ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/conf.C
(Generate patch)

Comparing gvpe/src/conf.C (file contents):
Revision 1.13 by pcg, Tue Apr 8 02:00:54 2003 UTC vs.
Revision 1.35 by pcg, Fri Mar 18 01:53:05 2005 UTC

1/* 1/*
2 conf.c -- configuration code 2 conf.c -- configuration code
3 Copyright (C) 1998 Robert van der Meulen 3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4 1998-2002 Ivo Timmermans <ivo@o2w.nl>
5 2000-2002 Guus Sliepen <guus@sliepen.eu.org>
6 2000 Cris van Pelt <tribbel@arise.dhs.org>
7 2003 Marc Lehmann <pcg@goof.com>
8 4
5 This file is part of GVPE.
6
9 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by 8 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or 9 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version. 10 (at your option) any later version.
13 11
14 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details. 15 GNU General Public License for more details.
18 16
19 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software 18 along with gvpe; if not, write to the Free Software
21 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22*/ 20*/
23 21
24#include "config.h" 22#include "config.h"
25 23
… …
31#include <netdb.h> 29#include <netdb.h>
32#include <sys/stat.h> 30#include <sys/stat.h>
33#include <sys/types.h> 31#include <sys/types.h>
34#include <unistd.h> 32#include <unistd.h>
35 33
36#include <netinet/in.h> 34#include "netcompat.h"
37#include <netinet/icmp.h>
38 35
39#include <openssl/err.h> 36#include <openssl/err.h>
40#include <openssl/pem.h> 37#include <openssl/pem.h>
41#include <openssl/rsa.h> 38#include <openssl/rsa.h>
42#include <openssl/rand.h> 39#include <openssl/rand.h>
43 40#include <openssl/bn.h>
44#include "gettext.h"
45 41
46#include "conf.h" 42#include "conf.h"
47#include "slog.h" 43#include "slog.h"
48#include "util.h" 44#include "util.h"
49 45
50char *confbase; 46char *confbase;
51char *thisnode; 47char *thisnode;
52char *identname; 48char *identname;
53char *pidfilename;
54 49
55struct configuration conf; 50struct configuration conf;
56 51
57u8 best_protocol (u8 protset) 52u8 best_protocol (u8 protset)
58{ 53{
59 if (protset & PROT_IPv4 ) return PROT_IPv4; 54 if (protset & PROT_IPv4 ) return PROT_IPv4;
60 if (protset & PROT_ICMPv4) return PROT_ICMPv4; 55 if (protset & PROT_ICMPv4) return PROT_ICMPv4;
61 if (protset & PROT_UDPv4 ) return PROT_UDPv4; 56 if (protset & PROT_UDPv4 ) return PROT_UDPv4;
62 if (protset & PROT_TCPv4 ) return PROT_TCPv4; 57 if (protset & PROT_TCPv4 ) return PROT_TCPv4;
58 if (protset & PROT_DNSv4 ) return PROT_DNSv4;
63 59
64 return 0; 60 return 0;
65} 61}
66 62
67const char *strprotocol (u8 protocol) 63const char *strprotocol (u8 protocol)
68{ 64{
69 if (protocol & PROT_IPv4 ) return "rawip"; 65 if (protocol & PROT_IPv4 ) return "rawip";
70 if (protocol & PROT_ICMPv4) return "icmp"; 66 if (protocol & PROT_ICMPv4) return "icmp";
71 if (protocol & PROT_UDPv4 ) return "udp"; 67 if (protocol & PROT_UDPv4 ) return "udp";
72 if (protocol & PROT_TCPv4 ) return "tcp"; 68 if (protocol & PROT_TCPv4 ) return "tcp";
69 if (protocol & PROT_DNSv4 ) return "dns";
73 70
74 return "<unknown>"; 71 return "<unknown>";
75} 72}
76 73
77void 74void
… …
96 if (rsa_key) 93 if (rsa_key)
97 RSA_free (rsa_key); 94 RSA_free (rsa_key);
98 95
99 free (nodename); 96 free (nodename);
100 free (hostname); 97 free (hostname);
98#if ENABLE_DNS
99 free (domain);
100 free (dns_hostname);
101#endif
101} 102}
102 103
103void configuration::init () 104void configuration::init ()
104{ 105{
105 memset (this, 0, sizeof (*this)); 106 memset (this, 0, sizeof (*this));
106 107
108 mtu = DEFAULT_MTU;
107 rekey = DEFAULT_REKEY; 109 rekey = DEFAULT_REKEY;
108 keepalive = DEFAULT_KEEPALIVE; 110 keepalive = DEFAULT_KEEPALIVE;
109 llevel = L_INFO; 111 llevel = L_INFO;
110 ip_proto = IPPROTO_GRE; 112 ip_proto = IPPROTO_GRE;
113#if ENABLE_ICMP
111 icmp_type = ICMP_ECHOREPLY; 114 icmp_type = ICMP_ECHOREPLY;
115#endif
112 116
113 default_node.udp_port = DEFAULT_UDPPORT; 117 default_node.udp_port = DEFAULT_UDPPORT;
114 default_node.tcp_port = DEFAULT_UDPPORT; 118 default_node.tcp_port = DEFAULT_UDPPORT; // ehrm
115 default_node.connectmode = conf_node::C_ALWAYS; 119 default_node.connectmode = conf_node::C_ALWAYS;
116 default_node.compress = true; 120 default_node.compress = true;
117 default_node.protocols = PROT_UDPv4; 121 default_node.protocols = 0;
122 default_node.max_retry = DEFAULT_MAX_RETRY;
123
124#if ENABLE_DNS
125 default_node.dns_port = 0; // default is 0 == client
126 dns_forw_host = strdup ("127.0.0.1");
127 dns_forw_port = 53;
128#endif
129
130 conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
118} 131}
119 132
120void configuration::cleanup() 133void configuration::cleanup()
121{ 134{
122 if (rsa_key) 135 if (rsa_key)
123 RSA_free (rsa_key); 136 RSA_free (rsa_key);
124 137
125 rsa_key = 0; 138 rsa_key = 0;
126 139
140 free (pidfilename); pidfilename = 0;
127 free (ifname); ifname = 0; 141 free (ifname); ifname = 0;
128#if ENABLE_HTTP_PROXY 142#if ENABLE_HTTP_PROXY
129 free (proxy_host); proxy_host = 0; 143 free (proxy_host); proxy_host = 0;
130 free (proxy_auth); proxy_auth = 0; 144 free (proxy_auth); proxy_auth = 0;
145#endif
146#if ENABLE_DNS
147 free (dns_forw_host); dns_forw_host = 0;
131#endif 148#endif
132} 149}
133 150
134void 151void
135configuration::clear_config () 152configuration::clear_config ()
… …
160 char *fname; 177 char *fname;
161 FILE *f; 178 FILE *f;
162 179
163 clear_config (); 180 clear_config ();
164 181
165 asprintf (&fname, "%s/vped.conf", confbase); 182 asprintf (&fname, "%s/gvpe.conf", confbase);
166 f = fopen (fname, "r"); 183 f = fopen (fname, "r");
167 184
168 if (f) 185 if (f)
169 { 186 {
170 char line[16384]; 187 char line[16384];
… …
228 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line); 245 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line);
229 } 246 }
230 else if (!strcmp (var, "ip-proto")) 247 else if (!strcmp (var, "ip-proto"))
231 ip_proto = atoi (val); 248 ip_proto = atoi (val);
232 else if (!strcmp (var, "icmp-type")) 249 else if (!strcmp (var, "icmp-type"))
250 {
251#if ENABLE_ICMP
233 icmp_type = atoi (val); 252 icmp_type = atoi (val);
253#endif
254 }
234 255
235 // per config 256 // per config
236 else if (!strcmp (var, "node")) 257 else if (!strcmp (var, "node"))
237 { 258 {
238 default_node.id++; 259 default_node.id++;
… …
256 277
257 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL)) 278 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
258 { 279 {
259 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 280 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
260 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 281 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
261 exit (1); 282 exit (EXIT_FAILURE);
262 } 283 }
263 284
264 RSA_blinding_on (node->rsa_key, 0); 285 require (RSA_blinding_on (node->rsa_key, 0));
265 286
266 fclose (f); 287 fclose (f);
267 } 288 }
268 else 289 else
269 { 290 {
270 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno)); 291 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
271 292
272 if (need_keys) 293 if (need_keys)
273 exit (1); 294 exit (EXIT_FAILURE);
274 } 295 }
275 296
276 free (fname); 297 free (fname);
277 } 298 }
278 299
279 if (!::thisnode || !strcmp (node->nodename, ::thisnode)) 300 if (::thisnode && !strcmp (node->nodename, ::thisnode))
280 thisnode = node; 301 thisnode = node;
281 } 302 }
282 else if (!strcmp (var, "private-key")) 303 else if (!strcmp (var, "private-key"))
283 prikeyfile = strdup (val); 304 free (prikeyfile), prikeyfile = strdup (val);
284 else if (!strcmp (var, "ifpersist")) 305 else if (!strcmp (var, "ifpersist"))
285 { 306 {
286 parse_bool (ifpersist, "ifpersist", true, false); 307 parse_bool (ifpersist, "ifpersist", true, false);
287 } 308 }
288 else if (!strcmp (var, "ifname")) 309 else if (!strcmp (var, "ifname"))
289 ifname = strdup (val); 310 free (ifname), ifname = strdup (val);
290 else if (!strcmp (var, "rekey")) 311 else if (!strcmp (var, "rekey"))
291 rekey = atoi (val); 312 rekey = atoi (val);
292 else if (!strcmp (var, "keepalive")) 313 else if (!strcmp (var, "keepalive"))
293 keepalive = atoi (val); 314 keepalive = atoi (val);
294 else if (!strcmp (var, "mtu")) 315 else if (!strcmp (var, "mtu"))
295 mtu = atoi (val); 316 mtu = atoi (val);
296 else if (!strcmp (var, "if-up")) 317 else if (!strcmp (var, "if-up"))
297 script_if_up = strdup (val); 318 free (script_if_up), script_if_up = strdup (val);
298 else if (!strcmp (var, "node-up")) 319 else if (!strcmp (var, "node-up"))
299 script_node_up = strdup (val); 320 free (script_node_up), script_node_up = strdup (val);
300 else if (!strcmp (var, "node-down")) 321 else if (!strcmp (var, "node-down"))
301 script_node_down = strdup (val); 322 free (script_node_down), script_node_down = strdup (val);
323 else if (!strcmp (var, "pid-file"))
324 free (pidfilename), pidfilename = strdup (val);
325 else if (!strcmp (var, "dns-forw-host"))
326 {
327#if ENABLE_DNS
328 free (dns_forw_host), dns_forw_host = strdup (val);
329#endif
330 }
331 else if (!strcmp (var, "dns-forw-port"))
332 {
333#if ENABLE_DNS
334 dns_forw_port = atoi (val);
335#endif
336 }
337 else if (!strcmp (var, "http-proxy-host"))
338 {
302#if ENABLE_HTTP_PROXY 339#if ENABLE_HTTP_PROXY
303 else if (!strcmp (var, "http-proxy-host"))
304 proxy_host = strdup (val); 340 free (proxy_host), proxy_host = strdup (val);
341#endif
342 }
305 else if (!strcmp (var, "http-proxy-port")) 343 else if (!strcmp (var, "http-proxy-port"))
344 {
345#if ENABLE_HTTP_PROXY
306 proxy_port = atoi (val); 346 proxy_port = atoi (val);
347#endif
348 }
307 else if (!strcmp (var, "http-proxy-auth")) 349 else if (!strcmp (var, "http-proxy-auth"))
350 {
351#if ENABLE_HTTP_PROXY
308 proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val)); 352 proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val));
309#endif 353#endif
354 }
310 355
311 /* node-specific, non-defaultable */ 356 /* node-specific, non-defaultable */
312 else if (node != &default_node && !strcmp (var, "hostname")) 357 else if (node != &default_node && !strcmp (var, "hostname"))
313 {
314 free (node->hostname);
315 node->hostname = strdup (val); 358 free (node->hostname), node->hostname = strdup (val);
316 }
317 359
318 /* node-specific, defaultable */ 360 /* node-specific, defaultable */
319 else if (!strcmp (var, "udp-port")) 361 else if (!strcmp (var, "udp-port"))
320 node->udp_port = atoi (val); 362 node->udp_port = atoi (val);
321 else if (!strcmp (var, "tcp-port")) 363 else if (!strcmp (var, "tcp-port"))
322 node->tcp_port = atoi (val); 364 node->tcp_port = atoi (val);
365 else if (!strcmp (var, "dns-hostname"))
366 {
367#if ENABLE_DNS
368 free (node->dns_hostname), node->dns_hostname = strdup (val);
369#endif
370 }
371 else if (!strcmp (var, "dns-port"))
372 {
373#if ENABLE_DNS
374 node->dns_port = atoi (val);
375#endif
376 }
377 else if (!strcmp (var, "dns-domain"))
378 {
379#if ENABLE_DNS
380 free (node->domain), node->domain = strdup (val);
381#endif
382 }
323 else if (!strcmp (var, "router-priority")) 383 else if (!strcmp (var, "router-priority"))
324 node->routerprio = atoi (val); 384 node->routerprio = atoi (val);
385 else if (!strcmp (var, "max-retry"))
386 node->max_retry = atoi (val);
325 else if (!strcmp (var, "connect")) 387 else if (!strcmp (var, "connect"))
326 { 388 {
327 if (!strcmp (val, "ondemand")) 389 if (!strcmp (val, "ondemand"))
328 node->connectmode = conf_node::C_ONDEMAND; 390 node->connectmode = conf_node::C_ONDEMAND;
329 else if (!strcmp (val, "never")) 391 else if (!strcmp (val, "never"))
… …
332 node->connectmode = conf_node::C_ALWAYS; 394 node->connectmode = conf_node::C_ALWAYS;
333 else if (!strcmp (val, "disabled")) 395 else if (!strcmp (val, "disabled"))
334 node->connectmode = conf_node::C_DISABLED; 396 node->connectmode = conf_node::C_DISABLED;
335 else 397 else
336 slog (L_WARN, 398 slog (L_WARN,
337 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d"), 399 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d"),
338 var, fname, lineno); 400 var, fname, lineno);
339 } 401 }
340 else if (!strcmp (var, "inherit-tos")) 402 else if (!strcmp (var, "inherit-tos"))
341 { 403 {
342 parse_bool (node->inherit_tos, "inherit-tos", true, false); 404 parse_bool (node->inherit_tos, "inherit-tos", true, false);
343 } 405 }
… …
354 } 416 }
355 else if (!strcmp (var, "enable-icmp")) 417 else if (!strcmp (var, "enable-icmp"))
356 { 418 {
357#if ENABLE_ICMP 419#if ENABLE_ICMP
358 u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v; 420 u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v;
421#endif
422 }
423 else if (!strcmp (var, "enable-dns"))
424 {
425#if ENABLE_DNS
426 u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) | v;
359#endif 427#endif
360 } 428 }
361 else if (!strcmp (var, "enable-udp")) 429 else if (!strcmp (var, "enable-udp"))
362 { 430 {
363 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v; 431 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
… …
377 fclose (f); 445 fclose (f);
378 } 446 }
379 else 447 else
380 { 448 {
381 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno)); 449 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
382 exit (1); 450 exit (EXIT_FAILURE);
383 } 451 }
384 452
385 free (fname); 453 free (fname);
386 454
387 fname = config_filename (prikeyfile, "hostkey"); 455 fname = config_filename (prikeyfile, "hostkey");
… …
393 461
394 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL)) 462 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL))
395 { 463 {
396 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 464 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
397 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 465 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
398 exit (1); 466 exit (EXIT_FAILURE);
399 } 467 }
400 468
401 RSA_blinding_on (rsa_key, 0); 469 require (RSA_blinding_on (rsa_key, 0));
402 470
403 fclose (f); 471 fclose (f);
404 } 472 }
405 else 473 else
406 { 474 {
407 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno)); 475 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));
408 476
409 if (need_keys) 477 if (need_keys)
410 exit (1); 478 exit (EXIT_FAILURE);
411 } 479 }
480
481 if (need_keys && ::thisnode
482 && rsa_key && thisnode && thisnode->rsa_key)
483 if (BN_cmp (rsa_key->n, thisnode->rsa_key->n) != 0
484 || BN_cmp (rsa_key->e, thisnode->rsa_key->e) != 0)
485 {
486 slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
487 exit (EXIT_FAILURE);
488 }
412 489
413 free (fname); 490 free (fname);
414} 491}
415 492
416char *configuration::config_filename (const char *name, const char *dflt) 493char *configuration::config_filename (const char *name, const char *dflt)
… …
438 printf (_("MTU: %d\n"), mtu); 515 printf (_("MTU: %d\n"), mtu);
439 printf (_("rekeying interval: %d\n"), rekey); 516 printf (_("rekeying interval: %d\n"), rekey);
440 printf (_("keepalive interval: %d\n"), keepalive); 517 printf (_("keepalive interval: %d\n"), keepalive);
441 printf (_("interface: %s\n"), ifname); 518 printf (_("interface: %s\n"), ifname);
442 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>"); 519 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>");
443 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) : -1); 520 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
444 printf ("\n"); 521 printf ("\n");
445 522
446 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n", 523 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n",
447 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port")); 524 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));
448 525
… …
452 printf ("\n"); 529 printf ("\n");
453} 530}
454 531
455configuration::configuration () 532configuration::configuration ()
456{ 533{
534 asprintf (&confbase, "%s/gvpe", CONFDIR);
535
457 init (); 536 init ();
458} 537}
459 538
460configuration::~configuration () 539configuration::~configuration ()
461{ 540{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines