1 /* strongSwan IPsec config file parser
2 * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms of the GNU General Public License as published by the
6 * Free Software Foundation; either version 2 of the License, or (at your
7 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 #include <sys/types.h>
25 #include "../pluto/constants.h"
26 #include "../pluto/defs.h"
27 #include "../pluto/log.h"
33 #include "interfaces.h"
35 /* strings containing a colon are interpreted as an IPv6 address */
36 #define ip_version(string) (strchr(string, '.') ? AF_INET : AF_INET6)
38 static const char ike_defaults
[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
39 static const char esp_defaults
[] = "aes128-sha1,3des-sha1";
41 static const char firewall_defaults
[] = "ipsec _updown iptables";
43 static bool daemon_exists(char *daemon
, char *path
)
46 if (stat(path
, &st
) != 0)
48 plog("Disabling %sstart option, '%s' not found", daemon
, path
);
54 static void default_values(starter_config_t
*cfg
)
59 memset(cfg
, 0, sizeof(struct starter_config
));
61 /* is there enough space for all seen flags? */
62 assert(KW_SETUP_LAST
- KW_SETUP_FIRST
<
63 sizeof(cfg
->setup
.seen
) * BITS_PER_BYTE
);
64 assert(KW_CONN_LAST
- KW_CONN_FIRST
<
65 sizeof(cfg
->conn_default
.seen
) * BITS_PER_BYTE
);
66 assert(KW_END_LAST
- KW_END_FIRST
<
67 sizeof(cfg
->conn_default
.right
.seen
) * BITS_PER_BYTE
);
68 assert(KW_CA_LAST
- KW_CA_FIRST
<
69 sizeof(cfg
->ca_default
.seen
) * BITS_PER_BYTE
);
71 cfg
->setup
.seen
= LEMPTY
;
72 cfg
->setup
.fragicmp
= TRUE
;
73 cfg
->setup
.hidetos
= TRUE
;
74 cfg
->setup
.uniqueids
= TRUE
;
75 cfg
->setup
.interfaces
= new_list("%defaultroute");
78 cfg
->setup
.charonstart
= TRUE
;
81 cfg
->setup
.plutostart
= TRUE
;
84 cfg
->conn_default
.seen
= LEMPTY
;
85 cfg
->conn_default
.startup
= STARTUP_NO
;
86 cfg
->conn_default
.state
= STATE_IGNORE
;
87 cfg
->conn_default
.policy
= POLICY_ENCRYPT
| POLICY_TUNNEL
| POLICY_PUBKEY
|
88 POLICY_PFS
| POLICY_MOBIKE
;
90 cfg
->conn_default
.ike
= clone_str(ike_defaults
);
91 cfg
->conn_default
.esp
= clone_str(esp_defaults
);
92 cfg
->conn_default
.sa_ike_life_seconds
= OAKLEY_ISAKMP_SA_LIFETIME_DEFAULT
;
93 cfg
->conn_default
.sa_ipsec_life_seconds
= PLUTO_SA_LIFE_DURATION_DEFAULT
;
94 cfg
->conn_default
.sa_rekey_margin
= SA_REPLACEMENT_MARGIN_DEFAULT
;
95 cfg
->conn_default
.sa_rekey_fuzz
= SA_REPLACEMENT_FUZZ_DEFAULT
;
96 cfg
->conn_default
.sa_keying_tries
= SA_REPLACEMENT_RETRIES_DEFAULT
;
97 cfg
->conn_default
.addr_family
= AF_INET
;
98 cfg
->conn_default
.tunnel_addr_family
= AF_INET
;
99 cfg
->conn_default
.install_policy
= TRUE
;
100 cfg
->conn_default
.dpd_delay
= 30; /* seconds */
101 cfg
->conn_default
.dpd_timeout
= 150; /* seconds */
103 cfg
->conn_default
.left
.seen
= LEMPTY
;
104 cfg
->conn_default
.right
.seen
= LEMPTY
;
106 cfg
->conn_default
.left
.sendcert
= CERT_SEND_IF_ASKED
;
107 cfg
->conn_default
.right
.sendcert
= CERT_SEND_IF_ASKED
;
109 anyaddr(AF_INET
, &cfg
->conn_default
.left
.addr
);
110 anyaddr(AF_INET
, &cfg
->conn_default
.left
.nexthop
);
111 anyaddr(AF_INET
, &cfg
->conn_default
.right
.addr
);
112 anyaddr(AF_INET
, &cfg
->conn_default
.right
.nexthop
);
113 cfg
->conn_default
.left
.ikeport
= 500;
114 cfg
->conn_default
.right
.ikeport
= 500;
116 cfg
->ca_default
.seen
= LEMPTY
;
119 #define KW_POLICY_FLAG(sy, sn, fl) \
120 if (streq(kw->value, sy)) { conn->policy |= fl; } \
121 else if (streq(kw->value, sn)) { conn->policy &= ~fl; } \
122 else { plog("# bad policy value: %s=%s", kw->entry->name, kw->value); cfg->err++; }
124 static void load_setup(starter_config_t
*cfg
, config_parsed_t
*cfgp
)
129 DBG_log("Loading config setup")
132 for (kw
= cfgp
->config_setup
; kw
; kw
= kw
->next
)
134 bool assigned
= FALSE
;
136 kw_token_t token
= kw
->entry
->token
;
138 if ((int)token
< KW_SETUP_FIRST
|| token
> KW_SETUP_LAST
)
140 plog("# unsupported keyword '%s' in config setup", kw
->entry
->name
);
145 if (!assign_arg(token
, KW_SETUP_FIRST
, kw
, (char *)cfg
, &assigned
))
147 plog(" bad argument value in config setup");
153 /* verify the executables are actually available (some distros split
154 * packages but enabled both) */
156 cfg
->setup
.charonstart
= cfg
->setup
.charonstart
&&
157 daemon_exists("charon", CHARON_CMD
);
159 cfg
->setup
.charonstart
= FALSE
;
162 cfg
->setup
.plutostart
= cfg
->setup
.plutostart
&&
163 daemon_exists("pluto", PLUTO_CMD
);
165 cfg
->setup
.plutostart
= FALSE
;
169 static void kw_end(starter_conn_t
*conn
, starter_end_t
*end
, kw_token_t token
,
170 kw_list_t
*kw
, char *conn_name
, starter_config_t
*cfg
)
173 bool assigned
= FALSE
;
174 bool has_port_wildcard
; /* set if port is %any */
176 char *name
= kw
->entry
->name
;
177 char *value
= kw
->value
;
179 if (!assign_arg(token
, KW_END_FIRST
, kw
, (char *)end
, &assigned
))
182 /* post processing of some keywords that were assigned automatically */
188 if (streq(value
, "%defaultroute"))
190 if (cfg
->defaultroute
.defined
)
192 end
->addr
= cfg
->defaultroute
.addr
;
193 end
->nexthop
= cfg
->defaultroute
.nexthop
;
195 else if (!cfg
->defaultroute
.supported
)
197 plog("%%defaultroute not supported, fallback to %%any");
201 plog("# default route not known: %s=%s", name
, value
);
205 else if (streq(value
, "%any") || streq(value
, "%any4"))
207 anyaddr(conn
->addr_family
, &end
->addr
);
209 else if (streq(value
, "%any6"))
211 conn
->addr_family
= AF_INET6
;
212 anyaddr(conn
->addr_family
, &end
->addr
);
214 else if (streq(value
, "%group"))
218 conn
->policy
|= POLICY_GROUP
| POLICY_TUNNEL
;
219 anyaddr(conn
->addr_family
, &end
->addr
);
220 anyaddr(conn
->tunnel_addr_family
, &any
);
221 end
->has_client
= TRUE
;
225 /* check for allow_any prefix */
228 end
->allow_any
= TRUE
;
231 conn
->addr_family
= ip_version(value
);
232 ugh
= ttoaddr(value
, 0, conn
->addr_family
, &end
->addr
);
235 plog("# bad addr: %s=%s [%s]", name
, value
, ugh
);
236 if (streq(ugh
, "does not look numeric and name lookup failed"))
238 end
->dns_failed
= TRUE
;
239 anyaddr(conn
->addr_family
, &end
->addr
);
246 end
->host
= clone_str(value
);
250 if ((strlen(value
) >= 6 && strncmp(value
,"vhost:",6) == 0)
251 || (strlen(value
) >= 5 && strncmp(value
,"vnet:",5) == 0))
253 /* used by pluto only */
254 end
->has_virt
= TRUE
;
262 end
->has_client
= TRUE
;
263 conn
->tunnel_addr_family
= ip_version(value
);
265 pos
= strchr(value
, ',');
270 ugh
= ttosubnet(value
, len
, ip_version(value
), &net
);
273 plog("# bad subnet: %s=%s [%s]", name
, value
, ugh
);
281 plog("# natip and sourceip cannot be defined at the same time");
286 if (streq(value
, "%modeconfig") || streq(value
, "%modecfg") ||
287 streq(value
, "%config") || streq(value
, "%cfg"))
289 /* request ip via config payload */
291 end
->sourceip
= NULL
;
292 end
->sourceip_mask
= 1;
295 { /* %poolname, strip %, serve ip requests */
297 end
->sourceip
= clone_str(value
+1);
298 end
->sourceip_mask
= 0;
308 conn
->tunnel_addr_family
= ip_version(value
);
309 pos
= strchr(value
, '/');
312 { /* CIDR notation, address pool */
313 ugh
= ttosubnet(value
, 0, conn
->tunnel_addr_family
, &net
);
316 plog("# bad subnet: %s=%s [%s]", name
, value
, ugh
);
321 end
->sourceip
= clone_str(value
);
322 end
->sourceip_mask
= atoi(pos
+ 1);
326 ugh
= ttoaddr(value
, 0, conn
->tunnel_addr_family
, &addr
);
329 plog("# bad addr: %s=%s [%s]", name
, value
, ugh
);
332 end
->sourceip_mask
= (conn
->tunnel_addr_family
== AF_INET
) ?
336 conn
->policy
|= POLICY_TUNNEL
;
339 if (end
->sendcert
== CERT_YES_SEND
)
341 end
->sendcert
= CERT_ALWAYS_SEND
;
343 else if (end
->sendcert
== CERT_NO_SEND
)
345 end
->sendcert
= CERT_NEVER_SEND
;
355 /* individual processing of keywords that were not assigned automatically */
359 if (streq(value
, "%defaultroute"))
361 if (cfg
->defaultroute
.defined
)
363 end
->nexthop
= cfg
->defaultroute
.nexthop
;
367 plog("# default route not known: %s=%s", name
, value
);
371 else if (streq(value
, "%direct"))
373 ugh
= anyaddr(conn
->addr_family
, &end
->nexthop
);
377 conn
->addr_family
= ip_version(value
);
378 ugh
= ttoaddr(value
, 0, conn
->addr_family
, &end
->nexthop
);
382 plog("# bad addr: %s=%s [%s]", name
, value
, ugh
);
386 case KW_SUBNETWITHIN
:
390 end
->has_client
= TRUE
;
391 end
->has_client_wildcard
= TRUE
;
392 conn
->tunnel_addr_family
= ip_version(value
);
394 ugh
= ttosubnet(value
, 0, ip_version(value
), &net
);
397 plog("# bad subnet: %s=%s [%s]", name
, value
, ugh
);
400 end
->subnet
= clone_str(value
);
404 ugh
= ttoprotoport(value
, 0, &end
->protocol
, &end
->port
, &has_port_wildcard
);
405 end
->has_port_wildcard
= has_port_wildcard
;
410 plog("# natip and sourceip cannot be defined at the same time");
413 if (streq(value
, "%defaultroute"))
417 if (cfg
->defaultroute
.defined
)
419 addrtot(&cfg
->defaultroute
.addr
, 0, buf
, sizeof(buf
));
420 end
->sourceip
= clone_str(buf
);
424 plog("# default route not known: %s=%s", name
, value
);
432 conn
->tunnel_addr_family
= ip_version(value
);
433 ugh
= ttoaddr(value
, 0, conn
->tunnel_addr_family
, &addr
);
436 plog("# bad addr: %s=%s [%s]", name
, value
, ugh
);
439 end
->sourceip
= clone_str(value
);
441 end
->has_natip
= TRUE
;
442 conn
->policy
|= POLICY_TUNNEL
;
450 plog(" bad argument value in conn '%s'", conn_name
);
455 * handles left|right=<FQDN> DNS resolution failure
457 static void handle_dns_failure(const char *label
, starter_end_t
*end
,
458 starter_config_t
*cfg
, starter_conn_t
*conn
)
464 plog("# fallback to %s=%%any due to '%%' prefix or %sallowany=yes",
469 /* declare an error */
476 * handles left|rightfirewall and left|rightupdown parameters
478 static void handle_firewall(const char *label
, starter_end_t
*end
,
479 starter_config_t
*cfg
)
481 if (end
->firewall
&& (end
->seen
& LELEM(KW_FIREWALL
- KW_END_FIRST
)))
483 if (end
->updown
!= NULL
)
485 plog("# cannot have both %sfirewall and %supdown", label
, label
);
490 end
->updown
= clone_str(firewall_defaults
);
491 end
->firewall
= FALSE
;
496 static bool handle_mark(char *value
, mark_t
*mark
)
500 pos
= strchr(value
, '/');
504 mark
->mask
= strtoul(pos
+1, &endptr
, 0);
507 plog("# invalid mark mask: %s", pos
+1);
513 mark
->mask
= 0xffffffff;
521 mark
->value
= strtoul(value
, &endptr
, 0);
524 plog("# invalid mark value: %s", value
);
532 * parse a conn section
534 static void load_conn(starter_conn_t
*conn
, kw_list_t
*kw
, starter_config_t
*cfg
)
536 char *conn_name
= (conn
->name
== NULL
)? "%default":conn
->name
;
538 for ( ; kw
; kw
= kw
->next
)
540 bool assigned
= FALSE
;
542 kw_token_t token
= kw
->entry
->token
;
544 if (token
>= KW_LEFT_FIRST
&& token
<= KW_LEFT_LAST
)
546 kw_end(conn
, &conn
->left
, token
- KW_LEFT_FIRST
+ KW_END_FIRST
547 , kw
, conn_name
, cfg
);
550 else if (token
>= KW_RIGHT_FIRST
&& token
<= KW_RIGHT_LAST
)
552 kw_end(conn
, &conn
->right
, token
- KW_RIGHT_FIRST
+ KW_END_FIRST
553 , kw
, conn_name
, cfg
);
557 if (token
== KW_AUTO
)
559 token
= KW_CONN_SETUP
;
561 else if (token
== KW_ALSO
)
565 also_t
*also
= malloc_thing(also_t
);
567 also
->name
= clone_str(kw
->value
);
568 also
->next
= conn
->also
;
572 DBG_log(" also=%s", kw
->value
)
578 if (token
< KW_CONN_FIRST
|| token
> KW_CONN_LAST
)
580 plog("# unsupported keyword '%s' in conn '%s'"
581 , kw
->entry
->name
, conn_name
);
586 if (!assign_arg(token
, KW_CONN_FIRST
, kw
, (char *)conn
, &assigned
))
588 plog(" bad argument value in conn '%s'", conn_name
);
599 conn
->policy
&= ~(POLICY_TUNNEL
| POLICY_SHUNT_MASK
);
600 if (streq(kw
->value
, "tunnel"))
602 conn
->policy
|= POLICY_TUNNEL
;
604 else if (streq(kw
->value
, "beet"))
606 conn
->policy
|= POLICY_BEET
;
608 else if (streq(kw
->value
, "transport_proxy"))
610 conn
->policy
|= POLICY_PROXY
;
612 else if (streq(kw
->value
, "passthrough") || streq(kw
->value
, "pass"))
614 conn
->policy
|= POLICY_SHUNT_PASS
;
616 else if (streq(kw
->value
, "drop"))
618 conn
->policy
|= POLICY_SHUNT_DROP
;
620 else if (streq(kw
->value
, "reject"))
622 conn
->policy
|= POLICY_SHUNT_REJECT
;
624 else if (strcmp(kw
->value
, "transport") != 0)
626 plog("# bad policy value: %s=%s", kw
->entry
->name
, kw
->value
);
631 KW_POLICY_FLAG("yes", "no", POLICY_PFS
)
634 KW_POLICY_FLAG("yes", "no", POLICY_COMPRESS
)
637 KW_POLICY_FLAG("ah", "esp", POLICY_AUTHENTICATE
)
640 conn
->policy
&= ~(POLICY_ID_AUTH_MASK
| POLICY_ENCRYPT
);
642 if (!streq(kw
->value
, "never"))
644 char *value
= kw
->value
;
645 char *second
= strchr(kw
->value
, '|');
652 /* also handles the cases secret|rsasig and rsasig|secret */
655 if (streq(value
, "rsa") || streq(value
, "rsasig") ||
656 streq(value
, "ecdsa") || streq(value
, "ecdsasig") ||
657 streq(value
, "pubkey"))
659 conn
->policy
|= POLICY_PUBKEY
| POLICY_ENCRYPT
;
661 else if (streq(value
, "secret") || streq(value
, "psk"))
663 conn
->policy
|= POLICY_PSK
| POLICY_ENCRYPT
;
665 else if (streq(value
, "xauthrsasig"))
667 conn
->policy
|= POLICY_XAUTH_RSASIG
| POLICY_ENCRYPT
;
669 else if (streq(value
, "xauthpsk"))
671 conn
->policy
|= POLICY_XAUTH_PSK
| POLICY_ENCRYPT
;
675 plog("# bad policy value: %s=%s", kw
->entry
->name
, kw
->value
);
684 second
= NULL
; /* traverse the loop no more than twice */
689 if (!handle_mark(kw
->value
, &conn
->mark_in
))
694 conn
->mark_out
= conn
->mark_in
;
697 if (!handle_mark(kw
->value
, &conn
->mark_in
))
703 if (!handle_mark(kw
->value
, &conn
->mark_out
))
709 if (streq(kw
->value
, "%mtu"))
717 conn
->tfc
= strtoul(kw
->value
, &endptr
, 10);
720 plog("# bad integer value: %s=%s", kw
->entry
->name
, kw
->value
);
726 if (streq(kw
->value
, "%forever"))
728 conn
->sa_keying_tries
= 0;
734 conn
->sa_keying_tries
= strtoul(kw
->value
, &endptr
, 10);
737 plog("# bad integer value: %s=%s", kw
->entry
->name
, kw
->value
);
743 KW_POLICY_FLAG("no", "yes", POLICY_DONT_REKEY
)
746 KW_POLICY_FLAG("no", "yes", POLICY_DONT_REAUTH
)
749 KW_POLICY_FLAG("yes", "no", POLICY_MOBIKE
)
752 KW_POLICY_FLAG("yes", "no", POLICY_FORCE_ENCAP
)
755 KW_POLICY_FLAG("push", "pull", POLICY_MODECFG_PUSH
)
758 KW_POLICY_FLAG("server", "client", POLICY_XAUTH_SERVER
)
765 handle_dns_failure("left", &conn
->left
, cfg
, conn
);
766 handle_dns_failure("right", &conn
->right
, cfg
, conn
);
767 handle_firewall("left", &conn
->left
, cfg
);
768 handle_firewall("right", &conn
->right
, cfg
);
772 * initialize a conn object with the default conn
774 static void conn_default(char *name
, starter_conn_t
*conn
, starter_conn_t
*def
)
776 memcpy(conn
, def
, sizeof(starter_conn_t
));
777 conn
->name
= clone_str(name
);
779 clone_args(KW_CONN_FIRST
, KW_CONN_LAST
, (char *)conn
, (char *)def
);
780 clone_args(KW_END_FIRST
, KW_END_LAST
, (char *)&conn
->left
, (char *)&def
->left
);
781 clone_args(KW_END_FIRST
, KW_END_LAST
, (char *)&conn
->right
, (char *)&def
->right
);
787 static void load_ca(starter_ca_t
*ca
, kw_list_t
*kw
, starter_config_t
*cfg
)
789 char *ca_name
= (ca
->name
== NULL
)? "%default":ca
->name
;
791 for ( ; kw
; kw
= kw
->next
)
793 bool assigned
= FALSE
;
795 kw_token_t token
= kw
->entry
->token
;
797 if (token
== KW_AUTO
)
801 else if (token
== KW_ALSO
)
805 also_t
*also
= malloc_thing(also_t
);
807 also
->name
= clone_str(kw
->value
);
808 also
->next
= ca
->also
;
812 DBG_log(" also=%s", kw
->value
)
818 if (token
< KW_CA_FIRST
|| token
> KW_CA_LAST
)
820 plog("# unsupported keyword '%s' in ca '%s'", kw
->entry
->name
, ca_name
);
825 if (!assign_arg(token
, KW_CA_FIRST
, kw
, (char *)ca
, &assigned
))
827 plog(" bad argument value in ca '%s'", ca_name
);
832 /* treat 'route' and 'start' as 'add' */
833 if (ca
->startup
!= STARTUP_NO
)
834 ca
->startup
= STARTUP_ADD
;
838 * initialize a ca object with the default ca
840 static void ca_default(char *name
, starter_ca_t
*ca
, starter_ca_t
*def
)
842 memcpy(ca
, def
, sizeof(starter_ca_t
));
843 ca
->name
= clone_str(name
);
845 clone_args(KW_CA_FIRST
, KW_CA_LAST
, (char *)ca
, (char *)def
);
848 static kw_list_t
* find_also_conn(const char* name
, starter_conn_t
*conn
,
849 starter_config_t
*cfg
);
851 static void load_also_conns(starter_conn_t
*conn
, also_t
*also
,
852 starter_config_t
*cfg
)
856 kw_list_t
*kw
= find_also_conn(also
->name
, conn
, cfg
);
860 plog(" conn '%s' cannot include '%s'", conn
->name
, also
->name
);
865 DBG_log("conn '%s' includes '%s'", conn
->name
, also
->name
)
867 /* only load if no error occurred in the first round */
869 load_conn(conn
, kw
, cfg
);
876 * find a conn included by also
878 static kw_list_t
* find_also_conn(const char* name
, starter_conn_t
*conn
,
879 starter_config_t
*cfg
)
881 starter_conn_t
*c
= cfg
->conn_first
;
885 if (streq(name
, c
->name
))
887 if (conn
->visit
== c
->visit
)
889 plog("# detected also loop");
893 c
->visit
= conn
->visit
;
894 load_also_conns(conn
, c
->also
, cfg
);
900 plog("# also '%s' not found", name
);
905 static kw_list_t
* find_also_ca(const char* name
, starter_ca_t
*ca
,
906 starter_config_t
*cfg
);
908 static void load_also_cas(starter_ca_t
*ca
, also_t
*also
, starter_config_t
*cfg
)
912 kw_list_t
*kw
= find_also_ca(also
->name
, ca
, cfg
);
916 plog(" ca '%s' cannot include '%s'", ca
->name
, also
->name
);
921 DBG_log("ca '%s' includes '%s'", ca
->name
, also
->name
)
923 /* only load if no error occurred in the first round */
925 load_ca(ca
, kw
, cfg
);
932 * find a ca included by also
934 static kw_list_t
* find_also_ca(const char* name
, starter_ca_t
*ca
,
935 starter_config_t
*cfg
)
937 starter_ca_t
*c
= cfg
->ca_first
;
941 if (streq(name
, c
->name
))
943 if (ca
->visit
== c
->visit
)
945 plog("# detected also loop");
949 c
->visit
= ca
->visit
;
950 load_also_cas(ca
, c
->also
, cfg
);
956 plog("# also '%s' not found", name
);
962 * free the memory used by also_t objects
964 static void free_also(also_t
*head
)
977 * free the memory used by a starter_conn_t object
979 static void confread_free_conn(starter_conn_t
*conn
)
981 free_args(KW_END_FIRST
, KW_END_LAST
, (char *)&conn
->left
);
982 free_args(KW_END_FIRST
, KW_END_LAST
, (char *)&conn
->right
);
983 free_args(KW_CONN_NAME
, KW_CONN_LAST
, (char *)conn
);
984 free_also(conn
->also
);
988 * free the memory used by a starter_ca_t object
991 confread_free_ca(starter_ca_t
*ca
)
993 free_args(KW_CA_NAME
, KW_CA_LAST
, (char *)ca
);
998 * free the memory used by a starter_config_t object
1000 void confread_free(starter_config_t
*cfg
)
1002 starter_conn_t
*conn
= cfg
->conn_first
;
1003 starter_ca_t
*ca
= cfg
->ca_first
;
1005 free_args(KW_SETUP_FIRST
, KW_SETUP_LAST
, (char *)cfg
);
1007 confread_free_conn(&cfg
->conn_default
);
1009 while (conn
!= NULL
)
1011 starter_conn_t
*conn_aux
= conn
;
1014 confread_free_conn(conn_aux
);
1018 confread_free_ca(&cfg
->ca_default
);
1022 starter_ca_t
*ca_aux
= ca
;
1025 confread_free_ca(ca_aux
);
1033 * load and parse an IPsec configuration file
1035 starter_config_t
* confread_load(const char *file
)
1037 starter_config_t
*cfg
= NULL
;
1038 config_parsed_t
*cfgp
;
1039 section_list_t
*sconn
, *sca
;
1040 starter_conn_t
*conn
;
1046 /* load IPSec configuration file */
1047 cfgp
= parser_load_conf(file
);
1052 cfg
= malloc_thing(starter_config_t
);
1054 /* set default values */
1055 default_values(cfg
);
1057 /* determine default route */
1058 get_defaultroute(&cfg
->defaultroute
);
1060 /* load config setup section */
1061 load_setup(cfg
, cfgp
);
1063 /* in the first round parse also statements */
1064 cfg
->parse_also
= TRUE
;
1066 /* find %default ca section */
1067 for (sca
= cfgp
->ca_first
; sca
; sca
= sca
->next
)
1069 if (streq(sca
->name
, "%default"))
1072 DBG_log("Loading ca %%default")
1074 load_ca(&cfg
->ca_default
, sca
->kw
, cfg
);
1078 /* parameters defined in ca %default sections can be overloads */
1079 cfg
->ca_default
.seen
= LEMPTY
;
1081 /* load other ca sections */
1082 for (sca
= cfgp
->ca_first
; sca
; sca
= sca
->next
)
1086 /* skip %default ca section */
1087 if (streq(sca
->name
, "%default"))
1091 DBG_log("Loading ca '%s'", sca
->name
)
1093 ca
= malloc_thing(starter_ca_t
);
1095 ca_default(sca
->name
, ca
, &cfg
->ca_default
);
1099 previous_err
= cfg
->err
;
1100 load_ca(ca
, ca
->kw
, cfg
);
1101 if (cfg
->err
> previous_err
)
1103 /* errors occurred - free the ca */
1104 confread_free_ca(ca
);
1105 cfg
->non_fatal_err
+= cfg
->err
- previous_err
;
1106 cfg
->err
= previous_err
;
1110 /* success - insert the ca into the chained list */
1112 cfg
->ca_last
->next
= ca
;
1119 for (ca
= cfg
->ca_first
; ca
; ca
= ca
->next
)
1121 also_t
*also
= ca
->also
;
1123 while (also
!= NULL
)
1125 kw_list_t
*kw
= find_also_ca(also
->name
, cfg
->ca_first
, cfg
);
1127 load_ca(ca
, kw
, cfg
);
1131 if (ca
->startup
!= STARTUP_NO
)
1132 ca
->state
= STATE_TO_ADD
;
1135 /* find %default conn sections */
1136 for (sconn
= cfgp
->conn_first
; sconn
; sconn
= sconn
->next
)
1138 if (streq(sconn
->name
, "%default"))
1141 DBG_log("Loading conn %%default")
1143 load_conn(&cfg
->conn_default
, sconn
->kw
, cfg
);
1147 /* parameter defined in conn %default sections can be overloaded */
1148 cfg
->conn_default
.seen
= LEMPTY
;
1149 cfg
->conn_default
.right
.seen
= LEMPTY
;
1150 cfg
->conn_default
.left
.seen
= LEMPTY
;
1152 /* load other conn sections */
1153 for (sconn
= cfgp
->conn_first
; sconn
; sconn
= sconn
->next
)
1157 /* skip %default conn section */
1158 if (streq(sconn
->name
, "%default"))
1162 DBG_log("Loading conn '%s'", sconn
->name
)
1164 conn
= malloc_thing(starter_conn_t
);
1166 conn_default(sconn
->name
, conn
, &cfg
->conn_default
);
1167 conn
->kw
= sconn
->kw
;
1170 previous_err
= cfg
->err
;
1171 load_conn(conn
, conn
->kw
, cfg
);
1172 if (cfg
->err
> previous_err
)
1174 /* error occurred - free the conn */
1175 confread_free_conn(conn
);
1176 cfg
->non_fatal_err
+= cfg
->err
- previous_err
;
1177 cfg
->err
= previous_err
;
1181 /* success - insert the conn into the chained list */
1183 cfg
->conn_last
->next
= conn
;
1184 cfg
->conn_last
= conn
;
1185 if (!cfg
->conn_first
)
1186 cfg
->conn_first
= conn
;
1190 /* in the second round do not parse also statements */
1191 cfg
->parse_also
= FALSE
;
1193 for (ca
= cfg
->ca_first
; ca
; ca
= ca
->next
)
1195 ca
->visit
= ++visit
;
1196 load_also_cas(ca
, ca
->also
, cfg
);
1198 if (ca
->startup
!= STARTUP_NO
)
1199 ca
->state
= STATE_TO_ADD
;
1202 for (conn
= cfg
->conn_first
; conn
; conn
= conn
->next
)
1204 conn
->visit
= ++visit
;
1205 load_also_conns(conn
, conn
->also
, cfg
);
1207 if (conn
->startup
!= STARTUP_NO
)
1208 conn
->state
= STATE_TO_ADD
;
1211 parser_free_conf(cfgp
);
1213 total_err
= cfg
->err
+ cfg
->non_fatal_err
;
1216 plog("### %d parsing error%s (%d fatal) ###"
1217 , total_err
, (total_err
> 1)?"s":"", cfg
->err
);