X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fnet_setup.c;h=44c8d8dca3e3e2dbba197d9457caa409f412ca9e;hb=7ea85043ac1fb2096baea44f6b0af27ac0d0b2cf;hp=4407cd4f7353235b0237e8f1a85806cd44e6e52a;hpb=01f47c46af514a9d7f39c143e4558a8426a0d3eb;p=tinc diff --git a/src/net_setup.c b/src/net_setup.c index 4407cd4f..44c8d8dc 100644 --- a/src/net_setup.c +++ b/src/net_setup.c @@ -1,7 +1,8 @@ /* net_setup.c -- Setup. Copyright (C) 1998-2005 Ivo Timmermans, - 2000-2006 Guus Sliepen + 2000-2009 Guus Sliepen + 2006 Scott Lamb This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -13,26 +14,20 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - - $Id$ + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. */ #include "system.h" -#include -#include -#include -#include -#include - #include "splay_tree.h" +#include "cipher.h" #include "conf.h" #include "connection.h" #include "control.h" #include "device.h" +#include "digest.h" #include "graph.h" #include "logger.h" #include "net.h" @@ -40,6 +35,7 @@ #include "process.h" #include "protocol.h" #include "route.h" +#include "rsa.h" #include "subnet.h" #include "utils.h" #include "xalloc.h" @@ -50,161 +46,94 @@ static struct event device_ev; bool read_rsa_public_key(connection_t *c) { FILE *fp; char *fname; - char *key; - - cp(); - - if(!c->rsa_key) { - c->rsa_key = RSA_new(); -// RSA_blinding_on(c->rsa_key, NULL); - } + char *n; + bool result; /* First, check for simple PublicKey statement */ - if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &key)) { - BN_hex2bn(&c->rsa_key->n, key); - BN_hex2bn(&c->rsa_key->e, "FFFF"); - free(key); - return true; + if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &n)) { + result = rsa_set_hex_public_key(&c->rsa, n, "FFFF"); + free(n); + return result; } /* Else, check for PublicKeyFile statement and read it */ - if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname)) { - fp = fopen(fname, "r"); - - if(!fp) { - logger(LOG_ERR, _("Error reading RSA public key file `%s': %s"), - fname, strerror(errno)); - free(fname); - return false; - } - - free(fname); - c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); - fclose(fp); - - if(c->rsa_key) - return true; /* Woohoo. */ + if(!get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname)) + xasprintf(&fname, "%s/hosts/%s", confbase, c->name); - /* If it fails, try PEM_read_RSA_PUBKEY. */ - fp = fopen(fname, "r"); - - if(!fp) { - logger(LOG_ERR, _("Error reading RSA public key file `%s': %s"), - fname, strerror(errno)); - free(fname); - return false; - } - - free(fname); - c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); - fclose(fp); - - if(c->rsa_key) { -// RSA_blinding_on(c->rsa_key, NULL); - return true; - } + fp = fopen(fname, "r"); - logger(LOG_ERR, _("Reading RSA public key file `%s' failed: %s"), + if(!fp) { + logger(LOG_ERR, "Error reading RSA public key file `%s': %s", fname, strerror(errno)); + free(fname); return false; } - /* Else, check if a harnessed public key is in the config file */ - - asprintf(&fname, "%s/hosts/%s", confbase, c->name); - fp = fopen(fname, "r"); - - if(fp) { - c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); - fclose(fp); - } - - free(fname); - - if(c->rsa_key) - return true; - - /* Try again with PEM_read_RSA_PUBKEY. */ - - asprintf(&fname, "%s/hosts/%s", confbase, c->name); - fp = fopen(fname, "r"); - - if(fp) { - c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); -// RSA_blinding_on(c->rsa_key, NULL); - fclose(fp); - } + result = rsa_read_pem_public_key(&c->rsa, fp); + fclose(fp); + if(!result) + logger(LOG_ERR, "Reading RSA public key file `%s' failed: %s", fname, strerror(errno)); free(fname); - - if(c->rsa_key) - return true; - - logger(LOG_ERR, _("No public key for %s specified!"), c->name); - - return false; + return result; } -bool read_rsa_private_key(void) { +bool read_rsa_private_key() { FILE *fp; - char *fname, *key, *pubkey; - struct stat s; + char *fname; + char *n, *d; + bool result; - cp(); + /* First, check for simple PrivateKey statement */ - if(get_config_string(lookup_config(config_tree, "PrivateKey"), &key)) { - if(!get_config_string(lookup_config(myself->connection->config_tree, "PublicKey"), &pubkey)) { - logger(LOG_ERR, _("PrivateKey used but no PublicKey found!")); + if(get_config_string(lookup_config(config_tree, "PrivateKey"), &d)) { + if(!get_config_string(lookup_config(myself->connection->config_tree, "PublicKey"), &n)) { + logger(LOG_ERR, "PrivateKey used but no PublicKey found!"); + free(d); return false; } - myself->connection->rsa_key = RSA_new(); -// RSA_blinding_on(myself->connection->rsa_key, NULL); - BN_hex2bn(&myself->connection->rsa_key->d, key); - BN_hex2bn(&myself->connection->rsa_key->n, pubkey); - BN_hex2bn(&myself->connection->rsa_key->e, "FFFF"); - free(key); - free(pubkey); + result = rsa_set_hex_private_key(&myself->connection->rsa, n, "FFFF", d); + free(n); + free(d); return true; } + /* Else, check for PrivateKeyFile statement and read it */ + if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname)) - asprintf(&fname, "%s/rsa_key.priv", confbase); + xasprintf(&fname, "%s/rsa_key.priv", confbase); fp = fopen(fname, "r"); if(!fp) { - logger(LOG_ERR, _("Error reading RSA private key file `%s': %s"), + logger(LOG_ERR, "Error reading RSA private key file `%s': %s", fname, strerror(errno)); free(fname); return false; } #if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN) + struct stat s; + if(fstat(fileno(fp), &s)) { - logger(LOG_ERR, _("Could not stat RSA private key file `%s': %s'"), - fname, strerror(errno)); + logger(LOG_ERR, "Could not stat RSA private key file `%s': %s'", fname, strerror(errno)); free(fname); return false; } if(s.st_mode & ~0100700) - logger(LOG_WARNING, _("Warning: insecure file permissions for RSA private key file `%s'!"), fname); + logger(LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname); #endif - myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL); + result = rsa_read_pem_private_key(&myself->connection->rsa, fp); fclose(fp); - if(!myself->connection->rsa_key) { - logger(LOG_ERR, _("Reading RSA private key file `%s' failed: %s"), - fname, strerror(errno)); - free(fname); - return false; - } - + if(!result) + logger(LOG_ERR, "Reading RSA private key file `%s' failed: %s", fname, strerror(errno)); free(fname); - return true; + return result; } static struct event keyexpire_event; @@ -214,10 +143,8 @@ static void keyexpire_handler(int fd, short events, void *data) { } void regenerate_key() { - RAND_pseudo_bytes((unsigned char *)myself->key, myself->keylength); - if(timeout_initialized(&keyexpire_event)) { - ifdebug(STATUS) logger(LOG_INFO, _("Regenerating symmetric key")); + ifdebug(STATUS) logger(LOG_INFO, "Expiring symmetric keys"); event_del(&keyexpire_event); send_key_changed(broadcast, myself); } else { @@ -225,16 +152,6 @@ void regenerate_key() { } event_add(&keyexpire_event, &(struct timeval){keylifetime, 0}); - - if(myself->cipher) { - EVP_CIPHER_CTX_init(&packet_ctx); - if(!EVP_DecryptInit_ex(&packet_ctx, myself->cipher, NULL, (unsigned char *)myself->key, (unsigned char *)myself->key + myself->cipher->key_len)) { - logger(LOG_ERR, _("Error during initialisation of cipher for %s (%s): %s"), - myself->name, myself->hostname, ERR_error_string(ERR_get_error(), NULL)); - abort(); - } - - } } /* @@ -250,25 +167,23 @@ bool setup_myself(void) { bool choice; int i, err; - cp(); - myself = new_node(); myself->connection = new_connection(); init_configuration(&myself->connection->config_tree); - asprintf(&myself->hostname, _("MYSELF")); - asprintf(&myself->connection->hostname, _("MYSELF")); + xasprintf(&myself->hostname, "MYSELF"); + xasprintf(&myself->connection->hostname, "MYSELF"); myself->connection->options = 0; myself->connection->protocol_version = PROT_CURRENT; if(!get_config_string(lookup_config(config_tree, "Name"), &name)) { /* Not acceptable */ - logger(LOG_ERR, _("Name for tinc daemon required!")); + logger(LOG_ERR, "Name for tinc daemon required!"); return false; } if(!check_id(name)) { - logger(LOG_ERR, _("Invalid name for myself!")); + logger(LOG_ERR, "Invalid name for myself!"); free(name); return false; } @@ -277,7 +192,7 @@ bool setup_myself(void) { myself->connection->name = xstrdup(name); if(!read_connection_config(myself->connection)) { - logger(LOG_ERR, _("Cannot open host configuration file for myself!")); + logger(LOG_ERR, "Cannot open host configuration file for myself!"); return false; } @@ -285,7 +200,7 @@ bool setup_myself(void) { return false; if(!get_config_string(lookup_config(myself->connection->config_tree, "Port"), &myport)) - asprintf(&myport, "655"); + xasprintf(&myport, "655"); /* Read in all the subnets specified in the host configuration file */ @@ -314,9 +229,6 @@ bool setup_myself(void) { if(get_config_bool(lookup_config(myself->connection->config_tree, "TCPOnly"), &choice) && choice) myself->options |= OPTION_TCPONLY; - if(get_config_bool(lookup_config(myself->connection->config_tree, "PMTUDiscovery"), &choice) && choice) - myself->options |= OPTION_PMTU_DISCOVERY; - if(myself->options & OPTION_TCPONLY) myself->options |= OPTION_INDIRECT; @@ -330,18 +242,25 @@ bool setup_myself(void) { else if(!strcasecmp(mode, "hub")) routing_mode = RMODE_HUB; else { - logger(LOG_ERR, _("Invalid routing mode!")); + logger(LOG_ERR, "Invalid routing mode!"); return false; } free(mode); } else routing_mode = RMODE_ROUTER; + // Enable PMTUDiscovery by default if we are in router mode. + + choice = routing_mode == RMODE_ROUTER; + get_config_bool(lookup_config(myself->connection->config_tree, "PMTUDiscovery"), &choice); + if(choice) + myself->options |= OPTION_PMTU_DISCOVERY; + get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance); #if !defined(SOL_IP) || !defined(IP_TOS) if(priorityinheritance) - logger(LOG_WARNING, _("PriorityInheritance not supported on this platform")); + logger(LOG_WARNING, "%s not supported on this platform", "PriorityInheritance"); #endif if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire)) @@ -349,7 +268,7 @@ bool setup_myself(void) { if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) { if(maxtimeout <= 0) { - logger(LOG_ERR, _("Bogus maximum timeout!")); + logger(LOG_ERR, "Bogus maximum timeout!"); return false; } } else @@ -363,7 +282,7 @@ bool setup_myself(void) { else if(!strcasecmp(afname, "any")) addressfamily = AF_UNSPEC; else { - logger(LOG_ERR, _("Invalid address family!")); + logger(LOG_ERR, "Invalid address family!"); return false; } free(afname); @@ -373,79 +292,46 @@ bool setup_myself(void) { /* Generate packet encryption key */ - if(get_config_string - (lookup_config(myself->connection->config_tree, "Cipher"), &cipher)) { - if(!strcasecmp(cipher, "none")) { - myself->cipher = NULL; - } else { - myself->cipher = EVP_get_cipherbyname(cipher); - - if(!myself->cipher) { - logger(LOG_ERR, _("Unrecognized cipher type!")); - return false; - } - } - } else - myself->cipher = EVP_bf_cbc(); - - if(myself->cipher) - myself->keylength = myself->cipher->key_len + myself->cipher->iv_len; - else - myself->keylength = 1; - - myself->connection->outcipher = EVP_bf_ofb(); + if(!get_config_string(lookup_config(myself->connection->config_tree, "Cipher"), &cipher)) + cipher = xstrdup("aes256"); - myself->key = xmalloc(myself->keylength); + if(!cipher_open_by_name(&myself->incipher, cipher)) { + logger(LOG_ERR, "Unrecognized cipher type!"); + return false; + } if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime)) keylifetime = 3600; regenerate_key(); + /* Check if we want to use message authentication codes... */ - if(get_config_string - (lookup_config(myself->connection->config_tree, "Digest"), &digest)) { - if(!strcasecmp(digest, "none")) { - myself->digest = NULL; - } else { - myself->digest = EVP_get_digestbyname(digest); - - if(!myself->digest) { - logger(LOG_ERR, _("Unrecognized digest type!")); - return false; - } - } - } else - myself->digest = EVP_sha1(); - - myself->connection->outdigest = EVP_sha1(); - - if(get_config_int(lookup_config(myself->connection->config_tree, "MACLength"), - &myself->maclength)) { - if(myself->digest) { - if(myself->maclength > myself->digest->md_size) { - logger(LOG_ERR, _("MAC length exceeds size of digest!")); - return false; - } else if(myself->maclength < 0) { - logger(LOG_ERR, _("Bogus MAC length!")); - return false; - } - } - } else - myself->maclength = 4; + if(!get_config_string(lookup_config(myself->connection->config_tree, "Digest"), &digest)) + digest = xstrdup("sha256"); + + int maclength = 4; + get_config_int(lookup_config(myself->connection->config_tree, "MACLength"), &maclength); + + if(maclength < 0) { + logger(LOG_ERR, "Bogus MAC length!"); + return false; + } - myself->connection->outmaclength = 0; + if(!digest_open_by_name(&myself->indigest, digest, maclength)) { + logger(LOG_ERR, "Unrecognized digest type!"); + return false; + } /* Compression */ - if(get_config_int(lookup_config(myself->connection->config_tree, "Compression"), - &myself->compression)) { - if(myself->compression < 0 || myself->compression > 11) { - logger(LOG_ERR, _("Bogus compression level!")); + if(get_config_int(lookup_config(myself->connection->config_tree, "Compression"), &myself->incompression)) { + if(myself->incompression < 0 || myself->incompression > 11) { + logger(LOG_ERR, "Bogus compression level!"); return false; } } else - myself->compression = 0; + myself->incompression = 0; myself->connection->outcompression = 0; @@ -463,19 +349,19 @@ bool setup_myself(void) { if(!setup_device()) return false; - event_set(&device_ev, device_fd, EV_READ|EV_PERSIST, - handle_device_data, NULL); + event_set(&device_ev, device_fd, EV_READ|EV_PERSIST, handle_device_data, NULL); + if (event_add(&device_ev, NULL) < 0) { - logger(LOG_ERR, _("event_add failed: %s"), strerror(errno)); + logger(LOG_ERR, "event_add failed: %s", strerror(errno)); close_device(); return false; } /* Run tinc-up script to further initialize the tap interface */ - asprintf(&envp[0], "NETNAME=%s", netname ? : ""); - asprintf(&envp[1], "DEVICE=%s", device ? : ""); - asprintf(&envp[2], "INTERFACE=%s", iface ? : ""); - asprintf(&envp[3], "NAME=%s", myself->name); + xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); + xasprintf(&envp[1], "DEVICE=%s", device ? : ""); + xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); + xasprintf(&envp[3], "NAME=%s", myself->name); envp[4] = NULL; execute_script("tinc-up", envp); @@ -499,7 +385,7 @@ bool setup_myself(void) { err = getaddrinfo(address, myport, &hint, &ai); if(err || !ai) { - logger(LOG_ERR, _("System call `%s' failed: %s"), "getaddrinfo", + logger(LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", gai_strerror(err)); return false; } @@ -526,7 +412,7 @@ bool setup_myself(void) { EV_READ|EV_PERSIST, handle_new_meta_connection, NULL); if(event_add(&listen_socket[listen_sockets].ev_tcp, NULL) < 0) { - logger(LOG_EMERG, _("event_add failed: %s"), strerror(errno)); + logger(LOG_EMERG, "event_add failed: %s", strerror(errno)); abort(); } @@ -535,13 +421,13 @@ bool setup_myself(void) { EV_READ|EV_PERSIST, handle_incoming_vpn_data, NULL); if(event_add(&listen_socket[listen_sockets].ev_udp, NULL) < 0) { - logger(LOG_EMERG, _("event_add failed: %s"), strerror(errno)); + logger(LOG_EMERG, "event_add failed: %s", strerror(errno)); abort(); } ifdebug(CONNECTIONS) { hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); - logger(LOG_NOTICE, _("Listening on %s"), hostname); + logger(LOG_NOTICE, "Listening on %s", hostname); free(hostname); } @@ -549,7 +435,7 @@ bool setup_myself(void) { listen_sockets++; if(listen_sockets >= MAXSOCKETS) { - logger(LOG_WARNING, _("Maximum of %d listening sockets reached"), MAXSOCKETS); + logger(LOG_WARNING, "Maximum of %d listening sockets reached", MAXSOCKETS); break; } } @@ -557,9 +443,9 @@ bool setup_myself(void) { freeaddrinfo(ai); if(listen_sockets) - logger(LOG_NOTICE, _("Ready")); + logger(LOG_NOTICE, "Ready"); else { - logger(LOG_ERR, _("Unable to create any listening socket!")); + logger(LOG_ERR, "Unable to create any listening socket!"); return false; } @@ -567,17 +453,14 @@ bool setup_myself(void) { } /* - setup all initial network connections + initialize network */ -bool setup_network_connections(void) { - cp(); - +bool setup_network(void) { init_connections(); init_subnets(); init_nodes(); init_edges(); init_requests(); - init_control(); if(get_config_int(lookup_config(config_tree, "PingInterval"), &pinginterval)) { if(pinginterval < 1) { @@ -592,13 +475,11 @@ bool setup_network_connections(void) { pingtimeout = pinginterval; if(!get_config_int(lookup_config(config_tree, "MaxOutputBufferSize"), &maxoutbufsize)) - maxoutbufsize = 4 * MTU; + maxoutbufsize = 10 * MTU; if(!setup_myself()) return false; - try_outgoing_connections(); - return true; } @@ -611,26 +492,19 @@ void close_network_connections(void) { char *envp[5]; int i; - cp(); - for(node = connection_tree->head; node; node = next) { next = node->next; c = node->data; - - if(c->outgoing) { - if(c->outgoing->ai) - freeaddrinfo(c->outgoing->ai); - free(c->outgoing->name); - free(c->outgoing); - c->outgoing = NULL; - } - + c->outgoing = false; terminate_connection(c, false); } + list_delete_list(outgoing_list); + if(myself && myself->connection) { subnet_update(myself, NULL, false); terminate_connection(myself->connection, false); + free_connection(myself->connection); } for(i = 0; i < listen_sockets; i++) { @@ -640,13 +514,12 @@ void close_network_connections(void) { close(listen_socket[i].udp); } - asprintf(&envp[0], "NETNAME=%s", netname ? : ""); - asprintf(&envp[1], "DEVICE=%s", device ? : ""); - asprintf(&envp[2], "INTERFACE=%s", iface ? : ""); - asprintf(&envp[3], "NAME=%s", myself->name); + xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); + xasprintf(&envp[1], "DEVICE=%s", device ? : ""); + xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); + xasprintf(&envp[3], "NAME=%s", myself->name); envp[4] = NULL; - exit_control(); exit_requests(); exit_edges(); exit_subnets(); @@ -655,6 +528,8 @@ void close_network_connections(void) { execute_script("tinc-down", envp); + if(myport) free(myport); + for(i = 0; i < 4; i++) free(envp[i]);