ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/conf.C
(Generate patch)

Comparing gvpe/src/conf.C (file contents):
Revision 1.10 by pcg, Wed Apr 2 21:02:25 2003 UTC vs.
Revision 1.50 by pcg, Mon Mar 23 15:22:00 2009 UTC

1/* 1/*
2 conf.c -- configuration code 2 conf.c -- configuration code
3 Copyright (C) 1998 Robert van der Meulen 3 Copyright (C) 2003-2008 Marc Lehmann <gvpe@schmorp.de>
4 1998-2002 Ivo Timmermans <ivo@o2w.nl>
5 2000-2002 Guus Sliepen <guus@sliepen.eu.org>
6 2000 Cris van Pelt <tribbel@arise.dhs.org>
7 2003 Marc Lehmann <pcg@goof.com>
8 4
5 This file is part of GVPE.
6
9 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify it
10 it under the terms of the GNU General Public License as published by 8 under the terms of the GNU General Public License as published by the
11 the Free Software Foundation; either version 2 of the License, or 9 Free Software Foundation; either version 3 of the License, or (at your
12 (at your option) any later version. 10 option) any later version.
13 11
14 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful, but
15 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
17 GNU General Public License for more details. 15 Public License for more details.
18 16
19 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License along
20 along with this program; if not, write to the Free Software 18 with this program; if not, see <http://www.gnu.org/licenses/>.
21 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19
20 Additional permission under GNU GPL version 3 section 7
21
22 If you modify this Program, or any covered work, by linking or
23 combining it with the OpenSSL project's OpenSSL library (or a modified
24 version of that library), containing parts covered by the terms of the
25 OpenSSL or SSLeay licenses, the licensors of this Program grant you
26 additional permission to convey the resulting work. Corresponding
27 Source for a non-source form of such a combination shall include the
28 source code for the parts of OpenSSL used as well as that of the
29 covered work.
22*/ 30*/
23 31
24#include "config.h" 32#include "config.h"
25 33
26#include <cstdio> 34#include <cstdio>
… …
31#include <netdb.h> 39#include <netdb.h>
32#include <sys/stat.h> 40#include <sys/stat.h>
33#include <sys/types.h> 41#include <sys/types.h>
34#include <unistd.h> 42#include <unistd.h>
35 43
36#include <netinet/in.h> 44#include "netcompat.h"
37 45
38#include <openssl/err.h> 46#include <openssl/err.h>
39#include <openssl/pem.h> 47#include <openssl/pem.h>
40#include <openssl/rsa.h> 48#include <openssl/rsa.h>
41#include <openssl/rand.h> 49#include <openssl/rand.h>
42 50#include <openssl/bn.h>
43#include "gettext.h"
44 51
45#include "conf.h" 52#include "conf.h"
46#include "slog.h" 53#include "slog.h"
47#include "util.h" 54#include "util.h"
48 55
49char *confbase; 56char *confbase;
50char *thisnode; 57char *thisnode;
51char *identname; 58char *identname;
52char *pidfilename;
53 59
54struct configuration conf; 60struct configuration conf;
55 61
56u8 best_protocol (u8 protset) 62u8 best_protocol (u8 protset)
57{ 63{
58 if (protset & PROT_IPv4 ) return PROT_IPv4; 64 if (protset & PROT_IPv4 ) return PROT_IPv4;
65 if (protset & PROT_ICMPv4) return PROT_ICMPv4;
59 if (protset & PROT_UDPv4) return PROT_UDPv4; 66 if (protset & PROT_UDPv4 ) return PROT_UDPv4;
60 if (protset & PROT_TCPv4) return PROT_TCPv4; 67 if (protset & PROT_TCPv4 ) return PROT_TCPv4;
68 if (protset & PROT_DNSv4 ) return PROT_DNSv4;
61 69
62 return 0; 70 return 0;
63} 71}
64 72
65const char *strprotocol (u8 protocol) 73const char *strprotocol (u8 protocol)
66{ 74{
67 if (protocol & PROT_IPv4 ) return "rawip"; 75 if (protocol & PROT_IPv4 ) return "rawip";
76 if (protocol & PROT_ICMPv4) return "icmp";
68 if (protocol & PROT_UDPv4) return "udp"; 77 if (protocol & PROT_UDPv4 ) return "udp";
69 if (protocol & PROT_TCPv4) return "tcp"; 78 if (protocol & PROT_TCPv4 ) return "tcp";
79 if (protocol & PROT_DNSv4 ) return "dns";
70 80
71 return "<unknown>"; 81 return "<unknown>";
72} 82}
73 83
74configuration::configuration () 84static bool
85match_list (const vector<const char *> &list, const char *str)
75{ 86{
76 init (); 87 for (vector<const char *>::const_iterator i = list.end (); i-- > list.begin (); )
77} 88 if ((*i)[0] == '*' && !(*i)[1])
89 return true;
90 else if (!strcmp (*i, str))
91 return true;
78 92
79configuration::~configuration () 93 return false;
94}
95
96bool
97conf_node::may_direct (struct conf_node *other)
80{ 98{
81 cleanup (); 99 if (match_list (allow_direct, other->nodename))
100 return true;
101
102 if (match_list (deny_direct, other->nodename))
103 return false;
104
105 return true;
106}
107
108void
109conf_node::print ()
110{
111 printf ("%4d fe:fd:80:00:0%1x:%02x %c %-8.8s %-10.10s %s%s%d\n",
112 id,
113 id >> 8, id & 0xff,
114 compress ? 'Y' : 'N',
115 connectmode == C_ONDEMAND ? "ondemand"
116 : connectmode == C_NEVER ? "never"
117 : connectmode == C_ALWAYS ? "always"
118 : connectmode == C_DISABLED ? "disabled"
119 : "",
120 nodename,
121 hostname ? hostname : "",
122 hostname ? ":" : "",
123 hostname ? udp_port : 0
124 );
125}
126
127conf_node::~conf_node ()
128{
129#if 0
130 // does not work, because string pointers etc. are shared
131 // is not called, however
132 if (rsa_key)
133 RSA_free (rsa_key);
134
135 free (nodename);
136 free (hostname);
137 free (if_up_data);
138#if ENABLE_DNS
139 free (domain);
140 free (dns_hostname);
141#endif
142#endif
82} 143}
83 144
84void configuration::init () 145void configuration::init ()
85{ 146{
86 memset (this, 0, sizeof (*this)); 147 memset (this, 0, sizeof (*this));
87 148
149 mtu = DEFAULT_MTU;
150 nfmark = 0;
88 rekey = DEFAULT_REKEY; 151 rekey = DEFAULT_REKEY;
89 keepalive = DEFAULT_KEEPALIVE; 152 keepalive = DEFAULT_KEEPALIVE;
90 llevel = L_INFO; 153 llevel = L_INFO;
91 ip_proto = IPPROTO_GRE; 154 ip_proto = IPPROTO_GRE;
155#if ENABLE_ICMP
156 icmp_type = ICMP_ECHOREPLY;
157#endif
92 158
93 default_node.udp_port = DEFAULT_UDPPORT; 159 default_node.udp_port = DEFAULT_UDPPORT;
94 default_node.tcp_port = DEFAULT_UDPPORT; 160 default_node.tcp_port = DEFAULT_UDPPORT; // ehrm
95 default_node.connectmode = conf_node::C_ALWAYS; 161 default_node.connectmode = conf_node::C_ALWAYS;
96 default_node.compress = true; 162 default_node.compress = true;
97 default_node.protocols = PROT_UDPv4; 163 default_node.protocols = 0;
164 default_node.max_retry = DEFAULT_MAX_RETRY;
165 default_node.max_ttl = DEFAULT_MAX_TTL;
166 default_node.max_queue = DEFAULT_MAX_QUEUE;
167 default_node.if_up_data = strdup ("");
168
169#if ENABLE_DNS
170 default_node.dns_port = 0; // default is 0 == client
171
172 dns_forw_host = strdup ("127.0.0.1");
173 dns_forw_port = 53;
174 dns_timeout_factor = DEFAULT_DNS_TIMEOUT_FACTOR;
175 dns_send_interval = DEFAULT_DNS_SEND_INTERVAL;
176 dns_overlap_factor = DEFAULT_DNS_OVERLAP_FACTOR;
177 dns_max_outstanding = DEFAULT_DNS_MAX_OUTSTANDING;
178#endif
179
180 conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
98} 181}
99 182
100void configuration::cleanup() 183void configuration::cleanup()
101{ 184{
102 if (rsa_key) 185 if (rsa_key)
103 RSA_free (rsa_key); 186 RSA_free (rsa_key);
104 187
105 free (ifname);
106
107 rsa_key = 0; 188 rsa_key = 0;
108 ifname = 0; 189
190 free (pidfilename); pidfilename = 0;
191 free (ifname); ifname = 0;
192#if ENABLE_HTTP_PROXY
193 free (proxy_host); proxy_host = 0;
194 free (proxy_auth); proxy_auth = 0;
195#endif
196#if ENABLE_DNS
197 free (dns_forw_host); dns_forw_host = 0;
198#endif
109} 199}
110 200
111void 201void
112configuration::clear_config () 202configuration::clear ()
113{ 203{
114 for (configuration::node_vector::iterator i = nodes.begin(); i != nodes.end(); ++i) 204 for (configuration::node_vector::iterator i = nodes.begin(); i != nodes.end(); ++i)
115 delete *i; 205 delete *i;
116 206
117 nodes.clear (); 207 nodes.clear ();
118 208
119 cleanup (); 209 cleanup ();
120 init (); 210 init ();
121} 211}
122 212
123#define parse_bool(target,name,trueval,falseval) \ 213#define parse_bool(target,name,trueval,falseval) do { \
124 if (!strcmp (val, "yes")) target = trueval; \ 214 if (!strcmp (val, "yes")) target = trueval; \
125 else if (!strcmp (val, "no")) target = falseval; \ 215 else if (!strcmp (val, "no")) target = falseval; \
126 else if (!strcmp (val, "true")) target = trueval; \ 216 else if (!strcmp (val, "true")) target = trueval; \
127 else if (!strcmp (val, "false")) target = falseval; \ 217 else if (!strcmp (val, "false")) target = falseval; \
128 else if (!strcmp (val, "on")) target = trueval; \ 218 else if (!strcmp (val, "on")) target = trueval; \
129 else if (!strcmp (val, "off")) target = falseval; \ 219 else if (!strcmp (val, "off")) target = falseval; \
130 else \ 220 else \
131 slog (L_WARN, \ 221 return _("illegal boolean value, only 'yes|true|on' or 'no|false|off' allowed. (ignored)"); \
132 _("illegal value for '%s', only 'yes|true|on' or 'no|false|off' allowed, at '%s' line %d"), \ 222} while (0)
133 name, var, fname, lineno);
134 223
135void configuration::read_config (bool need_keys) 224const char *
225configuration_parser::parse_line (char *line)
226{
227 {
228 char *end = line + strlen (line);
229
230 while (*end < ' ' && end >= line)
231 end--;
232
233 *++end = 0;
234 }
235
236 char *tok = line;
237 const char *var = strtok (tok, "\t =");
238 tok = 0;
239
240 if (!var || !var[0])
241 return 0; /* no tokens on this line */
242
243 if (var[0] == '#')
244 return 0; /* comment: ignore */
245
246 char *val = strtok (NULL, "\t\n\r =");
247
248 if (!val || val[0] == '#')
249 return _("no value given for variable. (ignored)");
250
251 if (!strcmp (var, "on"))
252 {
253 if (!::thisnode
254 || (val[0] == '!' && strcmp (val + 1, ::thisnode))
255 || !strcmp (val, ::thisnode))
256 return parse_line (strtok (NULL, "\n\r"));
257 else
258 return 0;
259 }
260
261 // truly global
262 if (!strcmp (var, "loglevel"))
263 {
264 loglevel l = string_to_loglevel (val);
265
266 if (l == L_NONE)
267 return _("unknown loglevel. (skipping)");
268 }
269 else if (!strcmp (var, "ip-proto"))
270 conf.ip_proto = atoi (val);
271 else if (!strcmp (var, "icmp-type"))
272 {
273#if ENABLE_ICMP
274 conf.icmp_type = atoi (val);
275#endif
276 }
277
278 // per config
279 else if (!strcmp (var, "node"))
280 {
281 parse_argv ();
282
283 conf.default_node.id++;
284 node = new conf_node (conf.default_node);
285 conf.nodes.push_back (node);
286 node->nodename = strdup (val);
287
288 {
289 char *fname;
290 FILE *f;
291
292 asprintf (&fname, "%s/pubkey/%s", confbase, node->nodename);
293
294 f = fopen (fname, "r");
295 if (f)
296 {
297 node->rsa_key = RSA_new ();
298
299 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
300 {
301 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
302 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
303 exit (EXIT_FAILURE);
304 }
305
306 require (RSA_blinding_on (node->rsa_key, 0));
307
308 fclose (f);
309 }
310 else
311 {
312 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
313
314 if (need_keys)
315 exit (EXIT_FAILURE);
316 }
317
318 free (fname);
319 }
320
321 if (::thisnode && !strcmp (node->nodename, ::thisnode))
322 conf.thisnode = node;
323 }
324 else if (!strcmp (var, "private-key"))
325 free (conf.prikeyfile), conf.prikeyfile = strdup (val);
326 else if (!strcmp (var, "ifpersist"))
327 parse_bool (conf.ifpersist, "ifpersist", true, false);
328 else if (!strcmp (var, "ifname"))
329 free (conf.ifname), conf.ifname = strdup (val);
330 else if (!strcmp (var, "rekey"))
331 conf.rekey = atoi (val);
332 else if (!strcmp (var, "keepalive"))
333 conf.keepalive = atoi (val);
334 else if (!strcmp (var, "mtu"))
335 conf.mtu = atoi (val);
336 else if (!strcmp (var, "nfmark"))
337 conf.nfmark = atoi (val);
338 else if (!strcmp (var, "if-up"))
339 free (conf.script_if_up), conf.script_if_up = strdup (val);
340 else if (!strcmp (var, "node-up"))
341 free (conf.script_node_up), conf.script_node_up = strdup (val);
342 else if (!strcmp (var, "node-down"))
343 free (conf.script_node_down), conf.script_node_down = strdup (val);
344 else if (!strcmp (var, "pid-file"))
345 free (conf.pidfilename), conf.pidfilename = strdup (val);
346 else if (!strcmp (var, "dns-forw-host"))
347 {
348#if ENABLE_DNS
349 free (conf.dns_forw_host), conf.dns_forw_host = strdup (val);
350#endif
351 }
352 else if (!strcmp (var, "dns-forw-port"))
353 {
354#if ENABLE_DNS
355 conf.dns_forw_port = atoi (val);
356#endif
357 }
358 else if (!strcmp (var, "dns-timeout-factor"))
359 {
360#if ENABLE_DNS
361 conf.dns_timeout_factor = atof (val);
362#endif
363 }
364 else if (!strcmp (var, "dns-send-interval"))
365 {
366#if ENABLE_DNS
367 conf.dns_send_interval = atoi (val);
368#endif
369 }
370 else if (!strcmp (var, "dns-overlap-factor"))
371 {
372#if ENABLE_DNS
373 conf.dns_overlap_factor = atof (val);
374#endif
375 }
376 else if (!strcmp (var, "dns-max-outstanding"))
377 {
378#if ENABLE_DNS
379 conf.dns_max_outstanding = atoi (val);
380#endif
381 }
382 else if (!strcmp (var, "http-proxy-host"))
383 {
384#if ENABLE_HTTP_PROXY
385 free (conf.proxy_host), conf.proxy_host = strdup (val);
386#endif
387 }
388 else if (!strcmp (var, "http-proxy-port"))
389 {
390#if ENABLE_HTTP_PROXY
391 conf.proxy_port = atoi (val);
392#endif
393 }
394 else if (!strcmp (var, "http-proxy-auth"))
395 {
396#if ENABLE_HTTP_PROXY
397 conf.proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val));
398#endif
399 }
400
401 /* node-specific, non-defaultable */
402 else if (node != &conf.default_node && !strcmp (var, "hostname"))
403 free (node->hostname), node->hostname = strdup (val);
404
405 /* node-specific, defaultable */
406 else if (!strcmp (var, "udp-port"))
407 node->udp_port = atoi (val);
408 else if (!strcmp (var, "tcp-port"))
409 node->tcp_port = atoi (val);
410 else if (!strcmp (var, "dns-hostname"))
411 {
412#if ENABLE_DNS
413 free (node->dns_hostname), node->dns_hostname = strdup (val);
414#endif
415 }
416 else if (!strcmp (var, "dns-port"))
417 {
418#if ENABLE_DNS
419 node->dns_port = atoi (val);
420#endif
421 }
422 else if (!strcmp (var, "dns-domain"))
423 {
424#if ENABLE_DNS
425 free (node->domain), node->domain = strdup (val);
426#endif
427 }
428 else if (!strcmp (var, "if-up-data"))
429 free (node->if_up_data), node->if_up_data = strdup (val);
430 else if (!strcmp (var, "router-priority"))
431 node->routerprio = atoi (val);
432 else if (!strcmp (var, "max-retry"))
433 node->max_retry = atoi (val);
434 else if (!strcmp (var, "connect"))
435 {
436 if (!strcmp (val, "ondemand"))
437 node->connectmode = conf_node::C_ONDEMAND;
438 else if (!strcmp (val, "never"))
439 node->connectmode = conf_node::C_NEVER;
440 else if (!strcmp (val, "always"))
441 node->connectmode = conf_node::C_ALWAYS;
442 else if (!strcmp (val, "disabled"))
443 node->connectmode = conf_node::C_DISABLED;
444 else
445 return _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled'. (ignored)");
446 }
447 else if (!strcmp (var, "inherit-tos"))
448 parse_bool (node->inherit_tos, "inherit-tos", true, false);
449 else if (!strcmp (var, "compress"))
450 parse_bool (node->compress, "compress", true, false);
451 // all these bool options really really cost a lot of executable size!
452 else if (!strcmp (var, "enable-tcp"))
453 {
454#if ENABLE_TCP
455 u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v;
456#endif
457 }
458 else if (!strcmp (var, "enable-icmp"))
459 {
460#if ENABLE_ICMP
461 u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v;
462#endif
463 }
464 else if (!strcmp (var, "enable-dns"))
465 {
466#if ENABLE_DNS
467 u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) | v;
468#endif
469 }
470 else if (!strcmp (var, "enable-udp"))
471 {
472 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
473 }
474 else if (!strcmp (var, "enable-rawip"))
475 {
476 u8 v; parse_bool (v, "enable-rawip", PROT_IPv4, 0); node->protocols = (node->protocols & ~PROT_IPv4 ) | v;
477 }
478 else if (!strcmp (var, "allow-direct"))
479 node->allow_direct.push_back (strdup (val));
480 else if (!strcmp (var, "deny-direct"))
481 node->deny_direct.push_back (strdup (val));
482 else if (!strcmp (var, "max-ttl"))
483 node->max_ttl = atof (val);
484 else if (!strcmp (var, "max-queue"))
485 node->max_queue = atoi (val);
486
487 // unknown or misplaced
488 else
489 return _("unknown configuration directive. (ignored)");
490
491 return 0;
492}
493
494void conf_node::finalise ()
495{
496 if (max_queue < 1)
497 {
498 slog (L_WARN, _("%s: max-queue value invalid, setting it to 1."), nodename);
499 max_queue = 1;
500 }
501
502 if (routerprio > 1 && (connectmode != C_ALWAYS && connectmode != C_DISABLED))
503 {
504 //slog (L_WARN, _("%s: has non-zero router-priority but either 'never' or 'ondemand' as connectmode, setting it to 'always'."), nodename);
505 connectmode = C_ALWAYS;
506 }
507}
508
509void configuration_parser::parse_argv ()
510{
511 for (int i = 0; i < argc; ++i)
512 {
513 char *v = argv [i];
514
515 if (!*v)
516 continue;
517
518 char *enode = v;
519
520 while (*enode != '.' && *enode > ' ' && *enode != '=' && *enode)
521 enode++;
522
523 if (*enode != '.')
524 enode = 0;
525
526 char *wnode = node == &conf.default_node
527 ? 0
528 : node->nodename;
529
530 if ((!wnode && !enode)
531 || (wnode && enode && !strncmp (wnode, v, enode - v)))
532 {
533 const char *warn = parse_line (enode ? enode + 1 : v);
534
535 if (warn)
536 slog (L_WARN, _("%s, while parsing command line option '%s'."), warn, v);
537
538 *v = 0;
539 }
540 }
541}
542
543configuration_parser::configuration_parser (configuration &conf,
544 bool need_keys,
545 int argc,
546 char **argv)
547: conf (conf),need_keys (need_keys), argc (argc), argv (argv)
136{ 548{
137 char *fname; 549 char *fname;
138 FILE *f; 550 FILE *f;
139 551
140 clear_config (); 552 conf.clear ();
141 553
142 asprintf (&fname, "%s/vped.conf", confbase); 554 asprintf (&fname, "%s/gvpe.conf", confbase);
143 f = fopen (fname, "r"); 555 f = fopen (fname, "r");
144 556
145 if (f) 557 if (f)
146 { 558 {
147 char line[16384]; 559 char line[16384];
148 int lineno = 0; 560 int lineno = 0;
149 char *var, *val; 561 node = &conf.default_node;
150 conf_node *node = &default_node;
151 562
152 while (fgets (line, sizeof (line), f)) 563 while (fgets (line, sizeof (line), f))
153 { 564 {
154 lineno++; 565 lineno++;
155 566
156 { 567 const char *warn = parse_line (line);
157 char *end = line + strlen (line);
158 568
159 while (*end < ' ' && end >= line) 569 if (warn)
160 end--; 570 slog (L_WARN, _("%s, at '%s', line %d."), warn, fname, lineno);
161
162 *++end = 0;
163 }
164
165 char *tok = line;
166
167retry:
168 var = strtok (tok, "\t =");
169 tok = 0;
170
171 if (!var || !var[0])
172 continue; /* no tokens on this line */
173
174 if (var[0] == '#')
175 continue; /* comment: ignore */
176
177 val = strtok (NULL, "\t\n\r =");
178
179 if (!val || val[0] == '#')
180 {
181 slog (L_WARN,
182 _("no value for variable `%s', at '%s' line %d"),
183 var, fname, lineno);
184 break;
185 }
186
187 if (!strcmp (var, "on"))
188 {
189 if (!::thisnode
190 || (val[0] == '!' && strcmp (val + 1, ::thisnode))
191 || !strcmp (val, ::thisnode))
192 goto retry;
193
194 continue;
195 }
196
197 // truly global
198 if (!strcmp (var, "loglevel"))
199 {
200 loglevel l = string_to_loglevel (val);
201
202 if (l != L_NONE)
203 llevel = l;
204 else
205 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line);
206 }
207 else if (!strcmp (var, "ip-proto"))
208 ip_proto = atoi (val);
209
210 // per config
211 else if (!strcmp (var, "node"))
212 {
213 default_node.id++;
214
215 node = new conf_node (default_node);
216
217 nodes.push_back (node);
218
219 node->nodename = strdup (val);
220
221 {
222 char *fname;
223 FILE *f;
224
225 asprintf (&fname, "%s/pubkey/%s", confbase, node->nodename);
226
227 f = fopen (fname, "r");
228 if (f)
229 {
230 node->rsa_key = RSA_new ();
231
232 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
233 {
234 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
235 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
236 exit (1);
237 }
238
239 RSA_blinding_on (node->rsa_key, 0);
240
241 fclose (f);
242 }
243 else
244 {
245 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
246
247 if (need_keys)
248 exit (1);
249 }
250
251 free (fname);
252 }
253
254 if (!::thisnode || !strcmp (node->nodename, ::thisnode))
255 thisnode = node;
256 }
257 else if (!strcmp (var, "private-key"))
258 prikeyfile = strdup (val);
259 else if (!strcmp (var, "ifpersist"))
260 {
261 parse_bool (ifpersist, "ifpersist", true, false);
262 }
263 else if (!strcmp (var, "ifname"))
264 ifname = strdup (val);
265 else if (!strcmp (var, "rekey"))
266 rekey = atoi (val);
267 else if (!strcmp (var, "keepalive"))
268 keepalive = atoi (val);
269 else if (!strcmp (var, "mtu"))
270 mtu = atoi (val);
271 else if (!strcmp (var, "if-up"))
272 script_if_up = strdup (val);
273 else if (!strcmp (var, "node-up"))
274 script_node_up = strdup (val);
275 else if (!strcmp (var, "node-down"))
276 script_node_down = strdup (val);
277
278 /* node-specific, non-defaultable */
279 else if (node != &default_node && !strcmp (var, "hostname"))
280 {
281 free (node->hostname);
282 node->hostname = strdup (val);
283 }
284
285 /* node-specific, defaultable */
286 else if (!strcmp (var, "udp-port"))
287 node->udp_port = atoi (val);
288 else if (!strcmp (var, "tcp-port"))
289 node->tcp_port = atoi (val);
290 else if (!strcmp (var, "router-priority"))
291 node->routerprio = atoi (val);
292 else if (!strcmp (var, "connect"))
293 {
294 if (!strcmp (val, "ondemand"))
295 node->connectmode = conf_node::C_ONDEMAND;
296 else if (!strcmp (val, "never"))
297 node->connectmode = conf_node::C_NEVER;
298 else if (!strcmp (val, "always"))
299 node->connectmode = conf_node::C_ALWAYS;
300 else if (!strcmp (val, "disabled"))
301 node->connectmode = conf_node::C_DISABLED;
302 else
303 slog (L_WARN,
304 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d"),
305 var, fname, lineno);
306 }
307 else if (!strcmp (var, "inherit-tos"))
308 {
309 parse_bool (node->inherit_tos, "inherit-tos", true, false);
310 }
311 else if (!strcmp (var, "compress"))
312 {
313 parse_bool (node->compress, "compress", true, false);
314 }
315 // all these bool options really really cost a lot of executable size!
316 else if (!strcmp (var, "enable-tcp"))
317 {
318 u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v;
319 }
320 else if (!strcmp (var, "enable-udp"))
321 {
322 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
323 }
324 else if (!strcmp (var, "enable-rawip"))
325 {
326 u8 v; parse_bool (v, "enable-rawip", PROT_IPv4, 0); node->protocols = (node->protocols & ~PROT_IPv4 ) | v;
327 }
328
329 // unknown or misplaced
330 else
331 {
332 slog (L_WARN,
333 _("unknown or misplaced variable `%s', at '%s' line %d"),
334 var, fname, lineno);
335 }
336 } 571 }
337 572
338 fclose (f); 573 fclose (f);
574
575 parse_argv ();
339 } 576 }
340 else 577 else
341 { 578 {
342 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno)); 579 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
343 exit (1); 580 exit (EXIT_FAILURE);
344 } 581 }
345 582
346 free (fname); 583 free (fname);
347 584
348 fname = config_filename (prikeyfile, "hostkey"); 585 fname = conf.config_filename (conf.prikeyfile, "hostkey");
349 586
350 f = fopen (fname, "r"); 587 f = fopen (fname, "r");
351 if (f) 588 if (f)
352 { 589 {
353 rsa_key = RSA_new (); 590 conf.rsa_key = RSA_new ();
354 591
355 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL)) 592 if (!PEM_read_RSAPrivateKey (f, &conf.rsa_key, NULL, NULL))
356 { 593 {
357 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 594 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
358 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 595 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
359 exit (1); 596 exit (EXIT_FAILURE);
360 } 597 }
361 598
362 RSA_blinding_on (rsa_key, 0); 599 require (RSA_blinding_on (conf.rsa_key, 0));
363 600
364 fclose (f); 601 fclose (f);
365 } 602 }
366 else 603 else
367 { 604 {
368 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno)); 605 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));
369 606
370 if (need_keys) 607 if (need_keys)
371 exit (1); 608 exit (EXIT_FAILURE);
609 }
610
611 if (need_keys && ::thisnode
612 && conf.rsa_key && conf.thisnode && conf.thisnode->rsa_key)
613 if (BN_cmp (conf.rsa_key->n, conf.thisnode->rsa_key->n) != 0
614 || BN_cmp (conf.rsa_key->e, conf.thisnode->rsa_key->e) != 0)
615 {
616 slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
617 exit (EXIT_FAILURE);
372 } 618 }
373 619
374 free (fname); 620 free (fname);
621
622 for (configuration::node_vector::iterator i = conf.nodes.begin(); i != conf.nodes.end(); ++i)
623 (*i)->finalise ();
375} 624}
376 625
377char *configuration::config_filename (const char *name, const char *dflt) 626char *configuration::config_filename (const char *name, const char *dflt)
378{ 627{
379 char *fname; 628 char *fname;
… …
399 printf (_("MTU: %d\n"), mtu); 648 printf (_("MTU: %d\n"), mtu);
400 printf (_("rekeying interval: %d\n"), rekey); 649 printf (_("rekeying interval: %d\n"), rekey);
401 printf (_("keepalive interval: %d\n"), keepalive); 650 printf (_("keepalive interval: %d\n"), keepalive);
402 printf (_("interface: %s\n"), ifname); 651 printf (_("interface: %s\n"), ifname);
403 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>"); 652 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>");
404 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) : -1); 653 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
405 printf ("\n"); 654 printf ("\n");
406 655
407 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n", 656 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n",
408 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port")); 657 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));
409 658
… …
411 (*i)->print (); 660 (*i)->print ();
412 661
413 printf ("\n"); 662 printf ("\n");
414} 663}
415 664
416void 665configuration::configuration ()
417conf_node::print ()
418{ 666{
419 printf ("%4d fe:fd:80:00:0%1x:%02x %c %-8.8s %-10.10s %s%s%d\n", 667 asprintf (&confbase, "%s/gvpe", CONFDIR);
420 id,
421 id >> 8, id & 0xff,
422 compress ? 'Y' : 'N',
423 connectmode == C_ONDEMAND ? "ondemand" :
424 connectmode == C_NEVER ? "never" :
425 connectmode == C_ALWAYS ? "always" : "",
426 nodename,
427 hostname ? hostname : "",
428 hostname ? ":" : "",
429 hostname ? udp_port : 0
430 );
431}
432 668
669 init ();
670}
671
672configuration::~configuration ()
673{
674 cleanup ();
675}
676
677

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines