]> git.ipfire.org Git - people/teissler/ipfire-2.x.git/blob - src/misc-progs/openvpnctrl.c
tor: added daemon stats and little changes on styling
[people/teissler/ipfire-2.x.git] / src / misc-progs / openvpnctrl.c
1 #include <signal.h>
2 #include <stdio.h>
3 #include <string.h>
4 #include <unistd.h>
5 #include <stdlib.h>
6 #include <sys/types.h>
7 #include <arpa/inet.h>
8 #include <netinet/in.h>
9 #include <fcntl.h>
10 #include "setuid.h"
11 #include "libsmooth.h"
12
13 #define noovpndebug
14
15 // global vars
16 struct keyvalue *kv = NULL;
17 FILE *ifacefile = NULL;
18
19 char redif[STRING_SIZE];
20 char blueif[STRING_SIZE];
21 char orangeif[STRING_SIZE];
22 char enablered[STRING_SIZE] = "off";
23 char enableblue[STRING_SIZE] = "off";
24 char enableorange[STRING_SIZE] = "off";
25
26 // consts
27 char OVPNRED[STRING_SIZE] = "OVPN";
28 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
29 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
30 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
31 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
32
33 struct connection_struct {
34 char name[STRING_SIZE];
35 char type[STRING_SIZE];
36 char proto[STRING_SIZE];
37 char status[STRING_SIZE];
38 char local_subnet[STRING_SIZE];
39 char transfer_subnet[STRING_SIZE];
40 char role[STRING_SIZE];
41 int port;
42 struct connection_struct *next;
43 };
44
45 typedef struct connection_struct connection;
46
47 void exithandler(void)
48 {
49 if(kv)
50 freekeyvalues(kv);
51 if (ifacefile)
52 fclose(ifacefile);
53 }
54
55 void usage(void)
56 {
57 #ifdef ovpndebug
58 printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION);
59 #else
60 printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION);
61 #endif
62 printf("openvpnctrl <option>\n");
63 printf(" Valid options are:\n");
64 printf(" -s --start\n");
65 printf(" starts OpenVPN (implicitly creates chains and firewall rules)\n");
66 printf(" -k --kill\n");
67 printf(" kills/stops OpenVPN\n");
68 printf(" -r --restart\n");
69 printf(" restarts OpenVPN (implicitly creates chains and firewall rules)\n");
70 printf(" -sn2n --start-net-2-net\n");
71 printf(" starts all net2net connections\n");
72 printf(" you may pass a connection name to the switch to only start a specific one\n");
73 printf(" -kn2n --kill-net-2-net\n");
74 printf(" kills all net2net connections\n");
75 printf(" you may pass a connection name to the switch to only start a specific one\n");
76 printf(" -d --display\n");
77 printf(" displays OpenVPN status to syslog\n");
78 printf(" -fwr --firewall-rules\n");
79 printf(" removes current OpenVPN chains and rules and resets them according to the config\n");
80 printf(" -sdo --start-daemon-only\n");
81 printf(" starts OpenVPN daemon only\n");
82 printf(" -ccr --create-chains-and-rules\n");
83 printf(" creates chains and rules for OpenVPN\n");
84 printf(" -dcr --delete-chains-and-rules\n");
85 printf(" removes all chains for OpenVPN\n");
86 exit(1);
87 }
88
89 connection *getConnections() {
90 FILE *fp = NULL;
91
92 if (!(fp = fopen(CONFIG_ROOT "/ovpn/ovpnconfig", "r"))) {
93 fprintf(stderr, "Could not open openvpn n2n configuration file.\n");
94 exit(1);
95 }
96
97 char line[STRING_SIZE] = "";
98 char result[STRING_SIZE] = "";
99 char *resultptr;
100 int count;
101 connection *conn_first = NULL;
102 connection *conn_last = NULL;
103 connection *conn_curr;
104
105 while ((fgets(line, STRING_SIZE, fp) != NULL)) {
106 if (line[strlen(line) - 1] == '\n')
107 line[strlen(line) - 1] = '\0';
108
109 conn_curr = (connection *)malloc(sizeof(connection));
110 memset(conn_curr, 0, sizeof(connection));
111
112 if (conn_first == NULL) {
113 conn_first = conn_curr;
114 } else {
115 conn_last->next = conn_curr;
116 }
117 conn_last = conn_curr;
118
119 count = 0;
120 char *lineptr = &line;
121 while (1) {
122 if (*lineptr == NULL)
123 break;
124
125 resultptr = result;
126 while (*lineptr != NULL) {
127 if (*lineptr == ',') {
128 lineptr++;
129 break;
130 }
131 *resultptr++ = *lineptr++;
132 }
133 *resultptr = '\0';
134
135 if (count == 1) {
136 strcpy(conn_curr->status, result);
137 } else if (count == 2) {
138 strcpy(conn_curr->name, result);
139 } else if (count == 4) {
140 strcpy(conn_curr->type, result);
141 } else if (count == 7) {
142 strcpy(conn_curr->role, result);
143 } else if (count == 9) {
144 strcpy(conn_curr->local_subnet, result);
145 } else if (count == 28) {
146 strcpy(conn_curr->transfer_subnet, result);
147 } else if (count == 29) {
148 strcpy(conn_curr->proto, result);
149 } else if (count == 30) {
150 conn_curr->port = atoi(result);
151 }
152
153 count++;
154 }
155 }
156
157 fclose(fp);
158
159 return conn_first;
160 }
161
162 int readPidFile(const char *pidfile) {
163 FILE *fp = fopen(pidfile, "r");
164 if (fp == NULL) {
165 fprintf(stderr, "PID file not found: '%s'\n", pidfile);
166 exit(1);
167 }
168
169 int pid = 0;
170 fscanf(fp, "%d", &pid);
171 fclose(fp);
172
173 return pid;
174 }
175
176 void ovpnInit(void) {
177
178 // Read OpenVPN configuration
179 kv = initkeyvalues();
180 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings")) {
181 fprintf(stderr, "Cannot read ovpn settings\n");
182 exit(1);
183 }
184
185 if (!findkey(kv, "ENABLED", enablered)) {
186 fprintf(stderr, "Cannot read ENABLED\n");
187 exit(1);
188 }
189
190 if (!findkey(kv, "ENABLED_BLUE", enableblue)){
191 fprintf(stderr, "Cannot read ENABLED_BLUE\n");
192 exit(1);
193 }
194
195 if (!findkey(kv, "ENABLED_ORANGE", enableorange)){
196 fprintf(stderr, "Cannot read ENABLED_ORANGE\n");
197 exit(1);
198 }
199 freekeyvalues(kv);
200
201 // read interface settings
202
203 // details for the red int
204 memset(redif, 0, STRING_SIZE);
205 if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r")))
206 {
207 if (fgets(redif, STRING_SIZE, ifacefile))
208 {
209 if (redif[strlen(redif) - 1] == '\n')
210 redif[strlen(redif) - 1] = '\0';
211 }
212 fclose (ifacefile);
213 ifacefile = NULL;
214
215 if (!VALID_DEVICE(redif))
216 {
217 memset(redif, 0, STRING_SIZE);
218 }
219 }
220
221 kv=initkeyvalues();
222 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
223 {
224 fprintf(stderr, "Cannot read ethernet settings\n");
225 exit(1);
226 }
227
228 if (strcmp(enableblue, "on")==0){
229 if (!findkey(kv, "BLUE_DEV", blueif)){
230 fprintf(stderr, "Cannot read BLUE_DEV\n");
231 exit(1);
232 }
233 }
234 if (strcmp(enableorange, "on")==0){
235 if (!findkey(kv, "ORANGE_DEV", orangeif)){
236 fprintf(stderr, "Cannot read ORNAGE_DEV\n");
237 exit(1);
238 }
239 }
240 freekeyvalues(kv);
241 }
242
243 void executeCommand(char *command) {
244 #ifdef ovpndebug
245 printf(strncat(command, "\n", 2));
246 #endif
247 safe_system(strncat(command, " >/dev/null 2>&1", 17));
248 }
249
250 void setChainRules(char *chain, char *interface, char *protocol, char *port)
251 {
252 char str[STRING_SIZE];
253
254 sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
255 executeCommand(str);
256 sprintf(str, "/sbin/iptables -A %sINPUT -i tun+ -j ACCEPT", chain);
257 executeCommand(str);
258 sprintf(str, "/sbin/iptables -A %sFORWARD -i tun+ -j ACCEPT", chain);
259 executeCommand(str);
260 }
261
262 void flushChain(char *chain) {
263 char str[STRING_SIZE];
264
265 sprintf(str, "/sbin/iptables -F %sINPUT", chain);
266 executeCommand(str);
267 sprintf(str, "/sbin/iptables -F %sFORWARD", chain);
268 executeCommand(str);
269 safe_system(str);
270 }
271
272 void flushChainNAT(char *chain) {
273 char str[STRING_SIZE];
274
275 sprintf(str, "/sbin/iptables -t nat -F %s", chain);
276 executeCommand(str);
277 }
278
279 void deleteChainReference(char *chain) {
280 char str[STRING_SIZE];
281
282 sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
283 executeCommand(str);
284 safe_system(str);
285 sprintf(str, "/sbin/iptables -D FORWARD -j %sFORWARD", chain);
286 executeCommand(str);
287 safe_system(str);
288 }
289
290 void deleteChain(char *chain) {
291 char str[STRING_SIZE];
292
293 sprintf(str, "/sbin/iptables -X %sINPUT", chain);
294 executeCommand(str);
295 sprintf(str, "/sbin/iptables -X %sFORWARD", chain);
296 executeCommand(str);
297 }
298
299 void deleteAllChains(void) {
300 // not an elegant solution, but to avoid timing problems with undeleted chain references
301 deleteChainReference(OVPNRED);
302 deleteChainReference(OVPNBLUE);
303 deleteChainReference(OVPNORANGE);
304 flushChain(OVPNRED);
305 flushChain(OVPNBLUE);
306 flushChain(OVPNORANGE);
307 deleteChain(OVPNRED);
308 deleteChain(OVPNBLUE);
309 deleteChain(OVPNORANGE);
310 }
311
312 void createChainReference(char *chain) {
313 char str[STRING_SIZE];
314 sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
315 executeCommand(str);
316 sprintf(str, "/sbin/iptables -I FORWARD %s -j %sFORWARD", "12", chain);
317 executeCommand(str);
318 }
319
320 void createChain(char *chain) {
321 char str[STRING_SIZE];
322 sprintf(str, "/sbin/iptables -N %sINPUT", chain);
323 executeCommand(str);
324 sprintf(str, "/sbin/iptables -N %sFORWARD", chain);
325 executeCommand(str);
326 }
327
328 void createAllChains(void) {
329 // create chain and chain references
330 if (!strcmp(enableorange, "on")) {
331 if (strlen(orangeif)) {
332 createChain(OVPNORANGE);
333 createChainReference(OVPNORANGE);
334 } else {
335 fprintf(stderr, "OpenVPN enabled on orange but no orange interface found\n");
336 //exit(1);
337 }
338 }
339
340 if (!strcmp(enableblue, "on")) {
341 if (strlen(blueif)) {
342 createChain(OVPNBLUE);
343 createChainReference(OVPNBLUE);
344 } else {
345 fprintf(stderr, "OpenVPN enabled on blue but no blue interface found\n");
346 //exit(1);
347 }
348 }
349
350 if (!strcmp(enablered, "on")) {
351 if (strlen(redif)) {
352 createChain(OVPNRED);
353 createChainReference(OVPNRED);
354 } else {
355 fprintf(stderr, "OpenVPN enabled on red but no red interface found\n");
356 //exit(1);
357 }
358 }
359 }
360
361 char* calcTransferNetAddress(const connection* conn) {
362 char *subnetmask = strdup(conn->transfer_subnet);
363 char *address = strsep(&subnetmask, "/");
364
365 if ((address == NULL) || (subnetmask == NULL)) {
366 goto ERROR;
367 }
368
369 in_addr_t _address = inet_addr(address);
370 in_addr_t _subnetmask = inet_addr(subnetmask);
371 _address &= _subnetmask;
372
373 if (strcmp(conn->role, "server") == 0) {
374 _address += 1 << 24;
375 } else if (strcmp(conn->role, "client") == 0) {
376 _address += 2 << 24;
377 } else {
378 goto ERROR;
379 }
380
381 struct in_addr address_info;
382 address_info.s_addr = _address;
383
384 return inet_ntoa(address_info);
385
386 ERROR:
387 fprintf(stderr, "Could not determine transfer net address: %s\n", conn->name);
388
389 free(address);
390 return NULL;
391 }
392
393 char* getLocalSubnetAddress(const connection* conn) {
394 kv = initkeyvalues();
395 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
396 fprintf(stderr, "Cannot read ethernet settings\n");
397 exit(1);
398 }
399
400 const char *zones[] = {"GREEN", "BLUE", "ORANGE", NULL};
401 char *zone = NULL;
402
403 // Get net address of the local openvpn subnet.
404 char *subnetmask = strdup(conn->local_subnet);
405 char *address = strsep(&subnetmask, "/");
406
407 if ((address == NULL) || (subnetmask == NULL)) {
408 goto ERROR;
409 }
410
411 in_addr_t _address = inet_addr(address);
412 in_addr_t _subnetmask = inet_addr(subnetmask);
413
414 in_addr_t _netaddr = (_address & _subnetmask);
415 in_addr_t _broadcast = (_address | ~_subnetmask);
416
417 char zone_address_key[STRING_SIZE];
418 char zone_address[STRING_SIZE];
419 in_addr_t zone_addr;
420
421 int i = 0;
422 while (zones[i]) {
423 zone = zones[i++];
424 snprintf(zone_address_key, STRING_SIZE, "%s_ADDRESS", zone);
425
426 if (!findkey(kv, zone_address_key, zone_address))
427 continue;
428
429 zone_addr = inet_addr(zone_address);
430 if ((zone_addr > _netaddr) && (zone_addr < _broadcast)) {
431 freekeyvalues(kv);
432
433 return strdup(zone_address);
434 }
435 }
436
437 ERROR:
438 fprintf(stderr, "Could not determine local subnet address: %s\n", conn->name);
439
440 freekeyvalues(kv);
441 return NULL;
442 }
443
444 void setFirewallRules(void) {
445 char protocol[STRING_SIZE] = "";
446 char dport[STRING_SIZE] = "";
447 char dovpnip[STRING_SIZE] = "";
448
449 kv = initkeyvalues();
450 if (!readkeyvalues(kv, CONFIG_ROOT "/ovpn/settings"))
451 {
452 fprintf(stderr, "Cannot read ovpn settings\n");
453 exit(1);
454 }
455
456 /* we got one device, so lets proceed further */
457 if (!findkey(kv, "DDEST_PORT", dport)){
458 fprintf(stderr, "Cannot read DDEST_PORT\n");
459 exit(1);
460 }
461
462 if (!findkey(kv, "DPROTOCOL", protocol)){
463 fprintf(stderr, "Cannot read DPROTOCOL\n");
464 exit(1);
465 }
466
467 if (!findkey(kv, "VPN_IP", dovpnip)){
468 fprintf(stderr, "Cannot read VPN_IP\n");
469 // exit(1); step further as we don't need an ip
470 }
471 freekeyvalues(kv);
472
473 // Flush all chains.
474 flushChain(OVPNRED);
475 flushChain(OVPNBLUE);
476 flushChain(OVPNORANGE);
477 flushChainNAT(OVPNNAT);
478
479 // set firewall rules
480 if (!strcmp(enablered, "on") && strlen(redif))
481 setChainRules(OVPNRED, redif, protocol, dport);
482 if (!strcmp(enableblue, "on") && strlen(blueif))
483 setChainRules(OVPNBLUE, blueif, protocol, dport);
484 if (!strcmp(enableorange, "on") && strlen(orangeif))
485 setChainRules(OVPNORANGE, orangeif, protocol, dport);
486
487 // read connection configuration
488 connection *conn = getConnections();
489
490 // set firewall rules for n2n connections
491 char command[STRING_SIZE];
492 char *local_subnet_address = NULL;
493 char *transfer_subnet_address = NULL;
494 while (conn != NULL) {
495 if (strcmp(conn->type, "net") == 0) {
496 sprintf(command, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %d -j ACCEPT",
497 OVPNRED, redif, conn->proto, conn->port);
498 executeCommand(command);
499
500 local_subnet_address = getLocalSubnetAddress(conn);
501 transfer_subnet_address = calcTransferNetAddress(conn);
502
503 if ((local_subnet_address) && (transfer_subnet_address)) {
504 snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
505 OVPNNAT, transfer_subnet_address, local_subnet_address);
506 executeCommand(command);
507 }
508 }
509
510 conn = conn->next;
511 }
512 }
513
514 void stopDaemon(void) {
515 char command[STRING_SIZE];
516
517 int pid = readPidFile("/var/run/openvpn.pid");
518 if (!pid > 0) {
519 exit(1);
520 }
521
522 fprintf(stderr, "Killing PID %d.\n", pid);
523 kill(pid, SIGTERM);
524
525 snprintf(command, STRING_SIZE - 1, "/bin/rm -f /var/run/openvpn.pid");
526 executeCommand(command);
527 }
528
529 void startDaemon(void) {
530 char command[STRING_SIZE];
531
532 if (!((strcmp(enablered, "on")==0) || (strcmp(enableblue, "on")==0) || (strcmp(enableorange, "on")==0))){
533 fprintf(stderr, "OpenVPN is not enabled on any interface\n");
534 exit(1);
535 } else {
536 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
537 executeCommand(command);
538 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config /var/ipfire/ovpn/server.conf");
539 executeCommand(command);
540 }
541 }
542
543 int startNet2Net(char *name) {
544 connection *conn = NULL;
545 connection *conn_iter;
546
547 conn_iter = getConnections();
548
549 while (conn_iter) {
550 if ((strcmp(conn_iter->type, "net") == 0) && (strcmp(conn_iter->name, name) == 0)) {
551 conn = conn_iter;
552 break;
553 }
554 conn_iter = conn_iter->next;
555 }
556
557 if (conn == NULL) {
558 fprintf(stderr, "Connection not found.\n");
559 return 1;
560 }
561
562 if (strcmp(conn->status, "on") != 0) {
563 fprintf(stderr, "Connection '%s' is not enabled.\n", conn->name);
564 return 1;
565 }
566
567 fprintf(stderr, "Starting connection %s...\n", conn->name);
568
569 char configfile[STRING_SIZE];
570 snprintf(configfile, STRING_SIZE - 1, CONFIG_ROOT "/ovpn/n2nconf/%s/%s.conf",
571 conn->name, conn->name);
572
573 FILE *fp = fopen(configfile, "r");
574 if (fp == NULL) {
575 fprintf(stderr, "Could not find configuration file for connection '%s' at '%s'.\n",
576 conn->name, configfile);
577 return 2;
578 }
579 fclose(fp);
580
581 // Make sure all firewall rules are up to date.
582 setFirewallRules();
583
584 char command[STRING_SIZE];
585 snprintf(command, STRING_SIZE-1, "/sbin/modprobe tun");
586 executeCommand(command);
587 snprintf(command, STRING_SIZE-1, "/usr/sbin/openvpn --config %s", configfile);
588 executeCommand(command);
589
590 return 0;
591 }
592
593 int killNet2Net(char *name) {
594 connection *conn = NULL;
595 connection *conn_iter;
596
597 conn_iter = getConnections();
598
599 while (conn_iter) {
600 if (strcmp(conn_iter->name, name) == 0) {
601 conn = conn_iter;
602 break;
603 }
604 conn_iter = conn_iter->next;
605 }
606
607 if (conn == NULL) {
608 fprintf(stderr, "Connection not found.\n");
609 return 1;
610 }
611
612 char pidfile[STRING_SIZE];
613 snprintf(pidfile, STRING_SIZE - 1, "/var/run/%sn2n.pid", conn->name);
614
615 int pid = readPidFile(pidfile);
616 if (!pid > 0) {
617 fprintf(stderr, "Could not read pid file of connection %s.", conn->name);
618 return 1;
619 }
620
621 fprintf(stderr, "Killing connection %s (PID %d)...\n", conn->name, pid);
622 kill(pid, SIGTERM);
623
624 char command[STRING_SIZE];
625 snprintf(command, STRING_SIZE - 1, "/bin/rm -f %s", pidfile);
626 executeCommand(command);
627
628 return 0;
629 }
630
631 void startAllNet2Net() {
632 int exitcode = 0, _exitcode = 0;
633
634 connection *conn = getConnections();
635
636 while(conn) {
637 /* Skip all connections that are not of type "net" or disabled. */
638 if ((strcmp(conn->type, "net") != 0) || (strcmp(conn->status, "on") != 0)) {
639 conn = conn->next;
640 continue;
641 }
642
643 _exitcode = startNet2Net(conn->name);
644 conn = conn->next;
645
646 if (_exitcode > exitcode) {
647 exitcode = _exitcode;
648 }
649 }
650
651 exit(exitcode);
652 }
653
654 void killAllNet2Net() {
655 int exitcode = 0, _exitcode = 0;
656
657 connection *conn = getConnections();
658
659 while(conn) {
660 /* Skip all connections that are not of type "net". */
661 if (strcmp(conn->type, "net") != 0) {
662 conn = conn->next;
663 continue;
664 }
665
666 _exitcode = killNet2Net(conn->name);
667 conn = conn->next;
668
669 if (_exitcode > exitcode) {
670 exitcode = _exitcode;
671 }
672 }
673
674 exit(exitcode);
675 }
676
677 void displayopenvpn(void) {
678 char command[STRING_SIZE];
679
680 snprintf(command, STRING_SIZE - 1, "/bin/killall -sSIGUSR2 openvpn");
681 executeCommand(command);
682 }
683
684 int main(int argc, char *argv[]) {
685 if (!(initsetuid()))
686 exit(1);
687 if(argc < 2)
688 usage();
689
690 if(argc == 3) {
691 ovpnInit();
692
693 if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
694 startNet2Net(argv[2]);
695 return 0;
696 }
697 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
698 killNet2Net(argv[2]);
699 return 0;
700 } else {
701 usage();
702 return 1;
703 }
704 }
705 else if(argc == 2) {
706 if( (strcmp(argv[1], "-k") == 0) || (strcmp(argv[1], "--kill") == 0) ) {
707 stopDaemon();
708 return 0;
709 }
710 else if( (strcmp(argv[1], "-d") == 0) || (strcmp(argv[1], "--display") == 0) ) {
711 displayopenvpn();
712 return 0;
713 }
714 else if( (strcmp(argv[1], "-dcr") == 0) || (strcmp(argv[1], "--delete-chains-and-rules") == 0) ) {
715 deleteAllChains();
716 return 0;
717 }
718 else {
719 ovpnInit();
720
721 if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
722 deleteAllChains();
723 createAllChains();
724 setFirewallRules();
725 startDaemon();
726 return 0;
727 }
728 else if( (strcmp(argv[1], "-sn2n") == 0) || (strcmp(argv[1], "--start-net-2-net") == 0) ) {
729 startAllNet2Net();
730 return 0;
731 }
732 else if( (strcmp(argv[1], "-kn2n") == 0) || (strcmp(argv[1], "--kill-net-2-net") == 0) ) {
733 killAllNet2Net();
734 return 0;
735 }
736 else if( (strcmp(argv[1], "-sdo") == 0) || (strcmp(argv[1], "--start-daemon-only") == 0) ) {
737 startDaemon();
738 return 0;
739 }
740 else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
741 stopDaemon();
742 deleteAllChains();
743 createAllChains();
744 setFirewallRules();
745 startDaemon();
746 return 0;
747 }
748 else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
749 deleteAllChains();
750 createAllChains();
751 setFirewallRules();
752 return 0;
753 }
754 else if( (strcmp(argv[1], "-ccr") == 0) || (strcmp(argv[1], "--create-chains-and-rules") == 0) ) {
755 createAllChains();
756 setFirewallRules();
757 return 0;
758 }
759 else {
760 usage();
761 return 0;
762 }
763 }
764 }
765 else {
766 usage();
767 return 0;
768 }
769 return 0;
770 }
771