src/misc-progs/openvpnctrl.c

   1 #include <signal.h>
   2 #include <stdio.h>
   3 #include <string.h>
   4 #include <unistd.h>
   5 #include <stdlib.h>
   6 #include <sys/types.h>
   7 #include <fcntl.h>
   8 #include "setuid.h"
   9 #include "libsmooth.h"
  10
  11 #define noovpndebug
  12
  13 // global vars
  14         struct keyvalue *kv = NULL;
  15         FILE *ifacefile = NULL;
  16
  17 char redif[STRING_SIZE];
  18 char blueif[STRING_SIZE];
  19 char orangeif[STRING_SIZE];
  20 char enablered[STRING_SIZE] = "off";
  21 char enableblue[STRING_SIZE] = "off";
  22 char enableorange[STRING_SIZE] = "off";
  23
  24 // consts
  25 char OVPNRED[STRING_SIZE] = "OVPN";
  26 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
  27 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
  28 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.1.2";
  29
  30 struct connection_struct {
  31         char name[STRING_SIZE];
  32         char proto[STRING_SIZE];
  33         int port;
  34         struct connection_struct *next;
  35 };
  36
  37 typedef struct connection_struct connection;
  38
  39 void exithandler(void)
  40 {
  41         if(kv)
  42                 freekeyvalues(kv);
  43         if (ifacefile)
  44                 fclose(ifacefile);
  45 }
  46
  47 void usage(void)
  48 {
  49 #ifdef ovpndebug
  50         printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
  51 #else
  52         printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
  53 #endif
  54         printf("openvpnctrl <option>\n");
  55         printf(" Valid options are:\n");
  56         printf(" -s   --start\n");
  57         printf("      starts OpenVPN (implicitly creates chains and firewall rules)\n");
  58         printf(" -k   --kill\n");
  59         printf("      kills/stops OpenVPN\n");
  60         printf(" -r   --restart\n");
  61         printf("      restarts OpenVPN (implicitly creates chains and firewall rules)\n");
  62         printf(" -d   --display\n");
  63         printf("      displays OpenVPN status to syslog\n");
  64         printf(" -fwr --firewall-rules\n");
  65         printf("      removes current OpenVPN chains and rules and resets them according to the config\n");
  66         printf(" -sdo --start-daemon-only\n");
  67         printf("      starts OpenVPN daemon only\n");
  68         printf(" -ccr --create-chains-and-rules\n");
  69         printf("      creates chains and rules for OpenVPN\n");
  70         printf(" -dcr --delete-chains-and-rules\n");
  71         printf("      removes all chains for OpenVPN\n");
  72         exit(1);
  73 }
  74
  75 connection *getConnections() {
  76         FILE *fp = NULL;
  77
  78         if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
  79                 fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
  80                 exit(1);
  81         }
  82
  83         char line[STRING_SIZE] = "";
  84         char *result;
  85         int count;
  86         connection *conn_first = NULL;
  87         connection *conn_last = NULL;
  88         connection *conn_curr;
  89
  90         while ((fgets(line, STRING_SIZE, fp) != NULL)) {
  91                 if (line[strlen(line) - 1] == '\n')
  92                         line[strlen(line) - 1] = '\0';
  93
  94                 conn_curr = (connection *)malloc(sizeof(connection));
  95                 memset(conn_curr, 0, sizeof(connection));
  96
  97                 if (conn_first == NULL) {
  98                         conn_first = conn_curr;
  99                 } else {
 100                         conn_last->next = conn_curr;
 101                 }
 102                 conn_last = conn_curr;
 103
 104                 count = 0;
 105                 result = strtok(line, ",");
 106                 while (result) {
 107                         if (count == 2) {
 108                                 strcpy(conn_curr->name, result);
 109                         } else if (count == 12) {
 110                                 strcpy(conn_curr->proto, result);
 111                         } else if (count == 13) {
 112                                 conn_curr->port = atoi(result);
 113                         }
 114
 115                         result = strtok(NULL, ",");
 116                         count++;
 117                 }
 118         }
 119
 120         fclose(fp);
 121
 122         return conn_first;
 123 }
 124
 125 void ovpnInit(void) {
 126
 127         // Read OpenVPN configuration
 128         kv = initkeyvalues();
 129         if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
 130                 fprintf(stderr, "Cannot read ovpn settings\n");
 131                 exit(1);
 132         }
 133
 134         if (!findkey(kv, "ENABLED", enablered)) {
 135                 fprintf(stderr, "Cannot read ENABLED\n");
 136                 exit(1);
 137         }
 138
 139         if (!findkey(kv, "ENABLED_BLUE", enableblue)){
 140                 fprintf(stderr, "Cannot read ENABLED_BLUE\n");
 141                 exit(1);
 142         }
 143
 144         if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
 145                 fprintf(stderr, "Cannot read ENABLED_ORANGE\n");
 146                 exit(1);
 147         }
 148         freekeyvalues(kv);
 149
 150         // read interface settings
 151
 152         // details for the red int
 153         memset(redif, 0, STRING_SIZE);
 154         if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
 155         {
 156                 if (fgets(redif, STRING_SIZE, ifacefile))
 157                 {
 158                         if (redif[strlen(redif) - 1] == '\n')
 159                                 redif[strlen(redif) - 1] = '\0';
 160                 }
 161                 fclose (ifacefile);
 162                 ifacefile = NULL;
 163
 164                 if (!VALID_DEVICE(redif))
 165                 {
 166                         memset(redif, 0, STRING_SIZE);
 167                 }
 168         }
 169
 170         kv=initkeyvalues();
 171         if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
 172         {
 173                 fprintf(stderr, "Cannot read ethernet settings\n");
 174                 exit(1);
 175         }
 176
 177         if (strcmp(enableblue, "on")==0){
 178                 if (!findkey(kv, "BLUE_DEV", blueif)){
 179                         fprintf(stderr, "Cannot read BLUE_DEV\n");
 180                         exit(1);
 181                 }
 182         }
 183         if (strcmp(enableorange, "on")==0){
 184                 if (!findkey(kv, "ORANGE_DEV", orangeif)){
 185                         fprintf(stderr, "Cannot read ORNAGE_DEV\n");
 186                         exit(1);
 187                 }
 188         }
 189         freekeyvalues(kv);
 190 }
 191
 192 void executeCommand(char *command) {
 193 #ifdef ovpndebug
 194         printf(strncat(command, "\n", 2));
 195 #endif
 196         safe_system(strncat(command, " >/dev/null 2>&1", 17));
 197 }
 198
 199 void setChainRules(char *chain, char *interface, char *protocol, char *port)
 200 {
 201         char str[STRING_SIZE];
 202
 203         sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
 204         executeCommand(str);
 205         sprintf(str, "/sbin/iptables -A %sINPUT -i tun+ -j ACCEPT", chain);
 206         executeCommand(str);
 207         sprintf(str, "/sbin/iptables -A %sFORWARD -i tun+ -j ACCEPT", chain);
 208         executeCommand(str);
 209 }
 210
 211 void flushChain(char *chain) {
 212         char str[STRING_SIZE];
 213
 214         sprintf(str, "/sbin/iptables -F %sINPUT", chain);
 215         executeCommand(str);
 216         sprintf(str, "/sbin/iptables -F %sFORWARD", chain);
 217         executeCommand(str);
 218         safe_system(str);
 219 }
 220
 221 void deleteChainReference(char *chain) {
 222         char str[STRING_SIZE];
 223
 224         sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
 225         executeCommand(str);
 226         safe_system(str);
 227         sprintf(str, "/sbin/iptables -D FORWARD -j %sFORWARD", chain);
 228         executeCommand(str);
 229         safe_system(str);
 230 }
 231
 232 void deleteChain(char *chain) {
 233         char str[STRING_SIZE];
 234
 235         sprintf(str, "/sbin/iptables -X %sINPUT", chain);
 236         executeCommand(str);
 237         sprintf(str, "/sbin/iptables -X %sFORWARD", chain);
 238         executeCommand(str);
 239 }
 240
 241 void deleteAllChains(void) {
 242         // not an elegant solution, but to avoid timing problems with undeleted chain references
 243         deleteChainReference(OVPNRED);
 244         deleteChainReference(OVPNBLUE);
 245         deleteChainReference(OVPNORANGE);
 246         flushChain(OVPNRED);
 247         flushChain(OVPNBLUE);
 248         flushChain(OVPNORANGE);
 249         deleteChain(OVPNRED);
 250         deleteChain(OVPNBLUE);
 251         deleteChain(OVPNORANGE);
 252 }
 253
 254 void createChainReference(char *chain) {
 255         char str[STRING_SIZE];
 256         sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
 257         executeCommand(str);
 258         sprintf(str, "/sbin/iptables -I FORWARD %s -j %sFORWARD", "12", chain);
 259         executeCommand(str);
 260 }
 261
 262 void createChain(char *chain) {
 263         char str[STRING_SIZE];
 264         sprintf(str, "/sbin/iptables -N %sINPUT", chain);
 265         executeCommand(str);
 266         sprintf(str, "/sbin/iptables -N %sFORWARD", chain);
 267         executeCommand(str);
 268 }
 269
 270 void createAllChains(void) {
 271         if (!((strcmp(enablered, "on")==0) || (strcmp(enableblue, "on")==0) || (strcmp(enableorange, "on")==0))){
 272                 fprintf(stderr, "OpenVPN is not enabled on any interface\n");
 273                 exit(1);
 274         } else {
 275                 // create chain and chain references
 276                 if (!strcmp(enableorange, "on")) {
 277                         if (strlen(orangeif)) {
 278                                 createChain(OVPNORANGE);
 279                                 createChainReference(OVPNORANGE);
 280                         } else {
 281                                 fprintf(stderr, "OpenVPN enabled on orange but no orange interface found\n");
 282                                 //exit(1);
 283                         }
 284                 }
 285
 286                 if (!strcmp(enableblue, "on")) {
 287                         if (strlen(blueif)) {
 288                                 createChain(OVPNBLUE);
 289                                 createChainReference(OVPNBLUE);
 290                         } else {
 291                                 fprintf(stderr, "OpenVPN enabled on blue but no blue interface found\n");
 292                                 //exit(1);
 293                         }
 294                 }
 295
 296                 if (!strcmp(enablered, "on")) {
 297                         if (strlen(redif)) {
 298                                 createChain(OVPNRED);
 299                                 createChainReference(OVPNRED);
 300                         } else {
 301                                 fprintf(stderr, "OpenVPN enabled on red but no red interface found\n");
 302                                 //exit(1);
 303                         }
 304                 }
 305         }
 306 }
 307
 308 void setFirewallRules(void) {
 309         char protocol[STRING_SIZE] = "";
 310         char dport[STRING_SIZE] = "";
 311         char dovpnip[STRING_SIZE] = "";
 312
 313         /* check if it makes sence to proceed further */
 314         if (!((strcmp(enablered, "on")==0) || (strcmp(enableblue, "on")==0) || (strcmp(enableorange, "on")==0))){
 315                 fprintf(stderr, "Config error, at least one device must be enabled\n");
 316                 exit(1);
 317         }
 318
 319         kv = initkeyvalues();
 320         if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
 321         {
 322                 fprintf(stderr, "Cannot read ovpn settings\n");
 323                 exit(1);
 324         }
 325
 326         /* we got one device, so lets proceed further   */
 327         if (!findkey(kv, "DDEST_PORT", dport)){
 328                 fprintf(stderr, "Cannot read DDEST_PORT\n");
 329                 exit(1);
 330         }
 331
 332         if (!findkey(kv, "DPROTOCOL", protocol)){
 333                 fprintf(stderr, "Cannot read DPROTOCOL\n");
 334                 exit(1);
 335         }
 336
 337         if (!findkey(kv, "VPN_IP", dovpnip)){
 338                 fprintf(stderr, "Cannot read VPN_IP\n");
 339 //              exit(1); step further as we don't need an ip
 340         }
 341         freekeyvalues(kv);
 342
 343         // read connection configuration
 344         connection *conn = getConnections();
 345
 346         // Flush all chains.
 347         flushChain(OVPNRED);
 348         flushChain(OVPNBLUE);
 349         flushChain(OVPNORANGE);
 350
 351         // set firewall rules
 352         if (!strcmp(enablered, "on") && strlen(redif))
 353                 setChainRules(OVPNRED, redif, protocol, dport);
 354         if (!strcmp(enableblue, "on") && strlen(blueif))
 355                 setChainRules(OVPNBLUE, blueif, protocol, dport);
 356         if (!strcmp(enableorange, "on") && strlen(orangeif))
 357                 setChainRules(OVPNORANGE, orangeif, protocol, dport);
 358
 359         // set firewall rules for n2n connections
 360         char *port;
 361         while (conn) {
 362                 sprintf(port, "%d", conn->port);
 363                 setChainRules(OVPNRED, redif, conn->proto, port);
 364                 conn = conn->next;
 365         }
 366 }
 367
 368 void stopDaemon(void) {
 369         char command[STRING_SIZE];
 370
 371         snprintf(command, STRING_SIZE - 1, "/bin/killall openvpn");
 372         executeCommand(command);
 373         snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
 374         executeCommand(command);
 375         snprintf(command, STRING_SIZE-1, "/sbin/modprobe -r tun");
 376         executeCommand(command);
 377 }
 378
 379 void startDaemon(void) {
 380         char command[STRING_SIZE];
 381
 382         if (!((strcmp(enablered, "on")==0) || (strcmp(enableblue, "on")==0) || (strcmp(enableorange, "on")==0))){
 383                 fprintf(stderr, "OpenVPN is not enabled on any interface\n");
 384                 exit(1);
 385         } else {
 386                 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
 387                 executeCommand(command);
 388                 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
 389                 executeCommand(command);
 390         }
 391 }
 392
 393 void startNet2Net(char *name) {
 394         connection *conn = NULL;
 395         connection *conn_iter;
 396
 397         conn_iter = getConnections();
 398
 399         while (conn_iter) {
 400                 if (strcmp(conn_iter->name, name) == 0) {
 401                         conn = conn_iter;
 402                         break;
 403                 }
 404                 conn_iter = conn_iter->next;
 405         }
 406
 407         if (conn == NULL) {
 408                 fprintf(stderr, "Connection not found.\n");
 409                 exit(1);
 410         }
 411
 412         char configfile[STRING_SIZE];
 413         snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
 414                 conn->name, conn->name);
 415
 416         FILE *fp = fopen(configfile, "r");
 417         if (fp == NULL) {
 418                 fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
 419                         conn->name, configfile);
 420                 exit(2);
 421         }
 422         fclose(fp);
 423
 424         // Make sure all firewall rules are up to date.
 425         setFirewallRules();
 426
 427         char command[STRING_SIZE];
 428         sprintf(command, "/usr/sbin/openvpn --config %s", configfile);
 429         executeCommand(command);
 430 }
 431
 432 void killNet2Net(char *name) {
 433         connection *conn = NULL;
 434         connection *conn_iter;
 435
 436         conn_iter = getConnections();
 437
 438         while (conn_iter) {
 439                 if (strcmp(conn_iter->name, name) == 0) {
 440                         conn = conn_iter;
 441                         break;
 442                 }
 443                 conn_iter = conn_iter->next;
 444         }
 445
 446         if (conn == NULL) {
 447                 fprintf(stderr, "Connection not found.\n");
 448                 exit(1);
 449         }
 450
 451         char pidfile[STRING_SIZE];
 452         snprintf(&pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);
 453
 454         FILE *fp = fopen(pidfile, "r");
 455         if (fp == NULL) {
 456                 fprintf(stderr, "Could not determine PID for connection '%s'.\n", conn->name);
 457                 fprintf(stderr, "PID file not found: '%s'\n", pidfile);
 458                 exit(1);
 459         }
 460
 461         int pid;
 462         fscanf(fp, "%d", &pid);
 463         fclose(fp);
 464
 465         fprintf(stderr, "Killing PID %d.\n", pid);
 466         kill(pid, SIGTERM);
 467
 468         exit(0);
 469 }
 470
 471 void displayopenvpn(void) {
 472         char command[STRING_SIZE];
 473
 474         snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
 475         executeCommand(command);
 476 }
 477
 478 int main(int argc, char *argv[]) {
 479         if (!(initsetuid()))
 480             exit(1);
 481         if(argc < 2)
 482             usage();
 483
 484         if(argc == 3) {
 485                 if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
 486                         startNet2Net(argv[2]);
 487                         return 0;
 488                 }
 489                 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
 490                         killNet2Net(argv[2]);
 491                         return 0;
 492                 } else {
 493                         usage();
 494                         return 1;
 495                 }
 496         }
 497         else if(argc == 2) {
 498                 if( (strcmp(argv[1], "-k") == 0) || (strcmp(argv[1], "--kill") == 0) ) {
 499                         stopDaemon();
 500                         return 0;
 501                 }
 502                 else if( (strcmp(argv[1], "-d") == 0) || (strcmp(argv[1], "--display") == 0) ) {
 503                         displayopenvpn();
 504                         return 0;
 505                 }
 506                 else if( (strcmp(argv[1], "-dcr") == 0) || (strcmp(argv[1], "--delete-chains-and-rules") == 0) ) {
 507                         deleteAllChains();
 508                         return 0;
 509                 }
 510                 else {
 511                         ovpnInit();
 512
 513                         if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
 514                                 deleteAllChains();
 515                                 createAllChains();
 516                                 setFirewallRules();
 517                                 startDaemon();
 518                                 return 0;
 519                         }
 520                         else if( (strcmp(argv[1], "-sdo") == 0) || (strcmp(argv[1], "--start-daemon-only") == 0) ) {
 521                                 startDaemon();
 522                                 return 0;
 523                         }
 524                         else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
 525                                 stopDaemon();
 526                                 deleteAllChains();
 527                                 createAllChains();
 528                                 setFirewallRules();
 529                                 startDaemon();
 530                                 return 0;
 531                         }
 532                         else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
 533                                 deleteAllChains();
 534                                 createAllChains();
 535                                 setFirewallRules();
 536                                 return 0;
 537                         }
 538                         else if( (strcmp(argv[1], "-ccr") == 0) || (strcmp(argv[1], "--create-chains-and-rules") == 0) ) {
 539                                 createAllChains();
 540                                 setFirewallRules();
 541                                 return 0;
 542                         }
 543                         else {
 544                                 usage();
 545                                 return 0;
 546                         }
 547                 }
 548         }
 549         else {
 550                 usage();
 551                 return 0;
 552         }
 553 return 0;
 554 }
 555