X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Fnet_setup.c;h=7c9f23a958d3c293cb40a67e27bd7d4b41286a3f;hb=f0e7e6b03e34e69cac5b01a2d943ad3b9b59d36c;hp=8ae1e72bbaafd3d90cd1118c2faa3085b36032cb;hpb=2eba7933053d7d21bf82e647978ee90abe98dc3a;p=tinc diff --git a/src/net_setup.c b/src/net_setup.c index 8ae1e72b..7c9f23a9 100644 --- a/src/net_setup.c +++ b/src/net_setup.c @@ -1,7 +1,7 @@ /* net_setup.c -- Setup. Copyright (C) 1998-2005 Ivo Timmermans, - 2000-2013 Guus Sliepen + 2000-2014 Guus Sliepen 2006 Scott Lamb 2010 Brandon Black @@ -38,6 +38,7 @@ #include "protocol.h" #include "route.h" #include "rsa.h" +#include "script.h" #include "subnet.h" #include "utils.h" #include "xalloc.h" @@ -51,7 +52,7 @@ char *proxyport; char *proxyuser; char *proxypass; proxytype_t proxytype; -int autoconnect; +bool autoconnect; bool disablebuggypeers; char *scriptinterpreter; @@ -70,25 +71,23 @@ bool node_read_ecdsa_public_key(node_t *n) { if(!read_host_config(config_tree, n->name)) goto exit; - /* First, check for simple ECDSAPublicKey statement */ + /* First, check for simple Ed25519PublicKey statement */ - if(get_config_string(lookup_config(config_tree, "ECDSAPublicKey"), &p)) { + if(get_config_string(lookup_config(config_tree, "Ed25519PublicKey"), &p)) { n->ecdsa = ecdsa_set_base64_public_key(p); free(p); goto exit; } - /* Else, check for ECDSAPublicKeyFile statement and read it */ + /* Else, check for Ed25519PublicKeyFile statement and read it */ - if(!get_config_string(lookup_config(config_tree, "ECDSAPublicKeyFile"), &pubname)) + if(!get_config_string(lookup_config(config_tree, "Ed25519PublicKeyFile"), &pubname)) xasprintf(&pubname, "%s" SLASH "hosts" SLASH "%s", confbase, n->name); fp = fopen(pubname, "r"); - if(!fp) { - logger(DEBUG_ALWAYS, LOG_ERR, "Error reading ECDSA public key file `%s': %s", pubname, strerror(errno)); + if(!fp) goto exit; - } n->ecdsa = ecdsa_read_pem_public_key(fp); fclose(fp); @@ -113,23 +112,23 @@ bool read_ecdsa_public_key(connection_t *c) { return false; } - /* First, check for simple ECDSAPublicKey statement */ + /* First, check for simple Ed25519PublicKey statement */ - if(get_config_string(lookup_config(c->config_tree, "ECDSAPublicKey"), &p)) { + if(get_config_string(lookup_config(c->config_tree, "Ed25519PublicKey"), &p)) { c->ecdsa = ecdsa_set_base64_public_key(p); free(p); return c->ecdsa; } - /* Else, check for ECDSAPublicKeyFile statement and read it */ + /* Else, check for Ed25519PublicKeyFile statement and read it */ - if(!get_config_string(lookup_config(c->config_tree, "ECDSAPublicKeyFile"), &fname)) + if(!get_config_string(lookup_config(c->config_tree, "Ed25519PublicKeyFile"), &fname)) xasprintf(&fname, "%s" SLASH "hosts" SLASH "%s", confbase, c->name); fp = fopen(fname, "r"); if(!fp) { - logger(DEBUG_ALWAYS, LOG_ERR, "Error reading ECDSA public key file `%s': %s", + logger(DEBUG_ALWAYS, LOG_ERR, "Error reading Ed25519 public key file `%s': %s", fname, strerror(errno)); free(fname); return false; @@ -139,7 +138,7 @@ bool read_ecdsa_public_key(connection_t *c) { fclose(fp); if(!c->ecdsa) - logger(DEBUG_ALWAYS, LOG_ERR, "Parsing ECDSA public key file `%s' failed.", fname); + logger(DEBUG_ALWAYS, LOG_ERR, "Parsing Ed25519 public key file `%s' failed.", fname); free(fname); return c->ecdsa; } @@ -188,15 +187,15 @@ static bool read_ecdsa_private_key(void) { /* Check for PrivateKeyFile statement and read it */ - if(!get_config_string(lookup_config(config_tree, "ECDSAPrivateKeyFile"), &fname)) - xasprintf(&fname, "%s" SLASH "ecdsa_key.priv", confbase); + if(!get_config_string(lookup_config(config_tree, "Ed25519PrivateKeyFile"), &fname)) + xasprintf(&fname, "%s" SLASH "ed25519_key.priv", confbase); fp = fopen(fname, "r"); if(!fp) { - logger(DEBUG_ALWAYS, LOG_ERR, "Error reading ECDSA private key file `%s': %s", fname, strerror(errno)); + logger(DEBUG_ALWAYS, LOG_ERR, "Error reading Ed25519 private key file `%s': %s", fname, strerror(errno)); if(errno == ENOENT) - logger(DEBUG_ALWAYS, LOG_INFO, "Create an ECDSA keypair with `tinc -n %s generate-ecdsa-keys'.", netname ?: "."); + logger(DEBUG_ALWAYS, LOG_INFO, "Create an Ed25519 keypair with `tinc -n %s generate-ed25519-keys'.", netname ?: "."); free(fname); return false; } @@ -205,20 +204,20 @@ static bool read_ecdsa_private_key(void) { struct stat s; if(fstat(fileno(fp), &s)) { - logger(DEBUG_ALWAYS, LOG_ERR, "Could not stat ECDSA private key file `%s': %s'", fname, strerror(errno)); + logger(DEBUG_ALWAYS, LOG_ERR, "Could not stat Ed25519 private key file `%s': %s'", fname, strerror(errno)); free(fname); return false; } if(s.st_mode & ~0100700) - logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: insecure file permissions for ECDSA private key file `%s'!", fname); + logger(DEBUG_ALWAYS, LOG_WARNING, "Warning: insecure file permissions for Ed25519 private key file `%s'!", fname); #endif myself->connection->ecdsa = ecdsa_read_pem_private_key(fp); fclose(fp); if(!myself->connection->ecdsa) - logger(DEBUG_ALWAYS, LOG_ERR, "Reading ECDSA private key file `%s' failed: %s", fname, strerror(errno)); + logger(DEBUG_ALWAYS, LOG_ERR, "Reading Ed25519 private key file `%s' failed", fname); free(fname); return myself->connection->ecdsa; } @@ -232,7 +231,7 @@ static bool read_invitation_key(void) { invitation_key = NULL; } - xasprintf(&fname, "%s" SLASH "invitations" SLASH "ecdsa_key.priv", confbase); + xasprintf(&fname, "%s" SLASH "invitations" SLASH "ed25519_key.priv", confbase); fp = fopen(fname, "r"); @@ -240,7 +239,7 @@ static bool read_invitation_key(void) { invitation_key = ecdsa_read_pem_private_key(fp); fclose(fp); if(!invitation_key) - logger(DEBUG_ALWAYS, LOG_ERR, "Reading ECDSA private key file `%s' failed: %s", fname, strerror(errno)); + logger(DEBUG_ALWAYS, LOG_ERR, "Reading Ed25519 private key file `%s' failed", fname); } free(fname); @@ -410,17 +409,18 @@ char *get_name(void) { if(*name == '$') { char *envname = getenv(name + 1); + char hostname[32] = ""; if(!envname) { if(strcmp(name + 1, "HOST")) { logger(DEBUG_ALWAYS, LOG_ERR, "Invalid Name: environment variable %s does not exist\n", name + 1); return false; } - char envname[32]; - if(gethostname(envname, 32)) { + if(gethostname(hostname, sizeof hostname) || !*hostname) { logger(DEBUG_ALWAYS, LOG_ERR, "Could not get hostname: %s\n", strerror(errno)); return false; } - envname[31] = 0; + hostname[31] = 0; + envname = hostname; } free(name); name = xstrdup(envname); @@ -455,11 +455,7 @@ bool setup_myself_reloadable(void) { free(scriptextension); if(!get_config_string(lookup_config(config_tree, "ScriptsExtension"), &scriptextension)) -#ifdef HAVE_MINGW - scriptextension = xstrdup(".bat"); -#else scriptextension = xstrdup(""); -#endif get_config_string(lookup_config(config_tree, "Proxy"), &proxy); if(proxy) { @@ -634,7 +630,15 @@ bool setup_myself_reloadable(void) { if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime)) keylifetime = 3600; - get_config_int(lookup_config(config_tree, "AutoConnect"), &autoconnect); + config_t *cfg = lookup_config(config_tree, "AutoConnect"); + if(cfg) { + if(!get_config_bool(cfg, &autoconnect)) { + // Some backwards compatibility with when this option was an int + int val = 0; + get_config_int(cfg, &val); + autoconnect = val; + } + } get_config_bool(lookup_config(config_tree, "DisableBuggyPeers"), &disablebuggypeers); @@ -643,12 +647,92 @@ bool setup_myself_reloadable(void) { return true; } +/* + Add listening sockets. +*/ +static bool add_listen_address(char *address, bool bindto) { + char *port = myport; + + if(address) { + char *space = strchr(address, ' '); + if(space) { + *space++ = 0; + port = space; + } + + if(!strcmp(address, "*")) + *address = 0; + } + + struct addrinfo *ai, hint = {0}; + hint.ai_family = addressfamily; + hint.ai_socktype = SOCK_STREAM; + hint.ai_protocol = IPPROTO_TCP; + hint.ai_flags = AI_PASSIVE; + + int err = getaddrinfo(address && *address ? address : NULL, port, &hint, &ai); + free(address); + + if(err || !ai) { + logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", err == EAI_SYSTEM ? strerror(err) : gai_strerror(err)); + return false; + } + + for(struct addrinfo *aip = ai; aip; aip = aip->ai_next) { + // Ignore duplicate addresses + bool found = false; + + for(int i = 0; i < listen_sockets; i++) + if(!memcmp(&listen_socket[i].sa, aip->ai_addr, aip->ai_addrlen)) { + found = true; + break; + } + + if(found) + continue; + + if(listen_sockets >= MAXSOCKETS) { + logger(DEBUG_ALWAYS, LOG_ERR, "Too many listening sockets"); + return false; + } + + int tcp_fd = setup_listen_socket((sockaddr_t *) aip->ai_addr); + + if(tcp_fd < 0) + continue; + + int udp_fd = setup_vpn_in_socket((sockaddr_t *) aip->ai_addr); + + if(tcp_fd < 0) { + close(tcp_fd); + continue; + } + + io_add(&listen_socket[listen_sockets].tcp, handle_new_meta_connection, &listen_socket[listen_sockets], tcp_fd, IO_READ); + io_add(&listen_socket[listen_sockets].udp, handle_incoming_vpn_data, &listen_socket[listen_sockets], udp_fd, IO_READ); + + if(debug_level >= DEBUG_CONNECTIONS) { + char *hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); + logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Listening on %s", hostname); + free(hostname); + } + + listen_socket[listen_sockets].bindto = bindto; + memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen); + listen_sockets++; + } + + freeaddrinfo(ai); + return true; +} + /* Configure node_t myself and set up the local sockets (listen only) */ static bool setup_myself(void) { char *name, *hostname, *cipher, *digest, *type; char *address = NULL; + bool port_specified = false; if(!(name = get_name())) { logger(DEBUG_ALWAYS, LOG_ERR, "Name for tinc daemon required!"); @@ -663,9 +747,8 @@ static bool setup_myself(void) { if(!get_config_string(lookup_config(config_tree, "Port"), &myport)) myport = xstrdup("655"); - - xasprintf(&myself->hostname, "MYSELF port %s", myport); - myself->connection->hostname = xstrdup(myself->hostname); + else + port_specified = true; myself->connection->options = 0; myself->connection->protocol_major = PROT_MAJOR; @@ -673,14 +756,20 @@ static bool setup_myself(void) { myself->options |= PROT_MINOR << 24; - get_config_bool(lookup_config(config_tree, "ExperimentalProtocol"), &experimental); - - if(experimental && !read_ecdsa_private_key()) - return false; + if(!get_config_bool(lookup_config(config_tree, "ExperimentalProtocol"), &experimental)) { + experimental = read_ecdsa_private_key(); + if(!experimental) + logger(DEBUG_ALWAYS, LOG_WARNING, "Support for SPTPS disabled."); + } else { + if(experimental && !read_ecdsa_private_key()) + return false; + } if(!read_rsa_private_key()) return false; + /* Ensure myport is numeric */ + if(!atoi(myport)) { struct addrinfo *ai = str2addrinfo("localhost", myport, SOCK_DGRAM); sockaddr_t sa; @@ -711,7 +800,12 @@ static bool setup_myself(void) { get_config_bool(lookup_config(config_tree, "TunnelServer"), &tunnelserver); strictsubnets |= tunnelserver; - + if(get_config_int(lookup_config(config_tree, "MaxConnectionBurst"), &max_connection_burst)) { + if(max_connection_burst <= 0) { + logger(DEBUG_ALWAYS, LOG_ERR, "MaxConnectionBurst cannot be negative!"); + return false; + } + } if(get_config_int(lookup_config(config_tree, "UDPRcvBuf"), &udp_rcvbuf)) { if(udp_rcvbuf <= 0) { @@ -742,14 +836,15 @@ static bool setup_myself(void) { if(!get_config_string(lookup_config(config_tree, "Cipher"), &cipher)) cipher = xstrdup("blowfish"); - if(!(myself->incipher = cipher_open_by_name(cipher))) { + if(!strcasecmp(cipher, "none")) { + myself->incipher = NULL; + } else if(!(myself->incipher = cipher_open_by_name(cipher))) { logger(DEBUG_ALWAYS, LOG_ERR, "Unrecognized cipher type!"); return false; } free(cipher); - send_key_changed(); timeout_add(&keyexpire_timeout, keyexpire_handler, &keyexpire_timeout, &(struct timeval){keylifetime, rand() % 100000}); /* Check if we want to use message authentication codes... */ @@ -765,7 +860,9 @@ static bool setup_myself(void) { if(!get_config_string(lookup_config(config_tree, "Digest"), &digest)) digest = xstrdup("sha1"); - if(!(myself->indigest = digest_open_by_name(digest, maclength))) { + if(!strcasecmp(digest, "none")) { + myself->indigest = NULL; + } else if(!(myself->indigest = digest_open_by_name(digest, maclength))) { logger(DEBUG_ALWAYS, LOG_ERR, "Unrecognized digest type!"); return false; } @@ -827,55 +924,8 @@ static bool setup_myself(void) { if(device_fd >= 0) io_add(&device_io, handle_device_data, NULL, device_fd, IO_READ); - /* Run tinc-up script to further initialize the tap interface */ - char *envp[5] = {NULL}; - xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); - xasprintf(&envp[1], "DEVICE=%s", device ? : ""); - xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); - xasprintf(&envp[3], "NAME=%s", myself->name); - - execute_script("tinc-up", envp); - - for(int i = 0; i < 4; i++) - free(envp[i]); - - /* Run subnet-up scripts for our own subnets */ - - subnet_update(myself, NULL, true); - /* Open sockets */ -#ifndef HAVE_MINGW - int unix_fd = socket(AF_UNIX, SOCK_STREAM, 0); - if(unix_fd < 0) { - logger(DEBUG_ALWAYS, LOG_ERR, "Could not create UNIX socket: %s", sockstrerror(errno)); - return false; - } - - struct sockaddr_un sa; - sa.sun_family = AF_UNIX; - strncpy(sa.sun_path, unixsocketname, sizeof sa.sun_path); - - if(connect(unix_fd, (struct sockaddr *)&sa, sizeof sa) >= 0) { - logger(DEBUG_ALWAYS, LOG_ERR, "UNIX socket %s is still in use!", unixsocketname); - return false; - } - - unlink(unixsocketname); - - if(bind(unix_fd, (struct sockaddr *)&sa, sizeof sa) < 0) { - logger(DEBUG_ALWAYS, LOG_ERR, "Could not bind UNIX socket to %s: %s", unixsocketname, sockstrerror(errno)); - return false; - } - - if(listen(unix_fd, 3) < 0) { - logger(DEBUG_ALWAYS, LOG_ERR, "Could not listen on UNIX socket %s: %s", unixsocketname, sockstrerror(errno)); - return false; - } - - io_add(&unix_socket, handle_new_unix_connection, &unix_socket, unix_fd, IO_READ); -#endif - if(!do_detach && getenv("LISTEN_FDS")) { sockaddr_t sa; socklen_t salen; @@ -918,82 +968,50 @@ static bool setup_myself(void) { } } else { listen_sockets = 0; - config_t *cfg = lookup_config(config_tree, "BindToAddress"); + int cfgs = 0; - do { + for(config_t *cfg = lookup_config(config_tree, "BindToAddress"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + cfgs++; get_config_string(cfg, &address); - if(cfg) - cfg = lookup_config_next(config_tree, cfg); - - char *port = myport; - - if(address) { - char *space = strchr(address, ' '); - if(space) { - *space++ = 0; - port = space; - } - - if(!strcmp(address, "*")) - *address = 0; - } - - struct addrinfo *ai, hint = {0}; - hint.ai_family = addressfamily; - hint.ai_socktype = SOCK_STREAM; - hint.ai_protocol = IPPROTO_TCP; - hint.ai_flags = AI_PASSIVE; - - int err = getaddrinfo(address && *address ? address : NULL, port, &hint, &ai); - free(address); - - if(err || !ai) { - logger(DEBUG_ALWAYS, LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", err == EAI_SYSTEM ? strerror(err) : gai_strerror(err)); + if(!add_listen_address(address, true)) return false; - } - - for(struct addrinfo *aip = ai; aip; aip = aip->ai_next) { - if(listen_sockets >= MAXSOCKETS) { - logger(DEBUG_ALWAYS, LOG_ERR, "Too many listening sockets"); - return false; - } - - int tcp_fd = setup_listen_socket((sockaddr_t *) aip->ai_addr); - - if(tcp_fd < 0) - continue; - - int udp_fd = setup_vpn_in_socket((sockaddr_t *) aip->ai_addr); - - if(tcp_fd < 0) { - close(tcp_fd); - continue; - } - - io_add(&listen_socket[listen_sockets].tcp, handle_new_meta_connection, &listen_socket[listen_sockets], tcp_fd, IO_READ); - io_add(&listen_socket[listen_sockets].udp, handle_incoming_vpn_data, &listen_socket[listen_sockets], udp_fd, IO_READ); - - if(debug_level >= DEBUG_CONNECTIONS) { - hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); - logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Listening on %s", hostname); - free(hostname); - } + } - memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen); - listen_sockets++; - } + for(config_t *cfg = lookup_config(config_tree, "ListenAddress"); cfg; cfg = lookup_config_next(config_tree, cfg)) { + cfgs++; + get_config_string(cfg, &address); + if(!add_listen_address(address, false)) + return false; + } - freeaddrinfo(ai); - } while(cfg); + if(!cfgs) + if(!add_listen_address(address, NULL)) + return false; } - if(listen_sockets) - logger(DEBUG_ALWAYS, LOG_NOTICE, "Ready"); - else { + if(!listen_sockets) { logger(DEBUG_ALWAYS, LOG_ERR, "Unable to create any listening socket!"); return false; } + /* If no Port option was specified, set myport to the port used by the first listening socket. */ + + if(!port_specified) { + sockaddr_t sa; + socklen_t salen = sizeof sa; + if(!getsockname(listen_socket[0].udp.fd, &sa.sa, &salen)) { + free(myport); + sockaddr2str(&sa, NULL, &myport); + if(!myport) + myport = xstrdup("655"); + } + } + + xasprintf(&myself->hostname, "MYSELF port %s", myport); + myself->connection->hostname = xstrdup(myself->hostname); + + /* Done. */ + last_config_check = now.tv_sec; return true; @@ -1027,6 +1045,26 @@ bool setup_network(void) { if(!setup_myself()) return false; + if(!init_control()) + return false; + + /* Run tinc-up script to further initialize the tap interface */ + + char *envp[5] = {NULL}; + xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); + xasprintf(&envp[1], "DEVICE=%s", device ? : ""); + xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); + xasprintf(&envp[3], "NAME=%s", myself->name); + + execute_script("tinc-up", envp); + + for(int i = 0; i < 4; i++) + free(envp[i]); + + /* Run subnet-up scripts for our own subnets */ + + subnet_update(myself, NULL, true); + return true; } @@ -1044,7 +1082,8 @@ void close_network_connections(void) { terminate_connection(c, false); } - list_delete_list(outgoing_list); + if(outgoing_list) + list_delete_list(outgoing_list); if(myself && myself->connection) { subnet_update(myself, NULL, false); @@ -1059,11 +1098,6 @@ void close_network_connections(void) { close(listen_socket[i].udp.fd); } -#ifndef HAVE_MINGW - io_del(&unix_socket); - close(unix_socket.fd); -#endif - char *envp[5] = {NULL}; xasprintf(&envp[0], "NETNAME=%s", netname ? : ""); xasprintf(&envp[1], "DEVICE=%s", device ? : ""); @@ -1085,5 +1119,7 @@ void close_network_connections(void) { devops.close(); + exit_control(); + return; }