tinc-vpn.org Git - tinc/blob - src/pokey/net_setup.c

   1 /*
   2     net_setup.c -- Setup.
   3     Copyright (C) 1998-2002 Ivo Timmermans <itimmermans@bigfoot.com>,
   4                   2000-2002 Guus Sliepen <guus@sliepen.warande.net>
   5
   6     This program is free software; you can redistribute it and/or modify
   7     it under the terms of the GNU General Public License as published by
   8     the Free Software Foundation; either version 2 of the License, or
   9     (at your option) any later version.
  10
  11     This program is distributed in the hope that it will be useful,
  12     but WITHOUT ANY WARRANTY; without even the implied warranty of
  13     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14     GNU General Public License for more details.
  15
  16     You should have received a copy of the GNU General Public License
  17     along with this program; if not, write to the Free Software
  18     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19
  20     $Id: net_setup.c,v 1.1 2002/04/28 12:46:26 zarq Exp $
  21 */
  22
  23 #include "config.h"
  24
  25 #include <errno.h>
  26 #include <fcntl.h>
  27 #include <netdb.h>
  28 #include <netinet/in.h>
  29 #ifdef HAVE_LINUX
  30  #include <netinet/ip.h>
  31  #include <netinet/tcp.h>
  32 #endif
  33 #include <stdio.h>
  34 #include <stdlib.h>
  35 #include <string.h>
  36 #include <signal.h>
  37 #include <sys/time.h>
  38 #include <sys/types.h>
  39 #include <unistd.h>
  40 #include <sys/ioctl.h>
  41 /* SunOS really wants sys/socket.h BEFORE net/if.h,
  42    and FreeBSD wants these lines below the rest. */
  43 #include <arpa/inet.h>
  44 #include <sys/socket.h>
  45 #include <net/if.h>
  46
  47 #include <openssl/pem.h>
  48 #include <openssl/rsa.h>
  49 #include <openssl/rand.h>
  50
  51 #include <utils.h>
  52 #include <xalloc.h>
  53 #include <avl_tree.h>
  54 #include <list.h>
  55
  56 #include "conf.h"
  57 #include "interface.h"
  58 #include "connection.h"
  59 #include "meta.h"
  60 #include "net.h"
  61 #include "netutl.h"
  62 #include "process.h"
  63 #include "protocol.h"
  64 #include "subnet.h"
  65 #include "graph.h"
  66 #include "process.h"
  67 #include "route.h"
  68 #include "device.h"
  69 #include "event.h"
  70 #include "logging.h"
  71
  72 #include "system.h"
  73
  74 char *myport;
  75
  76 int read_rsa_public_key(connection_t *c)
  77 {
  78   FILE *fp;
  79   char *fname;
  80   char *key;
  81 cp
  82   if(!c->rsa_key)
  83     c->rsa_key = RSA_new();
  84
  85   /* First, check for simple PublicKey statement */
  86
  87   if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &key))
  88     {
  89       BN_hex2bn(&c->rsa_key->n, key);
  90       BN_hex2bn(&c->rsa_key->e, "FFFF");
  91       free(key);
  92       return 0;
  93     }
  94
  95   /* Else, check for PublicKeyFile statement and read it */
  96
  97   if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname))
  98     {
  99       if(is_safe_path(fname))
 100         {
 101           if((fp = fopen(fname, "r")) == NULL)
 102             {
 103               log(0, TLOG_ERROR,
 104                   _("Error reading RSA public key file `%s': %s"),
 105                   fname, strerror(errno));
 106               free(fname);
 107               return -1;
 108             }
 109           free(fname);
 110           c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL);
 111           fclose(fp);
 112           if(!c->rsa_key)
 113             {
 114               syslog(LOG_ERR, _("Reading RSA public key file `%s' failed: %s"),
 115                      fname, strerror(errno));
 116               return -1;
 117             }
 118           return 0;
 119         }
 120       else
 121         {
 122           free(fname);
 123           return -1;
 124         }
 125     }
 126
 127   /* Else, check if a harnessed public key is in the config file */
 128
 129   asprintf(&fname, "%s/hosts/%s", confbase, c->name);
 130   if((fp = fopen(fname, "r")))
 131     {
 132       c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL);
 133       fclose(fp);
 134     }
 135
 136   free(fname);
 137
 138   if(c->rsa_key)
 139     return 0;
 140   else
 141     {
 142       syslog(LOG_ERR, _("No public key for %s specified!"), c->name);
 143       return -1;
 144     }
 145 }
 146
 147 int read_rsa_private_key(void)
 148 {
 149   FILE *fp;
 150   char *fname, *key;
 151 cp
 152   if(get_config_string(lookup_config(config_tree, "PrivateKey"), &key))
 153     {
 154       myself->connection->rsa_key = RSA_new();
 155       BN_hex2bn(&myself->connection->rsa_key->d, key);
 156       BN_hex2bn(&myself->connection->rsa_key->e, "FFFF");
 157       free(key);
 158       return 0;
 159     }
 160
 161   if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname))
 162     asprintf(&fname, "%s/rsa_key.priv", confbase);
 163
 164   if(is_safe_path(fname))
 165     {
 166       if((fp = fopen(fname, "r")) == NULL)
 167         {
 168           syslog(LOG_ERR, _("Error reading RSA private key file `%s': %s"),
 169                  fname, strerror(errno));
 170           free(fname);
 171           return -1;
 172         }
 173       free(fname);
 174       myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
 175       fclose(fp);
 176       if(!myself->connection->rsa_key)
 177         {
 178           syslog(LOG_ERR, _("Reading RSA private key file `%s' failed: %s"),
 179                  fname, strerror(errno));
 180           return -1;
 181         }
 182       return 0;
 183     }
 184
 185   free(fname);
 186   return -1;
 187 }
 188
 189 int check_rsa_key(RSA *rsa_key)
 190 {
 191   char *test1, *test2, *test3;
 192 cp
 193   if(rsa_key->p && rsa_key->q)
 194     {
 195       if(RSA_check_key(rsa_key) != 1)
 196           return -1;
 197     }
 198   else
 199     {
 200       test1 = xmalloc(RSA_size(rsa_key));
 201       test2 = xmalloc(RSA_size(rsa_key));
 202       test3 = xmalloc(RSA_size(rsa_key));
 203
 204       if(RSA_public_encrypt(RSA_size(rsa_key), test1, test2, rsa_key, RSA_NO_PADDING) != RSA_size(rsa_key))
 205           return -1;
 206
 207       if(RSA_private_decrypt(RSA_size(rsa_key), test2, test3, rsa_key, RSA_NO_PADDING) != RSA_size(rsa_key))
 208           return -1;
 209
 210       if(memcmp(test1, test3, RSA_size(rsa_key)))
 211           return -1;
 212     }
 213 cp
 214   return 0;
 215 }
 216
 217 /*
 218   Configure node_t myself and set up the local sockets (listen only)
 219 */
 220 int setup_myself(void)
 221 {
 222   config_t *cfg;
 223   subnet_t *subnet;
 224   char *name, *mode, *afname, *cipher, *digest;
 225   int choice;
 226 cp
 227   myself = new_node();
 228   myself->connection = new_connection();
 229   init_configuration(&myself->connection->config_tree);
 230
 231   asprintf(&myself->hostname, _("MYSELF"));
 232   asprintf(&myself->connection->hostname, _("MYSELF"));
 233
 234   myself->connection->options = 0;
 235   myself->connection->protocol_version = PROT_CURRENT;
 236
 237   if(!get_config_string(lookup_config(config_tree, "Name"), &name)) /* Not acceptable */
 238     {
 239       syslog(LOG_ERR, _("Name for tinc daemon required!"));
 240       return -1;
 241     }
 242
 243   if(check_id(name))
 244     {
 245       syslog(LOG_ERR, _("Invalid name for myself!"));
 246       free(name);
 247       return -1;
 248     }
 249
 250   myself->name = name;
 251   myself->connection->name = xstrdup(name);
 252
 253 cp
 254   if(read_rsa_private_key())
 255     return -1;
 256
 257   if(read_connection_config(myself->connection))
 258     {
 259       syslog(LOG_ERR, _("Cannot open host configuration file for myself!"));
 260       return -1;
 261     }
 262
 263   if(read_rsa_public_key(myself->connection))
 264     return -1;
 265 cp
 266
 267   if(check_rsa_key(myself->connection->rsa_key))
 268     {
 269       syslog(LOG_ERR, _("Invalid public/private keypair!"));
 270       return -1;
 271     }
 272
 273   if(!get_config_string(lookup_config(myself->connection->config_tree, "Port"), &myport))
 274     asprintf(&myport, "655");
 275
 276 /* Read in all the subnets specified in the host configuration file */
 277
 278   cfg = lookup_config(myself->connection->config_tree, "Subnet");
 279
 280   while(cfg)
 281     {
 282       if(!get_config_subnet(cfg, &subnet))
 283         return -1;
 284
 285       subnet_add(myself, subnet);
 286
 287       cfg = lookup_config_next(myself->connection->config_tree, cfg);
 288     }
 289
 290 cp
 291   /* Check some options */
 292
 293   if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice))
 294     if(choice)
 295       myself->options |= OPTION_INDIRECT;
 296
 297   if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice))
 298     if(choice)
 299       myself->options |= OPTION_TCPONLY;
 300
 301   if(get_config_bool(lookup_config(myself->connection->config_tree, "IndirectData"), &choice))
 302     if(choice)
 303       myself->options |= OPTION_INDIRECT;
 304
 305   if(get_config_bool(lookup_config(myself->connection->config_tree, "TCPOnly"), &choice))
 306     if(choice)
 307       myself->options |= OPTION_TCPONLY;
 308
 309   if(myself->options & OPTION_TCPONLY)
 310     myself->options |= OPTION_INDIRECT;
 311
 312   if(get_config_string(lookup_config(config_tree, "Mode"), &mode))
 313     {
 314       if(!strcasecmp(mode, "router"))
 315         routing_mode = RMODE_ROUTER;
 316       else if (!strcasecmp(mode, "switch"))
 317         routing_mode = RMODE_SWITCH;
 318       else if (!strcasecmp(mode, "hub"))
 319         routing_mode = RMODE_HUB;
 320       else
 321         {
 322           syslog(LOG_ERR, _("Invalid routing mode!"));
 323           return -1;
 324         }
 325       free(mode);
 326     }
 327   else
 328     routing_mode = RMODE_ROUTER;
 329
 330   get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance);
 331 #if !defined(SOL_IP) || !defined(IP_TOS)
 332   if(priorityinheritance)
 333     syslog(LOG_WARNING, _("PriorityInheritance not supported on this platform"));
 334 #endif
 335
 336   if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire))
 337     macexpire= 600;
 338
 339   if(get_config_int(lookup_config(myself->connection->config_tree, "MaxTimeout"), &maxtimeout))
 340     {
 341       if(maxtimeout <= 0)
 342         {
 343           syslog(LOG_ERR, _("Bogus maximum timeout!"));
 344           return -1;
 345         }
 346     }
 347   else
 348     maxtimeout = 900;
 349
 350   if(get_config_string(lookup_config(config_tree, "AddressFamily"), &afname))
 351     {
 352       if(!strcasecmp(afname, "IPv4"))
 353         addressfamily = AF_INET;
 354       else if (!strcasecmp(afname, "IPv6"))
 355         addressfamily = AF_INET6;
 356       else if (!strcasecmp(afname, "any"))
 357         addressfamily = AF_UNSPEC;
 358       else
 359         {
 360           syslog(LOG_ERR, _("Invalid address family!"));
 361           return -1;
 362         }
 363       free(afname);
 364     }
 365   else
 366     addressfamily = AF_INET;
 367
 368   get_config_bool(lookup_config(config_tree, "Hostnames"), &hostnames);
 369 cp
 370   /* Generate packet encryption key */
 371
 372   if(get_config_string(lookup_config(myself->connection->config_tree, "Cipher"), &cipher))
 373     {
 374       if(!strcasecmp(cipher, "none"))
 375         {
 376           myself->cipher = NULL;
 377         }
 378       else
 379         {
 380           if(!(myself->cipher = EVP_get_cipherbyname(cipher)))
 381             {
 382               syslog(LOG_ERR, _("Unrecognized cipher type!"));
 383               return -1;
 384             }
 385         }
 386     }
 387   else
 388     myself->cipher = EVP_bf_cbc();
 389
 390   if(myself->cipher)
 391     myself->keylength = myself->cipher->key_len + myself->cipher->iv_len;
 392   else
 393     myself->keylength = 1;
 394
 395   myself->connection->outcipher = EVP_bf_ofb();
 396
 397   myself->key = (char *)xmalloc(myself->keylength);
 398   RAND_pseudo_bytes(myself->key, myself->keylength);
 399
 400   if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime))
 401     keylifetime = 3600;
 402
 403   keyexpires = now + keylifetime;
 404
 405   /* Check if we want to use message authentication codes... */
 406
 407   if(get_config_string(lookup_config(myself->connection->config_tree, "Digest"), &digest))
 408     {
 409       if(!strcasecmp(digest, "none"))
 410         {
 411           myself->digest = NULL;
 412         }
 413       else
 414         {
 415           if(!(myself->digest = EVP_get_digestbyname(digest)))
 416             {
 417               syslog(LOG_ERR, _("Unrecognized digest type!"));
 418               return -1;
 419             }
 420         }
 421     }
 422   else
 423     myself->digest = EVP_sha1();
 424
 425   myself->connection->outdigest = EVP_sha1();
 426
 427   if(get_config_int(lookup_config(myself->connection->config_tree, "MACLength"), &myself->maclength))
 428     {
 429       if(myself->digest)
 430         {
 431           if(myself->maclength > myself->digest->md_size)
 432             {
 433               syslog(LOG_ERR, _("MAC length exceeds size of digest!"));
 434               return -1;
 435             }
 436           else if (myself->maclength < 0)
 437             {
 438               syslog(LOG_ERR, _("Bogus MAC length!"));
 439               return -1;
 440             }
 441         }
 442     }
 443   else
 444     myself->maclength = 4;
 445
 446   myself->connection->outmaclength = 0;
 447
 448   /* Compression */
 449
 450   if(get_config_int(lookup_config(myself->connection->config_tree, "Compression"), &myself->compression))
 451     {
 452       if(myself->compression < 0 || myself->compression > 9)
 453         {
 454           syslog(LOG_ERR, _("Bogus compression level!"));
 455           return -1;
 456         }
 457     }
 458   else
 459     myself->compression = 0;
 460
 461   myself->connection->outcompression = 0;
 462 cp
 463   /* Done */
 464
 465   myself->nexthop = myself;
 466   myself->via = myself;
 467   myself->status.active = 1;
 468   node_add(myself);
 469
 470   graph();
 471
 472   syslog(LOG_NOTICE, _("Ready"));
 473 cp
 474   return 0;
 475 }
 476
 477 /*
 478   setup all initial network connections
 479 */
 480 int setup_network_connections(void)
 481 {
 482 cp
 483   now = time(NULL);
 484
 485   init_connections();
 486   init_subnets();
 487   init_nodes();
 488   init_edges();
 489   init_events();
 490   init_requests();
 491
 492   if(get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout))
 493     {
 494       if(pingtimeout < 1)
 495         {
 496           pingtimeout = 86400;
 497         }
 498     }
 499   else
 500     pingtimeout = 60;
 501
 502   if(setup_myself() < 0)
 503     return -1;
 504
 505   try_outgoing_connections();
 506 cp
 507   return 0;
 508 }
 509
 510 /*
 511   close all open network connections
 512 */
 513 void close_network_connections(void)
 514 {
 515   avl_node_t *node, *next;
 516   connection_t *c;
 517   int i;
 518 cp
 519   for(node = connection_tree->head; node; node = next)
 520     {
 521       next = node->next;
 522       c = (connection_t *)node->data;
 523       if(c->outgoing)
 524         free(c->outgoing->name), free(c->outgoing), c->outgoing = NULL;
 525       terminate_connection(c, 0);
 526     }
 527
 528   if(myself && myself->connection)
 529     terminate_connection(myself->connection, 0);
 530
 531   for(i = 0; i < listen_sockets; i++)
 532     {
 533       close(listen_socket[i].tcp);
 534       close(listen_socket[i].udp);
 535     }
 536
 537   exit_requests();
 538   exit_events();
 539   exit_edges();
 540   exit_subnets();
 541   exit_nodes();
 542   exit_connections();
 543
 544 cp
 545   return;
 546 }