pcg	1.1
281	pcg	1.40	f = fopen (fname, "r");
282			if (f)
283			{
284			node->rsa_key = RSA_new ();
285	pcg	1.1
286	pcg	1.40	if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
287	pcg	1.1	{
288	pcg	1.40	ERR_load_RSA_strings (); ERR_load_PEM_strings ();
289			slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
290			exit (EXIT_FAILURE);
291			}
292
293			require (RSA_blinding_on (node->rsa_key, 0));
294	pcg	1.1
295	pcg	1.40	fclose (f);
296			}
297			else
298			{
299			slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
300	pcg	1.1
301	pcg	1.40	if (need_keys)
302			exit (EXIT_FAILURE);
303			}
304	pcg	1.1
305	pcg	1.40	free (fname);
306			}
307	pcg	1.1
308	pcg	1.40	if (::thisnode && !strcmp (node->nodename, ::thisnode))
309			conf.thisnode = node;
310			}
311			else if (!strcmp (var, "private-key"))
312			free (conf.prikeyfile), conf.prikeyfile = strdup (val);
313			else if (!strcmp (var, "ifpersist"))
314			parse_bool (conf.ifpersist, "ifpersist", true, false);
315			else if (!strcmp (var, "ifname"))
316			free (conf.ifname), conf.ifname = strdup (val);
317			else if (!strcmp (var, "rekey"))
318			conf.rekey = atoi (val);
319			else if (!strcmp (var, "keepalive"))
320			conf.keepalive = atoi (val);
321			else if (!strcmp (var, "mtu"))
322			conf.mtu = atoi (val);
323			else if (!strcmp (var, "if-up"))
324			free (conf.script_if_up), conf.script_if_up = strdup (val);
325			else if (!strcmp (var, "node-up"))
326			free (conf.script_node_up), conf.script_node_up = strdup (val);
327			else if (!strcmp (var, "node-down"))
328			free (conf.script_node_down), conf.script_node_down = strdup (val);
329			else if (!strcmp (var, "pid-file"))
330			free (conf.pidfilename), conf.pidfilename = strdup (val);
331			else if (!strcmp (var, "dns-forw-host"))
332			{
333	pcg	1.30	#if ENABLE_DNS
334	pcg	1.40	free (conf.dns_forw_host), conf.dns_forw_host = strdup (val);
335	pcg	1.34	#endif
336	pcg	1.40	}
337			else if (!strcmp (var, "dns-forw-port"))
338			{
339	pcg	1.34	#if ENABLE_DNS
340	pcg	1.40	conf.dns_forw_port = atoi (val);
341	pcg	1.28	#endif
342	pcg	1.40	}
343			else if (!strcmp (var, "dns-timeout-factor"))
344			{
345	pcg	1.38	#if ENABLE_DNS
346	pcg	1.40	conf.dns_timeout_factor = atof (val);
347	pcg	1.38	#endif
348	pcg	1.40	}
349			else if (!strcmp (var, "dns-send-interval"))
350			{
351	pcg	1.38	#if ENABLE_DNS
352	pcg	1.40	conf.dns_send_interval = atoi (val);
353	pcg	1.38	#endif
354	pcg	1.40	}
355			else if (!strcmp (var, "dns-overlap-factor"))
356			{
357	pcg	1.38	#if ENABLE_DNS
358	pcg	1.40	conf.dns_overlap_factor = atof (val);
359	pcg	1.38	#endif
360	pcg	1.40	}
361			else if (!strcmp (var, "dns-max-outstanding"))
362			{
363	pcg	1.38	#if ENABLE_DNS
364	pcg	1.40	conf.dns_max_outstanding = atoi (val);
365	pcg	1.38	#endif
366	pcg	1.40	}
367			else if (!strcmp (var, "http-proxy-host"))
368			{
369	pcg	1.12	#if ENABLE_HTTP_PROXY
370	pcg	1.40	free (conf.proxy_host), conf.proxy_host = strdup (val);
371	pcg	1.20	#endif
372	pcg	1.40	}
373			else if (!strcmp (var, "http-proxy-port"))
374			{
375	pcg	1.20	#if ENABLE_HTTP_PROXY
376	pcg	1.40	conf.proxy_port = atoi (val);
377	pcg	1.20	#endif
378	pcg	1.40	}
379			else if (!strcmp (var, "http-proxy-auth"))
380			{
381	pcg	1.20	#if ENABLE_HTTP_PROXY
382	pcg	1.40	conf.proxy_auth = (char )base64_encode ((const u8 )val, strlen (val));
383	pcg	1.12	#endif
384	pcg	1.40	}
385	pcg	1.1
386	pcg	1.40	/* node-specific, non-defaultable */
387			else if (node != &conf.default_node && !strcmp (var, "hostname"))
388			free (node->hostname), node->hostname = strdup (val);
389
390			/* node-specific, defaultable */
391			else if (!strcmp (var, "udp-port"))
392			node->udp_port = atoi (val);
393			else if (!strcmp (var, "tcp-port"))
394			node->tcp_port = atoi (val);
395			else if (!strcmp (var, "dns-hostname"))
396			{
397	pcg	1.30	#if ENABLE_DNS
398	pcg	1.40	free (node->dns_hostname), node->dns_hostname = strdup (val);
399	pcg	1.34	#endif
400	pcg	1.40	}
401			else if (!strcmp (var, "dns-port"))
402			{
403	pcg	1.34	#if ENABLE_DNS
404	pcg	1.40	node->dns_port = atoi (val);
405	pcg	1.34	#endif
406	pcg	1.40	}
407			else if (!strcmp (var, "dns-domain"))
408			{
409	pcg	1.34	#if ENABLE_DNS
410	pcg	1.40	free (node->domain), node->domain = strdup (val);
411	pcg	1.28	#endif
412	pcg	1.40	}
413			else if (!strcmp (var, "if-up-data"))
414			free (node->if_up_data), node->if_up_data = strdup (val);
415			else if (!strcmp (var, "router-priority"))
416			node->routerprio = atoi (val);
417			else if (!strcmp (var, "max-retry"))
418			node->max_retry = atoi (val);
419			else if (!strcmp (var, "connect"))
420			{
421			if (!strcmp (val, "ondemand"))
422			node->connectmode = conf_node::C_ONDEMAND;
423			else if (!strcmp (val, "never"))
424			node->connectmode = conf_node::C_NEVER;
425			else if (!strcmp (val, "always"))
426			node->connectmode = conf_node::C_ALWAYS;
427			else if (!strcmp (val, "disabled"))
428			node->connectmode = conf_node::C_DISABLED;
429			else
430			return _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled'. (ignored)");
431			}
432			else if (!strcmp (var, "inherit-tos"))
433			parse_bool (node->inherit_tos, "inherit-tos", true, false);
434			else if (!strcmp (var, "compress"))
435			parse_bool (node->compress, "compress", true, false);
436			// all these bool options really really cost a lot of executable size!
437			else if (!strcmp (var, "enable-tcp"))
438			{
439	pcg	1.11	#if ENABLE_TCP
440	pcg	1.40	u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) \| v;
441	pcg	1.13	#endif
442	pcg	1.40	}
443			else if (!strcmp (var, "enable-icmp"))
444			{
445	pcg	1.13	#if ENABLE_ICMP
446	pcg	1.40	u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) \| v;
447	pcg	1.11	#endif
448	pcg	1.40	}
449			else if (!strcmp (var, "enable-dns"))
450			{
451	pcg	1.24	#if ENABLE_DNS
452	pcg	1.40	u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) \| v;
453	pcg	1.24	#endif
454	pcg	1.40	}
455			else if (!strcmp (var, "enable-udp"))
456			{
457			u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) \| v;
458			}
459			else if (!strcmp (var, "enable-rawip"))
460			{
461			u8 v; parse_bool (v, "enable-rawip", PROT_IPv4, 0); node->protocols = (node->protocols & ~PROT_IPv4 ) \| v;
462			}
463	pcg	1.42	else if (!strcmp (var, "allow-direct"))
464			node->allow_direct.push_back (strdup (val));
465			else if (!strcmp (var, "deny-direct"))
466			node->deny_direct.push_back (strdup (val));
467	pcg	1.43	else if (!strcmp (var, "max-ttl"))
468			node->max_ttl = atof (val);
469			else if (!strcmp (var, "max-queue"))
470			node->max_queue = atoi (val);
471	pcg	1.40
472			// unknown or misplaced
473			else
474			return _("unknown configuration directive. (ignored)");
475
476			return 0;
477			}
478
479			void configuration_parser::parse_argv ()
480			{
481			for (int i = 0; i < argc; ++i)
482			{
483			char *v = argv [i];
484
485			if (!*v)
486			continue;
487
488			char *enode = v;
489
490			while (enode != '.' && enode > ' ' && enode != '=' && enode)
491			enode++;
492
493			if (*enode != '.')
494			enode = 0;
495
496			char *wnode = node == &conf.default_node
497			? 0
498			: node->nodename;
499
500			if ((!wnode && !enode)
501			\|\| (wnode && enode && !strncmp (wnode, v, enode - v)))
502			{
503			const char *warn = parse_line (enode ? enode + 1 : v);
504
505			if (warn)
506			slog (L_WARN, _("%s, while parsing command line option '%s'."), warn, v);
507
508			*v = 0;
509			}
510			}
511			}
512
513			configuration_parser::configuration_parser (configuration &conf,
514			bool need_keys,
515			int argc,
516			char **argv)
517			: conf (conf),need_keys (need_keys), argc (argc), argv (argv)
518			{
519			char *fname;
520			FILE *f;
521
522			conf.clear ();
523
524			asprintf (&fname, "%s/gvpe.conf", confbase);
525			f = fopen (fname, "r");
526
527			if (f)
528			{
529			char line[16384];
530			int lineno = 0;
531			node = &conf.default_node;
532
533			while (fgets (line, sizeof (line), f))
534			{
535			lineno++;
536
537			const char *warn = parse_line (line);
538
539			if (warn)
540			slog (L_WARN, _("%s, at '%s', line %d."), warn, fname, lineno);
541	pcg	1.1	}
542
543			fclose (f);
544	pcg	1.40
545			parse_argv ();
546	pcg	1.1	}
547			else
548			{
549			slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
550	pcg	1.22	exit (EXIT_FAILURE);
551	pcg	1.1	}
552
553			free (fname);
554
555	pcg	1.40	fname = conf.config_filename (conf.prikeyfile, "hostkey");
556	pcg	1.1
557			f = fopen (fname, "r");
558			if (f)
559			{
560	pcg	1.40	conf.rsa_key = RSA_new ();
561	pcg	1.1
562	pcg	1.40	if (!PEM_read_RSAPrivateKey (f, &conf.rsa_key, NULL, NULL))
563	pcg	1.1	{
564			ERR_load_RSA_strings (); ERR_load_PEM_strings ();
565			slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
566	pcg	1.22	exit (EXIT_FAILURE);
567	pcg	1.1	}
568
569	pcg	1.40	require (RSA_blinding_on (conf.rsa_key, 0));
570	pcg	1.1
571			fclose (f);
572			}
573			else
574			{
575			slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));
576
577			if (need_keys)
578	pcg	1.22	exit (EXIT_FAILURE);
579	pcg	1.1	}
580	pcg	1.22
581	pcg	1.23	if (need_keys && ::thisnode
582	pcg	1.40	&& conf.rsa_key && conf.thisnode && conf.thisnode->rsa_key)
583			if (BN_cmp (conf.rsa_key->n, conf.thisnode->rsa_key->n) != 0
584			\|\| BN_cmp (conf.rsa_key->e, conf.thisnode->rsa_key->e) != 0)
585	pcg	1.22	{
586			slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
587			exit (EXIT_FAILURE);
588			}
589	pcg	1.1
590			free (fname);
591			}
592
593			char configuration::config_filename (const char name, const char *dflt)
594			{
595			char *fname;
596
597			asprintf (&fname, name ? name : dflt, ::thisnode);
598
599			if (!ABSOLUTE_PATH (fname))
600			{
601			char *rname = fname;
602			asprintf (&fname, "%s/%s", confbase, rname);
603			free (rname);
604			}
605
606			return fname;
607			}
608
609			void
610			configuration::print ()
611			{
612			printf (_("\nConfiguration\n\n"));
613			printf (_("# of nodes: %d\n"), nodes.size ());
614			printf (_("this node: %s\n"), thisnode ? thisnode->nodename : "<unset>");
615			printf (_("MTU: %d\n"), mtu);
616			printf (_("rekeying interval: %d\n"), rekey);
617			printf (_("keepalive interval: %d\n"), keepalive);
618			printf (_("interface: %s\n"), ifname);
619			printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>");
620	pcg	1.15	printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
621	pcg	1.1	printf ("\n");
622
623			printf ("%4s %-17s %s %-8.8s %-10.10s %s\n",
624			_("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));
625
626			for (node_vector::iterator i = nodes.begin (); i != nodes.end (); ++i)
627			(*i)->print ();
628
629			printf ("\n");
630			}
631
632	pcg	1.12	configuration::configuration ()
633			{
634	pcg	1.27	asprintf (&confbase, "%s/gvpe", CONFDIR);
635	pcg	1.26
636	pcg	1.12	init ();
637			}
638
639			configuration::~configuration ()
640	pcg	1.1	{
641	pcg	1.12	cleanup ();
642	pcg	1.1	}
643	pcg	1.12
644	pcg	1.1