X-Git-Url: https://tinc-vpn.org/git/browse?p=tinc;a=blobdiff_plain;f=src%2Fnet_setup.c;h=e447a1f99090633a03e6b09002d58555595a62ee;hp=e279d3741491e403a20c54825d8cf478c80afb5d;hb=af95368c0f30955f0e13b587d5d6d4989fd5a83e;hpb=9528a63c35da77ba5b825068aeffbc5587816dd5 diff --git a/src/net_setup.c b/src/net_setup.c index e279d374..e447a1f9 100644 --- a/src/net_setup.c +++ b/src/net_setup.c @@ -1,7 +1,7 @@ /* net_setup.c -- Setup. - Copyright (C) 1998-2002 Ivo Timmermans , - 2000-2002 Guus Sliepen + Copyright (C) 1998-2005 Ivo Timmermans , + 2000-2005 Guus Sliepen This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -17,67 +17,36 @@ along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - $Id: net_setup.c,v 1.1.2.32 2003/06/25 20:52:59 guus Exp $ + $Id$ */ -#include "config.h" - -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -/* SunOS really wants sys/socket.h BEFORE net/if.h, - and FreeBSD wants these lines below the rest. */ -#include -#include -#include -#ifdef HAVE_NETINET_IN_SYSTM_H -#include -#endif -#ifdef HAVE_NETINET_IP_H -#include -#endif -#ifdef HAVE_NETINET_TCP_H -#include -#endif +#include "system.h" #include #include #include +#include +#include -#include -#include -#include -#include - +#include "avl_tree.h" #include "conf.h" #include "connection.h" -#include "meta.h" +#include "device.h" +#include "event.h" +#include "graph.h" +#include "logger.h" #include "net.h" #include "netutl.h" #include "process.h" #include "protocol.h" -#include "subnet.h" -#include "graph.h" -#include "process.h" #include "route.h" -#include "device.h" -#include "event.h" - -#include "system.h" +#include "subnet.h" +#include "utils.h" +#include "xalloc.h" char *myport; -int read_rsa_public_key(connection_t *c) +bool read_rsa_public_key(connection_t *c) { FILE *fp; char *fname; @@ -96,56 +65,50 @@ int read_rsa_public_key(connection_t *c) BN_hex2bn(&c->rsa_key->n, key); BN_hex2bn(&c->rsa_key->e, "FFFF"); free(key); - return 0; + return true; } /* Else, check for PublicKeyFile statement and read it */ - if(get_config_string - (lookup_config(c->config_tree, "PublicKeyFile"), &fname)) { - if(is_safe_path(fname)) { - fp = fopen(fname, "r"); - - if(!fp) { - syslog(LOG_ERR, _("Error reading RSA public key file `%s': %s"), - fname, strerror(errno)); - free(fname); - return -1; - } + if(get_config_string(lookup_config(c->config_tree, "PublicKeyFile"), &fname)) { + fp = fopen(fname, "r"); + if(!fp) { + logger(LOG_ERR, _("Error reading RSA public key file `%s': %s"), + fname, strerror(errno)); free(fname); - c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); - fclose(fp); + return false; + } - if(c->rsa_key) - return 0; /* Woohoo. */ + free(fname); + c->rsa_key = PEM_read_RSAPublicKey(fp, &c->rsa_key, NULL, NULL); + fclose(fp); - /* If it fails, try PEM_read_RSA_PUBKEY. */ - fp = fopen(fname, "r"); + if(c->rsa_key) + return true; /* Woohoo. */ - if(!fp) { - syslog(LOG_ERR, _("Error reading RSA public key file `%s': %s"), - fname, strerror(errno)); - free(fname); - return -1; - } + /* If it fails, try PEM_read_RSA_PUBKEY. */ + fp = fopen(fname, "r"); + if(!fp) { + logger(LOG_ERR, _("Error reading RSA public key file `%s': %s"), + fname, strerror(errno)); free(fname); - c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); - fclose(fp); + return false; + } - if(c->rsa_key) { -// RSA_blinding_on(c->rsa_key, NULL); - return 0; - } + free(fname); + c->rsa_key = PEM_read_RSA_PUBKEY(fp, &c->rsa_key, NULL, NULL); + fclose(fp); - syslog(LOG_ERR, _("Reading RSA public key file `%s' failed: %s"), - fname, strerror(errno)); - return -1; - } else { - free(fname); - return -1; + if(c->rsa_key) { +// RSA_blinding_on(c->rsa_key, NULL); + return true; } + + logger(LOG_ERR, _("Reading RSA public key file `%s' failed: %s"), + fname, strerror(errno)); + return false; } /* Else, check if a harnessed public key is in the config file */ @@ -161,7 +124,7 @@ int read_rsa_public_key(connection_t *c) free(fname); if(c->rsa_key) - return 0; + return true; /* Try again with PEM_read_RSA_PUBKEY. */ @@ -177,71 +140,87 @@ int read_rsa_public_key(connection_t *c) free(fname); if(c->rsa_key) - return 0; + return true; - syslog(LOG_ERR, _("No public key for %s specified!"), c->name); + logger(LOG_ERR, _("No public key for %s specified!"), c->name); - return -1; + return false; } -int read_rsa_private_key(void) +bool read_rsa_private_key(void) { FILE *fp; - char *fname, *key; + char *fname, *key, *pubkey; + struct stat s; cp(); if(get_config_string(lookup_config(config_tree, "PrivateKey"), &key)) { + if(!get_config_string(lookup_config(myself->connection->config_tree, "PublicKey"), &pubkey)) { + logger(LOG_ERR, _("PrivateKey used but no PublicKey found!")); + return false; + } myself->connection->rsa_key = RSA_new(); // RSA_blinding_on(myself->connection->rsa_key, NULL); BN_hex2bn(&myself->connection->rsa_key->d, key); + BN_hex2bn(&myself->connection->rsa_key->n, pubkey); BN_hex2bn(&myself->connection->rsa_key->e, "FFFF"); free(key); - return 0; + free(pubkey); + return true; } if(!get_config_string(lookup_config(config_tree, "PrivateKeyFile"), &fname)) asprintf(&fname, "%s/rsa_key.priv", confbase); - if(is_safe_path(fname)) { - fp = fopen(fname, "r"); + fp = fopen(fname, "r"); - if(!fp) { - syslog(LOG_ERR, _("Error reading RSA private key file `%s': %s"), - fname, strerror(errno)); - free(fname); - return -1; - } + if(!fp) { + logger(LOG_ERR, _("Error reading RSA private key file `%s': %s"), + fname, strerror(errno)); + free(fname); + return false; + } +#if !defined(HAVE_MINGW) && !defined(HAVE_CYGWIN) + if(fstat(fileno(fp), &s)) { + logger(LOG_ERR, _("Could not stat RSA private key file `%s': %s'"), + fname, strerror(errno)); free(fname); - myself->connection->rsa_key = - PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL); - fclose(fp); + return false; + } - if(!myself->connection->rsa_key) { - syslog(LOG_ERR, _("Reading RSA private key file `%s' failed: %s"), - fname, strerror(errno)); - return -1; - } + if(s.st_mode & ~0100700) + logger(LOG_WARNING, _("Warning: insecure file permissions for RSA private key file `%s'!"), fname); +#endif + + myself->connection->rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL); + fclose(fp); - return 0; + if(!myself->connection->rsa_key) { + logger(LOG_ERR, _("Reading RSA private key file `%s' failed: %s"), + fname, strerror(errno)); + free(fname); + return false; } free(fname); - return -1; + return true; } /* Configure node_t myself and set up the local sockets (listen only) */ -int setup_myself(void) +bool setup_myself(void) { config_t *cfg; subnet_t *subnet; char *name, *hostname, *mode, *afname, *cipher, *digest; char *address = NULL; - struct addrinfo hint, *ai, *aip; - int choice, err; + char *envp[5]; + struct addrinfo *ai, *aip, hint = {0}; + bool choice; + int i, err; cp(); @@ -256,32 +235,28 @@ int setup_myself(void) myself->connection->protocol_version = PROT_CURRENT; if(!get_config_string(lookup_config(config_tree, "Name"), &name)) { /* Not acceptable */ - syslog(LOG_ERR, _("Name for tinc daemon required!")); - return -1; + logger(LOG_ERR, _("Name for tinc daemon required!")); + return false; } - if(check_id(name)) { - syslog(LOG_ERR, _("Invalid name for myself!")); + if(!check_id(name)) { + logger(LOG_ERR, _("Invalid name for myself!")); free(name); - return -1; + return false; } myself->name = name; myself->connection->name = xstrdup(name); - if(read_rsa_private_key()) - return -1; - - if(read_connection_config(myself->connection)) { - syslog(LOG_ERR, _("Cannot open host configuration file for myself!")); - return -1; + if(!read_connection_config(myself->connection)) { + logger(LOG_ERR, _("Cannot open host configuration file for myself!")); + return false; } - if(read_rsa_public_key(myself->connection)) - return -1; + if(!read_rsa_private_key()) + return false; - if(!get_config_string - (lookup_config(myself->connection->config_tree, "Port"), &myport)) + if(!get_config_string(lookup_config(myself->connection->config_tree, "Port"), &myport)) asprintf(&myport, "655"); /* Read in all the subnets specified in the host configuration file */ @@ -290,7 +265,7 @@ int setup_myself(void) while(cfg) { if(!get_config_subnet(cfg, &subnet)) - return -1; + return false; subnet_add(myself, subnet); @@ -299,28 +274,26 @@ int setup_myself(void) /* Check some options */ - if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice)) - if(choice) - myself->options |= OPTION_INDIRECT; + if(get_config_bool(lookup_config(config_tree, "IndirectData"), &choice) && choice) + myself->options |= OPTION_INDIRECT; + + if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice) && choice) + myself->options |= OPTION_TCPONLY; - if(get_config_bool(lookup_config(config_tree, "TCPOnly"), &choice)) - if(choice) - myself->options |= OPTION_TCPONLY; + if(get_config_bool(lookup_config(myself->connection->config_tree, "IndirectData"), &choice) && choice) + myself->options |= OPTION_INDIRECT; - if(get_config_bool - (lookup_config(myself->connection->config_tree, "IndirectData"), - &choice)) - if(choice) - myself->options |= OPTION_INDIRECT; + if(get_config_bool(lookup_config(myself->connection->config_tree, "TCPOnly"), &choice) && choice) + myself->options |= OPTION_TCPONLY; - if(get_config_bool - (lookup_config(myself->connection->config_tree, "TCPOnly"), &choice)) - if(choice) - myself->options |= OPTION_TCPONLY; + if(get_config_bool(lookup_config(myself->connection->config_tree, "PMTUDiscovery"), &choice) && choice) + myself->options |= OPTION_PMTU_DISCOVERY; if(myself->options & OPTION_TCPONLY) myself->options |= OPTION_INDIRECT; + get_config_bool(lookup_config(config_tree, "TunnelServer"), &tunnelserver); + if(get_config_string(lookup_config(config_tree, "Mode"), &mode)) { if(!strcasecmp(mode, "router")) routing_mode = RMODE_ROUTER; @@ -329,29 +302,27 @@ int setup_myself(void) else if(!strcasecmp(mode, "hub")) routing_mode = RMODE_HUB; else { - syslog(LOG_ERR, _("Invalid routing mode!")); - return -1; + logger(LOG_ERR, _("Invalid routing mode!")); + return false; } free(mode); } else routing_mode = RMODE_ROUTER; - get_config_bool(lookup_config(config_tree, "PriorityInheritance"), - &priorityinheritance); + get_config_bool(lookup_config(config_tree, "PriorityInheritance"), &priorityinheritance); + #if !defined(SOL_IP) || !defined(IP_TOS) if(priorityinheritance) - syslog(LOG_WARNING, _("PriorityInheritance not supported on this platform")); + logger(LOG_WARNING, _("PriorityInheritance not supported on this platform")); #endif if(!get_config_int(lookup_config(config_tree, "MACExpire"), &macexpire)) macexpire = 600; - if(get_config_int - (lookup_config(myself->connection->config_tree, "MaxTimeout"), - &maxtimeout)) { + if(get_config_int(lookup_config(config_tree, "MaxTimeout"), &maxtimeout)) { if(maxtimeout <= 0) { - syslog(LOG_ERR, _("Bogus maximum timeout!")); - return -1; + logger(LOG_ERR, _("Bogus maximum timeout!")); + return false; } } else maxtimeout = 900; @@ -364,8 +335,8 @@ int setup_myself(void) else if(!strcasecmp(afname, "any")) addressfamily = AF_UNSPEC; else { - syslog(LOG_ERR, _("Invalid address family!")); - return -1; + logger(LOG_ERR, _("Invalid address family!")); + return false; } free(afname); } @@ -382,8 +353,8 @@ int setup_myself(void) myself->cipher = EVP_get_cipherbyname(cipher); if(!myself->cipher) { - syslog(LOG_ERR, _("Unrecognized cipher type!")); - return -1; + logger(LOG_ERR, _("Unrecognized cipher type!")); + return false; } } } else @@ -396,16 +367,23 @@ int setup_myself(void) myself->connection->outcipher = EVP_bf_ofb(); - myself->key = (char *) xmalloc(myself->keylength); - RAND_pseudo_bytes(myself->key, myself->keylength); + myself->key = xmalloc(myself->keylength); + RAND_pseudo_bytes((unsigned char *)myself->key, myself->keylength); if(!get_config_int(lookup_config(config_tree, "KeyExpire"), &keylifetime)) keylifetime = 3600; keyexpires = now + keylifetime; - EVP_CIPHER_CTX_init(&packet_ctx); - EVP_DecryptInit_ex(&packet_ctx, myself->cipher, NULL, myself->key, myself->key + myself->cipher->key_len); + if(myself->cipher) { + EVP_CIPHER_CTX_init(&packet_ctx); + if(!EVP_DecryptInit_ex(&packet_ctx, myself->cipher, NULL, (unsigned char *)myself->key, (unsigned char *)myself->key + myself->cipher->key_len)) { + logger(LOG_ERR, _("Error during initialisation of cipher for %s (%s): %s"), + myself->name, myself->hostname, ERR_error_string(ERR_get_error(), NULL)); + return false; + } + + } /* Check if we want to use message authentication codes... */ @@ -417,8 +395,8 @@ int setup_myself(void) myself->digest = EVP_get_digestbyname(digest); if(!myself->digest) { - syslog(LOG_ERR, _("Unrecognized digest type!")); - return -1; + logger(LOG_ERR, _("Unrecognized digest type!")); + return false; } } } else @@ -426,16 +404,15 @@ int setup_myself(void) myself->connection->outdigest = EVP_sha1(); - if(get_config_int - (lookup_config(myself->connection->config_tree, "MACLength"), + if(get_config_int(lookup_config(myself->connection->config_tree, "MACLength"), &myself->maclength)) { if(myself->digest) { if(myself->maclength > myself->digest->md_size) { - syslog(LOG_ERR, _("MAC length exceeds size of digest!")); - return -1; + logger(LOG_ERR, _("MAC length exceeds size of digest!")); + return false; } else if(myself->maclength < 0) { - syslog(LOG_ERR, _("Bogus MAC length!")); - return -1; + logger(LOG_ERR, _("Bogus MAC length!")); + return false; } } } else @@ -445,12 +422,11 @@ int setup_myself(void) /* Compression */ - if(get_config_int - (lookup_config(myself->connection->config_tree, "Compression"), + if(get_config_int(lookup_config(myself->connection->config_tree, "Compression"), &myself->compression)) { if(myself->compression < 0 || myself->compression > 11) { - syslog(LOG_ERR, _("Bogus compression level!")); - return -1; + logger(LOG_ERR, _("Bogus compression level!")); + return false; } } else myself->compression = 0; @@ -461,15 +437,34 @@ int setup_myself(void) myself->nexthop = myself; myself->via = myself; - myself->status.active = 1; - myself->status.reachable = 1; + myself->status.active = true; + myself->status.reachable = true; node_add(myself); graph(); - /* Open sockets */ + /* Open device */ + + if(!setup_device()) + return false; + + /* Run tinc-up script to further initialize the tap interface */ + asprintf(&envp[0], "NETNAME=%s", netname ? : ""); + asprintf(&envp[1], "DEVICE=%s", device ? : ""); + asprintf(&envp[2], "INTERFACE=%s", iface ? : ""); + asprintf(&envp[3], "NAME=%s", myself->name); + envp[4] = NULL; + + execute_script("tinc-up", envp); + + for(i = 0; i < 5; i++) + free(envp[i]); + + /* Run subnet-up scripts for our own subnets */ - memset(&hint, 0, sizeof(hint)); + subnet_update(myself, NULL, true); + + /* Open sockets */ get_config_string(lookup_config(config_tree, "BindToAddress"), &address); @@ -481,9 +476,9 @@ int setup_myself(void) err = getaddrinfo(address, myport, &hint, &ai); if(err || !ai) { - syslog(LOG_ERR, _("System call `%s' failed: %s"), "getaddrinfo", + logger(LOG_ERR, _("System call `%s' failed: %s"), "getaddrinfo", gai_strerror(err)); - return -1; + return false; } listen_sockets = 0; @@ -501,9 +496,9 @@ int setup_myself(void) if(listen_socket[listen_sockets].udp < 0) continue; - if(debug_lvl >= DEBUG_CONNECTIONS) { + ifdebug(CONNECTIONS) { hostname = sockaddr2hostname((sockaddr_t *) aip->ai_addr); - syslog(LOG_NOTICE, _("Listening on %s"), hostname); + logger(LOG_NOTICE, _("Listening on %s"), hostname); free(hostname); } @@ -514,23 +509,20 @@ int setup_myself(void) freeaddrinfo(ai); if(listen_sockets) - syslog(LOG_NOTICE, _("Ready")); + logger(LOG_NOTICE, _("Ready")); else { - syslog(LOG_ERR, _("Unable to create any listening socket!")); - return -1; + logger(LOG_ERR, _("Unable to create any listening socket!")); + return false; } - return 0; + return true; } /* setup all initial network connections */ -int setup_network_connections(void) +bool setup_network_connections(void) { - char *envp[5]; - int i; - cp(); now = time(NULL); @@ -542,34 +534,27 @@ int setup_network_connections(void) init_events(); init_requests(); - if(get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout)) { - if(pingtimeout < 1) { - pingtimeout = 86400; + if(get_config_int(lookup_config(config_tree, "PingInterval"), &pinginterval)) { + if(pinginterval < 1) { + pinginterval = 86400; } } else - pingtimeout = 60; - - if(setup_device() < 0) - return -1; + pinginterval = 60; - if(setup_myself() < 0) - return -1; + if(!get_config_int(lookup_config(config_tree, "PingTimeout"), &pingtimeout)) + pingtimeout = 5; + if(pingtimeout < 1 || pingtimeout > pinginterval) + pingtimeout = pinginterval; - /* Run tinc-up script to further initialize the tap interface */ - asprintf(&envp[0], "NETNAME=%s", netname ? : ""); - asprintf(&envp[1], "DEVICE=%s", device ? : ""); - asprintf(&envp[2], "INTERFACE=%s", interface ? : ""); - asprintf(&envp[3], "NAME=%s", myself->name); - envp[4] = NULL; - - execute_script("tinc-up", envp); + if(!get_config_int(lookup_config(config_tree, "MaxOutputBufferSize"), &maxoutbufsize)) + maxoutbufsize = 4 * MTU; - for(i = 0; i < 5; i++) - free(envp[i]); + if(!setup_myself()) + return false; try_outgoing_connections(); - return 0; + return true; } /* @@ -586,21 +571,29 @@ void close_network_connections(void) for(node = connection_tree->head; node; node = next) { next = node->next; - c = (connection_t *) node->data; + c = node->data; if(c->outgoing) free(c->outgoing->name), free(c->outgoing), c->outgoing = NULL; - terminate_connection(c, 0); + terminate_connection(c, false); } - if(myself && myself->connection) - terminate_connection(myself->connection, 0); + if(myself && myself->connection) { + subnet_update(myself, NULL, false); + terminate_connection(myself->connection, false); + } for(i = 0; i < listen_sockets; i++) { close(listen_socket[i].tcp); close(listen_socket[i].udp); } + asprintf(&envp[0], "NETNAME=%s", netname ? : ""); + asprintf(&envp[1], "DEVICE=%s", device ? : ""); + asprintf(&envp[2], "INTERFACE=%s", iface ? : ""); + asprintf(&envp[3], "NAME=%s", myself->name); + envp[4] = NULL; + exit_requests(); exit_events(); exit_edges(); @@ -608,12 +601,6 @@ void close_network_connections(void) exit_nodes(); exit_connections(); - asprintf(&envp[0], "NETNAME=%s", netname ? : ""); - asprintf(&envp[1], "DEVICE=%s", device ? : ""); - asprintf(&envp[2], "INTERFACE=%s", interface ? : ""); - asprintf(&envp[3], "NAME=%s", myself->name); - envp[4] = NULL; - execute_script("tinc-down", envp); for(i = 0; i < 4; i++)