X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fnet_setup.c;h=50d5680a5d24855180490a8ecb2d9a1e22aba72c;hp=2684514392dac017d4b3faeba8f8b4aa510bce69;hb=776dbf88df1911ec379c2fece0089fd2f5c71021;hpb=9dea33f5301119dd4423eb962956cf2d246af3f3 diff --git a/src/net_setup.c b/src/net_setup.c index 26845143..50d5680a 100644 --- a/src/net_setup.c +++ b/src/net_setup.c @@ -1,7 +1,7 @@ /* net_setup.c -- Setup. Copyright (C) 1998-2005 Ivo Timmermans, - 2000-2012 Guus Sliepen + 2000-2015 Guus Sliepen 2006 Scott Lamb 2010 Brandon Black @@ -39,6 +39,7 @@ #include "netutl.h" #include "process.h" #include "protocol.h" +#include "proxy.h" #include "route.h" #include "subnet.h" #include "utils.h" @@ -49,7 +50,8 @@ devops_t devops; bool read_rsa_public_key(connection_t *c) { FILE *fp; - char *fname; + char *pubname; + char *hcfname; char *key; if(!c->rsa_key) { @@ -60,7 +62,10 @@ bool read_rsa_public_key(connection_t *c) { /* First, check for simple PublicKey statement */ if(get_config_string(lookup_config(c->config_tree, "PublicKey"), &key)) { - BN_hex2bn(&c->rsa_key->n, key); + if(BN_hex2bn(&c->rsa_key->n, key) != strlen(key)) { + logger(LOG_ERR, "Invalid PublicKey for %s!", c->name); + return false; + } BN_hex2bn(&c->rsa_key->e, "FFFF"); free(key); return true; @@ -68,80 +73,79 @@ bool read_rsa_public_key(connection_t *c) { /* Else, check for PublicKeyFile statement and read it */ - if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname)) { - fp = fopen(fname, "r"); + if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &pubname)) { + fp = fopen(pubname, "r"); if(!fp) { - logger(LOG_ERR, "Error reading RSA public key file `%s': %s", - fname, strerror(errno)); - free(fname); + logger(LOG_ERR, "Error reading RSA public key file `%s': %s", pubname, strerror(errno)); + free(pubname); return false; } - free(fname); c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); fclose(fp); - if(c->rsa_key) + if(c->rsa_key) { + free(pubname); return true; /* Woohoo. */ + } /* If it fails, try PEM_read_RSA_PUBKEY. */ - fp = fopen(fname, "r"); + fp = fopen(pubname, "r"); if(!fp) { - logger(LOG_ERR, "Error reading RSA public key file `%s': %s", - fname, strerror(errno)); - free(fname); + logger(LOG_ERR, "Error reading RSA public key file `%s': %s", pubname, strerror(errno)); + free(pubname); return false; } - free(fname); c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); fclose(fp); if(c->rsa_key) { // RSA_blinding_on(c->rsa_key, NULL); + free(pubname); return true; } - logger(LOG_ERR, "Reading RSA public key file `%s' failed: %s", - fname, strerror(errno)); + logger(LOG_ERR, "Reading RSA public key file `%s' failed: %s", pubname, strerror(errno)); + free(pubname); return false; } /* Else, check if a harnessed public key is in the config file */ - xasprintf(&fname, "%s/hosts/%s", confbase, c->name); - fp = fopen(fname, "r"); + xasprintf(&hcfname, "%s/hosts/%s", confbase, c->name); + fp = fopen(hcfname, "r"); if(!fp) { - logger(LOG_ERR, "Error reading RSA public key file `%s': %s", fname, strerror(errno)); - free(fname); + logger(LOG_ERR, "Error reading RSA public key file `%s': %s", hcfname, strerror(errno)); + free(hcfname); return false; } c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); fclose(fp); - free(fname); - if(c->rsa_key) + if(c->rsa_key) { + free(hcfname); return true; + } /* Try again with PEM_read_RSA_PUBKEY. */ - xasprintf(&fname, "%s/hosts/%s", confbase, c->name); - fp = fopen(fname, "r"); + fp = fopen(hcfname, "r"); if(!fp) { - logger(LOG_ERR, "Error reading RSA public key file `%s': %s", fname, strerror(errno)); - free(fname); + logger(LOG_ERR, "Error reading RSA public key file `%s': %s", hcfname, strerror(errno)); + free(hcfname); return false; } + free(hcfname); c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); // RSA_blinding_on(c->rsa_key, NULL); fclose(fp); - free(fname); if(c->rsa_key) return true; @@ -154,20 +158,27 @@ bool read_rsa_public_key(connection_t *c) { static bool read_rsa_private_key(void) { FILE *fp; char *fname, *key, *pubkey; - struct stat s; if(get_config_string(lookup_config(config_tree, "PrivateKey"), &key)) { + myself->connection->rsa_key = RSA_new(); +// RSA_blinding_on(myself->connection->rsa_key, NULL); + if(BN_hex2bn(&myself->connection->rsa_key->d, key) != strlen(key)) { + logger(LOG_ERR, "Invalid PrivateKey for myself!"); + free(key); + return false; + } + free(key); if(!get_config_string(lookup_config(config_tree, "PublicKey"), &pubkey)) { logger(LOG_ERR, "PrivateKey used but no PublicKey found!"); return false; } - myself->connection->rsa_key = RSA_new(); -// RSA_blinding_on(myself->connection->rsa_key, NULL); - BN_hex2bn(&myself->connection->rsa_key->d, key); - BN_hex2bn(&myself->connection->rsa_key->n, pubkey); - BN_hex2bn(&myself->connection->rsa_key->e, "FFFF"); - free(key); + if(BN_hex2bn(&myself->connection->rsa_key->n, pubkey) != strlen(pubkey)) { + logger(LOG_ERR, "Invalid PublicKey for myself!"); + free(pubkey); + return false; + } free(pubkey); + BN_hex2bn(&myself->connection->rsa_key->e, "FFFF"); return true; } @@ -184,15 +195,14 @@ static bool read_rsa_private_key(void) { } #if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN) - if(fstat(fileno(fp), &s)) { - logger(LOG_ERR, "Could not stat RSA private key file `%s': %s'", - fname, strerror(errno)); - free(fname); - return false; - } + struct stat s; - if(s.st_mode & ~0100700) - logger(LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname); + if(!fstat(fileno(fp), &s)) { + if(s.st_mode & ~0100700) + logger(LOG_WARNING, "Warning: insecure file permissions for RSA private key file `%s'!", fname); + } else { + logger(LOG_WARNING, "Could not stat RSA private key file `%s': %s'", fname, strerror(errno)); + } #endif myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL); @@ -269,6 +279,47 @@ void load_all_subnets(void) { closedir(dir); } +char *get_name(void) { + char *name = NULL; + + get_config_string(lookup_config(config_tree, "Name"), &name); + + if(!name) + return NULL; + + if(*name == '$') { + char *envname = getenv(name + 1); + char hostname[32] = ""; + if(!envname) { + if(strcmp(name + 1, "HOST")) { + fprintf(stderr, "Invalid Name: environment variable %s does not exist\n", name + 1); + free(name); + return false; + } + if(gethostname(hostname, sizeof hostname) || !*hostname) { + fprintf(stderr, "Could not get hostname: %s\n", strerror(errno)); + free(name); + return false; + } + hostname[31] = 0; + envname = hostname; + } + free(name); + name = xstrdup(envname); + for(char *c = name; *c; c++) + if(!isalnum(*c)) + *c = '_'; + } + + if(!check_id(name)) { + logger(LOG_ERR, "Invalid name for myself!"); + free(name); + return false; + } + + return name; +} + /* Configure node_t myself and set up the local sockets (listen only) */ @@ -278,11 +329,14 @@ static bool setup_myself(void) { char *name, *hostname, *mode, *afname, *cipher, *digest, *type; char *fname = NULL; char *address = NULL; - char *envp[5]; + char *proxy = NULL; + char *space; + char *envp[5] = {NULL}; struct addrinfo *ai, *aip, hint = {0}; bool choice; int i, err; int replaywin_int; + bool port_specified = false; myself = new_node(); myself->connection = new_connection(); @@ -293,16 +347,12 @@ static bool setup_myself(void) { myself->connection->options = 0; myself->connection->protocol_version = PROT_CURRENT; - if(!get_config_string(lookup_config(config_tree, "Name"), &name)) { /* Not acceptable */ + if(!(name = get_name())) { logger(LOG_ERR, "Name for tinc daemon required!"); return false; } - if(!check_id(name)) { - logger(LOG_ERR, "Invalid name for myself!"); - free(name); - return false; - } + /* Read tinc.conf and our own host config file */ myself->name = name; myself->connection->name = xstrdup(name); @@ -316,6 +366,10 @@ static bool setup_myself(void) { if(!get_config_string(lookup_config(config_tree, "Port"), &myport)) myport = xstrdup("655"); + else + port_specified = true; + + /* Ensure myport is numeric */ if(!atoi(myport)) { struct addrinfo *ai = str2addrinfo("localhost", myport, SOCK_DGRAM); @@ -327,6 +381,70 @@ static bool setup_myself(void) { sockaddr2str(&sa, NULL, &myport); } + if(get_config_string(lookup_config(config_tree, "Proxy"), &proxy)) { + if((space = strchr(proxy, ' '))) + *space++ = 0; + + if(!strcasecmp(proxy, "none")) { + proxytype = PROXY_NONE; + } else if(!strcasecmp(proxy, "socks4")) { + proxytype = PROXY_SOCKS4; + } else if(!strcasecmp(proxy, "socks4a")) { + proxytype = PROXY_SOCKS4A; + } else if(!strcasecmp(proxy, "socks5")) { + proxytype = PROXY_SOCKS5; + } else if(!strcasecmp(proxy, "http")) { + proxytype = PROXY_HTTP; + } else if(!strcasecmp(proxy, "exec")) { + proxytype = PROXY_EXEC; + } else { + logger(LOG_ERR, "Unknown proxy type %s!", proxy); + free(proxy); + return false; + } + + switch(proxytype) { + case PROXY_NONE: + default: + break; + + case PROXY_EXEC: + if(!space || !*space) { + logger(LOG_ERR, "Argument expected for proxy type exec!"); + free(proxy); + return false; + } + proxyhost = xstrdup(space); + break; + + case PROXY_SOCKS4: + case PROXY_SOCKS4A: + case PROXY_SOCKS5: + case PROXY_HTTP: + proxyhost = space; + if(space && (space = strchr(space, ' '))) + *space++ = 0, proxyport = space; + if(space && (space = strchr(space, ' '))) + *space++ = 0, proxyuser = space; + if(space && (space = strchr(space, ' '))) + *space++ = 0, proxypass = space; + if(!proxyhost || !*proxyhost || !proxyport || !*proxyport) { + logger(LOG_ERR, "Host and port argument expected for proxy!"); + free(proxy); + return false; + } + proxyhost = xstrdup(proxyhost); + proxyport = xstrdup(proxyport); + if(proxyuser && *proxyuser) + proxyuser = xstrdup(proxyuser); + if(proxypass && *proxypass) + proxypass = xstrdup(proxypass); + break; + } + + free(proxy); + } + /* Read in all the subnets specified in the host configuration file */ cfg = lookup_config(config_tree, "Subnet"); @@ -366,6 +484,7 @@ static bool setup_myself(void) { routing_mode = RMODE_HUB; else { logger(LOG_ERR, "Invalid routing mode!"); + free(mode); return false; } free(mode); @@ -380,6 +499,7 @@ static bool setup_myself(void) { forwarding_mode = FMODE_KERNEL; else { logger(LOG_ERR, "Invalid forwarding mode!"); + free(mode); return false; } free(mode); @@ -397,11 +517,29 @@ static bool setup_myself(void) { get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance); get_config_bool(lookup_config(config_tree, "DecrementTTL"), &decrement_ttl); - get_config_bool(lookup_config(config_tree, "Broadcast"), &broadcast); + if(get_config_string(lookup_config(config_tree, "Broadcast"), &mode)) { + if(!strcasecmp(mode, "no")) + broadcast_mode = BMODE_NONE; + else if(!strcasecmp(mode, "yes") || !strcasecmp(mode, "mst")) + broadcast_mode = BMODE_MST; + else if(!strcasecmp(mode, "direct")) + broadcast_mode = BMODE_DIRECT; + else { + logger(LOG_ERR, "Invalid broadcast mode!"); + free(mode); + return false; + } + free(mode); + } #if !defined(SOL_IP) || !defined(IP_TOS) if(priorityinheritance) - logger(LOG_WARNING, "%s not supported on this platform", "PriorityInheritance"); + logger(LOG_WARNING, "%s not supported on this platform for IPv4 connection", "PriorityInheritance"); +#endif + +#if !defined(IPPROTO_IPV6) || !defined(IPV6_TCLASS) + if(priorityinheritance) + logger(LOG_WARNING, "%s not supported on this platform for IPv6 connection", "PriorityInheritance"); #endif if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire)) @@ -415,6 +553,18 @@ static bool setup_myself(void) { } else maxtimeout = 900; + if(get_config_int(lookup_config(config_tree, "MinTimeout"), &mintimeout)) { + if(mintimeout < 0) { + logger(LOG_ERR, "Bogus minimum timeout!"); + return false; + } + if(mintimeout > maxtimeout) { + logger(LOG_WARNING, "Minimum timeout (%d s) cannot be larger than maximum timeout (%d s). Correcting !", mintimeout, maxtimeout ); + mintimeout=maxtimeout; + } + } else + mintimeout = 0; + if(get_config_int(lookup_config(config_tree, "UDPRcvBuf"), &udp_rcvbuf)) { if(udp_rcvbuf <= 0) { logger(LOG_ERR, "UDPRcvBuf cannot be negative!"); @@ -446,6 +596,7 @@ static bool setup_myself(void) { addressfamily = AF_UNSPEC; else { logger(LOG_ERR, "Invalid address family!"); + free(afname); return false; } free(afname); @@ -455,8 +606,7 @@ static bool setup_myself(void) { /* Generate packet encryption key */ - if(get_config_string - (lookup_config(config_tree, "Cipher"), &cipher)) { + if(get_config_string(lookup_config(config_tree, "Cipher"), &cipher)) { if(!strcasecmp(cipher, "none")) { myself->incipher = NULL; } else { @@ -464,9 +614,11 @@ static bool setup_myself(void) { if(!myself->incipher) { logger(LOG_ERR, "Unrecognized cipher type!"); + free(cipher); return false; } } + free(cipher); } else myself->incipher = EVP_bf_cbc(); @@ -492,9 +644,12 @@ static bool setup_myself(void) { if(!myself->indigest) { logger(LOG_ERR, "Unrecognized digest type!"); + free(digest); return false; } } + + free(digest); } else myself->indigest = EVP_sha1(); @@ -548,6 +703,8 @@ static bool setup_myself(void) { devops = dummy_devops; else if(!strcasecmp(type, "raw_socket")) devops = raw_socket_devops; + else if(!strcasecmp(type, "multicast")) + devops = multicast_devops; #ifdef ENABLE_UML else if(!strcasecmp(type, "uml")) devops = uml_devops; @@ -556,6 +713,7 @@ static bool setup_myself(void) { else if(!strcasecmp(type, "vde")) devops = vde_devops; #endif + free(type); } if(!devops.setup()) @@ -566,11 +724,16 @@ static bool setup_myself(void) { xasprintf(&envp[1], "DEVICE=%s", device ? : ""); xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); xasprintf(&envp[3], "NAME=%s", myself->name); - envp[4] = NULL; +#ifdef HAVE_MINGW + Sleep(1000); +#endif +#ifdef HAVE_CYGWIN + sleep(1); +#endif execute_script("tinc-up", envp); - for(i = 0; i < 5; i++) + for(i = 0; i < 4; i++) free(envp[i]); /* Run subnet-up scripts for our own subnets */ @@ -579,66 +742,138 @@ static bool setup_myself(void) { /* Open sockets */ - listen_sockets = 0; - cfg = lookup_config(config_tree, "BindToAddress"); - - do { - get_config_string(cfg, &address); - if(cfg) - cfg = lookup_config_next(config_tree, cfg); - - hint.ai_family = addressfamily; - hint.ai_socktype = SOCK_STREAM; - hint.ai_protocol = IPPROTO_TCP; - hint.ai_flags = AI_PASSIVE; + if(!do_detach && getenv("LISTEN_FDS")) { + sockaddr_t sa; + socklen_t salen; - err = getaddrinfo(address, myport, &hint, &ai); - free(address); + listen_sockets = atoi(getenv("LISTEN_FDS")); +#ifdef HAVE_UNSETENV + unsetenv("LISTEN_FDS"); +#endif - if(err || !ai) { - logger(LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", - gai_strerror(err)); + if(listen_sockets > MAXSOCKETS) { + logger(LOG_ERR, "Too many listening sockets"); return false; } - for(aip = ai; aip; aip = aip->ai_next) { - if(listen_sockets >= MAXSOCKETS) { - logger(LOG_ERR, "Too many listening sockets"); + for(i = 0; i < listen_sockets; i++) { + salen = sizeof sa; + if(getsockname(i + 3, &sa.sa, &salen) < 0) { + logger(LOG_ERR, "Could not get address of listen fd %d: %s", i + 3, sockstrerror(errno)); return false; } - listen_socket[listen_sockets].tcp = - setup_listen_socket((sockaddr_t *) aip->ai_addr); - - if(listen_socket[listen_sockets].tcp < 0) - continue; + listen_socket[i].tcp = i + 3; - listen_socket[listen_sockets].udp = - setup_vpn_in_socket((sockaddr_t *) aip->ai_addr); +#ifdef FD_CLOEXEC + fcntl(i + 3, F_SETFD, FD_CLOEXEC); +#endif - if(listen_socket[listen_sockets].udp < 0) - continue; + listen_socket[i].udp = setup_vpn_in_socket(&sa); + if(listen_socket[i].udp < 0) + return false; ifdebug(CONNECTIONS) { - hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); + hostname = sockaddr2hostname(&sa); logger(LOG_NOTICE, "Listening on %s", hostname); free(hostname); } - memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen); - listen_sockets++; + memcpy(&listen_socket[i].sa, &sa, salen); } + } else { + listen_sockets = 0; + cfg = lookup_config(config_tree, "BindToAddress"); + + do { + get_config_string(cfg, &address); + if(cfg) + cfg = lookup_config_next(config_tree, cfg); + + char *port = myport; + + if(address) { + char *space = strchr(address, ' '); + if(space) { + *space++ = 0; + port = space; + } + + if(!strcmp(address, "*")) + *address = 0; + } + + hint.ai_family = addressfamily; + hint.ai_socktype = SOCK_STREAM; + hint.ai_protocol = IPPROTO_TCP; + hint.ai_flags = AI_PASSIVE; + +#if HAVE_DECL_RES_INIT + // ensure glibc reloads /etc/resolv.conf. + res_init(); +#endif + err = getaddrinfo(address && *address ? address : NULL, port, &hint, &ai); + free(address); + + if(err || !ai) { + logger(LOG_ERR, "System call `%s' failed: %s", "getaddrinfo", + gai_strerror(err)); + return false; + } + + for(aip = ai; aip; aip = aip->ai_next) { + if(listen_sockets >= MAXSOCKETS) { + logger(LOG_ERR, "Too many listening sockets"); + return false; + } - freeaddrinfo(ai); - } while(cfg); + listen_socket[listen_sockets].tcp = + setup_listen_socket((sockaddr_t *) aip->ai_addr); - if(listen_sockets) - logger(LOG_NOTICE, "Ready"); - else { + if(listen_socket[listen_sockets].tcp < 0) + continue; + + listen_socket[listen_sockets].udp = + setup_vpn_in_socket((sockaddr_t *) aip->ai_addr); + + if(listen_socket[listen_sockets].udp < 0) + continue; + + ifdebug(CONNECTIONS) { + hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); + logger(LOG_NOTICE, "Listening on %s", hostname); + free(hostname); + } + + memcpy(&listen_socket[listen_sockets].sa, aip->ai_addr, aip->ai_addrlen); + listen_sockets++; + } + + freeaddrinfo(ai); + } while(cfg); + } + + if(!listen_sockets) { logger(LOG_ERR, "Unable to create any listening socket!"); return false; } + /* If no Port option was specified, set myport to the port used by the first listening socket. */ + + if(!port_specified) { + sockaddr_t sa; + socklen_t salen = sizeof sa; + if(!getsockname(listen_socket[0].udp, &sa.sa, &salen)) { + free(myport); + sockaddr2str(&sa, NULL, &myport); + if(!myport) + myport = xstrdup("655"); + } + } + + /* Done. */ + + logger(LOG_NOTICE, "Ready"); return true; } @@ -682,7 +917,7 @@ bool setup_network(void) { void close_network_connections(void) { avl_node_t *node, *next; connection_t *c; - char *envp[5]; + char *envp[5] = {NULL}; int i; for(node = connection_tree->head; node; node = next) { @@ -716,7 +951,6 @@ void close_network_connections(void) { xasprintf(&envp[1], "DEVICE=%s", device ? : ""); xasprintf(&envp[2], "INTERFACE=%s", iface ? : ""); xasprintf(&envp[3], "NAME=%s", myself->name); - envp[4] = NULL; exit_requests(); exit_edges();