]>
Commit | Line | Data |
---|---|---|
997358a6 MW |
1 | /* strongSwan IPsec config file parser |
2 | * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify it | |
5 | * under the terms of the GNU General Public License as published by the | |
6 | * Free Software Foundation; either version 2 of the License, or (at your | |
7 | * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. | |
8 | * | |
9 | * This program is distributed in the hope that it will be useful, but | |
10 | * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY | |
11 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
12 | * for more details. | |
997358a6 MW |
13 | */ |
14 | ||
15 | #include <stddef.h> | |
16 | #include <stdlib.h> | |
17 | #include <string.h> | |
18 | #include <assert.h> | |
19 | ||
20 | #include <freeswan.h> | |
21 | ||
f13a03ad MW |
22 | #include <eap/eap.h> |
23 | ||
997358a6 MW |
24 | #include "../pluto/constants.h" |
25 | #include "../pluto/defs.h" | |
26 | #include "../pluto/log.h" | |
27 | ||
28 | #include "keywords.h" | |
29 | #include "parser.h" | |
30 | #include "confread.h" | |
31 | #include "args.h" | |
32 | #include "interfaces.h" | |
33 | ||
fc0afb68 | 34 | /* strings containing a colon are interpreted as an IPv6 address */ |
9d53cc5d | 35 | #define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6) |
fc0afb68 | 36 | |
11e6d285 AS |
37 | static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536"; |
38 | static const char esp_defaults[] = "aes128-sha1,3des-sha1"; | |
997358a6 MW |
39 | |
40 | static const char firewall_defaults[] = "ipsec _updown iptables"; | |
41 | ||
fc0afb68 | 42 | static void default_values(starter_config_t *cfg) |
997358a6 | 43 | { |
9d53cc5d AS |
44 | if (cfg == NULL) |
45 | return; | |
46 | ||
47 | memset(cfg, 0, sizeof(struct starter_config)); | |
48 | ||
49 | /* is there enough space for all seen flags? */ | |
50 | assert(KW_SETUP_LAST - KW_SETUP_FIRST < | |
51 | sizeof(cfg->setup.seen) * BITS_PER_BYTE); | |
52 | assert(KW_CONN_LAST - KW_CONN_FIRST < | |
53 | sizeof(cfg->conn_default.seen) * BITS_PER_BYTE); | |
54 | assert(KW_END_LAST - KW_END_FIRST < | |
55 | sizeof(cfg->conn_default.right.seen) * BITS_PER_BYTE); | |
56 | assert(KW_CA_LAST - KW_CA_FIRST < | |
57 | sizeof(cfg->ca_default.seen) * BITS_PER_BYTE); | |
58 | ||
59 | cfg->setup.seen = LEMPTY; | |
60 | cfg->setup.fragicmp = TRUE; | |
61 | cfg->setup.hidetos = TRUE; | |
62 | cfg->setup.uniqueids = TRUE; | |
63 | cfg->setup.interfaces = new_list("%defaultroute"); | |
e4838d02 MW |
64 | |
65 | #ifdef START_CHARON | |
9d53cc5d | 66 | cfg->setup.charonstart = TRUE; |
e4838d02 MW |
67 | #endif |
68 | #ifdef START_PLUTO | |
9d53cc5d | 69 | cfg->setup.plutostart = TRUE; |
e4838d02 | 70 | #endif |
65cf07ac | 71 | |
9d53cc5d AS |
72 | cfg->conn_default.seen = LEMPTY; |
73 | cfg->conn_default.startup = STARTUP_NO; | |
74 | cfg->conn_default.state = STATE_IGNORE; | |
11e6d285 | 75 | cfg->conn_default.policy = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_PUBKEY | |
9d53cc5d AS |
76 | POLICY_PFS | POLICY_MOBIKE; |
77 | ||
78 | cfg->conn_default.ike = clone_str(ike_defaults); | |
79 | cfg->conn_default.esp = clone_str(esp_defaults); | |
80 | cfg->conn_default.sa_ike_life_seconds = OAKLEY_ISAKMP_SA_LIFETIME_DEFAULT; | |
81 | cfg->conn_default.sa_ipsec_life_seconds = PLUTO_SA_LIFE_DURATION_DEFAULT; | |
82 | cfg->conn_default.sa_rekey_margin = SA_REPLACEMENT_MARGIN_DEFAULT; | |
83 | cfg->conn_default.sa_rekey_fuzz = SA_REPLACEMENT_FUZZ_DEFAULT; | |
84 | cfg->conn_default.sa_keying_tries = SA_REPLACEMENT_RETRIES_DEFAULT; | |
85 | cfg->conn_default.addr_family = AF_INET; | |
86 | cfg->conn_default.tunnel_addr_family = AF_INET; | |
87 | cfg->conn_default.install_policy = TRUE; | |
88 | cfg->conn_default.dpd_delay = 30; /* seconds */ | |
89 | cfg->conn_default.dpd_timeout = 150; /* seconds */ | |
90 | ||
91 | cfg->conn_default.left.seen = LEMPTY; | |
92 | cfg->conn_default.right.seen = LEMPTY; | |
93 | ||
94 | cfg->conn_default.left.sendcert = CERT_SEND_IF_ASKED; | |
95 | cfg->conn_default.right.sendcert = CERT_SEND_IF_ASKED; | |
96 | ||
97 | anyaddr(AF_INET, &cfg->conn_default.left.addr); | |
98 | anyaddr(AF_INET, &cfg->conn_default.left.nexthop); | |
99 | anyaddr(AF_INET, &cfg->conn_default.right.addr); | |
100 | anyaddr(AF_INET, &cfg->conn_default.right.nexthop); | |
667b7372 MW |
101 | cfg->conn_default.left.ikeport = 500; |
102 | cfg->conn_default.right.ikeport = 500; | |
9d53cc5d AS |
103 | |
104 | cfg->ca_default.seen = LEMPTY; | |
997358a6 MW |
105 | } |
106 | ||
107 | #define KW_POLICY_FLAG(sy, sn, fl) \ | |
9d53cc5d AS |
108 | if (streq(kw->value, sy)) { conn->policy |= fl; } \ |
109 | else if (streq(kw->value, sn)) { conn->policy &= ~fl; } \ | |
110 | else { plog("# bad policy value: %s=%s", kw->entry->name, kw->value); cfg->err++; } | |
997358a6 | 111 | |
a4848432 | 112 | static void load_setup(starter_config_t *cfg, config_parsed_t *cfgp) |
997358a6 | 113 | { |
9d53cc5d | 114 | kw_list_t *kw; |
997358a6 | 115 | |
9d53cc5d AS |
116 | DBG(DBG_CONTROL, |
117 | DBG_log("Loading config setup") | |
118 | ) | |
997358a6 | 119 | |
9d53cc5d AS |
120 | for (kw = cfgp->config_setup; kw; kw = kw->next) |
121 | { | |
122 | bool assigned = FALSE; | |
3d7a244b | 123 | |
9d53cc5d | 124 | kw_token_t token = kw->entry->token; |
7daf5226 | 125 | |
9d53cc5d AS |
126 | if (token < KW_SETUP_FIRST || token > KW_SETUP_LAST) |
127 | { | |
128 | plog("# unsupported keyword '%s' in config setup", kw->entry->name); | |
129 | cfg->err++; | |
130 | continue; | |
131 | } | |
3d7a244b | 132 | |
9d53cc5d AS |
133 | if (!assign_arg(token, KW_SETUP_FIRST, kw, (char *)cfg, &assigned)) |
134 | { | |
135 | plog(" bad argument value in config setup"); | |
136 | cfg->err++; | |
137 | continue; | |
65cf07ac | 138 | } |
9d53cc5d | 139 | } |
997358a6 MW |
140 | } |
141 | ||
270bb348 AS |
142 | static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token, |
143 | kw_list_t *kw, char *conn_name, starter_config_t *cfg) | |
997358a6 | 144 | { |
9d53cc5d AS |
145 | err_t ugh = NULL; |
146 | bool assigned = FALSE; | |
72353428 | 147 | bool has_port_wildcard; /* set if port is %any */ |
9d53cc5d AS |
148 | |
149 | char *name = kw->entry->name; | |
150 | char *value = kw->value; | |
151 | ||
152 | if (!assign_arg(token, KW_END_FIRST, kw, (char *)end, &assigned)) | |
153 | goto err; | |
154 | ||
155 | /* post processing of some keywords that were assigned automatically */ | |
156 | switch (token) | |
157 | { | |
158 | case KW_SUBNET: | |
159 | if ((strlen(value) >= 6 && strncmp(value,"vhost:",6) == 0) | |
160 | || (strlen(value) >= 5 && strncmp(value,"vnet:",5) == 0)) | |
161 | { | |
162 | /* used by pluto only */ | |
163 | end->has_virt = TRUE; | |
164 | } | |
165 | else | |
166 | { | |
167 | ip_subnet net; | |
168 | char *pos; | |
169 | int len = 0; | |
7daf5226 | 170 | |
9d53cc5d AS |
171 | end->has_client = TRUE; |
172 | conn->tunnel_addr_family = ip_version(value); | |
7daf5226 | 173 | |
9d53cc5d AS |
174 | pos = strchr(value, ','); |
175 | if (pos) | |
176 | { | |
177 | len = pos - value; | |
178 | } | |
179 | ugh = ttosubnet(value, len, ip_version(value), &net); | |
180 | if (ugh != NULL) | |
181 | { | |
182 | plog("# bad subnet: %s=%s [%s]", name, value, ugh); | |
183 | goto err; | |
184 | } | |
185 | } | |
186 | break; | |
187 | case KW_SOURCEIP: | |
188 | if (end->has_natip) | |
189 | { | |
190 | plog("# natip and sourceip cannot be defined at the same time"); | |
191 | goto err; | |
192 | } | |
270bb348 | 193 | if (value[0] == '%') |
9d53cc5d | 194 | { |
270bb348 AS |
195 | if (streq(value, "%modeconfig") || streq(value, "%modecfg") || |
196 | streq(value, "%config") || streq(value, "%cfg")) | |
197 | { | |
198 | /* request ip via config payload */ | |
61e48488 | 199 | free(end->sourceip); |
270bb348 AS |
200 | end->sourceip = NULL; |
201 | end->sourceip_mask = 1; | |
202 | } | |
203 | else | |
204 | { /* %poolname, strip %, serve ip requests */ | |
61e48488 | 205 | free(end->sourceip); |
270bb348 | 206 | end->sourceip = clone_str(value+1); |
8015c91c | 207 | end->sourceip_mask = 0; |
270bb348 | 208 | } |
9d53cc5d AS |
209 | end->modecfg = TRUE; |
210 | } | |
211 | else | |
212 | { | |
270bb348 | 213 | char *pos; |
9d53cc5d AS |
214 | ip_address addr; |
215 | ip_subnet net; | |
7daf5226 | 216 | |
9d53cc5d | 217 | conn->tunnel_addr_family = ip_version(value); |
270bb348 AS |
218 | pos = strchr(value, '/'); |
219 | ||
220 | if (pos) | |
9d53cc5d AS |
221 | { /* CIDR notation, address pool */ |
222 | ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &net); | |
270bb348 AS |
223 | if (ugh != NULL) |
224 | { | |
225 | plog("# bad subnet: %s=%s [%s]", name, value, ugh); | |
226 | goto err; | |
227 | } | |
228 | *pos = '\0'; | |
fc753c1d AS |
229 | free(end->sourceip); |
230 | end->sourceip = clone_str(value); | |
270bb348 | 231 | end->sourceip_mask = atoi(pos + 1); |
9d53cc5d | 232 | } |
8015c91c | 233 | else |
270bb348 | 234 | { /* fixed srcip */ |
9d53cc5d | 235 | ugh = ttoaddr(value, 0, conn->tunnel_addr_family, &addr); |
270bb348 AS |
236 | if (ugh != NULL) |
237 | { | |
238 | plog("# bad addr: %s=%s [%s]", name, value, ugh); | |
239 | goto err; | |
240 | } | |
270bb348 AS |
241 | end->sourceip_mask = (conn->tunnel_addr_family == AF_INET) ? |
242 | 32 : 128; | |
9d53cc5d AS |
243 | } |
244 | } | |
245 | conn->policy |= POLICY_TUNNEL; | |
246 | break; | |
247 | case KW_SENDCERT: | |
248 | if (end->sendcert == CERT_YES_SEND) | |
249 | { | |
250 | end->sendcert = CERT_ALWAYS_SEND; | |
251 | } | |
252 | else if (end->sendcert == CERT_NO_SEND) | |
253 | { | |
254 | end->sendcert = CERT_NEVER_SEND; | |
255 | } | |
256 | break; | |
257 | default: | |
258 | break; | |
259 | } | |
65cf07ac | 260 | |
9d53cc5d AS |
261 | if (assigned) |
262 | return; | |
65cf07ac | 263 | |
9d53cc5d AS |
264 | /* individual processing of keywords that were not assigned automatically */ |
265 | switch (token) | |
266 | { | |
267 | case KW_HOST: | |
268 | if (streq(value, "%defaultroute")) | |
269 | { | |
270 | if (cfg->defaultroute.defined) | |
271 | { | |
272 | end->addr = cfg->defaultroute.addr; | |
273 | end->nexthop = cfg->defaultroute.nexthop; | |
274 | } | |
075448fb MW |
275 | else if (!cfg->defaultroute.supported) |
276 | { | |
277 | plog("%%defaultroute not supported, fallback to %%any"); | |
278 | } | |
9d53cc5d AS |
279 | else |
280 | { | |
281 | plog("# default route not known: %s=%s", name, value); | |
65cf07ac | 282 | goto err; |
9d53cc5d AS |
283 | } |
284 | } | |
285 | else if (streq(value, "%any") || streq(value, "%any4")) | |
286 | { | |
287 | anyaddr(conn->addr_family, &end->addr); | |
288 | } | |
289 | else if (streq(value, "%any6")) | |
290 | { | |
291 | conn->addr_family = AF_INET6; | |
292 | anyaddr(conn->addr_family, &end->addr); | |
293 | } | |
294 | else if (streq(value, "%group")) | |
295 | { | |
296 | ip_address any; | |
a80521d1 | 297 | |
9d53cc5d AS |
298 | conn->policy |= POLICY_GROUP | POLICY_TUNNEL; |
299 | anyaddr(conn->addr_family, &end->addr); | |
300 | anyaddr(conn->tunnel_addr_family, &any); | |
301 | end->has_client = TRUE; | |
302 | } | |
303 | else | |
65cf07ac | 304 | { |
9d53cc5d AS |
305 | /* check for allow_any prefix */ |
306 | if (value[0] == '%') | |
307 | { | |
308 | end->allow_any = TRUE; | |
309 | value++; | |
310 | } | |
311 | conn->addr_family = ip_version(value); | |
312 | ugh = ttoaddr(value, 0, conn->addr_family, &end->addr); | |
313 | if (ugh != NULL) | |
314 | { | |
315 | plog("# bad addr: %s=%s [%s]", name, value, ugh); | |
316 | if (streq(ugh, "does not look numeric and name lookup failed")) | |
3f946e1c | 317 | { |
9d53cc5d AS |
318 | end->dns_failed = TRUE; |
319 | anyaddr(conn->addr_family, &end->addr); | |
3f946e1c AS |
320 | } |
321 | else | |
322 | { | |
9d53cc5d | 323 | goto err; |
3d7a244b | 324 | } |
9d53cc5d | 325 | } |
65cf07ac | 326 | } |
9d53cc5d AS |
327 | break; |
328 | case KW_NEXTHOP: | |
329 | if (streq(value, "%defaultroute")) | |
0e4d1d05 | 330 | { |
9d53cc5d | 331 | if (cfg->defaultroute.defined) |
270bb348 | 332 | { |
9d53cc5d | 333 | end->nexthop = cfg->defaultroute.nexthop; |
270bb348 | 334 | } |
9d53cc5d AS |
335 | else |
336 | { | |
337 | plog("# default route not known: %s=%s", name, value); | |
338 | goto err; | |
339 | } | |
340 | } | |
341 | else if (streq(value, "%direct")) | |
342 | { | |
343 | ugh = anyaddr(conn->addr_family, &end->nexthop); | |
344 | } | |
345 | else | |
346 | { | |
347 | conn->addr_family = ip_version(value); | |
348 | ugh = ttoaddr(value, 0, conn->addr_family, &end->nexthop); | |
349 | } | |
350 | if (ugh != NULL) | |
351 | { | |
352 | plog("# bad addr: %s=%s [%s]", name, value, ugh); | |
353 | goto err; | |
354 | } | |
355 | break; | |
356 | case KW_SUBNETWITHIN: | |
357 | { | |
358 | ip_subnet net; | |
7daf5226 | 359 | |
9d53cc5d AS |
360 | end->has_client = TRUE; |
361 | end->has_client_wildcard = TRUE; | |
362 | conn->tunnel_addr_family = ip_version(value); | |
3d7a244b | 363 | |
9d53cc5d AS |
364 | ugh = ttosubnet(value, 0, ip_version(value), &net); |
365 | if (ugh != NULL) | |
0e4d1d05 | 366 | { |
9d53cc5d AS |
367 | plog("# bad subnet: %s=%s [%s]", name, value, ugh); |
368 | goto err; | |
3a5f6dff | 369 | } |
9d53cc5d AS |
370 | end->subnet = clone_str(value); |
371 | break; | |
372 | } | |
373 | case KW_PROTOPORT: | |
374 | ugh = ttoprotoport(value, 0, &end->protocol, &end->port, &has_port_wildcard); | |
375 | end->has_port_wildcard = has_port_wildcard; | |
376 | break; | |
377 | case KW_NATIP: | |
270bb348 | 378 | if (end->sourceip) |
9d53cc5d AS |
379 | { |
380 | plog("# natip and sourceip cannot be defined at the same time"); | |
381 | goto err; | |
0e4d1d05 | 382 | } |
9d53cc5d AS |
383 | if (streq(value, "%defaultroute")) |
384 | { | |
385 | char buf[64]; | |
7daf5226 | 386 | |
9d53cc5d AS |
387 | if (cfg->defaultroute.defined) |
388 | { | |
389 | addrtot(&cfg->defaultroute.addr, 0, buf, sizeof(buf)); | |
270bb348 | 390 | end->sourceip = clone_str(buf); |
9d53cc5d AS |
391 | } |
392 | else | |
393 | { | |
394 | plog("# default route not known: %s=%s", name, value); | |
395 | goto err; | |
396 | } | |
397 | } | |
398 | else | |
399 | { | |
400 | ip_address addr; | |
7daf5226 | 401 | |
9d53cc5d AS |
402 | conn->tunnel_addr_family = ip_version(value); |
403 | ugh = ttoaddr(value, 0, conn->tunnel_addr_family, &addr); | |
404 | if (ugh != NULL) | |
405 | { | |
406 | plog("# bad addr: %s=%s [%s]", name, value, ugh); | |
407 | goto err; | |
408 | } | |
270bb348 | 409 | end->sourceip = clone_str(value); |
9d53cc5d AS |
410 | } |
411 | end->has_natip = TRUE; | |
412 | conn->policy |= POLICY_TUNNEL; | |
413 | break; | |
414 | default: | |
415 | break; | |
416 | } | |
417 | return; | |
997358a6 MW |
418 | |
419 | err: | |
9d53cc5d AS |
420 | plog(" bad argument value in conn '%s'", conn_name); |
421 | cfg->err++; | |
997358a6 MW |
422 | } |
423 | ||
ec11518d AS |
424 | /* |
425 | * handles left|right=<FQDN> DNS resolution failure | |
426 | */ | |
a4848432 AS |
427 | static void handle_dns_failure(const char *label, starter_end_t *end, |
428 | starter_config_t *cfg) | |
ec11518d | 429 | { |
9d53cc5d AS |
430 | if (end->dns_failed) |
431 | { | |
432 | if (end->allow_any) | |
ec11518d | 433 | { |
9d53cc5d AS |
434 | plog("# fallback to %s=%%any due to '%%' prefix or %sallowany=yes", |
435 | label, label); | |
ec11518d | 436 | } |
9d53cc5d AS |
437 | else |
438 | { | |
439 | /* declare an error */ | |
440 | cfg->err++; | |
441 | } | |
442 | } | |
ec11518d AS |
443 | } |
444 | ||
997358a6 MW |
445 | /* |
446 | * handles left|rightfirewall and left|rightupdown parameters | |
447 | */ | |
a4848432 AS |
448 | static void handle_firewall(const char *label, starter_end_t *end, |
449 | starter_config_t *cfg) | |
997358a6 | 450 | { |
9d53cc5d AS |
451 | if (end->firewall && (end->seen & LELEM(KW_FIREWALL - KW_END_FIRST))) |
452 | { | |
453 | if (end->updown != NULL) | |
65cf07ac | 454 | { |
9d53cc5d AS |
455 | plog("# cannot have both %sfirewall and %supdown", label, label); |
456 | cfg->err++; | |
457 | } | |
458 | else | |
459 | { | |
460 | end->updown = clone_str(firewall_defaults); | |
461 | end->firewall = FALSE; | |
65cf07ac | 462 | } |
9d53cc5d | 463 | } |
997358a6 MW |
464 | } |
465 | ||
f13a03ad | 466 | static bool handle_mark(char *value, mark_t *mark) |
26c4d010 AS |
467 | { |
468 | char *pos, *endptr; | |
469 | ||
470 | pos = strchr(value, '/'); | |
471 | if (pos) | |
472 | { | |
473 | *pos = '\0'; | |
474 | mark->mask = strtoul(pos+1, &endptr, 0); | |
475 | if (*endptr != '\0') | |
476 | { | |
477 | plog("# invalid mark mask: %s", pos+1); | |
478 | return FALSE; | |
479 | } | |
480 | } | |
481 | else | |
482 | { | |
483 | mark->mask = 0xffffffff; | |
484 | } | |
485 | if (value == '\0') | |
486 | { | |
487 | mark->value = 0; | |
488 | } | |
489 | else | |
490 | { | |
491 | mark->value = strtoul(value, &endptr, 0); | |
492 | if (*endptr != '\0') | |
493 | { | |
494 | plog("# invalid mark value: %s", value); | |
495 | return FALSE; | |
496 | } | |
497 | } | |
498 | return TRUE; | |
499 | } | |
500 | ||
997358a6 MW |
501 | /* |
502 | * parse a conn section | |
503 | */ | |
a4848432 | 504 | static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg) |
997358a6 | 505 | { |
9d53cc5d | 506 | char *conn_name = (conn->name == NULL)? "%default":conn->name; |
997358a6 | 507 | |
9d53cc5d AS |
508 | for ( ; kw; kw = kw->next) |
509 | { | |
510 | bool assigned = FALSE; | |
511 | ||
512 | kw_token_t token = kw->entry->token; | |
513 | ||
514 | if (token >= KW_LEFT_FIRST && token <= KW_LEFT_LAST) | |
515 | { | |
516 | kw_end(conn, &conn->left, token - KW_LEFT_FIRST + KW_END_FIRST | |
517 | , kw, conn_name, cfg); | |
518 | continue; | |
519 | } | |
520 | else if (token >= KW_RIGHT_FIRST && token <= KW_RIGHT_LAST) | |
65cf07ac | 521 | { |
9d53cc5d AS |
522 | kw_end(conn, &conn->right, token - KW_RIGHT_FIRST + KW_END_FIRST |
523 | , kw, conn_name, cfg); | |
524 | continue; | |
525 | } | |
65cf07ac | 526 | |
9d53cc5d AS |
527 | if (token == KW_AUTO) |
528 | { | |
529 | token = KW_CONN_SETUP; | |
530 | } | |
531 | else if (token == KW_ALSO) | |
532 | { | |
533 | if (cfg->parse_also) | |
534 | { | |
535 | also_t *also = malloc_thing(also_t); | |
65cf07ac | 536 | |
9d53cc5d AS |
537 | also->name = clone_str(kw->value); |
538 | also->next = conn->also; | |
539 | conn->also = also; | |
997358a6 | 540 | |
9d53cc5d AS |
541 | DBG(DBG_CONTROL, |
542 | DBG_log(" also=%s", kw->value) | |
543 | ) | |
544 | } | |
545 | continue; | |
546 | } | |
65cf07ac | 547 | |
9d53cc5d AS |
548 | if (token < KW_CONN_FIRST || token > KW_CONN_LAST) |
549 | { | |
550 | plog("# unsupported keyword '%s' in conn '%s'" | |
551 | , kw->entry->name, conn_name); | |
552 | cfg->err++; | |
553 | continue; | |
554 | } | |
555 | ||
556 | if (!assign_arg(token, KW_CONN_FIRST, kw, (char *)conn, &assigned)) | |
557 | { | |
558 | plog(" bad argument value in conn '%s'", conn_name); | |
559 | cfg->err++; | |
560 | continue; | |
561 | } | |
3d7a244b | 562 | |
9d53cc5d AS |
563 | if (assigned) |
564 | continue; | |
565 | ||
566 | switch (token) | |
567 | { | |
568 | case KW_TYPE: | |
569 | conn->policy &= ~(POLICY_TUNNEL | POLICY_SHUNT_MASK); | |
570 | if (streq(kw->value, "tunnel")) | |
571 | { | |
572 | conn->policy |= POLICY_TUNNEL; | |
573 | } | |
574 | else if (streq(kw->value, "beet")) | |
575 | { | |
576 | conn->policy |= POLICY_BEET; | |
577 | } | |
578 | else if (streq(kw->value, "transport_proxy")) | |
579 | { | |
7daf5226 MW |
580 | conn->policy |= POLICY_PROXY; |
581 | } | |
9d53cc5d AS |
582 | else if (streq(kw->value, "passthrough") || streq(kw->value, "pass")) |
583 | { | |
584 | conn->policy |= POLICY_SHUNT_PASS; | |
585 | } | |
586 | else if (streq(kw->value, "drop")) | |
587 | { | |
588 | conn->policy |= POLICY_SHUNT_DROP; | |
589 | } | |
590 | else if (streq(kw->value, "reject")) | |
591 | { | |
592 | conn->policy |= POLICY_SHUNT_REJECT; | |
593 | } | |
594 | else if (strcmp(kw->value, "transport") != 0) | |
595 | { | |
596 | plog("# bad policy value: %s=%s", kw->entry->name, kw->value); | |
597 | cfg->err++; | |
598 | } | |
599 | break; | |
600 | case KW_PFS: | |
601 | KW_POLICY_FLAG("yes", "no", POLICY_PFS) | |
602 | break; | |
603 | case KW_COMPRESS: | |
604 | KW_POLICY_FLAG("yes", "no", POLICY_COMPRESS) | |
7daf5226 | 605 | break; |
9d53cc5d AS |
606 | case KW_AUTH: |
607 | KW_POLICY_FLAG("ah", "esp", POLICY_AUTHENTICATE) | |
7daf5226 | 608 | break; |
9d53cc5d AS |
609 | case KW_AUTHBY: |
610 | conn->policy &= ~(POLICY_ID_AUTH_MASK | POLICY_ENCRYPT); | |
611 | ||
f8799170 | 612 | if (!streq(kw->value, "never")) |
9d53cc5d AS |
613 | { |
614 | char *value = kw->value; | |
615 | char *second = strchr(kw->value, '|'); | |
616 | ||
617 | if (second != NULL) | |
0f806802 | 618 | { |
9d53cc5d | 619 | *second = '\0'; |
0f806802 | 620 | } |
3d7a244b | 621 | |
9d53cc5d AS |
622 | /* also handles the cases secret|rsasig and rsasig|secret */ |
623 | for (;;) | |
f27f6296 | 624 | { |
11e6d285 AS |
625 | if (streq(value, "rsa") || streq(value, "rsasig") || |
626 | streq(value, "ecdsa") || streq(value, "ecdsasig") || | |
627 | streq(value, "pubkey")) | |
9d53cc5d | 628 | { |
11e6d285 | 629 | conn->policy |= POLICY_PUBKEY | POLICY_ENCRYPT; |
9d53cc5d AS |
630 | } |
631 | else if (streq(value, "secret") || streq(value, "psk")) | |
632 | { | |
633 | conn->policy |= POLICY_PSK | POLICY_ENCRYPT; | |
634 | } | |
9d53cc5d AS |
635 | else if (streq(value, "xauthrsasig")) |
636 | { | |
637 | conn->policy |= POLICY_XAUTH_RSASIG | POLICY_ENCRYPT; | |
638 | } | |
f8799170 | 639 | else if (streq(value, "xauthpsk") || streq(value, "eap")) |
9d53cc5d AS |
640 | { |
641 | conn->policy |= POLICY_XAUTH_PSK | POLICY_ENCRYPT; | |
642 | } | |
643 | else | |
644 | { | |
645 | plog("# bad policy value: %s=%s", kw->entry->name, kw->value); | |
646 | cfg->err++; | |
3d7a244b | 647 | break; |
9d53cc5d AS |
648 | } |
649 | if (second == NULL) | |
650 | { | |
3d7a244b | 651 | break; |
9d53cc5d AS |
652 | } |
653 | value = second; | |
654 | second = NULL; /* traverse the loop no more than twice */ | |
655 | } | |
656 | } | |
657 | break; | |
658 | case KW_EAP: | |
659 | { | |
660 | char *sep; | |
7daf5226 | 661 | |
9d53cc5d AS |
662 | /* check for vendor-type format */ |
663 | sep = strchr(kw->value, '-'); | |
664 | if (sep) | |
665 | { | |
666 | *(sep++) = '\0'; | |
667 | conn->eap_type = atoi(kw->value); | |
668 | conn->eap_vendor = atoi(sep); | |
669 | if (conn->eap_type == 0 || conn->eap_vendor == 0) | |
a80521d1 | 670 | { |
9d53cc5d AS |
671 | plog("# invalid EAP type: %s=%s", kw->entry->name, kw->value); |
672 | cfg->err++; | |
3d7a244b | 673 | } |
9d53cc5d AS |
674 | break; |
675 | } | |
87799b0c AS |
676 | conn->eap_type = eap_type_from_string(kw->value); |
677 | if (conn->eap_type == 0) | |
9d53cc5d AS |
678 | { |
679 | conn->eap_type = atoi(kw->value); | |
680 | if (conn->eap_type == 0) | |
681 | { | |
682 | plog("# unknown EAP type: %s=%s", kw->entry->name, kw->value); | |
683 | cfg->err++; | |
a80521d1 | 684 | } |
9d53cc5d AS |
685 | } |
686 | break; | |
65cf07ac | 687 | } |
ee26c537 | 688 | case KW_MARK: |
26c4d010 | 689 | if (!handle_mark(kw->value, &conn->mark_in)) |
ee26c537 | 690 | { |
26c4d010 AS |
691 | cfg->err++; |
692 | break; | |
ee26c537 | 693 | } |
26c4d010 AS |
694 | conn->mark_out = conn->mark_in; |
695 | break; | |
696 | case KW_MARK_IN: | |
697 | if (!handle_mark(kw->value, &conn->mark_in)) | |
ee26c537 | 698 | { |
26c4d010 | 699 | cfg->err++; |
ee26c537 | 700 | } |
26c4d010 AS |
701 | break; |
702 | case KW_MARK_OUT: | |
703 | if (!handle_mark(kw->value, &conn->mark_out)) | |
ee26c537 | 704 | { |
26c4d010 | 705 | cfg->err++; |
ee26c537 AS |
706 | } |
707 | break; | |
6c302616 MW |
708 | case KW_TFC: |
709 | if (streq(kw->value, "%mtu")) | |
710 | { | |
711 | conn->tfc = -1; | |
712 | } | |
713 | else | |
714 | { | |
715 | char *endptr; | |
716 | ||
717 | conn->tfc = strtoul(kw->value, &endptr, 10); | |
718 | if (*endptr != '\0') | |
719 | { | |
720 | plog("# bad integer value: %s=%s", kw->entry->name, kw->value); | |
721 | cfg->err++; | |
722 | } | |
723 | } | |
724 | break; | |
9d53cc5d AS |
725 | case KW_KEYINGTRIES: |
726 | if (streq(kw->value, "%forever")) | |
727 | { | |
728 | conn->sa_keying_tries = 0; | |
729 | } | |
730 | else | |
731 | { | |
732 | char *endptr; | |
733 | ||
734 | conn->sa_keying_tries = strtoul(kw->value, &endptr, 10); | |
735 | if (*endptr != '\0') | |
736 | { | |
737 | plog("# bad integer value: %s=%s", kw->entry->name, kw->value); | |
a0d13f42 | 738 | cfg->err++; |
9d53cc5d AS |
739 | } |
740 | } | |
741 | break; | |
742 | case KW_REKEY: | |
743 | KW_POLICY_FLAG("no", "yes", POLICY_DONT_REKEY) | |
744 | break; | |
745 | case KW_REAUTH: | |
746 | KW_POLICY_FLAG("no", "yes", POLICY_DONT_REAUTH) | |
747 | break; | |
748 | case KW_MOBIKE: | |
749 | KW_POLICY_FLAG("yes", "no", POLICY_MOBIKE) | |
750 | break; | |
751 | case KW_FORCEENCAPS: | |
752 | KW_POLICY_FLAG("yes", "no", POLICY_FORCE_ENCAP) | |
753 | break; | |
754 | case KW_MODECONFIG: | |
755 | KW_POLICY_FLAG("push", "pull", POLICY_MODECFG_PUSH) | |
756 | break; | |
757 | case KW_XAUTH: | |
758 | KW_POLICY_FLAG("server", "client", POLICY_XAUTH_SERVER) | |
759 | break; | |
760 | default: | |
761 | break; | |
762 | } | |
763 | } | |
ec11518d | 764 | |
9d53cc5d AS |
765 | handle_dns_failure("left", &conn->left, cfg); |
766 | handle_dns_failure("right", &conn->right, cfg); | |
767 | handle_firewall("left", &conn->left, cfg); | |
768 | handle_firewall("right", &conn->right, cfg); | |
997358a6 MW |
769 | } |
770 | ||
771 | /* | |
772 | * initialize a conn object with the default conn | |
773 | */ | |
a4848432 | 774 | static void conn_default(char *name, starter_conn_t *conn, starter_conn_t *def) |
997358a6 | 775 | { |
9d53cc5d AS |
776 | memcpy(conn, def, sizeof(starter_conn_t)); |
777 | conn->name = clone_str(name); | |
65cf07ac | 778 | |
9d53cc5d AS |
779 | clone_args(KW_CONN_FIRST, KW_CONN_LAST, (char *)conn, (char *)def); |
780 | clone_args(KW_END_FIRST, KW_END_LAST, (char *)&conn->left, (char *)&def->left); | |
781 | clone_args(KW_END_FIRST, KW_END_LAST, (char *)&conn->right, (char *)&def->right); | |
997358a6 MW |
782 | } |
783 | ||
784 | /* | |
785 | * parse a ca section | |
786 | */ | |
a4848432 | 787 | static void load_ca(starter_ca_t *ca, kw_list_t *kw, starter_config_t *cfg) |
997358a6 | 788 | { |
9d53cc5d | 789 | char *ca_name = (ca->name == NULL)? "%default":ca->name; |
997358a6 | 790 | |
9d53cc5d AS |
791 | for ( ; kw; kw = kw->next) |
792 | { | |
793 | bool assigned = FALSE; | |
997358a6 | 794 | |
9d53cc5d | 795 | kw_token_t token = kw->entry->token; |
997358a6 | 796 | |
9d53cc5d AS |
797 | if (token == KW_AUTO) |
798 | { | |
799 | token = KW_CA_SETUP; | |
800 | } | |
801 | else if (token == KW_ALSO) | |
802 | { | |
803 | if (cfg->parse_also) | |
804 | { | |
805 | also_t *also = malloc_thing(also_t); | |
65cf07ac | 806 | |
9d53cc5d AS |
807 | also->name = clone_str(kw->value); |
808 | also->next = ca->also; | |
809 | ca->also = also; | |
65cf07ac | 810 | |
9d53cc5d AS |
811 | DBG(DBG_CONTROL, |
812 | DBG_log(" also=%s", kw->value) | |
813 | ) | |
a0d13f42 | 814 | } |
9d53cc5d AS |
815 | continue; |
816 | } | |
997358a6 | 817 | |
9d53cc5d AS |
818 | if (token < KW_CA_FIRST || token > KW_CA_LAST) |
819 | { | |
820 | plog("# unsupported keyword '%s' in ca '%s'", kw->entry->name, ca_name); | |
821 | cfg->err++; | |
822 | continue; | |
823 | } | |
997358a6 | 824 | |
9d53cc5d AS |
825 | if (!assign_arg(token, KW_CA_FIRST, kw, (char *)ca, &assigned)) |
826 | { | |
827 | plog(" bad argument value in ca '%s'", ca_name); | |
828 | cfg->err++; | |
65cf07ac | 829 | } |
9d53cc5d | 830 | } |
997358a6 | 831 | |
9d53cc5d AS |
832 | /* treat 'route' and 'start' as 'add' */ |
833 | if (ca->startup != STARTUP_NO) | |
834 | ca->startup = STARTUP_ADD; | |
997358a6 MW |
835 | } |
836 | ||
837 | /* | |
838 | * initialize a ca object with the default ca | |
839 | */ | |
a4848432 | 840 | static void ca_default(char *name, starter_ca_t *ca, starter_ca_t *def) |
997358a6 | 841 | { |
9d53cc5d AS |
842 | memcpy(ca, def, sizeof(starter_ca_t)); |
843 | ca->name = clone_str(name); | |
997358a6 | 844 | |
9d53cc5d | 845 | clone_args(KW_CA_FIRST, KW_CA_LAST, (char *)ca, (char *)def); |
997358a6 MW |
846 | } |
847 | ||
a4848432 AS |
848 | static kw_list_t* find_also_conn(const char* name, starter_conn_t *conn, |
849 | starter_config_t *cfg); | |
997358a6 | 850 | |
a4848432 AS |
851 | static void load_also_conns(starter_conn_t *conn, also_t *also, |
852 | starter_config_t *cfg) | |
997358a6 | 853 | { |
9d53cc5d AS |
854 | while (also != NULL) |
855 | { | |
856 | kw_list_t *kw = find_also_conn(also->name, conn, cfg); | |
3d7a244b | 857 | |
9d53cc5d AS |
858 | if (kw == NULL) |
859 | { | |
860 | plog(" conn '%s' cannot include '%s'", conn->name, also->name); | |
861 | } | |
862 | else | |
863 | { | |
864 | DBG(DBG_CONTROL, | |
865 | DBG_log("conn '%s' includes '%s'", conn->name, also->name) | |
866 | ) | |
867 | /* only load if no error occurred in the first round */ | |
868 | if (cfg->err == 0) | |
869 | load_conn(conn, kw, cfg); | |
65cf07ac | 870 | } |
9d53cc5d AS |
871 | also = also->next; |
872 | } | |
997358a6 MW |
873 | } |
874 | ||
875 | /* | |
876 | * find a conn included by also | |
877 | */ | |
f13a03ad | 878 | static kw_list_t* find_also_conn(const char* name, starter_conn_t *conn, |
a4848432 | 879 | starter_config_t *cfg) |
997358a6 | 880 | { |
9d53cc5d | 881 | starter_conn_t *c = cfg->conn_first; |
997358a6 | 882 | |
9d53cc5d AS |
883 | while (c != NULL) |
884 | { | |
885 | if (streq(name, c->name)) | |
65cf07ac | 886 | { |
9d53cc5d AS |
887 | if (conn->visit == c->visit) |
888 | { | |
889 | plog("# detected also loop"); | |
890 | cfg->err++; | |
891 | return NULL; | |
892 | } | |
893 | c->visit = conn->visit; | |
894 | load_also_conns(conn, c->also, cfg); | |
895 | return c->kw; | |
65cf07ac | 896 | } |
9d53cc5d AS |
897 | c = c->next; |
898 | } | |
997358a6 | 899 | |
9d53cc5d AS |
900 | plog("# also '%s' not found", name); |
901 | cfg->err++; | |
902 | return NULL; | |
997358a6 MW |
903 | } |
904 | ||
a4848432 AS |
905 | static kw_list_t* find_also_ca(const char* name, starter_ca_t *ca, |
906 | starter_config_t *cfg); | |
997358a6 | 907 | |
a4848432 | 908 | static void load_also_cas(starter_ca_t *ca, also_t *also, starter_config_t *cfg) |
997358a6 | 909 | { |
9d53cc5d AS |
910 | while (also != NULL) |
911 | { | |
912 | kw_list_t *kw = find_also_ca(also->name, ca, cfg); | |
3d7a244b | 913 | |
9d53cc5d AS |
914 | if (kw == NULL) |
915 | { | |
916 | plog(" ca '%s' cannot include '%s'", ca->name, also->name); | |
65cf07ac | 917 | } |
9d53cc5d AS |
918 | else |
919 | { | |
920 | DBG(DBG_CONTROL, | |
921 | DBG_log("ca '%s' includes '%s'", ca->name, also->name) | |
922 | ) | |
923 | /* only load if no error occurred in the first round */ | |
924 | if (cfg->err == 0) | |
925 | load_ca(ca, kw, cfg); | |
926 | } | |
927 | also = also->next; | |
928 | } | |
997358a6 MW |
929 | } |
930 | ||
931 | /* | |
932 | * find a ca included by also | |
933 | */ | |
a4848432 AS |
934 | static kw_list_t* find_also_ca(const char* name, starter_ca_t *ca, |
935 | starter_config_t *cfg) | |
997358a6 | 936 | { |
9d53cc5d | 937 | starter_ca_t *c = cfg->ca_first; |
997358a6 | 938 | |
9d53cc5d AS |
939 | while (c != NULL) |
940 | { | |
941 | if (streq(name, c->name)) | |
65cf07ac | 942 | { |
9d53cc5d AS |
943 | if (ca->visit == c->visit) |
944 | { | |
945 | plog("# detected also loop"); | |
946 | cfg->err++; | |
947 | return NULL; | |
948 | } | |
949 | c->visit = ca->visit; | |
950 | load_also_cas(ca, c->also, cfg); | |
951 | return c->kw; | |
65cf07ac | 952 | } |
9d53cc5d AS |
953 | c = c->next; |
954 | } | |
997358a6 | 955 | |
9d53cc5d AS |
956 | plog("# also '%s' not found", name); |
957 | cfg->err++; | |
958 | return NULL; | |
997358a6 MW |
959 | } |
960 | ||
3345c0a1 AS |
961 | /* |
962 | * free the memory used by also_t objects | |
963 | */ | |
a4848432 | 964 | static void free_also(also_t *head) |
3345c0a1 | 965 | { |
9d53cc5d AS |
966 | while (head != NULL) |
967 | { | |
968 | also_t *also = head; | |
969 | ||
970 | head = also->next; | |
971 | free(also->name); | |
972 | free(also); | |
973 | } | |
3345c0a1 AS |
974 | } |
975 | ||
976 | /* | |
977 | * free the memory used by a starter_conn_t object | |
978 | */ | |
a4848432 | 979 | static void confread_free_conn(starter_conn_t *conn) |
3345c0a1 | 980 | { |
9d53cc5d AS |
981 | free_args(KW_END_FIRST, KW_END_LAST, (char *)&conn->left); |
982 | free_args(KW_END_FIRST, KW_END_LAST, (char *)&conn->right); | |
983 | free_args(KW_CONN_NAME, KW_CONN_LAST, (char *)conn); | |
984 | free_also(conn->also); | |
3345c0a1 AS |
985 | } |
986 | ||
987 | /* | |
988 | * free the memory used by a starter_ca_t object | |
989 | */ | |
990 | static void | |
991 | confread_free_ca(starter_ca_t *ca) | |
992 | { | |
9d53cc5d AS |
993 | free_args(KW_CA_NAME, KW_CA_LAST, (char *)ca); |
994 | free_also(ca->also); | |
3345c0a1 AS |
995 | } |
996 | ||
997 | /* | |
998 | * free the memory used by a starter_config_t object | |
999 | */ | |
a4848432 | 1000 | void confread_free(starter_config_t *cfg) |
3345c0a1 | 1001 | { |
9d53cc5d AS |
1002 | starter_conn_t *conn = cfg->conn_first; |
1003 | starter_ca_t *ca = cfg->ca_first; | |
3345c0a1 | 1004 | |
9d53cc5d | 1005 | free_args(KW_SETUP_FIRST, KW_SETUP_LAST, (char *)cfg); |
3345c0a1 | 1006 | |
9d53cc5d | 1007 | confread_free_conn(&cfg->conn_default); |
3345c0a1 | 1008 | |
9d53cc5d AS |
1009 | while (conn != NULL) |
1010 | { | |
1011 | starter_conn_t *conn_aux = conn; | |
3345c0a1 | 1012 | |
9d53cc5d AS |
1013 | conn = conn->next; |
1014 | confread_free_conn(conn_aux); | |
1015 | free(conn_aux); | |
1016 | } | |
3345c0a1 | 1017 | |
9d53cc5d | 1018 | confread_free_ca(&cfg->ca_default); |
3345c0a1 | 1019 | |
9d53cc5d AS |
1020 | while (ca != NULL) |
1021 | { | |
1022 | starter_ca_t *ca_aux = ca; | |
3345c0a1 | 1023 | |
9d53cc5d AS |
1024 | ca = ca->next; |
1025 | confread_free_ca(ca_aux); | |
1026 | free(ca_aux); | |
1027 | } | |
997358a6 | 1028 | |
9d53cc5d | 1029 | free(cfg); |
3345c0a1 | 1030 | } |
997358a6 MW |
1031 | |
1032 | /* | |
1033 | * load and parse an IPsec configuration file | |
1034 | */ | |
a4848432 | 1035 | starter_config_t* confread_load(const char *file) |
997358a6 | 1036 | { |
9d53cc5d AS |
1037 | starter_config_t *cfg = NULL; |
1038 | config_parsed_t *cfgp; | |
1039 | section_list_t *sconn, *sca; | |
1040 | starter_conn_t *conn; | |
1041 | starter_ca_t *ca; | |
1042 | ||
1043 | u_int total_err; | |
1044 | u_int visit = 0; | |
1045 | ||
1046 | /* load IPSec configuration file */ | |
1047 | cfgp = parser_load_conf(file); | |
1048 | if (!cfgp) | |
1049 | { | |
1050 | return NULL; | |
1051 | } | |
1052 | cfg = malloc_thing(starter_config_t); | |
997358a6 | 1053 | |
9d53cc5d AS |
1054 | /* set default values */ |
1055 | default_values(cfg); | |
997358a6 | 1056 | |
9d53cc5d AS |
1057 | /* determine default route */ |
1058 | get_defaultroute(&cfg->defaultroute); | |
997358a6 | 1059 | |
9d53cc5d AS |
1060 | /* load config setup section */ |
1061 | load_setup(cfg, cfgp); | |
997358a6 | 1062 | |
9d53cc5d AS |
1063 | /* in the first round parse also statements */ |
1064 | cfg->parse_also = TRUE; | |
65cf07ac | 1065 | |
9d53cc5d AS |
1066 | /* find %default ca section */ |
1067 | for (sca = cfgp->ca_first; sca; sca = sca->next) | |
1068 | { | |
1069 | if (streq(sca->name, "%default")) | |
65cf07ac | 1070 | { |
9d53cc5d AS |
1071 | DBG(DBG_CONTROL, |
1072 | DBG_log("Loading ca %%default") | |
1073 | ) | |
1074 | load_ca(&cfg->ca_default, sca->kw, cfg); | |
65cf07ac | 1075 | } |
9d53cc5d | 1076 | } |
997358a6 | 1077 | |
9d53cc5d AS |
1078 | /* parameters defined in ca %default sections can be overloads */ |
1079 | cfg->ca_default.seen = LEMPTY; | |
997358a6 | 1080 | |
9d53cc5d AS |
1081 | /* load other ca sections */ |
1082 | for (sca = cfgp->ca_first; sca; sca = sca->next) | |
1083 | { | |
1084 | u_int previous_err; | |
3345c0a1 | 1085 | |
9d53cc5d AS |
1086 | /* skip %default ca section */ |
1087 | if (streq(sca->name, "%default")) | |
1088 | continue; | |
65cf07ac | 1089 | |
9d53cc5d AS |
1090 | DBG(DBG_CONTROL, |
1091 | DBG_log("Loading ca '%s'", sca->name) | |
1092 | ) | |
1093 | ca = malloc_thing(starter_ca_t); | |
997358a6 | 1094 | |
9d53cc5d AS |
1095 | ca_default(sca->name, ca, &cfg->ca_default); |
1096 | ca->kw = sca->kw; | |
1097 | ca->next = NULL; | |
65cf07ac | 1098 | |
9d53cc5d AS |
1099 | previous_err = cfg->err; |
1100 | load_ca(ca, ca->kw, cfg); | |
1101 | if (cfg->err > previous_err) | |
1102 | { | |
1103 | /* errors occurred - free the ca */ | |
1104 | confread_free_ca(ca); | |
1105 | cfg->non_fatal_err += cfg->err - previous_err; | |
1106 | cfg->err = previous_err; | |
3345c0a1 | 1107 | } |
9d53cc5d | 1108 | else |
65cf07ac | 1109 | { |
9d53cc5d AS |
1110 | /* success - insert the ca into the chained list */ |
1111 | if (cfg->ca_last) | |
1112 | cfg->ca_last->next = ca; | |
1113 | cfg->ca_last = ca; | |
1114 | if (!cfg->ca_first) | |
1115 | cfg->ca_first = ca; | |
1116 | } | |
1117 | } | |
997358a6 | 1118 | |
9d53cc5d AS |
1119 | for (ca = cfg->ca_first; ca; ca = ca->next) |
1120 | { | |
1121 | also_t *also = ca->also; | |
7daf5226 | 1122 | |
9d53cc5d AS |
1123 | while (also != NULL) |
1124 | { | |
1125 | kw_list_t *kw = find_also_ca(also->name, cfg->ca_first, cfg); | |
65cf07ac | 1126 | |
9d53cc5d AS |
1127 | load_ca(ca, kw, cfg); |
1128 | also = also->next; | |
3d7a244b | 1129 | } |
65cf07ac | 1130 | |
9d53cc5d AS |
1131 | if (ca->startup != STARTUP_NO) |
1132 | ca->state = STATE_TO_ADD; | |
1133 | } | |
1134 | ||
1135 | /* find %default conn sections */ | |
1136 | for (sconn = cfgp->conn_first; sconn; sconn = sconn->next) | |
1137 | { | |
1138 | if (streq(sconn->name, "%default")) | |
65cf07ac | 1139 | { |
9d53cc5d AS |
1140 | DBG(DBG_CONTROL, |
1141 | DBG_log("Loading conn %%default") | |
1142 | ) | |
1143 | load_conn(&cfg->conn_default, sconn->kw, cfg); | |
65cf07ac | 1144 | } |
9d53cc5d | 1145 | } |
997358a6 | 1146 | |
9d53cc5d AS |
1147 | /* parameter defined in conn %default sections can be overloaded */ |
1148 | cfg->conn_default.seen = LEMPTY; | |
1149 | cfg->conn_default.right.seen = LEMPTY; | |
1150 | cfg->conn_default.left.seen = LEMPTY; | |
997358a6 | 1151 | |
9d53cc5d AS |
1152 | /* load other conn sections */ |
1153 | for (sconn = cfgp->conn_first; sconn; sconn = sconn->next) | |
1154 | { | |
1155 | u_int previous_err; | |
7daf5226 | 1156 | |
9d53cc5d AS |
1157 | /* skip %default conn section */ |
1158 | if (streq(sconn->name, "%default")) | |
1159 | continue; | |
3d7a244b | 1160 | |
9d53cc5d AS |
1161 | DBG(DBG_CONTROL, |
1162 | DBG_log("Loading conn '%s'", sconn->name) | |
1163 | ) | |
1164 | conn = malloc_thing(starter_conn_t); | |
1165 | ||
1166 | conn_default(sconn->name, conn, &cfg->conn_default); | |
1167 | conn->kw = sconn->kw; | |
1168 | conn->next = NULL; | |
7daf5226 | 1169 | |
9d53cc5d AS |
1170 | previous_err = cfg->err; |
1171 | load_conn(conn, conn->kw, cfg); | |
1172 | if (cfg->err > previous_err) | |
1173 | { | |
1174 | /* error occurred - free the conn */ | |
1175 | confread_free_conn(conn); | |
1176 | cfg->non_fatal_err += cfg->err - previous_err; | |
1177 | cfg->err = previous_err; | |
3345c0a1 | 1178 | } |
9d53cc5d AS |
1179 | else |
1180 | { | |
1181 | /* success - insert the conn into the chained list */ | |
1182 | if (cfg->conn_last) | |
1183 | cfg->conn_last->next = conn; | |
1184 | cfg->conn_last = conn; | |
1185 | if (!cfg->conn_first) | |
1186 | cfg->conn_first = conn; | |
1187 | } | |
1188 | } | |
997358a6 | 1189 | |
9d53cc5d AS |
1190 | /* in the second round do not parse also statements */ |
1191 | cfg->parse_also = FALSE; | |
997358a6 | 1192 | |
9d53cc5d AS |
1193 | for (ca = cfg->ca_first; ca; ca = ca->next) |
1194 | { | |
1195 | ca->visit = ++visit; | |
1196 | load_also_cas(ca, ca->also, cfg); | |
997358a6 | 1197 | |
9d53cc5d AS |
1198 | if (ca->startup != STARTUP_NO) |
1199 | ca->state = STATE_TO_ADD; | |
1200 | } | |
997358a6 | 1201 | |
9d53cc5d AS |
1202 | for (conn = cfg->conn_first; conn; conn = conn->next) |
1203 | { | |
1204 | conn->visit = ++visit; | |
1205 | load_also_conns(conn, conn->also, cfg); | |
997358a6 | 1206 | |
9d53cc5d AS |
1207 | if (conn->startup != STARTUP_NO) |
1208 | conn->state = STATE_TO_ADD; | |
1209 | } | |
997358a6 | 1210 | |
9d53cc5d | 1211 | parser_free_conf(cfgp); |
997358a6 | 1212 | |
9d53cc5d AS |
1213 | total_err = cfg->err + cfg->non_fatal_err; |
1214 | if (total_err > 0) | |
1215 | { | |
1216 | plog("### %d parsing error%s (%d fatal) ###" | |
1217 | , total_err, (total_err > 1)?"s":"", cfg->err); | |
1218 | } | |
997358a6 | 1219 | |
9d53cc5d | 1220 | return cfg; |
997358a6 | 1221 | } |