ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/conf.C
(Generate patch)

Comparing gvpe/src/conf.C (file contents):
Revision 1.12 by pcg, Mon Apr 7 01:12:56 2003 UTC vs.
Revision 1.33 by pcg, Sun Mar 6 18:34:46 2005 UTC

1/* 1/*
2 conf.c -- configuration code 2 conf.c -- configuration code
3 Copyright (C) 1998 Robert van der Meulen 3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4 1998-2002 Ivo Timmermans <ivo@o2w.nl>
5 2000-2002 Guus Sliepen <guus@sliepen.eu.org>
6 2000 Cris van Pelt <tribbel@arise.dhs.org>
7 2003 Marc Lehmann <pcg@goof.com>
8 4
5 This file is part of GVPE.
6
9 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by 8 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or 9 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version. 10 (at your option) any later version.
13 11
14 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details. 15 GNU General Public License for more details.
18 16
19 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software 18 along with gvpe; if not, write to the Free Software
21 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22*/ 20*/
23 21
24#include "config.h" 22#include "config.h"
25 23
… …
31#include <netdb.h> 29#include <netdb.h>
32#include <sys/stat.h> 30#include <sys/stat.h>
33#include <sys/types.h> 31#include <sys/types.h>
34#include <unistd.h> 32#include <unistd.h>
35 33
36#include <netinet/in.h> 34#include "netcompat.h"
37 35
38#include <openssl/err.h> 36#include <openssl/err.h>
39#include <openssl/pem.h> 37#include <openssl/pem.h>
40#include <openssl/rsa.h> 38#include <openssl/rsa.h>
41#include <openssl/rand.h> 39#include <openssl/rand.h>
40#include <openssl/bn.h>
42 41
43#include "gettext.h" 42#include "gettext.h"
44 43
45#include "conf.h" 44#include "conf.h"
46#include "slog.h" 45#include "slog.h"
47#include "util.h" 46#include "util.h"
48 47
49char *confbase; 48char *confbase;
50char *thisnode; 49char *thisnode;
51char *identname; 50char *identname;
52char *pidfilename;
53 51
54struct configuration conf; 52struct configuration conf;
55 53
56u8 best_protocol (u8 protset) 54u8 best_protocol (u8 protset)
57{ 55{
58 if (protset & PROT_IPv4 ) return PROT_IPv4; 56 if (protset & PROT_IPv4 ) return PROT_IPv4;
57 if (protset & PROT_ICMPv4) return PROT_ICMPv4;
59 if (protset & PROT_UDPv4) return PROT_UDPv4; 58 if (protset & PROT_UDPv4 ) return PROT_UDPv4;
60 if (protset & PROT_TCPv4) return PROT_TCPv4; 59 if (protset & PROT_TCPv4 ) return PROT_TCPv4;
60 if (protset & PROT_DNSv4 ) return PROT_DNSv4;
61 61
62 return 0; 62 return 0;
63} 63}
64 64
65const char *strprotocol (u8 protocol) 65const char *strprotocol (u8 protocol)
66{ 66{
67 if (protocol & PROT_IPv4 ) return "rawip"; 67 if (protocol & PROT_IPv4 ) return "rawip";
68 if (protocol & PROT_ICMPv4) return "icmp";
68 if (protocol & PROT_UDPv4) return "udp"; 69 if (protocol & PROT_UDPv4 ) return "udp";
69 if (protocol & PROT_TCPv4) return "tcp"; 70 if (protocol & PROT_TCPv4 ) return "tcp";
71 if (protocol & PROT_DNSv4 ) return "dns";
70 72
71 return "<unknown>"; 73 return "<unknown>";
72} 74}
73 75
74void 76void
… …
93 if (rsa_key) 95 if (rsa_key)
94 RSA_free (rsa_key); 96 RSA_free (rsa_key);
95 97
96 free (nodename); 98 free (nodename);
97 free (hostname); 99 free (hostname);
100#if ENABLE_DNS
101 free (domain);
102 free (dns_hostname);
103#endif
98} 104}
99 105
100void configuration::init () 106void configuration::init ()
101{ 107{
102 memset (this, 0, sizeof (*this)); 108 memset (this, 0, sizeof (*this));
103 109
110 mtu = DEFAULT_MTU;
104 rekey = DEFAULT_REKEY; 111 rekey = DEFAULT_REKEY;
105 keepalive = DEFAULT_KEEPALIVE; 112 keepalive = DEFAULT_KEEPALIVE;
106 llevel = L_INFO; 113 llevel = L_INFO;
107 ip_proto = IPPROTO_GRE; 114 ip_proto = IPPROTO_GRE;
115#if ENABLE_ICMP
116 icmp_type = ICMP_ECHOREPLY;
117#endif
108 118
109 default_node.udp_port = DEFAULT_UDPPORT; 119 default_node.udp_port = DEFAULT_UDPPORT;
110 default_node.tcp_port = DEFAULT_UDPPORT; 120 default_node.tcp_port = DEFAULT_UDPPORT; // ehrm
111 default_node.connectmode = conf_node::C_ALWAYS; 121 default_node.connectmode = conf_node::C_ALWAYS;
112 default_node.compress = true; 122 default_node.compress = true;
113 default_node.protocols = PROT_UDPv4; 123 default_node.protocols = 0;
124 default_node.max_retry = DEFAULT_MAX_RETRY;
125
126#if ENABLE_DNS
127 default_node.dns_port = 0; // default is 0 == client
128 dns_forw_host = strdup ("127.0.0.1");
129 dns_forw_port = 53;
130#endif
131
132 conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
114} 133}
115 134
116void configuration::cleanup() 135void configuration::cleanup()
117{ 136{
118 if (rsa_key) 137 if (rsa_key)
119 RSA_free (rsa_key); 138 RSA_free (rsa_key);
120 139
121 rsa_key = 0; 140 rsa_key = 0;
122 141
142 free (pidfilename); pidfilename = 0;
123 free (ifname); ifname = 0; 143 free (ifname); ifname = 0;
124#if ENABLE_HTTP_PROXY 144#if ENABLE_HTTP_PROXY
125 free (proxy_host); proxy_host = 0; 145 free (proxy_host); proxy_host = 0;
126 free (proxy_auth); proxy_auth = 0; 146 free (proxy_auth); proxy_auth = 0;
147#endif
148#if ENABLE_DNS
149 free (dns_forw_host); dns_forw_host = 0;
127#endif 150#endif
128} 151}
129 152
130void 153void
131configuration::clear_config () 154configuration::clear_config ()
… …
156 char *fname; 179 char *fname;
157 FILE *f; 180 FILE *f;
158 181
159 clear_config (); 182 clear_config ();
160 183
161 asprintf (&fname, "%s/vped.conf", confbase); 184 asprintf (&fname, "%s/gvpe.conf", confbase);
162 f = fopen (fname, "r"); 185 f = fopen (fname, "r");
163 186
164 if (f) 187 if (f)
165 { 188 {
166 char line[16384]; 189 char line[16384];
… …
223 else 246 else
224 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line); 247 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line);
225 } 248 }
226 else if (!strcmp (var, "ip-proto")) 249 else if (!strcmp (var, "ip-proto"))
227 ip_proto = atoi (val); 250 ip_proto = atoi (val);
251 else if (!strcmp (var, "icmp-type"))
252 {
253#if ENABLE_ICMP
254 icmp_type = atoi (val);
255#endif
256 }
228 257
229 // per config 258 // per config
230 else if (!strcmp (var, "node")) 259 else if (!strcmp (var, "node"))
231 { 260 {
232 default_node.id++; 261 default_node.id++;
… …
250 279
251 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL)) 280 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
252 { 281 {
253 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 282 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
254 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 283 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
255 exit (1); 284 exit (EXIT_FAILURE);
256 } 285 }
257 286
258 RSA_blinding_on (node->rsa_key, 0); 287 require (RSA_blinding_on (node->rsa_key, 0));
259 288
260 fclose (f); 289 fclose (f);
261 } 290 }
262 else 291 else
263 { 292 {
264 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno)); 293 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
265 294
266 if (need_keys) 295 if (need_keys)
267 exit (1); 296 exit (EXIT_FAILURE);
268 } 297 }
269 298
270 free (fname); 299 free (fname);
271 } 300 }
272 301
273 if (!::thisnode || !strcmp (node->nodename, ::thisnode)) 302 if (::thisnode && !strcmp (node->nodename, ::thisnode))
274 thisnode = node; 303 thisnode = node;
275 } 304 }
276 else if (!strcmp (var, "private-key")) 305 else if (!strcmp (var, "private-key"))
277 prikeyfile = strdup (val); 306 free (prikeyfile), prikeyfile = strdup (val);
278 else if (!strcmp (var, "ifpersist")) 307 else if (!strcmp (var, "ifpersist"))
279 { 308 {
280 parse_bool (ifpersist, "ifpersist", true, false); 309 parse_bool (ifpersist, "ifpersist", true, false);
281 } 310 }
282 else if (!strcmp (var, "ifname")) 311 else if (!strcmp (var, "ifname"))
283 ifname = strdup (val); 312 free (ifname), ifname = strdup (val);
284 else if (!strcmp (var, "rekey")) 313 else if (!strcmp (var, "rekey"))
285 rekey = atoi (val); 314 rekey = atoi (val);
286 else if (!strcmp (var, "keepalive")) 315 else if (!strcmp (var, "keepalive"))
287 keepalive = atoi (val); 316 keepalive = atoi (val);
288 else if (!strcmp (var, "mtu")) 317 else if (!strcmp (var, "mtu"))
289 mtu = atoi (val); 318 mtu = atoi (val);
290 else if (!strcmp (var, "if-up")) 319 else if (!strcmp (var, "if-up"))
291 script_if_up = strdup (val); 320 free (script_if_up), script_if_up = strdup (val);
292 else if (!strcmp (var, "node-up")) 321 else if (!strcmp (var, "node-up"))
293 script_node_up = strdup (val); 322 free (script_node_up), script_node_up = strdup (val);
294 else if (!strcmp (var, "node-down")) 323 else if (!strcmp (var, "node-down"))
295 script_node_down = strdup (val); 324 free (script_node_down), script_node_down = strdup (val);
325 else if (!strcmp (var, "pid-file"))
326 free (pidfilename), pidfilename = strdup (val);
327#if ENABLE_DNS
328 else if (!strcmp (var, "dns-forw-host"))
329 free (dns_forw_host), dns_forw_host = strdup (val);
330 else if (!strcmp (var, "dns-forw-port"))
331 dns_forw_port = atoi (val);
332#endif
333 else if (!strcmp (var, "http-proxy-host"))
334 {
296#if ENABLE_HTTP_PROXY 335#if ENABLE_HTTP_PROXY
297 else if (!strcmp (var, "http-proxy-host"))
298 proxy_host = strdup (val); 336 free (proxy_host), proxy_host = strdup (val);
337#endif
338 }
299 else if (!strcmp (var, "http-proxy-port")) 339 else if (!strcmp (var, "http-proxy-port"))
340 {
341#if ENABLE_HTTP_PROXY
300 proxy_port = atoi (val); 342 proxy_port = atoi (val);
343#endif
344 }
301 else if (!strcmp (var, "http-proxy-auth")) 345 else if (!strcmp (var, "http-proxy-auth"))
346 {
347#if ENABLE_HTTP_PROXY
302 proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val)); 348 proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val));
303#endif 349#endif
350 }
304 351
305 /* node-specific, non-defaultable */ 352 /* node-specific, non-defaultable */
306 else if (node != &default_node && !strcmp (var, "hostname")) 353 else if (node != &default_node && !strcmp (var, "hostname"))
307 {
308 free (node->hostname);
309 node->hostname = strdup (val); 354 free (node->hostname), node->hostname = strdup (val);
310 }
311 355
312 /* node-specific, defaultable */ 356 /* node-specific, defaultable */
313 else if (!strcmp (var, "udp-port")) 357 else if (!strcmp (var, "udp-port"))
314 node->udp_port = atoi (val); 358 node->udp_port = atoi (val);
315 else if (!strcmp (var, "tcp-port")) 359 else if (!strcmp (var, "tcp-port"))
316 node->tcp_port = atoi (val); 360 node->tcp_port = atoi (val);
361#if ENABLE_DNS
362 else if (!strcmp (var, "dns-hostname"))
363 free (node->dns_hostname), node->dns_hostname = strdup (val);
364 else if (!strcmp (var, "dns-port"))
365 node->dns_port = atoi (val);
366 else if (!strcmp (var, "dns-domain"))
367 free (node->domain), node->domain = strdup (val);
368#endif
317 else if (!strcmp (var, "router-priority")) 369 else if (!strcmp (var, "router-priority"))
318 node->routerprio = atoi (val); 370 node->routerprio = atoi (val);
371 else if (!strcmp (var, "max-retry"))
372 node->max_retry = atoi (val);
319 else if (!strcmp (var, "connect")) 373 else if (!strcmp (var, "connect"))
320 { 374 {
321 if (!strcmp (val, "ondemand")) 375 if (!strcmp (val, "ondemand"))
322 node->connectmode = conf_node::C_ONDEMAND; 376 node->connectmode = conf_node::C_ONDEMAND;
323 else if (!strcmp (val, "never")) 377 else if (!strcmp (val, "never"))
… …
326 node->connectmode = conf_node::C_ALWAYS; 380 node->connectmode = conf_node::C_ALWAYS;
327 else if (!strcmp (val, "disabled")) 381 else if (!strcmp (val, "disabled"))
328 node->connectmode = conf_node::C_DISABLED; 382 node->connectmode = conf_node::C_DISABLED;
329 else 383 else
330 slog (L_WARN, 384 slog (L_WARN,
331 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d"), 385 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d"),
332 var, fname, lineno); 386 var, fname, lineno);
333 } 387 }
334 else if (!strcmp (var, "inherit-tos")) 388 else if (!strcmp (var, "inherit-tos"))
335 { 389 {
336 parse_bool (node->inherit_tos, "inherit-tos", true, false); 390 parse_bool (node->inherit_tos, "inherit-tos", true, false);
337 } 391 }
… …
342 // all these bool options really really cost a lot of executable size! 396 // all these bool options really really cost a lot of executable size!
343 else if (!strcmp (var, "enable-tcp")) 397 else if (!strcmp (var, "enable-tcp"))
344 { 398 {
345#if ENABLE_TCP 399#if ENABLE_TCP
346 u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v; 400 u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v;
401#endif
402 }
403 else if (!strcmp (var, "enable-icmp"))
404 {
405#if ENABLE_ICMP
406 u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v;
407#endif
408 }
409 else if (!strcmp (var, "enable-dns"))
410 {
411#if ENABLE_DNS
412 u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) | v;
347#endif 413#endif
348 } 414 }
349 else if (!strcmp (var, "enable-udp")) 415 else if (!strcmp (var, "enable-udp"))
350 { 416 {
351 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v; 417 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
… …
365 fclose (f); 431 fclose (f);
366 } 432 }
367 else 433 else
368 { 434 {
369 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno)); 435 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
370 exit (1); 436 exit (EXIT_FAILURE);
371 } 437 }
372 438
373 free (fname); 439 free (fname);
374 440
375 fname = config_filename (prikeyfile, "hostkey"); 441 fname = config_filename (prikeyfile, "hostkey");
… …
381 447
382 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL)) 448 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL))
383 { 449 {
384 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 450 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
385 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 451 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
386 exit (1); 452 exit (EXIT_FAILURE);
387 } 453 }
388 454
389 RSA_blinding_on (rsa_key, 0); 455 require (RSA_blinding_on (rsa_key, 0));
390 456
391 fclose (f); 457 fclose (f);
392 } 458 }
393 else 459 else
394 { 460 {
395 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno)); 461 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));
396 462
397 if (need_keys) 463 if (need_keys)
398 exit (1); 464 exit (EXIT_FAILURE);
399 } 465 }
466
467 if (need_keys && ::thisnode
468 && rsa_key && thisnode && thisnode->rsa_key)
469 if (BN_cmp (rsa_key->n, thisnode->rsa_key->n) != 0
470 || BN_cmp (rsa_key->e, thisnode->rsa_key->e) != 0)
471 {
472 slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
473 exit (EXIT_FAILURE);
474 }
400 475
401 free (fname); 476 free (fname);
402} 477}
403 478
404char *configuration::config_filename (const char *name, const char *dflt) 479char *configuration::config_filename (const char *name, const char *dflt)
… …
426 printf (_("MTU: %d\n"), mtu); 501 printf (_("MTU: %d\n"), mtu);
427 printf (_("rekeying interval: %d\n"), rekey); 502 printf (_("rekeying interval: %d\n"), rekey);
428 printf (_("keepalive interval: %d\n"), keepalive); 503 printf (_("keepalive interval: %d\n"), keepalive);
429 printf (_("interface: %s\n"), ifname); 504 printf (_("interface: %s\n"), ifname);
430 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>"); 505 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>");
431 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) : -1); 506 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
432 printf ("\n"); 507 printf ("\n");
433 508
434 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n", 509 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n",
435 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port")); 510 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));
436 511
… …
440 printf ("\n"); 515 printf ("\n");
441} 516}
442 517
443configuration::configuration () 518configuration::configuration ()
444{ 519{
520 asprintf (&confbase, "%s/gvpe", CONFDIR);
521
445 init (); 522 init ();
446} 523}
447 524
448configuration::~configuration () 525configuration::~configuration ()
449{ 526{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines