ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/src/conf.C
(Generate patch)

Comparing gvpe/src/conf.C (file contents):
Revision 1.12 by pcg, Mon Apr 7 01:12:56 2003 UTC vs.
Revision 1.36 by pcg, Sun Mar 20 02:34:16 2005 UTC

1/* 1/*
2 conf.c -- configuration code 2 conf.c -- configuration code
3 Copyright (C) 1998 Robert van der Meulen 3 Copyright (C) 2003-2005 Marc Lehmann <gvpe@schmorp.de>
4 1998-2002 Ivo Timmermans <ivo@o2w.nl>
5 2000-2002 Guus Sliepen <guus@sliepen.eu.org>
6 2000 Cris van Pelt <tribbel@arise.dhs.org>
7 2003 Marc Lehmann <pcg@goof.com>
8 4
5 This file is part of GVPE.
6
9 This program is free software; you can redistribute it and/or modify 7 GVPE is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by 8 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or 9 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version. 10 (at your option) any later version.
13 11
14 This program is distributed in the hope that it will be useful, 12 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of 13 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details. 15 GNU General Public License for more details.
18 16
19 You should have received a copy of the GNU General Public License 17 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software 18 along with gvpe; if not, write to the Free Software
21 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 19 Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22*/ 20*/
23 21
24#include "config.h" 22#include "config.h"
25 23
… …
31#include <netdb.h> 29#include <netdb.h>
32#include <sys/stat.h> 30#include <sys/stat.h>
33#include <sys/types.h> 31#include <sys/types.h>
34#include <unistd.h> 32#include <unistd.h>
35 33
36#include <netinet/in.h> 34#include "netcompat.h"
37 35
38#include <openssl/err.h> 36#include <openssl/err.h>
39#include <openssl/pem.h> 37#include <openssl/pem.h>
40#include <openssl/rsa.h> 38#include <openssl/rsa.h>
41#include <openssl/rand.h> 39#include <openssl/rand.h>
42 40#include <openssl/bn.h>
43#include "gettext.h"
44 41
45#include "conf.h" 42#include "conf.h"
46#include "slog.h" 43#include "slog.h"
47#include "util.h" 44#include "util.h"
48 45
49char *confbase; 46char *confbase;
50char *thisnode; 47char *thisnode;
51char *identname; 48char *identname;
52char *pidfilename;
53 49
54struct configuration conf; 50struct configuration conf;
55 51
56u8 best_protocol (u8 protset) 52u8 best_protocol (u8 protset)
57{ 53{
58 if (protset & PROT_IPv4 ) return PROT_IPv4; 54 if (protset & PROT_IPv4 ) return PROT_IPv4;
55 if (protset & PROT_ICMPv4) return PROT_ICMPv4;
59 if (protset & PROT_UDPv4) return PROT_UDPv4; 56 if (protset & PROT_UDPv4 ) return PROT_UDPv4;
60 if (protset & PROT_TCPv4) return PROT_TCPv4; 57 if (protset & PROT_TCPv4 ) return PROT_TCPv4;
58 if (protset & PROT_DNSv4 ) return PROT_DNSv4;
61 59
62 return 0; 60 return 0;
63} 61}
64 62
65const char *strprotocol (u8 protocol) 63const char *strprotocol (u8 protocol)
66{ 64{
67 if (protocol & PROT_IPv4 ) return "rawip"; 65 if (protocol & PROT_IPv4 ) return "rawip";
66 if (protocol & PROT_ICMPv4) return "icmp";
68 if (protocol & PROT_UDPv4) return "udp"; 67 if (protocol & PROT_UDPv4 ) return "udp";
69 if (protocol & PROT_TCPv4) return "tcp"; 68 if (protocol & PROT_TCPv4 ) return "tcp";
69 if (protocol & PROT_DNSv4 ) return "dns";
70 70
71 return "<unknown>"; 71 return "<unknown>";
72} 72}
73 73
74void 74void
… …
93 if (rsa_key) 93 if (rsa_key)
94 RSA_free (rsa_key); 94 RSA_free (rsa_key);
95 95
96 free (nodename); 96 free (nodename);
97 free (hostname); 97 free (hostname);
98#if ENABLE_DNS
99 free (domain);
100 free (dns_hostname);
101#endif
98} 102}
99 103
100void configuration::init () 104void configuration::init ()
101{ 105{
102 memset (this, 0, sizeof (*this)); 106 memset (this, 0, sizeof (*this));
103 107
108 mtu = DEFAULT_MTU;
104 rekey = DEFAULT_REKEY; 109 rekey = DEFAULT_REKEY;
105 keepalive = DEFAULT_KEEPALIVE; 110 keepalive = DEFAULT_KEEPALIVE;
106 llevel = L_INFO; 111 llevel = L_INFO;
107 ip_proto = IPPROTO_GRE; 112 ip_proto = IPPROTO_GRE;
113#if ENABLE_ICMP
114 icmp_type = ICMP_ECHOREPLY;
115#endif
108 116
109 default_node.udp_port = DEFAULT_UDPPORT; 117 default_node.udp_port = DEFAULT_UDPPORT;
110 default_node.tcp_port = DEFAULT_UDPPORT; 118 default_node.tcp_port = DEFAULT_UDPPORT; // ehrm
111 default_node.connectmode = conf_node::C_ALWAYS; 119 default_node.connectmode = conf_node::C_ALWAYS;
112 default_node.compress = true; 120 default_node.compress = true;
113 default_node.protocols = PROT_UDPv4; 121 default_node.protocols = 0;
122 default_node.max_retry = DEFAULT_MAX_RETRY;
123
124#if ENABLE_DNS
125 default_node.dns_port = 0; // default is 0 == client
126 dns_forw_host = strdup ("127.0.0.1");
127 dns_forw_port = 53;
128#endif
129
130 conf.pidfilename = strdup (LOCALSTATEDIR "/run/gvpe.pid");
114} 131}
115 132
116void configuration::cleanup() 133void configuration::cleanup()
117{ 134{
118 if (rsa_key) 135 if (rsa_key)
119 RSA_free (rsa_key); 136 RSA_free (rsa_key);
120 137
121 rsa_key = 0; 138 rsa_key = 0;
122 139
140 free (pidfilename); pidfilename = 0;
123 free (ifname); ifname = 0; 141 free (ifname); ifname = 0;
124#if ENABLE_HTTP_PROXY 142#if ENABLE_HTTP_PROXY
125 free (proxy_host); proxy_host = 0; 143 free (proxy_host); proxy_host = 0;
126 free (proxy_auth); proxy_auth = 0; 144 free (proxy_auth); proxy_auth = 0;
145#endif
146#if ENABLE_DNS
147 free (dns_forw_host); dns_forw_host = 0;
127#endif 148#endif
128} 149}
129 150
130void 151void
131configuration::clear_config () 152configuration::clear_config ()
… …
156 char *fname; 177 char *fname;
157 FILE *f; 178 FILE *f;
158 179
159 clear_config (); 180 clear_config ();
160 181
161 asprintf (&fname, "%s/vped.conf", confbase); 182 asprintf (&fname, "%s/gvpe.conf", confbase);
162 f = fopen (fname, "r"); 183 f = fopen (fname, "r");
163 184
164 if (f) 185 if (f)
165 { 186 {
166 char line[16384]; 187 char line[16384];
… …
196 val = strtok (NULL, "\t\n\r ="); 217 val = strtok (NULL, "\t\n\r =");
197 218
198 if (!val || val[0] == '#') 219 if (!val || val[0] == '#')
199 { 220 {
200 slog (L_WARN, 221 slog (L_WARN,
201 _("no value for variable `%s', at '%s' line %d"), 222 _("no value for variable `%s', at '%s' line %d, skipping."),
202 var, fname, lineno); 223 var, fname, lineno);
203 break; 224 continue;
204 } 225 }
205 226
206 if (!strcmp (var, "on")) 227 if (!strcmp (var, "on"))
207 { 228 {
208 if (!::thisnode 229 if (!::thisnode
… …
223 else 244 else
224 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line); 245 slog (L_WARN, "'%s': %s, at '%s' line %d", val, UNKNOWN_LOGLEVEL, fname, line);
225 } 246 }
226 else if (!strcmp (var, "ip-proto")) 247 else if (!strcmp (var, "ip-proto"))
227 ip_proto = atoi (val); 248 ip_proto = atoi (val);
249 else if (!strcmp (var, "icmp-type"))
250 {
251#if ENABLE_ICMP
252 icmp_type = atoi (val);
253#endif
254 }
228 255
229 // per config 256 // per config
230 else if (!strcmp (var, "node")) 257 else if (!strcmp (var, "node"))
231 { 258 {
232 default_node.id++; 259 default_node.id++;
… …
250 277
251 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL)) 278 if (!PEM_read_RSAPublicKey(f, &node->rsa_key, NULL, NULL))
252 { 279 {
253 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 280 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
254 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 281 slog (L_ERR, _("unable to open public rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
255 exit (1); 282 exit (EXIT_FAILURE);
256 } 283 }
257 284
258 RSA_blinding_on (node->rsa_key, 0); 285 require (RSA_blinding_on (node->rsa_key, 0));
259 286
260 fclose (f); 287 fclose (f);
261 } 288 }
262 else 289 else
263 { 290 {
264 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno)); 291 slog (need_keys ? L_ERR : L_NOTICE, _("unable to read public rsa key file '%s': %s"), fname, strerror (errno));
265 292
266 if (need_keys) 293 if (need_keys)
267 exit (1); 294 exit (EXIT_FAILURE);
268 } 295 }
269 296
270 free (fname); 297 free (fname);
271 } 298 }
272 299
273 if (!::thisnode || !strcmp (node->nodename, ::thisnode)) 300 if (::thisnode && !strcmp (node->nodename, ::thisnode))
274 thisnode = node; 301 thisnode = node;
275 } 302 }
276 else if (!strcmp (var, "private-key")) 303 else if (!strcmp (var, "private-key"))
277 prikeyfile = strdup (val); 304 free (prikeyfile), prikeyfile = strdup (val);
278 else if (!strcmp (var, "ifpersist")) 305 else if (!strcmp (var, "ifpersist"))
279 {
280 parse_bool (ifpersist, "ifpersist", true, false); 306 parse_bool (ifpersist, "ifpersist", true, false);
281 }
282 else if (!strcmp (var, "ifname")) 307 else if (!strcmp (var, "ifname"))
283 ifname = strdup (val); 308 free (ifname), ifname = strdup (val);
284 else if (!strcmp (var, "rekey")) 309 else if (!strcmp (var, "rekey"))
285 rekey = atoi (val); 310 rekey = atoi (val);
286 else if (!strcmp (var, "keepalive")) 311 else if (!strcmp (var, "keepalive"))
287 keepalive = atoi (val); 312 keepalive = atoi (val);
288 else if (!strcmp (var, "mtu")) 313 else if (!strcmp (var, "mtu"))
289 mtu = atoi (val); 314 mtu = atoi (val);
290 else if (!strcmp (var, "if-up")) 315 else if (!strcmp (var, "if-up"))
291 script_if_up = strdup (val); 316 free (script_if_up), script_if_up = strdup (val);
292 else if (!strcmp (var, "node-up")) 317 else if (!strcmp (var, "node-up"))
293 script_node_up = strdup (val); 318 free (script_node_up), script_node_up = strdup (val);
294 else if (!strcmp (var, "node-down")) 319 else if (!strcmp (var, "node-down"))
295 script_node_down = strdup (val); 320 free (script_node_down), script_node_down = strdup (val);
321 else if (!strcmp (var, "pid-file"))
322 free (pidfilename), pidfilename = strdup (val);
323 else if (!strcmp (var, "dns-forw-host"))
324 {
325#if ENABLE_DNS
326 free (dns_forw_host), dns_forw_host = strdup (val);
327#endif
328 }
329 else if (!strcmp (var, "dns-forw-port"))
330 {
331#if ENABLE_DNS
332 dns_forw_port = atoi (val);
333#endif
334 }
335 else if (!strcmp (var, "http-proxy-host"))
336 {
296#if ENABLE_HTTP_PROXY 337#if ENABLE_HTTP_PROXY
297 else if (!strcmp (var, "http-proxy-host"))
298 proxy_host = strdup (val); 338 free (proxy_host), proxy_host = strdup (val);
339#endif
340 }
299 else if (!strcmp (var, "http-proxy-port")) 341 else if (!strcmp (var, "http-proxy-port"))
342 {
343#if ENABLE_HTTP_PROXY
300 proxy_port = atoi (val); 344 proxy_port = atoi (val);
345#endif
346 }
301 else if (!strcmp (var, "http-proxy-auth")) 347 else if (!strcmp (var, "http-proxy-auth"))
348 {
349#if ENABLE_HTTP_PROXY
302 proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val)); 350 proxy_auth = (char *)base64_encode ((const u8 *)val, strlen (val));
303#endif 351#endif
352 }
304 353
305 /* node-specific, non-defaultable */ 354 /* node-specific, non-defaultable */
306 else if (node != &default_node && !strcmp (var, "hostname")) 355 else if (node != &default_node && !strcmp (var, "hostname"))
307 {
308 free (node->hostname);
309 node->hostname = strdup (val); 356 free (node->hostname), node->hostname = strdup (val);
310 }
311 357
312 /* node-specific, defaultable */ 358 /* node-specific, defaultable */
313 else if (!strcmp (var, "udp-port")) 359 else if (!strcmp (var, "udp-port"))
314 node->udp_port = atoi (val); 360 node->udp_port = atoi (val);
315 else if (!strcmp (var, "tcp-port")) 361 else if (!strcmp (var, "tcp-port"))
316 node->tcp_port = atoi (val); 362 node->tcp_port = atoi (val);
363 else if (!strcmp (var, "dns-hostname"))
364 {
365#if ENABLE_DNS
366 free (node->dns_hostname), node->dns_hostname = strdup (val);
367#endif
368 }
369 else if (!strcmp (var, "dns-port"))
370 {
371#if ENABLE_DNS
372 node->dns_port = atoi (val);
373#endif
374 }
375 else if (!strcmp (var, "dns-domain"))
376 {
377#if ENABLE_DNS
378 free (node->domain), node->domain = strdup (val);
379#endif
380 }
317 else if (!strcmp (var, "router-priority")) 381 else if (!strcmp (var, "router-priority"))
318 node->routerprio = atoi (val); 382 node->routerprio = atoi (val);
383 else if (!strcmp (var, "max-retry"))
384 node->max_retry = atoi (val);
319 else if (!strcmp (var, "connect")) 385 else if (!strcmp (var, "connect"))
320 { 386 {
321 if (!strcmp (val, "ondemand")) 387 if (!strcmp (val, "ondemand"))
322 node->connectmode = conf_node::C_ONDEMAND; 388 node->connectmode = conf_node::C_ONDEMAND;
323 else if (!strcmp (val, "never")) 389 else if (!strcmp (val, "never"))
… …
326 node->connectmode = conf_node::C_ALWAYS; 392 node->connectmode = conf_node::C_ALWAYS;
327 else if (!strcmp (val, "disabled")) 393 else if (!strcmp (val, "disabled"))
328 node->connectmode = conf_node::C_DISABLED; 394 node->connectmode = conf_node::C_DISABLED;
329 else 395 else
330 slog (L_WARN, 396 slog (L_WARN,
331 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d"), 397 _("illegal value for 'connectmode', use one of 'ondemand', 'never', 'always' or 'disabled', at '%s' line %d, ignoring."),
332 var, fname, lineno); 398 var, fname, lineno);
333 } 399 }
334 else if (!strcmp (var, "inherit-tos")) 400 else if (!strcmp (var, "inherit-tos"))
335 {
336 parse_bool (node->inherit_tos, "inherit-tos", true, false); 401 parse_bool (node->inherit_tos, "inherit-tos", true, false);
337 }
338 else if (!strcmp (var, "compress")) 402 else if (!strcmp (var, "compress"))
339 {
340 parse_bool (node->compress, "compress", true, false); 403 parse_bool (node->compress, "compress", true, false);
341 }
342 // all these bool options really really cost a lot of executable size! 404 // all these bool options really really cost a lot of executable size!
343 else if (!strcmp (var, "enable-tcp")) 405 else if (!strcmp (var, "enable-tcp"))
344 { 406 {
345#if ENABLE_TCP 407#if ENABLE_TCP
346 u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v; 408 u8 v; parse_bool (v, "enable-tcp" , PROT_TCPv4, 0); node->protocols = (node->protocols & ~PROT_TCPv4) | v;
409#endif
410 }
411 else if (!strcmp (var, "enable-icmp"))
412 {
413#if ENABLE_ICMP
414 u8 v; parse_bool (v, "enable-icmp" , PROT_ICMPv4, 0); node->protocols = (node->protocols & ~PROT_ICMPv4) | v;
415#endif
416 }
417 else if (!strcmp (var, "enable-dns"))
418 {
419#if ENABLE_DNS
420 u8 v; parse_bool (v, "enable-dns" , PROT_DNSv4, 0); node->protocols = (node->protocols & ~PROT_DNSv4) | v;
347#endif 421#endif
348 } 422 }
349 else if (!strcmp (var, "enable-udp")) 423 else if (!strcmp (var, "enable-udp"))
350 { 424 {
351 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v; 425 u8 v; parse_bool (v, "enable-udp" , PROT_UDPv4, 0); node->protocols = (node->protocols & ~PROT_UDPv4) | v;
… …
356 } 430 }
357 431
358 // unknown or misplaced 432 // unknown or misplaced
359 else 433 else
360 slog (L_WARN, 434 slog (L_WARN,
361 _("unknown or misplaced variable `%s', at '%s' line %d"), 435 _("unknown or misplaced variable `%s', at '%s' line %d, skipping."),
362 var, fname, lineno); 436 var, fname, lineno);
363 } 437 }
364 438
365 fclose (f); 439 fclose (f);
366 } 440 }
367 else 441 else
368 { 442 {
369 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno)); 443 slog (L_ERR, _("unable to read config file '%s': %s"), fname, strerror (errno));
370 exit (1); 444 exit (EXIT_FAILURE);
371 } 445 }
372 446
373 free (fname); 447 free (fname);
374 448
375 fname = config_filename (prikeyfile, "hostkey"); 449 fname = config_filename (prikeyfile, "hostkey");
… …
381 455
382 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL)) 456 if (!PEM_read_RSAPrivateKey (f, &rsa_key, NULL, NULL))
383 { 457 {
384 ERR_load_RSA_strings (); ERR_load_PEM_strings (); 458 ERR_load_RSA_strings (); ERR_load_PEM_strings ();
385 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0)); 459 slog (L_ERR, _("unable to read private rsa key file '%s': %s"), fname, ERR_error_string (ERR_get_error (), 0));
386 exit (1); 460 exit (EXIT_FAILURE);
387 } 461 }
388 462
389 RSA_blinding_on (rsa_key, 0); 463 require (RSA_blinding_on (rsa_key, 0));
390 464
391 fclose (f); 465 fclose (f);
392 } 466 }
393 else 467 else
394 { 468 {
395 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno)); 469 slog (need_keys ? L_ERR : L_NOTICE, _("unable to open private rsa key file '%s': %s"), fname, strerror (errno));
396 470
397 if (need_keys) 471 if (need_keys)
398 exit (1); 472 exit (EXIT_FAILURE);
399 } 473 }
474
475 if (need_keys && ::thisnode
476 && rsa_key && thisnode && thisnode->rsa_key)
477 if (BN_cmp (rsa_key->n, thisnode->rsa_key->n) != 0
478 || BN_cmp (rsa_key->e, thisnode->rsa_key->e) != 0)
479 {
480 slog (L_NOTICE, _("private hostkey and public node key mismatch: is '%s' the correct node?"), ::thisnode);
481 exit (EXIT_FAILURE);
482 }
400 483
401 free (fname); 484 free (fname);
402} 485}
403 486
404char *configuration::config_filename (const char *name, const char *dflt) 487char *configuration::config_filename (const char *name, const char *dflt)
… …
426 printf (_("MTU: %d\n"), mtu); 509 printf (_("MTU: %d\n"), mtu);
427 printf (_("rekeying interval: %d\n"), rekey); 510 printf (_("rekeying interval: %d\n"), rekey);
428 printf (_("keepalive interval: %d\n"), keepalive); 511 printf (_("keepalive interval: %d\n"), keepalive);
429 printf (_("interface: %s\n"), ifname); 512 printf (_("interface: %s\n"), ifname);
430 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>"); 513 printf (_("primary rsa key: %s\n"), prikeyfile ? prikeyfile : "<default>");
431 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) : -1); 514 printf (_("rsa key size: %d\n"), rsa_key ? RSA_size (rsa_key) * 8 : -1);
432 printf ("\n"); 515 printf ("\n");
433 516
434 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n", 517 printf ("%4s %-17s %s %-8.8s %-10.10s %s\n",
435 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port")); 518 _("ID#"), _("MAC"), _("Com"), _("Conmode"), _("Node"), _("Host:Port"));
436 519
… …
440 printf ("\n"); 523 printf ("\n");
441} 524}
442 525
443configuration::configuration () 526configuration::configuration ()
444{ 527{
528 asprintf (&confbase, "%s/gvpe", CONFDIR);
529
445 init (); 530 init ();
446} 531}
447 532
448configuration::~configuration () 533configuration::~configuration ()
449{ 534{

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines